Function at 0x100096a6
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3394
call fcn.10017cc0
mov eax, dword [0x10027120]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x3230], eax
mov eax, dword [ebp + 0xc]
xor esi, esi
push edi
mov dword [ebp - 0x3238], eax
mov dword [ebp - 0x324c], ecx
cmp eax, esi
je 0x10009a02
cmp word [eax], si
je 0x10009a02
xor eax, eax
push 7
mov word [ebp - 0x24], ax
pop ecx
lea edi, [ebp - 0x22]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
push 0x1fe
mov word [ebp - 0x228], ax
lea eax, [ebp - 0x226]
push esi
push eax
call fcn.1000f470
add esp, 0xc
xor eax, eax
push 0xffe
mov word [ebp - 0x3228], ax
lea eax, [ebp - 0x3226]
push esi
push eax
call fcn.1000f470
mov edi, dword [ebp - 0x3238]
add esp, 0xc
lea eax, [ebp - 0x3228]
push eax
lea eax, [ebp - 0x323c]
push eax
lea eax, [ebp - 0x228]
push eax
lea ebx, [ebp - 0x24]
mov dword [ebp - 0x323c], esi
call fcn.10009e28
add esp, 0xc
test eax, eax
je 0x10009a02
push 5
mov eax, ebx
push str.https
push eax
call fcn.1000de30
add esp, 0xc
mov ebx, eax
neg ebx
sbb ebx, ebx
inc ebx
cmp word [ebp - 0x323c], si
jne 0x100097a4
mov eax, ebx
neg eax
sbb eax, eax
and eax, 0x16b
add eax, 0x50
movzx eax, ax
mov dword [ebp - 0x323c], eax
lea eax, [ebp - 0x3241]
push eax
call fcn.10009e81
mov eax, dword [ebp - 0x324c]
mov dword [ebp - 0x3238], esi
mov dword [ebp - 0x3240], eax
cmp eax, esi
jne 0x100097e3
push esi
push esi
push esi
push esi
push str.Mozilla_5.0__Windows_NT_6.1__WOW64__Trident_7.0__rv:11.0__like_Gecko
call dword [0x1002959c]
mov dword [ebp - 0x3240], eax
cmp eax, esi
je 0x100099fa
push esi
push esi
push 3
push esi
push esi
push dword [ebp - 0x323c]
lea eax, [ebp - 0x228]
push eax
push dword [ebp - 0x3240]
call dword [0x100295a0]
mov dword [ebp - 0x3248], eax
cmp eax, esi
je 0x100099e6
push 0x13c
lea eax, [ebp - 0x338c]
push esi
push eax
call fcn.1000f470
mov edi, dword [ebp - 0x3230]
mov eax, dword [edi + 0x30]
add esp, 0xc
mov dword [ebp - 0x3390], 0x100231c4
mov ecx, 0x840c0300
cmp eax, esi
je 0x10009843
or ecx, eax
mov eax, dword [edi + 0x34]
cmp eax, esi
je 0x1000984e
not eax
and ecx, eax
mov eax, ebx
neg eax
sbb eax, eax
push esi
and eax, 0x803000
or eax, ecx
push eax
lea eax, [ebp - 0x3390]
push eax
push esi
push esi
lea eax, [ebp - 0x3228]
push eax
push str.POST
push dword [ebp - 0x3248]
call dword [0x100295a4]
mov dword [ebp - 0x3234], eax
cmp eax, esi
je 0x100099da
cmp ebx, esi
je 0x100098d6
push 4
pop ebx
lea ecx, [ebp - 0x3230]
push ecx
lea ecx, [ebp - 0x322c]
push ecx
push 0x1f
push eax
mov dword [ebp - 0x322c], esi
mov dword [ebp - 0x3230], ebx
call dword [0x100295a8]
or dword [ebp - 0x322c], 0x3100
push ebx
lea eax, [ebp - 0x322c]
push eax
push 0x1f
push dword [ebp - 0x3234]
call dword [0x100295ac]
mov eax, dword [edi + 8]
mov ebx, dword [edi]
mov dword [ebp - 0x322c], eax
mov eax, dword [edi + 4]
mov dword [ebp - 0x3230], eax
cmp ebx, esi
je 0x100098fc
cmp word [ebx], si
je 0x100098fc
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
jmp 0x100098fe
xor eax, eax
push dword [ebp - 0x3230]
push dword [ebp - 0x322c]
push eax
push ebx
mov ebx, dword [ebp - 0x3234]
push ebx
call dword [0x100295b0]
test eax, eax
je 0x100099d3
push esi
lea eax, [ebp - 0x322c]
push eax
lea eax, [ebp - 0x3234]
push eax
push 0x20000013
push ebx
mov dword [ebp - 0x3238], 1
mov dword [ebp - 0x3234], esi
mov dword [ebp - 0x322c], 4
call dword [0x100295b4]
test eax, eax
je 0x100099d3
mov eax, dword [ebp - 0x3234]
push esi
mov dword [edi + 0xc], eax
lea eax, [ebp - 0x322c]
push eax
lea eax, [ebp - 0x3230]
push eax
push 0x20000005
push ebx
mov dword [ebp - 0x3230], esi
call dword [0x100295b4]
test eax, eax
je 0x10009991
mov eax, dword [ebp - 0x3230]
mov dword [edi + 0x10], eax
lea eax, [ebp - 0x322c]
push eax
push 0x2000
lea eax, [ebp - 0x2228]
push eax
push ebx
call dword [0x100295b8]
test eax, eax
je 0x100099d3
cmp dword [ebp - 0x322c], esi
je 0x100099d3
push dword [ebp - 0x322c]
lea ecx, [edi + 0x14]
lea eax, [ebp - 0x2228]
call fcn.1000a25f
cmp dword [ebp - 0x322c], esi
jne 0x10009991
push ebx
call dword [0x100295bc]
push dword [ebp - 0x3248]
call dword [0x100295bc]
cmp dword [ebp - 0x324c], esi
jne 0x100099fa
push dword [ebp - 0x3240]
call dword [0x100295bc]
mov eax, dword [ebp - 0x3238]
jmp 0x10009a04
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000d755
leave
ret