Function at 0x4bae10
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4bb0e2
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov rax, qword [rsp + 0x50]
mov rcx, rax
and rax, 0x1f
cmp rax, 0x11
jne 0x4baf5e
bt ecx, 8
jae 0x4bb0c4
mov rax, qword [rsp + 0x40]
mov rdx, qword [rax + 0x40]
mov rax, qword [rax + 0x38]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
test rsi, rsi
jl 0x4bb088
mov rdi, qword [rsp + 0x60]
cmp rdi, rsi
jl 0x4bb088
cmp rdi, rdx
jg 0x4bb088
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x10], rdx
lea rax, [0x007db040]
mov qword [rsp], rax
call fcn.00410220
mov rdi, qword [rsp + 8]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
sub rax, rcx
mov qword [rdi + 8], rax
mov rax, qword [rsp + 0x10]
sub rax, rcx
mov qword [rdi + 0x10], rax
test rax, rax
jle 0x4baf39
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rdx + 0x30]
mov esi, dword [0x01636820]
mov rbx, qword [rbx]
imul rcx, rbx
mov rbx, qword [rsp + 0x28]
lea rax, [rbx + rcx]
test esi, esi
jne 0x4baf32
mov qword [rdi], rax
mov rax, qword [rsp + 0x50]
test rax, 0x60
je 0x4baf2e
mov eax, 0x20
test byte [rdx], al
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x70], rdi
or rax, 0x97
mov qword [rsp + 0x78], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
xor eax, eax
jmp 0x4baf0d
call fcn.004544a0
jmp 0x4baefb
mov ecx, dword [0x01636820]
test ecx, ecx
jne 0x4baf52
mov rax, qword [rsp + 0x28]
mov qword [rdi], rax
mov rdx, qword [rsp + 0x20]
jmp 0x4baefb
mov rax, qword [rsp + 0x28]
call fcn.004544a0
jmp 0x4baf4b
cmp rax, 0x17
jne 0x4baf7a
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsi]
mov rdx, qword [rsi + 0x10]
mov rax, qword [rsp + 0x40]
jmp 0x4bae6a
cmp rax, 0x18
jne 0x4bb024
mov rax, qword [rsp + 0x58]
test rax, rax
jl 0x4bb0a6
mov rdx, qword [rsp + 0x60]
cmp rdx, rax
jl 0x4bb0a6
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rbx + 8]
cmp rdx, rsi
jg 0x4bb0a6
lea rax, [0x00824660]
mov qword [rsp], rax
call fcn.00410220
mov rdi, qword [rsp + 8]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax + 8]
mov rdx, qword [rsp + 0x58]
cmp rdx, rcx
jge 0x4baffa
mov rcx, qword [rax]
mov rbx, qword [rsp + 0x60]
sub rbx, rdx
mov qword [rdi + 8], rbx
mov ebx, dword [0x01636820]
lea rax, [rdx + rcx]
test ebx, ebx
jne 0x4bb01d
mov qword [rdi], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rdi
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x78], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
call fcn.004544a0
jmp 0x4baffa
mov qword [rsp + 0x18], rax
lea rax, [0x00823da0]
mov qword [rsp], rax
call fcn.00410220
mov rdi, qword [rsp + 8]
mov qword [rdi + 8], 0x13
mov eax, dword [0x01636820]
test eax, eax
jne 0x4bb05c
lea rax, [0x008a668f]
mov qword [rdi], rax
jmp 0x4bb068
lea rax, [0x008a668f]
call fcn.004544a0
mov rax, qword [rsp + 0x18]
mov qword [rdi + 0x10], rax
lea rax, [0x007fb060]
mov qword [rsp], rax
mov qword [rsp + 8], rdi
call fcn.0042a320
ud2
lea rax, [0x007df460]
mov qword [rsp], rax
lea rax, [0x008f8380]
mov qword [rsp + 8], rax
call fcn.0042a320
ud2
lea rax, [0x007df460]
mov qword [rsp], rax
lea rax, [0x008f8370]
mov qword [rsp + 8], rax
call fcn.0042a320
ud2
lea rax, [0x007df460]
mov qword [rsp], rax
lea rax, [0x008f8360]
mov qword [rsp + 8], rax
call fcn.0042a320
ud2
call fcn.00451b80
jmp fcn.004bae10