Function at 0x4f86b0
Capabilities:
Create process on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xa8
lea r13, [rsp + 0x90]
lea rsi, [rcx + 0x190]
mov r12, rcx
lea r15, [rsp + 0x60]
mov rcx, r13
call fcn.004cdf4c
mov r9, r13
mov rdx, rsi
mov rcx, r15
mov r8d, 0x200003e8
call fcn.00428d90
mov rcx, r13
call fcn.004cddea
mov rcx, qword [rsp + 0x60]
cmp dword [rcx], 0
je 0x4f8a65
add rcx, 4
mov r8d, 7
lea rdx, str.http:__
call sub.msvcrt.dll_strncmp
test eax, eax
jne 0x4f8766
mov edx, 6
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov rax, qword [rsp + 0x60]
xor ecx, ecx
xor r9d, r9d
mov dword [rsp + 0x28], 1
lea rdx, str.open
mov qword [rsp + 0x20], 0
lea r8, [rax + 4]
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor ecx, ecx
call sub.msvcrt.dll_exit
lea rax, [rsp + 0x68]
mov rcx, rax
mov qword [rsp + 0x30], rax
call fcn.004cdf4c
mov rdx, qword [rsp + 0x30]
lea r9, [rsp + 0x5b]
mov rcx, r15
lea r8, [rsp + 0x5c]
call fcn.004b63c3
test al, al
jne 0x4f87bd
mov r8, r15
mov rcx, r13
lea rdx, str.invalid_address__
call fcn.004b5b0b
mov rcx, r12
mov rdx, r13
call fcn.004faab0
mov rcx, r13
call fcn.004cddea
jmp 0x4f8a5b
mov rcx, r12
lea r14, [rsp + 0x88]
call fcn.004f7540
mov rdi, qword [r12 + 0xa0]
mov r8, r15
mov rcx, r14
lea rdx, str.Connecting_to
mov rax, qword [rdi]
mov rbp, qword [rax + 0x1a0]
call fcn.004b5b0b
lea r8, [0x005376d5]
mov rdx, r14
mov rcx, r13
call fcn.004b59fc
mov r8, r13
xor edx, edx
mov rcx, rdi
call rbp
mov rcx, r13
call fcn.004cddea
mov rcx, r14
call fcn.004cddea
or edx, 0xffffffff
xor ecx, ecx
call sym.winbox.exe_createHandler_IHandlerHooks__unsigned_int_
lea rcx, [r12 + 0x1e0]
mov rdx, rax
call fcn.00525500
cmp byte [r12 + 0x1bd], 0
jne 0x4f88c1
movzx ecx, byte [rsp + 0x5b]
call fcn.00404d85
lea rcx, [r12 + 0x138]
mov rdx, rax
call fcn.005244b0
lea rdx, [rsp + 0x40]
mov rcx, r12
lea rax, [0x004f32e0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 0
call fcn.004d4ff0
lea rcx, [r12 + 0x140]
mov rdx, rax
call fcn.00524930
mov rcx, qword [r12 + 0x138]
mov rdx, qword [r12 + 0x140]
mov rax, qword [rcx]
call qword [rax + 0x60]
mov rcx, qword [r12 + 0x138]
mov r8d, dword [rsp + 0x5c]
mov rdx, qword [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x20]
jmp 0x4f8a5b
mov rcx, r12
call fcn.004f7320
cmp byte [rsp + 0x5b], 0
jne 0x4f88ff
mov rcx, r13
lea rdx, str.bad_ROMON_address
call fcn.004cdfee
mov rdx, r13
mov rcx, r12
call fcn.004faab0
mov rcx, r13
call fcn.004cddea
mov rcx, r12
call fcn.004f27b0
jmp 0x4f8a5b
mov ecx, 1
lea rdi, [rsp + 0x78]
lea rbp, [rsp + 0x80]
call fcn.0046be73
lea r10, [rsp + 0x70]
mov rcx, r10
mov rdx, rax
mov qword [rsp + 0x38], r10
call fcn.005240f0
mov rcx, r13
call fcn.004cebd6
mov rcx, qword [rsp + 0x70]
mov r8, qword [rsp + 0x30]
mov rdx, r13
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, r14
call fcn.004cdf4c
mov rdx, rsi
mov r9, r14
mov rcx, rdi
mov r8d, 0x20000001
call fcn.00428d90
mov rcx, r14
call fcn.004cddea
mov rcx, r14
call fcn.004cdf4c
mov r9, r14
mov rdx, rsi
mov rcx, rbp
mov r8d, 0x20000003
call fcn.00428d90
mov rcx, r14
call fcn.004cddea
mov rcx, r14
call fcn.00429106
mov r8, r13
mov edx, 0x30000004
mov rcx, r14
call fcn.0042a094
mov r8d, 1
mov edx, 6
mov rcx, r14
call fcn.00429f6e
mov r8, rdi
mov edx, 0x20000007
mov rcx, r14
call fcn.0042a052
mov r8, rbp
mov edx, 0x20000008
mov rcx, r14
call fcn.0042a052
mov rsi, qword [r12 + 0x1e0]
lea rdx, [rsp + 0x40]
mov rcx, r12
mov rax, qword [rsi]
mov rbx, qword [rax + 0xb8]
lea rax, [0x004f73a0]
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], rax
call fcn.004d4f80
mov r9, r14
mov edx, 0x7d1
mov rcx, rsi
mov qword [rsp + 0x20], rax
lea r8, [0x005303c8]
mov dword [rsp + 0x28], 0
call rbx
mov rcx, r14
call fcn.00429bd8
mov rcx, rbp
call fcn.004cddea
mov rcx, rdi
call fcn.004cddea
mov rcx, r13
call fcn.004cebe6
mov r10, qword [rsp + 0x38]
mov rcx, r10
call fcn.004b63ae
mov rcx, qword [rsp + 0x30]
call fcn.004cddea
mov rcx, r15
call fcn.004cddea
nop
add rsp, 0xa8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret