Function at 0x140061330
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x2e8]
sub rsp, 0x3c0
mov qword [rbp + 0x168], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x140232230]
xor rax, rsp
mov qword [rbp + 0x2b0], rax
mov r14, rcx
add edx, 0xffff63bf
cmp edx, 0x1e
ja case.0x140061393.40007
movsxd rax, edx
lea rdx, [0x140000000]
mov ecx, dword [rdx + rax*4 + 0x61bb8]
add rcx, rdx
jmp rcx
lea rax, [rbp - 0x58]
mov qword [rsp + 0x40], rax
mov qword [rbp - 0x40], 7
xor esi, esi
mov qword [rbp - 0x48], rsi
mov word [rbp - 0x58], si
lea r8d, [rsi + 0x57]
lea rdx, str._mainproc___Main_OnCommand_____user_clicked_tray_icon_right_click_menu_PeerBlock_item
lea rcx, [rbp - 0x58]
call fcn.14000dc20
nop
lea r8d, [rsi + 5]
lea rdx, [rbp - 0x58]
call fcn.140078560
cmp byte [0x140239c74], sil
setne sil
mov edx, esi
mov rcx, r14
call fcn.140066370
jmp case.0x140061393.40007
lea rax, [rbp + 0x108]
mov qword [rsp + 0x40], rax
mov qword [rbp + 0x120], 7
xor esi, esi
mov qword [rbp + 0x118], rsi
mov word [rbp + 0x108], si
lea r8d, [rsi + 0x55]
lea rdx, str._mainproc___Main_OnCommand_____user_clicked_tray_icon_right_click_menu_Enabled_item
lea rcx, [rbp + 0x108]
call fcn.14000dc20
nop
lea r8d, [rsi + 5]
lea rdx, [rbp + 0x108]
call fcn.140078560
cmp byte [0x140239b4c], sil
jne case.0x140061393.40007
mov cl, 1
call fcn.140060b90
jmp case.0x140061393.40007
lea rax, [rbp - 0x18]
mov qword [rsp + 0x40], rax
mov qword [rbp], 7
xor esi, esi
mov qword [rbp - 8], rsi
mov word [rbp - 0x18], si
lea r8d, [rsi + 0x56]
lea rdx, str._mainproc___Main_OnCommand_____user_clicked_tray_icon_right_click_menu_Disabled_item
lea rcx, [rbp - 0x18]
call fcn.14000dc20
nop
lea r8d, [rsi + 5]
lea rdx, [rbp - 0x18]
call fcn.140078560
cmp byte [0x140239b4c], sil
je case.0x140061393.40007
xor ecx, ecx
call fcn.140060b90
jmp case.0x140061393.40007
lea rax, [rbp + 0xe8]
mov qword [rsp + 0x40], rax
mov qword [rbp + 0x100], 7
xor esi, esi
mov qword [rbp + 0xf8], rsi
mov word [rbp + 0xe8], si
lea r8d, [rsi + 0x58]
lea rdx, str._mainproc___Main_OnCommand_____user_clicked_tray_icon_right_click_menu_Block_HTTP_item
lea rcx, [rbp + 0xe8]
call fcn.14000dc20
nop
lea r8d, [rsi + 5]
lea rdx, [rbp + 0xe8]
call fcn.140078560
cmp byte [0x140239c77], sil
jne 0x140061521
cmp byte [0x140239c78], sil
jne 0x140061521
cmp byte [0x140239ad0], sil
setne cl
xor edx, edx
call fcn.140060dc0
jmp case.0x140061393.40007
xor edx, edx
xor ecx, ecx
call fcn.140060dc0
jmp case.0x140061393.40007
lea rax, [rbp + 0x28]
mov qword [rsp + 0x40], rax
mov qword [rbp + 0x40], 7
xor esi, esi
mov qword [rbp + 0x38], rsi
mov word [rbp + 0x28], si
lea r8d, [rsi + 0x67]
lea rdx, str._mainproc___Main_OnCommand_____user_clicked_tray_icon_right_click_menu_Allow_HTTP_for_15_minutes_item
lea rcx, [rbp + 0x28]
call fcn.14000dc20
nop
lea r8d, [rsi + 5]
lea rdx, [rbp + 0x28]
call fcn.140078560
cmp byte [0x140239c77], sil
jne 0x140061584
lea edx, [rsi + 0xf]
xor ecx, ecx
call fcn.140060dc0
jmp case.0x140061393.40007
xor edx, edx
mov cl, 1
call fcn.140060dc0
jmp case.0x140061393.40007
lea rax, [rbp + 0xa8]
mov qword [rsp + 0x40], rax
mov qword [rbp + 0xc0], 7
xor esi, esi
mov qword [rbp + 0xb8], rsi
mov word [rbp + 0xa8], si
lea r8d, [rsi + 0x67]
lea rdx, str._mainproc___Main_OnCommand_____user_clicked_tray_icon_right_click_menu_Allow_HTTP_for_60_minutes_item
lea rcx, [rbp + 0xa8]
call fcn.14000dc20
nop
lea r8d, [rsi + 5]
lea rdx, [rbp + 0xa8]
call fcn.140078560
cmp byte [0x140239c78], sil
jne 0x140061584
lea edx, [rsi + 0x3c]
xor ecx, ecx
call fcn.140060dc0
jmp case.0x140061393.40007
lea rax, [rbp + 0x68]
mov qword [rsp + 0x40], rax
mov qword [rbp + 0x80], 7
xor esi, esi
mov qword [rbp + 0x78], rsi
mov word [rbp + 0x68], si
lea r8d, [rsi + 0x5b]
lea rdx, str._mainproc___Main_OnCommand_____user_clicked_tray_icon_right_click_menu_Always_on_Top_item
lea rcx, [rbp + 0x68]
call fcn.14000dc20
nop
lea r8d, [rsi + 5]
lea rdx, [rbp + 0x68]
call fcn.140078560
cmp byte [0x140239c75], sil
sete al
mov byte [0x140239c75], al
mov edx, esi
test al, al
setne dl
add rdx, 0xfffffffffffffffe
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rcx, r14
call qword [sym.imp.USER32.dll_SetWindowPos]
cmp byte [0x140239c75], sil
setne sil
mov r8d, esi
mov edx, 0x496
mov rcx, qword [0x140235458]
call qword [sym.imp.USER32.dll_CheckDlgButton]
jmp case.0x140061393.40007
lea rax, [rsp + 0x48]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x60], 7
xor esi, esi
mov qword [rsp + 0x58], rsi
mov word [rsp + 0x48], si
lea r8d, [rsi + 0x5c]
lea rdx, str._mainproc___Main_OnCommand_____user_clicked_tray_icon_right_click_menu_Hide_tray_menu_item
lea rcx, [rsp + 0x48]
call fcn.14000dc20
nop
lea r8d, [rsi + 5]
lea rdx, [rsp + 0x48]
call fcn.140078560
cmp byte [0x1402391eb], sil
je case.0x140061393.40007
mov byte [0x1402391eb], sil
lea rdx, [0x140239250]
lea ecx, [rsi + 2]
call qword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
cmp byte [0x140239b59], sil
je case.0x140061393.40007
mov byte [0x140239b59], sil
mov edx, 0xcb
lea r9d, [rsi + 0x40]
lea r8d, [rdx + 1]
mov rcx, r14
call fcn.1400681f0
jmp case.0x140061393.40007
lea rax, [rsp + 0x68]
mov qword [rsp + 0x40], rax
mov qword [rbp - 0x80], 7
xor esi, esi
mov qword [rsp + 0x78], rsi
mov word [rsp + 0x68], si
lea r8d, [rsi + 0x5f]
lea rdx, str._mainproc___Main_OnCommand_____user_clicked_tray_icon_right_click_menu_Check_for_updates_item
lea rcx, [rsp + 0x68]
call fcn.14000dc20
nop
lea r8d, [rsi + 5]
lea rdx, [rsp + 0x68]
call fcn.140078560
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8003
mov rcx, qword [0x140239228]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x140061393.40007
lea rax, [rbp - 0x78]
mov qword [rsp + 0x40], rax
mov qword [rbp - 0x60], 7
xor esi, esi
mov qword [rbp - 0x68], rsi
mov word [rbp - 0x78], si
lea r8d, [rsi + 0x52]
lea rdx, str._mainproc___Main_OnCommand_____user_clicked_tray_icon_right_click_menu_Help_item
lea rcx, [rbp - 0x78]
call fcn.14000dc20
nop
lea r8d, [rsi + 5]
lea rdx, [rbp - 0x78]
call fcn.140078560
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8, str.http:__www.peerblock.com_quick_guide
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp case.0x140061393.40007
lea rax, [rbp - 0x38]
mov qword [rsp + 0x40], rax
mov qword [rbp - 0x20], 7
xor esi, esi
mov qword [rbp - 0x28], rsi
mov word [rbp - 0x38], si
lea r8d, [rsi + 0x55]
lea rdx, str._mainproc___Main_OnCommand_____user_clicked_tray_icon_right_click_menu_Support_item
lea rcx, [rbp - 0x38]
call fcn.14000dc20
nop
lea r8d, [rsi + 5]
lea rdx, [rbp - 0x38]
call fcn.140078560
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8, str.http:__forums.peerblock.com
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp case.0x140061393.40007
lea rax, [rbp + 8]
mov qword [rsp + 0x40], rax
mov qword [rbp + 0x20], 7
xor esi, esi
mov qword [rbp + 0x18], rsi
mov word [rbp + 8], si
lea r8d, [rsi + 0x53]
lea rdx, str._mainproc___Main_OnCommand_____user_clicked_tray_icon_right_click_menu_About_item
lea rcx, [rbp + 8]
call fcn.14000dc20
nop
lea r8d, [rsi + 5]
lea rdx, [rbp + 8]
call fcn.140078560
mov rcx, qword [0x1402391c0]
test rcx, rcx
jne 0x1400618c8
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov qword [rsp + 0x20], rsi
lea r9, [0x140001180]
mov r8, r14
lea edx, [rsi + 0x78]
call qword [sym.imp.USER32.dll_CreateDialogParamW]
mov qword [0x1402391c0], rax
jmp case.0x140061393.40007
call qword [sym.imp.USER32.dll_SetForegroundWindow]
jmp case.0x140061393.40007
lea rax, [rbp + 0x48]
mov qword [rsp + 0x40], rax
mov qword [rbp + 0x60], 7
xor esi, esi
mov qword [rbp + 0x58], rsi
mov word [rbp + 0x48], si
lea r8d, [rsi + 0x52]
lea rdx, str._mainproc___Main_OnCommand_____user_clicked_tray_icon_right_click_menu_Exit_item
lea rcx, [rbp + 0x48]
call fcn.14000dc20
nop
lea r8d, [rsi + 5]
lea rdx, [rbp + 0x48]
call fcn.140078560
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
mov r15b, 1
lea r12, [0x140239db0]
mov qword [rbp + 0x170], r12
mov byte [rbp + 0x178], sil
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [rbp + 0x178], r15b
mov ebx, dword [0x140239230]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x140239b6c]
imul eax, eax, 0x3e8
add eax, ebx
cmp edi, eax
jbe 0x1400619b3
lea rax, [rbp + 0x88]
mov qword [rsp + 0x40], rax
mov qword [rbp + 0xa0], 7
mov qword [rbp + 0x98], rsi
mov word [rbp + 0x88], si
lea r8d, [rsi + 0x5b]
lea rdx, str._mainproc___Main_OnCommand_____sufficient_time_has_passed_since_last_block__exiting_program
lea rcx, [rbp + 0x88]
call fcn.14000dc20
nop
lea r8d, [rsi + 5]
lea rdx, [rbp + 0x88]
call fcn.140078560
jmp 0x140061b81
lea rax, [rbp + 0x148]
mov qword [rsp + 0x40], rax
mov qword [rbp + 0x160], 7
mov qword [rbp + 0x158], rsi
mov word [rbp + 0x148], si
mov r8d, 0x68
lea rdx, str._mainproc___Main_OnCommand_____insufficient_time_has_passed_since_last_block__displaying_warning_message
lea rcx, [rbp + 0x148]
call fcn.14000dc20
nop
mov r8d, 5
lea rdx, [rbp + 0x148]
call fcn.140078560
mov edx, 0x107
lea rcx, [rbp + 0x190]
call fcn.1400091d0
nop
mov rdx, rax
lea rcx, [rbp + 0x1b0]
call fcn.140003f90
nop
lea rdx, [0x140239b6c]
mov rcx, rax
call fcn.1400190a0
mov rdx, rax
lea rcx, [rbp + 0x170]
call fcn.14000dbe0
nop
lea rcx, [rbp + 0x1b0]
call fcn.1400090e0
nop
cmp qword [rbp + 0x1a8], 8
jb 0x140061a68
mov rcx, qword [rbp + 0x190]
call fcn.1401669a0
mov qword [rbp + 0x1a8], 7
mov qword [rbp + 0x1a0], rsi
mov word [rbp + 0x190], si
mov r9d, gethostname
mov r8d, 0x106
lea rdx, [rbp + 0x170]
mov rcx, r14
call fcn.140068150
cmp eax, 6
jne 0x140061af4
lea rax, [rbp + 0x128]
mov qword [rsp + 0x40], rax
mov qword [rbp + 0x140], 7
mov qword [rbp + 0x138], rsi
mov word [rbp + 0x128], si
mov r8d, 0x40
lea rdx, str._mainproc___Main_OnCommand_____user_clicked_Yes__exiting_program
lea rcx, [rbp + 0x128]
call fcn.14000dc20
nop
mov r8d, 5
lea rdx, [rbp + 0x128]
call fcn.140078560
jmp 0x140061b4d
cmp eax, 7
jne 0x140061b4d
lea rax, [rbp + 0xc8]
mov qword [rsp + 0x40], rax
mov qword [rbp + 0xe0], 7
mov qword [rbp + 0xd8], rsi
mov word [rbp + 0xc8], si
mov r8d, 0x43
lea rdx, str._mainproc___Main_OnCommand_____user_clicked_No__NOT_exiting_program
lea rcx, [rbp + 0xc8]
call fcn.14000dc20
nop
mov r8d, 5
lea rdx, [rbp + 0xc8]
call fcn.140078560
xor r15b, r15b
cmp qword [rbp + 0x188], 8
jb 0x140061b63
mov rcx, qword [rbp + 0x170]
call fcn.1401669a0
mov qword [rbp + 0x188], 7
mov qword [rbp + 0x180], rsi
mov word [rbp + 0x170], si
test r15b, r15b
je case.0x140061393.40007
mov rcx, r14
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rcx, qword [rbp + 0x2b0]
xor rcx, rsp
call fcn.140166980
lea r11, [rsp + 0x3c0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret