Function at 0x40de40
Capabilities:
Reference http user-agent string
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5436c1
mov eax, dword fs:[0]
push eax
sub esp, 0x138
mov eax, dword [0x5960c0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
push 0
push 0
push 0
push 0
push 1
push 0
lea ecx, [ebp - 0x144]
mov dword [ebp - 4], 1
call fcn.00434be3
mov byte [ebp - 4], 2
mov dword [ebp - 0x120], 0x1bb
call fcn.004219a6
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40deb7
push 0x80004005
call fcn.00402210
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x118], eax
mov byte [ebp - 4], 3
call fcn.004219a6
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40dee7
push 0x80004005
call fcn.00402210
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x11c], eax
lea ecx, [ebp - 0x120]
push ecx
lea edx, [ebp - 0x11c]
push edx
lea eax, [ebp - 0x118]
push eax
mov ebx, 4
mov byte [ebp - 4], bl
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x128]
push ecx
push edx
mov dword [ebp - 0x128], 0
call fcn.004351b3
mov eax, dword [ebp - 0x120]
mov ecx, dword [ebp - 0x118]
push 0
push 0
push eax
push 0x800000
push ecx
lea ecx, [ebp - 0x144]
call fcn.00435629
mov edx, dword [ebp - 0x11c]
push 0xa4803000
push 0
push 0
push 1
push 0
push edx
push 1
mov ecx, eax
call fcn.004356e3
push 0xffffffffffffffff
mov esi, eax
push 0x10000000
push str.User_Agent:_Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko___t_tChrome_89.0.4389.90_Safari_537.36
mov ecx, esi
call fcn.00434517
push 0xffffffffffffffff
push 0x10000000
push str.Accept:_text_html_application_xhtmlxml_application_xml_q0.9_image_avif_image_webp_image_apng__t_t__q0.8_application_signed_exchange_vb3_q0.9
mov ecx, esi
call fcn.00434517
push 0xffffffffffffffff
push 0x10000000
push str.Accept_Encoding:_gzip__deflate__br
mov ecx, esi
call fcn.00434517
push 0xffffffffffffffff
push 0x10000000
push str.Accept_Language:_zh_CN_zh_q0.9_en_q0.8
mov ecx, esi
call fcn.00434517
push 0
push 0
push 0
push 0
mov ecx, esi
mov byte [ebp - 4], 5
call fcn.00435161
push 0
push 0x80
push 2
push 0
push 3
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 0xc]
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0x2800
mov dword [ebp - 0x124], eax
call fcn.0041afeb
push 0x2800
mov edi, eax
push 0
push edi
call fcn.00521f30
add esp, 0x10
mov edx, dword [esi]
mov eax, dword [edx + 0x38]
push 0x400
push edi
mov ecx, esi
call eax
mov edx, dword [ebp - 0x124]
push 0
lea ecx, [ebp - 0x12c]
push ecx
mov ebx, eax
push ebx
push edi
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test ebx, ebx
jne 0x40e011
mov eax, dword [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x11c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40e071
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x118]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40e097
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x144]
mov byte [ebp - 4], 1
call fcn.004352d9
mov byte [ebp - 4], 0
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40e0c9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40e0ef
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, 1
jmp 0x40e15b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0051ac68
mov esp, ebp
pop ebp
ret