Function at 0x1800024e0
Capabilities:
Reference http user-agent string

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xb40
mov byte [rsp + 0xaf8], 0
lea rdi, [rsp + 0xaf9]
xor eax, eax
mov ecx, 0x3b
rep stosb byte [rdi], al
mov qword [rsp + 0x98], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0xb0], 0
mov dword [rsp + 0xaf0], 0
mov dword [rsp + 0xb8], 0
mov dword [rsp + 0x90], 0
mov dword [rsp + 0xa0], 0
mov byte [rsp + 0xc0], 0
lea rdi, [rsp + 0xc1]
xor eax, eax
mov ecx, 0xa27
rep stosb byte [rdi], al
mov r8d, 0x626b7368
mov edx, 0x3f7a0
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsp + 0xa8], rax
cmp qword [rsp + 0xa8], 0
jne 0x1800025ab
mov eax, 0xc0000001
jmp 0x180002a01
mov qword [rsp + 0x40], 0
lea rdi, [rsp + 0x48]
xor eax, eax
mov ecx, 0x40
rep stosb byte [rdi], al
mov rax, qword [rsp + 0xb60]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xb58]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0xb50]
lea r8, str.GET___s_HTTP_1.1_r_nHost:__s:_s_r_nAccept:text_html__application_xhtmlxml__image_jxr____r_nAccept_Language:_zh_Hans_CN__zh_Hans__q0.8__en_US__q0.5__en__q0.3_r_nUser_Agent:_Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_46.0.2486.0_Safari_537.36_Edge_13.10586_r_nConnection:Keep_Alive_r_n_r_n
mov edx, 0xa28
lea rcx, [rsp + 0xc0]
call fcn.180004220
lea r8, [rsp + 0x40]
mov rdx, qword [rsp + 0xb60]
mov rcx, qword [rsp + 0xb58]
call fcn.180002b60
mov dword [rsp + 0xbc], eax
cmp dword [rsp + 0xbc], 0
jge 0x18000262d
jmp 0x1800029c4
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0xc0]
call fcn.180003770
mov dword [rsp + 0xbc], eax
cmp dword [rsp + 0xbc], 0
jl 0x1800029c4
jmp 0x18000265b
mov r8d, 0x3f7a0
xor edx, edx
mov rcx, qword [rsp + 0xa8]
call fcn.180004740
mov qword [rsp + 0x30], 0
mov qword [rsp + 0xb0], 0
mov dword [rsp + 0x90], 0
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x90]
mov edx, 0x3f7a0
mov rcx, qword [rsp + 0xa8]
call fcn.180003ae0
mov dword [rsp + 0xbc], eax
cmp dword [rsp + 0xbc], 0
jl 0x1800029a7
jmp 0x1800026cb
lea rcx, [0x1800055b8]
call sub.ntoskrnl.exe_strlen
mov rdi, rax
lea rcx, [0x1800055c0]
call sub.ntoskrnl.exe_strlen
mov r8, rax
lea rdx, str.HTTP_1.
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.ntoskrnl.exe_RtlCompareMemory]
cmp rdi, rax
jne 0x180002889
lea rcx, [0x1800055d0]
call sub.ntoskrnl.exe_strlen
mov rdi, rax
lea rcx, [0x1800055e0]
call sub.ntoskrnl.exe_strlen
mov r8, rax
lea rdx, str.HTTP_1.1_200_OK
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.ntoskrnl.exe_RtlCompareMemory]
cmp rdi, rax
jne 0x180002879
lea rdx, [0x180005600]
mov rcx, qword [rsp + 0xa8]
call sub.ntoskrnl.exe_strstr
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x180002867
lea rdx, [0x180005614]
mov rcx, qword [rsp + 0x30]
call sub.ntoskrnl.exe_strstr
mov qword [rsp + 0xb0], rax
cmp qword [rsp + 0xb0], 0
je 0x180002855
mov rax, qword [rsp + 0x30]
mov rdi, qword [rsp + 0xb0]
sub rdi, rax
lea rcx, [0x180005618]
call sub.ntoskrnl.exe_strlen
sub rdi, rax
lea rcx, str.Content_Length:
call sub.ntoskrnl.exe_strlen
mov rdx, qword [rsp + 0x30]
add rdx, rax
mov r8, rdi
lea rcx, [rsp + 0xaf8]
call fcn.1800043b0
lea rcx, [rsp + 0xaf8]
call sub.ntoskrnl.exe_atoi
mov dword [rsp + 0xaf0], eax
mov eax, dword [rsp + 0xaf0]
add eax, 4
mov edx, eax
mov r8d, 0x626b7368
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsp + 0x98], rax
mov rcx, qword [rsp + 0xb70]
mov rax, qword [rsp + 0x98]
mov qword [rcx], rax
cmp qword [rsp + 0x98], 0
jne 0x180002837
mov dword [rsp + 0xbc], 0xc0000001
jmp 0x1800029c4
mov eax, dword [rsp + 0xaf0]
add eax, 4
mov r8d, eax
xor edx, edx
mov rcx, qword [rsp + 0x98]
call fcn.180004740
jmp 0x180002865
mov dword [rsp + 0xbc], 0xc0000001
jmp 0x1800029c4
jmp 0x180002877
mov dword [rsp + 0xbc], 0xc0000001
jmp 0x1800029c4
jmp 0x180002889
mov dword [rsp + 0xbc], 0xc0000001
jmp 0x1800029c4
lea rdx, [0x180005644]
mov rcx, qword [rsp + 0xa8]
call sub.ntoskrnl.exe_strstr
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x98], 0
jne 0x1800028b2
jmp 0x1800029c4
cmp qword [rsp + 0x30], 0
je 0x180002955
cmp qword [rsp + 0xb0], 0
je 0x180002955
mov edi, dword [rsp + 0x90]
lea rcx, [0x18000564c]
call sub.ntoskrnl.exe_strlen
mov rcx, qword [rsp + 0x30]
add rcx, rax
sub rcx, qword [rsp + 0xa8]
mov rax, rdi
sub rax, rcx
mov dword [rsp + 0xb38], eax
cmp dword [rsp + 0xb38], 0
jbe 0x18000293c
mov edi, dword [rsp + 0xb38]
lea rcx, str._r_n_r_n
call sub.ntoskrnl.exe_strlen
mov rdx, qword [rsp + 0x30]
add rdx, rax
mov eax, dword [rsp + 0xb8]
mov rcx, qword [rsp + 0x98]
add rcx, rax
mov r8, rdi
call fcn.1800043b0
mov ecx, dword [rsp + 0xb38]
mov eax, dword [rsp + 0xb8]
add eax, ecx
mov dword [rsp + 0xb8], eax
jmp 0x180002993
mov r8d, dword [rsp + 0x90]
mov eax, dword [rsp + 0xb8]
mov rcx, qword [rsp + 0x98]
add rcx, rax
mov rdx, qword [rsp + 0xa8]
call fcn.1800043b0
mov edx, dword [rsp + 0x90]
mov eax, dword [rsp + 0xb8]
add eax, edx
mov dword [rsp + 0xb8], eax
mov eax, dword [rsp + 0xaf0]
cmp dword [rsp + 0xb8], eax
jb 0x18000265b
cmp dword [rsp + 0xbc], 0
jge 0x1800029b3
jmp 0x1800029c4
mov rcx, qword [rsp + 0xb68]
mov eax, dword [rsp + 0xb8]
mov dword [rcx], eax
cmp qword [rsp + 0xa8], 0
je 0x1800029ee
mov edx, 0x626b7368
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov qword [rsp + 0xa8], 0
lea rcx, [rsp + 0x40]
call fcn.180003e30
jmp 0x1800029fa
mov eax, dword [rsp + 0xbc]
add rsp, 0xb40
pop rdi
ret