Function at 0x17940
Capabilities:
Reference http user-agent string

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x488
mov rax, qword [0x0001d100]
xor rax, rsp
mov qword [rsp + 0x470], rax
or qword [rsp + 0x30], 0xffffffffffffffff
mov r15, rcx
mov r13d, r8d
mov r14, rdx
mov edi, 0x206
lea rcx, [rsp + 0x52]
xor esi, esi
mov r8, rdi
xor edx, edx
mov qword [rsp + 0x38], r9
mov word [rsp + 0x50], si
call fcn.0001a460
lea rcx, [rsp + 0x262]
mov r8, rdi
xor edx, edx
mov word [rsp + 0x260], si
call fcn.0001a460
lea ecx, [rsi + 1]
mov edx, 0x400
mov r8d, 0x6473656e
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
lea ecx, [rsi + 1]
mov edx, 0x2800
mov r8d, 0x72656364
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov r12d, esi
mov esi, 0x104
lea r8, [0x000de130]
lea rcx, [rsp + 0x50]
mov rdx, rsi
mov rbp, rax
call fcn.00011008
lea r8, [0x0001b880]
lea rcx, [rsp + 0x50]
mov rdx, rsi
call fcn.00011080
lea r8, [0x000ffdb0]
lea rcx, [rsp + 0x260]
mov rdx, rsi
call fcn.00011008
lea r8, [0x0001b890]
lea rcx, [rsp + 0x260]
mov rdx, rsi
call fcn.00011080
movsxd rdi, dword [0x000dd8ec]
lea rax, [0x000de760]
mov rcx, rdi
lea r8, [rsp + 0x260]
mov rdx, rsi
imul rcx, rcx, 0x208
add rcx, rax
call fcn.00011080
inc edi
mov dword [0x000dd8ec], edi
call fcn.00019dec
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x17c7e
mov eax, 2
mov word [rsp + 0x40], ax
lea ecx, [rax + 6]
movzx eax, r13w
ror ax, cl
mov rcx, r15
mov word [rsp + 0x42], ax
call fcn.00019798
mov edi, 0x10
lea rdx, [rsp + 0x40]
mov r8d, edi
mov rcx, rsi
mov dword [rsp + 0x44], eax
call fcn.000199ec
test eax, eax
js 0x17adc
mov edi, 0x400
xor edx, edx
mov rcx, rbx
mov r8, rdi
call fcn.0001a460
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r15
jmp 0x17b1c
mov rcx, r14
call fcn.00019798
lea rdx, [rsp + 0x40]
mov r8d, edi
mov rcx, rsi
mov dword [rsp + 0x44], eax
call fcn.000199ec
test eax, eax
js 0x17c76
mov edi, 0x400
xor edx, edx
mov rcx, rbx
mov r8, rdi
call fcn.0001a460
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r14
mov r9, qword [rsp + 0x38]
lea r8, [0x0001b7d0]
mov rdx, rdi
mov rcx, rbx
call fcn.00011ef4
xor r13d, r13d
cmp eax, r13d
jl 0x17c83
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
xor r9d, r9d
mov rdx, rbx
not rcx
lea r8, [rcx - 1]
mov rcx, rsi
call fcn.00019ccc
cmp eax, r13d
jl 0x17c76
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
mov byte [0x0001d264], r13b
call fcn.000117ac
cmp eax, r13d
jl 0x17c40
xor edx, edx
mov r8d, 0x2800
mov rcx, rbp
call fcn.0001a460
xor r9d, r9d
mov r8d, 0x27d8
mov rdx, rbp
mov rcx, rsi
call fcn.00019be8
cmp eax, r13d
jle 0x17bdd
movsxd rcx, eax
xor r9d, r9d
mov r8d, eax
mov byte [rcx + rbp], r13b
mov rcx, qword [rsp + 0x30]
mov rdx, rbp
add r12d, eax
mov byte [0x0001d264], r13b
call fcn.000118a8
mov byte [0x0001d264], 1
jmp 0x17b87
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
cmp r12d, r13d
mov rcx, rsi
mov edi, eax
cmovg edi, r13d
call fcn.00019914
mov byte [0x0001d264], r13b
cmp r12d, dword [rsp + 0x4f8]
jne 0x17c34
mov edx, 0x1018
mov ecx, 1
mov r8d, 0x666c726e
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
cmp rax, r13
je 0x17c45
lea rcx, [rsp + 0x50]
mov rdx, rax
call fcn.00011d80
jmp 0x17c45
lea rcx, [rsp + 0x50]
call fcn.000118fc
jmp 0x17c45
mov edi, 0xc0000001
mov byte [0x0001d264], 1
cmp rbx, r13
je 0x17c5f
mov edx, 0x6473656e
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
cmp rbp, r13
je 0x17c72
mov edx, 0x72656364
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, edi
jmp 0x17c83
mov rcx, rsi
call fcn.00019914
mov eax, 0xc0000001
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.0001a090
add rsp, 0x488
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret