Function at 0x435a70
Capabilities:
Get geographical location
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x435ee7
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movzx eax, byte [0x01635edc]
test al, al
jne 0x435cd5
movzx eax, byte [0x01635eda]
test al, al
jne 0x435cd5
mov eax, dword [0x01635f50]
test eax, eax
ja 0x435ccb
mov eax, dword [0x010f0a80]
mov rcx, qword [0x010f0a88]
sub rcx, qword [0x010f0a98]
mov rdx, rcx
sub ecx, eax
mov ebx, dword [0x010f0a84]
sub ecx, ebx
mov esi, dword [0x010f0a94]
sub ecx, esi
test ecx, ecx
jg 0x435cc1
jl 0x435e07
lea rax, [0x016365f8]
mov qword [rsp], rax
call fcn.0040e440
xor eax, eax
mov rcx, rax
jmp 0x435b20
mov rdx, qword [rsp + 0x20]
inc rdx
mov rcx, rax
mov rax, rdx
mov qword [rsp + 0x28], rcx
mov rdx, qword [0x010f0058]
mov rbx, qword [0x010f0050]
cmp rax, rdx
jge 0x435b97
mov qword [rsp + 0x20], rax
mov rcx, qword [rbx + rax*8]
mov qword [rsp + 0x38], rcx
mov qword [rsp], rcx
call fcn.0044bb10
movzx eax, byte [rsp + 8]
test al, al
je 0x435b5f
mov rax, qword [rsp + 0x28]
jmp 0x435b12
mov rax, qword [rsp + 0x38]
mov ecx, dword [rax + 0x90]
mov edx, ecx
and ecx, 0xffffefff
lea ebx, [rcx - 1]
cmp ebx, 2
jbe 0x435d69
cmp ecx, 4
jne 0x435b8d
mov rax, qword [rsp + 0x28]
inc rax
jmp 0x435b12
mov rax, qword [rsp + 0x28]
jmp 0x435b12
lea rax, [0x016365f8]
mov qword [rsp], rax
call fcn.0040e630
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x435d4e
call fcn.004463a0
mov rax, qword [rsp]
test rax, rax
je 0x435d15
mov qword [rsp + 0x40], rax
movabs rax, 0x100000004
mov qword [rsp + 8], rax
call fcn.0042e4a0
mov rax, qword [rsp + 0x40]
mov qword [rax + 0xb8], 0
mov rcx, qword [0x010f0ac0]
test rcx, rcx
je 0x435ca9
lea rdx, [rcx + 0xb8]
test byte [rdx], al
mov rdx, rax
mov qword [rcx + 0xb8], rax
lea rax, [0x010f0ac0]
test byte [rax], al
mov qword [0x010f0ac0], rdx
inc dword [0x010f0ac8]
mov rax, qword [0x010f0aa8]
test rax, rax
je 0x435c53
mov rcx, qword [rax + 0x10]
mov qword [0x010f0aa8], rcx
mov ecx, 0xffffffff
lea rdx, [0x010f0ab0]
lock xadd dword [rdx], ecx
test rax, rax
je 0x435cfa
mov rcx, qword [0x010f0a78]
test rcx, rcx
je 0x435c7d
mov rdx, qword [rcx + 0x128]
mov qword [0x010f0a78], rdx
add dword [0x010f0a80], 0xffffffff
test rcx, rcx
je 0x435cdf
lea rdx, [rcx + 0xa8]
test byte [rdx], al
mov qword [rcx + 0xa8], rax
lea rax, [rcx + 0x118]
mov qword [rsp], rax
call fcn.0040e720
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
lea rcx, [0x010f0ab8]
test byte [rcx], al
mov rdx, rax
mov qword [0x010f0ab8], rax
jmp 0x435c13
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
lea rax, [0x008ab6de]
mov qword [rsp], rax
mov qword [rsp + 8], 0x19
call fcn.0042ab20
ud2
lea rax, [0x008ab6f7]
mov qword [rsp], rax
mov qword [rsp + 8], 0x19
call fcn.0042ab20
ud2
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
mov dword [rax + 0xbc], 0xffffffff
lea rax, [0x008b3ccf]
mov qword [rsp], rax
mov qword [rsp + 8], 0x25
call fcn.0042ab20
ud2
lea rax, [0x008ba80d]
mov qword [rsp], rax
mov qword [rsp + 8], 0x36
call fcn.0042ab20
ud2
mov dword [rsp + 0x1c], edx
lea rax, [0x016365f8]
mov qword [rsp], rax
call fcn.0040e630
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0x98]
mov qword [rsp + 0x30], rax
call fcn.0042b400
lea rax, [0x008ad5ad]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1b
call fcn.0042bdc0
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
call fcn.0042bbe0
lea rax, [0x008987e3]
mov qword [rsp], rax
mov qword [rsp + 8], 0xb
call fcn.0042bdc0
mov eax, dword [rsp + 0x1c]
mov eax, eax
mov qword [rsp], rax
call fcn.0042bac0
call fcn.0042b6b0
call fcn.0042b490
lea rax, [0x008a8067]
mov qword [rsp], rax
mov qword [rsp + 8], 0x15
call fcn.0042ab20
ud2
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x18], eax
mov dword [rsp + 0x14], ebx
mov dword [rsp + 0x10], esi
call fcn.0042b400
lea rax, [0x008ad5c8]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1b
call fcn.0042bdc0
mov eax, dword [rsp + 0x18]
movsxd rax, eax
mov qword [rsp], rax
call fcn.0042bbe0
lea rax, [0x0089f0da]
mov qword [rsp], rax
mov qword [rsp + 8], 0xe
call fcn.0042bdc0
mov eax, dword [rsp + 0x14]
movsxd rax, eax
mov qword [rsp], rax
call fcn.0042bbe0
lea rax, [0x0089201c]
mov qword [rsp], rax
mov qword [rsp + 8], 8
call fcn.0042bdc0
mov rax, qword [rsp + 0x30]
movsxd rax, eax
mov qword [rsp], rax
call fcn.0042bbe0
lea rax, [0x0088fe20]
mov qword [rsp], rax
mov qword [rsp + 8], 7
call fcn.0042bdc0
mov eax, dword [rsp + 0x10]
movsxd rax, eax
mov qword [rsp], rax
call fcn.0042bbe0
call fcn.0042b6b0
call fcn.0042b490
lea rax, [0x008af85c]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1e
call fcn.0042ab20
ud2
call fcn.00451b80
jmp fcn.00435a70