Function at 0x4f95c0
Capabilities:
Create process on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xa8
lea r13, [rsp + 0x90]
lea rsi, [rcx + 0x198]
mov r12, rcx
lea r15, [rsp + 0x60]
mov rcx, r13
call fcn.004cebac
mov r9, r13
mov rdx, rsi
mov rcx, r15
mov r8d, 0x200003e8
call fcn.00428e30
mov rcx, r13
call fcn.004cea4a
mov rcx, qword [rsp + 0x60]
cmp dword [rcx], 0
je 0x4f9975
add rcx, 4
mov r8d, 7
lea rdx, str.http:__
call sub.msvcrt.dll_strncmp
test eax, eax
jne 0x4f9676
mov edx, 6
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov rax, qword [rsp + 0x60]
xor ecx, ecx
xor r9d, r9d
mov dword [rsp + 0x28], 1
lea rdx, str.open
mov qword [rsp + 0x20], 0
lea r8, [rax + 4]
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor ecx, ecx
call sub.msvcrt.dll_exit
lea rax, [rsp + 0x68]
mov rcx, rax
mov qword [rsp + 0x30], rax
call fcn.004cebac
mov rdx, qword [rsp + 0x30]
lea r9, [rsp + 0x5b]
mov rcx, r15
lea r8, [rsp + 0x5c]
call fcn.004b6fc3
test al, al
jne 0x4f96cd
mov r8, r15
mov rcx, r13
lea rdx, str.invalid_address__
call fcn.004b670b
mov rcx, r12
mov rdx, r13
call fcn.004fb9d0
mov rcx, r13
call fcn.004cea4a
jmp 0x4f996b
mov rcx, r12
lea r14, [rsp + 0x88]
call fcn.004f8450
mov rdi, qword [r12 + 0xa8]
mov r8, r15
mov rcx, r14
lea rdx, str.Connecting_to
mov rax, qword [rdi]
mov rbp, qword [rax + 0x1a0]
call fcn.004b670b
lea r8, [0x00538735]
mov rdx, r14
mov rcx, r13
call fcn.004b65fc
mov r8, r13
xor edx, edx
mov rcx, rdi
call rbp
mov rcx, r13
call fcn.004cea4a
mov rcx, r14
call fcn.004cea4a
or edx, 0xffffffff
xor ecx, ecx
call sym.winbox.exe_createHandler_IHandlerHooks__unsigned_int_
lea rcx, [r12 + 0x1e8]
mov rdx, rax
call fcn.00526510
cmp byte [r12 + 0x1c5], 0
jne 0x4f97d1
movzx ecx, byte [rsp + 0x5b]
call fcn.00404e25
lea rcx, [r12 + 0x140]
mov rdx, rax
call fcn.005254c0
lea rdx, [rsp + 0x40]
mov rcx, r12
lea rax, [0x004f41e0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 0
call fcn.004d5c60
lea rcx, [r12 + 0x148]
mov rdx, rax
call fcn.00525940
mov rcx, qword [r12 + 0x140]
mov rdx, qword [r12 + 0x148]
mov rax, qword [rcx]
call qword [rax + 0x60]
mov rcx, qword [r12 + 0x140]
mov r8d, dword [rsp + 0x5c]
mov rdx, qword [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x20]
jmp 0x4f996b
mov rcx, r12
call fcn.004f8230
cmp byte [rsp + 0x5b], 0
jne 0x4f980f
mov rcx, r13
lea rdx, str.bad_ROMON_address
call fcn.004cec4e
mov rdx, r13
mov rcx, r12
call fcn.004fb9d0
mov rcx, r13
call fcn.004cea4a
mov rcx, r12
call fcn.004f36b0
jmp 0x4f996b
mov ecx, 1
lea rdi, [rsp + 0x78]
lea rbp, [rsp + 0x80]
call fcn.0046c5af
lea r10, [rsp + 0x70]
mov rcx, r10
mov rdx, rax
mov qword [rsp + 0x38], r10
call fcn.00525100
mov rcx, r13
call fcn.004cf836
mov rcx, qword [rsp + 0x70]
mov r8, qword [rsp + 0x30]
mov rdx, r13
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, r14
call fcn.004cebac
mov rdx, rsi
mov r9, r14
mov rcx, rdi
mov r8d, 0x20000001
call fcn.00428e30
mov rcx, r14
call fcn.004cea4a
mov rcx, r14
call fcn.004cebac
mov r9, r14
mov rdx, rsi
mov rcx, rbp
mov r8d, 0x20000003
call fcn.00428e30
mov rcx, r14
call fcn.004cea4a
mov rcx, r14
call fcn.004291a6
mov r8, r13
mov edx, 0x30000004
mov rcx, r14
call fcn.0042a134
mov r8d, 1
mov edx, 6
mov rcx, r14
call fcn.0042a00e
mov r8, rdi
mov edx, 0x20000007
mov rcx, r14
call fcn.0042a0f2
mov r8, rbp
mov edx, 0x20000008
mov rcx, r14
call fcn.0042a0f2
mov rsi, qword [r12 + 0x1e8]
lea rdx, [rsp + 0x40]
mov rcx, r12
mov rax, qword [rsi]
mov rbx, qword [rax + 0xb8]
lea rax, [0x004f82b0]
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], rax
call fcn.004d5bf0
mov r9, r14
mov edx, 0x7d1
mov rcx, rsi
mov qword [rsp + 0x20], rax
lea r8, [0x005313c8]
mov dword [rsp + 0x28], 0
call rbx
mov rcx, r14
call fcn.00429c78
mov rcx, rbp
call fcn.004cea4a
mov rcx, rdi
call fcn.004cea4a
mov rcx, r13
call fcn.004cf846
mov r10, qword [rsp + 0x38]
mov rcx, r10
call fcn.004b6fae
mov rcx, qword [rsp + 0x30]
call fcn.004cea4a
mov rcx, r15
call fcn.004cea4a
nop
add rsp, 0xa8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret