Function at 0x409ba0
Capabilities:
Reference http user-agent string

Disassembly:
sub esp, 0x850
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x868]
mov ecx, 0x183
xor eax, eax
mov byte [esp + 0x160], 0
rep stosd dword es:[edi], eax
mov ecx, 7
lea edi, [esp + 0x41]
mov byte [esp + 0x40], al
mov byte [esp + 0x60], 0x2f
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x161]
mov byte [esp + 0x61], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x62]
mov dword [esp + 0x1c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0x864]
xor ecx, ecx
mov eax, dword [eax]
mov dl, byte [eax]
test dl, dl
je 0x409c35
cmp dl, 0x3f
je 0x409c29
mov dl, byte [ecx + eax + 1]
inc ecx
test dl, dl
jne 0x409c19
jmp 0x409c35
test ecx, ecx
jl 0x409c35
lea ecx, [eax + ecx + 1]
mov dword [esp + 0x1c], ecx
lea edx, [esp + 0x61]
lea ecx, [esp + 0x160]
push edx
lea edx, [esp + 0x44]
push ecx
push edx
push str._:_____
push eax
mov dword [esp + 0x2c], 0x50
call fcn.00409a90
add esp, 0x14
lea esi, [esp + 0x40]
mov eax, str.http
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x409c8e
test cl, cl
je 0x409c8a
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x409c8e
add eax, 2
add esi, 2
test cl, cl
jne 0x409c66
xor eax, eax
jmp 0x409c93
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40a551
mov cl, byte [esp + 0x160]
test cl, cl
je 0x409d66
cmp cl, 0x3a
je 0x409cc0
mov cl, byte [esp + eax + 0x161]
inc eax
test cl, cl
jne 0x409caa
jmp 0x409d66
test eax, eax
jl 0x409d66
mov byte [esp + eax + 0x160], 0
lea ebp, [esp + eax + 0x161]
mov al, byte [0x422cd0]
xor edi, edi
xor ecx, ecx
mov ebx, 1
test al, al
je 0x409cfb
mov dl, byte [ebp]
cmp dl, al
je 0x409cfe
mov al, byte [ecx + 0x422cd1]
inc ecx
test al, al
jne 0x409cec
or ecx, 0xffffffff
inc ecx
test ecx, ecx
je 0x409d07
inc ebp
or ebx, 0xffffffff
mov al, byte [ebp]
test al, al
je 0x409d5f
mov dl, byte [str.0123456789abcdef]
cmp al, 0x41
jl 0x409d23
cmp al, 0x5a
jg 0x409d23
mov ecx, 1
jmp 0x409d25
xor ecx, ecx
xor esi, esi
test dl, dl
je 0x409d41
shl cl, 5
or cl, al
mov al, dl
cmp cl, al
je 0x409d44
mov al, byte [esi + 0x422cbd]
inc esi
test al, al
jne 0x409d32
or esi, 0xffffffff
lea eax, [esi + 1]
test eax, eax
je 0x409d5f
cmp eax, 0xa
jg 0x409d5f
lea ecx, [edi + edi*4]
inc ebp
lea edi, [eax + ecx*2 - 1]
mov al, byte [ebp]
test al, al
jne 0x409d14
imul ebx, edi
mov dword [esp + 0x18], ebx
mov ebp, dword [esp + 0x86c]
cmp ebp, 0xffffffff
jne 0x409d96
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x160]
push edx
push eax
call fcn.0040a640
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x86c], ebp
je 0x40a551
mov ebx, dword [esp + 0x864]
mov edi, dword [ebx + 4]
test edi, edi
je 0x409db7
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov eax, str.POST
test ecx, ecx
jne 0x409dbc
mov eax, 0x422e8c
lea ecx, [esp + 0x60]
push ecx
push eax
push str._s__s_HTTP_1.0_r_n
push 0
push ebp
call fcn.0040a740
add esp, 0x14
push 0
push 0
push str.User_Agent:_Mozilla_5.0__compatible__Viper_4.0__r_n
push ebp
call fcn.0040a6e0
lea edx, [esp + 0x160]
push edx
push str.Host:__s_r_n
push 0
push ebp
call fcn.0040a740
mov eax, dword [ebx + 4]
mov esi, dword [ebx + 8]
add esp, 0x10
test eax, eax
je 0x409e68
mov dl, byte [eax]
mov ecx, eax
test dl, dl
je 0x409e13
mov dl, byte [ecx + 1]
inc ecx
test dl, dl
jne 0x409e0b
sub ecx, eax
mov edi, ecx
je 0x409e68
test esi, esi
je 0x409e22
cmp byte [esi], 0
jne 0x409e27
mov esi, str.application_x_www_form_urlencoded
push 0
push 0
push str.Content_Length:
push ebp
call fcn.0040a6e0
push edi
lea eax, [esp + 0x24]
push 0x422cd4
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [esp + 0x20]
push 0
push 0
push ecx
push ebp
call fcn.0040a6e0
push 0
push 0
push 0x422cd8
push ebp
call fcn.0040a6e0
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x409ea0
cmp byte [eax], 0
je 0x409ea0
push 0
push 0
push str.Cookie:
push ebp
call fcn.0040a6e0
mov edx, dword [ebx + 0xc]
push 0
push 0
push edx
push ebp
call fcn.0040a6e0
push 0
push 0
push 0x422cd8
push ebp
call fcn.0040a6e0
test esi, esi
je 0x409eba
cmp byte [esi], 0
je 0x409eba
push esi
push str.Content_Type:__s_r_n
push 0
push ebp
call fcn.0040a740
add esp, 0x10
mov eax, dword [ebx + 0x1c]
test eax, eax
je 0x409ed0
push 0
push 0
push str.Connection:_Keep_Alive_r_n
push ebp
call fcn.0040a6e0
push 0
push 0
push 0x422cd8
push ebp
call fcn.0040a6e0
mov ecx, dword [ebx + 4]
test ecx, ecx
je 0x409ef1
push 0
push 0
push ecx
push ebp
call fcn.0040a6e0
test eax, eax
jl 0x40a54b
lea eax, [esp + 0x260]
push 0x400
push eax
push ebp
call fcn.0040a810
cmp eax, 0xffffffff
je 0x40a551
mov ecx, dword [esp + 0x868]
lea edx, [esp + 0x260]
push ecx
push str.HTTP_.__
push edx
call fcn.00409a90
add esp, 0xc
test eax, eax
je 0x40a551
mov ebp, dword [esp + 0x86c]
lea eax, [esp + 0x260]
push 0x400
push eax
push ebp
call fcn.0040a810
cmp eax, 0xffffffff
je 0x40a54b
test eax, eax
je 0x40a43d
mov al, byte [esp + 0x260]
lea ebp, [esp + 0x260]
test al, al
mov dword [esp + 0x14], ebp
je 0x409f8b
cmp al, 0x3a
je 0x409f87
mov al, byte [ebp + 1]
inc ebp
test al, al
jne 0x409f7b
mov dword [esp + 0x14], ebp
cmp byte [ebp], 0x3a
jne 0x409f9a
mov byte [ebp], 0
inc ebp
mov dword [esp + 0x14], ebp
cmp byte [ebp], 0x20
jne 0x409fa5
inc ebp
mov dword [esp + 0x14], ebp
lea edx, [esp + 0x260]
lea ecx, [esp + 0x260]
test edx, edx
mov esi, str.Connection
mov dword [esp + 0x10], ecx
je 0x40a022
mov eax, esi
test eax, eax
je 0x40a022
mov ecx, dword [esp + 0x10]
mov bl, byte [ecx]
cmp bl, 0x41
jl 0x409fdd
cmp bl, 0x5a
jg 0x409fdd
mov ecx, 1
jmp 0x409fdf
xor ecx, ecx
mov dl, byte [esi]
cmp dl, 0x41
jl 0x409ff2
cmp dl, 0x5a
jg 0x409ff2
mov eax, 1
jmp 0x409ff4
xor eax, eax
shl al, 5
movsx edi, al
movsx eax, dl
shl cl, 5
or edi, eax
movsx eax, cl
movsx ecx, bl
or eax, ecx
sub eax, edi
jne 0x40a02e
mov edi, dword [esp + 0x10]
inc edi
test bl, bl
mov dword [esp + 0x10], edi
je 0x40a02e
inc esi
test dl, dl
jne 0x409fc6
jmp 0x40a02e
lea eax, [esp + 0x260]
sub eax, str.Connection
test eax, eax
jne 0x40a0ba
test ebp, ebp
mov esi, str.Keep_Alive
mov edi, ebp
je 0x40a097
mov edx, esi
test edx, edx
je 0x40a097
mov bl, byte [edi]
cmp bl, 0x41
jl 0x40a05a
cmp bl, 0x5a
jg 0x40a05a
mov ecx, 1
jmp 0x40a05c
xor ecx, ecx
mov dl, byte [esi]
cmp dl, 0x41
jl 0x40a06f
cmp dl, 0x5a
jg 0x40a06f
mov eax, 1
jmp 0x40a071
xor eax, eax
shl al, 5
movsx ebp, al
movsx eax, dl
shl cl, 5
or ebp, eax
movsx eax, cl
movsx ecx, bl
or eax, ecx
sub eax, ebp
jne 0x40a09f
inc edi
test bl, bl
je 0x40a09f
inc esi
test dl, dl
jne 0x40a047
jmp 0x40a09f
sub ebp, str.Keep_Alive
mov eax, ebp
test eax, eax
jne 0x409f3a
mov edx, dword [esp + 0x868]
mov dword [edx + 8], 1
jmp 0x409f3a
lea ecx, [esp + 0x260]
lea eax, [esp + 0x260]
test ecx, ecx
mov esi, str.Content_Length
mov dword [esp + 0x10], eax
je 0x40a137
mov edx, esi
test edx, edx
je 0x40a137
mov eax, dword [esp + 0x10]
mov bl, byte [eax]
cmp bl, 0x41
jl 0x40a0f2
cmp bl, 0x5a
jg 0x40a0f2
mov ecx, 1
jmp 0x40a0f4
xor ecx, ecx
mov dl, byte [esi]
cmp dl, 0x41
jl 0x40a107
cmp dl, 0x5a
jg 0x40a107
mov eax, 1
jmp 0x40a109
xor eax, eax
shl al, 5
movsx edi, al
movsx eax, dl
shl cl, 5
or edi, eax
movsx eax, cl
movsx ecx, bl
or eax, ecx
sub eax, edi
jne 0x40a143
mov edi, dword [esp + 0x10]
inc edi
test bl, bl
mov dword [esp + 0x10], edi
je 0x40a143
inc esi
test dl, dl
jne 0x40a0db
jmp 0x40a143
lea eax, [esp + 0x260]
sub eax, str.Content_Length
test eax, eax
jne 0x40a1e7
mov al, byte [0x422cd0]
xor edi, edi
xor ecx, ecx
mov ebx, 1
test al, al
je 0x40a16f
mov dl, byte [ebp]
cmp dl, al
je 0x40a172
mov al, byte [ecx + 0x422cd1]
inc ecx
test al, al
jne 0x40a160
or ecx, 0xffffffff
inc ecx
test ecx, ecx
je 0x40a17b
inc ebp
or ebx, 0xffffffff
mov al, byte [ebp]
test al, al
je 0x40a1d3
mov dl, byte [str.0123456789abcdef]
cmp al, 0x41
jl 0x40a197
cmp al, 0x5a
jg 0x40a197
mov ecx, 1
jmp 0x40a199
xor ecx, ecx
xor esi, esi
test dl, dl
je 0x40a1b5
shl cl, 5
or cl, al
mov al, dl
cmp cl, al
je 0x40a1b8
mov al, byte [esi + 0x422cbd]
inc esi
test al, al
jne 0x40a1a6
or esi, 0xffffffff
lea eax, [esi + 1]
test eax, eax
je 0x40a1d3
cmp eax, 0xa
jg 0x40a1d3
lea ecx, [edi + edi*4]
inc ebp
lea edi, [eax + ecx*2 - 1]
mov al, byte [ebp]
test al, al
jne 0x40a188
imul ebx, edi
mov edx, dword [esp + 0x868]
mov eax, ebx
mov dword [edx + 4], eax
jmp 0x409f3a
lea eax, [esp + 0x260]
mov esi, str.Set_Cookie
test eax, eax
lea edi, [esp + 0x260]
je 0x40a258
mov ecx, esi
test ecx, ecx
je 0x40a258
mov bl, byte [edi]
cmp bl, 0x41
jl 0x40a217
cmp bl, 0x5a
jg 0x40a217
mov ecx, 1
jmp 0x40a219
xor ecx, ecx
mov dl, byte [esi]
cmp dl, 0x41
jl 0x40a22c
cmp dl, 0x5a
jg 0x40a22c
mov eax, 1
jmp 0x40a22e
xor eax, eax
shl al, 5
movsx ebp, al
movsx eax, dl
shl cl, 5
or ebp, eax
movsx eax, cl
movsx ecx, bl
or eax, ecx
sub eax, ebp
jne 0x40a252
inc edi
test bl, bl
je 0x40a252
inc esi
test dl, dl
jne 0x40a204
mov ebp, dword [esp + 0x14]
jmp 0x40a264
lea eax, [esp + 0x260]
sub eax, str.Set_Cookie
mov edx, dword [esp + 0x868]
test eax, eax
jne 0x40a2a9
add edx, 0xc
test ebp, ebp
jne 0x40a27e
mov byte [edx], 0
jmp 0x409f3a
mov esi, 1
mov eax, ebp
sub esi, ebp
sub edx, ebp
lea ecx, [esi + eax]
cmp ecx, 0x400
jae 0x40a299
movsx ecx, byte [eax]
jmp 0x40a29b
xor ecx, ecx
test cl, cl
mov byte [edx + eax], cl
je 0x409f3a
inc eax
jmp 0x40a289
mov eax, dword [edx]
cmp eax, 0xce
jne 0x40a369
lea eax, [esp + 0x260]
mov esi, str.Content_Range
test eax, eax
lea edi, [esp + 0x260]
je 0x40a327
mov ecx, esi
test ecx, ecx
je 0x40a327
mov bl, byte [edi]
cmp bl, 0x41
jl 0x40a2e6
cmp bl, 0x5a
jg 0x40a2e6
mov ecx, 1
jmp 0x40a2e8
xor ecx, ecx
mov dl, byte [esi]
cmp dl, 0x41
jl 0x40a2fb
cmp dl, 0x5a
jg 0x40a2fb
mov eax, 1
jmp 0x40a2fd
xor eax, eax
shl al, 5
movsx ebp, al
movsx eax, dl
shl cl, 5
or ebp, eax
movsx eax, cl
movsx ecx, bl
or eax, ecx
sub eax, ebp
jne 0x40a321
inc edi
test bl, bl
je 0x40a321
inc esi
test dl, dl
jne 0x40a2d3
mov ebp, dword [esp + 0x14]
jmp 0x40a333
lea eax, [esp + 0x260]
sub eax, str.Content_Range
test eax, eax
jne 0x409f3a
mov eax, dword [esp + 0x868]
lea edx, [eax + 0x414]
lea ecx, [eax + 0x410]
push edx
add eax, 0x40c
push ecx
push eax
push str.bytes___
push ebp
call fcn.00409a90
add esp, 0x14
jmp 0x409f3a
cmp eax, 0x12e
jne 0x409f3a
lea edx, [esp + 0x260]
mov esi, str.Location
test edx, edx
lea edi, [esp + 0x260]
je 0x40a3e5
mov eax, esi
test eax, eax
je 0x40a3e5
mov bl, byte [edi]
cmp bl, 0x41
jl 0x40a3a4
cmp bl, 0x5a
jg 0x40a3a4
mov ecx, 1
jmp 0x40a3a6
xor ecx, ecx
mov dl, byte [esi]
cmp dl, 0x41
jl 0x40a3b9
cmp dl, 0x5a
jg 0x40a3b9
mov eax, 1
jmp 0x40a3bb
xor eax, eax
shl al, 5
movsx ebp, al
movsx eax, dl
shl cl, 5
or ebp, eax
movsx eax, cl
movsx ecx, bl
or eax, ecx
sub eax, ebp
jne 0x40a3df
inc edi
test bl, bl
je 0x40a3df
inc esi
test dl, dl
jne 0x40a391
mov ebp, dword [esp + 0x14]
jmp 0x40a3f1
lea eax, [esp + 0x260]
sub eax, str.Location
test eax, eax
jne 0x409f3a
mov edx, dword [esp + 0x868]
add edx, 0x40c
test ebp, ebp
jne 0x40a412
mov byte [edx], 0
jmp 0x409f3a
mov esi, 1
mov eax, ebp
sub esi, ebp
sub edx, ebp
lea ecx, [eax + esi]
cmp ecx, 0x200
jae 0x40a42d
movsx ecx, byte [eax]
jmp 0x40a42f
xor ecx, ecx
test cl, cl
mov byte [edx + eax], cl
je 0x409f3a
inc eax
jmp 0x40a41d
mov esi, dword [esp + 0x868]
cmp dword [esi], 0x12e
jne 0x40a5c9
push ebp
call sub.WSOCK32.dll_closesocket
or ebp, 0xffffffff
mov ecx, dword [esp + 0x864]
mov dword [esp + 0x86c], ebp
mov eax, dword [ecx + 0x18]
test eax, eax
je 0x40a551
cmp byte [esi + 0x410], 0x3a
je 0x40a561
cmp byte [esi + 0x411], 0x3a
je 0x40a561
mov edx, esi
mov al, byte [edx + 0x40c]
lea ebx, [edx + 0x40c]
cmp al, 0x2f
jne 0x40a4b6
push 0x100
lea eax, [esp + 0x64]
push ebx
push eax
call fcn.00419c60
add esp, 0xc
jmp 0x409d6d
lea edi, [esp + 0x60]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, ecx
je 0x40a4d2
cmp byte [esp + esi + 0x60], 0x2f
je 0x40a4d9
dec esi
jne 0x40a4c8
cmp byte [esp + esi + 0x60], 0x2f
jne 0x40a4da
inc esi
mov ecx, 0x100
lea edx, [esp + esi + 0x60]
sub ecx, esi
push ecx
push ebx
push edx
call fcn.00419c60
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x1c]
not ecx
dec ecx
test eax, eax
je 0x409d6d
mov al, byte [ebx]
xor edx, edx
test al, al
je 0x40a527
cmp al, 0x3f
je 0x40a51f
mov al, byte [edx + ebx + 1]
inc edx
test al, al
jne 0x40a510
jmp 0x40a527
test edx, edx
jge 0x409d6d
mov edx, dword [esp + 0x1c]
mov eax, 0x100
sub eax, ecx
add ecx, esi
sub eax, esi
dec edx
push eax
lea eax, [esp + ecx + 0x64]
push edx
push eax
call fcn.00419c60
add esp, 0xc
jmp 0x409d6d
push ebp
call sub.WSOCK32.dll_closesocket
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x850
ret 0xc
mov eax, dword [ecx + 0x18]
mov edx, dword [ecx + 0x1c]
mov dword [esp + 0x38], eax
dec eax
mov dword [ecx + 0x18], eax
mov eax, dword [ecx + 0x14]
mov dword [esp + 0x3c], edx
mov edx, dword [ecx + 0x10]
mov dword [esp + 0x34], eax
mov eax, dword [ecx + 8]
mov ecx, dword [ecx + 4]
mov dword [esp + 0x30], edx
mov dword [esp + 0x28], eax
lea edx, [esi + 0x40c]
lea eax, [esp + 0x660]
push edx
push eax
mov dword [esp + 0x2c], ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0xffffffffffffffff
lea edx, [esp + 0x24]
lea ecx, [esp + 0x664]
push esi
push edx
mov dword [esp + 0x2c], ecx
call fcn.00409ba0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x850
ret 0xc
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x850
ret 0xc