Function at 0x631500
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
lea rax, [rsp - 0x58]
cmp rax, qword [rcx + 0x10]
jbe 0x631fcc
sub rsp, 0xd8
mov qword [rsp + 0xd0], rbp
lea rbp, [rsp + 0xd0]
mov rcx, qword [rsp + 0xf0]
cmp rcx, 1
jb 0x631fc5
lea rdx, [rcx - 1]
mov qword [rsp + 0x70], rdx
mov rbx, rdx
neg rdx
sar rdx, 0x3f
and rdx, 1
mov qword [rsp + 0x98], rdx
mov rsi, qword [rsp + 0xe8]
lea r8, [rsi + rdx]
mov qword [rsp + 0xa0], r8
mov r9, qword [rsp + 0xe0]
mov rdi, qword [r9 + 0x20]
lea r10, [r9 + 0x20]
test rdi, rdi
je 0x631f70
mov qword [rsp + 0xb8], rdi
mov r11d, dword [0x01636820]
mov rax, qword [rdi + 0x20]
test r11d, r11d
jne 0x631f1e
mov qword [r9 + 0x20], rax
xorps xmm0, xmm0
lea rdi, [rdi - 0x10]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.004546ad
mov rbp, qword [rbp]
mov rax, qword [rsp + 0xb8]
mov byte [rax], 4
movzx r10d, word [r9]
mov word [rax + 2], r10w
lea r10, [rax + 0x40]
test byte [r10], al
mov qword [rax + 0x30], 0
mov qword [rax + 0x38], 2
mov r11d, dword [0x01636820]
lea rdi, [rax + 0x28]
test r11d, r11d
jne 0x631f07
mov qword [rax + 0x28], r10
cmp rcx, 1
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xc8], rdi
je 0x631ef9
movzx edx, byte [rsi + rdx]
cmp dl, 0x5e
jne 0x631eeb
lea rdx, [rcx - 2]
mov rbx, rdx
neg rdx
sar rdx, 0x3f
and rdx, 1
add rdx, r8
movzx r8d, word [r9]
test r8w, 4
jne 0x63168c
mov r8, qword [rax + 0x38]
mov r10, qword [rax + 0x30]
mov r11, qword [rax + 0x28]
lea r12, [r10 + 2]
cmp r12, r8
jg 0x631e3c
lea r8, [r10 + 2]
mov qword [rax + 0x30], r8
shl r10, 2
movabs r8, 0xa0000000a
mov qword [r11 + r10], r8
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x78], r8
mov r10, qword [rax + 0x30]
mov r11, qword [rax + 0x28]
mov r12, qword [rax + 0x38]
mov r13d, 1
jmp 0x6316e8
mov rcx, qword [rsp + 0xf0]
mov rdi, qword [rsp + 0xc8]
mov r9, qword [rsp + 0xe0]
xor r13d, r13d
mov r11, r8
mov r12, rbx
mov r10, rsi
mov rsi, qword [rsp + 0xe8]
mov r8, qword [rsp + 0x78]
mov rbx, rax
mov rax, qword [rsp + 0xb0]
test rbx, rbx
jne 0x631d13
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0xa8], rdx
je 0x631722
movzx r14d, byte [rdx]
cmp r14b, 0x2d
jne 0x631722
movzx r14d, word [r9]
test r14w, 0x40
jne 0x631722
test r13b, r13b
je 0x631c05
mov qword [rsp + 0xc0], r11
mov qword [rsp + 0x90], r12
mov qword [rsp + 0x88], r10
cmp rbx, 2
jle 0x631759
movzx r13d, byte [rdx]
cmp r13b, 0x5b
jne 0x631759
movzx r13d, byte [rdx + 1]
cmp r13b, 0x3a
je 0x631b45
mov qword [rsp], r9
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], r11
mov qword [rsp + 0x20], r10
mov qword [rsp + 0x28], r12
call fcn.00630ba0
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x58]
mov r8, qword [rsp + 0x30]
test rdi, rdi
jne 0x631b1a
test r8, r8
jne 0x6316ac
mov rax, qword [rsp + 0xe0]
mov qword [rsp], rax
mov rcx, qword [rsp + 0xa8]
mov qword [rsp + 8], rcx
mov rdx, qword [rsp + 0x80]
mov qword [rsp + 0x10], rdx
mov rbx, qword [rsp + 0xc0]
mov qword [rsp + 0x18], rbx
mov rsi, qword [rsp + 0x88]
mov qword [rsp + 0x20], rsi
mov rdi, qword [rsp + 0x90]
mov qword [rsp + 0x28], rdi
call fcn.00630490
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x30]
test rsi, rsi
je 0x631834
mov r8, rsi
mov rsi, rcx
mov rdi, rax
mov rax, rbx
mov rbx, rdi
jmp 0x6316ac
mov rax, qword [rsp + 0xe0]
mov qword [rsp], rax
mov rcx, qword [rsp + 0xa8]
mov qword [rsp + 8], rcx
mov rdx, qword [rsp + 0x80]
mov qword [rsp + 0x10], rdx
mov rbx, qword [rsp + 0xe8]
mov qword [rsp + 0x18], rbx
mov rsi, qword [rsp + 0xf0]
mov qword [rsp + 0x20], rsi
call fcn.006302e0
mov rax, qword [rsp + 0x40]
mov ecx, dword [rsp + 0x28]
mov rdx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x48]
test rax, rax
jne 0x631aef
cmp rdx, 2
jl 0x6318b7
movzx eax, byte [rbx]
cmp al, 0x2d
jne 0x6318b7
movzx eax, byte [rbx + 1]
lea rsi, [rbx + 1]
cmp al, 0x5d
jne 0x631979
mov eax, ecx
mov qword [rsp + 0x70], rdx
mov qword [rsp + 0xa0], rbx
mov rsi, qword [rsp + 0xe0]
movzx edi, word [rsi]
test di, 1
jne 0x631935
mov rdx, qword [rsp + 0xc0]
mov qword [rsp], rdx
mov rdx, qword [rsp + 0x88]
mov qword [rsp + 8], rdx
mov rdx, qword [rsp + 0x90]
mov qword [rsp + 0x10], rdx
mov dword [rsp + 0x18], eax
mov dword [rsp + 0x1c], ecx
call fcn.00632210
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x30]
mov rbx, rdx
mov r8, rcx
mov rsi, rax
mov rax, qword [rsp + 0x70]
mov rdx, qword [rsp + 0xa0]
jmp 0x6316ac
mov rdx, qword [rsp + 0xc0]
mov qword [rsp], rdx
mov rdx, qword [rsp + 0x88]
mov qword [rsp + 8], rdx
mov rdx, qword [rsp + 0x90]
mov qword [rsp + 0x10], rdx
mov dword [rsp + 0x18], eax
mov dword [rsp + 0x1c], ecx
call fcn.00632360
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x28]
jmp 0x63191a
mov dword [rsp + 0x6c], ecx
mov rax, qword [rsp + 0xe0]
mov qword [rsp], rax
mov qword [rsp + 8], rsi
lea rcx, [rdx - 1]
mov qword [rsp + 0x10], rcx
mov rcx, qword [rsp + 0xe8]
mov qword [rsp + 0x18], rcx
mov rdx, qword [rsp + 0xf0]
mov qword [rsp + 0x20], rdx
call fcn.006302e0
mov eax, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
test rsi, rsi
jne 0x631ac4
mov ebx, dword [rsp + 0x6c]
cmp eax, ebx
jl 0x6319f0
mov rbx, rdx
mov rdx, rcx
mov ecx, eax
mov eax, dword [rsp + 0x6c]
jmp 0x6318b9
mov rax, qword [rsp + 0x80]
mov rdx, rax
sub rax, rcx
cmp rax, rdx
ja 0x631fb7
mov qword [rsp + 0x80], rax
lea rax, [0x00824a20]
mov qword [rsp], rax
call fcn.00410220
mov rdi, qword [rsp + 8]
mov qword [rdi + 8], 0x1d
mov eax, dword [0x01636820]
test eax, eax
jne 0x631ab3
lea rcx, [0x008aebe8]
mov qword [rdi], rcx
mov rcx, qword [rsp + 0x80]
mov qword [rdi + 0x18], rcx
mov ecx, dword [0x01636820]
lea rdx, [rdi + 0x10]
test ecx, ecx
jne 0x631a98
mov rax, qword [rsp + 0xa8]
mov qword [rdi + 0x10], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0xf8], xmm0
lea rax, [0x008f9840]
mov qword [rsp + 0x108], rax
mov qword [rsp + 0x110], rdi
mov rbp, qword [rsp + 0xd0]
add rsp, 0xd8
ret
mov rax, rdi
mov rdi, rdx
mov rcx, rax
mov rax, qword [rsp + 0xa8]
call fcn.004544a0
mov rdi, rcx
jmp 0x631a66
lea rax, [0x008aebe8]
call fcn.004544a0
jmp 0x631a40
xorps xmm0, xmm0
movups xmmword [rsp + 0xf8], xmm0
mov qword [rsp + 0x108], rsi
mov qword [rsp + 0x110], rbx
mov rbp, qword [rsp + 0xd0]
add rsp, 0xd8
ret
xorps xmm0, xmm0
movups xmmword [rsp + 0xf8], xmm0
mov qword [rsp + 0x108], rax
mov qword [rsp + 0x110], rsi
mov rbp, qword [rsp + 0xd0]
add rsp, 0xd8
ret
xorps xmm0, xmm0
movups xmmword [rsp + 0xf8], xmm0
mov qword [rsp + 0x108], rdi
mov qword [rsp + 0x110], rcx
mov rbp, qword [rsp + 0xd0]
add rsp, 0xd8
ret
mov qword [rsp], r9
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], r11
mov qword [rsp + 0x20], r10
mov qword [rsp + 0x28], r12
call fcn.00630630
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x38]
mov r8, qword [rsp + 0x30]
test rcx, rcx
jne 0x631bda
test r8, r8
je 0x631ba5
mov rax, rdx
mov rdx, rbx
mov rbx, rsi
mov rsi, rdi
jmp 0x6316ac
mov rdx, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0x80]
mov r9, qword [rsp + 0xe0]
mov r10, qword [rsp + 0x88]
mov r11, qword [rsp + 0xc0]
mov r12, qword [rsp + 0x90]
jmp 0x631759
xorps xmm0, xmm0
movups xmmword [rsp + 0xf8], xmm0
mov qword [rsp + 0x108], rcx
mov qword [rsp + 0x110], rax
mov rbp, qword [rsp + 0xd0]
add rsp, 0xd8
ret
cmp rbx, 1
je 0x631c1a
movzx r13d, byte [rdx + 1]
cmp r13b, 0x5d
je 0x631722
lea rax, [rbx - 1]
mov rcx, rax
neg rax
sar rax, 0x3f
and rax, 1
add rax, rdx
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.0045f6a0
mov rax, qword [rsp + 0x18]
inc rax
mov rcx, qword [rsp + 0x80]
cmp rax, rcx
ja 0x631fbe
mov qword [rsp + 0x98], rax
lea rax, [0x00824a20]
mov qword [rsp], rax
call fcn.00410220
mov rdi, qword [rsp + 8]
mov qword [rdi + 8], 0x1d
mov eax, dword [0x01636820]
test eax, eax
jne 0x631d02
lea rcx, [0x008aebe8]
mov qword [rdi], rcx
mov rcx, qword [rsp + 0x98]
mov qword [rdi + 0x18], rcx
mov ecx, dword [0x01636820]
lea rdx, [rdi + 0x10]
test ecx, ecx
jne 0x631ce7
mov rax, qword [rsp + 0xa8]
mov qword [rdi + 0x10], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0xf8], xmm0
lea rax, [0x008f9840]
mov qword [rsp + 0x108], rax
mov qword [rsp + 0x110], rdi
mov rbp, qword [rsp + 0xd0]
add rsp, 0xd8
ret
mov rax, rdi
mov rdi, rdx
mov rcx, rax
mov rax, qword [rsp + 0xa8]
call fcn.004544a0
mov rdi, rcx
jmp 0x631cb5
lea rax, [0x008aebe8]
call fcn.004544a0
jmp 0x631c8f
movzx r14d, byte [rdx]
cmp r14b, 0x5d
je 0x631d25
test rbx, rbx
jmp 0x6316f1
test r13b, r13b
je 0x631d32
test rbx, rbx
jmp 0x6316f1
mov qword [rax + 0x30], r10
mov qword [rax + 0x38], r12
lea rcx, [rbx - 1]
mov qword [rsp + 0x70], rcx
neg rcx
sar rcx, 0x3f
and rcx, 1
add rcx, rdx
mov qword [rsp + 0xa0], rcx
mov edx, dword [0x01636820]
test edx, edx
jne 0x631e2f
mov qword [rax + 0x28], r11
mov qword [rsp], rdi
call fcn.00631fe0
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x78]
test rbx, rbx
jl 0x631e08
mov rbx, qword [rsp + 0xb0]
mov qword [rbx + 0x30], rdx
mov qword [rbx + 0x38], rcx
mov ecx, dword [0x01636820]
test ecx, ecx
jne 0x631df9
mov qword [rbx + 0x28], rax
mov rax, qword [rsp + 0xe0]
mov qword [rsp], rax
mov qword [rsp + 8], rbx
call fcn.00629810
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0xf8], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x100], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x108], xmm0
mov rbp, qword [rsp + 0xd0]
add rsp, 0xd8
ret
mov rdi, qword [rsp + 0xc8]
call fcn.004544a0
jmp 0x631dab
mov qword [rsp], rax
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rcx
call fcn.00632e10
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x18]
jmp 0x631d8d
mov rax, r11
call fcn.004544a0
jmp 0x631d6b
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0xc0], rdx
lea rax, [0x007dec60]
mov qword [rsp], rax
mov qword [rsp + 8], r11
mov qword [rsp + 0x10], r10
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r12
call fcn.0043d870
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0xb0]
mov qword [rbx + 0x38], rdx
mov edx, dword [0x01636820]
test edx, edx
jne 0x631edc
mov qword [rbx + 0x28], rax
mov rdx, qword [rsp + 0xc0]
mov rbx, qword [rsp + 0x98]
mov rsi, qword [rsp + 0xe8]
mov rdi, qword [rsp + 0xc8]
mov r9, qword [rsp + 0xe0]
mov r10, rcx
mov r11, rax
mov rax, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0xf0]
jmp 0x631672
mov rdi, qword [rsp + 0xc8]
call fcn.004544a0
jmp 0x631e99
mov rdx, r8
mov r8d, 1
jmp 0x631693
mov rdx, r8
mov r8d, 1
jmp 0x631693
mov r11, rax
mov rax, r10
call fcn.004544a0
cmp rcx, 1
mov rax, r11
jmp 0x631615
mov rcx, rdi
mov rdi, r10
call fcn.004544a0
lea rdx, [0x0086ebe0]
mov qword [rsp], rdx
mov qword [rsp + 8], rcx
call fcn.004112d0
mov rcx, qword [rsp + 0xf0]
mov rdx, qword [rsp + 0x98]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0xe8]
mov r8, qword [rsp + 0xa0]
mov r9, qword [rsp + 0xe0]
jmp 0x6315ce
lea rax, [0x0086ebe0]
mov qword [rsp], rax
call fcn.00410220
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0xf0]
mov rdx, qword [rsp + 0x98]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0xe8]
mov r8, qword [rsp + 0xa0]
mov r9, qword [rsp + 0xe0]
jmp 0x6315d6
call fcn.00429340
ud2
call fcn.00429340
ud2
call fcn.00429340
ud2
call fcn.00451b80
jmp fcn.00631500