Function at 0x17110
Capabilities:
Reference http user-agent string

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x488
mov rax, qword [0x0001c100]
xor rax, rsp
mov qword [rsp + 0x470], rax
or qword [rsp + 0x30], 0xffffffffffffffff
mov r15, rcx
mov r13d, r8d
mov r14, rdx
mov edi, 0x206
lea rcx, [rsp + 0x52]
xor esi, esi
mov r8, rdi
xor edx, edx
mov qword [rsp + 0x38], r9
mov word [rsp + 0x50], si
call fcn.00019aa0
lea rcx, [rsp + 0x262]
mov r8, rdi
xor edx, edx
mov word [rsp + 0x260], si
call fcn.00019aa0
lea ecx, [rsi + 1]
mov edx, 0x400
mov r8d, 0x6473656e
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
lea ecx, [rsi + 1]
mov edx, 0x2800
mov r8d, 0x72656364
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov r12d, esi
mov esi, 0x104
lea r8, [0x000dcb30]
lea rcx, [rsp + 0x50]
mov rdx, rsi
mov rbp, rax
call fcn.00011e34
lea r8, [0x0001ad40]
lea rcx, [rsp + 0x50]
mov rdx, rsi
call fcn.00011eac
lea r8, [0x000fe5b0]
lea rcx, [rsp + 0x260]
mov rdx, rsi
call fcn.00011e34
lea r8, [0x0001ad50]
lea rcx, [rsp + 0x260]
mov rdx, rsi
call fcn.00011eac
movsxd rdi, dword [0x000dc2ec]
lea rax, [0x000dd160]
mov rcx, rdi
lea r8, [rsp + 0x260]
mov rdx, rsi
imul rcx, rcx, 0x208
add rcx, rax
call fcn.00011eac
inc edi
mov dword [0x000dc2ec], edi
call fcn.0001942c
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1744d
mov eax, 2
mov word [rsp + 0x40], ax
lea ecx, [rax + 6]
movzx eax, r13w
ror ax, cl
mov rcx, r15
mov word [rsp + 0x42], ax
call fcn.00018dd8
mov edi, 0x10
lea rdx, [rsp + 0x40]
mov r8d, edi
mov rcx, rsi
mov dword [rsp + 0x44], eax
call fcn.0001902c
test eax, eax
js 0x172ac
mov edi, 0x400
xor edx, edx
mov rcx, rbx
mov r8, rdi
call fcn.00019aa0
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r15
jmp 0x172ec
mov rcx, r14
call fcn.00018dd8
lea rdx, [rsp + 0x40]
mov r8d, edi
mov rcx, rsi
mov dword [rsp + 0x44], eax
call fcn.0001902c
test eax, eax
js 0x17445
mov edi, 0x400
xor edx, edx
mov rcx, rbx
mov r8, rdi
call fcn.00019aa0
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r14
mov r9, qword [rsp + 0x38]
lea r8, [0x0001ac90]
mov rdx, rdi
mov rcx, rbx
call fcn.000118e0
xor r13d, r13d
cmp eax, r13d
jl 0x17452
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
xor r9d, r9d
mov rdx, rbx
not rcx
lea r8, [rcx - 1]
mov rcx, rsi
call fcn.0001930c
cmp eax, r13d
jl 0x17445
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
mov byte [0x000dc268], r13b
call fcn.000115bc
cmp eax, r13d
jl 0x1740f
mov edi, 0x2800
mov r8, rdi
xor edx, edx
mov rcx, rbp
call fcn.00019aa0
xor r9d, r9d
mov r8d, edi
mov rdx, rbp
mov rcx, rsi
call fcn.00019228
cmp eax, r13d
jle 0x173ac
movsxd rcx, eax
xor r9d, r9d
mov r8d, eax
mov byte [rcx + rbp], r13b
mov rcx, qword [rsp + 0x30]
mov rdx, rbp
add r12d, eax
mov byte [0x000dc268], r13b
call fcn.000116b8
mov byte [0x000dc268], 1
jmp 0x1735c
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
cmp r12d, r13d
mov rcx, rsi
mov edi, eax
cmovg edi, r13d
call fcn.00018f54
mov byte [0x000dc268], r13b
cmp r12d, dword [rsp + 0x4f8]
jne 0x17403
mov edx, 0x1018
mov ecx, 1
mov r8d, 0x666c726e
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
cmp rax, r13
je 0x17414
lea rcx, [rsp + 0x50]
mov rdx, rax
call fcn.00011760
jmp 0x17414
lea rcx, [rsp + 0x50]
call fcn.0001170c
jmp 0x17414
mov edi, 0xc0000001
mov byte [0x000dc268], 1
cmp rbx, r13
je 0x1742e
mov edx, 0x6473656e
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
cmp rbp, r13
je 0x17441
mov edx, 0x72656364
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, edi
jmp 0x17452
mov rcx, rsi
call fcn.00018f54
mov eax, 0xc0000001
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.000196e0
add rsp, 0x488
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret