Function at 0x43fd30
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
lea rax, [rsp - 0x108]
cmp rax, qword [rcx + 0x10]
jbe 0x440a4a
sub rsp, 0x188
mov qword [rsp + 0x180], rbp
lea rbp, [rsp + 0x180]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rcx, qword [rax + 0x30]
mov rdx, qword [rcx + 0x18]
mov rbx, rdx
mov r8, qword [rdx + 0x10]
cmp r8, 0xfffffffffffffb2e
je 0x440a2f
mov qword [rsp + 0x90], rax
mov r8, qword [rcx + 0x90]
mov qword [rsp + 0xd0], r8
cmp rdx, r8
jne 0x4408a1
movzx edx, byte [r8 + 0xc5]
test dl, dl
jne 0x440342
mov rdx, qword [rcx + 8]
mov qword [rsp + 0xd8], rdx
lea rsi, [rcx + 0x10]
lea rdi, [rsp + 0xe0]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00454a36
mov rbp, qword [rbp]
mov rcx, qword [rax + 0x30]
mov qword [rcx + 0x10], 0
mov rcx, qword [rax + 0x30]
mov qword [rcx + 0x30], 0
mov rcx, qword [rax + 0x30]
mov qword [rcx + 8], 0
mov rcx, qword [rax + 0x30]
mov qword [rcx + 0x18], 0
mov rcx, qword [r8 + 0x10]
mov qword [rsp + 0x88], rcx
cmp rcx, 0xfffffffffffffade
jne 0x43fe61
mov rdx, qword [rax + 0x30]
mov ebx, dword [rdx + 0xd0]
test ebx, ebx
je 0x44030c
mov rax, qword [r8]
add rax, 0x1370
mov qword [r8 + 0x10], rax
lea rax, [r8 + 0x38]
mov qword [rsp], rax
call fcn.00451940
mov rax, qword [rsp + 0xd0]
mov rcx, qword [rax]
test rcx, rcx
je 0x4405a2
mov rdx, qword [rax + 0x38]
lea rbx, [rdx - 8]
mov qword [rsp + 0x28], rbx
cmp rbx, rcx
jb 0x4400f0
mov rcx, qword [rax]
cmp rbx, rcx
jb 0x440495
mov rcx, qword [rsp + 0x88]
cmp rcx, 0xfffffffffffffade
jne 0x43ffe8
mov rcx, qword [rsp + 0x90]
mov rcx, qword [rcx + 0x30]
mov rdx, qword [rcx]
cmp rax, rdx
je 0x44047a
mov rdx, qword [rcx + 0xa0]
test rdx, rdx
jne 0x43fede
mov ecx, dword [rcx + 0xd0]
test ecx, ecx
je 0x44045f
mov qword [rsp], rax
movabs rcx, 0x400000002
mov qword [rsp + 8], rcx
call fcn.0042e4a0
mov rax, qword [rsp + 0xd0]
movzx ecx, byte [rax + 0xc2]
test cl, cl
jne 0x43ff16
jmp 0x43ffb7
mov rax, qword [rsp + 0xd0]
mov qword [rsp], rax
movabs rcx, 0x100400000004
mov qword [rsp + 8], rcx
call fcn.0042e3b0
movzx eax, byte [rsp + 0x10]
test al, al
je 0x43ff0e
mov rax, qword [rsp + 0xd0]
movzx ecx, byte [rax + 0xc3]
test cl, cl
je 0x440092
mov byte [rax + 0xc2], 0
mov byte [rax + 0xc0], 0
mov qword [rsp], rax
movabs rcx, 0x400001004
mov qword [rsp + 8], rcx
call fcn.0042df40
mov rax, qword [rsp + 0xd0]
mov qword [rsp], rax
movabs rcx, 0x200000004
mov qword [rsp + 8], rcx
call fcn.0042e4a0
mov rax, qword [rsp + 0xd0]
mov rcx, qword [rax]
add rcx, 0x1370
mov qword [rax + 0x10], rcx
lea rcx, [rax + 0x38]
mov qword [rsp], rcx
call fcn.00451940
mov rax, qword [rsp + 0xd0]
mov qword [rsp], rax
movabs rcx, 0x200000004
mov qword [rsp + 8], rcx
call fcn.0042e4a0
mov rax, qword [rsp + 0xd0]
mov qword [rsp], rax
call fcn.00432c00
mov rax, qword [rsp + 0xd0]
mov rcx, qword [rax + 8]
sub rcx, qword [rax]
shl rcx, 1
mov rdx, qword [0x00b01308]
cmp rcx, rdx
ja 0x4403f8
mov qword [rsp + 0x80], rcx
mov qword [rsp], rax
movabs rcx, 0x800000002
mov qword [rsp + 8], rcx
call fcn.0042e4a0
mov rax, qword [rsp + 0xd0]
mov qword [rsp], rax
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 8], rcx
mov byte [rsp + 0x10], 1
call fcn.0043f9b0
mov rax, qword [rsp + 0xd0]
mov qword [rsp], rax
movabs rcx, 0x200000008
mov qword [rsp + 8], rcx
call fcn.0042e4a0
mov rax, qword [rsp + 0xd0]
add rax, 0x38
mov qword [rsp], rax
call fcn.00451940
mov rbp, qword [rsp + 0x180]
add rsp, 0x188
ret
mov rcx, qword [rax + 0x30]
mov rdx, qword [rcx + 0xa0]
test byte [rdx], al
test byte [rcx], al
mov qword [rsp], rax
lea rcx, [rdx + 0x1270]
mov qword [rsp + 0xa0], rcx
mov qword [rsp + 8], rcx
call fcn.0041b890
movzx eax, byte [0x01635ed7]
test al, al
jne 0x4400dd
mov rax, qword [rsp + 0xd0]
mov byte [rax + 0xc3], 1
jmp 0x43ff4e
mov rax, qword [rsp + 0xa0]
mov qword [rsp], rax
call fcn.0041f880
jmp 0x4400c9
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x78], rdx
mov rcx, qword [rax + 8]
mov qword [rsp + 0x70], rcx
mov rdx, qword [rsp + 0xe0]
mov qword [rsp + 0x68], rdx
mov rbx, qword [rsp + 0xd8]
mov qword [rsp + 0x60], rbx
mov rsi, qword [rsp + 0x100]
mov qword [rsp + 0x58], rsi
mov rdi, qword [rax + 0x40]
mov qword [rsp + 0x50], rdi
mov r8, qword [rax + 0x60]
mov qword [rsp + 0x48], r8
mov r9, qword [rax + 0x50]
mov qword [rsp + 0xc8], r9
call fcn.0042b400
lea rax, [0x008a83af]
mov qword [rsp], rax
mov qword [rsp + 8], 0x15
call fcn.0042bdc0
mov rax, qword [rsp + 0x28]
mov qword [rsp], rax
call fcn.0042bc50
lea rax, [0x0089205c]
mov qword [rsp], rax
mov qword [rsp + 8], 8
call fcn.0042bdc0
mov rax, qword [rsp + 0x80]
mov qword [rsp], rax
call fcn.0042bc50
lea rax, [0x0088aebe]
mov qword [rsp], rax
mov qword [rsp + 8], 2
call fcn.0042bdc0
mov rax, qword [rsp + 0x70]
mov qword [rsp], rax
call fcn.0042bc50
lea rax, [0x008a2109]
mov qword [rsp], rax
mov qword [rsp + 8], 0xf
call fcn.0042bdc0
mov rax, qword [rsp + 0x68]
mov qword [rsp], rax
call fcn.0042bc50
lea rax, [0x0088b77f]
mov qword [rsp], rax
mov qword [rsp + 8], 4
call fcn.0042bdc0
mov rax, qword [rsp + 0x60]
mov qword [rsp], rax
call fcn.0042bc50
lea rax, [0x0088b76f]
mov qword [rsp], rax
mov qword [rsp + 8], 4
call fcn.0042bdc0
mov rax, qword [rsp + 0x58]
mov qword [rsp], rax
call fcn.0042bc50
lea rax, [0x0089f0bf]
mov qword [rsp], rax
mov qword [rsp + 8], 0xd
call fcn.0042bdc0
mov rax, qword [rsp + 0x50]
mov qword [rsp], rax
call fcn.0042bc50
lea rax, [0x0088b77f]
mov qword [rsp], rax
mov qword [rsp + 8], 4
call fcn.0042bdc0
mov rax, qword [rsp + 0x78]
mov qword [rsp], rax
call fcn.0042bc50
lea rax, [0x0088b76f]
mov qword [rsp], rax
mov qword [rsp + 8], 4
call fcn.0042bdc0
mov rax, qword [rsp + 0x48]
mov qword [rsp], rax
call fcn.0042bc50
lea rax, [0x0088e051]
mov qword [rsp], rax
mov qword [rsp + 8], 6
call fcn.0042bdc0
mov rax, qword [rsp + 0xc8]
mov qword [rsp], rax
call fcn.0042bd70
lea rax, [0x0088b018]
mov qword [rsp], rax
mov qword [rsp + 8], 2
call fcn.0042bdc0
call fcn.0042b490
mov rax, qword [rsp + 0xd0]
mov rbx, qword [rsp + 0x28]
jmp 0x43fe8b
mov ebx, dword [rdx + 0xb8]
test ebx, ebx
jne 0x43fe47
mov rbx, qword [rdx + 0xc8]
test rbx, rbx
jne 0x43fe47
mov rdx, qword [rdx + 0xa0]
mov edx, dword [rdx + 0xc]
cmp edx, 1
jne 0x43fe47
jmp 0x43fe61
mov rax, qword [rcx + 8]
mov qword [rsp + 0x110], rax
lea rsi, [rcx + 0x10]
lea rdi, [rsp + 0x118]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00454a36
mov rbp, qword [rbp]
mov rax, qword [rsp + 0x110]
mov qword [r8 + 0x70], rax
mov rax, qword [rsp + 0x118]
mov qword [r8 + 0x78], rax
mov rax, qword [r8 + 0x40]
mov qword [rsp], rax
call fcn.00443c90
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 8]
test rcx, rcx
jne 0x4403bc
mov rdx, qword [rsp + 0xd0]
mov eax, 9
lea rcx, [0x008943d9]
xor ebx, ebx
jmp 0x4405bd
mov qword [rsp + 0xc0], rcx
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.004443d0
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rsp + 0xd0]
mov rbx, qword [rdx + 0x40]
mov rsi, qword [rsp + 0xc0]
sub rbx, qword [rsi]
jmp 0x4405bd
call fcn.0042b400
lea rax, [0x008b1c86]
mov qword [rsp], rax
mov qword [rsp + 8], 0x21
call fcn.0042bdc0
mov rax, qword [0x00b01308]
mov qword [rsp], rax
call fcn.0042bac0
lea rax, [0x0089aafe]
mov qword [rsp], rax
mov qword [rsp + 8], 0xc
call fcn.0042bdc0
call fcn.0042b490
lea rax, [0x008a1260]
mov qword [rsp], rax
mov qword [rsp + 8], 0xe
call fcn.0042ab20
ud2
lea rax, [0x008b2668]
mov qword [rsp], rax
mov qword [rsp + 8], 0x22
call fcn.0042ab20
ud2
lea rax, [0x008a6701]
mov qword [rsp], rax
mov qword [rsp + 8], 0x13
call fcn.0042ab20
ud2
mov ecx, dword [rax + 0x90]
mov dword [rsp + 0x24], ecx
call fcn.0042b400
lea rax, [0x0089c5fe]
mov qword [rsp], rax
mov qword [rsp + 8], 0xc
call fcn.0042bdc0
mov rax, qword [rsp + 0xd0]
mov qword [rsp], rax
call fcn.0042bd70
lea rax, [0x0089cd0c]
mov qword [rsp], rax
mov qword [rsp + 8], 0xd
call fcn.0042bdc0
mov eax, dword [rsp + 0x24]
mov eax, eax
mov qword [rsp], rax
call fcn.0042bc50
lea rax, [0x0088afac]
mov qword [rsp], rax
mov qword [rsp + 8], 2
call fcn.0042bdc0
call fcn.0042b490
mov rax, qword [rsp + 0xd0]
mov rax, qword [rax]
mov qword [rsp + 0x80], rax
call fcn.0042b400
lea rax, [0x008b05d6]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1f
call fcn.0042bdc0
mov rax, qword [rsp + 0x28]
mov qword [rsp], rax
call fcn.0042bc50
lea rax, [0x0088b03b]
mov qword [rsp], rax
mov qword [rsp + 8], 3
call fcn.0042bdc0
mov rax, qword [rsp + 0x80]
mov qword [rsp], rax
call fcn.0042bc50
call fcn.0042b6b0
call fcn.0042b490
lea rax, [0x008aeeda]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1d
call fcn.0042ab20
ud2
lea rax, [0x008ab9fe]
mov qword [rsp], rax
mov qword [rsp + 8], 0x19
call fcn.0042ab20
ud2
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x98], rcx
mov rsi, qword [rdx]
mov qword [rsp + 0x80], rsi
mov rdi, qword [rdx + 8]
mov qword [rsp + 0x78], rdi
mov r8, qword [rsp + 0x118]
mov qword [rsp + 0x70], r8
mov r9, qword [rsp + 0x110]
mov qword [rsp + 0x68], r9
mov r10, qword [rsp + 0x138]
mov qword [rsp + 0x60], r10
mov r11, qword [rdx + 0x40]
mov qword [rsp + 0x58], r11
mov r12, qword [rdx + 0x38]
mov qword [rsp + 0x50], r12
mov r13, qword [rdx + 0x60]
mov qword [rsp + 0x48], r13
mov r14, qword [rdx + 0x50]
mov qword [rsp + 0xc8], r14
call fcn.0042b400
lea rax, [0x008a839a]
mov qword [rsp], rax
mov qword [rsp + 8], 0x15
call fcn.0042bdc0
mov rax, qword [rsp + 0x98]
mov qword [rsp], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 8], rax
call fcn.0042bdc0
lea rax, [0x0088ae59]
mov qword [rsp], rax
mov qword [rsp + 8], 1
call fcn.0042bdc0
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
call fcn.0042bc50
lea rax, [0x0088b783]
mov qword [rsp], rax
mov qword [rsp + 8], 4
call fcn.0042bdc0
mov rax, qword [rsp + 0x50]
mov qword [rsp], rax
call fcn.0042bc50
lea rax, [0x0089205c]
mov qword [rsp], rax
mov qword [rsp + 8], 8
call fcn.0042bdc0
mov rax, qword [rsp + 0x80]
mov qword [rsp], rax
call fcn.0042bc50
lea rax, [0x0088aebe]
mov qword [rsp], rax
mov qword [rsp + 8], 2
call fcn.0042bdc0
mov rax, qword [rsp + 0x78]
mov qword [rsp], rax
call fcn.0042bc50
lea rax, [0x008a2109]
mov qword [rsp], rax
mov qword [rsp + 8], 0xf
call fcn.0042bdc0
mov rax, qword [rsp + 0x70]
mov qword [rsp], rax
call fcn.0042bc50
lea rax, [0x0088b77f]
mov qword [rsp], rax
mov qword [rsp + 8], 4
call fcn.0042bdc0
mov rax, qword [rsp + 0x68]
mov qword [rsp], rax
call fcn.0042bc50
lea rax, [0x0088b76f]
mov qword [rsp], rax
mov qword [rsp + 8], 4
call fcn.0042bdc0
mov rax, qword [rsp + 0x60]
mov qword [rsp], rax
call fcn.0042bc50
lea rax, [0x0089f0bf]
mov qword [rsp], rax
mov qword [rsp + 8], 0xd
call fcn.0042bdc0
mov rax, qword [rsp + 0x58]
mov qword [rsp], rax
call fcn.0042bc50
lea rax, [0x0088b77f]
mov qword [rsp], rax
mov qword [rsp + 8], 4
call fcn.0042bdc0
mov rax, qword [rsp + 0x50]
mov qword [rsp], rax
call fcn.0042bc50
lea rax, [0x0088b76f]
mov qword [rsp], rax
mov qword [rsp + 8], 4
call fcn.0042bdc0
mov rax, qword [rsp + 0x48]
mov qword [rsp], rax
call fcn.0042bc50
lea rax, [0x0088e051]
mov qword [rsp], rax
mov qword [rsp + 8], 6
call fcn.0042bdc0
mov rax, qword [rsp + 0xc8]
mov qword [rsp], rax
call fcn.0042bd70
lea rax, [0x0088b018]
mov qword [rsp], rax
mov qword [rsp + 8], 2
call fcn.0042bdc0
call fcn.0042b490
mov rax, qword [rsp + 0x90]
mov rax, qword [rax + 0x30]
mov byte [rax + 0xf9], 2
mov rax, qword [rsp + 0x118]
mov qword [rsp], rax
mov rax, qword [rsp + 0x110]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x138]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x18], rax
call fcn.0044ac50
lea rax, [0x008b1066]
mov qword [rsp], rax
mov qword [rsp + 8], 0x20
call fcn.0042ab20
ud2
mov qword [rsp + 0xb8], rcx
mov qword [rsp + 0x40], rbx
mov rax, qword [rcx]
mov qword [rsp + 0xb0], rax
mov rdx, qword [rcx + 0x50]
mov qword [rsp + 0xa8], rdx
call fcn.0042b400
lea rax, [0x008b1026]
mov qword [rsp], rax
mov qword [rsp + 8], 0x20
call fcn.0042bdc0
mov rax, qword [rsp + 0x40]
mov qword [rsp], rax
call fcn.0042bc50
lea rax, [0x0088bbbb]
mov qword [rsp], rax
mov qword [rsp + 8], 4
call fcn.0042bdc0
mov rax, qword [rsp + 0xb8]
mov qword [rsp], rax
call fcn.0042bd70
lea rax, [0x00894364]
mov qword [rsp], rax
mov qword [rsp + 8], 9
call fcn.0042bdc0
mov rax, qword [rsp + 0xd0]
mov qword [rsp], rax
call fcn.0042bd70
lea rax, [0x0088fe19]
mov qword [rsp], rax
mov qword [rsp + 8], 7
call fcn.0042bdc0
mov rax, qword [rsp + 0xb0]
mov qword [rsp], rax
call fcn.0042bd70
lea rax, [0x0089aa4a]
mov qword [rsp], rax
mov qword [rsp + 8], 0xc
call fcn.0042bdc0
mov rax, qword [rsp + 0xa8]
mov qword [rsp], rax
call fcn.0042bd70
call fcn.0042b6b0
call fcn.0042b490
mov rax, qword [rsp + 0x90]
mov rcx, qword [rax + 0x30]
test byte [rax], al
mov rax, qword [rcx + 8]
mov qword [rsp + 0x148], rax
lea rsi, [rcx + 0x10]
lea rdi, [rsp + 0x150]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00454a36
mov rbp, qword [rbp]
mov rax, qword [rsp + 0x150]
mov rcx, qword [rsp + 0x158]
mov qword [rsp], rax
mov rax, qword [rsp + 0x148]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x170]
mov qword [rsp + 0x10], rax
mov qword [rsp + 0x18], rcx
call fcn.0044ac50
lea rax, [0x008b39aa]
mov qword [rsp], rax
mov qword [rsp + 8], 0x24
call fcn.0042ab20
ud2
lea rax, [0x008aa2e0]
mov qword [rsp], rax
mov qword [rsp + 8], 0x17
call fcn.0042ab20
ud2
call fcn.00451b80
jmp fcn.0043fd30