Function at 0x409e60
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0x4013e6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xb8
push ebx
push esi
push edi
mov dword [ebp - 0xc], esp
mov dword [ebp - 8], 0x401378
mov edx, dword [ebp + 0xc]
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
xor edi, edi
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x60], edi
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x80], edi
call esi
mov edx, dword [ebp + 0x10]
lea ecx, [ebp - 0x28]
call esi
push edi
lea eax, [ebp - 0x60]
push 0x404a30
push eax
call dword [sym.imp.MSVBVM60.DLL_rtcCreateObject2]
lea ecx, [ebp - 0x60]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaObjVar]
lea edx, [ebp - 0x2c]
push eax
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaObjSetAddref]
lea ecx, [ebp - 0x60]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
sub esp, 0x10
mov ecx, 8
mov esi, esp
mov dword [ebp - 0x80], ecx
mov eax, 0x404ce4
sub esp, 0x10
mov dword [esi], ecx
mov ecx, dword [ebp - 0x7c]
mov dword [ebp - 0x78], eax
mov ebx, 0x4008
mov dword [esi + 4], ecx
mov ecx, esp
lea edx, [ebp - 0x40]
sub esp, 0x10
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x74]
mov dword [esi + 0xc], eax
mov dword [ecx], ebx
mov ebx, dword [ebp - 0x9c]
mov eax, 0xb
mov dword [ecx + 4], ebx
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaLateMemCall]
mov dword [ecx + 8], edx
mov edx, dword [ebp - 0x94]
mov dword [ecx + 0xc], edx
mov edx, dword [ebp - 0xac]
mov ecx, esp
push 3
push 0x404a60
mov dword [ecx], eax
or eax, 0xffffffff
mov dword [ecx + 4], edx
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0xa4]
mov dword [ecx + 0xc], eax
mov ecx, dword [ebp - 0x2c]
push ecx
call esi
mov eax, 0x404a80
mov ecx, 8
add esp, 0x2c
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x80], ecx
mov dword [ebp - 0xa0], ecx
mov edx, esp
mov dword [edx], ecx
mov ecx, dword [ebp - 0x7c]
sub esp, 0x10
mov dword [edx + 4], ecx
mov ecx, esp
push 2
push 0x404ac0
mov dword [edx + 8], eax
mov eax, dword [ebp - 0x74]
mov dword [edx + 0xc], eax
mov edx, dword [ebp - 0xa0]
mov dword [ecx], edx
mov eax, 0x404aa4
mov dword [ecx + 4], ebx
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0x94]
mov dword [ecx + 0xc], eax
mov ecx, dword [ebp - 0x2c]
push ecx
call esi
add esp, 0x1c
mov ecx, 8
mov edx, esp
mov dword [ebp - 0x80], ecx
mov dword [ebp - 0xa0], ecx
mov eax, 0x404ae8
mov dword [edx], ecx
mov ecx, dword [ebp - 0x7c]
mov dword [ebp - 0x78], eax
sub esp, 0x10
mov dword [edx + 4], ecx
mov ecx, esp
push 2
push 0x404ac0
mov dword [edx + 8], eax
mov eax, dword [ebp - 0x74]
mov dword [edx + 0xc], eax
mov edx, dword [ebp - 0xa0]
mov dword [ecx], edx
mov eax, 0x404b04
mov dword [ecx + 4], ebx
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0x94]
mov dword [ecx + 0xc], eax
mov ecx, dword [ebp - 0x2c]
push ecx
call esi
add esp, 0x1c
mov ecx, 8
mov edx, esp
mov dword [ebp - 0x80], ecx
mov dword [ebp - 0xa0], ecx
mov eax, 0x404bf4
mov dword [edx], ecx
mov ecx, dword [ebp - 0x7c]
mov dword [ebp - 0x78], eax
sub esp, 0x10
mov dword [edx + 4], ecx
mov ecx, esp
push 2
push 0x404ac0
mov dword [edx + 8], eax
mov eax, dword [ebp - 0x74]
mov dword [edx + 0xc], eax
mov edx, dword [ebp - 0xa0]
mov dword [ecx], edx
mov eax, 0x404cf4
mov dword [ecx + 4], ebx
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0x94]
mov dword [ecx + 0xc], eax
mov ecx, dword [ebp - 0x2c]
push ecx
call esi
mov eax, dword [ebp - 0x28]
add esp, 0x1c
mov edx, esp
mov ecx, 8
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x80], ecx
mov dword [edx], ecx
mov ecx, dword [ebp - 0x7c]
push 1
mov dword [edx + 4], ecx
mov ecx, dword [ebp - 0x2c]
push 0x404c88
push ecx
mov dword [edx + 8], eax
mov eax, dword [ebp - 0x74]
mov dword [edx + 0xc], eax
call esi
add esp, 0x1c
lea edx, [ebp - 0x60]
push edx
call dword [sym.imp.MSVBVM60.DLL_rtcGetPresentDate]
mov ebx, dword [sym.imp.MSVBVM60.DLL___vbaVarMove]
lea edx, [ebp - 0x60]
lea ecx, [ebp - 0x50]
call ebx
jmp 0x40a0d0
mov ebx, dword [sym.imp.MSVBVM60.DLL___vbaVarMove]
mov eax, dword [ebp - 0x2c]
push edi
push 0x404c94
lea ecx, [ebp - 0x60]
push eax
push ecx
mov dword [ebp - 0x78], 4
mov dword [ebp - 0x80], 0x8002
call dword [sym.imp.MSVBVM60.DLL___vbaLateMemCallLd]
add esp, 0x10
lea edx, [ebp - 0x80]
push eax
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaVarTstNe]
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
lea ecx, [ebp - 0x60]
mov dword [ebp - 0xc4], eax
call esi
cmp word [ebp - 0xc4], di
je 0x40a1a8
lea eax, [ebp - 0x60]
push 0x32
push eax
call fcn.00409a20
lea ecx, [ebp - 0x60]
call esi
lea ecx, [ebp - 0x60]
push ecx
call dword [sym.imp.MSVBVM60.DLL_rtcGetPresentDate]
lea edx, [ebp - 0x60]
lea ecx, [ebp - 0x3c]
call ebx
push 1
lea edx, [ebp - 0x3c]
push 1
lea eax, [ebp - 0x50]
push edx
push eax
lea ecx, [ebp - 0x60]
push 0x404cb0
push ecx
call dword [0x401044]
lea edx, [ebp - 0x60]
lea eax, [ebp - 0x80]
push edx
push eax
mov dword [ebp - 0x78], 0xf
mov dword [ebp - 0x80], 0x8002
call dword [sym.imp.MSVBVM60.DLL___vbaVarTstGt]
lea ecx, [ebp - 0x60]
mov ebx, eax
call esi
cmp bx, di
je 0x40a0ca
lea edx, [ebp - 0x80]
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x78], 0x404cb8
mov dword [ebp - 0x80], 8
call dword [sym.imp.MSVBVM60.DLL___vbaVarCopy]
push 0x40a225
jmp 0x40a1fb
mov ecx, dword [ebp - 0x2c]
push edi
push 0x404cc4
lea edx, [ebp - 0x60]
push ecx
push edx
call dword [sym.imp.MSVBVM60.DLL___vbaLateMemCallLd]
add esp, 0x10
mov edx, eax
lea ecx, [ebp - 0x24]
call ebx
lea eax, [ebp - 0x2c]
push edi
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaObjSetAddref]
push 0x40a225
jmp 0x40a1fb
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
lea ecx, [ebp - 0x28]
call esi
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeObj]
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
lea ecx, [ebp - 0x3c]
call edi
lea ecx, [ebp - 0x40]
call esi
lea ecx, [ebp - 0x50]
call edi
ret