Function at 0x4353a0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
lea rax, [rsp - 0x30]
cmp rax, qword [rcx + 0x10]
jbe 0x435760
sub rsp, 0xb0
mov qword [rsp + 0xa8], rbp
lea rbp, [rsp + 0xa8]
mov qword [rsp + 0x48], 0
mov rax, qword [sym.imp.kernel32.dll_DuplicateHandle]
lea rcx, [rsp + 0x48]
mov qword [rsp], rax
mov qword [rsp + 8], 0xffffffffffffffff
mov qword [rsp + 0x10], 0xfffffffffffffffe
mov qword [rsp + 0x18], 0xffffffffffffffff
mov qword [rsp + 0x20], rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], 2
call fcn.00435c60
cmp qword [rsp + 0x40], 0
je 0x435700
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x98], rax
test byte [rax], al
lea rcx, [rax + 0x328]
mov qword [rsp + 0xa0], rcx
nop
mov qword [rsp], rcx
call fcn.0040bfe0
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x98]
mov qword [rcx + 0x330], rax
cmp qword [rcx + 0x348], 0
jne 0x435493
cmp byte [0x008110d2], 0
jne 0x435562
nop
nop
mov rax, qword [rsp + 0xa0]
mov qword [rsp], rax
call fcn.0040c240
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
movups xmmword [rsp + 0x78], xmm0
movups xmmword [rsp + 0x88], xmm0
mov rax, qword [sym.imp.kernel32.dll_VirtualQuery]
lea rcx, [rsp + 0x68]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], 0x30
nop
call fcn.00435ae0
cmp qword [rsp + 0x20], 0
je 0x435640
mov rax, qword [rsp + 0x70]
lea rcx, [rax + 0x4000]
mov qword [rsp + 0x50], rcx
mov rdx, qword gs:[0x28]
mov rdx, qword [rdx]
mov rbx, qword [rdx + 8]
mov qword [rsp + 0x60], rbx
nop dword [rax + rax]
cmp rcx, rbx
ja 0x4355ae
sub rbx, rax
add rbx, 0xffffffffffffc000
cmp rbx, 0x4000000
ja 0x4355ae
mov qword [rdx], rcx
add rax, 0x53a0
mov qword [rdx + 0x10], rax
mov qword [rdx + 0x18], rax
call fcn.0046c720
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov rax, qword [sym.imp.kernel32.dll_CreateWaitableTimerExW]
mov qword [rsp], rax
xorps xmm0, xmm0
movups xmmword [rsp + 8], xmm0
mov qword [rsp + 0x18], 2
mov qword [rsp + 0x20], 0x100003
call fcn.00435b40
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x98]
mov qword [rcx + 0x348], rax
test rax, rax
jne 0x435493
jmp 0x4356a0
call fcn.0043aa00
lea rax, [0x0065e5f2]
mov qword [rsp], rax
mov qword [rsp + 8], 0x13
call fcn.0043b480
mov rax, qword [rsp + 0x50]
mov qword [rsp], rax
call fcn.0043b2a0
lea rax, [0x0065a2a3]
mov qword [rsp], rax
mov qword [rsp + 8], 1
call fcn.0043b480
mov rax, qword [rsp + 0x60]
mov qword [rsp], rax
nop dword [rax]
call fcn.0043b2a0
lea rax, [0x0065a2d0]
mov qword [rsp], rax
mov qword [rsp + 8], 2
call fcn.0043b480
nop
call fcn.0043aaa0
lea rax, [0x0065c0b3]
mov qword [rsp], rax
mov qword [rsp + 8], 0xc
call fcn.00439220
nop
call fcn.0046e160
mov eax, dword [rsp]
mov qword [rsp + 0x58], rax
call fcn.0043aa00
lea rax, [0x00664d60]
mov qword [rsp], rax
mov qword [rsp + 8], 0x24
call fcn.0043b480
mov rax, qword [rsp + 0x58]
mov qword [rsp], rax
call fcn.0043b100
call fcn.0043ace0
nop
call fcn.0043aaa0
lea rax, [0x00664024]
mov qword [rsp], rax
mov qword [rsp + 8], 0x22
call fcn.00439220
nop
call fcn.0046e160
mov eax, dword [rsp]
mov qword [rsp + 0x58], rax
call fcn.0043aa00
lea rax, [0x00666fbe]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2d
call fcn.0043b480
mov rax, qword [rsp + 0x58]
mov qword [rsp], rax
call fcn.0043b100
call fcn.0043ace0
nop
call fcn.0043aaa0
lea rax, [0x00667692]
mov qword [rsp], rax
mov qword [rsp + 8], 0x30
call fcn.00439220
nop
call fcn.0046e160
mov eax, dword [rsp]
mov qword [rsp + 0x58], rax
call fcn.0043aa00
lea rax, [0x00666f91]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2d
call fcn.0043b480
mov rax, qword [rsp + 0x58]
mov qword [rsp], rax
call fcn.0043b100
call fcn.0043ace0
nop
call fcn.0043aaa0
lea rax, [0x00665318]
mov qword [rsp], rax
mov qword [rsp + 8], 0x25
call fcn.00439220
nop
nop
call fcn.0046abe0
jmp fcn.004353a0