Function at 0x140015dd0
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x1060]
mov eax, 0x1160
call fcn.14001a520
sub rsp, rax
mov rax, qword [0x140048360]
xor rax, rsp
mov qword [rbp + 0x1050], rax
cmp qword [rcx + 0x68], 0
mov rdi, rcx
mov esi, 0x80004005
je 0x1400160bb
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
xor r14d, r14d
mov ebx, eax
mov dword [rsp + 0x50], r14d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, [rsp + 0x50]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
cmp ebx, dword [rsp + 0x50]
jne 0x1400160bb
mov rbx, qword [rdi + 0x68]
mov dword [rsp + 0x50], r14d
mov dword [rsp + 0x54], r14d
test rbx, rbx
je 0x1400160e4
mov rax, qword [rbx]
lea rcx, [rsp + 0x50]
lea r9, [rsp + 0x54]
mov qword [rsp + 0x20], rcx
lea r8d, [r14 + 4]
mov edx, 0x8b
mov rcx, rbx
call qword [rax + 0x38]
mov esi, eax
test eax, eax
jns 0x140015e93
lea r8, [0x140034118]
mov rdx, rbx
mov ecx, eax
call fcn.140016fc0
test esi, esi
js 0x1400160bb
test dword [rsp + 0x50], 0x800
je 0x140015ebd
mov rcx, qword [rdi + 0x68]
test rcx, rcx
je 0x1400160ef
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 0x378]
test byte [rsp + 0x50], 4
je 0x140015edc
mov rcx, qword [rdi + 0x68]
test rcx, rcx
je 0x1400160fa
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 0x4d0]
test dword [rsp + 0x50], 0x80000
je 0x140015f83
mov rcx, qword [rdi + 0x68]
test rcx, rcx
je 0x140016105
call fcn.140014320
cmp eax, 1
jne 0x140015f0a
mov dword [rdi + 0x5c], 0x8000
jmp 0x140015f11
mov dword [rdi + 0x5c], 0x8004
lea rdx, str.igfxtrayWindow
lea rcx, str.igfxtrayClass
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x140015f3f
movsxd r8, dword [rdi + 0x5c]
xor r9d, r9d
mov edx, 0x807d
mov rcx, rax
call qword [sym.imp.USER32.dll_PostMessageW]
lea rdx, str.Intel_R__Display_Port_Topology_Viewer
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x140015f68
movsxd r8, dword [rdi + 0x5c]
xor r9d, r9d
mov edx, 0x807d
mov rcx, rax
call qword [sym.imp.USER32.dll_PostMessageW]
mov rcx, qword [rdi + 0x48]
test rcx, rcx
je 0x140015f83
mov r8d, dword [rdi + 0x5c]
add rcx, 0x10
mov edx, 0x80000
call fcn.140013d40
test dword [rsp + 0x50], 0x20000
je 0x140015fa5
cmp qword [rdi + 0x68], r14
je 0x140015fa5
mov rcx, qword [rdi + 0x68]
test rcx, rcx
je 0x140016110
call fcn.1400164b0
test dword [rsp + 0x50], 0x400000
je 0x1400160a3
xor eax, eax
lea rcx, [rsp + 0x78]
xor edx, edx
lea r8d, [rax + 0x60]
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
call fcn.1400198d0
lea rcx, [rbp + 0x852]
xor edx, edx
mov r8d, 0x7fe
mov dword [rsp + 0x70], 0x68
mov word [rbp + 0x850], r14w
call fcn.1400198d0
lea rcx, [rbp + 0x850]
mov edx, 0x400
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rcx, [rbp - 0x1e]
xor edx, edx
mov r8d, 0x862
mov word [rbp - 0x20], r14w
call fcn.1400198d0
lea r8, [rbp + 0x850]
lea rcx, [rbp - 0x20]
mov edx, 0x400
call fcn.1400180f0
lea r8, str.IntelWiDiUMS64.exe_38CD7AA6_0119_4D26_9717_B80FFFDB147E
lea rcx, [rbp - 0x20]
mov edx, 0x432
call fcn.140018068
lea rax, [rsp + 0x58]
lea rdx, [rbp - 0x20]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x28], 0x4000020
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1400160bb
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400160bb
mov rcx, qword [rdi + 0x48]
test rcx, rcx
je 0x1400160bb
mov r8d, dword [rdi + 0x5c]
add rcx, 0x10
xor edx, edx
call fcn.140013d40
mov eax, esi
mov rcx, qword [rbp + 0x1050]
xor rcx, rsp
call fcn.1400198a0
lea r11, [rsp + 0x1160]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
mov ecx, 0x80004003
call fcn.140016fb0
int3
mov ecx, 0x80004003
call fcn.140016fb0
int3
mov ecx, 0x80004003
call fcn.140016fb0
int3
mov ecx, 0x80004003
call fcn.140016fb0
int3
mov ecx, 0x80004003
call fcn.140016fb0
int3