Function at 0x1400025d0
Capabilities:
Reference http user-agent string

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rbx, rdx
mov rsi, rcx
lea rdx, str.EMAIL
mov rbp, r8
mov rcx, rbx
mov rdi, r9
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x140002860
lea rdx, str.IPV4
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400027b8
lea rdx, str.IPV6
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400029e0
lea rdx, [0x14001c258]
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400029f0
lea rdx, str.DIGIT
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x140002970
lea rdx, [0x14001c26d]
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x140002a70
lea rdx, [0x14001c28c]
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x140002aea
lea rdx, [0x14001c2c5]
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400029fd
lea rdx, [0x14001c2e4]
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x140002b58
lea rdx, str.UUID1
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x140002ba8
lea rdx, str.UUID2
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x140002bbc
lea rdx, str.UUID3
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x140002be4
lea rdx, str.UUID4
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x140002bd0
lea rdx, str.UUID
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x140002bd0
lea rdx, str.UUID5
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x140002bf8
lea rdx, str.BYTES
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x140002c0c
lea rdx, str.SPACE
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x140002c1c
lea rdx, str.USERAGENT
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x140002c4f
lea rdx, str.NULL
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x140002c33
lea rdx, [0x14001c3f8]
mov rcx, rbp
call fcn.140002150
mov rdi, rax
jmp 0x140002813
mov ecx, 0x10
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov rdi, rax
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
mov r13d, eax
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
movzx r13d, r13b
mov r12d, eax
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
movzx r12d, r12b
mov ebp, eax
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
movzx ebp, bpl
mov rcx, rdi
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x28], r12d
movzx r9d, al
lea r8, str._d._d._d._d
mov edx, 0x10
mov dword [rsp + 0x20], ebp
call fcn.14000e130
test rdi, rdi
je 0x140002954
lea rdx, [0x14001c41a]
mov rcx, rsi
mov r8, rdi
call fcn.14000e0d0
lea rdx, str.USERAGENT
mov rcx, rbx
mov ebp, eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x140002960
movsxd rax, ebp
add rax, rsi
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, 0x100
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov rdi, rax
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
movsxd rcx, eax
movabs rax, 0xcccccccccccccccd
mul rcx
shr rdx, 5
lea rax, [rdx + rdx*4]
shl rax, 3
sub rcx, rax
lea rax, str.gmail.com
mov rax, qword [rax + rcx*8]
mov qword [rsp + 0x40], rax
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdq
shr edx, 0x1a
lea ebp, [rax + rdx]
and ebp, 0x3f
sub ebp, edx
movsxd r15, ebp
lea rcx, [r15 + 1]
mov qword [rsp + 0x48], r15
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov r14, rax
test rax, rax
je 0x14000292a
test r15, r15
je 0x140002920
lea r13, [r15 + rax]
mov rbp, rax
lea r15, str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.__
movabs r12, 0xfc0fc0fc0fc0fc1
nop dword [rax + rax]
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
add rbp, 1
movsxd rcx, eax
mov rax, rcx
mul r12
shr rdx, 2
mov rax, rdx
shl rax, 6
add rax, rdx
sub rcx, rax
movzx eax, byte [r15 + rcx]
mov byte [rbp - 1], al
cmp r13, rbp
jne 0x1400028f0
mov rax, qword [rsp + 0x48]
mov byte [r14 + rax], 0
mov rax, qword [rsp + 0x40]
mov r9, r14
mov edx, 0x100
mov rcx, rdi
lea r8, str._s__s
mov qword [rsp + 0x20], rax
call fcn.14000e130
test rdi, rdi
jne 0x14000281c
mov rax, rsi
jmp 0x14000284d
mov rcx, rdi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
jmp 0x140002847
lea rcx, [rbp + 1]
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov rdi, rax
test rax, rax
je 0x140002954
test rbp, rbp
je 0x1400029ce
mov r14, rax
lea r13, [rbp + rax]
lea r15, str.0123456789
movabs r12, 0xcccccccccccccccd
nop
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
add r14, 1
movsxd rcx, eax
mov rax, rcx
mul r12
shr rdx, 3
lea rax, [rdx + rdx*4]
add rax, rax
sub rcx, rax
movzx eax, byte [r15 + rcx]
mov byte [r14 - 1], al
cmp r13, r14
jne 0x1400029a0
mov byte [rdi + rbp], 0
jmp 0x14000281c
call fcn.140002310
mov rdi, rax
jmp 0x140002813
call fcn.1400021d0
mov rdi, rax
jmp 0x140002813
lea rcx, [rbp + 1]
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov rdi, rax
test rax, rax
je 0x140002954
test rbp, rbp
je 0x1400029ce
mov r14, rax
lea r13, [rbp + rax]
lea r15, str.ABCDEFGHIJKLMNOPQRSTUVWXYZ
movabs r12, 0x4ec4ec4ec4ec4ec5
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
add r14, 1
movsxd rcx, eax
mov rax, rcx
mul r12
shr rdx, 3
lea rax, [rdx + rdx*2]
lea rax, [rdx + rax*4]
add rax, rax
sub rcx, rax
movzx eax, byte [r15 + rcx]
mov byte [r14 - 1], al
cmp r14, r13
jne 0x140002a30
jmp 0x1400029ce
lea rcx, [rbp + 1]
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov rdi, rax
test rax, rax
je 0x140002954
test rbp, rbp
je 0x1400029ce
mov r14, rax
lea r13, [rbp + rax]
lea r15, str.abcdefghijklmnopqrstuvwxyz
movabs r12, 0x4ec4ec4ec4ec4ec5
nop word [rax + rax]
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
add r14, 1
movsxd rcx, eax
mov rax, rcx
mul r12
shr rdx, 3
lea rax, [rdx + rdx*2]
lea rdx, [rdx + rax*4]
mov rax, rcx
add rdx, rdx
sub rax, rdx
movzx eax, byte [r15 + rax]
mov byte [r14 - 1], al
cmp r14, r13
jne 0x140002ab0
jmp 0x1400029ce
lea rcx, [rbp + 1]
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov rdi, rax
test rax, rax
je 0x140002954
test rbp, rbp
je 0x1400029ce
mov r14, rax
lea r13, [rax + rbp]
lea r15, str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ
movabs r12, 0x4ec4ec4ec4ec4ec5
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
add r14, 1
movsxd rcx, eax
mov rax, rcx
mul r12
shr rdx, 4
lea rax, [rdx + rdx*2]
lea rax, [rdx + rax*4]
shl rax, 2
sub rcx, rax
movzx eax, byte [r15 + rcx]
mov byte [r14 - 1], al
cmp r14, r13
jne 0x140002b20
jmp 0x1400029ce
lea rcx, [rbp + 1]
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov rdi, rax
test rax, rax
je 0x140002954
test rbp, rbp
je 0x1400029ce
mov r12, rax
lea r13, [rbp + rax]
lea r14, str.0123456789ABCDEF
nop dword [rax]
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
add r12, 1
and eax, 0xf
movzx eax, byte [r14 + rax]
mov byte [r12 - 1], al
cmp r12, r13
jne 0x140002b88
jmp 0x1400029ce
lea rcx, str.xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
call fcn.1400023d0
mov rdi, rax
jmp 0x140002813
lea rcx, str.xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
call fcn.1400023d0
mov rdi, rax
jmp 0x140002813
lea rcx, str.xxxxxxxx_xxxx_4xxx_xxxx_xxxxxxxxxxxx
call fcn.1400023d0
mov rdi, rax
jmp 0x140002813
lea rcx, str.xxxxxxxx_xxxx_3xxx_xxxx_xxxxxxxxxxxx
call fcn.1400023d0
mov rdi, rax
jmp 0x140002813
lea rcx, str.xxxxxxxx_xxxx_5xxx_xxxx_xxxxxxxxxxxx
call fcn.1400023d0
mov rdi, rax
jmp 0x140002813
mov rcx, rbp
call fcn.140002460
mov rdi, rax
jmp 0x140002813
lea rdx, str.__r_n_t_v_b_f
mov rcx, rbp
call fcn.140002150
mov rdi, rax
jmp 0x140002813
mov r8, rdi
lea rdx, str.___s__
mov rcx, rsi
call fcn.14000e0d0
cdqe
add rax, rsi
jmp 0x14000284d
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
mov ecx, 0x2d
xor edx, edx
cdqe
div rcx
lea rax, str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_110.0.0.0_Safari_537.36
mov rdi, qword [rax + rdx*8]
jmp 0x140002813