Function at 0x140075c10
Capabilities:
Create process on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x38
mov eax, dword [0x1402dded0]
xor edi, edi
mov rbx, rcx
add eax, 0xffffdc84
cmp eax, 1
ja 0x140075c42
lea ebp, [rdi + 1]
cmp word [rcx + 0x13e0], di
jne 0x140075c44
mov ebp, edi
lea rcx, str.UNavTray
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowW]
mov edx, 3
lea rcx, [0x1402de0c8]
lea r8d, [rdx - 2]
mov rsi, rax
call fcn.140039390
mov edx, 3
lea rcx, [0x1402de0c8]
lea r8d, [rdx - 2]
mov r14, rax
call fcn.1400392c0
xor r8d, r8d
lea rcx, [0x1402de0c8]
lea edx, [r8 + 3]
mov r13, rax
call fcn.140039390
xor r8d, r8d
lea rcx, [0x1402de0c8]
lea edx, [r8 + 3]
mov r15, rax
call fcn.1400392c0
mov r12d, edi
mov dword [rsp + 0x90], edi
mov qword [rsp + 0x98], rax
mov dword [rsp + 0x80], edi
test rax, rax
je 0x140075cff
mov rcx, qword [rax + 0x58]
mov edx, edi
mov dword [rsp + 0x88], edx
test rcx, rcx
je 0x140075cf9
mov rax, qword [rcx]
lea r8, [rsp + 0x88]
mov edx, 0x3000133
call qword [rax + 0x18]
mov edx, dword [rsp + 0x88]
test edx, edx
sete r12b
test r15, r15
je 0x140075d3e
mov rcx, qword [r15 + 0x58]
mov eax, edi
mov dword [rsp + 0x88], eax
test rcx, rcx
je 0x140075d30
mov rax, qword [rcx]
lea r8, [rsp + 0x88]
mov edx, 0x3000133
call qword [rax + 0x18]
mov eax, dword [rsp + 0x88]
mov ecx, edi
test eax, eax
sete cl
mov dword [rsp + 0x90], ecx
test r13, r13
je 0x140075d7d
mov rcx, qword [r13 + 0x58]
mov eax, edi
mov dword [rsp + 0x80], eax
test rcx, rcx
je 0x140075d6f
mov rax, qword [rcx]
lea r8, [rsp + 0x80]
mov edx, 0x3000133
call qword [rax + 0x18]
mov eax, dword [rsp + 0x80]
mov ecx, edi
test eax, eax
sete cl
mov dword [rsp + 0x80], ecx
test r14, r14
je 0x140075db4
mov rcx, qword [r14 + 0x58]
mov eax, edi
mov dword [rsp + 0x88], eax
test rcx, rcx
je 0x140075dae
mov rax, qword [rcx]
lea r8, [rsp + 0x88]
mov edx, 0x3000133
call qword [rax + 0x18]
mov eax, dword [rsp + 0x88]
test eax, eax
sete dil
mov eax, dword [rbx + 0xc]
and eax, 0xffffffbf
cmp eax, 0x31
ja case.0x140075ddc.2
lea rdx, [0x140000000]
movzx eax, byte [rdx + rax + 0x75fa4]
mov ecx, dword [rdx + rax*4 + 0x75f98]
add rcx, rdx
jmp rcx
test ebp, ebp
je 0x140075e03
test rsi, rsi
je 0x140075f87
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x140075f87
mov rax, qword [rbx]
mov r8d, dword [rbx + 0x408]
lea rdx, [rbx + 0x38]
mov rcx, rbx
call qword [rax + 0x108]
mov dword [rbx + 0x408], eax
jmp 0x140075f87
test ebp, ebp
je 0x140075e8c
test rsi, rsi
jne 0x140075e73
lea rax, [0x14017e008]
lea r8, [rbx + 0x13e0]
lea r9, [0x140165848]
lea rdx, str.open
xor ecx, ecx
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rcx, rbx
call fcn.140077100
mov rsi, rax
test rax, rax
je 0x140075f87
xor r9d, r9d
xor r8d, r8d
mov edx, 0x4d2
mov rcx, rsi
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x140075f87
mov eax, dword [rsp + 0x90]
test eax, eax
jne 0x140075e9b
test edi, edi
je 0x140075ead
mov ecx, dword [rsp + 0x80]
test r12d, r12d
jne 0x140075eb4
test ecx, ecx
je 0x140075ed0
jmp 0x140075eb4
mov ecx, dword [rsp + 0x80]
test r15, r15
jne 0x140075ebe
test r14, r14
je 0x140075ef9
mov rdx, qword [rsp + 0x98]
test rdx, rdx
jne 0x140075f01
test r13, r13
jne 0x140075f01
mov rax, qword [rbx]
mov r9d, dword [rbx + 0x408]
mov rdx, qword [rbx + 0xa58]
lea r8, [rbx + 0x38]
mov rcx, rbx
call qword [rax + 0x110]
mov dword [rbx + 0x408], eax
jmp 0x140075f87
mov rdx, qword [rsp + 0x98]
test r12d, r12d
jne 0x140075f0a
test ecx, ecx
je 0x140075f12
test eax, eax
jne 0x140075f12
test edi, edi
je 0x140075f26
test rdx, rdx
jne 0x140075f1c
test r13, r13
je 0x140075f4c
test r15, r15
jne 0x140075f4c
test r14, r14
jne 0x140075f4c
mov rax, qword [rbx]
mov r9d, dword [rbx + 0x408]
mov rdx, qword [rbx + 0xa68]
lea r8, [rbx + 0x38]
mov rcx, rbx
call qword [rax + 0x110]
mov dword [rbx + 0x408], eax
jmp 0x140075f87
mov rax, qword [rbx]
mov r9d, dword [rbx + 0x408]
mov rdx, qword [rbx + 0xa60]
lea r8, [rbx + 0x38]
mov rcx, rbx
call qword [rax + 0x110]
mov dword [rbx + 0x408], eax
jmp 0x140075f87
lea r8, str.CTrayIcon::ProcessOEMTrayIcon:_invalid_state____n
lea rcx, str.CTPTrayAction::ProcessOEMTrayIcon
xor edx, edx
call fcn.14011a490
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret