Function at 0x18000c530
Capabilities:
Reference http user-agent string

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xb40
mov byte [rsp + 0xaf8], 0
lea rdi, [rsp + 0xaf9]
xor eax, eax
mov ecx, 0x3b
rep stosb byte [rdi], al
mov qword [rsp + 0x98], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0xb0], 0
mov dword [rsp + 0xaf0], 0
mov dword [rsp + 0xb8], 0
mov dword [rsp + 0x90], 0
mov dword [rsp + 0xa0], 0
mov byte [rsp + 0xc0], 0
lea rdi, [rsp + 0xc1]
xor eax, eax
mov ecx, 0xa27
rep stosb byte [rdi], al
mov r8d, 0x6f6a386b
mov edx, 0x3f7a0
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsp + 0xa8], rax
cmp qword [rsp + 0xa8], 0
jne 0x18000c5fb
mov eax, 0xc0000001
jmp 0x18000ca51
mov qword [rsp + 0x40], 0
lea rdi, [rsp + 0x48]
xor eax, eax
mov ecx, 0x40
rep stosb byte [rdi], al
mov rax, qword [rsp + 0xb60]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xb58]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0xb50]
lea r8, str.GET___s_HTTP_1.1_r_nHost:__s:_s_r_nAccept:text_html__application_xhtmlxml__image_jxr____r_nAccept_Language:_zh_Hans_CN__zh_Hans__q0.8__en_US__q0.5__en__q0.3_r_nUser_Agent:_Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_46.0.2486.0_Safari_537.36_Edge_13.10586_r_nConnection:Keep_Alive_r_n_r_n
mov edx, 0xa28
lea rcx, [rsp + 0xc0]
call fcn.18000c4a0
lea r8, [rsp + 0x40]
mov rdx, qword [rsp + 0xb60]
mov rcx, qword [rsp + 0xb58]
call fcn.18000cbb0
mov dword [rsp + 0xbc], eax
cmp dword [rsp + 0xbc], 0
jge 0x18000c67d
jmp 0x18000ca14
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0xc0]
call fcn.18000d7c0
mov dword [rsp + 0xbc], eax
cmp dword [rsp + 0xbc], 0
jl 0x18000ca14
jmp 0x18000c6ab
mov r8d, 0x3f7a0
xor edx, edx
mov rcx, qword [rsp + 0xa8]
call fcn.180014bb0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0xb0], 0
mov dword [rsp + 0x90], 0
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x90]
mov edx, 0x3f7a0
mov rcx, qword [rsp + 0xa8]
call fcn.18000db30
mov dword [rsp + 0xbc], eax
cmp dword [rsp + 0xbc], 0
jl 0x18000c9f7
jmp 0x18000c71b
lea rcx, [0x180016c48]
call sub.ntoskrnl.exe_strlen
mov rdi, rax
lea rcx, [0x180016c50]
call sub.ntoskrnl.exe_strlen
mov r8, rax
lea rdx, str.HTTP_1.
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.ntoskrnl.exe_RtlCompareMemory]
cmp rdi, rax
jne 0x18000c8d9
lea rcx, [0x180016c60]
call sub.ntoskrnl.exe_strlen
mov rdi, rax
lea rcx, [0x180016c70]
call sub.ntoskrnl.exe_strlen
mov r8, rax
lea rdx, str.HTTP_1.1_200_OK
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.ntoskrnl.exe_RtlCompareMemory]
cmp rdi, rax
jne 0x18000c8c9
lea rdx, [0x180016c90]
mov rcx, qword [rsp + 0xa8]
call sub.ntoskrnl.exe_strstr
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x18000c8b7
lea rdx, [0x180016ca4]
mov rcx, qword [rsp + 0x30]
call sub.ntoskrnl.exe_strstr
mov qword [rsp + 0xb0], rax
cmp qword [rsp + 0xb0], 0
je 0x18000c8a5
mov rax, qword [rsp + 0x30]
mov rdi, qword [rsp + 0xb0]
sub rdi, rax
lea rcx, [0x180016ca8]
call sub.ntoskrnl.exe_strlen
sub rdi, rax
lea rcx, str.Content_Length:
call sub.ntoskrnl.exe_strlen
mov rdx, qword [rsp + 0x30]
add rdx, rax
mov r8, rdi
lea rcx, [rsp + 0xaf8]
call fcn.180014cb0
lea rcx, [rsp + 0xaf8]
call sub.ntoskrnl.exe_atoi
mov dword [rsp + 0xaf0], eax
mov eax, dword [rsp + 0xaf0]
add eax, 4
mov edx, eax
mov r8d, 0x6f6a386b
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsp + 0x98], rax
mov rcx, qword [rsp + 0xb70]
mov rax, qword [rsp + 0x98]
mov qword [rcx], rax
cmp qword [rsp + 0x98], 0
jne 0x18000c887
mov dword [rsp + 0xbc], 0xc0000001
jmp 0x18000ca14
mov eax, dword [rsp + 0xaf0]
add eax, 4
mov r8d, eax
xor edx, edx
mov rcx, qword [rsp + 0x98]
call fcn.180014bb0
jmp 0x18000c8b5
mov dword [rsp + 0xbc], 0xc0000001
jmp 0x18000ca14
jmp 0x18000c8c7
mov dword [rsp + 0xbc], 0xc0000001
jmp 0x18000ca14
jmp 0x18000c8d9
mov dword [rsp + 0xbc], 0xc0000001
jmp 0x18000ca14
lea rdx, [0x180016cd4]
mov rcx, qword [rsp + 0xa8]
call sub.ntoskrnl.exe_strstr
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x98], 0
jne 0x18000c902
jmp 0x18000ca14
cmp qword [rsp + 0x30], 0
je 0x18000c9a5
cmp qword [rsp + 0xb0], 0
je 0x18000c9a5
mov edi, dword [rsp + 0x90]
lea rcx, [0x180016cdc]
call sub.ntoskrnl.exe_strlen
mov rcx, qword [rsp + 0x30]
add rcx, rax
sub rcx, qword [rsp + 0xa8]
mov rax, rdi
sub rax, rcx
mov dword [rsp + 0xb38], eax
cmp dword [rsp + 0xb38], 0
jbe 0x18000c98c
mov edi, dword [rsp + 0xb38]
lea rcx, str._r_n_r_n
call sub.ntoskrnl.exe_strlen
mov rdx, qword [rsp + 0x30]
add rdx, rax
mov eax, dword [rsp + 0xb8]
mov rcx, qword [rsp + 0x98]
add rcx, rax
mov r8, rdi
call fcn.180014cb0
mov ecx, dword [rsp + 0xb38]
mov eax, dword [rsp + 0xb8]
add eax, ecx
mov dword [rsp + 0xb8], eax
jmp 0x18000c9e3
mov r8d, dword [rsp + 0x90]
mov eax, dword [rsp + 0xb8]
mov rcx, qword [rsp + 0x98]
add rcx, rax
mov rdx, qword [rsp + 0xa8]
call fcn.180014cb0
mov edx, dword [rsp + 0x90]
mov eax, dword [rsp + 0xb8]
add eax, edx
mov dword [rsp + 0xb8], eax
mov eax, dword [rsp + 0xaf0]
cmp dword [rsp + 0xb8], eax
jb 0x18000c6ab
cmp dword [rsp + 0xbc], 0
jge 0x18000ca03
jmp 0x18000ca14
mov rcx, qword [rsp + 0xb68]
mov eax, dword [rsp + 0xb8]
mov dword [rcx], eax
cmp qword [rsp + 0xa8], 0
je 0x18000ca3e
mov edx, 0x6f6a386b
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov qword [rsp + 0xa8], 0
lea rcx, [rsp + 0x40]
call fcn.18000de80
jmp 0x18000ca4a
mov eax, dword [rsp + 0xbc]
add rsp, 0xb40
pop rdi
ret