Function at 0x411880
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x411d0a
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov rax, qword [0x0110c308]
mov rdx, qword [rsp + 0x58]
cmp rdx, rax
jae 0x4118f8
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
mov dword [rsp + 0x80], 0
mov qword [rsp + 0x88], 0
mov qword [rsp + 0x90], 0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rbx, qword [0x0110c310]
cmp rdx, rbx
jae 0x4118b9
mov rbx, rdx
sub rdx, rax
shr rdx, 0xd
mov rsi, qword [0x0110c030]
mov rdi, qword [0x0110c028]
cmp rdx, rsi
jae 0x411d03
mov rsi, qword [rdi + rdx*8]
test rsi, rsi
je 0x41193e
mov rdi, qword [rsi + 0x18]
cmp rbx, rdi
jae 0x411be4
test rsi, rsi
je 0x411948
movzx eax, byte [rsi + 0x64]
cmp al, 2
jne 0x411983
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
mov dword [rsp + 0x80], 0
mov qword [rsp + 0x88], rsi
mov qword [rsp + 0x90], 0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, dword [0x01636a64]
test eax, eax
jne 0x4119c8
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
mov dword [rsp + 0x80], 0
mov qword [rsp + 0x88], rsi
mov qword [rsp + 0x90], 0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rdx
call fcn.0042b400
call fcn.0042b400
lea rax, [0x008a46e1]
mov qword [rsp], rax
mov qword [rsp + 8], 0x11
call fcn.0042bdc0
mov rax, qword [rsp + 0x58]
mov qword [rsp], rax
call fcn.0042bc50
call fcn.0042b490
mov rax, qword [rsp + 0x40]
movzx ecx, byte [rax + 0x64]
cmp cl, 1
je 0x411bbc
call fcn.0042b400
lea rax, [0x008a6893]
mov qword [rsp], rax
mov qword [rsp + 8], 0x14
call fcn.0042bdc0
call fcn.0042b490
mov rax, qword [rsp + 0x40]
movzx ecx, byte [rax + 0x64]
mov qword [rsp + 0x30], rcx
mov rdx, qword [rax + 0x80]
mov qword [rsp + 0x28], rdx
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x20], rax
call fcn.0042b400
lea rax, [0x0088c814]
mov qword [rsp], rax
mov qword [rsp + 8], 5
call fcn.0042bdc0
mov rax, qword [rsp + 0x38]
mov qword [rsp], rax
call fcn.0042bc50
lea rax, [0x0089cccb]
mov qword [rsp], rax
mov qword [rsp + 8], 0xd
call fcn.0042bdc0
mov rax, qword [rsp + 0x20]
mov qword [rsp], rax
call fcn.0042bc50
lea rax, [0x0089aa92]
mov qword [rsp], rax
mov qword [rsp + 8], 0xc
call fcn.0042bdc0
mov rax, qword [rsp + 0x28]
mov qword [rsp], rax
call fcn.0042bc50
lea rax, [0x0089aa9e]
mov qword [rsp], rax
mov qword [rsp + 8], 0xc
call fcn.0042bdc0
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
call fcn.0042bac0
call fcn.0042b6b0
call fcn.0042b490
mov rax, qword [rsp + 0x60]
test rax, rax
je 0x411ccd
call fcn.0042b400
lea rax, [0x008afc58]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1e
call fcn.0042bdc0
mov rax, qword [rsp + 0x60]
mov qword [rsp], rax
call fcn.0042bc50
lea rax, [0x0088ae59]
mov qword [rsp], rax
mov qword [rsp + 8], 1
call fcn.0042bdc0
mov rax, qword [rsp + 0x68]
mov qword [rsp], rax
call fcn.0042bc50
lea rax, [0x0088aeba]
mov qword [rsp], rax
mov qword [rsp + 8], 2
call fcn.0042bdc0
call fcn.0042b490
lea rax, [0x0088f491]
mov qword [rsp], rax
mov qword [rsp + 8], 6
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x18], rax
call fcn.0041d570
jmp 0x411ccd
call fcn.0042b400
lea rax, [0x008ab053]
mov qword [rsp], rax
mov qword [rsp + 8], 0x19
call fcn.0042bdc0
call fcn.0042b490
jmp 0x411a3d
mov r8, qword [rsi + 0x80]
cmp rbx, r8
jb 0x411bf8
test rsi, rsi
jmp 0x41193e
movzx r8d, byte [rsi + 0x64]
cmp r8b, 1
je 0x411c0b
test rsi, rsi
jmp 0x41193e
movzx edx, word [rsi + 0x5e]
test dx, dx
je 0x411c7e
sub rbx, rdi
movzx edx, dx
and rdx, rbx
lea rbx, [rdx + rdi]
movzx ecx, byte [rsi + 0x66]
shr rdx, cl
cmp cl, 0x40
sbb rdi, rdi
and rdx, rdi
mov rcx, rbx
sub rbx, rax
mov rax, qword [0x0110c2f8]
mov rdi, rbx
shr rbx, 5
sub rax, rbx
dec rax
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rax
shr rdi, 3
and rdi, 3
mov dword [rsp + 0x80], edi
mov qword [rsp + 0x88], rsi
mov qword [rsp + 0x90], rdx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rbx, rdi
mov rdx, qword [rsi + 0x68]
cmp rbx, rdx
jb 0x411cc5
movzx ecx, byte [rsi + 0x66]
shr rbx, cl
cmp cl, 0x40
sbb r8, r8
and rbx, r8
movzx r8d, word [rsi + 0x5c]
imul r8, rbx
movzx ecx, byte [rsi + 0x67]
shr r8, cl
cmp cl, 0x40
sbb rbx, rbx
and r8, rbx
imul rdx, r8
add rdx, rdi
mov rbx, rdx
mov rdx, r8
jmp 0x411c31
mov rdx, rdi
xor r8d, r8d
jmp 0x411cba
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
mov byte [rax + 0xf9], 2
lea rax, [0x008bbf24]
mov qword [rsp], rax
mov qword [rsp + 8], 0x3e
call fcn.0042ab20
ud2
call fcn.004292d0
ud2
call fcn.00451b80
jmp fcn.00411880