Function at 0x6fc33bc0
Capabilities:
Reference http user-agent string

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6fc33ef2
sub esp, 0x58
mov dword [esp + 0x24], 0
mov eax, dword [0x6fe304b4]
lea ecx, [esp + 0x24]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
mov dword [esp + 8], 0xfffffffe
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 2
call fcn.6fc342c0
mov eax, dword [esp + 0x20]
test eax, eax
je 0x6fc33e96
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [esp + 0x50], eax
test byte [eax], al
lea ecx, [eax + 0x1b8]
mov dword [esp + 0x54], ecx
nop
mov dword [esp], ecx
call fcn.6fc099f0
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x50]
mov dword [ecx + 0x1bc], eax
mov eax, dword [ecx + 0x1c8]
test eax, eax
jne 0x6fc33cc3
movzx eax, byte [0x700a742e]
test al, al
je 0x6fc33cc3
mov eax, dword [0x6fe304b0]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], 0x100003
call fcn.6fc341d0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x50]
mov dword [ecx + 0x1c8], eax
test eax, eax
je 0x6fc33e3b
nop
nop
mov eax, dword [esp + 0x54]
mov dword [esp], eax
call fcn.6fc09bf0
lea edi, [esp + 0x34]
xor eax, eax
call fcn.6fc62199
mov eax, dword [sub.KERNEL32.DLL_VirtualQuery]
lea ecx, [esp + 0x34]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 0x1c
call fcn.6fc34180
mov eax, dword [esp + 0x10]
test eax, eax
je 0x6fc33de0
mov eax, dword [esp + 0x38]
lea ecx, [eax + 0x4000]
mov dword [esp + 0x28], ecx
mov edx, dword fs:[0x14]
mov edx, dword [edx]
mov ebx, dword [edx + 4]
mov dword [esp + 0x30], ebx
cmp ebx, ecx
jb 0x6fc33d56
sub ebx, eax
add ebx, 0xffffc000
cmp ebx, 0x4000000
ja 0x6fc33d56
mov dword [edx], ecx
add eax, 0x4ba0
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
call fcn.6fc61d20
add esp, 0x58
ret
call fcn.6fc38990
lea eax, [0x6fe8076c]
mov dword [esp], eax
mov dword [esp + 4], 0x13
call fcn.6fc39270
mov dword [esp + 4], 0
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call fcn.6fc390f0
lea eax, [0x6fe7bb7b]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.6fc39270
mov dword [esp + 4], 0
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call fcn.6fc390f0
lea eax, [0x6fe7bba6]
mov dword [esp], eax
mov dword [esp + 4], 2
call fcn.6fc39270
call fcn.6fc38a00
lea eax, [0x6fe7dd87]
mov dword [esp], eax
mov dword [esp + 4], 0xc
call fcn.6fc36d90
call fcn.6fc62cb0
mov eax, dword [esp]
mov dword [esp + 0x2c], eax
call fcn.6fc38990
lea eax, [0x6fe87a99]
mov dword [esp], eax
mov dword [esp + 4], 0x24
call fcn.6fc39270
mov dword [esp + 4], 0
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call fcn.6fc38f10
call fcn.6fc38bb0
call fcn.6fc38a00
lea eax, str.VirtualQuery_for_stack_base_failedadding_nil_Certificate_to_CertPoolbad_scalar_length:__d__expected__dchacha20:_wrong_HChaCha20_key_sizecrypto_aes:_invalid_buffer_overlapcrypto_des:_invalid_buffer_overlapcrypto_rc4:_invalid_buffer_overlapcrypto_rsa:_missing_public_modulusdoaddtimer:_P_already_set_in_timerexpected_an_RSA_public_key__got__Tflag_provided_but_not_defined:___sforEachP:_sched.safePointWait___0frame_settings_window_size_too_bigframe_windowupdate_zero_inc_streamhttp2:_aborting_request_body_writehttp:_connection_has_been_hijackedhttp:_persistConn.readLoop_exitinghttp:_read_on_closed_response_bodyillegal_base64_data_at_input_byte_invalid_padding_bits_in_BIT_STRINGmspan.ensureSwept:_m_is_not_lockedout_of_memory_allocating_allArenasreflect:_ChanDir_of_non_chan_type_reflect:_Field_index_out_of_boundsreflect:_Field_of_non_struct_type_reflect:_string_index_out_of_rangeruntime.SetFinalizer:_cannot_pass_runtime:_g_is_running_but_p_is_notschedule:_spinning_with_local_workslice_bounds_out_of_range___x:_y:_slice_bounds_out_of_range__:_x:_y_stream_error:_stream_ID__d___v___vtimeout_waiting_for_client_prefacetls:_malformed_key_share_extensiontoo_many_references:_cannot_spliceunexpected_runtime.netpoll_error:_x509:_Ed25519_verification_failurex509:_invalid_certificate_policiesx509:_unhandled_critical_extension__must_separate_successive_digits1776356839400250464677810668945312588817841970012523233890533447265625CONTINUATION_frame_with_stream_ID_0attempt_to_clear_non_empty_span_setchacha20:_output_smaller_than_inputcrypto_md5:_invalid_hash_state_sizeencoding_hex:_odd_length_hex_stringfile_type_does_not_support_deadlinefindrunnable:_netpoll_with_spinninggreyobject:_obj_not_pointer_alignedhpack:_invalid_Huffman_encoded_datahttp:_server_closed_idle_connectionmheap.freeSpanLocked___invalid_freemime:_bogus_characters_after___:__qmime:_invalid_RFC_2047_encoded_wordmismatched_begin_end_of_activeSweepnetwork_dropped_connection_on_resetno_such_multicast_network_interfacepersistentalloc:_align_is_too_largepidleput:_P_has_non_empty_run_queuereflect.MakeSlice_of_non_slice_typeruntime:_close_polldesc_w_o_unblockruntime:_createevent_failed__errnoruntime:_inconsistent_read_deadlineryuFtoaFixed32_called_with_prec___9superfluous_leading_zeros_in_lengthtls:_server_selected_an_invalid_PSKtls:_too_many_non_advancing_recordstoo_many_Questions_to_pack___65535_traceback_did_not_unwind_completelytransform:_short_destination_buffertransport_endpoint_is_not_connectedunsupported_signature_algorithm:__vx509:_decryption_password_incorrectx509:_invalid_authority_info_accessx509:_malformed_extension_OID_fieldx509:_wrong_Ed25519_public_key_size__is_larger_than_maximum_page_size____is_not_Grunnable_or_Gscanrunnable_n0123456789abcdefghijklmnopqrstuvwxyz444089209850062616169452667236328125Go_pointer_stored_into_non_Go_memoryIA5String_contains_invalid_characterTime.UnmarshalBinary:_invalid_lengthUnable_to_determine_system_directoryaccessing_a_corrupted_shared_librarychacha20:_wrong_HChaCha20_nonce_sizecompressed_name_in_SRV_resource_datacrypto_cipher:_input_not_full_blockscrypto_sha1:_invalid_hash_state_sizecrypto_sha512:_invalid_hash_functionedwards25519:_invalid_point_encodingexpected_an_ECDSA_public_key__got__Thttp:_no_Location_header_in_responsehttp:_unexpected_EOF_reading_trailerinvalid_boolean_value__q_for___s:__vkeep_alive_interval_must_be_positivemalformed_MIME_header_initial_line:_method_ABI_and_value_ABI_dont_alignreflect:_NumField_of_non_struct_typeruntime:_VirtualQuery_failed__errnoruntime:_bad_notifyList_size___syncruntime:_inconsistent_write_deadlineruntime:_invalid_pc_encoded_table_fruntime:_invalid_typeBitsBulkBarrierruntime:_marked_free_object_in_span_runtime:_mcall_called_on_m__g0_stackruntime:_sudog_with_non_nil_waitlinkruntime:_unblock_on_closing_polldescruntime:_wrong_goroutine_in_newstackryuFtoaFixed64_called_with_prec___18strings.Builder.Grow:_negative_countsyntax_error_scanning_complex_numbertls:_server_did_not_send_a_key_shareuncaching_span_but_s.allocCount__0unsupported_SSLv2_handshake_receivedx509:_invalid_CRL_distribution_poin
mov dword [esp], eax
mov dword [esp + 4], 0x22
call fcn.6fc36d90
call fcn.6fc62cb0
mov eax, dword [esp]
mov dword [esp + 0x2c], eax
call fcn.6fc38990
lea eax, [0x6fe8a74a]
mov dword [esp], eax
mov dword [esp + 4], 0x2d
call fcn.6fc39270
mov dword [esp + 4], 0
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call fcn.6fc38f10
call fcn.6fc38bb0
call fcn.6fc38a00
lea eax, [0x6fe8b2d8]
mov dword [esp], eax
mov dword [esp + 4], 0x30
call fcn.6fc36d90
call fcn.6fc62cb0
mov eax, dword [esp]
mov dword [esp + 0x2c], eax
call fcn.6fc38990
lea eax, [0x6fe8a71d]
mov dword [esp], eax
mov dword [esp + 4], 0x2d
call fcn.6fc39270
mov dword [esp + 4], 0
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call fcn.6fc38f10
call fcn.6fc38bb0
call fcn.6fc38a00
lea eax, [0x6fe88150]
mov dword [esp], eax
mov dword [esp + 4], 0x25
call fcn.6fc36d90
nop
call fcn.6fc60ad0
jmp fcn.6fc33bc0