Function at 0x1400067a0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1bc0]
mov eax, 0x1cc0
call fcn.140008d40
sub rsp, rax
mov rax, qword [0x140044078]
xor rax, rsp
mov qword [rbp + 0x1bb0], rax
mov r15, r9
mov r14, r8
mov r13d, edx
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetShellWindow]
xor ecx, ecx
mov r12, rax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov edi, 1
mov dword [rsp + 0x34], eax
mov ecx, edi
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rsp + 0x30], eax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rsi, rax
test rax, rax
je 0x1400068a0
cmp rax, rbx
je 0x1400068a0
cmp rax, r12
lea r12d, [rdi + 1]
je 0x1400068a6
mov edx, r12d
mov rcx, rbx
call qword [sym.imp.USER32.dll_MonitorFromWindow]
mov edx, r12d
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.USER32.dll_MonitorFromWindow]
cmp rax, rbx
jne 0x1400068a6
lea rdx, [rsp + 0x38]
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [rsp + 0x40]
sub eax, dword [rsp + 0x38]
cmp eax, dword [rsp + 0x34]
jl 0x1400068a6
mov eax, dword [rsp + 0x44]
sub eax, dword [rsp + 0x3c]
cmp eax, dword [rsp + 0x30]
jl 0x1400068a6
mov rcx, qword [0x140046af0]
test rcx, rcx
je 0x140006bca
lea r9, str.Current_App_is_FullScreen_
lea r8, str.ToastShowingProcessMessage
call fcn.140005050
jmp 0x140006bca
mov r12d, 2
cmp r13d, 0x8003
jne 0x140006bca
mov r9d, r14d
mov dword [rsp + 0x20], r15d
lea r8, str.Message:_kAgtCmdShowToastOCNotification__wParam:__d__lParam:__d
mov edx, 0x400
lea rcx, [rbp + 0x13b0]
call fcn.1400052d0
mov rcx, qword [0x140046af0]
test rcx, rcx
je 0x1400068f2
lea r9, [rbp + 0x13b0]
lea r8, str.ToastShowingProcessMessage
call fcn.140005050
xor esi, esi
test r14d, r14d
jne 0x1400068fd
mov ebx, esi
jmp 0x140006912
cmp r14d, edi
jne 0x140006906
mov ebx, edi
jmp 0x140006912
mov ebx, dword [rsp + 0x30]
cmp r14d, 2
cmove ebx, r12d
test r15d, r15d
jne 0x14000691b
mov edi, esi
jmp 0x14000692c
cmp r15d, edi
je 0x14000692c
mov edi, dword [rsp + 0x30]
cmp r15d, 2
cmove edi, r12d
xor edx, edx
lea rcx, [rbp + 0x370]
mov r8d, 0x208
call fcn.14000a380
xor edx, edx
lea rcx, [rbp + 0x9a0]
mov r8d, 0x208
call fcn.14000a380
xor edx, edx
lea rcx, [rbp + 0x580]
mov r8d, 0x208
call fcn.14000a380
xor edx, edx
lea rcx, [rbp + 0x790]
mov r8d, 0x208
call fcn.14000a380
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x208
call fcn.14000a380
xor edx, edx
lea rcx, [rbp + 0x160]
mov r8d, 0x208
call fcn.14000a380
xor edx, edx
lea rcx, [rbp + 0xbb0]
mov r8d, 0x800
call fcn.14000a380
mov r8d, 0x104
lea rdx, [rbp + 0x370]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rbp + 0x370]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea r8, [rbp + 0x370]
lea rdx, str._sPSToastCreator.exe
lea rcx, [rbp + 0x9a0]
call fcn.140001760
lea r8, [rbp + 0x370]
lea rdx, str._simagesicons_appicon_toast.png
lea rcx, [rbp + 0x580]
call fcn.140001760
mov r9d, 0x104
lea r8, [rbp + 0x790]
mov edx, 0x7a
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadStringW]
test ebx, ebx
jne 0x140006a6c
test edi, edi
jne 0x140006a4c
mov r9d, 0x104
lea r8, [rsp + 0x50]
lea edx, [rbx + 0x72]
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadStringW]
lea edx, [rbx + 0x7e]
jmp 0x140006afc
cmp edi, 1
jne 0x140006a5e
lea r8, [rsp + 0x50]
lea edx, [rdi + 0x75]
jmp 0x140006b03
cmp edi, 2
jne 0x140006b11
lea edx, [rdi + 0x70]
jmp 0x140006ae4
cmp ebx, 1
jne 0x140006aa9
test edi, edi
jne 0x140006a90
mov r9d, 0x104
lea r8, [rsp + 0x50]
lea edx, [rbx + 0x70]
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadStringW]
lea edx, [rbx + 0x7d]
jmp 0x140006afc
cmp edi, 1
jne 0x140006a9f
lea r8, [rsp + 0x50]
lea edx, [rdi + 0x7a]
jmp 0x140006b03
cmp edi, 2
jne 0x140006b11
lea edx, [rdi + 0x6f]
jmp 0x140006ae4
cmp ebx, 2
jne 0x140006b11
test edi, edi
jne 0x140006acd
mov r9d, 0x104
lea r8, [rsp + 0x50]
lea edx, [rbx + 0x73]
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadStringW]
lea edx, [rbx + 0x7c]
jmp 0x140006afc
cmp edi, 1
jne 0x140006adc
lea r8, [rsp + 0x50]
lea edx, [rdi + 0x76]
jmp 0x140006b03
cmp edi, 2
jne 0x140006b11
lea edx, [rdi + 0x73]
mov r9d, 0x104
lea r8, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadStringW]
mov edx, 0x7d
lea r8, [rbp + 0x160]
mov r9d, 0x104
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadStringW]
movzx eax, word [0x14003e2b0]
lea r9, [rsp + 0x50]
cmp ax, word [rbp + 0x160]
lea r8, [rbp + 0x790]
lea rax, [rbp + 0x580]
lea rcx, [rbp + 0xbb0]
jne 0x140006b4e
lea rdx, str._toast_appid__Acer.NitroSense.Main__title___s__msg___s__iPath___s_
mov qword [rsp + 0x20], rax
call fcn.140006c00
jmp 0x140006b6b
mov qword [rsp + 0x28], rax
lea rdx, str._toast_appid__Acer.NitroSense.Main__title___s__msg___s__s__iPath___s_
lea rax, [rbp + 0x160]
mov qword [rsp + 0x20], rax
call fcn.140006c00
lea r9, [rbp + 0xbb0]
mov edx, 0x400
lea r8, str.Cmd_command:__s
lea rcx, [rbp + 0x13b0]
call fcn.1400052d0
mov rcx, qword [0x140046af0]
test rcx, rcx
je 0x140006ba9
lea r9, [rbp + 0x13b0]
lea r8, str.ToastShowingProcessMessage
call fcn.140005050
mov dword [rsp + 0x28], esi
lea r9, [rbp + 0xbb0]
lea r8, [rbp + 0x9a0]
mov qword [rsp + 0x20], rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rcx, qword [rbp + 0x1bb0]
xor rcx, rsp
call fcn.140008670
mov rbx, qword [rsp + 0x1d00]
add rsp, 0x1cc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret