Function at 0x14003b2c0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x440]
sub rsp, 0x540
mov rax, qword [0x140063010]
xor rax, rsp
mov qword [rbp + 0x430], rax
xor esi, esi
mov dword [rsp + 0x40], esi
call qword [sym.imp.WINMM.dll_timeGetTime]
mov dword [rbp + 0x10], eax
lea r9, [rsi - 1]
lea r14, str.VpnApp::CheckSystray
mov r8, r14
mov edx, 0x102
lea rcx, [rbp + 0x14]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
lea r8, [0x140051568]
mov edx, 0x104
lea rcx, [rbp + 0x14]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r9, [rsi - 1]
mov r8, r14
mov edx, 0x104
lea rcx, [rbp + 0x21c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
mov ecx, dword [0x140065724]
mov eax, dword [0x140065720]
lea r15d, [rsi + 1]
add ecx, eax
je 0x14003b40a
mov dword [rsp + 0x50], esi
call fcn.140028b70
mov qword [rsp + 0x48], rax
lock inc dword [rsp + 0x50]
mov rax, qword [rsp + 0x48]
test rax, rax
jne 0x14003b393
call fcn.140028b70
mov qword [rsp + 0x48], rax
lock inc dword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
mov dword [rsp + 0x78], 0x20
lea rax, [rbp + 0x14]
mov qword [rsp + 0x30], rax
lea rax, str.____s
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x21c]
mov qword [rsp + 0x20], rax
lea r9, [0x140000000]
lea r8, [rsp + 0x78]
movsx edx, r15w
call fcn.140028cf0
nop
mov qword [rsp + 0x48], rsi
mov eax, 0xffffffff
lock xadd dword [rsp + 0x50], eax
cmp eax, 1
js 0x14003b405
nop dword [rax]
call fcn.140028730
mov eax, 0xffffffff
lock xadd dword [rsp + 0x50], eax
cmp eax, 1
jns 0x14003b3f0
lock inc dword [rsp + 0x50]
xor edx, edx
lea rcx, str.bd_vpn_window_systray_plugin
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x14003b4df
mov ecx, dword [0x140065724]
mov eax, dword [0x140065720]
add ecx, eax
je 0x14003b496
mov dword [rsp + 0x60], esi
call fcn.140028b70
mov qword [rsp + 0x58], rax
lock inc dword [rsp + 0x60]
mov dword [rsp + 0x40], r15d
mov rax, qword [rsp + 0x58]
test rax, rax
jne 0x14003b463
call fcn.140028b70
mov qword [rsp + 0x58], rax
lock inc dword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
mov dword [rsp + 0x7c], 0x10
lea rax, str.Systray_found
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea r9, [0x140000000]
lea r8, [rsp + 0x7c]
movsx edx, si
call fcn.140028cf0
nop
mov eax, dword [rsp + 0x40]
test al, 1
je 0x14003b6d2
and eax, 0xfffffffe
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x58], rsi
mov eax, 0xffffffff
lock xadd dword [rsp + 0x60], eax
cmp eax, 1
js 0x14003b4d5
nop
call fcn.140028730
mov eax, 0xffffffff
lock xadd dword [rsp + 0x60], eax
cmp eax, 1
jns 0x14003b4c0
lock inc dword [rsp + 0x60]
jmp 0x14003b6d2
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rdi, rax
lea rcx, [rbp - 0x70]
call fcn.14002fd00
mov rbx, rax
mov qword [rbp - 0x78], rsi
mov rcx, qword [rax]
mov rcx, qword [rcx - 0x18]
test rcx, rcx
je 0x14003b512
mov rdx, qword [rcx]
call qword [rdx + 0x20]
mov rcx, rax
test rax, rax
jne 0x14003b523
call fcn.1400027a0
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x14003b707
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x78], rax
mov dword [rsp + 0x40], 4
lea r9, str.bdvpnapp.exe
mov rax, 0xffffffffffffffff
inc rax
cmp word [r9 + rax*2], 0
jne 0x14003b550
mov rdx, qword [rbx]
mov dword [rsp + 0x20], eax
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x78]
call fcn.140040020
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x2c], xmm0
movups xmmword [rbp - 0x1c], xmm0
movups xmmword [rbp - 0xc], xmm0
mov qword [rbp + 4], rax
mov dword [rbp + 0xc], eax
mov dword [rbp - 0x60], 0x70
mov dword [rbp - 0x5c], 0x400
mov qword [rbp - 0x58], rdi
lea rax, str.open
mov qword [rbp - 0x50], rax
mov rbx, qword [rbp - 0x78]
mov qword [rbp - 0x48], rbx
lea rax, [0x14004dce0]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rsi
mov dword [rbp - 0x30], r15d
lea rcx, [rbp - 0x60]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
setne dil
mov dword [rsp + 0x40], esi
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14003b5f3
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x70]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14003b616
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
test dil, dil
jne 0x14003b6d2
mov ecx, dword [0x140065724]
mov eax, dword [0x140065720]
add ecx, eax
je 0x14003b694
mov dword [rsp + 0x70], esi
call fcn.140028b70
mov qword [rsp + 0x68], rax
lock inc dword [rsp + 0x70]
mov dword [rsp + 0x40], 2
mov rax, qword [rsp + 0x68]
test rax, rax
jne 0x14003b663
call fcn.140028b70
mov qword [rsp + 0x68], rax
lock inc dword [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
mov dword [rbp - 0x80], 4
lea rax, str.Cannot_open_tray_app
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea r9, [0x140000000]
lea r8, [rbp - 0x80]
movsx edx, si
call fcn.140028cf0
nop
mov eax, dword [rsp + 0x40]
test al, 2
je 0x14003b6d2
and eax, 0xfffffffd
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x68], rsi
mov eax, 0xffffffff
lock xadd dword [rsp + 0x70], eax
cmp eax, 1
js 0x14003b6cd
call fcn.140028730
mov eax, 0xffffffff
lock xadd dword [rsp + 0x70], eax
cmp eax, 1
jns 0x14003b6b8
lock inc dword [rsp + 0x70]
lea rcx, [rbp + 0x10]
call fcn.140027640
mov rcx, qword [rbp + 0x430]
xor rcx, rsp
call fcn.140045c20
lea r11, [rsp + 0x540]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov ecx, 0x80004005
call fcn.140002900
int3