Function at 0x140002be0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rax, qword [0x14001d010]
xor rax, rsp
mov qword [rbp + 0x50], rax
mov rbx, rcx
xor r14d, r14d
mov qword [rbp + 0x40], r14
mov qword [rbp + 0x48], 7
mov word [rbp + 0x30], r14w
lea r8d, [r14 + 0x1b]
lea rdx, str.UPDATE_NOTIFIER_SHOW_DETAIL
lea rcx, [rbp + 0x30]
call fcn.140003940
nop
mov qword [rbp], r14
mov qword [rbp + 8], 7
mov word [rbp - 0x10], r14w
lea r8d, [r14 + 0x16]
lea rdx, str.TrayNotificationWindow
lea rcx, [rbp - 0x10]
call fcn.140003940
nop
mov qword [rbp + 0x20], r14
mov qword [rbp + 0x28], 7
mov word [rbp + 0x10], r14w
lea r8d, [r14 + 0x14]
lea rdx, str.WZUpdateNotifier.exe
lea rcx, [rbp + 0x10]
call fcn.140003940
nop
mov qword [rbp - 0x60], r14
mov qword [rbp - 0x58], 7
mov word [rbp - 0x70], r14w
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rbx + r8*2], 0
jne 0x140002ca0
mov rdx, rbx
lea rcx, [rbp - 0x70]
call fcn.140003940
nop
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], r14w
mov r8, 0xffffffffffffffff
inc r8
cmp word [rbx + r8*2], 0
jne 0x140002cd3
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.140003940
nop
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], r14w
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
cmovae rcx, qword [rbp - 0x70]
mov rdx, qword [rbp - 0x60]
test rdx, rdx
je 0x140002e6a
mov rax, rdx
mov rbx, rcx
nop
cmp word [rbx], 0x20
je 0x140002d35
add rbx, 2
sub rax, 1
jne 0x140002d20
jmp 0x140002e6a
sub rbx, rcx
sar rbx, 1
cmp rbx, 0xffffffffffffffff
je 0x140002e6a
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x38], 7
mov word [rbp - 0x50], r14w
mov r8, rbx
cmp rdx, rbx
cmovb r8, rdx
lea rdx, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
cmovae rdx, qword [rbp - 0x70]
lea rcx, [rbp - 0x50]
call fcn.140003940
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x140002db9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002db4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000345d
call fcn.140004298
movups xmm0, xmmword [rbp - 0x50]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rbp - 0x40]
movups xmmword [rsp + 0x60], xmm1
inc rbx
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x38], 7
mov word [rbp - 0x50], r14w
mov rax, qword [rbp - 0x60]
cmp rax, rbx
jb 0x140003457
sub rax, rbx
mov r8, 0xffffffffffffffff
cmp rax, r8
cmovb r8, rax
lea rax, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
cmovae rax, qword [rbp - 0x70]
lea rdx, [rax + rbx*2]
lea rcx, [rbp - 0x50]
call fcn.140003940
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x140002e59
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002e54
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000345d
call fcn.140004298
movups xmm0, xmmword [rbp - 0x50]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rbp - 0x40]
movups xmmword [rbp - 0x80], xmm1
lea rdi, [rsp + 0x50]
mov rcx, qword [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdi, rcx
lea rax, [rsp + 0x50]
cmovae rax, rcx
mov r9, qword [rsp + 0x60]
lea rsi, [rax + r9*2]
lea rbx, [rsp + 0x50]
cmovae rbx, rcx
cmp rbx, rsi
je 0x140002ebb
sub rdi, rbx
movzx ecx, word [rbx]
call fcn.140008bd4
mov word [rdi + rbx], ax
add rbx, 2
cmp rbx, rsi
jne 0x140002ea1
mov r9, qword [rsp + 0x60]
lea r8, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae r8, qword [rsp + 0x50]
mov rdx, r9
mov eax, 9
cmp r9, rax
cmova rdx, rax
lea rcx, str.launchurl
test rdx, rdx
je 0x140002f04
sub r8, rcx
nop word [rax + rax]
movzx eax, word [rcx]
cmp word [r8 + rcx], ax
jne 0x140002f0e
add rcx, 2
sub rdx, 1
jne 0x140002ef0
cmp r9, 9
je 0x14000323d
lea r8, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae r8, qword [rsp + 0x50]
mov rdx, r9
mov eax, 0xa
cmp r9, rax
cmova rdx, rax
lea rcx, str.showdetail
test rdx, rdx
je 0x140002f58
sub r8, rcx
nop dword [rax]
movzx eax, word [rcx]
cmp word [r8 + rcx], ax
jne 0x140003265
add rcx, 2
sub rdx, 1
jne 0x140002f40
cmp r9, 0xa
jne 0x140003265
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 8
cmovae rcx, qword [rbp - 0x10]
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
jne 0x1400031f3
lea rcx, [rbp - 0x50]
call fcn.140001bc0
nop
lea rdx, [rbp - 0x50]
mov r10, qword [rbp - 0x50]
mov r11, qword [rbp - 0x38]
cmp r11, 8
cmovae rdx, r10
mov r9, qword [rbp - 0x40]
test r9, r9
je 0x140002fdd
lea rcx, [r9 - 1]
mov rax, 0xffffffffffffffff
cmp rcx, rax
cmovb rax, rcx
lea r8, [rdx + rax*2]
cmp word [r8], 0x5c
je 0x140002fd5
cmp r8, rdx
je 0x140002fdd
sub r8, 2
cmp word [r8], 0x5c
jne 0x140002fc5
sub r8, rdx
sar r8, 1
jmp 0x140002fe4
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], r14w
inc r8
cmp r9, r8
cmovb r8, r9
lea rdx, [rbp - 0x50]
cmp r11, 8
cmovae rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140003940
nop
lea r9, [rbp + 0x10]
cmp qword [rbp + 0x28], 8
cmovae r9, qword [rbp + 0x10]
mov rcx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x48]
mov rax, r8
sub rax, rcx
mov rdx, qword [rbp + 0x20]
cmp rdx, rax
ja 0x140003074
lea rdi, [rcx + rdx]
mov qword [rsp + 0x40], rdi
lea rbx, [rsp + 0x30]
cmp r8, 8
cmovae rbx, qword [rsp + 0x30]
lea r8, [rdx + rdx]
lea rcx, [rbx + rcx*2]
mov rdx, r9
call fcn.140005ed0
mov word [rbx + rdi*2], r14w
lea rax, [rsp + 0x30]
jmp 0x140003083
mov qword [rsp + 0x20], rdx
lea rcx, [rsp + 0x30]
call fcn.140003df0
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], r14
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x20], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x1400030ec
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400030e7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003463
call fcn.140004298
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], r14w
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rcx, qword [rbp - 0x30]
xor edx, edx
call fcn.1400089d8
cmp eax, 0xffffffff
je 0x14000315c
lea rcx, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
cmovae rcx, qword [rsp + 0x70]
call fcn.140001f80
lea r8, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae r8, qword [rbp - 0x30]
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r14
lea r9, str._showdetail
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x14000319c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003197
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003469
call fcn.140004298
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], r14w
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x140003265
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400031ec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000346f
call fcn.140004298
jmp 0x140003265
lea r8, [rbp + 0x30]
cmp qword [rbp + 0x48], 8
cmovae r8, qword [rbp + 0x30]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_OpenEventW]
mov rbx, rax
test rax, rax
je 0x140003265
lea rcx, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
cmovae rcx, qword [rsp + 0x70]
call fcn.140001f80
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140003265
lea r8, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
cmovae r8, qword [rsp + 0x70]
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x1400032a6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400032a1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003475
call fcn.140004298
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], r14w
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x1400032fa
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400032f5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000347b
call fcn.140004298
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], r14w
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x14000334e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003349
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003481
call fcn.140004298
mov qword [rbp - 0x60], r14
mov qword [rbp - 0x58], 7
mov word [rbp - 0x70], r14w
mov rdx, qword [rbp + 0x28]
cmp rdx, 8
jb 0x1400033a0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000339a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003487
call fcn.140004298
nop
mov rdx, qword [rbp + 8]
cmp rdx, 8
jb 0x1400033e0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400033db
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000348d
call fcn.140004298
mov qword [rbp], r14
mov qword [rbp + 8], 7
mov word [rbp - 0x10], r14w
mov rdx, qword [rbp + 0x48]
cmp rdx, 8
jb 0x14000342d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003428
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003451
call fcn.140004298
mov rcx, qword [rbp + 0x50]
xor rcx, rsp
call fcn.140004260
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.140008e34
nop
call fcn.140003ac0
nop
call fcn.140008e34
nop
call fcn.140008e34
nop
call fcn.140008e34
nop
call fcn.140008e34
nop
call fcn.140008e34
nop
call fcn.140008e34
nop
call fcn.140008e34
nop
call fcn.140008e34
nop
call fcn.140008e34
int3