Function at 0x433780
Capabilities:
Reference http user-agent string

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x433b26
sub rsp, 0xb0
mov qword [rsp + 0xa8], rbp
lea rbp, [rsp + 0xa8]
mov qword [rsp + 0x48], 0
mov rax, qword [sym.imp.kernel32.dll_DuplicateHandle]
lea rcx, [rsp + 0x48]
mov qword [rsp], rax
mov qword [rsp + 8], 0xffffffffffffffff
mov qword [rsp + 0x10], 0xfffffffffffffffe
mov qword [rsp + 0x18], 0xffffffffffffffff
mov qword [rsp + 0x20], rcx
movups xmmword [rsp + 0x28], xmm15
mov qword [rsp + 0x38], 2
call fcn.00434120
xorps xmm15, xmm15
mov r14, qword [0x00a04c40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x40], 0
je 0x433ac5
mov rax, qword [r14 + 0x30]
mov qword [rsp + 0x98], rax
test byte [rax], al
lea rcx, [rax + 0x308]
mov qword [rsp + 0xa0], rcx
nop
mov rax, rcx
call fcn.0040b8e0
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x98]
mov qword [rdx + 0x310], rcx
cmp qword [rdx + 0x328], 0
jne 0x4338b5
cmp byte [0x00a049fb], 0
je 0x4338b5
mov rax, qword [sym.imp.kernel32.dll_CreateWaitableTimerExW]
mov qword [rsp], rax
movups xmmword [rsp + 8], xmm15
mov qword [rsp + 0x18], 2
mov qword [rsp + 0x20], 0x100003
call fcn.00433fa0
xorps xmm15, xmm15
mov r14, qword [0x00a04c40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x98]
mov qword [rcx + 0x328], rax
test rax, rax
je 0x433a65
nop
nop
mov rax, qword [rsp + 0xa0]
nop
call fcn.0040bb00
movups xmmword [rsp + 0x68], xmm15
movups xmmword [rsp + 0x78], xmm15
movups xmmword [rsp + 0x88], xmm15
mov rcx, qword [sym.imp.kernel32.dll_VirtualQuery]
lea rdx, [rsp + 0x68]
mov qword [rsp], rcx
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], 0x30
nop dword [rax]
call fcn.00433f20
xorps xmm15, xmm15
mov r14, qword [0x00a04c40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
nop dword [rax]
je 0x433a00
mov rax, qword [rsp + 0x70]
lea rcx, [rax + 0x4000]
mov qword [rsp + 0x50], rcx
mov rdx, qword [r14 + 8]
mov qword [rsp + 0x60], rdx
cmp rdx, rcx
jb 0x433990
sub rdx, rax
add rdx, 0xffffffffffffc000
cmp rdx, 0x4000000
ja 0x433990
mov qword [r14], rcx
add rax, 0x53a0
mov qword [r14 + 0x10], rax
mov qword [r14 + 0x18], rax
call fcn.00465860
xorps xmm15, xmm15
mov r14, qword [0x00a04c40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
call fcn.00438660
lea rax, [0x0071fd1b]
mov ebx, 0x13
call fcn.00438f60
mov rax, qword [rsp + 0x50]
call fcn.00438dc0
lea rax, [0x007eeb30]
mov ebx, 1
nop dword [rax]
call fcn.00438f60
mov rax, qword [rsp + 0x60]
call fcn.00438dc0
lea rax, [0x007197fa]
mov ebx, 2
nop dword [rax + rax]
call fcn.00438f60
call fcn.004386e0
lea rax, [0x0071c41f]
mov ebx, 0xc
call fcn.00436d20
nop dword [rax + rax]
call fcn.00467420
xorps xmm15, xmm15
mov r14, qword [0x00a04c40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x58], rax
nop
call fcn.00438660
lea rax, [0x007290c6]
mov ebx, 0x24
call fcn.00438f60
mov rax, qword [rsp + 0x58]
nop dword [rax + rax]
call fcn.00438c60
call fcn.004388c0
call fcn.004386e0
lea rax, str.VirtualQuery_for_stack_base_failedWEBVIEW2_BROWSER_EXECUTABLE_FOLDERadding_nil_Certificate_to_CertPoolchacha20:_wrong_HChaCha20_key_sizecrypto_aes:_invalid_buffer_overlapcrypto_des:_invalid_buffer_overlapcrypto_rc4:_invalid_buffer_overlapcrypto_rsa:_missing_public_modulusdoaddtimer:_P_already_set_in_timerexpected_an_RSA_public_key__got__Tfailed_to_construct_HKDF_label:__sflag_provided_but_not_defined:___sforEachP:_sched.safePointWait___0frame_settings_window_size_too_bigframe_windowupdate_zero_inc_streamhttp2:_aborting_request_body_writehttp:_connection_has_been_hijackedhttp:_persistConn.readLoop_exitinghttp:_read_on_closed_response_bodyillegal_base64_data_at_input_byte_in_u_hexadecimal_character_escapeinvalid_nested_repetition_operatorinvalid_or_unsupported_Perl_syntaxinvalid_padding_bits_in_BIT_STRINGmspan.ensureSwept:_m_is_not_lockedout_of_memory_allocating_allArenasreflect:_ChanDir_of_non_chan_type_reflect:_Field_index_out_of_boundsreflect:_Field_of_non_struct_type_reflect:_string_index_out_of_rangeruntime.SetFinalizer:_cannot_pass_runtime:_g_is_running_but_p_is_notschedule:_spinning_with_local_workslice_bounds_out_of_range___x:_y:_slice_bounds_out_of_range__:_x:_y_stream_error:_stream_ID__d___v___vtimeout_waiting_for_client_prefacetls:_malformed_key_share_extensiontoo_many_references:_cannot_spliceunexpected_number_of_return_valuesunexpected_runtime.netpoll_error:_unsupported_authentication_method_x509:_Ed25519_verification_failurex509:_invalid_certificate_policiesx509:_unhandled_critical_extensionx509:_unknown_public_key_algorithm__must_separate_successive_digits177635683940025046467781066894531252006_01_02T15:04:05.999999999Z07:0088817841970012523233890533447265625CONTINUATION_frame_with_stream_ID_0P224_point_is_the_point_at_infinityP256_point_is_the_point_at_infinityP384_point_is_the_point_at_infinityP521_point_is_the_point_at_infinitySubscribeServiceChangeNotificationsWEBVIEW2_RELEASE_CHANNEL_PREFERENCEattempt_to_clear_non_empty_span_setbigmod:_invalid_montgomeryMul_inputchacha20:_output_smaller_than_inputcrypto_md5:_invalid_hash_state_sizedynamic_table_size_update_too_largeencoding_hex:_odd_length_hex_stringfile_type_does_not_support_deadlinefindrunnable:_netpoll_with_spinningflate:_corrupt_input_before_offset_greyobject:_obj_not_pointer_alignedhpack:_invalid_Huffman_encoded_datahttp:_server_closed_idle_connectionmheap.freeSpanLocked___invalid_freemime:_bogus_characters_after___:__qmime:_invalid_RFC_2047_encoded_wordmismatched_begin_end_of_activeSweepmust_be_a__yourInterfaceType__nil_network_dropped_connection_on_resetno_such_multicast_network_interfacepersistentalloc:_align_is_too_largepidleput:_P_has_non_empty_run_queuereflect.MakeSlice_of_non_slice_typeruntime:_close_polldesc_w_o_unblockruntime:_createevent_failed__errnoruntime:_inconsistent_read_deadlineryuFtoaFixed32_called_with_prec___9superfluous_leading_zeros_in_lengthtls:_server_selected_an_invalid_PSKtls:_too_many_non_advancing_recordstoo_many_Questions_to_pack___65535_traceback_did_not_unwind_completelytransform:_short_destination_buffertransport_endpoint_is_not_connectedunsupported_signature_algorithm:__vx509:_decryption_password_incorrectx509:_invalid_authority_info_accessx509:_malformed_extension_OID_fieldx509:_wrong_Ed25519_public_key_size_LastStreamID_v_ErrCode_v_Debug_q__is_larger_than_maximum_page_size____is_not_Grunnable_or_Gscanrunnable_n0123456789abcdefghijklmnopqrstuvwxyz444089209850062616169452667236328125Go_pointer_stored_into_non_Go_memoryIA5String_contains_invalid_characterRoundTrip_retrying_after_failure:__vTime.UnmarshalBinary:_invalid_lengthUnable_to_determine_system_directory_WebViewSession__Got_me_some_cookiesaccessed_data_from_freed_user_arena_accessing_a_corrupted_shared_librarychacha20:_wrong_HChaCha20_nonce_sizecompressed_name_in_SRV_resource_datacrypto_cipher:_input_not_full_blockscrypto_sha1:_invalid_hash_state_sizecrypto_sha512:_invalid_hash_functionedwards25519:_invalid_point_encodingexpected_an_ECDSA_public_key__got__Thttp:_no_Location_header_in_responsehttp:_unexpected_EOF_reading_trailerinvalid_boolean_value__
mov ebx, 0x22
nop dword [rax + rax]
call fcn.00436d20
call fcn.00467420
xorps xmm15, xmm15
mov r14, qword [0x00a04c40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x58], rax
call fcn.00438660
lea rax, [0x0072c965]
mov ebx, 0x2d
call fcn.00438f60
mov rax, qword [rsp + 0x58]
nop
call fcn.00438c60
call fcn.004388c0
call fcn.004386e0
lea rax, [0x0072d74d]
mov ebx, 0x30
nop dword [rax + rax]
call fcn.00436d20
call fcn.00467420
xorps xmm15, xmm15
mov r14, qword [0x00a04c40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x58], rax
call fcn.00438660
lea rax, [0x0072c938]
mov ebx, 0x2d
call fcn.00438f60
mov rax, qword [rsp + 0x58]
nop
call fcn.00438c60
call fcn.004388c0
call fcn.004386e0
lea rax, [0x0072995b]
mov ebx, 0x25
nop dword [rax + rax]
call fcn.00436d20
nop
call fcn.00463860
jmp fcn.00433780