Function at 0x49e7e0
Capabilities:
Reference http user-agent string
Run powershell expression

Disassembly:
push esi
push ebx
sub esp, 0x24
mov eax, dword [0xd41044]
mov dword [esp + 0x1c], eax
xor eax, eax
mov eax, dword [esp + 0x30]
mov ebx, dword [esp + 0x34]
mov dword [esp + 8], 0x400
mov esi, dword [esp + 0x3c]
mov dword [esp], 0xa0d5c0
mov dword [esp + 4], eax
mov eax, dword [esp + 0x38]
call dword [eax]
sub esp, 0xc
mov dword [esi], eax
mov dword [ebx], eax
mov eax, dword [esp + 0x1c]
sub eax, dword [0xd41044]
jne 0x49e39e
add esp, 0x24
pop ebx
pop esi
ret
call fcn.00401690
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push esi
push ebx
sub esp, 0x14
mov esi, dword [0xd41044]
mov dword [esp + 0xc], esi
xor esi, esi
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov ebx, dword [esp + 0x2c]
mov esi, dword [esp + 0xc]
sub esi, dword [0xd41044]
jne 0x49e6c7
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x24], edx
mov dword [esp + 0x20], eax
add esp, 0x14
pop ebx
pop esi
jmp 0x49e350
call fcn.00401690
nop
nop
nop
nop
push ebp
mov ecx, 0x43eb90
vmovd xmm0, ecx
mov ebp, esp
push ebx
and esp, 0xfffffff0
sub esp, 0x50
mov eax, dword [ebp + 8]
lea edx, [esp + 0x14]
mov dword [esp + 0x30], 0
lea ebx, [esp + 0x20]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0xc]
vmovd xmm1, edx
lea edx, [esp + 0x10]
vpinsrd xmm1, xmm1, edx, 1
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x10], eax
mov eax, dword [0xd41044]
mov dword [esp + 0x4c], eax
mov eax, 0x43eb60
vpinsrd xmm0, xmm0, eax, 1
lea eax, [esp + 0x1c]
vmovq qword [esp + 0x40], xmm0
vmovd xmm0, eax
lea eax, [esp + 0x18]
vpinsrd xmm0, xmm0, eax, 1
mov eax, ecx
vpunpcklqdq xmm0, xmm0, xmm1
vmovdqu xmmword [esp + 0x20], xmm0
jmp 0x49e764
mov eax, dword [esp + eax*4 + 0x40]
mov dword [esp], ebx
call eax
mov eax, dword [esp + 0x30]
cmp eax, 1
jbe 0x49e760
mov eax, dword [esp + 0x4c]
sub eax, dword [0xd41044]
jne 0x49e783
mov ebx, dword [ebp - 4]
leave
ret
call fcn.00401690
nop
nop
nop
nop
nop
nop
nop
nop
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov eax, dword [esp + 0x70]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x78]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x80]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x84]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x88]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x8c]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x90]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x94]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x98]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x9c]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0xa0]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0xa4]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0xa8]
mov ebp, dword [0xd41044]
mov dword [esp + 0x4c], ebp
xor ebp, ebp
mov edx, dword [esp + 0xb0]
mov ecx, dword [esp + 0xb4]
mov dword [esp + 0x3c], eax
mov ebx, dword [esp + 0xb8]
mov eax, dword [esp + 0xac]
mov esi, dword [esp + 0xbc]
mov edi, dword [esp + 0xc0]
mov ebp, dword [esp + 0x4c]
sub ebp, dword [0xd41044]
jne 0x49e995
mov dword [esp + 0xac], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0xc0], edi
mov dword [esp + 0xa8], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0xbc], esi
mov dword [esp + 0xa4], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0xb8], ebx
mov dword [esp + 0xa0], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0xb4], ecx
mov dword [esp + 0x9c], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0xb0], edx
mov dword [esp + 0x98], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x94], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x90], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x8c], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x84], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x80], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x7c], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x78], eax
mov eax, dword [esp + 8]
mov dword [esp + 0x74], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x70], eax
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.0049e4c0
call fcn.00401690
nop
nop
nop
nop
nop
nop
push esi
push ebx
sub esp, 0x14
mov esi, dword [0xd41044]
mov dword [esp + 0xc], esi
xor esi, esi
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov ebx, dword [esp + 0x2c]
mov esi, dword [esp + 0xc]
sub esi, dword [0xd41044]
jne 0x49e9e7
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x24], edx
mov dword [esp + 0x20], eax
add esp, 0x14
pop ebx
pop esi
jmp 0x49e680
call fcn.00401690
nop
nop
nop
nop