Function at 0x1800033dc
Capabilities:
Reference http user-agent string

Disassembly:
push rdi
sub rsp, 0x20
mov r8, rcx
lea rdi, [rcx + 0xd840]
xor r10d, r10d
lea r9d, [r10 + 0x32]
movzx eax, r10w
mov ecx, r9d
rep stosw word [rdi], ax
lea rdi, [r8 + 0xd7dc]
movzx eax, r10w
mov ecx, r9d
rep stosw word [rdi], ax
mov rcx, r8
add rsp, 0x20
pop rdi
jmp 0x1800033dc
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1b8]
sub rsp, 0x290
xor r13d, r13d
mov r14, rcx
movsxd rdi, edx
lea ebx, [r13 + 0x62]
lea rcx, [rsp + 0x32]
xor edx, edx
mov r8d, ebx
mov r12d, r13d
mov word [rsp + 0x30], r13w
call fcn.18001cca0
lea rcx, [rbp + 0x12]
mov r8d, ebx
xor edx, edx
mov word [rbp + 0x10], r13w
call fcn.18001cca0
lea rcx, [rbp - 0x5e]
mov r8d, ebx
xor edx, edx
mov word [rbp - 0x60], r13w
call fcn.18001cca0
lea r15d, [r13 + 0x32]
lea rax, [rsp + 0x30]
imul rcx, rdi, 0x32
lea r8, [r14 + 0xc858]
mov r9d, r15d
xor edx, edx
add r8, rcx
xor ecx, ecx
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rdx, [rsp + 0x30]
lea rcx, str.0x01___s.
call fcn.180002394
lea r8, [rsp + 0x30]
lea rcx, [rbp + 0x10]
mov edx, r15d
call fcn.18001dfa4
lea r8, [rsp + 0x30]
lea rcx, [rbp - 0x60]
mov edx, r15d
call fcn.18001dfa4
lea rcx, [rbp + 0x81]
xor edx, edx
mov r8d, 0x103
mov dword [rbp + 0x1c8], r13d
mov byte [rbp + 0x80], r13b
call fcn.18001cca0
mov ebx, 0x400
lea r9, [rbp + 0x1c8]
lea rdx, [rbp + 0x80]
mov r8d, ebx
mov ecx, 0x10000001
mov dword [rsp + 0x20], r13d
call qword [sym.imp.urlmon.dll_UrlMkGetSessionOption]
mov r9d, dword [rbp + 0x1c8]
lea rdi, [r14 + 0xd0fc]
lea r8, [rbp + 0x80]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rcx, rdi
call fcn.18001d570
test rax, rax
jne 0x18000353a
lea rdx, str.Mozilla_5.0__compatible__MSIE_7.0__Win32_
mov rcx, rdi
call fcn.18001e010
lea rdx, str.http:__
lea rcx, [rsp + 0x30]
call fcn.18001e02c
test rax, rax
jne 0x18000363b
lea rdx, str.https:__
lea rcx, [rsp + 0x30]
call fcn.18001e02c
test rax, rax
jne 0x18000363b
lea rdx, [0x18003558c]
lea rcx, [rsp + 0x30]
call fcn.18001e02c
mov rdi, rax
test rax, rax
je 0x18000363b
lea rax, [rsp + 0x30]
lea rdx, [0x180035590]
lea rcx, [rsp + 0x30]
sub rdi, rax
sar rdi, 1
inc edi
call fcn.18001e02c
mov r15, rax
test rax, rax
je 0x180003635
movsxd rsi, edi
mov edi, gethostbyname
lea r8, [rsp + 0x30]
lea rcx, [rbp + 0x10]
mov edx, edi
mov r9, rsi
call fcn.18001e228
lea r8, [rbp + 0x10]
lea rcx, [rbp - 0x60]
mov edx, edi
call fcn.18001dfa4
lea rcx, [rbp + 0x10]
call fcn.18001d570
lea rcx, [rsp + 0x30]
lea r8, [rsp + 0x30]
sub r15, rcx
mov ecx, edi
movsxd rdi, eax
sub ecx, eax
sar r15, 1
lea r8, [r8 + rsi*2]
movsxd rbx, ecx
lea rcx, [rbp + 0x10]
mov r9, r15
lea rcx, [rcx + rdi*2]
sub r9, rsi
mov rdx, rbx
call fcn.18001e228
lea r8, [rsp + 0x32]
lea rcx, [rbp - 0x60]
lea r8, [r8 + r15*2]
lea rcx, [rcx + rdi*2]
mov rdx, rbx
call fcn.18001dfa4
mov r15d, gethostbyname
lea rdx, str.http:__
lea rcx, [rbp - 0x60]
call fcn.18001e02c
test rax, rax
jne 0x18000389d
lea rcx, [r14 + 0xd840]
lea r8, [rbp - 0x60]
mov rdx, r15
lea r12d, [rax + 1]
lea rsi, [rbp - 0x60]
call fcn.18001dfa4
lea rdx, str.https:__
lea rcx, [rbp - 0x60]
call fcn.18001e02c
test rax, rax
je 0x180003698
lea rcx, str.https:__
call fcn.18001d570
lea rsi, [rbp - 0x60]
lea rsi, [rsi + rax*2]
lea rcx, str.0x01__try_httpsviaconfigproxy.
mov dword [r14 + 0xc844], r12d
call fcn.180002394
mov r9d, r12d
mov rdx, rsi
mov rcx, r14
call fcn.1800038fc
test eax, eax
jne 0x1800038d9
lea rbx, [r14 + 0xd098]
mov rcx, rbx
call fcn.180006834
lea rcx, str.0x01__try_httpswpadproxy.
mov dword [r14 + 0xc844], 2
call fcn.180002394
mov rdx, rsi
mov rcx, rbx
call fcn.1800076ec
test eax, eax
je 0x18000371f
movzx eax, r13w
lea rdi, [r14 + 0xd7dc]
mov rcx, r15
rep stosw word [rdi], ax
mov rcx, r14
call fcn.180003c40
test eax, eax
jne 0x1800038d9
mov rcx, rbx
call fcn.180006834
lea rcx, str.0x01__try_httpsviaiexproxy.
mov dword [r14 + 0xc844], 3
call fcn.180002394
mov r8d, r12d
mov rdx, rsi
mov rcx, rbx
call fcn.18000761c
test eax, eax
je 0x180003783
mov rcx, rbx
call fcn.18001d570
cmp rax, r15
ja 0x1800038d9
lea rcx, [r14 + 0xd7dc]
mov r8, rbx
mov rdx, r15
call fcn.18001dfa4
mov rcx, r14
call fcn.180003c40
test eax, eax
jne 0x1800038d9
mov rcx, rbx
call fcn.180006834
lea rcx, str.0x01__try_httpsviafirefoxproxy.
mov dword [r14 + 0xc844], 4
call fcn.180002394
mov r8d, r12d
mov rdx, rsi
mov rcx, rbx
call fcn.180007680
test eax, eax
je 0x1800037e7
mov rcx, rbx
call fcn.18001d570
cmp rax, r15
ja 0x1800038d9
lea rcx, [r14 + 0xd7dc]
mov r8, rbx
mov rdx, r15
call fcn.18001dfa4
mov rcx, r14
call fcn.180003c40
test eax, eax
jne 0x1800038d9
mov rcx, rbx
call fcn.180006834
lea rcx, str.0x01__try_httpsviaautoproxy.
mov dword [r14 + 0xc844], 5
call fcn.180002394
mov rdx, rsi
mov rcx, rbx
call fcn.18000786c
test eax, eax
je 0x180003848
mov rcx, rbx
call fcn.18001d570
cmp rax, r15
ja 0x1800038d9
lea rcx, [r14 + 0xd7dc]
mov r8, rbx
mov rdx, r15
call fcn.18001dfa4
mov rcx, r14
call fcn.180003c40
test eax, eax
jne 0x1800038d9
mov rcx, rbx
call fcn.180006834
lea rcx, str.0x01__try_httpspreconfig.
mov dword [r14 + 0xc844], 6
call fcn.180002394
mov rdx, rsi
mov rcx, rbx
call fcn.1800075d0
test eax, eax
je 0x180003893
movzx eax, r13w
lea rdi, [r14 + 0xd7dc]
mov rcx, r15
rep stosw word [rdi], ax
mov rcx, r14
call fcn.180003c40
test eax, eax
jne 0x1800038d9
mov rcx, rbx
call fcn.180006834
mov dword [r14 + 0xc844], r13d
mov r12d, r13d
lea rcx, str.0x01__CN_failed.
call fcn.180002394
lea rcx, [r14 + 0xd098]
call fcn.180006834
lea r11, [rsp + 0x290]
mov eax, r12d
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
movsxd rdx, dword [r14 + 0xc844]
lea rax, [0x180035c90]
lea rcx, str.0x01___s_ok.
mov rdx, qword [rax + rdx*8]
call fcn.180002394
jmp 0x1800038a9