Function at 0x401cd0
Capabilities:
Reference http user-agent string

Disassembly:
sub esp, 0x20
push ebx
push esi
mov ebx, dword [esp + 0x2c]
push edi
push ebp
push 1
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov ecx, dword [esp + 0x44]
mov eax, dword [esp + 0x48]
mov edx, dword [esp + 0x3c]
push eax
push ecx
push edx
call sub.SSLEAY32.dll_Ordinal_108
add esp, 0xc
test eax, eax
jle 0x402078
lea eax, [esp + 0x10]
mov ecx, dword [esp + 0x3c]
push eax
push ecx
push ebx
call fcn.00401080
add esp, 0xc
push 1
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
lea ecx, [esp + 0x1c]
mov edx, dword [esp + 0x4c]
push ecx
mov byte [eax], 0
push 0
mov ebp, dword [edx]
push ebp
push eax
push ebx
call fcn.00401000
add esp, 0x14
mov edi, eax
mov byte [esi], 0
lea eax, [esp + 0x14]
push eax
push 0
push str.GET__sdc_fromhttps_3A_2F_2Fcloud.mail.ru_2Fhome_HTTP_1.1_r_nHost:_auth.mail.ru_r_nAccept:_text_html_application_xhtmlxml_application_xml_q0.9_image_avif_image_webp_image_apng___q0.8_application_signed_exchange_vb3_q0.7_r_nAccept_Language:_ru_RU_ru_q0.9_en_US_q0.8_en_q0.7_r_nConnection:_keep_alive_r_nDnt:_1_r_nReferer:_https:__account.mail.ru__r_nCache_Control:_max_age0_r_nSec_Ch_Ua:__Chromium__v_117____Not_ABrand__v_8__r_nSec_Ch_Ua_Mobile:__0_r_nSec_Ch_Ua_Platform:__Windows__r_nSec_Ch_Ua_Full_Version:__117.0.5938.11__r_nSec_Ch_Ua_Full_Version_List:__Chromium__v_117.0.5938.11____Not_ABrand__v_8.0.0.0__r_nSec_Ch_Ua_Platform_Version:__15.0.0__r_nSec_Fetch_Dest:_document_r_nSec_Fetch_Mode:_navigate_r_nSec_Fetch_Site:_same_site_r_nSec_Fetch_User:__1_r_nUpgrade_Insecure_Requests:_1_r_nUser_Agent:_Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_117.0.0.0_Safari_537.36_r_nCookie:
push esi
push ebx
call fcn.00401000
lea ecx, [esp + 0x28]
add esp, 0x14
push ecx
push 0
push edi
push eax
push ebx
call fcn.00401000
lea ecx, [esp + 0x28]
add esp, 0x14
push ecx
push 0
push str._r_n_r_n
push eax
push ebx
call fcn.00401000
mov esi, dword [esp + 0x68]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x3c]
add esp, 0x14
push eax
push ecx
push esi
call sub.SSLEAY32.dll_Ordinal_108
add esp, 0xc
test eax, eax
jle 0x402078
lea eax, [esp + 0x10]
push eax
push esi
push ebx
call fcn.00401080
mov dword [esp + 0x24], eax
add esp, 0xc
push str.token
push eax
call fcn.0040253c
add esp, 8
test eax, eax
jne 0x401dee
mov eax, dword [esp + 0x18]
push 0
push 0x407d94
push eax
mov byte [eax + 0x190], 0
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x20
ret
sub eax, dword [esp + 0x18]
add eax, 6
mov ebp, eax
mov dword [esp + 0x20], eax
cmp eax, dword [esp + 0x10]
jae 0x401e13
mov eax, dword [esp + 0x18]
cmp byte [ebp + eax], 0x26
je 0x401e13
inc ebp
cmp ebp, dword [esp + 0x10]
jb 0x401e01
cmp ebp, dword [esp + 0x10]
je 0x402078
mov eax, ebp
sub eax, dword [esp + 0x20]
mov dword [esp + 0x2c], eax
inc eax
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, dword [esp + 0x20]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x2c]
add esi, dword [esp + 0x18]
mov edi, dword [esp + 0x24]
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x1c]
sub eax, dword [esp + 0x20]
push ecx
mov byte [eax + ebp], 0
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
push edx
push eax
push ebx
call fcn.00401370
add esp, 0x10
mov edi, eax
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push str.auth.mail.ru_cookies1
push edi
push 0
call esi
lea eax, [esp + 0x1c]
push eax
push 0
push 0x407238
push edi
push ebx
call fcn.00401000
lea ecx, [esp + 0x30]
mov edx, dword [esp + 0x60]
add esp, 0x14
mov ebp, dword [edx]
push ecx
push 0
push ebp
push eax
push ebx
call fcn.00401000
add esp, 0x14
mov edi, eax
mov eax, dword [esp + 0x28]
mov byte [eax], 0
lea ecx, [esp + 0x14]
push ecx
push 0
push str.GET__sdc_token
push eax
push ebx
call fcn.00401000
lea ecx, [esp + 0x28]
mov edx, dword [esp + 0x38]
add esp, 0x14
push ecx
push 0
push edx
push eax
push ebx
call fcn.00401000
lea ecx, [esp + 0x28]
add esp, 0x14
push ecx
push 0
push str.fromhttps_3A_2F_2Fcloud.mail.ru_2Fhome_HTTP_1.1_r_nHost:_cloud.mail.ru_r_nAccept:_text_html_application_xhtmlxml_application_xml_q0.9_image_avif_image_webp_image_apng___q0.8_application_signed_exchange_vb3_q0.7_r_nAccept_Language:_ru_RU_ru_q0.9_en_US_q0.8_en_q0.7_r_nConnection:_keep_alive_r_nSec_Ch_Ua:__Chromium__v_117____Not_ABrand__v_8__r_nSec_Ch_Ua_Mobile:__0_r_nSec_Ch_Ua_Platform:__Windows__r_nSec_Fetch_Dest:_document_r_nSec_Fetch_Mode:_navigate_r_nSec_Fetch_Site:_none_r_nSec_Fetch_User:__1_r_nUpgrade_Insecure_Requests:_1_r_nUser_Agent:_Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_117.0.0.0_Safari_537.36_r_nCookie:
push eax
push ebx
call fcn.00401000
lea ecx, [esp + 0x28]
add esp, 0x14
push ecx
push 0
push edi
push eax
push ebx
call fcn.00401000
lea ecx, [esp + 0x28]
add esp, 0x14
push ecx
push 0
push str._r_n_r_n
push eax
push ebx
call fcn.00401000
mov ecx, dword [esp + 0x28]
add esp, 0x14
mov edi, eax
push ecx
mov eax, dword [esp + 0x40]
push edi
push eax
call sub.SSLEAY32.dll_Ordinal_108
add esp, 0xc
test eax, eax
jle 0x402078
lea eax, [esp + 0x10]
mov ecx, dword [esp + 0x3c]
push eax
push ecx
push ebx
call fcn.00401080
lea ecx, [esp + 0x28]
mov edx, dword [esp + 0x1c]
add esp, 0xc
push ecx
push edx
push eax
push ebx
call fcn.00401370
add esp, 0x10
mov ebp, eax
push 0
push str.cloud.mail.ru_cookies2
push ebp
push 0
call esi
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0x407238
push ebp
push ebx
call fcn.00401000
lea ecx, [esp + 0x30]
mov edx, dword [esp + 0x60]
add esp, 0x14
mov ebp, dword [edx]
push ecx
push 0
push ebp
push eax
push ebx
call fcn.00401000
add esp, 0x14
mov ebp, eax
mov byte [edi], 0
lea eax, [esp + 0x14]
push eax
push 0
push str.GET__home_HTTP_1.1_r_nHost:_cloud.mail.ru_r_nAccept:_text_html_application_xhtmlxml_application_xml_q0.9_image_avif_image_webp_image_apng___q0.8_application_signed_exchange_vb3_q0.7_r_nAccept_Language:_ru_RU_ru_q0.9_en_US_q0.8_en_q0.7_r_nDnt:_1_r_nSec_Ch_Ua:__Chromium__v_117____Not_ABrand__v_8__r_nSec_Ch_Ua_Mobile:__0_r_nSec_Ch_Ua_Platform:__Windows__r_nSec_Fetch_Dest:_document_r_nSec_Fetch_Mode:_navigate_r_nSec_Fetch_Site:_none_r_nSec_Fetch_User:__1_r_nUpgrade_Insecure_Requests:_1_r_nUser_Agent:_Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_117.0.0.0_Safari_537.36_r_nCookie:
push edi
push ebx
call fcn.00401000
lea ecx, [esp + 0x28]
add esp, 0x14
push ecx
push 0
push ebp
push eax
push ebx
call fcn.00401000
lea ecx, [esp + 0x28]
add esp, 0x14
push ecx
push 0
push str._r_n_r_n
push eax
push ebx
call fcn.00401000
mov ecx, dword [esp + 0x28]
add esp, 0x14
push ecx
push eax
mov eax, dword [esp + 0x44]
push eax
call sub.SSLEAY32.dll_Ordinal_108
add esp, 0xc
test eax, eax
jle 0x402078
lea eax, [esp + 0x10]
mov ecx, dword [esp + 0x3c]
push eax
push ecx
push ebx
call fcn.00401080
lea ecx, [esp + 0x28]
add esp, 0xc
mov edi, eax
push ecx
mov eax, dword [esp + 0x14]
push eax
push edi
push ebx
call fcn.00401370
add esp, 0x10
mov ebp, eax
push 0
push str.cloud.mail.ru_cookies3
push ebp
push 0
call esi
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0x407238
push ebp
push ebx
call fcn.00401000
lea ecx, [esp + 0x30]
mov edx, dword [esp + 0x60]
add esp, 0x14
mov ebp, dword [edx]
push ecx
push 0
push ebp
push eax
push ebx
call fcn.00401000
add esp, 0x14
push 0
push str.OUT_auth.mail.ru_response2
push edi
push 0
call esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x20
ret