Function at 0x1880d1f2
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xcec
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
call fcn.1880ce82
xor eax, eax
xor ebx, ebx
mov esi, 0x206
push esi
mov word [esp + 0x2d4], ax
lea eax, [esp + 0x2d6]
push ebx
push eax
mov dword [esp + 0x4c], ebx
mov byte [esp + 0x1f], bl
call fcn.18819090
add esp, 0xc
xor eax, eax
push esi
mov word [esp + 0x8ec], ax
lea eax, [esp + 0x8ee]
push ebx
push eax
mov dword [esp + 0x18], ebx
call fcn.18819090
add esp, 0xc
push 1
push 4
push 3
push str.SoftwareRealtime_SoftUltraMon
push str._s_u._u._u
lea eax, [esi + 2]
lea edi, [esp + 0x8fc]
call fcn.188016e6
add esp, 0x14
lea eax, [esp + 0xc]
push eax
push 1
push ebx
mov eax, edi
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
je 0x1880d698
cmp eax, 2
je 0x1880d2d7
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], str...UMSettings.cpp
mov dword [esp + 0x34], 0x175
mov dword [esp + 0x38], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop ecx
mov dword [esp + 0x3c], eax
lea esi, [esp + 0x2c]
lea edi, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
push 0x18836bec
lea eax, [esp + 0x18]
push eax
call fcn.1881d33f
xor eax, eax
push 9
mov word [esp + 0x5c], ax
pop ecx
lea edi, [esp + 0x5a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x5c]
push eax
mov byte [esp + 0x1b], 1
mov byte [esp + 0x30], bl
call fcn.18812fe6
push dword [esp + 0x28]
lea eax, [esp + 0x5c]
push eax
call fcn.18812b3e
cmp word [esp + 0x58], bx
je 0x1880d3d6
xor eax, eax
push esi
mov word [esp + 0xcc], ax
lea eax, [esp + 0xce]
push ebx
push eax
call fcn.18819090
add esp, 0xc
mov edi, 0x208
push str.SoftwareRealtime_SoftUltraMon
mov eax, edi
lea ecx, [esp + 0xcc]
call fcn.188014a8
cmp byte [esp + 0x28], bl
jne 0x1880d375
push 0x18833484
mov eax, edi
lea ebx, [esp + 0xcc]
call fcn.188014dd
lea eax, [esp + 0x58]
push eax
mov eax, edi
call fcn.188014dd
xor ebx, ebx
lea eax, [esp + 0xc]
push eax
push 1
push ebx
lea eax, [esp + 0xd4]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
je 0x1880d3d6
cmp eax, 2
je 0x1880d3d6
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], str...UMSettings.cpp
mov dword [esp + 0x34], 0x190
mov dword [esp + 0x38], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop ecx
mov dword [esp + 0x3c], eax
lea esi, [esp + 0x2c]
lea edi, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
push 0x18836bec
lea eax, [esp + 0x18]
jmp 0x1880d2d1
cmp dword [esp + 0xc], ebx
jne 0x1880d69e
xor eax, eax
push esi
mov word [esp + 0x4dc], ax
lea eax, [esp + 0x4de]
push ebx
push eax
call fcn.18819090
add esp, 0xc
lea eax, [esp + 0x4d8]
push eax
call fcn.1880d913
cmp word [esp + 0x4d8], bx
je 0x1880d698
xor eax, eax
push esi
mov word [esp + 0x6e4], ax
lea eax, [esp + 0x6e6]
push ebx
push eax
call fcn.18819090
add esp, 0xc
push str.User.reg
lea eax, [esp + 0x4dc]
push eax
push str._s_s
mov eax, 0x208
lea edi, [esp + 0x6ec]
call fcn.188016e6
add esp, 0xc
push ebx
push ebx
push 3
push ebx
push 7
push ebx
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x1880d698
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
push esi
mov word [esp + 0xcc], ax
lea eax, [esp + 0xce]
push ebx
push eax
call fcn.18819090
add esp, 0xc
push 0x104
lea eax, [esp + 0xcc]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x1880d4ea
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], str...UMSettings.cpp
mov dword [esp + 0x1c], 0x1a8
mov dword [esp + 0x20], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop ecx
mov dword [esp + 0x24], eax
lea esi, [esp + 0x14]
lea edi, [esp + 0x44]
rep movsd dword es:[edi], dword [esi]
push 0x18836bec
lea eax, [esp + 0x48]
jmp 0x1880d2d1
lea eax, [esp + 0xc8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp word [esp + eax*2 + 0xc6], 0x5c
je 0x1880d519
push 0x18833484
mov eax, 0x208
lea ebx, [esp + 0xcc]
call fcn.188014dd
push str.regedit.exe
mov eax, 0x208
lea ebx, [esp + 0xcc]
call fcn.188014dd
xor eax, eax
push esi
mov word [esp + 0xaf4], ax
xor esi, esi
lea eax, [esp + 0xaf6]
push esi
push eax
call fcn.18819090
add esp, 0xc
lea eax, [esp + 0x6e0]
push eax
mov eax, ebx
push eax
mov ebx, 0x208
push str.__s___s___s_
mov eax, ebx
lea edi, [esp + 0xafc]
call fcn.188016e6
add esp, 0xc
push 0x40
lea eax, [esp + 0x88]
push esi
push eax
call fcn.18819090
xor eax, eax
mov dword [esp + 0x38], esi
lea edi, [esp + 0x3c]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x84]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [esp + 0xb10]
push eax
push esi
mov dword [esp + 0xa8], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x1880d601
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], str...UMSettings.cpp
mov dword [esp + 0x1c], 0x1b5
mov dword [esp + 0x20], esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop ecx
mov dword [esp + 0x24], eax
lea esi, [esp + 0x14]
lea edi, [esp + 0x44]
rep movsd dword es:[edi], dword [esi]
push 0x18836bec
lea eax, [esp + 0x48]
jmp 0x1880d2d1
push 0xffffffffffffffff
push dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esp + 0x30]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [esp + 0x2c]
call edi
push str.Default
push str.SoftwareRealtime_SoftUltraMon
push str._s_s
mov eax, ebx
lea edi, [esp + 0x2dc]
call fcn.188016e6
add esp, 0xc
lea eax, [esp + 0xc]
push eax
push 1
push esi
mov eax, edi
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
je 0x1880d696
and dword [esp + 0x14], esi
mov dword [esp + 0x18], str...UMSettings.cpp
mov dword [esp + 0x1c], 0x1c3
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop ecx
mov dword [esp + 0x24], eax
lea esi, [esp + 0x14]
lea edi, [esp + 0x44]
rep movsd dword es:[edi], dword [esi]
push 0x18836bec
lea eax, [esp + 0x48]
jmp 0x1880d2d1
xor ebx, ebx
cmp dword [esp + 0xc], ebx
je 0x1880d6ce
push dword [esp + 0xc]
call fcn.1881218e
mov esi, dword [ebp + 8]
pop ecx
push eax
push dword [esp + 0x10]
push esi
call fcn.1880daf9
push dword [esp + 0xc]
mov dword [esp + 0x44], 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0xc], ebx
jmp 0x1880d6d1
mov esi, dword [ebp + 8]
cmp word [esp + 0x2d0], bx
je 0x1880d6f1
push ebx
lea eax, [esp + 0x2d4]
push eax
push 0x80000001
call fcn.188121fe
add esp, 0xc
xor eax, eax
inc eax
cmp byte [esi + 0x243c], bl
je 0x1880d701
mov eax, 0x101
lea ecx, [esp + 0xc]
push ecx
push eax
push ebx
push str.SoftwareRealtime_SoftUltraMon
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
je 0x1880d759
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], str...UMSettings.cpp
mov dword [esp + 0x1c], 0x1e4
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop ecx
mov dword [esp + 0x24], eax
lea esi, [esp + 0x14]
lea edi, [esp + 0x44]
rep movsd dword es:[edi], dword [esi]
push 0x18836bec
lea eax, [esp + 0x48]
jmp 0x1880d2d1
push dword [esp + 0xc]
mov eax, esi
call fcn.1880f9ab
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [esp + 0x13], bl
je 0x1880d78d
or dword [esi], 0xffffffff
or dword [esi + 4], 0xffffffff
mov eax, dword [esi]
and dword [esi + 4], 0x3fffffff
mov dword [esi], eax
mov eax, esi
call fcn.1880d79a
mov eax, dword [esp + 0x40]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4