Function at 0x1800092b0
Capabilities:
Reference http user-agent string

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xb40
mov byte [rsp + 0xaf8], 0
lea rdi, [rsp + 0xaf9]
xor eax, eax
mov ecx, 0x3b
rep stosb byte [rdi], al
mov qword [rsp + 0x98], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0xb0], 0
mov dword [rsp + 0xaf0], 0
mov dword [rsp + 0xb8], 0
mov dword [rsp + 0x90], 0
mov dword [rsp + 0xa0], 0
mov byte [rsp + 0xc0], 0
lea rdi, [rsp + 0xc1]
xor eax, eax
mov ecx, 0xa27
rep stosb byte [rdi], al
mov r8d, 0x6f6a386b
mov edx, 0x3f7a0
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsp + 0xa8], rax
cmp qword [rsp + 0xa8], 0
jne 0x18000937b
mov eax, 0xc0000001
jmp 0x1800097d1
mov qword [rsp + 0x40], 0
lea rdi, [rsp + 0x48]
xor eax, eax
mov ecx, 0x40
rep stosb byte [rdi], al
mov rax, qword [rsp + 0xb60]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xb58]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0xb50]
lea r8, str.GET___s_HTTP_1.1_r_nHost:__s:_s_r_nAccept:text_html__application_xhtmlxml__image_jxr____r_nAccept_Language:_zh_Hans_CN__zh_Hans__q0.8__en_US__q0.5__en__q0.3_r_nUser_Agent:_Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_46.0.2486.0_Safari_537.36_Edge_13.10586_r_nConnection:Keep_Alive_r_n_r_n
mov edx, 0xa28
lea rcx, [rsp + 0xc0]
call fcn.18000aff0
lea r8, [rsp + 0x40]
mov rdx, qword [rsp + 0xb60]
mov rcx, qword [rsp + 0xb58]
call fcn.180009930
mov dword [rsp + 0xbc], eax
cmp dword [rsp + 0xbc], 0
jge 0x1800093fd
jmp 0x180009794
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0xc0]
call fcn.18000a540
mov dword [rsp + 0xbc], eax
cmp dword [rsp + 0xbc], 0
jl 0x180009794
jmp 0x18000942b
mov r8d, 0x3f7a0
xor edx, edx
mov rcx, qword [rsp + 0xa8]
call fcn.1800105d0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0xb0], 0
mov dword [rsp + 0x90], 0
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x90]
mov edx, 0x3f7a0
mov rcx, qword [rsp + 0xa8]
call fcn.18000a8b0
mov dword [rsp + 0xbc], eax
cmp dword [rsp + 0xbc], 0
jl 0x180009777
jmp 0x18000949b
lea rcx, [0x180011868]
call sub.ntoskrnl.exe_strlen
mov rdi, rax
lea rcx, [0x180011870]
call sub.ntoskrnl.exe_strlen
mov r8, rax
lea rdx, str.HTTP_1.
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.ntoskrnl.exe_RtlCompareMemory]
cmp rdi, rax
jne 0x180009659
lea rcx, [0x180011880]
call sub.ntoskrnl.exe_strlen
mov rdi, rax
lea rcx, [0x180011890]
call sub.ntoskrnl.exe_strlen
mov r8, rax
lea rdx, str.HTTP_1.1_200_OK
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.ntoskrnl.exe_RtlCompareMemory]
cmp rdi, rax
jne 0x180009649
lea rdx, [0x1800118b0]
mov rcx, qword [rsp + 0xa8]
call sub.ntoskrnl.exe_strstr
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x180009637
lea rdx, [0x1800118c4]
mov rcx, qword [rsp + 0x30]
call sub.ntoskrnl.exe_strstr
mov qword [rsp + 0xb0], rax
cmp qword [rsp + 0xb0], 0
je 0x180009625
mov rax, qword [rsp + 0x30]
mov rdi, qword [rsp + 0xb0]
sub rdi, rax
lea rcx, [0x1800118c8]
call sub.ntoskrnl.exe_strlen
sub rdi, rax
lea rcx, str.Content_Length:
call sub.ntoskrnl.exe_strlen
mov rdx, qword [rsp + 0x30]
add rdx, rax
mov r8, rdi
lea rcx, [rsp + 0xaf8]
call fcn.1800106d0
lea rcx, [rsp + 0xaf8]
call sub.ntoskrnl.exe_atoi
mov dword [rsp + 0xaf0], eax
mov eax, dword [rsp + 0xaf0]
add eax, 4
mov edx, eax
mov r8d, 0x6f6a386b
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsp + 0x98], rax
mov rcx, qword [rsp + 0xb70]
mov rax, qword [rsp + 0x98]
mov qword [rcx], rax
cmp qword [rsp + 0x98], 0
jne 0x180009607
mov dword [rsp + 0xbc], 0xc0000001
jmp 0x180009794
mov eax, dword [rsp + 0xaf0]
add eax, 4
mov r8d, eax
xor edx, edx
mov rcx, qword [rsp + 0x98]
call fcn.1800105d0
jmp 0x180009635
mov dword [rsp + 0xbc], 0xc0000001
jmp 0x180009794
jmp 0x180009647
mov dword [rsp + 0xbc], 0xc0000001
jmp 0x180009794
jmp 0x180009659
mov dword [rsp + 0xbc], 0xc0000001
jmp 0x180009794
lea rdx, [0x1800118f4]
mov rcx, qword [rsp + 0xa8]
call sub.ntoskrnl.exe_strstr
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x98], 0
jne 0x180009682
jmp 0x180009794
cmp qword [rsp + 0x30], 0
je 0x180009725
cmp qword [rsp + 0xb0], 0
je 0x180009725
mov edi, dword [rsp + 0x90]
lea rcx, [0x1800118fc]
call sub.ntoskrnl.exe_strlen
mov rcx, qword [rsp + 0x30]
add rcx, rax
sub rcx, qword [rsp + 0xa8]
mov rax, rdi
sub rax, rcx
mov dword [rsp + 0xb38], eax
cmp dword [rsp + 0xb38], 0
jbe 0x18000970c
mov edi, dword [rsp + 0xb38]
lea rcx, str._r_n_r_n
call sub.ntoskrnl.exe_strlen
mov rdx, qword [rsp + 0x30]
add rdx, rax
mov eax, dword [rsp + 0xb8]
mov rcx, qword [rsp + 0x98]
add rcx, rax
mov r8, rdi
call fcn.1800106d0
mov ecx, dword [rsp + 0xb38]
mov eax, dword [rsp + 0xb8]
add eax, ecx
mov dword [rsp + 0xb8], eax
jmp 0x180009763
mov r8d, dword [rsp + 0x90]
mov eax, dword [rsp + 0xb8]
mov rcx, qword [rsp + 0x98]
add rcx, rax
mov rdx, qword [rsp + 0xa8]
call fcn.1800106d0
mov edx, dword [rsp + 0x90]
mov eax, dword [rsp + 0xb8]
add eax, edx
mov dword [rsp + 0xb8], eax
mov eax, dword [rsp + 0xaf0]
cmp dword [rsp + 0xb8], eax
jb 0x18000942b
cmp dword [rsp + 0xbc], 0
jge 0x180009783
jmp 0x180009794
mov rcx, qword [rsp + 0xb68]
mov eax, dword [rsp + 0xb8]
mov dword [rcx], eax
cmp qword [rsp + 0xa8], 0
je 0x1800097be
mov edx, 0x6f6a386b
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov qword [rsp + 0xa8], 0
lea rcx, [rsp + 0x40]
call fcn.18000ac00
jmp 0x1800097ca
mov eax, dword [rsp + 0xbc]
add rsp, 0xb40
pop rdi
ret