Function at 0x140008020
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0xe10]
sub rsp, 0xf10
mov rax, qword [0x140046088]
xor rax, rsp
mov qword [rbp + 0xe00], rax
mov rdi, r8
mov ebx, edx
call fcn.140007f20
test al, al
je 0x140008065
cmp ebx, 0x8008
jne 0x1400085b0
cmp ebx, 0x8002
jne 0x140008221
mov r9d, edi
lea r8, str._kAgtCmdShowToastBluelightShield__mode:_d
mov edx, 0x40
lea rcx, [rbp + 0x770]
call fcn.140005a20
mov rcx, qword [0x140048b90]
test rcx, rcx
je 0x1400080ad
lea r9, [rbp + 0x770]
xor edx, edx
lea r8, str.ToastShowingProcessMessage
call fcn.1400057d0
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call fcn.14000f120
xor edx, edx
lea rcx, [rbp + 0x350]
mov r8d, 0x208
call fcn.14000f120
xor edx, edx
lea rcx, [rbp + 0x140]
mov r8d, 0x208
call fcn.14000f120
xor edx, edx
lea rcx, [rbp + 0x560]
mov r8d, 0x208
call fcn.14000f120
xor edx, edx
lea rcx, [rbp + 0xbf0]
mov r8d, 0x208
call fcn.14000f120
xor edx, edx
lea rcx, [rbp + 0x7f0]
mov r8d, 0x400
call fcn.14000f120
mov r8d, 0x104
lea rdx, [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov r9d, 0x104
lea r8, [rbp + 0x140]
mov edx, 0x6a
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadStringW]
mov r9d, 0x104
lea r8, [rbp + 0x560]
mov edx, 0x6b
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadStringW]
test edi, edi
jne 0x14000817e
lea edx, [rdi + 0x6d]
jmp 0x14000819a
cmp edi, 1
jne 0x140008188
lea edx, [rdi + 0x6d]
jmp 0x14000819a
cmp edi, 2
jne 0x140008192
lea edx, [rdi + 0x6a]
jmp 0x14000819a
cmp edi, 3
jne 0x1400081af
lea edx, [rdi + 0x6c]
mov r9d, 0x104
lea r8, [rbp + 0xbf0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadStringW]
lea r9, [rbp + 0xbf0]
lea r8, [rbp + 0x560]
lea rdx, [0x14003edb0]
lea rcx, [rbp + 0x560]
call fcn.1400011f0
lea r8, [rsp + 0x30]
lea rdx, str._sQAToastCreator.exe
lea rcx, [rbp + 0x350]
call fcn.1400011f0
lea rax, [rbp + 0x560]
lea r9, [rbp + 0x140]
mov qword [rsp + 0x20], rax
lea r8, str.AcerIncorporated.QuickAccess_48frkmn4z8aw4_QuickAccessCentennialApp
lea rdx, str._toast_appid___s__title___s__msg___s_
lea rcx, [rbp + 0x7f0]
call fcn.140008700
lea r8, [rbp + 0x350]
jmp 0x140008594
cmp ebx, 0x8003
jne 0x1400082c4
mov rcx, qword [0x140048b90]
test rcx, rcx
je 0x14000824e
lea r9, str.kAgtCmdShowToastSwitchLock
xor edx, edx
lea r8, str.ToastShowingProcessMessage
call fcn.1400057d0
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call fcn.14000f120
xor edx, edx
lea rcx, [rbp + 0x140]
mov r8d, 0x208
call fcn.14000f120
xor edx, edx
lea rcx, [rbp + 0x350]
mov r8d, 0x208
call fcn.14000f120
xor edx, edx
lea rcx, [rbp + 0x7f0]
mov r8d, 0x400
call fcn.14000f120
mov r8d, 0x104
lea rdx, [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov edx, 0x70
jmp 0x14000853f
cmp ebx, 0x8004
jne 0x140008367
mov rcx, qword [0x140048b90]
test rcx, rcx
je 0x1400082f1
lea r9, str.kAgtCmdShowToastDustDefender
xor edx, edx
lea r8, str.ToastShowingProcessMessage
call fcn.1400057d0
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call fcn.14000f120
xor edx, edx
lea rcx, [rbp + 0x140]
mov r8d, 0x208
call fcn.14000f120
xor edx, edx
lea rcx, [rbp + 0x350]
mov r8d, 0x208
call fcn.14000f120
xor edx, edx
lea rcx, [rbp + 0x7f0]
mov r8d, 0x400
call fcn.14000f120
mov r8d, 0x104
lea rdx, [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov edx, 0x69
jmp 0x14000853f
cmp ebx, 0x8005
jne 0x14000846c
mov rcx, qword [0x140048b90]
test rcx, rcx
je 0x140008394
lea r9, str.kAgtCmdShowToastDockSafelyRemove
xor edx, edx
lea r8, str.ToastShowingProcessMessage
call fcn.1400057d0
xor edx, edx
lea rcx, [rbp + 0x560]
mov r8d, 0x208
call fcn.14000f120
xor edx, edx
lea rcx, [rbp + 0x140]
mov r8d, 0x208
call fcn.14000f120
xor edx, edx
lea rcx, [rbp + 0x350]
mov r8d, 0x208
call fcn.14000f120
xor edx, edx
lea rcx, [rbp + 0x7f0]
mov r8d, 0x400
call fcn.14000f120
mov r8d, 0x104
lea rdx, [rbp + 0x560]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rbp + 0x560]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov r9d, 0x104
lea r8, [rbp + 0x350]
mov edx, 0x71
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadStringW]
lea r8, [rbp + 0x560]
lea rdx, str._sQAToastCreator.exe
lea rcx, [rbp + 0x140]
call fcn.1400011f0
lea rax, [rbp + 0x560]
lea r9, [rbp + 0x350]
mov qword [rsp + 0x20], rax
lea r8, str.AcerIncorporated.QuickAccess_48frkmn4z8aw4_QuickAccessCentennialApp
lea rdx, str._toast_appid___s__msg___s__run___sPluginsDockSafelyRemoveUIDockSafelyRemoveUI.exe_
lea rcx, [rbp + 0x7f0]
call fcn.140008700
jmp 0x14000858d
cmp ebx, 0x8008
jne 0x1400084a1
mov rcx, qword [0x140048b90]
test rcx, rcx
je 0x140008495
lea r9, str.kAgtCmdShoweSIMMsg
xor edx, edx
lea r8, str.ToastShowingProcessMessage
call fcn.1400057d0
mov ecx, edi
call fcn.1400085e0
jmp 0x1400085b0
cmp ebx, 0x8009
jne 0x1400085b0
mov rcx, qword [0x140048b90]
test rcx, rcx
je 0x1400084ce
lea r9, str.kAgtCmdShowToastAcerOLEDFeatures
xor edx, edx
lea r8, str.ToastShowingProcessMessage
call fcn.1400057d0
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call fcn.14000f120
xor edx, edx
lea rcx, [rbp + 0x140]
mov r8d, 0x208
call fcn.14000f120
xor edx, edx
lea rcx, [rbp + 0x350]
mov r8d, 0x208
call fcn.14000f120
xor edx, edx
lea rcx, [rbp + 0x7f0]
mov r8d, 0x400
call fcn.14000f120
mov r8d, 0x104
lea rdx, [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov edx, 0x84
mov r9d, 0x104
lea r8, [rbp + 0x350]
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadStringW]
lea r8, [rsp + 0x30]
lea rdx, str._sQAToastCreator.exe
lea rcx, [rbp + 0x140]
call fcn.1400011f0
lea r9, [rbp + 0x350]
lea r8, str.AcerIncorporated.QuickAccess_48frkmn4z8aw4_QuickAccessCentennialApp
lea rdx, str._toast_appid___s__msg___s_
lea rcx, [rbp + 0x7f0]
call fcn.140008700
lea r8, [rbp + 0x140]
xor eax, eax
lea r9, [rbp + 0x7f0]
mov dword [rsp + 0x28], eax
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rcx, qword [rbp + 0xe00]
xor rcx, rsp
call fcn.14000ba00
lea r11, [rsp + 0xf10]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret