Function at 0x4b8790
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
lea rax, [rsp - 0x28]
cmp rax, qword [rcx + 0x10]
jbe 0x4b8bbf
sub rsp, 0xa8
mov qword [rsp + 0xa0], rbp
lea rbp, [rsp + 0xa0]
mov rax, qword [rsp + 0xc0]
movzx ecx, byte [rax + 0x17]
and ecx, 0x1f
cmp rcx, 0x14
jne 0x4b88b6
mov rcx, qword [rax + 0x40]
mov rdx, qword [rax + 0x38]
mov rbx, qword [rsp + 0xd8]
cmp rbx, rcx
jae 0x4b8ba1
mov qword [rsp + 0x60], rdx
mov ecx, dword [rdx + rbx*8]
mov dword [rsp + 8], ecx
mov qword [rsp], rax
call fcn.004afa50
mov rax, qword [rsp + 0x10]
movzx eax, byte [rax]
test al, 1
je 0x4b8aff
mov rax, qword [rsp + 0xc8]
mov rax, qword [rax]
test rax, rax
je 0x4b8a5d
mov rcx, qword [rax + 8]
mov rdx, qword [rsp + 0xd8]
cmp rdx, 0x186a0
jae 0x4b8a56
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rcx
mov rax, qword [rsp + 0x60]
mov eax, dword [rax + rdx*8 + 4]
mov dword [rsp + 8], eax
mov rax, qword [rsp + 0xc0]
mov qword [rsp], rax
call fcn.004afab0
mov rax, qword [rsp + 0xd8]
mov rcx, qword [rsp + 0x58]
lea rax, [rcx + rax*8 + 0x18]
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0xe0], rdx
mov qword [rsp + 0xe8], rcx
mov qword [rsp + 0xf0], rax
mov rbp, qword [rsp + 0xa0]
add rsp, 0xa8
ret
mov qword [rsp], rax
call fcn.004afe70
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0xd8]
cmp rdx, rax
jae 0x4b8a38
shl rdx, 4
mov eax, dword [rcx + rdx + 8]
mov dword [rsp + 0x4c], eax
mov ebx, dword [rcx + rdx + 4]
mov dword [rsp + 0x48], ebx
mov ecx, dword [rcx + rdx]
mov rdx, qword [rsp + 0xc0]
mov qword [rsp], rdx
mov dword [rsp + 8], ecx
call fcn.004afa50
mov rax, qword [rsp + 0x10]
movzx eax, byte [rax]
test al, 1
je 0x4b899f
lea rax, [0x007df6a0]
mov qword [rsp], rax
call fcn.00410220
mov rax, qword [rsp + 8]
mov qword [rsp + 0x68], rax
mov rcx, qword [rsp + 0xc0]
mov qword [rsp], rcx
mov edx, dword [rsp + 0x4c]
mov dword [rsp + 8], edx
call fcn.004afb10
mov eax, dword [0x01636820]
mov rcx, qword [rsp + 0x10]
test eax, eax
jne 0x4b8990
mov rax, qword [rsp + 0x68]
mov qword [rax], rcx
mov rax, qword [rsp + 0xc0]
mov qword [rsp], rax
mov ecx, dword [rsp + 0x48]
mov dword [rsp + 8], ecx
call fcn.004afab0
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rsp + 0xc0]
mov rax, qword [rsp + 0x68]
jmp 0x4b888e
mov rdi, qword [rsp + 0x68]
mov rax, rcx
call fcn.004544a0
jmp 0x4b8960
mov qword [rsp], 0
lea rax, [0x00895ec7]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 9
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x20], rax
lea rax, [0x008a76a4]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 0x15
call fcn.00441130
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rax
lea rax, [0x007df460]
mov qword [rsp], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 8], rax
call fcn.0040d660
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.0042a320
ud2
lea rax, [0x007df460]
mov qword [rsp], rax
lea rax, [0x008f82c0]
mov qword [rsp + 8], rax
call fcn.0042a320
ud2
call fcn.004292d0
ud2
mov qword [rsp], 0
lea rax, [0x00895ec7]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 9
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x20], rax
lea rax, [0x008b1446]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 0x21
call fcn.00441130
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x88], rax
lea rax, [0x007df460]
mov qword [rsp], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 8], rax
call fcn.0040d660
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x10]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.0042a320
ud2
mov qword [rsp], 0
lea rax, [0x00895ec7]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 9
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x20], rax
lea rax, [0x008a76a4]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 0x15
call fcn.00441130
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rcx
lea rax, [0x007df460]
mov qword [rsp], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 8], rax
call fcn.0040d660
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.0042a320
ud2
lea rax, [0x007df460]
mov qword [rsp], rax
lea rax, [0x008f82b0]
mov qword [rsp + 8], rax
call fcn.0042a320
ud2
call fcn.00451b80
jmp fcn.004b8790