Function at 0x140011ecc
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xd18]
sub rsp, 0xdf0
mov rax, qword [0x14003e0a8]
xor rax, rsp
mov qword [rbp + 0xce0], rax
mov rbx, rcx
call fcn.14001197c
xor r14d, r14d
mov edi, 0x206
lea rcx, [rbp + 0x292]
xor edx, edx
mov r8d, edi
mov r12d, r14d
mov r13b, r14b
mov word [rbp + 0x290], r14w
call fcn.14001dbc0
lea rcx, [rbp + 0x8c2]
mov r8d, edi
xor edx, edx
mov qword [rsp + 0x58], r14
mov word [rbp + 0x8c0], r14w
call fcn.14001dbc0
lea edi, [r14 + 1]
mov dword [rsp + 0x30], edi
mov r15d, 0x208
lea r9, str.SoftwareRealtime_SoftUltraMon
lea r8, str._s_u._u._u
lea rcx, [rbp + 0x8c0]
mov edx, r15d
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 3
call fcn.1400040ec
lea r11, [rsp + 0x58]
lea rdx, [rbp + 0x8c0]
mov r9d, edi
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], r11
call qword [0x140032018]
movsxd r11, eax
test eax, eax
je 0x14001245b
cmp r11d, 2
je 0x140012007
lea rax, str...UMSettings.cpp
mov qword [rbp - 0x78], r14
mov dword [rbp - 0x68], 0x175
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x60], r11
call qword [0x140032358]
lea rcx, [rsp + 0x60]
lea rdx, [rbp - 0x78]
lea r8d, [r14 + 0x28]
mov dword [rbp - 0x58], eax
call fcn.14001d320
lea rdx, [0x14003c7d8]
lea rcx, [rsp + 0x60]
call fcn.14001eeb4
int3
xor edx, edx
lea rcx, [rbp + 0x52]
mov r13b, dil
lea r8d, [rdx + 0x26]
mov word [rbp + 0x50], r14w
call fcn.14001dbc0
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x50]
mov byte [rsp + 0x50], r14b
call fcn.14001b1cc
mov sil, byte [rsp + 0x50]
lea rcx, [rbp + 0x50]
mov dl, sil
call fcn.14001ab38
cmp word [rbp + 0x50], r14w
je 0x140012127
lea rcx, [rbp + 0x82]
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x80], r14w
call fcn.14001dbc0
lea r8, str.SoftwareRealtime_SoftUltraMon
lea rcx, [rbp + 0x80]
mov rdx, r15
call fcn.140004074
test sil, sil
jne 0x1400120ad
lea r8, [0x140034f90]
lea rcx, [rbp + 0x80]
mov rdx, r15
call fcn.14000728c
lea r8, [rbp + 0x50]
lea rcx, [rbp + 0x80]
mov rdx, r15
call fcn.14000728c
lea rax, [rsp + 0x58]
lea rdx, [rbp + 0x80]
mov r9d, edi
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [0x140032018]
movsxd r11, eax
test eax, eax
je 0x140012127
cmp r11d, 2
je 0x140012127
lea rax, str...UMSettings.cpp
mov qword [rbp - 0x78], r14
mov dword [rbp - 0x68], 0x190
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x60], r11
call qword [0x140032358]
lea rcx, [rsp + 0x60]
lea rdx, [rbp - 0x78]
mov r8d, 0x28
mov dword [rbp - 0x58], eax
call fcn.14001d320
lea rdx, [0x14003c7d8]
lea rcx, [rsp + 0x60]
call fcn.14001eeb4
int3
mov rcx, qword [rsp + 0x58]
test rcx, rcx
jne 0x140012465
mov esi, 0x206
lea rcx, [rbp + 0x4a2]
xor edx, edx
mov r8d, esi
mov word [rbp + 0x4a0], r14w
call fcn.14001dbc0
lea rcx, [rbp + 0x4a0]
call fcn.140012800
cmp word [rbp + 0x4a0], r14w
je 0x14001245b
lea rcx, [rbp + 0x6b2]
mov r8d, esi
xor edx, edx
mov word [rbp + 0x6b0], r14w
call fcn.14001dbc0
lea r11, str.User.reg
lea r9, [rbp + 0x4a0]
lea r8, str._s_s
lea rcx, [rbp + 0x6b0]
mov rdx, r15
mov qword [rsp + 0x20], r11
call fcn.1400040ec
xor r9d, r9d
mov qword [rsp + 0x30], r14
lea rcx, [rbp + 0x6b0]
lea r8d, [r9 + 7]
xor edx, edx
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 3
call qword [0x1400320f0]
cmp rax, 0xffffffffffffffff
je 0x14001245b
mov rcx, rax
call qword [0x1400320f8]
lea rcx, [rbp + 0x82]
mov r8d, esi
xor edx, edx
mov word [rbp + 0x80], r14w
call fcn.14001dbc0
lea rcx, [rbp + 0x80]
mov edx, 0x104
call qword [0x140032138]
test eax, eax
jne 0x140012265
lea rax, str...UMSettings.cpp
mov qword [rsp + 0x60], r14
mov dword [rsp + 0x70], 0x1a8
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x78], r14
call qword [0x140032358]
lea rcx, [rbp - 0x50]
lea rdx, [rsp + 0x60]
mov r8d, 0x28
mov dword [rbp - 0x80], eax
call fcn.14001d320
lea rdx, [0x14003c7d8]
lea rcx, [rbp - 0x50]
call fcn.14001eeb4
int3
lea rcx, [rbp + 0x80]
call qword [0x140032350]
movsxd rcx, eax
cmp word [rbp + rcx*2 + 0x7e], 0x5c
je 0x140012293
lea r8, [0x140034f90]
lea rcx, [rbp + 0x80]
mov rdx, r15
call fcn.14000728c
lea r8, str.regedit.exe
lea rcx, [rbp + 0x80]
mov rdx, r15
call fcn.14000728c
lea rcx, [rbp + 0xad2]
mov r8, rsi
xor edx, edx
mov word [rbp + 0xad0], r14w
call fcn.14001dbc0
lea r11, [rbp + 0x6b0]
lea r9, [rbp + 0x80]
lea r8, str.__s___s___s_
lea rcx, [rbp + 0xad0]
mov rdx, r15
mov qword [rsp + 0x20], r11
call fcn.1400040ec
xor edx, edx
lea r8d, [rdx + 0x60]
lea rcx, [rbp - 0x18]
call fcn.14001dbc0
xor eax, eax
lea rdx, [rbp + 0xad0]
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rax
lea rax, [rbp - 0x78]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x20]
xor r9d, r9d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x28], r14d
mov dword [rbp - 0x20], 0x68
mov qword [rbp - 0x78], r14
mov dword [rsp + 0x20], r14d
call qword [0x140032108]
test eax, eax
jne 0x14001239a
lea rax, str...UMSettings.cpp
mov qword [rsp + 0x60], r14
mov dword [rsp + 0x70], 0x1b5
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x78], r14
call qword [0x140032358]
lea rcx, [rbp - 0x50]
lea rdx, [rsp + 0x60]
mov r8d, 0x28
mov dword [rbp - 0x80], eax
call fcn.14001d320
lea rdx, [0x14003c7d8]
lea rcx, [rbp - 0x50]
call fcn.14001eeb4
int3
mov rcx, qword [rbp - 0x78]
or edx, 0xffffffff
call qword [0x140032160]
mov rcx, qword [rbp - 0x70]
call qword [0x1400320f8]
mov rcx, qword [rbp - 0x78]
call qword [0x1400320f8]
lea r11, str.Default
lea r9, str.SoftwareRealtime_SoftUltraMon
lea r8, str._s_s
lea rcx, [rbp + 0x290]
mov rdx, r15
mov qword [rsp + 0x20], r11
call fcn.1400040ec
lea r11, [rsp + 0x58]
lea rdx, [rbp + 0x290]
mov r9d, edi
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], r11
call qword [0x140032018]
movsxd r11, eax
test eax, eax
je 0x14001245b
lea rax, str...UMSettings.cpp
mov qword [rsp + 0x60], r14
mov dword [rsp + 0x70], 0x1c3
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x78], r11
call qword [0x140032358]
lea rcx, [rbp - 0x50]
lea rdx, [rsp + 0x60]
mov r8d, 0x28
mov dword [rbp - 0x80], eax
call fcn.14001d320
lea rdx, [0x14003c7d8]
lea rcx, [rbp - 0x50]
call fcn.14001eeb4
int3
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14001248d
call fcn.140019eac
mov rdx, qword [rsp + 0x58]
mov rcx, rbx
mov r8d, eax
call fcn.140012a9c
mov rcx, qword [rsp + 0x58]
mov r12d, edi
call qword [0x140032008]
mov qword [rsp + 0x58], r14
cmp word [rbp + 0x290], r14w
je 0x1400124ad
lea rdx, [rbp + 0x290]
xor r8d, r8d
mov rcx, 0xffffffff80000001
call fcn.140019f48
cmp byte [rbx + 0x2510], r14b
mov eax, 0x101
lea rdx, str.SoftwareRealtime_SoftUltraMon
cmovne edi, eax
lea rax, [rsp + 0x58]
xor r8d, r8d
mov r9d, edi
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [0x140032018]
movsxd r11, eax
test eax, eax
je 0x140012533
lea rax, str...UMSettings.cpp
mov qword [rsp + 0x60], r14
mov dword [rsp + 0x70], 0x1e4
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x78], r11
call qword [0x140032358]
lea rcx, [rbp - 0x50]
lea rdx, [rsp + 0x60]
mov r8d, 0x28
mov dword [rbp - 0x80], eax
call fcn.14001d320
lea rdx, [0x14003c7d8]
lea rcx, [rbp - 0x50]
call fcn.14001eeb4
int3
mov rdx, qword [rsp + 0x58]
mov rcx, rbx
call fcn.140015bbc
mov rcx, qword [rsp + 0x58]
call qword [0x140032008]
test r13b, r13b
je 0x140012569
or qword [rbx], 0xffffffffffffffff
movabs rax, 0x3fffffffffffffff
mov rcx, rbx
and qword [rbx], rax
call fcn.14001259c
mov eax, r12d
mov rcx, qword [rbp + 0xce0]
xor rcx, rsp
call fcn.14001d120
lea r11, [rsp + 0xdf0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret