Function at 0x45a140
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
sub rsp, 0x78
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
xor ebx, ebx
cmp dword [0x0050bf38], 0x237c
mov qword [rax + 0x18], rsi
mov rsi, rcx
jne 0x459ae2
cmp word [rcx + 0xcf0], bx
je 0x459ae2
lea ebp, [rbx + 1]
jmp 0x459ae4
mov ebp, ebx
mov qword [rsp + 0x98], rdi
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x68], r13
lea rcx, str.UNavTray
xor edx, edx
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x58], r15
call qword [sym.imp.USER32.dll_FindWindowW]
lea rcx, [0x0050bfd8]
mov edx, 2
mov rdi, rax
call fcn.0040aff0
lea rcx, [0x0050bfd8]
mov edx, 2
mov r14, rax
call fcn.0040af40
lea rcx, [0x0050bfd8]
mov edx, 3
mov qword [rsp + 0x48], rax
call fcn.0040aff0
lea rcx, [0x0050bfd8]
mov edx, 3
mov r13, rax
call fcn.0040af40
mov r15d, ebx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x48]
mov dword [rsp + 0x38], ebx
test rax, rax
mov dword [rsp + 0x30], ebx
mov r12d, ebx
je 0x459ba7
mov rcx, qword [rax + 0x58]
mov edx, ebx
mov dword [rsp + 0x34], ebx
test rcx, rcx
je 0x459ba1
mov rax, qword [rcx]
lea r8, [rsp + 0x34]
mov edx, 0x3000133
call qword [rax + 0x18]
mov edx, dword [rsp + 0x34]
test edx, edx
sete r15b
test r14, r14
je 0x459bda
mov rcx, qword [r14 + 0x58]
mov eax, ebx
mov dword [rsp + 0x34], ebx
test rcx, rcx
je 0x459bcf
mov rax, qword [rcx]
lea r8, [rsp + 0x34]
mov edx, 0x3000133
call qword [rax + 0x18]
mov eax, dword [rsp + 0x34]
mov ecx, ebx
test eax, eax
sete cl
mov dword [rsp + 0x38], ecx
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x459c12
mov rcx, qword [rcx + 0x58]
mov eax, ebx
mov dword [rsp + 0x34], ebx
test rcx, rcx
je 0x459c07
mov rax, qword [rcx]
lea r8, [rsp + 0x34]
mov edx, 0x3000133
call qword [rax + 0x18]
mov eax, dword [rsp + 0x34]
mov ecx, ebx
test eax, eax
sete cl
mov dword [rsp + 0x30], ecx
test r13, r13
je 0x459c40
mov rcx, qword [r13 + 0x58]
mov eax, ebx
mov dword [rsp + 0x34], ebx
test rcx, rcx
je 0x459c3a
mov rax, qword [rcx]
lea r8, [rsp + 0x34]
mov edx, 0x3000133
call qword [rax + 0x18]
mov eax, dword [rsp + 0x34]
test eax, eax
sete r12b
mov eax, dword [rsi + 0xc]
test eax, eax
je 0x459c5f
sub eax, 1
je 0x459c88
sub eax, 0x10
je 0x459c88
sub eax, 0x10
je 0x459c5f
cmp eax, 0x10
jne 0x459ddd
test ebp, ebp
je 0x459dc8
test rdi, rdi
je 0x459ddd
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x459ddd
test ebp, ebp
je 0x459d1a
test rdi, rdi
jne 0x459d01
lea rax, [0x004d78ec]
lea r8, [rsi + 0xcf0]
lea r9, [0x004d0d8c]
lea rdx, str.open
xor ecx, ecx
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdi, rbx
nop
nop
test rdi, rdi
jne 0x459cf8
lea ecx, [rdi + 0x32]
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.UNavTray
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowW]
add ebx, 1
cmp ebx, 0xa
mov rdi, rax
jl 0x459cd0
test rdi, rdi
je 0x459ddd
xor r9d, r9d
xor r8d, r8d
mov edx, 0x4d2
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x459ddd
mov eax, dword [rsp + 0x38]
test eax, eax
jne 0x459d27
test r12d, r12d
je 0x459d36
test r15d, r15d
jne 0x459d3c
mov ecx, dword [rsp + 0x30]
test ecx, ecx
je 0x459d5e
jmp 0x459d40
mov ecx, dword [rsp + 0x30]
jmp 0x459d40
mov ecx, dword [rsp + 0x30]
test r14, r14
jne 0x459d4a
test r13, r13
je 0x459d76
mov r11, qword [rsp + 0x48]
test r11, r11
jne 0x459d6f
mov rdx, qword [rsp + 0x40]
test rdx, rdx
jne 0x459d80
mov rdx, qword [rsi + 0xd8]
mov rcx, rsi
call fcn.00458bf0
jmp 0x459ddd
mov rdx, qword [rsp + 0x40]
jmp 0x459d80
mov rdx, qword [rsp + 0x40]
mov r11, qword [rsp + 0x48]
test r15d, r15d
jne 0x459d89
test ecx, ecx
je 0x459d92
test eax, eax
jne 0x459d92
test r12d, r12d
je 0x459da6
test r11, r11
jne 0x459d9c
test rdx, rdx
je 0x459db7
test r14, r14
jne 0x459db7
test r13, r13
jne 0x459db7
mov rdx, qword [rsi + 0xe8]
mov rcx, rsi
call fcn.00458bf0
jmp 0x459ddd
mov rdx, qword [rsi + 0xe0]
mov rcx, rsi
call fcn.00458bf0
jmp 0x459ddd
lea rdx, [rsi + 0x168]
mov ecx, 2
call qword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov dword [rsi + 0x40], ebx
mov r15, qword [rsp + 0x58]
mov r14, qword [rsp + 0x60]
mov r13, qword [rsp + 0x68]
mov r12, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x98]
mov rsi, qword [rsp + 0x90]
mov rbp, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x80]
add rsp, 0x78
ret
push rbx
sub rsp, 0x20
mov rax, qword [0x0050bfe0]
mov rbx, rcx
test rax, rax
je 0x45a25d
cmp qword [rax], 0
je 0x45a25d
cmp dword [rcx + 0x538], 0
je 0x45a176
add rsp, 0x20
pop rbx
jmp 0x459ab0
cmp dword [rcx + 0x550], 0
jne 0x45a276
cmp dword [rcx + 0x548], 0
mov dword [rcx + 0x3c], 0
je 0x45a1f0
lea rcx, [0x0050bfd8]
mov edx, 2
call fcn.0040af40
test rax, rax
jne 0x45a1e5
lea edx, [rax + 3]
lea rcx, [0x0050bfd8]
call fcn.0040af40
test rax, rax
jne 0x45a1e5
lea edx, [rax + 2]
lea rcx, [0x0050bfd8]
call fcn.0040aff0
test rax, rax
jne 0x45a1e5
lea edx, [rax + 3]
lea rcx, [0x0050bfd8]
call fcn.0040aff0
test rax, rax
je 0x45a1f0
mov rcx, rax
call fcn.00406940
mov dword [rbx + 0x3c], eax
cmp dword [rbx + 0x3c], 0
je 0x45a210
test byte [rbx + 0xc], 0x20
jne 0x45a210
mov rdx, qword [rbx + 0xc8]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.00458bf0
mov eax, dword [rbx + 0xc]
test eax, eax
je 0x45a22b
sub eax, 1
je 0x45a249
sub eax, 0x10
je 0x45a234
sub eax, 0x10
je 0x45a22b
cmp eax, 0x10
jne 0x45a276
lea rdx, [rbx + 0x168]
jmp 0x45a264
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.00458ca0
mov rdx, qword [rbx + 0xd0]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.00458bf0
lea rdx, [rcx + 0x168]
mov ecx, 2
call qword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov dword [rbx + 0x40], 0
add rsp, 0x20
pop rbx
ret