Function at 0x401db7
Capabilities:
Reference http user-agent string

Disassembly:
mov eax, 0x406bb7
call fcn.004067f0
sub esp, 0x14
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, 0x40a50c
lea ecx, [ebp - 0x14]
push esi
call fcn.0040366d
mov byte [ebp - 4], 3
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea eax, [ebp + 0xc]
push eax
push esi
call fcn.00404dfd
pop ecx
test al, al
pop ecx
jne 0x402187
cmp dword [ebp + 0x10], ebx
je 0x402187
push dword [ebp + 0x10]
lea eax, [ebp + 0xc]
push ecx
mov ecx, esp
mov dword [ebp + 0x10], esp
push eax
call fcn.004035a3
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 3
push eax
call fcn.00401621
add esp, 0xc
cmp al, bl
je 0x40215d
lea eax, [ebp + 0x14]
push eax
lea eax, [ebp - 0x1c]
push str.GET__
push eax
call fcn.00404d60
push str._HTTP_1.0_r_n
push eax
lea eax, [ebp + 0x10]
mov byte [ebp - 4], 5
push eax
call fcn.00404cd1
add esp, 0x18
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 7
call fcn.0040355b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x20]
push str.Host:
push eax
call fcn.00404d60
mov esi, 0x40a344
mov byte [ebp - 4], 8
push esi
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00404cd1
add esp, 0x18
push eax
lea ecx, [ebp + 0x10]
mov byte [ebp - 4], 9
call fcn.004049b7
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 8
call fcn.0040355b
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 7
call fcn.0040355b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push str.Connection:_close_r_n
lea ecx, [ebp + 0x10]
call fcn.00404971
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push str.Cache_Control:_max_age0_r_n
lea ecx, [ebp + 0x10]
call fcn.00404971
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push str.User_Agent:_Mozilla_5.0__Windows_NT_5.1__AppleWebKit_536.11__KHTML__like_Gecko__Chrome_20.0.1132.57_Safari_536.11_r_n
lea ecx, [ebp + 0x10]
call fcn.00404971
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push str.Accept:_text_html_application_xhtmlxml_application_xml_q0.9___q0.8._r_n
lea ecx, [ebp + 0x10]
call fcn.00404971
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push str.Accept_Encoding:_gzip_deflate_sdch_r_n
lea ecx, [ebp + 0x10]
call fcn.00404971
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push str.Accept_Language:_zh_CN_zh_q0.8_r_n
lea ecx, [ebp + 0x10]
call fcn.00404971
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push str.Accept_Charset:_GBK_utf_8_q0.7__q0.3_r_n
lea ecx, [ebp + 0x10]
call fcn.00404971
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push str.Cookie:_BAIDUID4551B3A873310A1D9F1D8F3847FADA52:FG1__SSUDBTSP1373544335__SSUDBVkcDN6OGJ2RWV5Y3h6a1JYYUlsTklyOGZIdnpCdnpWUXotclo2WmV_eVBMQVpTQVFBQUFBJCQAAAAAAAAAAAEAAACBxKA1AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAI_f3lGPn95RWF__BAIDU_WISE_UIDbd_1374714064_282__Hm_lvt_9f14aaa038bbba8b12ec2a4a3e51d2541381926448__BDSVRTM1__H_PS_PSSID3635_1436_2981_3545_3448_r_n
lea ecx, [ebp + 0x10]
call fcn.00404971
nop
nop
nop
nop
nop
nop
push esi
lea ecx, [ebp + 0x10]
call fcn.00404971
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea ecx, [ebp + 0x10]
call fcn.0040318b
push eax
lea ecx, [ebp + 0x10]
call fcn.004031b5
push eax
push dword [ebp - 0x18]
call fcn.00401a59
add esp, 0xc
test al, al
je 0x402123
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 0x20]
push dword [ebp - 0x18]
push eax
call fcn.00401be2
add esp, 0xc
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0xa
call fcn.0040376f
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 7
call fcn.0040355b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, 0x3e8
lea ecx, [ebp - 0x1c]
call fcn.00403169
mov byte [ebp - 4], 0xb
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push ebx
push esi
push esi
lea ecx, [ebp - 0x1c]
call fcn.00404b89
push eax
push dword [ebp - 0x18]
call fcn.00402d07
add esp, 0x10
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
je 0x402117
cmp eax, 0xffffffff
je 0x402117
push eax
lea ecx, [ebp - 0x1c]
call fcn.00404b3a
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x14]
push eax
call fcn.004049b7
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 7
call fcn.0040355b
jmp 0x402070
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 7
call fcn.0040355b
nop
nop
nop
nop
nop
nop
push dword [ebp - 0x18]
call fcn.004027f2
pop ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea ecx, [ebp + 0x10]
mov byte [ebp - 4], 3
call fcn.0040355b
jmp 0x40216e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
call fcn.004035a3
mov dword [ebp - 0x10], 1
jmp 0x402199
nop
nop
mov ecx, dword [ebp + 8]
push esi
call fcn.0040366d
mov dword [ebp - 0x10], 1
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.0040355b
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.0040355b
lea ecx, [ebp + 0x14]
mov byte [ebp - 4], bl
call fcn.0040355b
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret