Function at 0x140008230
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x320]
sub rsp, 0x420
mov rbx, rcx
xor edx, edx
lea rcx, [rbp + 0x100]
mov r8d, 0x104
call fcn.14000d320
xor edx, edx
lea rcx, [rbp - 0x10]
mov r8d, 0x104
call fcn.14000d320
xor edx, edx
lea rcx, [rbp + 0x210]
mov r8d, 0x104
call fcn.14000d320
mov edx, 0x104
lea rcx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x1400084da
lea rcx, [rbp + 0x210]
dec rcx
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x1400082a2
lea r8, [rbp - 0x10]
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x1400082c0
lea rcx, [rbp + 0x100]
dec rcx
nop word [rax + rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x1400082e0
lea r8, [rbp - 0x10]
xor edx, edx
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x1400082f0
mov r8, rbx
lea rdx, str.explorer.exe_shell:AppsFolder_s_AMDRadeonsoftwareUWP
lea rcx, [rbp + 0x100]
call fcn.140002800
lea rcx, [rbp + 0x210]
dec rcx
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140008320
mov eax, dword [0x14006ea98]
movsd xmm0, qword [str.explorer.exe]
movsd qword [rcx], xmm0
mov dword [rcx + 8], eax
movzx eax, word [0x14006ea9c]
mov word [rcx + 0xc], ax
lea rcx, [rbp - 0x10]
dec rcx
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140008351
lea r8, [rbp + 0x100]
xor edx, edx
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140008370
xor ebx, ebx
mov ecx, ebx
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rbp + rcx - 0x10]
mov byte [rbp + rcx + 0x100], al
lea rcx, [rcx + 1]
test al, al
jne 0x140008390
xorps xmm1, xmm1
mov qword [rbp + 0x338], rbx
xor eax, eax
xorps xmm0, xmm0
mov qword [rsp + 0x70], rax
mov qword [rbp - 0x20], rax
lea rax, str.WinSta0Default
movups xmmword [rbp - 0x80], xmm1
mov dword [rbp - 0x80], 0x68
movups xmmword [rbp - 0x70], xmm1
mov qword [rbp - 0x70], rax
movups xmmword [rbp - 0x50], xmm1
mov dword [rbp - 0x44], 1
movups xmmword [rbp - 0x40], xmm1
mov word [rbp - 0x40], bx
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rbp - 0x60], xmm1
movups xmmword [rbp - 0x30], xmm1
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
cmp eax, 0xffffffff
je 0x1400084fa
lea rdx, [rbp + 0x338]
mov ecx, eax
call sub.WTSAPI32.dll_WTSQueryUserToken
mov rcx, qword [rbp + 0x338]
test rcx, rcx
je 0x1400084fa
test eax, eax
je 0x1400084fa
lea rax, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x50], rax
lea r8, [rbp + 0x100]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x48], rax
lea rdx, [rbp + 0x210]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], 0x20
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
test eax, eax
je 0x1400084c5
mov rcx, qword [rbp + 0x338]
test rcx, rcx
je 0x14000848d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x338], rbx
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400084a2
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x68], rbx
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400084b2
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov rbx, qword [rsp + 0x430]
add rsp, 0x420
pop rbp
ret
mov rcx, qword [0x140086ce0]
test rcx, rcx
je 0x1400084fa
lea r9, str.LaunchAppContainerProcess:_Failed_to_create_process_
jmp 0x1400084ed
mov rcx, qword [0x140086ce0]
test rcx, rcx
je 0x1400084fa
lea r9, str.LaunchAppContainerProcess:_Failed_to_retrieve_Windows_directory_
xor r8d, r8d
mov edx, 0x60004004
call fcn.140006660
mov rbx, qword [rsp + 0x430]
xor al, al
add rsp, 0x420
pop rbp
ret