Function at 0x44c970
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x44cc8d
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov rax, qword [rsp + 0x58]
lea rcx, [0x00b08f00]
jmp 0x44c9ad
mov rcx, qword [rcx + 0x1c0]
test rcx, rcx
je 0x44cbbc
mov rdx, qword [rcx + 0xc8]
cmp rax, rdx
jb 0x44c9a6
mov rdx, qword [rcx + 0xd0]
cmp rax, rdx
jae 0x44c9a6
test rcx, rcx
je 0x44ca4c
mov rax, qword [rcx + 0xd8]
mov rdx, qword [rcx + 0xe0]
cmp rdx, 1
jle 0x44ca3f
mov ebx, dword [rsp + 0x60]
xor esi, esi
jmp 0x44c9f2
inc rsi
cmp rsi, rdx
jge 0x44ca3b
lea rdi, [rsi + rsi*2]
mov r8, qword [rax + rdi*8]
mov r9, qword [rax + rdi*8 + 8]
movsxd r10, ebx
cmp r10, r8
jb 0x44c9ef
add r9, r8
cmp r10, r9
ja 0x44c9ef
mov rax, qword [rax + rdi*8 + 0x10]
add rax, r10
sub rax, r8
mov rdx, qword [rcx + 0x68]
cmp rax, rdx
ja 0x44cbc3
mov qword [rsp + 0x68], rax
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
xor eax, eax
jmp 0x44ca1f
mov ebx, dword [rsp + 0x60]
movsxd rax, ebx
add rax, qword [rcx + 0x60]
jmp 0x44ca1f
mov qword [rsp + 0x20], rax
call fcn.0044c1e0
lea rax, [0x007fda60]
mov qword [rsp], rax
mov rax, qword [0x010f0150]
mov qword [rsp + 8], rax
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x10], eax
call fcn.00409210
mov rax, qword [rsp + 0x18]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
call fcn.0044c230
mov rax, qword [rsp + 0x38]
test rax, rax
jne 0x44cbad
call fcn.0042b400
lea rax, [0x008a46f2]
mov qword [rsp], rax
mov qword [rsp + 8], 0x11
call fcn.0042bdc0
mov eax, dword [rsp + 0x60]
movsxd rax, eax
mov qword [rsp], rax
call fcn.0042bc50
lea rax, [0x0088e045]
mov qword [rsp], rax
mov qword [rsp + 8], 6
call fcn.0042bdc0
mov rax, qword [rsp + 0x20]
mov qword [rsp], rax
call fcn.0042bc50
lea rax, [0x008a2b4c]
mov qword [rsp], rax
mov qword [rsp + 8], 0x10
call fcn.0042bdc0
call fcn.0042b490
lea rax, [0x00b08f00]
jmp 0x44cb9f
mov qword [rsp + 0x40], rax
mov rcx, qword [rax + 0xc8]
mov qword [rsp + 0x30], rcx
mov rdx, qword [rax + 0xd0]
mov qword [rsp + 0x28], rdx
call fcn.0042b400
lea rax, [0x008904fd]
mov qword [rsp], rax
mov qword [rsp + 8], 7
call fcn.0042bdc0
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
call fcn.0042bc50
lea rax, [0x00891ff4]
mov qword [rsp], rax
mov qword [rsp + 8], 8
call fcn.0042bdc0
mov rax, qword [rsp + 0x28]
mov qword [rsp], rax
call fcn.0042bc50
call fcn.0042b6b0
call fcn.0042b490
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x1c0]
test rax, rax
jne 0x44cb19
jmp 0x44cc72
mov qword [rsp + 0x68], rax
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
xor ecx, ecx
jmp 0x44c9ce
mov qword [rsp + 0x30], rdx
mov rax, qword [rcx + 0x60]
mov qword [rsp + 0x28], rax
call fcn.0042b400
lea rax, [0x008a46f2]
mov qword [rsp], rax
mov qword [rsp + 8], 0x11
call fcn.0042bdc0
mov eax, dword [rsp + 0x60]
movsxd rax, eax
mov qword [rsp], rax
call fcn.0042bc50
lea rax, [0x0089f0f6]
mov qword [rsp], rax
mov qword [rsp + 8], 0xe
call fcn.0042bdc0
mov rax, qword [rsp + 0x28]
mov qword [rsp], rax
call fcn.0042bc50
lea rax, [0x0088b035]
mov qword [rsp], rax
mov qword [rsp + 8], 3
call fcn.0042bdc0
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
call fcn.0042bc50
call fcn.0042b6b0
call fcn.0042b490
lea rax, [0x008b1cc8]
mov qword [rsp], rax
mov qword [rsp + 8], 0x21
call fcn.0042ab20
ud2
lea rax, [0x008b7d5b]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2e
call fcn.0042ab20
ud2
call fcn.00451b80
jmp fcn.0044c970