Function at 0x18004fea0
Capabilities:
Reference http user-agent string

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov rsi, rcx
add rcx, 0x10
cmp qword [rcx + 0x18], 0x4d
jb 0x18004feef
mov rbx, qword [rcx]
mov qword [rcx + 0x10], 0x4d
mov r8d, 0x4d
lea rdx, str.Mozilla_5.0__Windows_NT_6.1__Win64__x64__rv:89.0__Gecko_20100101_Firefox_89.0
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x4d], 0
jmp 0x18004ff00
lea r9, str.Mozilla_5.0__Windows_NT_6.1__Win64__x64__rv:89.0__Gecko_20100101_Firefox_89.0
mov edx, 0x4d
call fcn.180009ec0
lea rcx, [rsi + 0x30]
cmp qword [rsi + 0x48], 0xf
jbe 0x18004ff0f
mov rcx, qword [rsi + 0x30]
xor ebp, ebp
mov qword [rsi + 0x40], rbp
mov byte [rcx], bpl
lea rcx, [rsi + 0x50]
cmp qword [rsi + 0x68], 0xf
jbe 0x18004ff27
mov rcx, qword [rsi + 0x50]
mov qword [rsi + 0x60], rbp
mov byte [rcx], bpl
lea rcx, [rsi + 0x70]
cmp qword [rsi + 0x88], 0xf
jbe 0x18004ff40
mov rcx, qword [rsi + 0x70]
mov qword [rsi + 0x80], rbp
mov byte [rcx], bpl
lea rcx, [rsi + 0x90]
cmp qword [rsi + 0xa8], 0xf
jbe 0x18004ff62
mov rcx, qword [rsi + 0x90]
mov qword [rsi + 0xa0], rbp
mov byte [rcx], bpl
lea rcx, [rsi + 0xb0]
cmp qword [rsi + 0xc8], 0xf
jbe 0x18004ff84
mov rcx, qword [rsi + 0xb0]
mov qword [rsi + 0xc0], rbp
mov byte [rcx], bpl
lea rcx, [rsi + 0xd0]
mov rax, qword [rcx + 0x18]
cmp rax, 3
jb 0x18004ffce
mov rbx, rcx
cmp rax, 0xf
jbe 0x18004ffab
mov rbx, qword [rcx]
mov qword [rcx + 0x10], 3
mov r8d, 3
lea rdx, [0x18005fb60]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 3], bpl
jmp 0x18004ffdf
lea r9, [0x18005fb60]
mov edx, 3
call fcn.180009ec0
lea rcx, [rsi + 0xf0]
cmp qword [rsi + 0x108], 0xf
jbe 0x18004fff7
mov rcx, qword [rsi + 0xf0]
mov qword [rsi + 0x100], rbp
mov byte [rcx], bpl
lea rcx, [rsi + 0x110]
cmp qword [rcx + 0x18], 0xf
jb 0x18005003a
mov rbx, rcx
jbe 0x180050017
mov rbx, qword [rcx]
mov qword [rcx + 0x10], 0xf
mov r8d, 0xf
lea rdx, str.www.example.com
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0xf], bpl
jmp 0x18005004b
lea r9, str.www.example.com
mov edx, 0xf
call fcn.180009ec0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0x50], xmm1
xor r8d, r8d
lea rdx, [0x18005da7b]
lea rcx, [rsp + 0x40]
call fcn.180009c60
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0x70], xmm1
xor r8d, r8d
lea rdx, [0x18005da7b]
lea rcx, [rsp + 0x60]
call fcn.180009c60
nop
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.180008660
lea r14, [rsi + 0x130]
lea rax, [rsp + 0x20]
cmp r14, rax
je 0x18005013e
mov r15, qword [r14]
mov rdi, qword [r15 + 8]
cmp byte [rdi + 0x19], 0
jne 0x180050111
nop dword [rax + rax]
mov r8, qword [rdi + 0x10]
mov rdx, r14
mov rcx, r14
call fcn.180009b90
mov rbx, rdi
mov rdi, qword [rdi]
lea rcx, [rbx + 0x20]
call fcn.180005bd0
mov edx, 0x60
mov rcx, rbx
call fcn.1800560c8
cmp byte [rdi + 0x19], 0
je 0x1800500e0
mov qword [r15 + 8], r15
mov qword [r15], r15
mov qword [r15 + 0x10], r15
mov qword [r14 + 8], rbp
mov rcx, qword [r14]
mov rax, qword [rsp + 0x20]
mov qword [r14], rax
mov qword [rsp + 0x20], rcx
mov rax, qword [rsp + 0x28]
mov qword [r14 + 8], rax
mov qword [rsp + 0x28], rbp
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x20]
call fcn.180009bf0
nop
lea r9, [fcn.180005bd0]
mov edx, 0x40
lea r8d, [rdx - 0x3f]
lea rcx, [rsp + 0x40]
call fcn.180055ff8
mov qword [rsi + 0x140], rbp
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret