Function at 0x1400148a0
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x1060]
mov eax, 0x1160
call fcn.140019170
sub rsp, rax
mov rax, qword [0x140046350]
xor rax, rsp
mov qword [rbp + 0x1050], rax
cmp qword [rcx + 0x68], 0
mov rdi, rcx
mov esi, 0x80004005
je 0x140014b8b
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
xor r14d, r14d
mov ebx, eax
mov dword [rsp + 0x50], r14d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, [rsp + 0x50]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
cmp ebx, dword [rsp + 0x50]
jne 0x140014b8b
mov rbx, qword [rdi + 0x68]
mov dword [rsp + 0x50], r14d
mov dword [rsp + 0x54], r14d
test rbx, rbx
je 0x140014bb4
mov rax, qword [rbx]
lea rcx, [rsp + 0x50]
lea r9, [rsp + 0x54]
mov qword [rsp + 0x20], rcx
lea r8d, [r14 + 4]
mov edx, 0x8a
mov rcx, rbx
call qword [rax + 0x38]
mov esi, eax
test eax, eax
jns 0x140014963
lea r8, [0x140030920]
mov rdx, rbx
mov ecx, eax
call fcn.140015580
test esi, esi
js 0x140014b8b
test dword [rsp + 0x50], 0x800
je 0x14001498d
mov rcx, qword [rdi + 0x68]
test rcx, rcx
je 0x140014bbf
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 0x378]
test byte [rsp + 0x50], 4
je 0x1400149ac
mov rcx, qword [rdi + 0x68]
test rcx, rcx
je 0x140014bca
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 0x4d0]
test dword [rsp + 0x50], 0x80000
je 0x140014a53
mov rcx, qword [rdi + 0x68]
test rcx, rcx
je 0x140014bd5
call fcn.140013280
cmp eax, 1
jne 0x1400149da
mov dword [rdi + 0x5c], 0x8000
jmp 0x1400149e1
mov dword [rdi + 0x5c], 0x8004
lea rdx, str.igfxtrayWindow
lea rcx, str.igfxtrayClass
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x140014a0f
movsxd r8, dword [rdi + 0x5c]
xor r9d, r9d
mov edx, 0x807d
mov rcx, rax
call qword [sym.imp.USER32.dll_PostMessageW]
lea rdx, str.Intel_R__Display_Port_Topology_Viewer
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x140014a38
movsxd r8, dword [rdi + 0x5c]
xor r9d, r9d
mov edx, 0x807d
mov rcx, rax
call qword [sym.imp.USER32.dll_PostMessageW]
mov rcx, qword [rdi + 0x48]
test rcx, rcx
je 0x140014a53
mov r8d, dword [rdi + 0x5c]
add rcx, 0x10
mov edx, 0x80000
call fcn.140012d60
test dword [rsp + 0x50], 0x20000
je 0x140014a75
cmp qword [rdi + 0x68], r14
je 0x140014a75
mov rcx, qword [rdi + 0x68]
test rcx, rcx
je 0x140014be0
call fcn.140014f80
test dword [rsp + 0x50], 0x400000
je 0x140014b73
xor eax, eax
lea rcx, [rsp + 0x78]
xor edx, edx
lea r8d, [rax + 0x60]
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
call fcn.140018400
lea rcx, [rbp + 0x852]
xor edx, edx
mov r8d, 0x7fe
mov dword [rsp + 0x70], 0x68
mov word [rbp + 0x850], r14w
call fcn.140018400
lea rcx, [rbp + 0x850]
mov edx, 0x400
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rcx, [rbp - 0x1e]
xor edx, edx
mov r8d, 0x862
mov word [rbp - 0x20], r14w
call fcn.140018400
lea r8, [rbp + 0x850]
lea rcx, [rbp - 0x20]
mov edx, 0x400
call fcn.1400162c0
lea r8, str.IntelWiDiUMS64.exe_38CD7AA6_0119_4D26_9717_B80FFFDB147E
lea rcx, [rbp - 0x20]
mov edx, 0x432
call fcn.140016238
lea rax, [rsp + 0x58]
lea rdx, [rbp - 0x20]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x28], 0x4000020
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140014b8b
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140014b8b
mov rcx, qword [rdi + 0x48]
test rcx, rcx
je 0x140014b8b
mov r8d, dword [rdi + 0x5c]
add rcx, 0x10
xor edx, edx
call fcn.140012d60
mov eax, esi
mov rcx, qword [rbp + 0x1050]
xor rcx, rsp
call fcn.1400183d0
lea r11, [rsp + 0x1160]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
mov ecx, 0x80004003
call fcn.140015570
int3
mov ecx, 0x80004003
call fcn.140015570
int3
mov ecx, 0x80004003
call fcn.140015570
int3
mov ecx, 0x80004003
call fcn.140015570
int3
mov ecx, 0x80004003
call fcn.140015570
int3