Function at 0x4698c0
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
sub rsp, 0x78
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
xor ebx, ebx
cmp dword [0x00527128], 0x237c
mov qword [rax + 0x18], rsi
mov rsi, rcx
jne 0x469262
cmp word [rcx + 0xd14], bx
je 0x469262
lea ebp, [rbx + 1]
jmp 0x469264
mov ebp, ebx
mov qword [rsp + 0x98], rdi
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x68], r13
lea rcx, str.UNavTray
xor edx, edx
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x58], r15
call qword [sym.imp.USER32.dll_FindWindowW]
lea rcx, [0x005271c8]
mov edx, 2
mov rdi, rax
call fcn.0040d6e0
lea rcx, [0x005271c8]
mov edx, 2
mov r14, rax
call fcn.0040d630
lea rcx, [0x005271c8]
mov edx, 3
mov qword [rsp + 0x48], rax
call fcn.0040d6e0
lea rcx, [0x005271c8]
mov edx, 3
mov r13, rax
call fcn.0040d630
mov r15d, ebx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x48]
mov dword [rsp + 0x38], ebx
test rax, rax
mov dword [rsp + 0x30], ebx
mov r12d, ebx
je 0x469327
mov rcx, qword [rax + 0x58]
mov edx, ebx
mov dword [rsp + 0x34], ebx
test rcx, rcx
je 0x469321
mov rax, qword [rcx]
lea r8, [rsp + 0x34]
mov edx, 0x3000133
call qword [rax + 0x18]
mov edx, dword [rsp + 0x34]
test edx, edx
sete r15b
test r14, r14
je 0x46935a
mov rcx, qword [r14 + 0x58]
mov eax, ebx
mov dword [rsp + 0x34], ebx
test rcx, rcx
je 0x46934f
mov rax, qword [rcx]
lea r8, [rsp + 0x34]
mov edx, 0x3000133
call qword [rax + 0x18]
mov eax, dword [rsp + 0x34]
mov ecx, ebx
test eax, eax
sete cl
mov dword [rsp + 0x38], ecx
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x469392
mov rcx, qword [rcx + 0x58]
mov eax, ebx
mov dword [rsp + 0x34], ebx
test rcx, rcx
je 0x469387
mov rax, qword [rcx]
lea r8, [rsp + 0x34]
mov edx, 0x3000133
call qword [rax + 0x18]
mov eax, dword [rsp + 0x34]
mov ecx, ebx
test eax, eax
sete cl
mov dword [rsp + 0x30], ecx
test r13, r13
je 0x4693c0
mov rcx, qword [r13 + 0x58]
mov eax, ebx
mov dword [rsp + 0x34], ebx
test rcx, rcx
je 0x4693ba
mov rax, qword [rcx]
lea r8, [rsp + 0x34]
mov edx, 0x3000133
call qword [rax + 0x18]
mov eax, dword [rsp + 0x34]
test eax, eax
sete r12b
mov eax, dword [rsi + 0xc]
test eax, eax
je 0x4693df
sub eax, 1
je 0x469408
sub eax, 0x10
je 0x469408
sub eax, 0x10
je 0x4693df
cmp eax, 0x10
jne 0x46955d
test ebp, ebp
je 0x469548
test rdi, rdi
je 0x46955d
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x46955d
test ebp, ebp
je 0x46949a
test rdi, rdi
jne 0x469481
lea rax, [0x004e8b88]
lea r8, [rsi + 0xd14]
lea r9, [0x004e7dfc]
lea rdx, str.open
xor ecx, ecx
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdi, rbx
nop
nop
test rdi, rdi
jne 0x469478
lea ecx, [rdi + 0x32]
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.UNavTray
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowW]
add ebx, 1
cmp ebx, 0xa
mov rdi, rax
jl 0x469450
test rdi, rdi
je 0x46955d
xor r9d, r9d
xor r8d, r8d
mov edx, 0x4d2
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x46955d
mov eax, dword [rsp + 0x38]
test eax, eax
jne 0x4694a7
test r12d, r12d
je 0x4694b6
test r15d, r15d
jne 0x4694bc
mov ecx, dword [rsp + 0x30]
test ecx, ecx
je 0x4694de
jmp 0x4694c0
mov ecx, dword [rsp + 0x30]
jmp 0x4694c0
mov ecx, dword [rsp + 0x30]
test r14, r14
jne 0x4694ca
test r13, r13
je 0x4694f6
mov r11, qword [rsp + 0x48]
test r11, r11
jne 0x4694ef
mov rdx, qword [rsp + 0x40]
test rdx, rdx
jne 0x469500
mov rdx, qword [rsi + 0xd8]
mov rcx, rsi
call fcn.00468350
jmp 0x46955d
mov rdx, qword [rsp + 0x40]
jmp 0x469500
mov rdx, qword [rsp + 0x40]
mov r11, qword [rsp + 0x48]
test r15d, r15d
jne 0x469509
test ecx, ecx
je 0x469512
test eax, eax
jne 0x469512
test r12d, r12d
je 0x469526
test r11, r11
jne 0x46951c
test rdx, rdx
je 0x469537
test r14, r14
jne 0x469537
test r13, r13
jne 0x469537
mov rdx, qword [rsi + 0xe8]
mov rcx, rsi
call fcn.00468350
jmp 0x46955d
mov rdx, qword [rsi + 0xe0]
mov rcx, rsi
call fcn.00468350
jmp 0x46955d
lea rdx, [rsi + 0x168]
mov ecx, 2
call qword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov dword [rsi + 0x40], ebx
mov r15, qword [rsp + 0x58]
mov r14, qword [rsp + 0x60]
mov r13, qword [rsp + 0x68]
mov r12, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x98]
mov rsi, qword [rsp + 0x90]
mov rbp, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x80]
add rsp, 0x78
ret
push rbx
sub rsp, 0x20
mov rax, qword [0x005271d0]
mov rbx, rcx
test rax, rax
je 0x4699dd
cmp qword [rax], 0
je 0x4699dd
cmp dword [rcx + 0x538], 0
je 0x4698f6
add rsp, 0x20
pop rbx
jmp 0x469230
cmp dword [rcx + 0x550], 0
jne 0x4699f6
cmp dword [rcx + 0x548], 0
mov dword [rcx + 0x3c], 0
je 0x469970
lea rcx, [0x005271c8]
mov edx, 2
call fcn.0040d630
test rax, rax
jne 0x469965
lea edx, [rax + 3]
lea rcx, [0x005271c8]
call fcn.0040d630
test rax, rax
jne 0x469965
lea edx, [rax + 2]
lea rcx, [0x005271c8]
call fcn.0040d6e0
test rax, rax
jne 0x469965
lea edx, [rax + 3]
lea rcx, [0x005271c8]
call fcn.0040d6e0
test rax, rax
je 0x469970
mov rcx, rax
call fcn.004080c0
mov dword [rbx + 0x3c], eax
cmp dword [rbx + 0x3c], 0
je 0x469990
test byte [rbx + 0xc], 0x20
jne 0x469990
mov rdx, qword [rbx + 0xc8]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.00468350
mov eax, dword [rbx + 0xc]
test eax, eax
je 0x4699ab
sub eax, 1
je 0x4699c9
sub eax, 0x10
je 0x4699b4
sub eax, 0x10
je 0x4699ab
cmp eax, 0x10
jne 0x4699f6
lea rdx, [rbx + 0x168]
jmp 0x4699e4
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.00468420
mov rdx, qword [rbx + 0xd0]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.00468350
lea rdx, [rcx + 0x168]
mov ecx, 2
call qword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov dword [rbx + 0x40], 0
add rsp, 0x20
pop rbx
ret