Function at 0x140002440
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, edx
mov rdi, rcx
call fcn.140001d50
cmp ebx, 1
jne 0x1400023db
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140002440
cmp ebx, 0x20
jne 0x1400023f7
xor r8d, r8d
mov dl, 1
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140002b40
cmp ebx, 0x2e
jne 0x140002413
xor r8d, r8d
xor edx, edx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140002b40
cmp ebx, 0x30
jne 0x14000242f
mov r8b, 1
xor edx, edx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140002b40
mov eax, 0x80004005
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov r11, rsp
push rdi
push r14
push r15
sub rsp, 0x360
mov qword [r11 - 0x2b8], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [0x140047008]
xor rax, rsp
mov qword [rsp + 0x350], rax
mov rsi, rcx
xor eax, eax
mov qword [r11 - 0x250], rax
mov qword [r11 - 0x248], rax
mov qword [r11 - 0x240], rax
lea rcx, [r11 - 0x250]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
mov dword [rsp + 0x40], 0x80004005
lea rax, [rsp + 0x48]
mov qword [rsp + 0x60], rax
mov ecx, SafeArrayPutElement
call fcn.14000d6dc
mov rbx, rax
mov qword [rsp + 0x50], rax
xor edi, edi
test rax, rax
je 0x1400024fa
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], rdi
mov dword [rbx + 0x10], 1
lea rcx, str.HotKeys.LastHotKey
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x1400024fd
mov ecx, 0x8007000e
call fcn.14000e740
mov rbx, rdi
mov qword [rsp + 0x48], rbx
test rbx, rbx
jne 0x140002511
mov ecx, 0x8007000e
call fcn.14000e740
lea rax, [rsp + 0x48]
mov qword [rsp + 0x50], rax
mov r14, qword [rsi + 0x630]
test r14, r14
jne 0x140002532
mov ecx, 0x80004003
call fcn.14000e740
nop
mov rax, qword [r14]
lea r8, [rsp + 0x128]
mov rdx, qword [rbx]
mov rcx, r14
call qword [rax + SafeArrayPutElement]
mov ebx, eax
test eax, eax
jns 0x14000255e
lea r8, [0x14003d990]
mov rdx, r14
mov ecx, eax
call fcn.14000e770
nop
lea rcx, [rsp + 0x48]
call fcn.1400016a0
mov dword [rsp + 0x40], ebx
test ebx, ebx
js 0x140002afb
mov rax, qword [rsp + 0x130]
mov r14d, eax
shr r14d, 0x10
movsx ecx, ax
cmp ecx, 0x1a9
jg 0x1400028da
je 0x1400025e3
sub ecx, 0x131
je 0x1400025ae
cmp ecx, 0x6d
jne 0x140002afb
lea r8, str.powercfg.cpl
jmp 0x1400025b2
lea r8, [rsi + 0x12]
mov dword [rsp + 0x28], 1
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jg 0x140002afb
mov ebx, 0x80004005
mov dword [rsp + 0x40], ebx
jmp 0x140002afb
cmp qword [rsi + 0x638], 0
je 0x140002afb
mov eax, 0xff
and r14w, ax
mov qword [rsp + 0x120], 7
mov qword [rsp + 0x118], rdi
mov word [rsp + 0x108], di
mov r8d, 0x11
lea rdx, str.QLBController.ico
lea rcx, [rsp + 0x108]
call fcn.140005780
mov r9d, 0x6b
lea r8, [rsp + 0x108]
lea rdx, [rsp + 0xe8]
mov rcx, rsi
call fcn.140003020
nop
mov r9d, 0x104
lea r8, [rsp + 0x140]
mov rcx, qword [rsi + 8]
cmp r14w, 1
mov edx, 0x72
je 0x140002672
mov edx, 0x73
call qword [sym.imp.USER32.dll_LoadStringW]
lea rax, [rsp + 0x48]
mov qword [rsp + 0xc8], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0xd0], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0xd8], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0xe0], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x78], rax
mov ecx, SafeArrayPutElement
call fcn.14000d6dc
mov rbx, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x140002700
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], rdi
mov dword [rbx + 0x10], 1
lea rcx, [0x14003df20]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x140002703
mov ecx, 0x8007000e
call fcn.14000e740
mov rbx, rdi
mov qword [rsp + 0x48], rbx
test rbx, rbx
jne 0x140002718
mov ecx, 0x8007000e
call fcn.14000e740
nop
mov ecx, SafeArrayPutElement
call fcn.14000d6dc
mov rbx, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x140002762
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], rdi
mov dword [rbx + 0x10], 1
lea rcx, [0x14003df20]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x140002765
mov ecx, 0x8007000e
call fcn.14000e740
mov rbx, rdi
mov qword [rsp + 0x68], rbx
test rbx, rbx
jne 0x14000277a
mov ecx, 0x8007000e
call fcn.14000e740
nop
mov ecx, SafeArrayPutElement
call fcn.14000d6dc
mov rbx, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x1400027c5
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], rdi
mov dword [rbx + 0x10], 1
lea rcx, [rsp + 0x140]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x1400027c8
mov ecx, 0x8007000e
call fcn.14000e740
mov rbx, rdi
mov qword [rsp + 0x70], rbx
test rbx, rbx
jne 0x1400027dd
mov ecx, 0x8007000e
call fcn.14000e740
nop
mov ecx, SafeArrayPutElement
call fcn.14000d6dc
mov rbx, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x140002827
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], rdi
mov dword [rbx + 0x10], 1
lea rcx, str.Ambient_Light_Sensor
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x14000282a
mov ecx, 0x8007000e
call fcn.14000e740
mov rbx, rdi
mov qword [rsp + 0x50], rbx
test rbx, rbx
jne 0x14000283f
mov ecx, 0x8007000e
call fcn.14000e740
nop
lea rdx, [rsp + 0xe8]
cmp qword [rsp + 0x100], 8
cmovae rdx, qword [rsp + 0xe8]
lea rcx, [rsp + 0x60]
call fcn.1400015f0
nop
mov rcx, qword [rsi + 0x638]
test rcx, rcx
jne 0x14000287b
mov ecx, 0x80004003
call fcn.14000e740
nop
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x30], rdx
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x50]
mov r8, rax
lea rdx, [0x140049c04]
call fcn.140001800
mov ebx, eax
mov dword [rsp + 0x40], eax
mov r8, qword [rsp + 0x100]
cmp r8, 8
jb 0x140002afb
mov rdx, qword [rsp + 0xe8]
lea rcx, [rsp + 0xe8]
jmp 0x140002af2
cmp ecx, 0x1b6
jl 0x140002afb
cmp ecx, 0x1b7
jle 0x140002931
cmp ecx, 0x270
jne 0x140002afb
mov dword [rsp + 0x48], edi
lea rdx, [rsp + 0x48]
call fcn.140001370
mov ebx, eax
mov dword [rsp + 0x40], eax
test eax, eax
js 0x140002afb
cmp dword [rsp + 0x48], 1
setne dil
mov edx, edi
call fcn.140001240
mov ebx, eax
mov dword [rsp + 0x40], eax
jmp 0x140002afb
call fcn.140004330
test eax, eax
jne 0x140002afb
cmp qword [rsi + 0x638], 0
je 0x140002afb
mov qword [rsp + 0x98], 7
mov qword [rsp + 0x90], rdi
mov word [rsp + 0x80], di
lea r8d, [rax + 0x12]
lea rdx, str.BrightnessDown.ico
lea rcx, [rsp + 0x80]
call fcn.140005780
mov r9d, 0x82
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0x108]
mov rcx, rsi
call fcn.140003020
nop
mov qword [rsp + 0xb8], 7
mov qword [rsp + 0xb0], rdi
mov word [rsp + 0xa0], di
mov r8d, 0x10
lea rdx, str.BrightnessUp.ico
lea rcx, [rsp + 0xa0]
call fcn.140005780
mov r9d, 0x83
lea r8, [rsp + 0xa0]
lea rdx, [rsp + 0xe8]
mov rcx, rsi
call fcn.140003020
nop
lea rax, [rsp + 0x60]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x78], rax
lea rdx, [rsp + 0xe8]
cmp qword [rsp + 0x100], 8
cmovae rdx, qword [rsp + 0xe8]
lea rcx, [rsp + 0x60]
call fcn.1400015f0
mov r15, rax
lea rdx, [rsp + 0x108]
cmp qword [rsp + 0x120], 8
cmovae rdx, qword [rsp + 0x108]
lea rcx, [rsp + 0x50]
call fcn.1400015f0
mov r14, rax
mov rbx, qword [rsi + 0x638]
test rbx, rbx
jne 0x140002a6c
mov ecx, 0x80004003
call fcn.14000e740
call fcn.1400033a0
nop
mov qword [rsp + 0x20], r15
mov r9, r14
mov r8d, eax
lea rdx, [0x140049c08]
mov rcx, rbx
call fcn.140001920
mov ebx, eax
mov dword [rsp + 0x40], eax
mov r8, qword [rsp + 0x100]
cmp r8, 8
jb 0x140002ab8
inc r8
mov rdx, qword [rsp + 0xe8]
lea rcx, [rsp + 0xe8]
call fcn.140005670
mov qword [rsp + 0x100], 7
mov qword [rsp + 0xf8], rdi
mov word [rsp + 0xe8], di
mov r8, qword [rsp + 0x120]
cmp r8, 8
jb 0x140002afb
mov rdx, qword [rsp + 0x108]
lea rcx, [rsp + 0x108]
inc r8
call fcn.140005670
nop
jmp 0x140002b01
lea rcx, [rsp + 0x128]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, ebx
mov rcx, qword [rsp + 0x350]
xor rcx, rsp
call fcn.14000d6b0
lea r11, [rsp + 0x360]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x100
mov qword [rbp - 0x29], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x140047008]
xor rax, rsp
mov qword [rbp + 0x37], rax
movzx esi, r8b
movzx ebx, dl
mov r14, rcx
mov ecx, 4
mov rax, qword gs:[0x58]
mov r9, qword [rax]
xor r15d, r15d
mov eax, dword [rcx + r9]
cmp dword [0x140049e70], eax
jle 0x140002bd3
lea rcx, [0x140049e70]
call fcn.14000dbc4
cmp dword [0x140049e70], 0xffffffff
jne 0x140002bd3
call fcn.1400019c0
mov edx, r15d
test al, al
setne dl
mov dword [0x140049e74], edx
lea rcx, [0x140049e70]
call fcn.14000db64
cmp dword [0x140049e74], r15d
je 0x140002be3
xor eax, eax
jmp 0x140002fea
mov dword [rbp + 0xf], r15d
lea rdx, [rbp + 0xf]
call fcn.140003750
mov edi, eax
cmp eax, 0x64
jbe 0x140002bfe
mov edi, 0x64
jmp 0x140002c0a
add eax, 2
add edi, 0xfffffffe
test sil, sil
cmovne edi, eax
mov qword [rbp + 7], 7
mov qword [rbp - 1], r15
mov word [rbp - 0x11], r15w
mov qword [rbp + 0x2f], 7
mov qword [rbp + 0x27], r15
mov word [rbp + 0x17], r15w
cmp dword [rbp + 0xf], 0
je 0x140002cf5
test bl, bl
je 0x140002cf5
mov qword [rbp - 0x61], 7
mov qword [rbp - 0x69], r15
mov word [rbp - 0x79], r15w
mov r8d, 0xe
lea rdx, str.VolumeMute.ico
lea rcx, [rbp - 0x79]
call fcn.140005780
mov r9d, 0x86
lea r8, [rbp - 0x79]
lea rdx, [rbp - 0x59]
mov rcx, r14
call fcn.140003020
mov rbx, rax
lea rax, [rbp - 0x11]
cmp rax, rbx
je 0x140002cbf
mov r8, qword [rbp + 7]
cmp r8, 8
jb 0x140002ca1
inc r8
mov rdx, qword [rbp - 0x11]
lea rcx, [rbp - 0x11]
call fcn.140005670
mov qword [rbp + 7], 7
mov qword [rbp - 1], r15
mov word [rbp - 0x11], r15w
mov rdx, rbx
lea rcx, [rbp - 0x11]
call fcn.140005010
nop
mov r8, qword [rbp - 0x41]
cmp r8, 8
jb 0x140002cd9
inc r8
mov rdx, qword [rbp - 0x59]
lea rcx, [rbp - 0x59]
call fcn.140005670
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp - 0x11]
lea rcx, [rbp + 0x17]
call fcn.140005340
mov edi, r15d
jmp 0x140002e2b
mov qword [rbp - 0x61], 7
mov qword [rbp - 0x69], r15
mov word [rbp - 0x79], r15w
mov r8d, 0xd
lea rdx, str.VolumeLow.ico
lea rcx, [rbp - 0x79]
call fcn.140005780
mov r9d, 0x85
lea r8, [rbp - 0x79]
lea rdx, [rbp - 0x59]
mov rcx, r14
call fcn.140003020
mov rbx, rax
lea rax, [rbp - 0x11]
cmp rax, rbx
je 0x140002d76
mov r8, qword [rbp + 7]
cmp r8, 8
jb 0x140002d58
inc r8
mov rdx, qword [rbp - 0x11]
lea rcx, [rbp - 0x11]
call fcn.140005670
mov qword [rbp + 7], 7
mov qword [rbp - 1], r15
mov word [rbp - 0x11], r15w
mov rdx, rbx
lea rcx, [rbp - 0x11]
call fcn.140005010
nop
mov r8, qword [rbp - 0x41]
cmp r8, 8
jb 0x140002d90
inc r8
mov rdx, qword [rbp - 0x59]
lea rcx, [rbp - 0x59]
call fcn.140005670
mov qword [rbp - 0x61], 7
mov qword [rbp - 0x69], r15
mov word [rbp - 0x79], r15w
mov r8d, 0xe
lea rdx, str.VolumeHigh.ico
lea rcx, [rbp - 0x79]
call fcn.140005780
mov r9d, 0x84
lea r8, [rbp - 0x79]
lea rdx, [rbp - 0x59]
mov rcx, r14
call fcn.140003020
mov rbx, rax
lea rax, [rbp + 0x17]
cmp rax, rbx
je 0x140002e11
mov r8, qword [rbp + 0x2f]
cmp r8, 8
jb 0x140002df3
inc r8
mov rdx, qword [rbp + 0x17]
lea rcx, [rbp + 0x17]
call fcn.140005670
mov qword [rbp + 0x2f], 7
mov qword [rbp + 0x27], r15
mov word [rbp + 0x17], r15w
mov rdx, rbx
lea rcx, [rbp + 0x17]
call fcn.140005010
nop
mov r8, qword [rbp - 0x41]
cmp r8, 8
jb 0x140002e2b
inc r8
mov rdx, qword [rbp - 0x59]
lea rcx, [rbp - 0x59]
call fcn.140005670
lea rax, [rsp + 0x38]
mov qword [rbp - 0x21], rax
lea rax, [rsp + 0x30]
mov qword [rbp - 0x19], rax
lea rsi, [rbp + 0x17]
cmp qword [rbp + 0x2f], 8
cmovae rsi, qword [rbp + 0x17]
mov ecx, SafeArrayPutElement
call fcn.14000d6dc
mov rbx, rax
mov qword [rbp - 0x39], rax
test rax, rax
je 0x140002e96
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r15
mov dword [rbx + 0x10], 1
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x140002e99
test rsi, rsi
je 0x140002e99
mov ecx, 0x8007000e
call fcn.14000e740
int3
mov rbx, r15
mov qword [rsp + 0x38], rbx
test rbx, rbx
jne 0x140002eae
mov ecx, 0x8007000e
call fcn.14000e740
int3
lea rax, [rsp + 0x38]
mov qword [rbp - 0x39], rax
lea rsi, [rbp - 0x11]
cmp qword [rbp + 7], 8
cmovae rsi, qword [rbp - 0x11]
mov ecx, SafeArrayPutElement
call fcn.14000d6dc
mov rbx, rax
mov qword [rbp - 0x31], rax
test rax, rax
je 0x140002f10
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r15
mov dword [rbx + 0x10], 1
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x140002f13
test rsi, rsi
je 0x140002f13
mov ecx, 0x8007000e
call fcn.14000e740
int3
mov rbx, r15
mov qword [rsp + 0x30], rbx
test rbx, rbx
jne 0x140002f28
mov ecx, 0x8007000e
call fcn.14000e740
int3
lea rax, [rsp + 0x30]
mov qword [rbp - 0x31], rax
mov rsi, qword [r14 + 0x638]
test rsi, rsi
jne 0x140002f48
mov ecx, 0x80004003
call fcn.14000e740
nop
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x140002f57
mov rcx, qword [rax]
jmp 0x140002f5a
mov rcx, r15
mov rax, qword [rsi]
mov qword [rsp + 0x20], rcx
mov r9, qword [rbx]
mov r8d, edi
lea rdx, [0x140049c00]
mov rcx, rsi
call qword [rax + 0x20]
mov ebx, eax
test eax, eax
jns 0x140002f8d
lea r8, [0x14003e0b8]
mov rdx, rsi
mov ecx, eax
call fcn.14000e770
nop
lea rcx, [rsp + 0x30]
call fcn.1400016a0
nop
lea rcx, [rsp + 0x38]
call fcn.1400016a0
nop
mov r8, qword [rbp + 0x2f]
cmp r8, 8
jb 0x140002fbd
inc r8
mov rdx, qword [rbp + 0x17]
lea rcx, [rbp + 0x17]
call fcn.140005670
mov qword [rbp + 0x2f], 7
mov qword [rbp + 0x27], r15
mov word [rbp + 0x17], r15w
mov r8, qword [rbp + 7]
cmp r8, 8
jb 0x140002fe8
inc r8
mov rdx, qword [rbp - 0x11]
lea rcx, [rbp - 0x11]
call fcn.140005670
mov eax, ebx
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.14000d6b0
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret