Function at 0x1800048c0
Capabilities:
Reference http user-agent string

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x550
mov qword [rsp + 0x128], 0xfffffffffffffffe
mov rax, qword [0x180065480]
xor rax, rsp
mov qword [rsp + 0x540], rax
mov qword [rsp + 0xb8], r9
mov qword [rsp + 0xa8], r8
mov rdi, rdx
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0xc8], rcx
mov qword [rsp + 0x108], rdx
mov rax, qword [rsp + 0x590]
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x598]
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x5a0]
mov qword [rsp + 0x118], rax
mov qword [rsp + 0xf8], rax
mov rax, qword [rsp + 0x5a8]
mov qword [rsp + 0xd0], rax
call fcn.180019554
mov rdx, rax
xor ebx, ebx
mov ecx, ebx
test rax, rax
setne cl
test ecx, ecx
jne 0x18000497a
mov ecx, 0x80004005
call fcn.180002660
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x90], rax
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0xc0], rbx
mov esi, 1
mov dword [rsp + 0x4c], esi
mov dword [rsp + 0x98], ebx
call fcn.180019554
mov rdx, rax
mov ecx, ebx
test rax, rax
setne cl
test ecx, ecx
jne 0x1800049ce
mov ecx, 0x80004005
call fcn.180002660
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x50], rax
mov r8d, 5
lea rdx, [rsp + 0x120]
mov rcx, rdi
call fcn.180015de0
lea rdx, str.https
mov rcx, qword [rax]
call fcn.18002cffc
test eax, eax
sete byte [rsp + 0x48]
mov rdx, qword [rsp + 0x120]
add rdx, 0xffffffffffffffe8
or rdi, 0xffffffffffffffff
mov eax, edi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180004a32
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, ebx
cmp byte [rsp + 0x48], al
cmovne eax, esi
mov dword [rsp + 0x70], eax
mov rcx, qword [rsp + 0x80]
call fcn.180015f50
mov rcx, qword [rsp + 0x88]
call fcn.180015f50
nop
call fcn.180019554
mov r11, rax
mov ecx, ebx
test rax, rax
setne cl
test ecx, ecx
jne 0x180004a79
mov ecx, 0x80004005
call fcn.180002660
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x60], rax
call fcn.180019554
mov r11, rax
mov ecx, ebx
test rax, rax
setne cl
test ecx, ecx
jne 0x180004aaa
mov ecx, 0x80004005
call fcn.180002660
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x78]
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0xf0]
mov rcx, qword [rsp + 0x68]
mov rcx, qword [rcx]
call fcn.1800189c8
mov qword [rsp + 0x20], rbx
xor r9d, r9d
movzx r8d, word [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0xc8]
call fcn.18001939c
mov rsi, rax
mov qword [rsp + 0xb0], rax
mov eax, 0x24280040
mov ecx, 0x24a80040
cmp dword [rsp + 0x70], 0
cmovne eax, ecx
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], 1
mov r9, qword [rsp + 0xa8]
mov r8, qword [rsp + 0x78]
mov edx, 1
mov rcx, rsi
call fcn.1800194fc
mov rbx, rax
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0xd0]
mov eax, dword [rax + 0x214c]
cmp eax, 1
jne 0x180004bd6
mov r9d, edi
mov r8d, 0x10000000
lea rdx, str.Connection:_keep_alive
mov rcx, rbx
call fcn.180017640
mov r9d, edi
mov r8d, 0x10000000
lea rdx, str.Accept:__
mov rcx, rbx
call fcn.180017640
mov r9d, edi
mov r8d, 0x10000000
lea rdx, str.Accept_Charset:_utf_8_q0.7__q0.3
mov rcx, rbx
call fcn.180017640
mov r9d, edi
mov r8d, 0x10000000
lea rdx, str.Accept_Language:_en_q0.8
mov rcx, rbx
call fcn.180017640
jmp 0x180004d07
cmp eax, 2
jne 0x180004c40
mov r9d, edi
mov r8d, 0x10000000
lea rdx, str.Connection:_keep_alive
mov rcx, rbx
call fcn.180017640
mov r9d, edi
mov r8d, 0x10000000
lea rdx, str.Accept:__
mov rcx, rbx
call fcn.180017640
mov r9d, edi
mov r8d, 0x10000000
lea rdx, str.Accept_Charset:_utf_8_q0.7__q0.3
mov rcx, rbx
call fcn.180017640
mov r9d, edi
mov r8d, 0x10000000
lea rdx, str.Accept_Language:_en_q0.8
mov rcx, rbx
call fcn.180017640
jmp 0x180004d07
cmp eax, 3
jne 0x180004ca7
mov r9d, edi
mov r8d, 0x10000000
lea rdx, str.Connection:_keep_alive
mov rcx, rbx
call fcn.180017640
mov r9d, edi
mov r8d, 0x10000000
lea rdx, str.Accept:__
mov rcx, rbx
call fcn.180017640
mov r9d, edi
mov r8d, 0x10000000
lea rdx, str.Accept_Charset:_utf_8_q0.7__q0.3
mov rcx, rbx
call fcn.180017640
mov r9d, edi
mov r8d, 0x10000000
lea rdx, str.Accept_Language:_en_q0.8
mov rcx, rbx
call fcn.180017640
jmp 0x180004d07
mov r9d, edi
mov r8d, 0x10000000
lea rdx, str.Connection:_keep_alive
mov rcx, rbx
call fcn.180017640
mov r9d, edi
mov r8d, 0x10000000
lea rdx, str.Accept:__
mov rcx, rbx
call fcn.180017640
mov r9d, edi
mov r8d, 0x10000000
lea rdx, str.Accept_Charset:_GBK_utf_8_q0.7__q0.3
mov rcx, rbx
call fcn.180017640
mov r9d, edi
mov r8d, 0x10000000
lea rdx, str.Accept_Language:_zh_CN_zh_q0.8
mov rcx, rbx
call fcn.180017640
mov r9d, edi
mov r8d, 0x10000000
lea rdx, str.User_Agent:_Mozilla_5.0__Windows_NT_6.1__WOW64__AppleWebKit_537.11__KHTML__like_Gecko__Chrome_23.0.1271.95_Safari_537.11
mov rcx, rbx
call fcn.180017640
mov rax, qword [rsp + 0xb8]
test rax, rax
je 0x180004d40
mov r9d, edi
mov r8d, 0x10000000
mov rdx, rax
mov rcx, rbx
call fcn.180017640
xor eax, eax
mov dword [rsp + 0x20], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.1800188e8
lea r9, [rsp + 0x98]
mov r8, qword [rsp + 0x88]
mov edx, socket
mov rcx, rbx
call fcn.180018c34
lea rdx, [rsp + 0x4c]
mov rcx, rbx
call fcn.180017694
mov eax, dword [rsp + 0x4c]
cmp eax, 0x12d
je 0x180004e68
cmp eax, 0x12e
je 0x180004e68
cmp eax, 0x12f
je 0x180004e68
mov rax, qword [rbx]
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [rax + 0xb0]
test eax, eax
je 0x180004e0d
lea r8, [0x180054044]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x110]
call fcn.180015e80
nop
mov rdx, qword [rax]
mov r8d, dword [rdx - 0x10]
mov rcx, qword [rsp + 0x80]
call fcn.180016650
nop
mov rdx, qword [rsp + 0x110]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180004da5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x180004da5
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x98]
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x18]
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180004e43
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180004e63
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
jmp 0x180005359
call fcn.180019554
mov rcx, rax
test rax, rax
mov eax, 0
setne al
test eax, eax
jne 0x180004e8a
mov ecx, 0x80004005
call fcn.180002660
int3
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
xor r9d, r9d
lea r8, [rsp + 0x40]
lea edx, [r9 + 0x16]
mov rcx, rbx
call fcn.180018c34
mov rcx, qword [rsp + 0x40]
cmp dword [rcx - 0x10], 0
jl 0x1800051d1
lea rdx, str.Location:
call fcn.18002d308
test rax, rax
je 0x1800051d1
sub eax, dword [rsp + 0x40]
cmp eax, 0xffffffff
je 0x1800051d1
lea r8d, [rax + 0xa]
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0x40]
call fcn.180015ce0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rax, qword [rsp + 0x40]
add rax, 0xffffffffffffffe8
mov qword [rsp + 0x70], rax
cmp rcx, rax
je 0x180004f67
cmp dword [rax + 0x10], 0
jl 0x180004f58
mov rax, qword [rax]
cmp qword [rcx], rax
jne 0x180004f58
call fcn.1800165c0
mov qword [rsp + 0xa0], rax
mov ecx, edi
mov rdx, qword [rsp + 0x70]
lock xadd dword [rdx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x180004f4d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rsp + 0xa0]
add rax, 0x18
mov qword [rsp + 0x40], rax
jmp 0x180004f67
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x40]
call fcn.180016470
nop
mov rdx, qword [rsp + 0xd8]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180004f89
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x40]
cmp dword [rcx - 0x10], 0
jle 0x180005061
mov edx, 0xa
call fcn.18002d840
test rax, rax
je 0x180005061
sub eax, dword [rsp + 0x40]
test eax, eax
jle 0x180005061
mov r8d, eax
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0x40]
call fcn.180015de0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rax, qword [rsp + 0x40]
add rax, 0xffffffffffffffe8
mov qword [rsp + 0xa0], rax
cmp rcx, rax
je 0x18000503f
cmp dword [rax + 0x10], 0
jl 0x180005030
mov rax, qword [rax]
cmp qword [rcx], rax
jne 0x180005030
call fcn.1800165c0
mov qword [rsp + 0x70], rax
mov ecx, edi
mov rdx, qword [rsp + 0xa0]
lock xadd dword [rdx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x180005025
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rsp + 0x70]
add rax, 0x18
mov qword [rsp + 0x40], rax
jmp 0x18000503f
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x40]
call fcn.180016470
nop
mov rdx, qword [rsp + 0x100]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180005061
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x98]
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x18]
mov rax, qword [rsi]
mov edx, 1
mov rcx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x40]
add rcx, 0xffffffffffffffe8
call fcn.1800165c0
add rax, 0x18
mov qword [rsp + 0xe0], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x118]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0xb8]
mov r8, qword [rsp + 0xa8]
lea rdx, [rsp + 0xe0]
mov rcx, qword [rsp + 0xc8]
call fcn.1800048c0
mov ebx, eax
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180005127
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180005147
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180005167
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180005187
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x90]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800051aa
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rax, qword [rsp + 0x68]
mov rdx, qword [rax]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], edi
dec edi
test edi, edi
jg 0x1800051ca
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, ebx
jmp 0x1800053e8
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x98]
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x18]
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rsi]
mov edx, 1
mov rcx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rbx]
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [rax + 0xb0]
test eax, eax
je 0x18000526a
lea r8, [0x180054044]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0xe8]
call fcn.180015e80
nop
mov rdx, qword [rax]
mov r8d, dword [rdx - 0x10]
mov rcx, qword [rsp + 0x80]
call fcn.180016650
nop
mov rdx, qword [rsp + 0xe8]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180005202
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x180005202
mov ebx, dword [rsp + 0x4c]
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18000528e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800052ae
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800052ce
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800052ee
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x90]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180005311
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rax, qword [rsp + 0x68]
mov rdx, qword [rax]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], edi
dec edi
test edi, edi
jg 0x180005331
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, ebx
jmp 0x1800053e8
test rbx, rbx
je 0x18000536c
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test rsi, rsi
je 0x18000537f
mov rax, qword [rsi]
mov edx, 1
mov rcx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov ebx, dword [rsp + 0x4c]
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800053a3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x90]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800053c6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rax, qword [rsp + 0x68]
mov rdx, qword [rax]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], edi
dec edi
test edi, edi
jg 0x1800053e6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, ebx
mov rcx, qword [rsp + 0x540]
xor rcx, rsp
call fcn.18002bd00
add rsp, 0x550
pop rdi
pop rsi
pop rbx
ret