Function at 0x1800036d0
Capabilities:
Reference http user-agent string

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xb40
mov byte [rsp + 0xaf8], 0
lea rdi, [rsp + 0xaf9]
xor eax, eax
mov ecx, 0x3b
rep stosb byte [rdi], al
mov qword [rsp + 0x98], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0xb0], 0
mov dword [rsp + 0xaf0], 0
mov dword [rsp + 0xb8], 0
mov dword [rsp + 0x90], 0
mov dword [rsp + 0xa0], 0
mov byte [rsp + 0xc0], 0
lea rdi, [rsp + 0xc1]
xor eax, eax
mov ecx, 0xa27
rep stosb byte [rdi], al
mov r8d, 0x626b7368
mov edx, 0x3f7a0
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsp + 0xa8], rax
cmp qword [rsp + 0xa8], 0
jne 0x18000379b
mov eax, 0xc0000001
jmp 0x180003bf1
mov qword [rsp + 0x40], 0
lea rdi, [rsp + 0x48]
xor eax, eax
mov ecx, 0x40
rep stosb byte [rdi], al
mov rax, qword [rsp + 0xb60]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xb58]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0xb50]
lea r8, str.GET___s_HTTP_1.1_r_nHost:__s:_s_r_nAccept:text_html__application_xhtmlxml__image_jxr____r_nAccept_Language:_zh_Hans_CN__zh_Hans__q0.8__en_US__q0.5__en__q0.3_r_nUser_Agent:_Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_46.0.2486.0_Safari_537.36_Edge_13.10586_r_nConnection:Keep_Alive_r_n_r_n
mov edx, 0xa28
lea rcx, [rsp + 0xc0]
call fcn.180005410
lea r8, [rsp + 0x40]
mov rdx, qword [rsp + 0xb60]
mov rcx, qword [rsp + 0xb58]
call fcn.180003d50
mov dword [rsp + 0xbc], eax
cmp dword [rsp + 0xbc], 0
jge 0x18000381d
jmp 0x180003bb4
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0xc0]
call fcn.180004960
mov dword [rsp + 0xbc], eax
cmp dword [rsp + 0xbc], 0
jl 0x180003bb4
jmp 0x18000384b
mov r8d, 0x3f7a0
xor edx, edx
mov rcx, qword [rsp + 0xa8]
call fcn.180005930
mov qword [rsp + 0x30], 0
mov qword [rsp + 0xb0], 0
mov dword [rsp + 0x90], 0
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x90]
mov edx, 0x3f7a0
mov rcx, qword [rsp + 0xa8]
call fcn.180004cd0
mov dword [rsp + 0xbc], eax
cmp dword [rsp + 0xbc], 0
jl 0x180003b97
jmp 0x1800038bb
lea rcx, [0x1800068f8]
call sub.ntoskrnl.exe_strlen
mov rdi, rax
lea rcx, [0x180006900]
call sub.ntoskrnl.exe_strlen
mov r8, rax
lea rdx, str.HTTP_1.
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.ntoskrnl.exe_RtlCompareMemory]
cmp rdi, rax
jne 0x180003a79
lea rcx, [0x180006910]
call sub.ntoskrnl.exe_strlen
mov rdi, rax
lea rcx, [0x180006920]
call sub.ntoskrnl.exe_strlen
mov r8, rax
lea rdx, str.HTTP_1.1_200_OK
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.ntoskrnl.exe_RtlCompareMemory]
cmp rdi, rax
jne 0x180003a69
lea rdx, [0x180006940]
mov rcx, qword [rsp + 0xa8]
call sub.ntoskrnl.exe_strstr
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x180003a57
lea rdx, [0x180006954]
mov rcx, qword [rsp + 0x30]
call sub.ntoskrnl.exe_strstr
mov qword [rsp + 0xb0], rax
cmp qword [rsp + 0xb0], 0
je 0x180003a45
mov rax, qword [rsp + 0x30]
mov rdi, qword [rsp + 0xb0]
sub rdi, rax
lea rcx, [0x180006958]
call sub.ntoskrnl.exe_strlen
sub rdi, rax
lea rcx, str.Content_Length:
call sub.ntoskrnl.exe_strlen
mov rdx, qword [rsp + 0x30]
add rdx, rax
mov r8, rdi
lea rcx, [rsp + 0xaf8]
call fcn.1800055a0
lea rcx, [rsp + 0xaf8]
call sub.ntoskrnl.exe_atoi
mov dword [rsp + 0xaf0], eax
mov eax, dword [rsp + 0xaf0]
add eax, 4
mov edx, eax
mov r8d, 0x626b7368
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsp + 0x98], rax
mov rcx, qword [rsp + 0xb70]
mov rax, qword [rsp + 0x98]
mov qword [rcx], rax
cmp qword [rsp + 0x98], 0
jne 0x180003a27
mov dword [rsp + 0xbc], 0xc0000001
jmp 0x180003bb4
mov eax, dword [rsp + 0xaf0]
add eax, 4
mov r8d, eax
xor edx, edx
mov rcx, qword [rsp + 0x98]
call fcn.180005930
jmp 0x180003a55
mov dword [rsp + 0xbc], 0xc0000001
jmp 0x180003bb4
jmp 0x180003a67
mov dword [rsp + 0xbc], 0xc0000001
jmp 0x180003bb4
jmp 0x180003a79
mov dword [rsp + 0xbc], 0xc0000001
jmp 0x180003bb4
lea rdx, [0x180006984]
mov rcx, qword [rsp + 0xa8]
call sub.ntoskrnl.exe_strstr
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x98], 0
jne 0x180003aa2
jmp 0x180003bb4
cmp qword [rsp + 0x30], 0
je 0x180003b45
cmp qword [rsp + 0xb0], 0
je 0x180003b45
mov edi, dword [rsp + 0x90]
lea rcx, [0x18000698c]
call sub.ntoskrnl.exe_strlen
mov rcx, qword [rsp + 0x30]
add rcx, rax
sub rcx, qword [rsp + 0xa8]
mov rax, rdi
sub rax, rcx
mov dword [rsp + 0xb38], eax
cmp dword [rsp + 0xb38], 0
jbe 0x180003b2c
mov edi, dword [rsp + 0xb38]
lea rcx, str._r_n_r_n
call sub.ntoskrnl.exe_strlen
mov rdx, qword [rsp + 0x30]
add rdx, rax
mov eax, dword [rsp + 0xb8]
mov rcx, qword [rsp + 0x98]
add rcx, rax
mov r8, rdi
call fcn.1800055a0
mov ecx, dword [rsp + 0xb38]
mov eax, dword [rsp + 0xb8]
add eax, ecx
mov dword [rsp + 0xb8], eax
jmp 0x180003b83
mov r8d, dword [rsp + 0x90]
mov eax, dword [rsp + 0xb8]
mov rcx, qword [rsp + 0x98]
add rcx, rax
mov rdx, qword [rsp + 0xa8]
call fcn.1800055a0
mov edx, dword [rsp + 0x90]
mov eax, dword [rsp + 0xb8]
add eax, edx
mov dword [rsp + 0xb8], eax
mov eax, dword [rsp + 0xaf0]
cmp dword [rsp + 0xb8], eax
jb 0x18000384b
cmp dword [rsp + 0xbc], 0
jge 0x180003ba3
jmp 0x180003bb4
mov rcx, qword [rsp + 0xb68]
mov eax, dword [rsp + 0xb8]
mov dword [rcx], eax
cmp qword [rsp + 0xa8], 0
je 0x180003bde
mov edx, 0x626b7368
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov qword [rsp + 0xa8], 0
lea rcx, [rsp + 0x40]
call fcn.180005020
jmp 0x180003bea
mov eax, dword [rsp + 0xbc]
add rsp, 0xb40
pop rdi
ret