Function at 0x140078ef0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
mov rax, qword [0x14058f6b8]
xor rax, rsp
mov qword [rbp + 0x90], rax
mov rbx, rcx
xor r12d, r12d
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x38], r12b
xor r8d, r8d
lea rdx, [0x1404d34b0]
lea rcx, [rsp + 0x38]
call fcn.14007cb70
nop
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp - 0x80]
call fcn.14039b120
mov dword [rsp + 0x30], 0x104
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x20], rax
lea r9, [0x1404d384c]
lea r8, str.http
lea edx, [r12 + 2]
xor ecx, ecx
call qword [sym.imp.SHLWAPI.dll_AssocQueryStringA]
mov edi, eax
lea rax, [rbp - 0x80]
mov r13, 0xffffffffffffffff
mov r8, r13
inc r8
cmp byte [rax + r8], 0
jne 0x140078fb2
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x38]
call fcn.14007cb70
test edi, edi
jne 0x140079130
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], 7
mov word [rsp + 0x58], r12w
lea rsi, [rsp + 0x38]
cmp qword [rsp + 0x50], 0x10
cmovae rsi, qword [rsp + 0x38]
mov r15, qword [rsp + 0x48]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9d, r15d
mov r8, rsi
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jle 0x140079083
movsxd r14, eax
inc r14
mov eax, 2
mul r14
cmovo rax, r13
mov rcx, rax
call fcn.1403987c8
mov rdi, rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rax
mov r9d, r15d
mov r8, rsi
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
js 0x14007907b
movsxd r8, eax
cmp r8, r14
jae 0x14007907b
mov rdx, rdi
lea rcx, [rsp + 0x58]
call fcn.140078ce0
nop
mov rcx, rdi
call fcn.140398020
mov r9, rbx
cmp qword [rbx + 0x18], 8
jb 0x140079090
mov r9, qword [rbx]
lea r8, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae r8, qword [rsp + 0x58]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r12
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jg 0x140079124
mov r8, rbx
cmp qword [rbx + 0x18], 8
jb 0x1400790cf
mov r8, qword [rbx]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jg 0x140079124
cmp qword [rbx + 0x18], 8
jb 0x1400790fd
mov rbx, qword [rbx]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r12
mov r9, rbx
lea r8, str.iexplore.exe
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rsp + 0x58]
call fcn.14007cec0
jmp 0x140079161
cmp qword [rbx + 0x18], 8
jb 0x14007913a
mov rbx, qword [rbx]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r12
mov r9, rbx
lea r8, str.iexplore.exe
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rsp + 0x38]
call fcn.14007cfc0
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.140398000
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret