Function at 0x417cf0
Capabilities:
Get geographical location
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
lea rax, [rsp - 0x148]
cmp rax, qword [rcx + 0x10]
jbe 0x418857
sub rsp, 0x1c8
mov qword [rsp + 0x1c0], rbp
lea rbp, [rsp + 0x1c0]
xor eax, eax
lea rcx, [0x01635f30]
xchg dword [rcx], eax
mov byte [0x01635ed7], 0
mov eax, 2
lea rcx, [0x01635f38]
xchg dword [rcx], eax
mov eax, dword [0x01635f38]
cmp eax, 1
jne 0x418831
mov eax, 1
mov byte [0x01636824], al
test al, al
je 0x418825
mov eax, 1
mov byte [0x01636820], al
mov rax, qword [0x0163e800]
mov qword [0x010f11b0], rax
call fcn.00455830
mov rax, qword [rsp]
mov qword [rsp + 0x48], rax
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rcx, qword [rax + 0x30]
inc dword [rcx + 0xd0]
mov rcx, qword [rax + 0x30]
mov qword [rsp + 0x178], rcx
test byte [rax], al
mov qword [rcx + 0xc8], 5
mov eax, dword [0x01636820]
lea rdi, [rcx + 0xc0]
mov qword [rsp + 0x198], rdi
test eax, eax
jne 0x418814
lea rax, [0x0088d5b1]
mov qword [rcx + 0xc0], rax
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov qword [rsp + 0x188], rax
mov rcx, qword [rax + 0x30]
mov byte [rcx + 0xf9], 2
mov rcx, qword [rax + 0x30]
mov rcx, qword [rcx + 0x90]
mov qword [rsp + 0x180], rcx
mov qword [rsp], rcx
movabs rdx, 0x400000002
mov qword [rsp + 8], rdx
call fcn.0042e4a0
mov rax, qword [rsp + 0x180]
mov qword [rax + 0xb0], 0x12
mov ecx, dword [0x01636820]
lea rdi, [rax + 0xa8]
test ecx, ecx
jne 0x418803
lea rcx, [0x008a5412]
mov qword [rax + 0xa8], rcx
lea rax, [0x0044f1e0]
mov qword [rsp + 0x1b0], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x1b8], rax
lea rcx, [rsp + 0x1b0]
mov qword [rsp], rcx
call fcn.00451a20
lea rax, [0x0044f230]
mov qword [rsp + 0x1a0], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x1a8], rax
lea rax, [rsp + 0x1a0]
mov qword [rsp], rax
call fcn.00451a20
mov rax, qword [rsp + 0x188]
mov rax, qword [rax + 0x30]
mov byte [rax + 0xf9], 0
mov rax, qword [rsp + 0x180]
mov qword [rsp], rax
movabs rax, 0x200000004
mov qword [rsp + 8], rax
call fcn.0042e4a0
movzx eax, byte [0x01112510]
test al, al
jne 0x4187f9
mov rcx, qword [rsp + 0x178]
mov qword [rcx + 0xc8], 0
mov edx, dword [0x01636820]
test edx, edx
jne 0x4187e5
mov qword [rcx + 0xc0], 0
mov eax, dword [0x01635f38]
test eax, eax
jne 0x41883c
movsd xmm0, qword [rsp + 0x1d0]
movsd qword [rsp], xmm0
call fcn.00417080
call fcn.00455830
mov rax, qword [rsp]
mov qword [rsp + 0x68], rax
call fcn.00455870
mov rax, qword [rsp]
movsxd rcx, dword [rsp + 8]
mov rdx, qword [0x010f11a0]
mov rbx, qword [rsp + 0x68]
mov rsi, rbx
sub rbx, rdx
add rbx, qword [0x010f1198]
mov qword [0x010f1198], rbx
mov qword [0x010f1190], rsi
imul rax, rax, 0x3b9aca00
add rax, rcx
lea rcx, [0x0163d170]
mov rdx, rax
xchg qword [rcx], rax
lea rax, [0x0163e7e0]
mov rcx, rsi
xchg qword [rax], rsi
movzx eax, byte [0x0163e180]
mov rbx, qword [0x010f1198]
lea rsi, [0x0163d180]
mov qword [rsi + rax*8], rbx
movzx eax, byte [0x0163e180]
lea rbx, [0x0163d980]
mov qword [rbx + rax*8], rdx
mov rax, qword [0x0163d178]
add rax, qword [0x010f1198]
mov qword [0x0163d178], rax
movsxd rax, dword [0x010f116c]
mov rdx, qword [0x010f1180]
sub rdx, qword [0x010f1178]
imul rdx, rax
mov qword [rsp + 0x40], rdx
mov rbx, qword [0x01636d58]
add rbx, qword [0x01636d50]
add rbx, qword [0x01636d60]
mov rsi, qword [0x010f1190]
sub rsi, qword [0x010f1188]
imul rax, rsi
mov qword [rsp + 0x70], rax
add rbx, rdx
add rbx, rax
add rbx, qword [0x010f1130]
mov qword [0x010f1130], rbx
mov rsi, qword [0x010f0b78]
sub rcx, rsi
movsxd rsi, dword [0x01635f3c]
imul rsi, rcx
add rsi, qword [0x010f0b80]
xorps xmm0, xmm0
cvtsi2sd xmm0, rbx
xorps xmm1, xmm1
cvtsi2sd xmm1, rsi
divsd xmm0, xmm1
movsd qword [0x0163e188], xmm0
mov qword [0x010f01b4], 0
movzx ecx, byte [0x010f1128]
test cl, cl
je 0x4180b6
inc dword [0x0163e184]
lea rax, [0x010f1158]
mov qword [rsp], rax
call fcn.0040e440
inc dword [0x0163e180]
mov rax, qword [0x010f1160]
mov qword [rsp], rax
call fcn.004321a0
mov qword [0x010f1160], 0
lea rax, [0x010f1158]
mov qword [rsp], rax
call fcn.0040e630
call fcn.00424030
lea rax, [0x008c59b8]
mov qword [rsp], rax
call fcn.00451a20
call fcn.004240b0
call fcn.00420220
lea rax, [0x008c5990]
mov qword [rsp], rax
call fcn.00451a20
mov eax, dword [0x01636a60]
test eax, eax
jle 0x41875e
movsd xmm0, qword [0x008f6798]
mulsd xmm0, qword [0x0163e188]
movsd qword [rsp + 0xb8], xmm0
mov qword [rsp + 0xc0], 0
xorps xmm1, xmm1
movups xmmword [rsp + 0xc8], xmm1
call fcn.0042b400
mov rax, qword [0x010f1178]
sub rax, qword [0x016366a8]
mov rcx, rax
movabs rax, 0x8637bd05af6c69b6
mul rcx
shr rdx, 0x13
mov qword [rsp + 0x18], rdx
lea rax, [rsp + 0xc0]
mov qword [rsp], rax
mov qword [rsp + 8], 0x18
mov qword [rsp + 0x10], 0x18
mov qword [rsp + 0x20], 3
call fcn.004197a0
mov eax, dword [0x0163e180]
mov qword [rsp + 0xb0], rax
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x28]
lea rsi, [rsp + 0x130]
mov qword [rsp], rsi
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], rcx
call fcn.004412b0
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0xa8], rax
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x190], rcx
call fcn.0042b400
lea rax, [0x0088b473]
mov qword [rsp], rax
mov qword [rsp + 8], 3
call fcn.0042bdc0
mov rax, qword [rsp + 0xb0]
mov qword [rsp], rax
call fcn.0042bac0
lea rax, [0x0088ae9e]
mov qword [rsp], rax
mov qword [rsp + 8], 2
call fcn.0042bdc0
mov rax, qword [rsp + 0x190]
mov qword [rsp], rax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 8], rax
call fcn.0042bdc0
lea rax, [0x0088affc]
mov qword [rsp], rax
mov qword [rsp + 8], 2
call fcn.0042bdc0
movsd xmm0, qword [rsp + 0xb8]
cvttsd2si rax, xmm0
mov qword [rsp], rax
call fcn.0042bbe0
lea rax, [0x0088b056]
mov qword [rsp], rax
mov qword [rsp + 8], 3
call fcn.0042bdc0
call fcn.0042b490
mov rax, qword [0x010f1178]
mov qword [rsp + 0xd8], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0xe0], xmm0
mov rcx, qword [0x010f1180]
mov qword [rsp + 0xd8], rcx
mov rcx, qword [0x010f1188]
mov qword [rsp + 0xe0], rcx
mov rcx, qword [0x010f1190]
mov qword [rsp + 0xe8], rcx
xor ecx, ecx
jmp 0x4183c6
lea rcx, [rsp + 0xc0]
mov qword [rsp], rcx
mov qword [rsp + 8], 0x18
mov qword [rsp + 0x10], 0x18
sub rdx, rax
mov qword [rsp + 0x18], rdx
call fcn.00419880
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
lea rbx, [rsp + 0x110]
mov qword [rsp], rbx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rdx
call fcn.004412b0
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x190], rax
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0xa8], rcx
call fcn.0042b400
mov rax, qword [rsp + 0x190]
mov qword [rsp], rax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 8], rax
call fcn.0042bdc0
call fcn.0042b490
mov rax, qword [rsp + 0x78]
lea rcx, [rax + 1]
xorps xmm0, xmm0
mov rax, qword [rsp + 0x58]
cmp rcx, 3
jge 0x41841e
mov qword [rsp + 0x78], rcx
mov rdx, qword [rsp + rcx*8 + 0xd8]
mov qword [rsp + 0x58], rdx
test rcx, rcx
je 0x418319
mov qword [rsp + 0x50], rax
call fcn.0042b400
lea rax, [0x0088ae59]
mov qword [rsp], rax
mov qword [rsp + 8], 1
call fcn.0042bdc0
call fcn.0042b490
mov rax, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
jmp 0x418319
call fcn.0042b400
lea rax, [0x00898804]
mov qword [rsp], rax
mov qword [rsp + 8], 0xb
call fcn.0042bdc0
call fcn.0042b490
mov qword [rsp + 0x150], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x158], xmm0
movups xmmword [rsp + 0x168], xmm0
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x150], rax
mov rax, qword [0x01636d50]
mov qword [rsp + 0x158], rax
mov rax, qword [0x01636d60]
add rax, qword [0x01636d58]
mov qword [rsp + 0x160], rax
mov rax, qword [0x01636d68]
mov qword [rsp + 0x168], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x170], rax
xor eax, eax
jmp 0x41855e
lea rax, [rsp + 0xc0]
mov qword [rsp], rax
mov qword [rsp + 8], 0x18
mov qword [rsp + 0x10], 0x18
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x18], rcx
call fcn.00419880
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x20]
lea rbx, [rsp + 0xf0]
mov qword [rsp], rbx
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rax
call fcn.004412b0
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0xa8], rax
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x190], rcx
call fcn.0042b400
mov rax, qword [rsp + 0x190]
mov qword [rsp], rax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 8], rax
call fcn.0042bdc0
call fcn.0042b490
mov rax, qword [rsp + 0x80]
inc rax
cmp rax, 5
jge 0x4185ef
mov qword [rsp + 0x80], rax
mov rcx, qword [rsp + rax*8 + 0x150]
mov qword [rsp + 0x60], rcx
cmp rax, 2
jne 0x4185ab
call fcn.0042b400
lea rax, [0x0088ae5d]
mov qword [rsp], rax
mov qword [rsp + 8], 1
call fcn.0042bdc0
call fcn.0042b490
jmp 0x4184b5
cmp rax, 3
je 0x418583
test rax, rax
je 0x4184b5
call fcn.0042b400
lea rax, [0x0088ae59]
mov qword [rsp], rax
mov qword [rsp + 8], 1
call fcn.0042bdc0
call fcn.0042b490
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
jmp 0x4184b5
movsxd rax, dword [0x010f1170]
mov qword [rsp + 0xa0], rax
mov rcx, qword [0x010f11a8]
mov qword [rsp + 0xb0], rcx
mov rdx, qword [0x010f11b0]
mov qword [rsp + 0x98], rdx
mov rbx, qword [0x010f11b8]
mov qword [rsp + 0x90], rbx
mov rsi, qword [0x010f11c0]
mov qword [rsp + 0x88], rsi
call fcn.0042b400
lea rax, [0x0089436d]
mov qword [rsp], rax
mov qword [rsp + 8], 9
call fcn.0042bdc0
mov rax, qword [rsp + 0xb0]
shr rax, 0x14
mov qword [rsp], rax
call fcn.0042bac0
lea rax, [0x0088aec0]
mov qword [rsp], rax
mov qword [rsp + 8], 2
call fcn.0042bdc0
mov rax, qword [rsp + 0x98]
shr rax, 0x14
mov qword [rsp], rax
call fcn.0042bac0
lea rax, [0x0088aec0]
mov qword [rsp], rax
mov qword [rsp + 8], 2
call fcn.0042bdc0
mov rax, qword [rsp + 0x90]
shr rax, 0x14
mov qword [rsp], rax
call fcn.0042bac0
lea rax, [0x0088c7f1]
mov qword [rsp], rax
mov qword [rsp + 8], 5
call fcn.0042bdc0
mov rax, qword [rsp + 0x88]
shr rax, 0x14
mov qword [rsp], rax
call fcn.0042bac0
lea rax, [0x008964e5]
mov qword [rsp], rax
mov qword [rsp + 8], 0xa
call fcn.0042bdc0
mov rax, qword [rsp + 0xa0]
mov qword [rsp], rax
call fcn.0042bbe0
lea rax, [0x0088aea0]
mov qword [rsp], rax
mov qword [rsp + 8], 2
call fcn.0042bdc0
call fcn.0042b490
movzx eax, byte [0x010f1128]
test al, al
jne 0x4187bd
call fcn.0042b400
call fcn.0042b6b0
call fcn.0042b490
call fcn.0042b490
lea rax, [0x00b01154]
mov qword [rsp], rax
call fcn.0043b750
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x178]
mov edx, dword [rcx + 0xd0]
lea ebx, [rdx - 1]
mov dword [rcx + 0xd0], ebx
cmp edx, 1
jne 0x4187ad
movzx ecx, byte [rax + 0xc0]
test cl, cl
je 0x4187ad
mov qword [rax + 0x10], 0xfffffffffffffade
mov rbp, qword [rsp + 0x1c0]
add rsp, 0x1c8
ret
call fcn.0042b400
lea rax, [0x0089431c]
mov qword [rsp], rax
mov qword [rsp + 8], 9
call fcn.0042bdc0
call fcn.0042b490
jmp 0x41874a
mov rdi, qword [rsp + 0x198]
xor eax, eax
call fcn.004544a0
jmp 0x417f3c
call fcn.004479f0
jmp 0x417f10
lea rax, [0x008a5412]
call fcn.004544a0
jmp 0x417e74
lea rax, [0x0088d5b1]
call fcn.004544a0
jmp 0x417df0
movzx eax, byte [0x01636825]
jmp 0x417d70
cmp eax, 2
sete al
jmp 0x417d5d
lea rax, [0x008aeb00]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1d
call fcn.0042ab20
ud2
call fcn.00451b80
jmp fcn.00417cf0