Function at 0x14001bf34
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x2d0
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov rax, qword [0x140051040]
xor rax, rsp
mov qword [rsp + 0x2c0], rax
mov r13, rdx
mov rsi, rcx
call qword [sym.imp.USER32.dll_CreatePopupMenu]
mov rbp, rax
mov ecx, 0x1a
call fcn.140014f98
mov r9, rax
xor r8d, r8d
mov edx, 0x403
mov rcx, rbp
call qword [sym.imp.USER32.dll_AppendMenuW]
xor r9d, r9d
xor r8d, r8d
mov r14d, 0xc00
mov edx, r14d
mov rcx, rbp
call qword [sym.imp.USER32.dll_AppendMenuW]
mov ecx, 0x1b
call fcn.140014f98
mov r9, rax
mov eax, dword [0x1400b3d9c]
neg eax
sbb edx, edx
and edx, 3
mov eax, dword [0x140050e04]
neg eax
sbb ecx, ecx
mov edi, 8
and ecx, edi
or edx, ecx
bts edx, 0xa
lea r8d, [rdi - 6]
mov rcx, rbp
call qword [sym.imp.USER32.dll_AppendMenuW]
lea ecx, [rdi + 0x18]
call fcn.140014f98
mov r9, rax
mov eax, dword [0x1400b3d9c]
neg eax
sbb edx, edx
and edx, edi
bts edx, 0xa
lea r8d, [rdi - 2]
mov rcx, rbp
call qword [sym.imp.USER32.dll_AppendMenuW]
xor r9d, r9d
xor r8d, r8d
mov edx, r14d
mov rcx, rbp
call qword [sym.imp.USER32.dll_AppendMenuW]
lea ecx, [rdi + 0x14]
call fcn.140014f98
mov r9, rax
mov eax, dword [0x1400b3d98]
neg eax
sbb edx, edx
and edx, 3
mov eax, dword [0x1400b3d84]
neg eax
sbb ecx, ecx
and ecx, edi
or edx, ecx
bts edx, 0xa
lea r8d, [rdi - 5]
mov rcx, rbp
call qword [sym.imp.USER32.dll_AppendMenuW]
lea ecx, [rdi + 0x15]
call fcn.140014f98
mov r9, rax
mov eax, dword [0x1400b3d98]
neg eax
sbb edx, edx
and edx, edi
bts edx, 0xa
lea r8d, [rdi - 4]
mov rcx, rbp
call qword [sym.imp.USER32.dll_AppendMenuW]
lea ecx, [rdi + 0xd]
call fcn.140014f98
mov r9, rax
mov eax, dword [0x14006db34]
neg eax
sbb edx, edx
and edx, edi
bts edx, 0xa
mov r8, rdi
mov rcx, rbp
call qword [sym.imp.USER32.dll_AppendMenuW]
lea ecx, [rdi + 0x49]
call fcn.140014f98
mov r9, rax
mov eax, dword [0x1400b3da0]
neg eax
sbb edx, edx
and edx, edi
bts edx, 0xa
lea r8d, [rdi + 1]
mov rcx, rbp
call qword [sym.imp.USER32.dll_AppendMenuW]
lea ecx, [rdi + 0x3c]
call fcn.140014f98
mov r9, rax
mov edx, 0x400
lea r8d, [rdi + 2]
mov rcx, rbp
call qword [sym.imp.USER32.dll_AppendMenuW]
call qword [sym.imp.USER32.dll_CreatePopupMenu]
mov rbx, rax
lea ecx, [rdi + 0x1a]
call fcn.140014f98
mov r9, rax
mov r8d, ebx
mov r12d, 0x410
mov edx, r12d
mov rcx, rbp
call qword [sym.imp.USER32.dll_AppendMenuW]
mov edx, dword [0x1400b3d80]
lea rcx, str.topmost
call fcn.1400152a8
mov dword [0x1400b3d80], eax
lea ecx, [rdi + 0x17]
call fcn.140014f98
mov r9, rax
mov eax, dword [0x1400b3d80]
neg eax
sbb edx, edx
and edx, edi
bts edx, 0xa
mov r8d, 0x2710
mov rcx, rbp
call qword [sym.imp.USER32.dll_AppendMenuW]
lea ecx, [rdi + 0x1b]
call fcn.140014f98
mov r9, rax
mov eax, dword [0x140050e08]
neg eax
sbb edx, edx
and edx, edi
bts edx, 0xa
lea r8d, [rdi + 3]
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
lea ecx, [rdi + 0x1c]
call fcn.140014f98
mov r9, rax
mov eax, dword [0x1400b3da4]
neg eax
sbb edx, edx
and edx, edi
bts edx, 0xa
lea r8d, [rdi + 4]
mov rcx, rbx
call qword [sym.imp.USER32.dll_AppendMenuW]
lea ecx, [rdi + 0x52]
call fcn.140014f98
mov r9, rax
lea edx, [r12 - 0x10]
lea r8d, [rdi + 5]
mov rcx, rbp
call qword [sym.imp.USER32.dll_AppendMenuW]
call qword [sym.imp.USER32.dll_CreatePopupMenu]
mov rdi, rax
mov rdx, qword [0x140047568]
lea rcx, [rsp + 0x40]
call fcn.1400052d4
mov r8d, edi
mov r9, qword [rax]
mov edx, r12d
mov rcx, rbp
call qword [sym.imp.USER32.dll_AppendMenuW]
lea rcx, [rsp + 0x40]
call fcn.140004268
lea rdx, str..exe_..
lea rcx, [rsp + 0x50]
call fcn.140004c38
mov rbx, rax
mov rdx, qword [0x140047568]
lea rcx, [rsp + 0x48]
call fcn.1400052d4
nop
mov r8, rbx
mov rdx, qword [rax]
lea rcx, [rsp + 0x40]
call fcn.1400111b4
mov r9, qword [rax]
mov r8d, 0xabe0
mov r12d, 0x400
mov edx, r12d
mov rcx, rdi
call qword [sym.imp.USER32.dll_AppendMenuW]
lea rcx, [rsp + 0x40]
call fcn.140004268
nop
lea rcx, [rsp + 0x48]
call fcn.140004268
nop
lea rcx, [rsp + 0x50]
call fcn.140004268
lea rdx, str..ini_..
lea rcx, [rsp + 0x40]
call fcn.140004c38
mov rbx, rax
mov rdx, qword [0x140047568]
lea rcx, [rsp + 0x48]
call fcn.1400052d4
nop
mov r8, rbx
mov rdx, qword [rax]
lea rcx, [rsp + 0x50]
call fcn.1400111b4
mov r9, qword [rax]
mov r8d, 0xabe1
mov edx, r12d
mov rcx, rdi
call qword [sym.imp.USER32.dll_AppendMenuW]
lea rcx, [rsp + 0x50]
call fcn.140004268
nop
lea rcx, [rsp + 0x48]
call fcn.140004268
nop
lea rcx, [rsp + 0x40]
call fcn.140004268
lea rdx, str..ini
lea rcx, [rsp + 0x40]
call fcn.140004c38
mov rbx, rax
mov rdx, qword [0x140047568]
lea rcx, [rsp + 0x48]
call fcn.1400052d4
nop
mov r8, rbx
mov rdx, qword [rax]
lea rcx, [rsp + 0x50]
call fcn.1400111b4
mov r9, qword [rax]
mov r8d, 0xabe2
mov edx, r12d
mov rcx, rdi
call qword [sym.imp.USER32.dll_AppendMenuW]
lea rcx, [rsp + 0x50]
call fcn.140004268
nop
lea rcx, [rsp + 0x48]
call fcn.140004268
nop
lea rcx, [rsp + 0x40]
call fcn.140004268
xor r9d, r9d
xor r8d, r8d
mov edx, r14d
mov rcx, rbp
call qword [sym.imp.USER32.dll_AppendMenuW]
mov rdx, qword [0x140047568]
lea rcx, [rsp + 0x60]
call fcn.1400052d4
mov rdi, rax
lea rdx, [0x14003b824]
lea rcx, [rsp + 0x70]
call fcn.140004c38
mov rbx, rax
mov ecx, 0xc9
call fcn.140014f98
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1400052d4
nop
mov r8, rbx
mov rdx, qword [rax]
lea rcx, [rsp + 0x48]
call fcn.1400111b4
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140004000
mov r9, qword [rax]
mov edi, 0xabe3
mov r8, rdi
mov edx, r12d
mov rcx, rbp
call qword [sym.imp.USER32.dll_AppendMenuW]
lea rcx, [rsp + 0x50]
call fcn.140004268
nop
lea rcx, [rsp + 0x48]
call fcn.140004268
nop
lea rcx, [rsp + 0x40]
call fcn.140004268
nop
lea rcx, [rsp + 0x70]
call fcn.140004268
nop
lea rcx, [rsp + 0x60]
call fcn.140004268
mov ecx, 0xca
call fcn.140014f98
mov r9, rax
lea r8d, [rdi + 1]
mov edx, r12d
mov rcx, rbp
call qword [sym.imp.USER32.dll_AppendMenuW]
xor edx, edx
mov ecx, 0x10f
call fcn.140017a50
mov rcx, rax
call fcn.140017b20
mov r9, rax
xor ebx, ebx
mov qword [rsp + 0x20], rbx
xor r8d, r8d
mov edx, edi
mov rcx, rbp
call qword [sym.imp.USER32.dll_SetMenuItemBitmaps]
xor edx, edx
lea ecx, [rbx + 0xe]
call fcn.140017a50
mov rcx, rax
call fcn.140017b20
mov r9, rax
mov qword [rsp + 0x20], rbx
xor r8d, r8d
lea edx, [rdi + 1]
mov rcx, rbp
call qword [sym.imp.USER32.dll_SetMenuItemBitmaps]
call fcn.14001be90
mov edi, 0xd809
cmp al, bl
jne 0x14001c4e3
xor r9d, r9d
xor r8d, r8d
mov edx, r14d
mov rcx, rbp
call qword [sym.imp.USER32.dll_AppendMenuW]
lea ecx, [rbx + 0x25]
call fcn.140014f98
mov r9, rax
mov r8, rdi
mov edx, r12d
mov rcx, rbp
call qword [sym.imp.USER32.dll_AppendMenuW]
xor r9d, r9d
xor r8d, r8d
mov edx, r14d
mov rcx, rbp
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r11d, dword [0x140052e0c]
neg r11d
sbb r8d, r8d
not r8d
and r8d, 8
mov edx, edi
mov rcx, rbp
call qword [sym.imp.USER32.dll_CheckMenuItem]
mov ecx, 0x21
call fcn.140014f98
mov r9, rax
mov r8d, 7
mov edx, r12d
mov rcx, rbp
call qword [sym.imp.USER32.dll_AppendMenuW]
xor r9d, r9d
xor r8d, r8d
mov edx, r14d
mov rcx, rbp
call qword [sym.imp.USER32.dll_AppendMenuW]
mov ecx, 0x1a
call fcn.140014f98
mov r9, rax
xor r8d, r8d
mov edi, 0x403
mov edx, edi
mov rcx, rbp
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r12, qword [rsi + 0x45838]
mov r14d, 0x1e61
mov r8d, r14d
mov rdx, r12
lea rcx, [rsp + 0x60]
call fcn.140015b74
movdqu xmm0, xmmword [rax]
movdqu xmmword [rsp + 0x60], xmm0
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x58], eax
mov rax, qword [rsp + 0x68]
shr rax, 0x20
mov dword [rsp + 0x5c], eax
lea rdx, [rsp + 0x58]
mov rcx, r12
call qword [sym.imp.USER32.dll_ClientToScreen]
mov r9d, 1
mov r8, r14
mov edx, edi
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageW]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], ebx
mov r9d, dword [rsp + 0x5c]
mov r8d, dword [rsp + 0x58]
mov edx, 0x100
mov rcx, rbp
call qword [sym.imp.USER32.dll_TrackPopupMenu]
mov edi, eax
xor r9d, r9d
mov r8, r14
mov edx, 0x403
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageW]
cmp edi, ebx
je 0x14001c9a4
cmp edi, 2
jne 0x14001c5fd
cmp dword [0x140050e04], ebx
sete bl
mov dword [0x140050e04], ebx
mov edx, ebx
lea rcx, str.tray_if_close
call fcn.140015288
jmp 0x14001c9a4
cmp edi, 3
jne 0x14001c624
cmp dword [0x1400b3d84], ebx
sete bl
mov dword [0x1400b3d84], ebx
mov edx, ebx
lea rcx, str.start_tray
call fcn.140015288
jmp 0x14001c9a4
cmp edi, 4
jne 0x14001c64b
cmp dword [0x1400b3d98], ebx
sete bl
mov dword [0x1400b3d98], ebx
mov edx, ebx
lea rcx, str.start_hiden
call fcn.140015288
jmp 0x14001c9a4
mov ebp, 5
cmp edi, ebp
jne 0x14001c671
mov edx, ebx
cmp dword [0x140050e00], ebx
sete dl
mov dword [0x140050e00], edx
lea rcx, str.tray_if_minimize
call fcn.140015288
cmp edi, 6
jne 0x14001c698
cmp dword [0x1400b3d9c], ebx
sete bl
mov dword [0x1400b3d9c], ebx
mov edx, ebx
lea rcx, str.hide_if_close
call fcn.140015288
jmp 0x14001c9a4
cmp edi, 7
jne 0x14001c6aa
mov rcx, rsi
call fcn.140018288
jmp 0x14001c9a4
cmp edi, 8
jne 0x14001c6b9
call fcn.140015018
jmp 0x14001c9a4
cmp edi, 9
jne 0x14001c6eb
cmp dword [0x1400b3da0], ebx
sete bl
mov dword [0x1400b3da0], ebx
mov edx, ebx
lea rcx, str.show_control_menu
call fcn.140015288
mov rdx, r13
mov rcx, rsi
call fcn.140018490
jmp 0x14001c9a4
cmp edi, 0xa
jne 0x14001c73f
lea rcx, [rsp + 0x80]
call fcn.14000682c
nop
xor r9d, r9d
xor r8d, r8d
lea edx, [rdi + 0x27]
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageW]
mov qword [rsp + 0x98], rax
mov rdx, qword [rsi + 0x45868]
lea rcx, [rsp + 0x80]
call fcn.1400070d4
nop
lea rcx, [rsp + 0x80]
call fcn.140006960
jmp 0x14001c9a4
cmp edi, 0xb
jne 0x14001c766
cmp dword [0x140050e08], ebx
sete bl
mov dword [0x140050e08], ebx
mov edx, ebx
lea rcx, str.hide_if_run
call fcn.140015288
jmp 0x14001c9a4
cmp edi, 0xc
jne 0x14001c78d
cmp dword [0x1400b3da4], ebx
sete bl
mov dword [0x1400b3da4], ebx
mov edx, ebx
lea rcx, str.hide_if_run_favorit
call fcn.140015288
jmp 0x14001c9a4
cmp edi, 0xd
jne 0x14001c79f
mov rcx, rsi
call fcn.140019dc4
jmp 0x14001c9a4
cmp edi, 0x2710
jne 0x14001c824
mov edx, ebx
cmp dword [0x1400b3d80], ebx
sete dl
mov dword [0x1400b3d80], edx
lea rcx, str.topmost
call fcn.140015288
cmp dword [0x1400b3d80], ebx
je 0x14001c7f8
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
or rdx, 0xffffffffffffffff
mov rcx, qword [rsi + 0x45868]
call qword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x14001c9a4
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
lea rdx, [r9 - 2]
mov rcx, qword [rsi + 0x45868]
call qword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x14001c9a4
cmp edi, 0xabe0
jne 0x14001c865
lea rcx, [rsp + 0x40]
call fcn.140015edc
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rbx
xor r9d, r9d
mov r8, qword [rsp + 0x40]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rsp + 0x40]
call fcn.140004268
jmp 0x14001c9a4
cmp edi, 0xabe1
jne 0x14001c8ba
lea rdx, [0x14006d330]
lea rcx, [rsp + 0x60]
call fcn.1400052d4
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1400192ec
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rbx
xor r9d, r9d
mov r8, qword [rsp + 0x40]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rsp + 0x40]
call fcn.140004268
jmp 0x14001c9a4
cmp edi, 0xabe2
jne 0x14001c8e9
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, [0x14006d330]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x14001c9a4
cmp edi, 0xabe3
jne 0x14001c8fd
mov rcx, qword [0x1400b3d90]
call fcn.14001b540
cmp edi, 0xabe4
jne 0x14001c916
mov rcx, qword [rsi + 0x45868]
call fcn.140013fc8
jmp 0x14001c9a4
cmp edi, 0xd809
jne 0x14001c9a4
mov edx, ebx
cmp dword [0x140052e0c], ebx
sete dl
mov dword [0x140052e0c], edx
lea rcx, str.disable_dark_theme
call fcn.140015288
mov r8d, 0x104
lea rdx, [rsp + 0xb0]
mov rcx, qword [0x14006c9c0]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x60]
call fcn.1400052d4
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, [rsp + 0xb0]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, 0xfefe
call qword [sym.imp.USER32.dll_PostQuitMessage]
lea rcx, [rsp + 0x60]
call fcn.140004268
mov rcx, qword [rsp + 0x2c0]
xor rcx, rsp
call fcn.140021e20
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret