Function at 0x61ae90
Capabilities:
Reference http user-agent string
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
lea eax, [esp - 0x14]
cmp eax, dword [ecx + 8]
jbe 0x61b28e
sub esp, 0x94
lea edi, [esp + 0x68]
xor eax, eax
call fcn.004690f5
mov ecx, dword [esp + 0xbc]
mov edx, ecx
rol cx, 8
nop
mov word [esp + 0x26], 0
mov word [esp + 0x26], cx
mov ecx, dword [esp + 0x68]
test ecx, ecx
jne 0x61afe0
mov eax, dword [esp + 0x80]
test eax, eax
jne 0x61b275
mov eax, dword [esp + 0x74]
add eax, 2
cmp eax, 2
jge 0x61af30
lea eax, [0x701240]
mov dword [esp], eax
call fcn.0040c500
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x1b
lea ecx, [0x7440d8]
mov dword [eax], ecx
lea ecx, [0x7b0bb8]
mov dword [esp + 0x68], ecx
mov dword [esp + 0x6c], eax
mov edx, dword [esp + 0xbc]
movzx eax, byte [esp + 0x7c]
test al, al
je 0x61af7a
mov eax, dword [esp + 0x74]
add eax, 2
lea ecx, [esp + 0x68]
cmp dword [ecx + 0x10], eax
jge 0x61af7a
lea eax, [0x701240]
mov dword [esp], eax
call fcn.0040c500
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x36
lea ecx, [0x74f236]
mov dword [eax], ecx
lea ecx, [0x7b0bb8]
mov dword [esp + 0x68], ecx
mov dword [esp + 0x6c], eax
jmp 0x61afe0
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x74]
lea ebx, [ecx + 2]
mov ebp, dword [esp + 0x70]
cmp eax, ebx
jae 0x61afca
mov dword [esp + 0x30], ecx
mov dword [esp], ebp
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 2
lea eax, [0x6f4820]
mov dword [esp + 0x10], eax
call fcn.0044e6e0
mov ebp, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0xbc]
movzx esi, word [esp + 0x26]
mov word [ebp + ecx], si
mov dword [esp + 0x74], ebx
mov dword [esp + 0x78], eax
mov dword [esp + 0x70], ebp
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x54], 0
lea eax, [0x61b460]
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0xac]
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0xa8]
mov dword [esp + 0x50], eax
lea eax, [esp + 0x68]
mov dword [esp], eax
mov dword [esp + 4], 1
mov byte [esp + 8], 0
lea eax, [esp + 0x4c]
mov dword [esp + 0xc], eax
call fcn.005a69a0
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 0
lea eax, [0x61b2a0]
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0xb4]
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0xb8]
mov dword [esp + 0x64], eax
mov eax, dword [esp + 0xb0]
mov dword [esp + 0x5c], eax
lea eax, [esp + 0x68]
mov dword [esp], eax
mov dword [esp + 4], 1
mov byte [esp + 8], 0
lea eax, [esp + 0x58]
mov dword [esp + 0xc], eax
call fcn.005a69a0
mov eax, dword [esp + 0x68]
test eax, eax
je 0x61b0bb
mov ecx, dword [esp + 0x6c]
xor ebp, ebp
mov ebx, ecx
xor edx, edx
xor ecx, ecx
jmp 0x61b0e9
mov ecx, dword [esp + 0x74]
mov eax, dword [esp + 0x84]
cmp ecx, eax
jb 0x61b270
mov edx, dword [esp + 0x70]
mov ebx, dword [esp + 0x78]
sub ebx, eax
mov ebp, ebx
neg ebx
sar ebx, 0x1f
and ebx, eax
sub ecx, eax
add edx, ebx
xor eax, eax
xor ebx, ebx
test eax, eax
je 0x61b108
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
jne 0x61b21c
jmp 0x61b21f
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x28], ecx
mov dword [esp + 0x3c], edx
lea eax, [0x6f4820]
mov dword [esp], eax
mov eax, dword [esp + 0xbc]
mov dword [esp + 4], eax
mov dword [esp + 8], eax
call fcn.0044e560
mov eax, dword [esp + 0xc]
mov dword [esp + 0x40], eax
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
lea ecx, [0x6247c0]
mov dword [esp + 0x34], ecx
mov ecx, dword [esp + 0x98]
mov ecx, dword [ecx + 0xc]
mov dword [esp + 0x38], ecx
lea ecx, [esp + 0x34]
mov dword [esp], ecx
mov ecx, dword [esp + 0x9c]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0xa0]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0xa4]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x18], ecx
call fcn.005df380
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 0x10]
mov ecx, dword [esp + 0x20]
mov dword [esp], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0xbc]
mov dword [esp + 8], edx
mov dword [esp + 0xc], edx
call eax
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x61b204
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xbc]
cmp ecx, eax
jne 0x61b204
mov eax, dword [esp + 0x40]
mov dword [esp + 0xc0], eax
mov dword [esp + 0xc4], ecx
mov dword [esp + 0xc8], ecx
add esp, 0x94
ret
lea eax, [0x6f44e0]
mov dword [esp], eax
lea eax, [0x7b06f8]
mov dword [esp + 4], eax
call fcn.00438b10
mov eax, dword [eax + 4]
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], ebx
lea eax, str.failed_to_construct_HKDF_label:__shttp2:_aborting_request_body_writehttp:_persistConn.readLoop_exitinghttp:_read_on_closed_response_bodystream_error:_stream_ID__d___v___vframe_settings_window_size_too_bigframe_windowupdate_zero_inc_streamunsupported_authentication_method_crypto_des:_invalid_buffer_overlapcrypto_rc4:_invalid_buffer_overlapcrypto_rsa:_missing_public_modulusadding_nil_Certificate_to_CertPoolx509:_unknown_public_key_algorithmx509:_invalid_certificate_policies_s__q_is_excluded_by_constraint__qx509:_Ed25519_verification_failurex509:_unhandled_critical_extensioninvalid_padding_bits_in_BIT_STRINGillegal_base64_data_at_input_byte_invalid_nested_repetition_operatorinvalid_or_unsupported_Perl_syntaxchacha20:_wrong_HChaCha20_key_sizepersistentalloc:_align_is_too_large_memory_classes_heap_released:bytesgreyobject:_obj_not_pointer_alignedmismatched_begin_end_of_activeSweepmheap.freeSpanLocked___invalid_freeattempt_to_clear_non_empty_span_setruntime:_close_polldesc_w_o_unblockruntime:_inconsistent_read_deadlinefindrunnable:_netpoll_with_spinningpidleput:_P_has_non_empty_run_queuetraceback_did_not_unwind_completelyruntime:_createevent_failed__errnonetwork_dropped_connection_on_resettransport_endpoint_is_not_connectedsocks_authentication_get_extra_dataexecutable_file_not_found_in__PATH____PacketSize_error:_type_unsupport1776356839400250464677810668945312588817841970012523233890533447265625ryuFtoaFixed32_called_with_prec___92006_01_02T15:04:05.999999999Z07:00ssh:_parse_error_in_message_type__dssh:_extended_code__d_unimplementedssh:_invalid_packet_length_multiplessh:_no_key_material_for_msgNewKeysssh:_junk_character_in_version_linecrypto_md5:_invalid_hash_state_sizeencoding_hex:_odd_length_hex_stringfile_type_does_not_support_deadlinereflect.MakeSlice_of_non_slice_typetoo_many_Questions_to_pack___65535_unsupported_signature_algorithm:__vtls:_too_many_non_advancing_recordstls:_server_selected_an_invalid_PSKtls:_invalid_or_missing_PSK_bindershttp:_server_closed_idle_connectionCONTINUATION_frame_with_stream_ID_0chacha20:_output_smaller_than_inputbigmod:_modulus_is_smaller_than_nat__must_separate_successive_digitsx509:_malformed_extension_OID_fieldx509:_wrong_Ed25519_public_key_sizex509:_invalid_authority_info_accesssuperfluous_leading_zeros_in_lengthflate:_corrupt_input_before_offset_mime:_bogus_characters_after___:__qhpack:_invalid_Huffman_encoded_datadynamic_table_size_update_too_largeP224_point_is_the_point_at_infinityP256_point_is_the_point_at_infinityP384_point_is_the_point_at_infinityP521_point_is_the_point_at_infinitytransform:_short_destination_bufferlfstack_node_allocated_from_the_heap__is_larger_than_maximum_page_size__runtime:_invalid_typeBitsBulkBarrieruncaching_span_but_s.allocCount__0_memory_classes_metadata_other:bytesuser_arena_span_is_on_the_wrong_listruntime:_marked_free_object_in_span_runtime:_unblock_on_closing_polldescruntime:_inconsistent_write_deadlineUnable_to_determine_system_directoryruntime:_VirtualQuery_failed__errnoruntime:_sudog_with_non_nil_waitlinkruntime:_mcall_called_on_m__g0_stackstartm:_P_required_for_spinningtrue__is_not_Grunnable_or_Gscanrunnable_nruntime:_bad_notifyList_size___syncaccessed_data_from_freed_user_arena_runtime:_wrong_goroutine_in_newstackruntime:_invalid_pc_encoded_table_faccessing_a_corrupted_shared_libraryssh_connect_to_target_node_error:__s___Error_writing_init_packet_return:invalid_boolean_value__q_for___s:__v444089209850062616169452667236328125ryuFtoaFixed64_called_with_prec___180123456789abcdefghijklmnopqrstuvwxyzTime.UnmarshalBinary:_invalid_lengthdiffie_hellman_group_exchange_sha256ssh:_tcpChan:_deadline_not_supportedssh:_overflow_reading_version_stringcrypto_cipher:_input_not_full_blockscrypto_rand:_argument_to_Int_is___0strings.Builder.Grow:_negative_countstrings:_Join_output_length_overflowreflect:_NumField_of_non_struct_typemethod_ABI_and_value_ABI_dont_aligncompressed_name_in_SRV_resource_dataexpected_an_ECDSA_public_key__got__Tunsupported_SSLv2_handshake_receivedtls:_server_did_not_send_a_key_sharehttp:_unexpected_EOF_reading_trailer_LastStreamID_v
mov dword [esp], eax
mov dword [esp + 4], 0x22
lea eax, [esp + 0x44]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], 1
call fcn.004c1f50
mov eax, dword [esp + 0x14]
test eax, eax
je 0x61b260
mov eax, dword [eax + 4]
mov ecx, dword [esp + 0x18]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00438b10
call fcn.00468f30
lea eax, [0x6f44e0]
mov dword [esp], eax
lea eax, [0x7b06f0]
mov dword [esp + 4], eax
call fcn.00438b10
nop
call fcn.00467a60
jmp fcn.0061ae90