Function at 0x499c44
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push rdi
push r12
push r14
sub rsp, 0x240
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rdi, rcx
lea rax, [rax + 8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x31]
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.00415c3c
nop
cmp qword [rdi + 0xf0], 0
je 0x499cb7
mov rax, qword [rdi + 0xf0]
test rax, rax
je 0x499ca6
lock add dword [rax + 8], 1
mov rbx, qword [rdi + 0xf0]
mov qword [rsp + 0x38], rbx
jmp 0x499d3a
mov r9d, 2
or r8, 0xffffffffffffffff
mov edx, 0x100c
mov rcx, qword [rdi + 0x1450]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbx, rax
cmp eax, 0xffffffff
je 0x49a1e9
xor edx, edx
lea r8d, [rdx + 0x44]
lea rcx, [rsp + 0x1c4]
call fcn.006aba40
mov dword [rsp + 0x1c4], ebx
mov dword [rsp + 0x1c0], 4
lea r9, [rsp + 0x1c0]
xor r8d, r8d
mov edx, 0x104b
mov rcx, qword [rdi + 0x1450]
call qword [sym.imp.USER32.dll_SendMessageW]
neg eax
sbb rbx, rbx
and rbx, qword [rsp + 0x1e8]
je 0x499d35
lock add dword [rbx + 8], 1
mov qword [rsp + 0x38], rbx
test rbx, rbx
je 0x49a1e9
lea rdx, [rsp + 0x130]
mov rcx, rbx
call fcn.00414e04
mov rsi, rax
lea rdx, str.userNI
lea rcx, [rsp + 0x40]
call fcn.005407dc
cmp rsi, rax
je 0x499d7d
mov r8, qword [rsi + 0x20]
mov rdx, qword [rsi + 0x28]
mov rcx, rax
call fcn.0040289c
nop
lea rax, [rsp + 0x130]
mov r14d, 0x100
mov rcx, qword [rsp + 0x158]
cmp rcx, rax
je 0x499db9
test rcx, rcx
je 0x499db9
mov rdx, qword [rsp + 0x130]
sub rdx, rcx
cmp rdx, r14
jbe 0x499db4
call fcn.006a4944
jmp 0x499db9
call fcn.006a3610
mov rcx, qword [rdi + 0x7b8]
lea rsi, [rcx + 0x370]
mov rax, qword [rsi + 0x28]
cmp rax, qword [rsi + 0x20]
lea rax, [rcx + 0x340]
cmove rsi, rax
lea rdx, str.hubNI
lea rcx, [rsp + 0x40]
call fcn.005407dc
cmp rsi, rax
je 0x499e00
mov r8, qword [rsi + 0x20]
mov rdx, qword [rsi + 0x28]
mov rcx, rax
call fcn.0040289c
mov rsi, qword [rdi + 0x7b8]
add rsi, 0xe8
lea rdx, str.myNI
lea rcx, [rsp + 0x40]
call fcn.005407dc
cmp rsi, rax
je 0x499e34
mov r8, qword [rsi + 0x20]
mov rdx, qword [rsi + 0x28]
mov rcx, rax
call fcn.0040289c
test byte [rbx + 0x18], 0x10
je 0x499eab
lea rcx, [rbx + 0x2c]
lea rdx, [rsp + 0x160]
call fcn.00414f58
mov rsi, rax
lea rdx, str.userCID
lea rcx, [rsp + 0x40]
call fcn.005407dc
cmp rsi, rax
je 0x499e75
mov r8, qword [rsi + 0x20]
mov rdx, qword [rsi + 0x28]
mov rcx, rax
call fcn.0040289c
nop
lea rax, [rsp + 0x160]
mov rcx, qword [rsp + 0x188]
cmp rcx, rax
je 0x499eab
test rcx, rcx
je 0x499eab
mov rdx, qword [rsp + 0x160]
sub rdx, rcx
cmp rdx, r14
jbe 0x499ea6
call fcn.006a4944
jmp 0x499eab
call fcn.006a3610
mov rsi, qword [rdi + 0x7b8]
add rsi, 0x340
lea rdx, str.hubURL
lea rcx, [rsp + 0x40]
call fcn.005407dc
cmp rsi, rax
je 0x499edf
mov r8, qword [rsi + 0x20]
mov rdx, qword [rsi + 0x28]
mov rcx, rax
call fcn.0040289c
mov rbp, qword [rdi + 0x7b8]
mov rsi, qword [0x00862cb8]
test rbp, rbp
je 0x499f24
mov rcx, rbp
call fcn.005a1568
cmp byte [rax + 0x2e10], 0
jne 0x499f1b
mov rcx, qword [rax + 0x30]
test rcx, rcx
je 0x499f1b
mov edx, 0x18
call fcn.004083bc
mov r12, rax
jmp 0x499f4f
lea r12, [rax + 0x4b8]
jmp 0x499f4f
cmp byte [rsi + 0x2e98], 0
jne 0x499f48
mov rcx, qword [rsi + 0xb8]
test rcx, rcx
je 0x499f48
mov edx, 0x18
call fcn.004083bc
mov r12, rax
jmp 0x499f4f
lea r12, [rsi + 0x540]
test rbp, rbp
je 0x499f86
mov rcx, rbp
call fcn.005a1568
cmp byte [rax + 0x2e0e], 0
jne 0x499f7d
mov rcx, qword [rax + 0x30]
test rcx, rcx
je 0x499f7d
mov edx, reloc.WS2_32.dll_shutdown
call fcn.004083bc
mov rsi, rax
jmp 0x499fb1
lea rsi, [rax + 0x458]
jmp 0x499fb1
cmp byte [rsi + 0x2e96], 0
jne 0x499faa
mov rcx, qword [rsi + 0xb8]
test rcx, rcx
je 0x499faa
mov edx, reloc.WS2_32.dll_shutdown
call fcn.004083bc
mov rsi, rax
jmp 0x499fb1
add rsi, 0x4e0
xor r9d, r9d
lea r8, [rsp + 0x40]
mov rdx, r12
lea rcx, [rsp + 0x100]
call fcn.0058b150
nop
mov r8, rax
mov rdx, rsi
lea rcx, [rsp + 0x210]
call fcn.00402448
mov rdx, rax
lea rcx, [rsp + 0xd0]
call fcn.0058904c
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.00401f00
nop
lea rax, [rsp + 0xd0]
mov rcx, qword [rsp + 0xf8]
cmp rcx, rax
je 0x49a035
test rcx, rcx
je 0x49a035
mov rdx, qword [rsp + 0xd0]
sub rdx, rcx
cmp rdx, r14
jbe 0x49a02f
call fcn.006a4944
jmp 0x49a035
call fcn.006a3610
nop
lea rax, [rsp + 0x100]
mov rcx, qword [rsp + 0x128]
cmp rcx, rax
je 0x49a06b
test rcx, rcx
je 0x49a06b
mov rdx, qword [rsp + 0x100]
sub rdx, rcx
cmp rdx, r14
jbe 0x49a066
call fcn.006a4944
jmp 0x49a06b
call fcn.006a3610
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x190]
call fcn.00402190
nop
mov rcx, rax
call fcn.0058bc34
mov sil, al
lea rax, [rsp + 0x190]
mov rcx, qword [rsp + 0x1b8]
cmp rcx, rax
je 0x49a0c2
test rcx, rcx
je 0x49a0c2
mov rdx, qword [rsp + 0x190]
sub rdx, rcx
cmp rdx, r14
jbe 0x49a0bd
call fcn.006a4944
jmp 0x49a0c2
call fcn.006a3610
test sil, sil
je 0x49a168
mov rcx, qword [rdi + 0x7b8]
test rcx, rcx
je 0x49a102
call fcn.005a1568
cmp byte [rax + 0x302c], 0
jne 0x49a0fa
mov rcx, qword [rax + 0x30]
test rcx, rcx
je 0x49a0fa
mov edx, 0x234
call fcn.0041024c
jmp 0x49a130
mov al, byte [rax + 0x2c4d]
jmp 0x49a130
mov rax, qword [0x00862cb8]
cmp byte [rax + 0x30b4], 0
jne 0x49a12a
mov rcx, qword [rax + 0xb8]
test rcx, rcx
je 0x49a12a
mov edx, 0x234
call fcn.0041024c
jmp 0x49a130
mov al, byte [rax + 0x2cd5]
test al, al
jne 0x49a159
mov dword [rsp + 0x28], 1
and qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0xc8]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x49a180
lea rcx, [rsp + 0x80]
call fcn.0052d6f8
jmp 0x49a180
xor r9d, r9d
mov rdx, qword [0x0086fb28]
mov r8, rdx
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_MessageBoxW]
nop
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0xc8]
cmp rcx, rax
je 0x49a1be
test rcx, rcx
je 0x49a1be
mov rax, qword [rsp + 0x80]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
cmp rdx, r14
jbe 0x49a1b8
call fcn.006a4944
jmp 0x49a1be
call fcn.006a3610
nop
or eax, 0xffffffff
lock xadd dword [rbx + 8], eax
add eax, 0xffffffff
jne 0x49a1db
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
nop
lea rcx, [rsp + 0x40]
call fcn.00415b98
xor eax, eax
jmp 0x49a1f5
lea rcx, [rsp + 0x40]
call fcn.00415b98
xor eax, eax
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r12
pop rdi
ret