Function at 0x654420
Capabilities:
Reference http user-agent string
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x654736
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
movzx eax, byte [0x01635e83]
cmp al, 1
jbe 0x65445d
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
jne 0x654466
call fcn.00429570
ud2
mov byte [0x01635e83], 1
call fcn.0046a650
call fcn.004e6470
call fcn.004dfae0
call fcn.004bebd0
call fcn.004514e0
call fcn.004acaf0
call fcn.00460de0
call fcn.004a1970
call fcn.004c51b0
call fcn.004cc830
call fcn.0045cf30
call fcn.0045ed10
lea rax, [0x008b97f0]
mov qword [rsp], rax
mov qword [rsp + 8], 0x33
call fcn.0045a2a0
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x10]
mov qword [0x010eef70], rcx
mov ecx, dword [0x01636820]
test ecx, ecx
jne 0x654725
mov qword [0x010eef78], rax
lea rax, [0x00807900]
mov qword [rsp], rax
call fcn.00410220
lea rax, [0x007c94a0]
mov qword [rsp], rax
call fcn.004b3720
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rax, qword [rax + 0x48]
mov qword [rsp], rcx
call rax
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x10]
mov qword [0x010eefb0], rax
mov eax, dword [0x01636820]
test eax, eax
jne 0x654711
mov qword [0x010eefb8], rcx
lea rax, [0x0080a780]
mov qword [rsp], rax
lea rax, [0x008f7980]
mov qword [rsp + 8], rax
call fcn.004b3720
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x010eef90], rax
mov eax, dword [0x01636820]
test eax, eax
jne 0x6546fd
mov qword [0x010eef98], rcx
lea rax, [0x00807b80]
mov qword [rsp], rax
call fcn.00410220
lea rax, [0x007c96e0]
mov qword [rsp], rax
call fcn.004b3720
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rax, qword [rax + 0x48]
mov qword [rsp], rcx
call rax
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x10]
mov qword [0x010eef80], rax
mov eax, dword [0x01636820]
test eax, eax
jne 0x6546e9
mov qword [0x010eef88], rcx
lea rax, [0x00807880]
mov qword [rsp], rax
call fcn.00410220
lea rax, [0x007c9460]
mov qword [rsp], rax
call fcn.004b3720
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rax, qword [rax + 0x48]
mov qword [rsp], rcx
call rax
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x10]
mov qword [0x010eefa0], rax
mov eax, dword [0x01636820]
test eax, eax
jne 0x6546d5
mov qword [0x010eefa8], rcx
lea rax, [0x00816720]
mov qword [rsp], rax
call fcn.00410220
mov rax, qword [rsp + 8]
lea rcx, [0x00654970]
mov qword [rax], rcx
mov qword [rax + 8], 0x20
mov edx, dword [0x01636820]
test edx, edx
jne 0x6546c7
mov qword [0x010ed420], rax
lea rax, [0x00816720]
mov qword [rsp], rax
call fcn.00410220
mov rax, qword [rsp + 8]
lea rcx, [0x00654970]
mov qword [rax], rcx
mov qword [rax + 8], 0x40
mov ecx, dword [0x01636820]
test ecx, ecx
jne 0x6546b9
mov qword [0x010ed428], rax
mov byte [0x01635e83], 2
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdi, [0x010ed428]
call fcn.004544a0
jmp 0x6546a8
lea rdi, [0x010ed420]
call fcn.004544a0
jmp 0x654670
lea rdi, [0x010eefa8]
mov rax, rcx
call fcn.004544a0
jmp 0x654638
lea rdi, [0x010eef88]
mov rax, rcx
call fcn.004544a0
jmp 0x6545de
lea rdi, [0x010eef98]
mov rax, rcx
call fcn.004544a0
jmp 0x654584
lea rdi, [0x010eefb8]
mov rax, rcx
call fcn.004544a0
jmp 0x654542
lea rdi, [0x010eef78]
call fcn.004544a0
jmp 0x6544e8
call fcn.00451b80
jmp fcn.00654420