Function at 0x4630c0
Capabilities:
Contain obfuscated stackstrings
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4b4f27
mov eax, dword fs:[0]
push eax
sub esp, 0x2f0
mov eax, dword [0x4ff1a0]
xor eax, esp
mov dword [esp + 0x2e8], eax
push ebx
push esi
push edi
mov eax, dword [0x4ff1a0]
xor eax, esp
push eax
lea eax, [esp + 0x300]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov edi, edx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ecx
cmp dword [edi + 0x10], ebx
jne 0x463123
or eax, 0xffffffff
jmp 0x4639fe
push 1
push 2
lea ecx, [esp + 0x2c]
call fcn.00413cc0
mov dword [esp + 0x308], ebx
lea edx, [esp + 0xf4]
push esi
push edx
call fcn.00418a60
add esp, 8
mov byte [esp + 0x308], 1
mov ecx, dword [esp + 0x1c]
push ecx
push ecx
push str.__verb_is:
push ecx
push eax
push ecx
push str.__body_is:
push ecx
push edi
push ecx
lea edx, [esp + 0x4c]
push str.url_is:
push edx
call fcn.00416b90
add esp, 0xc
push eax
call fcn.00416df0
add esp, 0xc
push eax
call fcn.00416b90
add esp, 0xc
push eax
call fcn.00416df0
add esp, 0xc
push eax
call fcn.00416b90
add esp, 0xc
push eax
call fcn.00416df0
add esp, 8
mov byte [esp + 0x308], bl
cmp dword [esp + 0x108], 8
jb 0x4631c6
mov eax, dword [esp + 0xf4]
push eax
call fcn.00490458
add esp, 4
xor ecx, ecx
push 0x17
mov word [esp + 0xf8], cx
push str.CReportMgr::SendRequest
lea ecx, [esp + 0xe0]
mov dword [esp + 0x110], 7
mov dword [esp + 0x10c], ebx
mov dword [esp + 0xf4], 0xf
mov dword [esp + 0xf0], ebx
mov byte [esp + 0xe0], bl
call fcn.0040ebe0
mov byte [esp + 0x308], 2
push 0xd
push str.ReportMgr.cpp
lea ecx, [esp + 0xfc]
mov dword [esp + 0x110], 0xf
mov dword [esp + 0x10c], ebx
mov byte [esp + 0xfc], bl
call fcn.0040ebe0
mov byte [esp + 0x308], 3
lea edx, [esp + 0xbc]
push edx
lea ecx, [esp + 0x28]
call fcn.00413de0
mov byte [esp + 0x308], 4
push eax
lea eax, [esp + 0xdc]
push eax
push 0x45
lea ecx, [esp + 0x100]
push ecx
push 2
call fcn.004144e0
mov ecx, eax
call fcn.0042e360
mov byte [esp + 0x308], 3
cmp dword [esp + 0xd0], 8
jb 0x4632a6
mov edx, dword [esp + 0xbc]
push edx
call fcn.00490458
add esp, 4
xor eax, eax
mov dword [esp + 0xd0], 7
mov dword [esp + 0xcc], ebx
mov word [esp + 0xbc], ax
mov byte [esp + 0x308], 2
cmp dword [esp + 0x108], 0x10
jb 0x4632e4
mov ecx, dword [esp + 0xf4]
push ecx
call fcn.00490458
add esp, 4
mov dword [esp + 0x108], 0xf
mov dword [esp + 0x104], ebx
mov byte [esp + 0xf4], bl
mov byte [esp + 0x308], bl
cmp dword [esp + 0xec], 0x10
jb 0x46331e
mov edx, dword [esp + 0xd8]
push edx
call fcn.00490458
add esp, 4
mov dword [esp + 0xec], 0xf
mov dword [esp + 0xe8], ebx
mov byte [esp + 0xd8], bl
mov dword [esp + 0x308], 0xffffffff
lea ecx, [esp + 0x24]
call fcn.00412cc0
lea eax, [esp + 0x12c]
push eax
mov edx, edi
call fcn.00433400
mov dword [esp + 0x308], 5
push 0x10
mov edi, 0xf
push str.Content_Length:
lea ecx, [esp + 0x118]
mov dword [esp + 0x12c], edi
mov dword [esp + 0x128], ebx
mov byte [esp + 0x118], bl
call fcn.0040ebe0
mov byte [esp + 0x308], 6
mov eax, dword [esi + 0x10]
push eax
lea ecx, [esp + 0xc0]
push ecx
call fcn.00419880
add esp, 8
mov byte [esp + 0x308], 7
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x11c]
call fcn.00409780
push 0x31
push str._r_nContent_Type:_application_x_www_form_urlencoded
mov ecx, eax
call fcn.00409870
push 0x1a
push str._r_nReferrer:_www.client.com
mov ecx, eax
call fcn.00409870
mov byte [esp + 0x308], 6
cmp dword [esp + 0xd0], 0x10
jb 0x463404
mov edx, dword [esp + 0xbc]
push edx
call fcn.00490458
add esp, 4
lea eax, [esp + 0x110]
push eax
lea ecx, [esp + 0xc0]
push ecx
mov dword [esp + 0xd8], edi
mov dword [esp + 0xd4], ebx
mov byte [esp + 0xc4], bl
call fcn.00418a60
add esp, 8
mov byte [esp + 0x308], 8
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x21c]
call fcn.0040f1f0
mov byte [esp + 0x308], 6
cmp dword [esp + 0xd0], 8
jb 0x46346b
mov edx, dword [esp + 0xbc]
push edx
call fcn.00490458
add esp, 4
xor eax, eax
mov word [esp + 0xbc], ax
mov eax, dword [esi + 0x10]
mov edi, 7
mov dword [esp + 0xd0], edi
mov dword [esp + 0xcc], ebx
cmp eax, ebx
je 0x4635d9
cmp dword [esi + 0x14], 0x10
jb 0x46349b
mov esi, dword [esi]
mov ebx, esi
mov edi, eax
lea esi, [esp + 0x12c]
call fcn.00434ad0
test al, al
jne 0x4635d2
push 1
push 2
lea ecx, [esp + 0x2c]
call fcn.00413cc0
mov byte [esp + 0x308], 0xd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ecx
lea ecx, [esp + 0x2c]
push str.SetAdditionalDataToSend_FAILED._GetLastError_is:
push ecx
call fcn.00416b90
add esp, 0xc
push eax
call fcn.004135f0
push str.CReportMgr::SendRequest
lea ecx, [esp + 0xdc]
call fcn.0040ece0
mov bl, 0xe
mov byte [esp + 0x308], bl
push str.ReportMgr.cpp
lea ecx, [esp + 0xc0]
call fcn.0040ece0
mov byte [esp + 0x308], 0xf
lea edx, [esp + 0xf4]
push edx
lea ecx, [esp + 0x28]
call fcn.00413de0
mov byte [esp + 0x308], 0x10
push eax
lea eax, [esp + 0xdc]
push eax
push 0x59
lea ecx, [esp + 0xc8]
push ecx
push 0
call fcn.004144e0
mov ecx, eax
call fcn.0042e360
mov byte [esp + 0x308], 0xf
lea ecx, [esp + 0xf4]
call fcn.0040f320
mov byte [esp + 0x308], bl
lea ecx, [esp + 0xbc]
call fcn.0040f350
mov byte [esp + 0x308], 0xd
lea ecx, [esp + 0xd8]
call fcn.0040f350
mov byte [esp + 0x308], 6
lea ecx, [esp + 0x24]
call fcn.00412cc0
mov byte [esp + 0x308], 5
lea ecx, [esp + 0x110]
call fcn.0040f350
mov dword [esp + 0x308], 0xffffffff
mov edx, esi
push edx
call fcn.00433660
mov eax, 0xfffffffd
jmp 0x4639fe
xor ebx, ebx
mov edi, 7
push 0x5a
xor eax, eax
push str.Mozilla_4.0__compatible__MSIE_8.0__Windows_NT_5.1__Trident_4.0__GTB7.4__FX1.0___like_Gecko
lea ecx, [esp + 0xe0]
mov dword [esp + 0xf4], edi
mov dword [esp + 0xf0], ebx
mov word [esp + 0xe0], ax
call fcn.0040e680
mov byte [esp + 0x308], 0x11
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0xe0]
push ecx
lea ecx, [esp + 0x274]
call fcn.0040f1f0
mov byte [esp + 0x308], 6
cmp dword [esp + 0xec], 8
jb 0x463645
mov edx, dword [esp + 0xd8]
push edx
call fcn.00490458
add esp, 4
xor eax, eax
push 0x4e25a0
lea ecx, [esp + 0xc0]
mov dword [esp + 0xf0], edi
mov dword [esp + 0xec], ebx
mov word [esp + 0xdc], ax
call fcn.0040e770
mov byte [esp + 0x308], 0x16
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0xc4]
push ecx
lea ecx, [esp + 0x1b0]
mov dword [esp + 0x24], 1
call fcn.0040f1f0
mov dword [esp + 0x308], 6
mov eax, 1
mov dword [esp + 0x18], eax
and eax, 0xfffffffe
lea ecx, [esp + 0xbc]
mov dword [esp + 0x18], eax
call fcn.0040f320
mov ecx, dword [esp + 0x1c]
lea edi, [esp + 0x12c]
call fcn.00433980
test al, al
jne 0x4637f2
push 1
push 2
lea ecx, [esp + 0x2c]
call fcn.00413cc0
mov byte [esp + 0x308], 0x1b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ecx
lea edx, [esp + 0x2c]
push str.SendHttpRequest_FAILED._GetLastError_is:
push edx
call fcn.00416b90
add esp, 0xc
push eax
call fcn.004135f0
push str.CReportMgr::SendRequest
lea ecx, [esp + 0xdc]
call fcn.0040ece0
mov byte [esp + 0x308], 0x1c
push str.ReportMgr.cpp
lea ecx, [esp + 0xc0]
call fcn.0040ece0
mov byte [esp + 0x308], 0x1d
lea eax, [esp + 0xf4]
push eax
lea ecx, [esp + 0x28]
call fcn.00413de0
mov byte [esp + 0x308], 0x1e
push eax
lea ecx, [esp + 0xdc]
push ecx
push 0x6e
lea edx, [esp + 0xc8]
push edx
push ebx
call fcn.004144e0
mov ecx, eax
call fcn.0042e360
mov byte [esp + 0x308], 0x1d
lea ecx, [esp + 0xf4]
call fcn.0040f320
mov byte [esp + 0x308], 0x1c
lea ecx, [esp + 0xbc]
call fcn.0040f350
mov byte [esp + 0x308], 0x1b
lea ecx, [esp + 0xd8]
call fcn.0040f350
mov byte [esp + 0x308], 6
lea ecx, [esp + 0x24]
call fcn.00412cc0
mov byte [esp + 0x308], 5
lea ecx, [esp + 0x110]
call fcn.0040f350
mov dword [esp + 0x308], 0xffffffff
mov eax, edi
push eax
call fcn.00433660
mov eax, 0xfffffffa
jmp 0x4639fe
lea ecx, [esp + 0xbc]
push ecx
lea ecx, [esp + 0x130]
call fcn.00434b20
mov byte [esp + 0x308], 0x1f
mov edx, dword [eax + 0x10]
push 3
push 0x4e7004
push edx
push ebx
mov ecx, eax
call fcn.0041fbd0
test eax, eax
setne byte [esp + 0x17]
mov byte [esp + 0x308], 6
lea ecx, [esp + 0xbc]
call fcn.0040f320
cmp byte [esp + 0x17], bl
je 0x463993
push 1
push 2
lea ecx, [esp + 0x2c]
call fcn.00413cc0
mov byte [esp + 0x308], 0x20
lea eax, [esp + 0xbc]
push eax
lea ecx, [esp + 0x130]
call fcn.00434b20
mov byte [esp + 0x308], 0x21
push eax
push ecx
lea ecx, [esp + 0x2c]
push str.GetResponseStatusCode_FAILED__GetResponseStatusCode_is:
push ecx
call fcn.00416b90
add esp, 0xc
push eax
call fcn.00416df0
add esp, 8
mov byte [esp + 0x308], 0x20
lea ecx, [esp + 0xbc]
call fcn.0040f320
push str.CReportMgr::SendRequest
lea ecx, [esp + 0xdc]
call fcn.0040ece0
mov byte [esp + 0x308], 0x22
push str.ReportMgr.cpp
lea ecx, [esp + 0xc0]
call fcn.0040ece0
mov byte [esp + 0x308], 0x23
lea edx, [esp + 0xf4]
push edx
lea ecx, [esp + 0x28]
call fcn.00413de0
mov byte [esp + 0x308], 0x24
push eax
lea eax, [esp + 0xdc]
push eax
push 0x75
lea ecx, [esp + 0xc8]
push ecx
push ebx
call fcn.004144e0
mov ecx, eax
call fcn.0042e360
mov byte [esp + 0x308], 0x23
lea ecx, [esp + 0xf4]
call fcn.0040f320
mov byte [esp + 0x308], 0x22
lea ecx, [esp + 0xbc]
call fcn.0040f350
mov byte [esp + 0x308], 0x20
lea ecx, [esp + 0xd8]
call fcn.0040f350
mov byte [esp + 0x308], 6
lea ecx, [esp + 0x24]
call fcn.00412cc0
mov byte [esp + 0x308], 5
lea ecx, [esp + 0x110]
call fcn.0040f350
mov dword [esp + 0x308], 0xffffffff
lea edx, [esp + 0x12c]
push edx
call fcn.00433660
mov eax, 0xfffffff9
jmp 0x4639fe
lea eax, [esp + 0xbc]
push eax
lea ecx, [esp + 0x130]
call fcn.004349f0
mov byte [esp + 0x308], 0x25
mov ecx, dword [esp + 0x20]
push eax
call fcn.00409ad0
mov byte [esp + 0x308], 6
lea ecx, [esp + 0xbc]
call fcn.0040f320
mov byte [esp + 0x308], 5
lea ecx, [esp + 0x110]
call fcn.0040f350
mov dword [esp + 0x308], 0xffffffff
lea ecx, [esp + 0x12c]
push ecx
call fcn.00433660
mov eax, 1
mov ecx, dword [esp + 0x300]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2e8]
xor ecx, esp
call fcn.004911d1
mov esp, ebp
pop ebp
ret