Function at 0x426c00
Capabilities:
Reference http user-agent string
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
lea rax, [rsp - 0x800]
cmp rax, qword [rcx + 0x10]
jbe 0x4270e6
sub rsp, 0x880
mov qword [rsp + 0x878], rbp
lea rbp, [rsp + 0x878]
lea rdi, [rsp + 0x78]
mov ecx, 0x100
xor eax, eax
rep stosq qword [rdi], rax
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x58], 0
mov dword [rsp + 0x4c], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x60], 0
mov rdx, qword gs:[0x28]
mov rdx, qword [rdx]
mov rdx, qword [rdx + 0x30]
mov rbx, qword [0x00b012f8]
cmp rbx, 0xffffffffffffffff
je 0x426fea
movzx ecx, byte [rsp + 0x888]
test cl, cl
je 0x426fe3
mov eax, 0xffffffff
mov qword [rsp + 0x70], rdx
mov dword [rsp + 0x44], eax
jmp 0x426cd0
mov eax, dword [rsp + 0x44]
movzx ecx, byte [rsp + 0x888]
mov rdx, qword [rsp + 0x70]
mov rbx, qword [0x010ee5a0]
test rbx, rbx
jne 0x426e04
mov qword [rsp + 0x68], 0
mov dword [rsp + 0x48], 0
test cl, cl
je 0x426cfc
mov byte [rdx + 0xe5], 1
mov rcx, qword [sym.imp.KERNEL32.DLL_GetQueuedCompletionStatus]
mov qword [rsp], rcx
mov rcx, qword [0x00b012f8]
mov qword [rsp + 8], rcx
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x10], rcx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x18], rcx
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rax
call fcn.00428f00
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x426dae
xor eax, eax
mov rcx, qword [rsp + 0x70]
mov byte [rcx + 0xe5], 0
lea rdx, [rsp + 0x60]
mov qword [rsp], rdx
mov rbx, qword [rsp + 0x68]
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], eax
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x14], eax
call fcn.004270f0
movzx eax, byte [rsp + 0x888]
test al, al
je 0x426d91
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x426cbf
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x890], rax
mov rbp, qword [rsp + 0x878]
add rsp, 0x880
ret
mov rax, qword [rsp + 0x70]
mov byte [rax + 0xe5], 0
call fcn.004554b0
mov eax, dword [rsp]
movzx ecx, byte [rsp + 0x888]
test cl, cl
je 0x426de1
mov rdx, qword [rsp + 0x68]
test rdx, rdx
jne 0x426d47
jmp 0x427006
cmp eax, 0x102
jne 0x426dce
mov qword [rsp + 0x890], 0
mov rbp, qword [rsp + 0x878]
add rsp, 0x880
ret
movsxd rbx, dword [0x01635f3c]
test rbx, rbx
je 0x4270df
mov esi, eax
mov eax, 0x40
mov rdi, rdx
cmp rbx, 0xffffffffffffffff
je 0x426e2b
cqo
idiv rbx
jmp 0x426e30
neg rax
xor edx, edx
mov dword [rsp + 0x4c], eax
cmp eax, 8
jae 0x426fdc
mov dword [rsp + 0x4c], 8
test cl, cl
je 0x426e50
mov byte [rdi + 0xe5], 1
lea rax, [rsp + 0x78]
mov qword [rsp + 0x10], rax
mov rax, qword [0x010ee5a0]
mov qword [rsp], rax
mov rax, qword [0x00b012f8]
mov qword [rsp + 8], rax
mov eax, dword [rsp + 0x4c]
mov qword [rsp + 0x18], rax
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], 0
call fcn.00428f60
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x426f8d
mov rcx, qword [rsp + 0x70]
mov byte [rcx + 0xe5], 0
xor eax, eax
jmp 0x426ee4
lea rcx, [rsp + 0x60]
mov qword [rsp], rcx
mov rdx, qword [rsp + 0x68]
mov qword [rsp + 8], rdx
mov dword [rsp + 0x10], eax
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x14], eax
call fcn.004270f0
mov eax, dword [rsp + 0x54]
inc eax
mov rcx, qword [rsp + 0x70]
mov edx, dword [rsp + 0x4c]
cmp eax, edx
jae 0x426f7e
cmp rax, 0x40
jae 0x427071
mov dword [rsp + 0x54], eax
shl rax, 5
mov rax, qword [rsp + rax + 0x80]
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x48], 0
mov rax, qword [rsp + 0x68]
mov rax, qword [rax + 0x20]
mov rax, qword [rax + 0x10]
mov qword [rsp + 8], rax
mov rax, qword [sym.imp.ws2_32.dll_WSAGetOverlappedResult]
mov qword [rsp], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x10], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], 0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
call fcn.00428f00
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x426f71
xor eax, eax
jmp 0x426eb5
call fcn.004554b0
mov eax, dword [rsp]
jmp 0x426eb5
movzx eax, byte [rsp + 0x888]
test al, al
jmp 0x426d81
mov rax, qword [rsp + 0x70]
mov byte [rax + 0xe5], 0
call fcn.004554b0
mov eax, dword [rsp]
mov dword [rsp + 0x5c], eax
movzx ecx, byte [rsp + 0x888]
test cl, cl
jne 0x427078
cmp eax, 0x102
jne 0x427078
mov qword [rsp + 0x890], 0
mov rbp, qword [rsp + 0x878]
add rsp, 0x880
ret
test cl, cl
jmp 0x426e47
xor eax, eax
jmp 0x426cb4
mov qword [rsp + 0x890], 0
mov rbp, qword [rsp + 0x878]
add rsp, 0x880
ret
mov dword [rsp + 0x5c], eax
call fcn.0042b400
lea rax, [0x008b95f7]
mov qword [rsp], rax
mov qword [rsp + 8], 0x32
call fcn.0042bdc0
mov eax, dword [rsp + 0x5c]
movsxd rax, eax
mov qword [rsp], rax
call fcn.0042bbe0
lea rax, [0x0088b02f]
mov qword [rsp], rax
mov qword [rsp + 8], 3
call fcn.0042bdc0
call fcn.0042b490
lea rax, [0x008aa187]
mov qword [rsp], rax
mov qword [rsp + 8], 0x17
call fcn.0042ab20
ud2
call fcn.004292d0
ud2
call fcn.0042b400
lea rax, [0x008b9f91]
mov qword [rsp], rax
mov qword [rsp + 8], 0x34
call fcn.0042bdc0
mov eax, dword [rsp + 0x5c]
movsxd rax, eax
mov qword [rsp], rax
call fcn.0042bbe0
lea rax, [0x0088b02f]
mov qword [rsp], rax
mov qword [rsp + 8], 3
call fcn.0042bdc0
call fcn.0042b490
lea rax, [0x008aa187]
mov qword [rsp], rax
mov qword [rsp + 8], 0x17
call fcn.0042ab20
ud2
call fcn.004293b0
ud2
call fcn.00451b80
jmp fcn.00426c00