Function at 0x40898d
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 8
call fcn.004c3266
add esp, 4
mov dword [ebp - 4], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebp - 8], 0
call fcn.00408b4c
push 0
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.ScriptControl
push 0x10030
push 0
push dword [ebp - 4]
push 3
mov ebx, 0x4c9e00
call fcn.004c327e
add esp, 0x28
push reloc.WS2_32.dll_connect
push 0
push str.JavaScript
push reloc.WS2_32.dll_connect
push 0
push str.Language
push 0x10030
push 0
push dword [ebp - 4]
push 3
mov ebx, 0x4c9d00
call fcn.004c327e
add esp, 0x28
push reloc.WS2_32.dll_connect
push 0
push str.navigatorappCodeName:_Mozilla__appMinorVersion:_0__appName:_Netscape__appVersion:_5.0__Windows_NT_10.0__WOW64__Trident_7.0__.NET4.0C__.NET4.0E__.NET_CLR_2.0.50727__.NET_CLR_3.0.30729__.NET_CLR_3.5.30729__InfoPath.3__rv:11.0__like_Gecko__browserLanguage:_zh_CN__cookieEnabled:true_cpuClass:_x86__language:_zh_CN__maxTouchPoints:0_msManipulationViewsEnabled:true_msMaxTouchPoints:0_msPointerEnabled:true_onLine:true_platform:_Win32__pointerEnabled:true_product:_Gecko__systemLanguage:_zh_CN__userAgent:_Mozilla_5.0__Windows_NT_10.0__WOW64__Trident_7.0__.NET4.0C__.NET4.0E__.NET_CLR_2.0.50727__.NET_CLR_3.0.30729__.NET_CLR_3.5.30729__InfoPath.3__rv:11.0__like_Gecko__userLanguage:_zh_CN__vendor:___vendorSub:___webdriver:false_windowthis_var_documentcookie:___window.hexin_var_TOKEN_SERVER_TIME1641546000.172__function_n_t_r_e_a_u_c__function__var_sa_0__ve_0__fu_0__lst_e_1__r_0___da_1__pn_0__ha_2__gn_1__wa_2__mZn_a_3__u_1__a_4___Ia_5___r_1__ye_2__Ea_6__Aat_n_2__u_2__n_3__e_3___Cu_3__bt_0__Ba_7__Ru_4__ku_5__Te_4__OZn_a_8__a_9__c_0___SZn_r_2__t_1__t_2__c_1___xn_4__Lr_3__Me_5__Nu_6__Pst_e_6__a_10___Dr_4__jZn_r_5__a_11__t_3___Vc_2__We_7__Xr_6___n_5__Fst_u_7__a_12__a_13___Hst_r_7__u_8__u_9___Yu_10__Uc_3__Ka_14__zc_4__Gr_8__Qn_6__Zn_7__Ju_11__qGn_a_15__t_4___nna_16__tnn_8__rna_17__enr_9__ane_8__onGn_u_12__r_10___una_18__cnr_11__snat_e_9__t_5__n_9___vne_10__fnat_n_10__e_3__r_12___lne_11__dne_12__pnr_13__hnr_14__gnn_11__wnn_12__mnr_15__Inn_13___ne_13__ynr_16__Ene_14__Ane_15__CnGn_n_14___bnt_6__Bna_19__Rne_16__knr_17__Tnc_5__Onn_15__SnZn_n_16__t_7__n_17___xnst_t_8__u_13___Lnt_9__Mne_17__Nnu_14__Pnr_3__Dnt_10__jna_20__Vnat_c_6__t_11__c_7__t_12___Wnc_8__Xnc_9___nu_15__Fne_18__Hne_18__Ync_10__Unsv_Knc_11__znn_18__function_Gn__var_earguments_r_18___if__e_return_n_19__for_var_ot_13__ia_21__un_18__u_e.length_u_var_se.charCodeAt_u__vsi_iiu_a_22_c_12__ot_14_.fromCharCode_v_return_ovar_Qn_new_a_23__n_20___new_e_3__fldp___function_Zn__return_arguments_t_15__.split_n_19__.reverse__.join_t_13__var_Jn_new_t_16__c_13___new_u_9__e_19____nt__function_o_var_in_21__sc_14__vat_e_20__n_22__n_23___fa_26__o_is_n_24__function_l__var_tc_15__this.setCookie_t_a_27___this.getCookie_t__o_u_17__n_25___this.delCookie_t_o_c_16__l_function_d_t_e_a_var_o_i_c_oicr_var_s_f_l_sfln_var_d_p_h_dphu_var_gGn_p_18__f_26___this.setCookie_t_o_21__vg_e_a_o_n_27__p_function_p_r_var_at_17__e_21___ofhrt_18__ia.indexOf_o__if_i_n_28__if_orn_29__a.substr_e_22__o.length__o_return_iu_19_var_sio_c_17___va.indexOf_gw_s__return_v_e_23__va_n_30____a.substring_s_v_o_e_24__m_function_m_e_o_i_u_s_var_vec_18_o_u_vn_31_u__s_vZn_t_19__a_28__n_32__c_19__s__i_vr_22_i__c_20__c_21__vo_a_29__d_nt_nt___var_tt__function_o_var_ic_22__se_25__vc_9__f_l_Q_m_a_30__at_a_31__r_23__a_32_____d_p_function_h_n_A_function__return_ng_n__f.getAttribute_n____function_g_e_var_o_i_u_oiuc_var_s_v_f_svfa_var_l_d_p_ldpr_var_h_g_w_hgwn_var_I___y_I_yt_var_Ey_20__Anew_g_33__d_24__st_Cn_v_33____return_e.replace_new_o_23__u_24___mE_.replace_A_g_34__function_w__var_o__if_vB___o_n_v_fa_30__s__else_if_l_c_25___a_34___trydnew_ActiveXObject_r_25___d.open___d.write_t_21___d.close___pd.w_t_22___u_19___I_i__fp.createElement_at_t_23__a_35__u_20__m__catch_h_fl.createElement_s__pl_n_35__l.getElementsByTagName_e_26___c_26__l_n_36__function_y_n_tryreturn_f.getItem_n_catch_t_return_e_27_o_t_24__w_function_E_n_return_v_y_n_:f_h_n_:void_t_25_o_a_36__b_function_A_n_var_t_r_e_return_trea_function__p.appendChild_f__f.addBehavior_e_37___f.load_s__var_tn___return_p.removeChild_f__tfunction_b_n_t_if_void_0t_return_R_n__if_v_k_n_t__elseif__f_return_void_e_22__O_n_t_function_B__tryreturn___s_in_a_30_u_21__s__catch_t_return_void_n_18_o_n_6__E_function_R_n_if_v_S_n__elseif__f_return_void_u_19__T_n_function_k_n_t_var_rbn_rC_tryf.setItem_n_t_catch_e_function_T_n_
push reloc.WS2_32.dll_connect
push 0
push str.AddCode
push 0x10030
push 0
push dword [ebp - 4]
push 3
mov ebx, 0x4c72b0
call fcn.004c327e
add esp, 0x28
push reloc.WS2_32.dll_connect
push 0
push str.LeyBc__
push reloc.WS2_32.dll_connect
push 0
push str.eval
push 0x10030
push 0
push dword [ebp - 4]
push 3
mov ebx, 0x4c7250
call fcn.004c327e
add esp, 0x28
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0x10031
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0x4c74a0
call fcn.004c327e
add esp, 0x1c
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0xc]
push ebx
push 0x10031
push 0
push ebx
push 1
mov ebx, 0x4c7370
call fcn.004c327e
add esp, 0x10
call fcn.004c3278
add esp, 4
mov eax, dword [ebp - 0x10]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x408aea
push ebx
call fcn.004c3278
add esp, 4
pop eax
mov dword [ebp - 8], eax
call fcn.00408b87
push dword [ebp - 8]
push 0x5d3fb1
mov ecx, 2
call fcn.00401187
add esp, 8
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
jmp 0x408b13
push eax
mov ebx, dword [ebp - 4]
push ebx
push 0x10030
push 0
push ebx
push 1
mov ebx, 0x4c9dd0
call fcn.004c327e
add esp, 0x10
call fcn.004c3278
add esp, 4
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x408b47
push ebx
call fcn.004c3278
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret