Function at 0x41e060
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x41e40c
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
mov rdx, qword [rcx + 0x30]
movsd xmm0, qword [0x0110c0b8]
inc dword [rdx + 0xd0]
mov edx, dword [0x0110c004]
test edx, edx
jne 0x41e33a
mov qword [rsp + 0x50], rcx
movsd qword [rsp + 0x28], xmm0
mov edx, 1
lea rbx, [0x0110c008]
lock xadd dword [rbx], edx
mov edx, dword [0x0110c000]
jmp 0x41e0dd
mov edx, esi
mov esi, edx
shr edx, 1
and edx, 1
dec edx
neg edx
cmp rdx, 2
jae 0x41e405
lea rdx, [rdx + rdx*4]
lea rdi, [0x0110afe0]
lea r8, [rdi + rdx*8 + 0x1080]
mov r9d, 0xffffffff
lock xadd dword [r8], r9d
dec r9d
test r9d, r9d
jge 0x41e306
mov edx, 1
lock xadd dword [r8], edx
xor eax, eax
test rax, rax
je 0x41e2ec
movzx edx, byte [rax + 0x64]
cmp dl, 1
je 0x41e149
mov r8d, dword [rax + 0x58]
cmp r8d, esi
jne 0x41e358
jmp 0x41e0db
mov edx, dword [rax + 0x58]
lea r8d, [rsi - 2]
cmp edx, r8d
jne 0x41e0db
lea edx, [rsi - 1]
mov r9, rax
mov eax, r8d
lock cmpxchg dword [r9 + 0x58], edx
sete dl
test dl, dl
je 0x41e0db
mov rax, qword [r9 + 0x20]
mov qword [rsp + 0x30], rax
mov qword [rsp], r9
mov byte [rsp + 8], 0
call fcn.0041e580
movzx eax, byte [rsp + 0x10]
test al, al
je 0x41e2e5
mov rax, qword [rsp + 0x30]
mov ecx, 0xffffffff
lea rdx, [0x0110c008]
lock xadd dword [rdx], ecx
dec ecx
test ecx, ecx
jne 0x41e1c2
mov ecx, dword [0x0110c004]
test ecx, ecx
je 0x41e1c2
mov ecx, dword [0x01636a50]
test ecx, ecx
jg 0x41e1e1
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 0x30]
add dword [rcx + 0xd0], 0xffffffff
mov qword [rsp + 0x68], rax
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 0x30], rax
mov rax, qword [0x0163e800]
mov qword [rsp + 0x48], rax
mov rcx, qword [0x0110c0b0]
mov qword [rsp + 0x40], rcx
mov rdx, qword [0x0110c0a0]
mov qword [rsp + 0x38], rdx
call fcn.0042b400
lea rax, [0x008b04de]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1f
call fcn.0042bdc0
mov rax, qword [rsp + 0x48]
shr rax, 0x14
mov qword [rsp], rax
call fcn.0042bac0
lea rax, [0x0089f51e]
mov qword [rsp], rax
mov qword [rsp + 8], 0xe
call fcn.0042bdc0
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
sub rax, rcx
shr rax, 0x14
mov qword [rsp], rax
call fcn.0042bac0
lea rax, [0x008a9732]
mov qword [rsp], rax
mov qword [rsp + 8], 0x17
call fcn.0042bdc0
mov rax, qword [rsp + 0x38]
mov qword [rsp], rax
call fcn.0042bac0
lea rax, [0x00896503]
mov qword [rsp], rax
mov qword [rsp + 8], 0xa
call fcn.0042bdc0
movsd xmm0, qword [rsp + 0x28]
movsd qword [rsp], xmm0
call fcn.0042b780
lea rax, [0x0089aa62]
mov qword [rsp], rax
mov qword [rsp + 8], 0xc
call fcn.0042bdc0
call fcn.0042b490
mov rax, qword [rsp + 0x30]
jmp 0x41e1c2
xor eax, eax
jmp 0x41e198
mov edx, 1
lea rsi, [0x0110c004]
xchg dword [rsi], edx
mov rax, 0xffffffffffffffff
jmp 0x41e198
mov r8d, r9d
shr r9d, 9
mov rdx, qword [rdi + rdx*8 + 0x1068]
lea r10, [rdx + r9*8]
test byte [r10], al
mov rdx, qword [rdx + r9*8]
test byte [rdx], al
and r8d, 0x1ff
mov rax, qword [rdx + r8*8]
mov qword [rdx + r8*8], 0
jmp 0x41e128
mov rax, qword [rcx + 0x30]
add dword [rax + 0xd0], 0xffffffff
mov qword [rsp + 0x68], 0xffffffffffffffff
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov dword [rsp + 0x24], esi
mov byte [rsp + 0x1f], dl
mov dword [rsp + 0x20], r8d
call fcn.0042b400
lea rax, [0x008aca0d]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1a
call fcn.0042bdc0
movzx eax, byte [rsp + 0x1f]
movzx eax, al
mov qword [rsp], rax
call fcn.0042bac0
lea rax, [0x0089aa86]
mov qword [rsp], rax
mov qword [rsp + 8], 0xc
call fcn.0042bdc0
mov eax, dword [rsp + 0x20]
mov qword [rsp], rax
call fcn.0042bac0
lea rax, [0x00896553]
mov qword [rsp], rax
mov qword [rsp + 8], 0xa
call fcn.0042bdc0
mov eax, dword [rsp + 0x24]
mov qword [rsp], rax
call fcn.0042bac0
call fcn.0042b6b0
call fcn.0042b490
lea rax, [0x008b04bf]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1f
call fcn.0042ab20
ud2
call fcn.004292d0
ud2
call fcn.00451b80
jmp fcn.0041e060