Function at 0x432340
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4326a1
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rcx, qword [rax + 0x30]
mov edx, dword [rcx + 0xd0]
test edx, edx
jne 0x432686
mov qword [rsp + 0x28], rax
mov rcx, qword [rcx + 0x138]
test rcx, rcx
jne 0x432623
mov rcx, qword [rax + 0x30]
movzx ecx, byte [rcx + 0xe9]
test cl, cl
jne 0x43266b
jmp 0x4323c2
mov qword [rsp], rax
call fcn.00431060
mov rax, qword [rsp + 0x28]
mov ecx, dword [0x010f0b38]
test ecx, ecx
jne 0x432614
mov rcx, qword [rax + 0x30]
mov rcx, qword [rcx + 0xa0]
test byte [rcx], al
mov ecx, dword [rcx + 0x22a0]
test ecx, ecx
jne 0x432605
movzx ecx, byte [0x01112510]
test cl, cl
je 0x4325ef
call fcn.00446980
mov rax, qword [rsp]
test rax, rax
jne 0x4325b5
test rax, rax
je 0x432578
test rax, rax
je 0x4324e3
test rax, rax
je 0x432494
xor ecx, ecx
test rax, rax
je 0x432484
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rdx + 0x30]
movzx ebx, byte [rbx + 0xe4]
test bl, bl
jne 0x432465
mov rbx, qword [rax + 0xe0]
test rbx, rbx
jne 0x4323b4
mov qword [rsp], rax
mov byte [rsp + 8], cl
call fcn.00431290
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov byte [rsp + 0x1f], cl
mov qword [rsp + 0x20], rax
call fcn.004320d0
mov rax, qword [rsp + 0x20]
movzx ecx, byte [rsp + 0x1f]
mov rdx, qword [rsp + 0x28]
jmp 0x43243e
call fcn.00431410
mov rax, qword [rsp]
movzx ecx, byte [rsp + 8]
jmp 0x43242a
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x30]
mov rcx, qword [rcx + 0xa0]
mov qword [rsp], rcx
call fcn.00437840
mov rax, qword [rsp + 8]
movzx ecx, byte [rsp + 0x10]
test rax, rax
je 0x4324d9
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rdx + 0x30]
movzx ebx, byte [rbx + 0xe4]
test bl, bl
jne 0x432650
jmp 0x432425
mov rdx, qword [rsp + 0x28]
jmp 0x432425
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rcx + 0x30]
mov rdx, qword [rdx + 0xa0]
mov edx, dword [rdx + 0x18]
mov ebx, 0x864b8a7e
imul rbx, rdx
shr rbx, 0x25
imul ebx, ebx, 0x3d
sub edx, ebx
test edx, edx
jne 0x43241e
mov edx, dword [0x010f0ac8]
test edx, edx
jle 0x43241e
lea rax, [0x010f0a70]
mov qword [rsp], rax
call fcn.0040e440
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x30]
mov rcx, qword [rcx + 0xa0]
mov qword [rsp], rcx
mov dword [rsp + 8], 1
call fcn.004372e0
mov rax, qword [rsp + 0x10]
mov qword [rsp + 0x20], rax
lea rcx, [0x010f0a70]
mov qword [rsp], rcx
call fcn.0040e630
mov rcx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x20]
jmp 0x43241e
mov ecx, dword [0x01635f30]
test ecx, ecx
je 0x432415
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x30]
mov rcx, qword [rcx + 0xa0]
lea rdx, [0x01636d40]
mov qword [rsp], rdx
mov qword [rsp + 8], rcx
call fcn.00416d30
mov rax, qword [rsp + 0x10]
jmp 0x432415
mov qword [rsp + 0x30], rax
movabs rax, 0x100000004
mov qword [rsp + 8], rax
call fcn.0042e4a0
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
mov qword [rsp + 8], 0
call fcn.004482f0
mov rax, qword [rsp + 0x30]
jmp 0x43240c
movzx ecx, byte [0x01112511]
test cl, cl
jne 0x4323fa
xor eax, eax
jmp 0x43240c
call fcn.0042fb20
mov rax, qword [rsp + 0x28]
jmp 0x4323eb
call fcn.00431160
mov rax, qword [rsp + 0x28]
jmp 0x4323c2
call fcn.00430d90
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x30]
mov rcx, qword [rcx + 0x138]
mov qword [rsp], rcx
mov byte [rsp + 8], 0
call fcn.00431290
mov rax, qword [rsp + 0x28]
jmp 0x43239f
lea rax, [0x008b26ac]
mov qword [rsp], rax
mov qword [rsp + 8], 0x22
call fcn.0042ab20
ud2
lea rax, [0x008a39cc]
mov qword [rsp], rax
mov qword [rsp + 8], 0x10
call fcn.0042ab20
ud2
lea rax, [0x008aa1cc]
mov qword [rsp], rax
mov qword [rsp + 8], 0x17
call fcn.0042ab20
ud2
call fcn.00451b80
jmp fcn.00432340