Function at 0x625270
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x6255a4
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov rax, qword [rsp + 0x78]
mov rcx, qword [rax + 0xa0]
test rcx, rcx
je 0x625544
movzx ecx, byte [rax + 0xd0]
test cl, cl
jne 0x6254e4
mov byte [rax + 0xd0], 1
mov rcx, qword [rax + 0xa0]
mov qword [rsp], rcx
call fcn.00498a50
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 8]
mov qword [rsp + 0x30], rcx
mov rdx, qword [rsp + 0x10]
mov qword [rsp + 0x38], rdx
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rbx + 0x140]
test rsi, rsi
jne 0x6254c2
mov esi, dword [0x01636820]
lea rdi, [rbx + 0xa8]
test esi, esi
jne 0x6254af
mov qword [rbx + 0xa8], rcx
mov rsi, qword [rbx + 0x128]
mov qword [rsp + 0x28], rsi
xor edi, edi
xor r8d, r8d
mov r9, r8
jmp 0x625360
mov r10, qword [rsp + 0x20]
lea rdi, [r10 + 1]
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x28]
mov r8, rax
mov r9, rdx
mov rax, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x48], r9
cmp rdi, rsi
jge 0x6253d0
mov qword [rsp + 0x20], rdi
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov rax, qword [rbx + 0x138]
mov qword [rsp], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 8], rax
call fcn.00403be0
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
test rax, rax
je 0x6253c1
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x6253b6
mov rax, qword [rsp + 0x50]
jmp 0x625338
mov rdx, rax
mov rax, rcx
jmp 0x625338
mov rax, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
jmp 0x625338
mov rax, qword [rbx + 0x118]
mov rcx, qword [rbx + 0x110]
mov rdx, qword [rbx + 0x108]
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rax
mov qword [rsp], rbx
call fcn.00624160
mov rax, qword [rsp + 0x38]
test rax, rax
jne 0x625490
mov rax, qword [rsp + 0x30]
mov ecx, dword [rax + 8]
test rcx, rcx
je 0x62546c
lea rax, [0x00871a60]
mov qword [rsp], rax
call fcn.00410220
mov eax, dword [0x01636820]
mov rdi, qword [rsp + 8]
test eax, eax
jne 0x625460
mov rax, qword [rsp + 0x30]
mov qword [rdi], rax
lea rax, [0x008f9820]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rdi
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rax, qword [rsp + 0x30]
call fcn.004544a0
jmp 0x62543f
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x88], rax
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x88], rax
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rsi, rax
mov rax, rcx
call fcn.004544a0
mov rax, rsi
jmp 0x625322
mov qword [rsp], rsi
call fcn.00403930
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x78]
jmp 0x625306
lea rax, [0x00810ba0]
mov qword [rsp], rax
call fcn.00410220
mov rdi, qword [rsp + 8]
mov qword [rdi + 8], 0x1d
mov eax, dword [0x01636820]
test eax, eax
jne 0x625536
lea rax, [0x008aeac6]
mov qword [rdi], rax
lea rax, [0x008f8f20]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rdi
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
lea rax, [0x008aeac6]
call fcn.004544a0
jmp 0x625515
lea rax, [0x00810ba0]
mov qword [rsp], rax
call fcn.00410220
mov rdi, qword [rsp + 8]
mov qword [rdi + 8], 0x11
mov eax, dword [0x01636820]
test eax, eax
jne 0x625596
lea rax, [0x008a435c]
mov qword [rdi], rax
lea rax, [0x008f8f20]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rdi
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
lea rax, [0x008a435c]
call fcn.004544a0
jmp 0x625575
call fcn.00451b80
jmp fcn.00625270