Function at 0x4360f0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword [0x99504c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x43643d
sub esp, 0x58
mov dword [esp + 0x24], 0
mov eax, dword [sym.imp.kernel32.dll_DuplicateHandle]
lea ecx, [esp + 0x24]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
mov dword [esp + 8], 0xfffffffe
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 2
call fcn.00436820
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4363e1
mov eax, dword [0x99504c]
mov eax, dword fs:[eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [esp + 0x50], eax
test byte [eax], al
lea ecx, [eax + 0x1b8]
mov dword [esp + 0x54], ecx
nop
mov dword [esp], ecx
call fcn.0040a350
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x50]
mov dword [ecx + 0x1bc], eax
mov eax, dword [sym.imp.kernel32.dll_GetCurrentThreadId]
mov dword [esp], eax
call fcn.00436600
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x50]
mov dword [ecx + 0x28], eax
mov dword [ecx + 0x2c], 0
mov eax, dword [ecx + 0x1c8]
test eax, eax
jne 0x43620f
movzx eax, byte [0x994f0c]
test al, al
je 0x43620f
mov eax, dword [sym.imp.kernel32.dll_CreateWaitableTimerExW]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], 0x100003
call fcn.00436730
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x50]
mov dword [ecx + 0x1c8], eax
test eax, eax
je 0x436386
nop
nop
mov eax, dword [esp + 0x54]
mov dword [esp], eax
call fcn.0040a550
lea edi, [esp + 0x34]
xor eax, eax
call fcn.004690f9
mov eax, dword [sym.imp.kernel32.dll_VirtualQuery]
lea ecx, [esp + 0x34]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 0x1c
call fcn.004366e0
mov eax, dword [esp + 0x10]
test eax, eax
je 0x43632b
mov eax, dword [esp + 0x38]
lea ecx, [eax + 0x4000]
mov dword [esp + 0x28], ecx
mov edx, dword [0x99504c]
mov edx, dword fs:[edx]
mov edx, dword [edx]
mov ebx, dword [edx + 4]
mov dword [esp + 0x30], ebx
cmp ebx, ecx
jb 0x4362a1
sub ebx, eax
lea eax, [ebx - 0x4000]
cmp eax, 0x4000000
ja 0x4362a1
mov dword [edx], ecx
mov eax, dword [edx]
add eax, 0xba0
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
call fcn.00468cb0
add esp, 0x58
ret
call fcn.0043af60
lea eax, [0x73f626]
mov dword [esp], eax
mov dword [esp + 4], 0x13
call fcn.0043b7e0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call fcn.0043b670
lea eax, [0x7ae8f8]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.0043b7e0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call fcn.0043b670
lea eax, [0x73a4cc]
mov dword [esp], eax
mov dword [esp + 4], 2
call fcn.0043b7e0
call fcn.0043afc0
lea eax, str.bad_g0_stackself_preempt__recovered_bad_recoverybad_g_statusentersyscallwirep:_p__m__p__statusreleasep:_m_sysmonwait_preemptoffcas64_failed_m__gsignal_byte_limit_nruntime:_spabi_mismatchout_of_rangeinvalid_slothost_is_downillegal_seekGetLengthSidGetLastErrorGetStdHandleGetTempPathWLoadLibraryWReadConsoleWSetEndOfFileTransmitFileGetAddrInfoWadvapi32.dlliphlpapi.dllkernel32.dllnetapi32.dllReused_port.127.0.0.1:_dexit_status_multipathtcprandautoseed___BADWIDTH_short_buffer127.0.0.1:53no_such_hostCIDR_addressunknown_portinvalid_portgetaddrinfowtransmitfile152587890625762939453125hmac_sha1_96ssh_userauthkey_exchangersa_sha2_256rsa_sha2_512direct_tcpipnot_pollableRevertToSelfCreateEventWGetConsoleCPUnlockFileExVirtualQueryreflect.CopyRCodeSuccessRCodeRefusedremote_errorc_hs_traffics_hs_trafficc_ap_traffics_ap_traffic_PRIVATE_KEYclose_notifyContent_TypeCookie.Valuecontent_typemax_forwardshttp2debug1http2debug2100_continuerecv_goaway_Multi_StatusNot_ModifiedUnauthorizedIm_a_teapotNot_ExtendedproxyconnectPUSH_PROMISECONTINUATIONinvalid_baseECDSA_SHA256ECDSA_SHA384ECDSA_SHA512Cypro_MinoanMeetei_MayekPahawh_HmongSora_SompengSyloti_NagriInstAltMatchunexpected__altmatch____anynotnl____Mime_VersionX_ImforwardsX_Powered_ByContent_Type__sensitive_SERIALNUMBERcaller_errorprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC_sweep_waitout_of_memoryunimplemented_is_nil__not_value_method_bad_map_state_span.base__bad_flushGen___not_pointer___sweepgen__MB_globals___work.nproc__work.nwait__nStackRoots_flushedWork_double_unlock_s.spanclass_MB__workersmin_too_large_byte_block__runtime:_valruntime:_seqfatal_error:__idlethreads_syscalltickload64_failedxadd64_failedxchg64_failednil_stackbase_n_tschedpc:__gp__status_pluginpath_:_unknown_pc__called_from_level_3_resetsrmount_errortimer_expiredexchange_fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynameUDP_ASSOCIATEssh_key_errorFindFirstFilegocacheverifyinstallgoroothtml_templatetlsmaxrsasize__default__q___default__v_Usage_of__s:_nlame_referral91.0.4472.12490.0.4430.21289.0.4389.1143814697265625invalid_base_parsing_time__out_of_rangehmac_sha2_256dalTLDpSugct_GetTempPath2WModule32NextWname_too_longPKCS1WithSHA1ECDSAWithSHA1key_expansionmaster_secretCLIENT_RANDOMaccess_denieduser_canceledAuthorizationAccept_RangesIf_None_MatchLast_Modified_FrameHeader_accept_rangesauthorizationcache_controlcontent_rangeif_none_matchlast_modifiedCache_ControlFQDN_too_longsocks_connectReset_ContentLoop_DetectedSTREAM_CLOSEDCONNECT_ERRORWINDOW_UPDATERegDeleteKeyWRegEnumValueWinvalid_ASN.1SHA256_RSAPSSSHA384_RSAPSSSHA512_RSAPSStrailing_dataemail_addressempty_integerunsupported:_Gunjala_GondiMasaram_GondiMende_KikakuiOld_Hungarianinvalid_UTF_8_in_host_namegzip__deflateuserArenaStateread_mem_statsallocfreetracegcstoptheworldGC_assist_waitfinalizer_waitsync.Cond.Waits.allocCount_nil_elem_type__to_finalizer_GC_worker_initruntime:_fullruntime:_wantMB__allocated_timeEndPeriod
mov dword [esp], eax
mov dword [esp + 4], 0xc
call fcn.00439230
call fcn.00469b00
mov eax, dword [esp]
mov dword [esp + 0x2c], eax
call fcn.0043af60
lea eax, [0x7486ef]
mov dword [esp], eax
mov dword [esp + 4], 0x24
call fcn.0043b7e0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call fcn.0043b4c0
call fcn.0043b170
call fcn.0043afc0
lea eax, [0x7477e8]
mov dword [esp], eax
mov dword [esp + 4], 0x22
call fcn.00439230
call fcn.00469b00
mov eax, dword [esp]
mov dword [esp + 0x2c], eax
call fcn.0043af60
lea eax, [0x74c49a]
mov dword [esp], eax
mov dword [esp + 4], 0x2d
call fcn.0043b7e0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call fcn.0043b4c0
call fcn.0043b170
call fcn.0043afc0
lea eax, [0x74d5b6]
mov dword [esp], eax
mov dword [esp + 4], 0x30
call fcn.00439230
call fcn.00469b00
mov eax, dword [esp]
mov dword [esp + 0x2c], eax
call fcn.0043af60
lea eax, [0x74c46d]
mov dword [esp], eax
mov dword [esp + 4], 0x2d
call fcn.0043b7e0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call fcn.0043b4c0
call fcn.0043b170
call fcn.0043afc0
lea eax, [0x748e44]
mov dword [esp], eax
mov dword [esp + 4], 0x25
call fcn.00439230
nop
call fcn.00467a60
jmp fcn.004360f0