Function at 0x14009c680
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x38
mov eax, dword [0x14026edd8]
mov rbx, rcx
add eax, 0xffffdc84
cmp eax, 1
ja 0x14009c6b5
cmp word [rcx + 0xf70], 0
je 0x14009c6b5
mov esi, 1
jmp 0x14009c6b7
xor esi, esi
lea rcx, str.UNavTray
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowW]
mov edx, 3
lea rcx, [0x14026ef98]
lea r8d, [rdx - 2]
mov rdi, rax
call fcn.14002c490
mov edx, 3
lea rcx, [0x14026ef98]
lea r8d, [rdx - 2]
mov r14, rax
call fcn.14002c3c0
xor r8d, r8d
lea rcx, [0x14026ef98]
lea edx, [r8 + 3]
mov r13, rax
call fcn.14002c490
xor r8d, r8d
lea rcx, [0x14026ef98]
lea edx, [r8 + 3]
mov r15, rax
call fcn.14002c3c0
xor r12d, r12d
xor ebp, ebp
mov qword [rsp + 0x98], rax
mov dword [rsp + 0x90], r12d
mov dword [rsp + 0x80], r12d
test rax, rax
je 0x14009c776
mov rcx, qword [rax + 0x58]
xor edx, edx
mov dword [rsp + 0x88], edx
test rcx, rcx
je 0x14009c770
mov rax, qword [rcx]
lea r8, [rsp + 0x88]
mov edx, 0x3000133
call qword [rax + 0x18]
mov edx, dword [rsp + 0x88]
test edx, edx
sete r12b
test r15, r15
je 0x14009c7b5
mov rcx, qword [r15 + 0x58]
xor eax, eax
mov dword [rsp + 0x88], eax
test rcx, rcx
je 0x14009c7a7
mov rax, qword [rcx]
lea r8, [rsp + 0x88]
mov edx, 0x3000133
call qword [rax + 0x18]
mov eax, dword [rsp + 0x88]
xor ecx, ecx
test eax, eax
sete cl
mov dword [rsp + 0x90], ecx
test r13, r13
je 0x14009c7f4
mov rcx, qword [r13 + 0x58]
xor eax, eax
mov dword [rsp + 0x80], eax
test rcx, rcx
je 0x14009c7e6
mov rax, qword [rcx]
lea r8, [rsp + 0x80]
mov edx, 0x3000133
call qword [rax + 0x18]
mov eax, dword [rsp + 0x80]
xor ecx, ecx
test eax, eax
sete cl
mov dword [rsp + 0x80], ecx
test r14, r14
je 0x14009c82b
mov rcx, qword [r14 + 0x58]
xor eax, eax
mov dword [rsp + 0x88], eax
test rcx, rcx
je 0x14009c825
mov rax, qword [rcx]
lea r8, [rsp + 0x88]
mov edx, 0x3000133
call qword [rax + 0x18]
mov eax, dword [rsp + 0x88]
test eax, eax
sete bpl
mov ecx, dword [rbx + 0xc]
test ecx, ecx
je 0x14009c849
dec ecx
je 0x14009c872
sub ecx, 0x10
je 0x14009c872
sub ecx, 0x10
je 0x14009c849
cmp ecx, 0x10
jne 0x14009c9a5
test esi, esi
je 0x14009c97d
test rdi, rdi
je 0x14009c9a5
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x14009c9a5
test esi, esi
je 0x14009c8d9
test rdi, rdi
jne 0x14009c8c0
lea rax, [0x1401302e8]
lea r8, [rbx + 0xf70]
lea r9, [0x1401226e8]
lea rdx, str.open
xor ecx, ecx
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rcx, rbx
call fcn.14009d970
mov rdi, rax
test rax, rax
je 0x14009c9a5
xor r9d, r9d
xor r8d, r8d
mov edx, 0x4d2
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x14009c9a5
mov eax, dword [rsp + 0x90]
test eax, eax
jne 0x14009c8e8
test ebp, ebp
je 0x14009c8fa
mov ecx, dword [rsp + 0x80]
test r12d, r12d
jne 0x14009c901
test ecx, ecx
je 0x14009c91d
jmp 0x14009c901
mov ecx, dword [rsp + 0x80]
test r15, r15
jne 0x14009c90b
test r14, r14
je 0x14009c92e
mov rdx, qword [rsp + 0x98]
test rdx, rdx
jne 0x14009c936
test r13, r13
jne 0x14009c936
mov rdx, qword [rbx + 0xe8]
mov rcx, rbx
call fcn.14009c5a0
jmp 0x14009c9a5
mov rdx, qword [rsp + 0x98]
test r12d, r12d
jne 0x14009c93f
test ecx, ecx
je 0x14009c947
test eax, eax
jne 0x14009c947
test ebp, ebp
je 0x14009c95b
test rdx, rdx
jne 0x14009c951
test r13, r13
je 0x14009c96c
test r15, r15
jne 0x14009c96c
test r14, r14
jne 0x14009c96c
mov rdx, qword [rbx + 0xf8]
mov rcx, rbx
call fcn.14009c5a0
jmp 0x14009c9a5
mov rdx, qword [rbx + 0xf0]
mov rcx, rbx
call fcn.14009c5a0
jmp 0x14009c9a5
lea rdx, [rbx + 0x178]
mov ecx, 2
call qword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
test eax, eax
jne 0x14009c99e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x14009c9a5
mov dword [rbx + 0x48], 0
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret