Function at 0x140015d10
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x1060]
mov eax, 0x1160
call fcn.14001aa80
sub rsp, rax
mov rax, qword [0x140048370]
xor rax, rsp
mov qword [rbp + 0x1050], rax
cmp qword [rcx + 0x68], 0
mov rdi, rcx
mov esi, 0x80004005
je 0x140015ffb
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
xor r14d, r14d
mov ebx, eax
mov dword [rsp + 0x50], r14d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, [rsp + 0x50]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
cmp ebx, dword [rsp + 0x50]
jne 0x140015ffb
mov rbx, qword [rdi + 0x68]
mov dword [rsp + 0x50], r14d
mov dword [rsp + 0x54], r14d
test rbx, rbx
je 0x140016024
mov rax, qword [rbx]
lea rcx, [rsp + 0x50]
lea r9, [rsp + 0x54]
mov qword [rsp + 0x20], rcx
lea r8d, [r14 + 4]
mov edx, 0x8b
mov rcx, rbx
call qword [rax + 0x38]
mov esi, eax
test eax, eax
jns 0x140015dd3
lea r8, [0x140031910]
mov rdx, rbx
mov ecx, eax
call fcn.140016e90
test esi, esi
js 0x140015ffb
test dword [rsp + 0x50], 0x800
je 0x140015dfd
mov rcx, qword [rdi + 0x68]
test rcx, rcx
je 0x14001602f
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 0x378]
test byte [rsp + 0x50], 4
je 0x140015e1c
mov rcx, qword [rdi + 0x68]
test rcx, rcx
je 0x14001603a
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 0x4d0]
test dword [rsp + 0x50], 0x80000
je 0x140015ec3
mov rcx, qword [rdi + 0x68]
test rcx, rcx
je 0x140016045
call fcn.140014260
cmp eax, 1
jne 0x140015e4a
mov dword [rdi + 0x5c], 0x8000
jmp 0x140015e51
mov dword [rdi + 0x5c], 0x8004
lea rdx, str.igfxtrayWindow
lea rcx, str.igfxtrayClass
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x140015e7f
movsxd r8, dword [rdi + 0x5c]
xor r9d, r9d
mov edx, 0x807d
mov rcx, rax
call qword [sym.imp.USER32.dll_PostMessageW]
lea rdx, str.Intel_R__Display_Port_Topology_Viewer
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x140015ea8
movsxd r8, dword [rdi + 0x5c]
xor r9d, r9d
mov edx, 0x807d
mov rcx, rax
call qword [sym.imp.USER32.dll_PostMessageW]
mov rcx, qword [rdi + 0x48]
test rcx, rcx
je 0x140015ec3
mov r8d, dword [rdi + 0x5c]
add rcx, 0x10
mov edx, 0x80000
call fcn.140013c80
test dword [rsp + 0x50], 0x20000
je 0x140015ee5
cmp qword [rdi + 0x68], r14
je 0x140015ee5
mov rcx, qword [rdi + 0x68]
test rcx, rcx
je 0x140016050
call fcn.1400163f0
test dword [rsp + 0x50], 0x400000
je 0x140015fe3
xor eax, eax
lea rcx, [rsp + 0x78]
xor edx, edx
lea r8d, [rax + 0x60]
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
call fcn.140019d30
lea rcx, [rbp + 0x852]
xor edx, edx
mov r8d, 0x7fe
mov dword [rsp + 0x70], 0x68
mov word [rbp + 0x850], r14w
call fcn.140019d30
lea rcx, [rbp + 0x850]
mov edx, 0x400
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rcx, [rbp - 0x1e]
xor edx, edx
mov r8d, 0x862
mov word [rbp - 0x20], r14w
call fcn.140019d30
lea r8, [rbp + 0x850]
lea rcx, [rbp - 0x20]
mov edx, 0x400
call fcn.140017bd0
lea r8, str.IntelWiDiUMS64.exe_38CD7AA6_0119_4D26_9717_B80FFFDB147E
lea rcx, [rbp - 0x20]
mov edx, 0x432
call fcn.140017b48
lea rax, [rsp + 0x58]
lea rdx, [rbp - 0x20]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x28], 0x4000020
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140015ffb
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140015ffb
mov rcx, qword [rdi + 0x48]
test rcx, rcx
je 0x140015ffb
mov r8d, dword [rdi + 0x5c]
add rcx, 0x10
xor edx, edx
call fcn.140013c80
mov eax, esi
mov rcx, qword [rbp + 0x1050]
xor rcx, rsp
call fcn.140019d00
lea r11, [rsp + 0x1160]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
mov ecx, 0x80004003
call fcn.140016e80
int3
mov ecx, 0x80004003
call fcn.140016e80
int3
mov ecx, 0x80004003
call fcn.140016e80
int3
mov ecx, 0x80004003
call fcn.140016e80
int3
mov ecx, 0x80004003
call fcn.140016e80
int3