Function at 0x4aafcc
Capabilities:
Create process on windows
Terminate process

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x9e0
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rbx, rcx
mov edx, gethostbyname
mov esi, 0x258
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Beep]
mov edx, gethostbyname
mov edi, 0x320
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_Beep]
mov edx, gethostbyname
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Beep]
mov edx, gethostbyname
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_Beep]
nop
test rbx, rbx
je 0x4ab2df
lea r8, str.exceptioninfo.txt
lea rdx, [0x0085e958]
lea rcx, [rsp + 0x60]
call fcn.00402658
nop
mov r9d, 3
mov r8d, 0x40000000
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.005944d4
nop
lea rax, [rsp + 0x60]
mov rcx, qword [rsp + 0x88]
cmp rcx, rax
je 0x4ab09a
test rcx, rcx
je 0x4ab09a
mov rdx, qword [rsp + 0x60]
sub rdx, rcx
cmp rdx, 0x100
jbe 0x4ab095
call fcn.006a4944
jmp 0x4ab09a
call fcn.006a3610
and dword [rsp + 0x9f0], 0
mov r9d, 2
lea r8, [rsp + 0x9f0]
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea rcx, [rsp + 0x90]
call fcn.004ade38
mov r9, qword [rax + 0x28]
lea r8, [0x00799fb4]
lea rdx, str._r_n_r_nVersion:__s___s__r_n
lea rcx, [rsp + 0x1e0]
call fcn.004ad2ac
lea rdx, [rsp + 0x90]
mov rcx, qword [rsp + 0xb8]
cmp rcx, rdx
je 0x4ab123
test rcx, rcx
je 0x4ab123
mov rdx, qword [rsp + 0x90]
sub rdx, rcx
cmp rdx, 0x100
jbe 0x4ab11e
call fcn.006a4944
jmp 0x4ab123
call fcn.006a3610
xor eax, eax
or rsi, 0xffffffffffffffff
mov rcx, rsi
lea rdi, [rsp + 0x1e0]
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x1e0]
lea rcx, [rsp + 0x48]
call fcn.00594b34
mov edi, 0x11c
mov r8, rdi
xor edx, edx
lea rcx, [rsp + 0xc0]
call fcn.006aba40
mov dword [rsp + 0xc0], edi
lea rcx, [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x4ab198
mov dword [rsp + 0xc0], 0x114
lea rcx, [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
movzx eax, byte [rsp + 0x1da]
movzx ecx, word [rsp + 0x1d4]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ecx
mov eax, dword [rsp + 0xcc]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0xc8]
mov r8d, dword [rsp + 0xc4]
lea rdx, str.Environment:__d._d._d._d._d_r_n
lea rcx, [rsp + 0x1e0]
call fcn.004ad2ac
xor eax, eax
mov rcx, rsi
lea rdi, [rsp + 0x1e0]
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x1e0]
lea rcx, [rsp + 0x48]
call fcn.00594b34
lea rcx, [rsp + 0x9f8]
call fcn.006a5720
lea rcx, [rsp + 0x9f8]
call fcn.006a8688
mov r9, rax
lea r8, str.Time:__Y__m__d__H:_M:_S_r_n
mov edx, 0x800
lea rcx, [rsp + 0x1e0]
call fcn.006a833c
xor eax, eax
mov rcx, rsi
lea rdi, [rsp + 0x1e0]
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x1e0]
lea rcx, [rsp + 0x48]
call fcn.00594b34
mov r8, rbx
lea rdx, str.crashed:__s_r_n
lea rcx, [rsp + 0x1e0]
call fcn.004ad2ac
xor eax, eax
mov rcx, rsi
lea rdi, [rsp + 0x1e0]
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x1e0]
lea rcx, [rsp + 0x48]
call fcn.00594b34
nop
lea rax, [0x007955b8]
mov qword [rsp + 0x40], rax
lea rax, [0x007955c8]
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x40]
call fcn.0059492c
lea rdx, [0x007955f8]
mov qword [rsp + 0x48], rdx
lea rax, [0x007955e8]
mov qword [rsp + 0x40], rax
mov rax, qword [0x00862cb8]
cmp byte [rax + 0x31ec], 0
jne 0x4ab307
mov rcx, qword [rax + 0xb8]
test rcx, rcx
je 0x4ab307
mov edx, 0x36c
call fcn.0041024c
jmp 0x4ab30d
mov al, byte [rax + 0x2e0d]
test al, al
je 0x4ab34e
mov r8d, 0x400
lea rdx, [rsp + 0x1e0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [rsp + 0x28], 5
and qword [rsp + 0x20], 0
lea r9, str._forcerestart
lea r8, [rsp + 0x1e0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, reloc.WS2_32.dll_listen
call qword [sym.imp.KERNEL32.dll_ExitProcess]