Function at 0x421c20
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x42217d
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov rax, qword [rsp + 0x58]
movzx ecx, byte [rax + 0x64]
cmp cl, 1
jne 0x421fff
movzx ecx, word [rax + 0x60]
mov word [rsp + 0x16], cx
test cx, cx
jne 0x422034
mov rdx, qword [rsp + 0x50]
test byte [rdx], al
mov ebx, dword [rax + 0x58]
mov esi, dword [rdx + 0x1020]
cmp ebx, esi
jne 0x422034
mov rcx, qword [rdx + 0x10b8]
sub rcx, qword [rax + 0x20]
mov qword [rdx + 0x10b8], rcx
movzx ecx, byte [rsp + 0x60]
test cl, cl
je 0x421cb8
mov rcx, qword [0x0163d108]
mov rbx, qword [rax + 0x20]
shl rbx, 0xd
sub rcx, rbx
mov qword [0x0163d108], rcx
movzx ecx, byte [rsp + 0x61]
test cl, cl
je 0x421cd7
mov rcx, qword [rax + 0x20]
shl rcx, 0xd
add rcx, qword [0x0163d100]
mov qword [0x0163d100], rcx
mov byte [rax + 0x64], 3
mov rcx, qword [rax + 0x10]
test rcx, rcx
je 0x421d11
mov rcx, qword [rax + 0x20]
cmp rcx, 0x80
jae 0x421ff1
test byte [rdx], al
shl rcx, 4
lea rcx, [rdx + rcx + 0x810]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.00422740
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov qword [rcx + 0x70], rax
test rax, rax
je 0x421fda
mov qword [rcx + 0x78], 0
mov rax, qword [rsp + 0x50]
test byte [rax], al
mov rdx, qword [rcx + 0x18]
sub rdx, qword [rax + 0x1328]
shr rdx, 0xd
test rdx, 0xffffffffffffffff
jbe 0x421fcf
mov rbx, qword [rax + 0x1050]
mov rsi, qword [rax + 0x1048]
lea rdi, [rdx - 1]
cmp rdi, rbx
jae 0x42202d
mov rbx, qword [rsi + rdx*8 - 8]
test rbx, rbx
je 0x421fc4
movzx esi, byte [rbx + 0x64]
cmp sil, 3
jne 0x421fb9
mov rsi, qword [rbx + 0x18]
mov qword [rcx + 0x18], rsi
mov rsi, qword [rcx + 0x20]
add rsi, qword [rbx + 0x20]
mov qword [rcx + 0x20], rsi
mov rsi, qword [rbx + 0x78]
mov qword [rcx + 0x78], rsi
movzx esi, byte [rcx + 0x65]
movzx edi, byte [rbx + 0x65]
or edi, esi
mov byte [rcx + 0x65], dil
mov rsi, qword [rbx + 0x20]
sub rdx, rsi
mov rsi, qword [rax + 0x1050]
mov rdi, qword [rax + 0x1048]
cmp rdx, rsi
jae 0x422026
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x20], rdx
mov qword [rdi + rdx*8], rcx
mov rsi, qword [rbx + 0x20]
cmp rsi, 0x80
jb 0x421f9d
lea rcx, [rax + 0x808]
mov qword [rsp], rcx
mov qword [rsp + 8], rbx
call fcn.00419f20
mov rax, qword [rsp + 0x38]
mov byte [rax + 0x64], 0
mov rcx, qword [rsp + 0x50]
lea rdx, [rcx + 0x34d0]
test byte [rdx], al
mov rdx, qword [rcx + 0x3500]
sub rdx, qword [rcx + 0x34d0]
mov qword [rcx + 0x3500], rdx
mov rdx, qword [rcx + 0x34e8]
mov qword [rax], rdx
mov qword [rcx + 0x34e8], rax
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x58]
mov rbx, qword [rdx + 0x20]
lea rsi, [rbx + rax]
mov rdi, qword [rcx + 0x1050]
mov r8, qword [rcx + 0x1048]
cmp rsi, rdi
jae 0x421f37
mov rsi, qword [r8 + rsi*8]
test rsi, rsi
je 0x421f37
movzx edi, byte [rsi + 0x64]
cmp dil, 3
jne 0x421f37
mov rdi, qword [rsi + 0x20]
add rbx, rdi
mov qword [rdx + 0x20], rbx
mov rbx, qword [rdx + 0x78]
add rbx, qword [rsi + 0x78]
mov qword [rdx + 0x78], rbx
movzx ebx, byte [rdx + 0x65]
movzx edi, byte [rsi + 0x65]
or edi, ebx
mov byte [rdx + 0x65], dil
mov rbx, qword [rcx + 0x1050]
mov rdi, qword [rcx + 0x1048]
mov r8, qword [rdx + 0x20]
lea rax, [r8 + rax - 1]
cmp rax, rbx
jae 0x42201f
mov qword [rsp + 0x38], rsi
mov qword [rdi + rax*8], rdx
mov rax, qword [rsi + 0x20]
cmp rax, 0x80
jb 0x421f81
lea rax, [rcx + 0x808]
mov qword [rsp], rax
mov qword [rsp + 8], rsi
call fcn.00419f20
mov rax, qword [rsp + 0x38]
mov byte [rax + 0x64], 0
mov rcx, qword [rsp + 0x50]
lea rdx, [rcx + 0x34d0]
test byte [rdx], al
mov rdx, qword [rcx + 0x3500]
sub rdx, qword [rcx + 0x34d0]
mov qword [rcx + 0x3500], rdx
mov rdx, qword [rcx + 0x34e8]
mov qword [rax], rdx
mov qword [rcx + 0x34e8], rax
mov rax, qword [rsp + 0x58]
mov rdx, qword [rax + 0x20]
cmp rdx, 0x80
jb 0x421f68
add rcx, 0x808
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.00419a10
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
shl rdx, 4
lea rcx, [rdx + rcx + 8]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.004228e0
jmp 0x421f5e
shl rax, 4
lea rax, [rax + rcx + 8]
mov qword [rsp], rax
mov qword [rsp + 8], rsi
call fcn.00422740
jmp 0x421efa
shl rsi, 4
lea rcx, [rsi + rax + 8]
mov qword [rsp], rcx
mov qword [rsp + 8], rbx
call fcn.00422740
jmp 0x421e06
mov rcx, rax
mov rax, rdx
jmp 0x421e48
mov rcx, rax
mov rax, rdx
jmp 0x421e48
mov rcx, rax
mov rax, rdx
jmp 0x421e48
call fcn.00455830
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x58]
mov qword [rcx + 0x70], rax
jmp 0x421d28
test byte [rdx], al
lea rcx, [rdx + 0x1010]
jmp 0x421d03
cmp cl, 2
jne 0x422162
movzx ecx, word [rax + 0x60]
test cx, cx
jne 0x422147
mov rdx, qword [rsp + 0x50]
jmp 0x421c96
call fcn.004292d0
ud2
call fcn.004292d0
ud2
call fcn.004292d0
ud2
mov rcx, qword [rsp + 0x50]
test byte [rcx], al
mov ecx, dword [rcx + 0x1020]
mov qword [rsp + 0x30], rcx
mov edx, dword [rax + 0x58]
mov qword [rsp + 0x28], rdx
mov rbx, qword [rax + 0x18]
mov qword [rsp + 0x18], rbx
call fcn.0042b400
lea rax, [0x008adb60]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1c
call fcn.0042bdc0
mov rax, qword [rsp + 0x58]
mov qword [rsp], rax
call fcn.0042bd70
lea rax, [0x0088c81e]
mov qword [rsp], rax
mov qword [rsp + 8], 5
call fcn.0042bdc0
mov rax, qword [rsp + 0x18]
mov qword [rsp], rax
call fcn.0042bc50
lea rax, [0x0089aa26]
mov qword [rsp], rax
mov qword [rsp + 8], 0xc
call fcn.0042bdc0
movzx eax, word [rsp + 0x16]
movzx eax, ax
mov qword [rsp], rax
call fcn.0042bac0
lea rax, [0x00896549]
mov qword [rsp], rax
mov qword [rsp + 8], 0xa
call fcn.0042bdc0
mov rax, qword [rsp + 0x28]
mov qword [rsp], rax
call fcn.0042bac0
lea rax, [0x0088ae5d]
mov qword [rsp], rax
mov qword [rsp + 8], 1
call fcn.0042bdc0
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
call fcn.0042bac0
call fcn.0042b6b0
call fcn.0042b490
lea rax, [0x008b2b65]
mov qword [rsp], rax
mov qword [rsp + 8], 0x23
call fcn.0042ab20
ud2
lea rax, [0x008b5a96]
mov qword [rsp], rax
mov qword [rsp + 8], 0x29
call fcn.0042ab20
ud2
lea rax, [0x008b5a6d]
mov qword [rsp], rax
mov qword [rsp + 8], 0x29
call fcn.0042ab20
ud2
call fcn.00451b80
jmp fcn.00421c20