Function at 0x43b460
Capabilities:
Get geographical location
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x43b73f
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rcx, qword [rax + 0x30]
mov rcx, qword [rcx + 0x90]
cmp rax, rcx
jne 0x43b724
mov rax, qword [rsp + 0x70]
mov qword [rsp], rax
call fcn.0043b980
movzx eax, byte [rsp + 8]
test al, al
jne 0x43b71a
call fcn.0042c9e0
mov rax, qword [rsp]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x70]
mov rdx, rcx
mov qword [rax + 0x30], 0
mov qword [rax + 0x28], 0
mov dword [rax + 0x38], 0
shr rcx, 3
mov rbx, rax
movabs rax, 0x5197f7d73404147
mov rsi, rdx
mul rcx
add rdx, rcx
rcr rdx, 1
shr rdx, 7
imul rdx, rdx, 0xfb
sub rcx, rdx
mov qword [rsp + 0x38], rcx
mov rax, qword [rsp + 0x80]
bt eax, 0
jae 0x43b713
mov rdx, qword [0x01636608]
test rdx, rdx
ja 0x43b6e6
xor edx, edx
bt eax, 1
jae 0x43b567
mov rax, qword [0x01636668]
test rax, rax
jbe 0x43b567
test rdx, rdx
je 0x43b6c9
mov qword [rbx + 0x28], rdx
mov qword [rsp + 0x28], rdx
shl rcx, 6
mov qword [rsp + 0x30], rcx
lea rax, [0x0110e640]
lea rdi, [rax + rcx]
mov qword [rsp + 0x48], rdi
jmp 0x43b598
lea rax, [0x0110e640]
mov rcx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x48]
test byte [rdi], al
lea rdx, [rax + rcx]
mov qword [rsp + 0x58], rdx
mov qword [rsp], rdx
call fcn.0040e440
mov rax, qword [rsp + 0x30]
lea rcx, [0x0110e640]
lea rdx, [rcx + rax + 0x10]
mov qword [rsp + 0x50], rdx
mov ebx, 1
lock xadd dword [rdx], ebx
mov rbx, qword [rsp + 0x70]
mov qword [rsp], rbx
call fcn.0043b980
movzx eax, byte [rsp + 8]
test al, al
jne 0x43b6ab
mov rax, qword [rsp + 0x48]
mov qword [rsp], rax
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 8], rcx
mov rdx, qword [rsp + 0x40]
mov qword [rsp + 0x10], rdx
movzx ebx, byte [rsp + 0x78]
mov byte [rsp + 0x18], bl
call fcn.0043b9b0
mov rax, qword [rsp + 0x58]
mov qword [rsp], rax
lea rax, [0x008981af]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0xa
mov byte [rsp + 0x18], 0x19
mov qword [rsp + 0x20], 4
call fcn.0042c8f0
mov rax, qword [rsp + 0x40]
mov ecx, dword [rax + 0x38]
test ecx, ecx
jne 0x43b669
mov rax, qword [rsp + 0x70]
mov qword [rsp], rax
call fcn.0043b980
movzx eax, byte [rsp + 8]
test al, al
je 0x43b587
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x30]
test rcx, rcx
jg 0x43b68a
mov qword [rsp], rax
call fcn.0042cd80
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov rax, qword [rsp + 0x28]
sub rcx, rax
mov qword [rsp], rcx
mov qword [rsp + 8], 3
call fcn.00424490
mov rax, qword [rsp + 0x40]
jmp 0x43b677
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x50]
lock xadd dword [rcx], eax
mov rax, qword [rsp + 0x58]
mov qword [rsp], rax
call fcn.0040e630
jmp 0x43b669
call fcn.00453390
mov rdx, qword [rsp]
mov rcx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x70]
jmp 0x43b563
call fcn.00453390
mov rdx, qword [rsp]
mov rbx, qword [rsp + 0x40]
mov qword [rbx + 0x30], 0xffffffffffffffff
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x70]
jmp 0x43b548
xor edx, edx
jmp 0x43b548
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
lea rax, [0x008aef88]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1d
call fcn.0042ab20
ud2
call fcn.00451b80
jmp fcn.0043b460