Function at 0x6b25a0
Capabilities:
Reference http user-agent string
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x6b28f9
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
movzx eax, byte [0x01635e87]
cmp al, 1
jbe 0x6b25dd
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
jne 0x6b25e6
call fcn.00429570
ud2
mov byte [0x01635e87], 1
call fcn.004dfae0
call fcn.0046a650
call fcn.004acaf0
call fcn.00506d50
call fcn.0045ed10
call fcn.00568a00
call fcn.004a0040
call fcn.004bebd0
call fcn.006ac010
call fcn.004cc830
call fcn.00478de0
call fcn.0048f3c0
call fcn.004a1970
call fcn.00406a00
mov eax, dword [0x01636820]
mov rcx, qword [rsp]
test eax, eax
jne 0x6b28e5
mov qword [0x010ed458], rcx
call fcn.00406a00
mov eax, dword [0x01636820]
mov rcx, qword [rsp]
test eax, eax
jne 0x6b28d1
mov qword [0x010ed448], rcx
mov rax, qword [0x010e3b28]
mov rcx, qword [0x010e3b20]
mov qword [rsp], 0
lea rdx, [0x00890494]
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], 7
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rax
call fcn.006ada70
mov rax, qword [rsp + 0x28]
mov qword [0x01635f98], rax
mov rax, qword [0x010e3b28]
mov rcx, qword [0x010e3b20]
mov qword [rsp], 1
lea rdx, [0x0089cee0]
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], 0xd
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rax
call fcn.006ada70
mov rax, qword [rsp + 0x28]
mov qword [0x01635f80], rax
mov rax, qword [0x010e3b18]
mov rcx, qword [0x010e3b10]
mov qword [rsp], 2
lea rdx, [0x0089029c]
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], 7
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rax
call fcn.006ada70
mov rax, qword [rsp + 0x28]
mov qword [0x01635f90], rax
mov rax, qword [0x010e3b08]
mov rcx, qword [0x010e3b00]
mov qword [rsp], 3
lea rdx, [0x0089241c]
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], 8
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rax
call fcn.006ada70
mov rax, qword [rsp + 0x28]
mov qword [0x01635f88], rax
call fcn.00406a00
mov eax, dword [0x01636820]
mov rcx, qword [rsp]
test eax, eax
jne 0x6b28bd
mov qword [0x010ed450], rcx
mov qword [rsp], 0
lea rax, [0x00890fd1]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 7
lea rax, [0x008c4d60]
mov qword [rsp + 0x18], rax
call fcn.006acd00
mov rax, qword [rsp + 0x20]
mov qword [0x01635f78], rax
mov qword [rsp], rax
xorps xmm0, xmm0
movups xmmword [rsp + 8], xmm0
mov qword [rsp + 0x18], 0
call fcn.006acc50
lea rsi, [rsp + 0x20]
lea rdi, [0x01636880]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00454a44
mov rbp, qword [rbp]
mov rax, qword [0x01635f78]
mov qword [rsp], rax
xorps xmm0, xmm0
movups xmmword [rsp + 8], xmm0
movups xmmword [rsp + 0x18], xmm0
movups xmmword [rsp + 0x28], xmm0
call fcn.006ad370
mov rax, qword [rsp + 0x38]
mov qword [0x016369c0], rax
lea rsi, [rsp + 0x40]
lea rdi, [0x016369c8]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00454a36
mov rbp, qword [rbp]
lea rax, [0x008bc85b]
mov qword [rsp], rax
mov qword [rsp + 8], 0x43
call fcn.0045a2a0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x010ef060], rax
mov eax, dword [0x01636820]
test eax, eax
jne 0x6b28ac
mov qword [0x010ef068], rcx
mov byte [0x01635e87], 2
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
lea rdi, [0x010ef068]
mov rax, rcx
call fcn.004544a0
jmp 0x6b289b
lea rdi, [0x010ed450]
mov rax, rcx
call fcn.004544a0
jmp 0x6b27a0
lea rdi, [0x010ed448]
mov rax, rcx
call fcn.004544a0
jmp 0x6b266a
lea rdi, [0x010ed458]
mov rax, rcx
call fcn.004544a0
jmp 0x6b264c
call fcn.00451b80
jmp fcn.006b25a0