Function at 0x14ebc
Capabilities:
Reference http user-agent string
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x4f8
mov rax, qword [0x0001a100]
xor rax, rsp
mov qword [rsp + 0x4e0], rax
mov rax, qword [rsp + 0x560]
or qword [rsp + 0x60], 0xffffffffffffffff
mov rbx, rcx
mov r14, r8
mov r15, rdx
mov edi, 0x206
lea rcx, [rsp + 0xc2]
xor ebp, ebp
mov r8, rdi
xor edx, edx
mov qword [rsp + 0x68], rax
mov r13d, r9d
mov word [rsp + 0xc0], bp
call fcn.00017cd0
lea rcx, [rsp + 0x2d2]
mov r8, rdi
xor edx, edx
mov word [rsp + 0x2d0], bp
call fcn.00017cd0
xor eax, eax
mov edi, 0x104
lea r8, [0x0001a150]
lea rcx, [rsp + 0xc0]
mov rdx, rdi
mov word [rsp + 0xa8], bp
mov qword [rsp + 0xaa], rax
mov dword [rsp + 0xb2], eax
mov word [rsp + 0xb6], ax
mov r12d, ebp
call fcn.00011008
lea r8, [0x00018430]
lea rcx, [rsp + 0xc0]
mov rdx, rdi
call fcn.00011080
lea r8, [0x0003bba0]
lea rcx, [rsp + 0x2d0]
mov rdx, rdi
call fcn.00011008
lea r8, [0x00018440]
lea rcx, [rsp + 0x2d0]
mov rdx, rdi
call fcn.00011080
movsxd rdi, dword [0x0001a148]
lea rax, [0x0001a360]
mov rcx, rdi
lea r8, [rsp + 0x2d0]
mov edx, 0x208
imul rcx, rcx, 0x208
add rcx, rax
call fcn.00011080
inc edi
mov dword [0x0001a148], edi
call fcn.00017864
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x152c4
lea eax, [rbp + 2]
lea ecx, [rbp + 8]
mov word [rsp + 0xa8], ax
movzx eax, r13w
ror ax, cl
mov rcx, r15
mov word [rsp + 0xaa], ax
call fcn.000171fc
lea edi, [rbp + 0x10]
lea rdx, [rsp + 0xa8]
mov r8d, edi
mov rcx, rsi
mov dword [rsp + 0xac], eax
call fcn.00017464
cmp eax, ebp
jl 0x1506c
mov ebp, 0x2800
xor edx, edx
mov rcx, rbx
mov r8, rbp
call fcn.00017cd0
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r15
jmp 0x150b2
mov rcx, r14
call fcn.000171fc
lea rdx, [rsp + 0xa8]
mov r8d, edi
mov rcx, rsi
mov dword [rsp + 0xac], eax
call fcn.00017464
cmp eax, ebp
jl 0x152bc
mov ebp, 0x2800
xor edx, edx
mov rcx, rbx
mov r8, rbp
call fcn.00017cd0
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r14
mov r9, qword [rsp + 0x68]
lea r8, [0x00018350]
mov rdx, rbp
mov rcx, rbx
call fcn.00011ba0
xor r13d, r13d
cmp eax, r13d
mov ecx, eax
jl 0x152c9
xor eax, eax
or r14, 0xffffffffffffffff
mov rdi, rbx
mov rcx, r14
xor r9d, r9d
mov rdx, rbx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, rsi
call fcn.00017744
cmp eax, r13d
jl 0x152bc
xor eax, eax
lea rdi, [rsp + 0xc0]
mov rcx, r14
repne scasw ax, word [rdi]
mov byte [0x0001a110], r13b
not rcx
cmp rcx, 1
je 0x152ae
mov rax, cr8
cmp al, r13b
jne 0x152ae
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0xa8]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [rsp + 0x50], r13d
mov qword [rsp + 0x48], r13
mov dword [rsp + 0x40], 0x20
mov dword [rsp + 0x38], 5
lea rax, [rsp + 0xa8]
mov dword [rsp + 0x30], 2
lea r9, [rsp + 0x68]
lea r8, [rsp + 0x78]
lea rcx, [rsp + 0x60]
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], r13
mov dword [rsp + 0x78], 0x30
mov qword [rsp + 0x80], r13
mov dword [rsp + 0x90], 0x240
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x98], r13
mov qword [rsp + 0xa0], r13
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
cmp eax, r13d
jl 0x152ae
mov r8, rbp
xor edx, edx
mov rcx, rbx
call fcn.00017cd0
xor r9d, r9d
mov r8d, 0x27d8
mov rdx, rbx
mov rcx, rsi
call fcn.00017660
mov rcx, qword [rsp + 0x60]
movsxd rdx, eax
cmp edx, r13d
jle 0x15260
add r12d, edx
mov byte [rdx + rbx], r13b
mov byte [0x0001a110], r13b
cmp rcx, r13
je 0x15254
cmp rbx, r13
je 0x15254
mov rax, cr8
cmp al, r13b
jne 0x15254
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r13
mov dword [rsp + 0x30], edx
lea rax, [rsp + 0xa8]
xor edx, edx
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwWriteFile]
mov byte [0x0001a110], 1
jmp 0x151d7
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov byte [0x0001a110], r13b
cmp r12d, dword [rsp + 0x570]
jne 0x152a1
mov rcx, rsi
call fcn.00017378
lea rdx, [0x0001a150]
lea rcx, [rsp + 0xc0]
call fcn.000119e4
mov ecx, 0xc0000001
cmp eax, r13d
cmovge ecx, r13d
jmp 0x152b3
lea rcx, [rsp + 0xc0]
call fcn.00011990
mov ecx, 0xc0000001
mov byte [0x0001a110], 1
jmp 0x152c9
mov rcx, rsi
call fcn.00017378
mov ecx, 0xc0000001
mov eax, ecx
mov rcx, qword [rsp + 0x4e0]
xor rcx, rsp
call fcn.00017920
add rsp, 0x4f8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret