Function at 0x140004ec0
Capabilities:
Generate random numbers using a mersenne twister
Reference http user-agent string

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rax, qword [0x1400f2260]
lea r8, [0x1400f18a0]
mov rbx, rcx
cmp rax, 0x26f
ja 0x140004f98
lea rdx, [rax + 1]
mov eax, dword [r8 + rax*4]
mov qword [0x1400f2260], rdx
mov edx, eax
shr edx, 0xb
xor eax, edx
mov edx, eax
shl edx, 7
and edx, 0x9d2c5680
xor eax, edx
mov edx, eax
shl edx, 0xf
and edx, 0xefc60000
xor eax, edx
mov edx, eax
shr edx, 0x12
xor eax, edx
lea rdx, str.Mozilla_5.0__X11__Linux_x86_64__rv:109.0__Gecko_20100101_Firefox_115.0
and eax, 1
mov rbp, qword [rdx + rax*8]
lea rax, [rbx + 0x10]
mov qword [rbx], rax
test rbp, rbp
je 0x140004ffd
mov rcx, rbp
call sub.msvcrt.dll_wcslen
lea rdi, [rax + rax]
mov rsi, rax
mov r12, rdi
sar r12, 1
cmp rdi, 0xe
ja 0x140004fb0
mov rcx, qword [rbx]
cmp r12, 1
jne 0x140004f80
movzx eax, word [rbp]
mov word [rcx], ax
xor eax, eax
mov qword [rbx + 8], r12
mov word [rcx + rsi*2], ax
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
test r12, r12
je 0x140004f67
mov r8, rdi
mov rdx, rbp
call sub.msvcrt.dll_memcpy
mov rcx, qword [rbx]
jmp 0x140004f67
mov rcx, r8
call fcn.1400a2140
mov rax, qword [0x1400f2260]
jmp 0x140004ee7
movabs rax, 0x7ffffffffffffffe
cmp rax, rdi
jb 0x140005009
movabs rax, 0x3fffffffffffffff
cmp r12, rax
je 0x140004ff8
lea rcx, [rdi + 2]
call fcn.1400bbc20
mov qword [rbx + 0x10], r12
mov r8, rdi
mov rdx, rbp
mov qword [rbx], rax
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov rcx, qword [rbx]
jmp 0x140004f67
call fcn.1400bdfe0
lea rcx, [0x1400c3100]
call fcn.1400be0e0
lea rcx, [0x1400c3015]
call fcn.1400be1d0
nop
nop word cs:[rax + rax]
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
lea rdi, [rsp + 0x70]
mov rsi, rcx
mov rcx, rdi
call fcn.140004ec0
mov rcx, qword [rsp + 0x70]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 0
mov edx, 1
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov rcx, rdi
mov qword [rsp + 0x60], rax
xor edi, edi
lea r15, [rsi + 8]
call fcn.1400aa490
lea rax, [rsi + 0x208]
mov qword [rsp + 0x68], r15
mov rbp, qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov qword [rsp + 0x48], rax
lea rax, [rsi + 0x408]
lea r14, [0x1400c0050]
mov qword [rsp + 0x58], rax
lea r12, [rsi + 0x608]
nop word cs:[rax + rax]
movzx r8d, word [rsi + 6]
mov rdx, qword [rsp + 0x68]
xor r9d, r9d
mov r13, rsi
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov rbx, rax
movsx eax, byte [rsi + 5]
xor r15d, r15d
bt eax, r15d
jae 0x140005178
movzx eax, byte [r13 + 4]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
mov rcx, rbx
mov rdx, qword [r14 + r15*8]
mov r8, qword [rsp + 0x48]
mov qword [rsp + 0x20], rdi
shl eax, 0x17
mov dword [rsp + 0x30], eax
call qword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
xor r9d, r9d
mov rsi, rax
mov eax, dword [r13 + 0x734]
test eax, eax
cmovne r9, r12
cmp word [r13 + 0x408], 0
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], eax
je 0x140005198
mov rdx, qword [rsp + 0x58]
mov r8d, 0xffffffff
mov rcx, rsi
call qword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
mov rcx, rsi
mov dword [rsp + 0x54], eax
call rbp
mov ecx, dword [r13]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [rsp + 0x54]
test edx, edx
je 0x1400051a0
movsx eax, byte [r13 + 5]
test r15, r15
jne 0x1400050d2
mov r15d, 1
bt eax, r15d
jb 0x1400050df
jmp 0x140005178
xor r8d, r8d
xor edx, edx
jmp 0x140005144
mov rsi, r13
mov rcx, rbx
call rbp
jmp 0x1400050b0