Function at 0x15718
Capabilities:
Reference http user-agent string

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x60
mov rax, qword [0x0001a100]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rsi, rdx
mov r12, rcx
mov ebx, 0x400
lea r8, [rsp + 0x30]
mov edx, 0x73796966
mov rcx, rbx
mov byte [rsp + 0x30], 1
mov byte [rsp + 0x31], 1
call fcn.000121d0
lea r8, [rsp + 0x31]
mov edx, 0x62756674
mov rcx, rbx
mov rdi, rax
call fcn.000121d0
xor r14d, r14d
mov rbp, rax
cmp rdi, r14
je 0x15ab5
cmp rax, r14
je 0x15ab5
call fcn.00017864
lea ecx, [r14 + 2]
cmp rax, r14
mov rbx, rax
jl 0x15a6e
cmp rax, 0xffffffffffffffff
je 0x15a6e
xor eax, eax
mov word [rsp + 0x40], cx
lea rcx, [0x000184d0]
mov qword [rsp + 0x42], rax
mov dword [rsp + 0x4a], eax
mov word [rsp + 0x4e], ax
mov eax, 0x6307
mov word [rsp + 0x42], ax
call fcn.000171fc
lea rcx, [0x000184e0]
mov dword [rsp + 0x44], eax
movabs rax, 0xfffff78000000014
mov r13, qword [rax]
mov rax, qword [rax]
sub rax, r13
cmp rax, 0x6b49d200
jge 0x15854
lea rdx, [rsp + 0x40]
mov r8d, 0x10
mov rcx, rbx
call fcn.00017464
cmp eax, r14d
jge 0x158ff
lea r8, [rsp + 0x38]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x38], 0xfffffffffa0a1f00
call qword [sym.imp.ntoskrnl.exe_KeDelayExecutionThread]
movabs rax, 0xfffff78000000014
mov rax, qword [rax]
sub rax, r13
cmp rax, 0x6b49d200
jl 0x15801
lea rcx, [0x000184e0]
mov eax, 0x6007
mov word [rsp + 0x42], ax
call fcn.000171fc
lea rdx, [rsp + 0x40]
mov r8d, 0x10
mov rcx, rbx
mov dword [rsp + 0x44], eax
call fcn.00017464
cmp eax, r14d
jl 0x15a61
mov dword [0x0003be18], 1
mov r13d, 0x400
xor edx, edx
mov rcx, rdi
mov r8, r13
call fcn.00017cd0
mov rcx, rdi
call fcn.00014b38
lea rdx, [0x000184f0]
mov r11, r13
sub rdx, rbp
mov rcx, rbp
lea rax, [r11 + 0x7ffffbfe]
cmp rax, r14
je 0x158d7
mov al, byte [rdx + rcx]
cmp al, r14b
je 0x158d7
mov byte [rcx], al
inc rcx
sub r11, 1
jne 0x158b8
cmp r11, r14
jne 0x158df
dec rcx
mov byte [rcx], r14b
mov r8, rdi
mov rdx, r13
mov rcx, rbp
call fcn.000148f0
mov rax, cr8
cmp byte [rsp + 0x30], r14b
je 0x15908
cmp al, 1
jmp 0x1590a
mov dword [0x0003be18], r14d
jmp 0x1588d
cmp al, 2
ja 0x1591a
mov edx, 0x73796966
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov r13d, 0x2800
xor edx, edx
mov rcx, r12
mov r8, r13
call fcn.00017cd0
mov r9, rbp
lea r8, [0x00018350]
mov rdx, r13
mov rcx, r12
cmp dword [0x0003be18], r14d
jne 0x15974
mov dword [rsp + 0x28], 0x763
lea rax, [0x000184d0]
mov qword [rsp + 0x20], rax
call fcn.00011ba0
cmp eax, r14d
jge 0x15985
mov rcx, rbx
call fcn.00017378
mov byte [rsi], r14b
jmp 0x15a92
mov dword [rsp + 0x28], 0x760
lea rax, [0x000184e0]
jmp 0x15955
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r12
repne scasb al, byte [rdi]
xor r9d, r9d
mov rdx, r12
not rcx
lea r8, [rcx - 1]
mov rcx, rbx
call fcn.00017744
cmp eax, r14d
jl 0x15964
cmp eax, 0xffffffff
je 0x15964
mov r8, r13
xor edx, edx
mov rcx, r12
call fcn.00017cd0
xor edx, edx
mov r8d, 0x400
mov rcx, rbp
call fcn.00017cd0
mov edi, 0x3e8
jmp 0x159f7
cdqe
mov r8, rbp
mov rdx, r13
mov rcx, r12
mov byte [rax + rbp], r14b
call fcn.000148f0
xor edx, edx
mov r8d, 0x400
mov rcx, rbp
call fcn.00017cd0
xor r9d, r9d
mov r8d, edi
mov rdx, rbp
mov rcx, rbx
call fcn.00017660
cmp eax, r14d
jg 0x159d3
mov rcx, rbx
call fcn.00017378
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r12
repne scasb al, byte [rdi]
not rcx
cmp rcx, 1
je 0x1596c
lea rdx, [0x00018500]
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_strstr]
cmp rax, r14
jne 0x1596c
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r12
repne scasb al, byte [rdi]
not rcx
dec rcx
test cl, 3
je 0x15a92
jmp 0x1596c
mov rcx, rbx
call fcn.00017378
mov ecx, 2
mov byte [rsi], r14b
mov rax, cr8
cmp byte [rsp + 0x30], r14b
je 0x15a80
cmp al, 1
jmp 0x15a82
cmp al, cl
ja 0x15a92
mov edx, 0x73796966
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rax, cr8
cmp byte [rsp + 0x31], r14b
je 0x15aa1
cmp al, 1
jmp 0x15aa3
cmp al, 2
ja 0x15ab8
mov edx, 0x62756674
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x15ab8
mov byte [rsi], r14b
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.00017920
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret