Function at 0x1400f5480
Capabilities:
Create process on windows
Get windows directory from kuser_shared_data
Set registry value

Disassembly:
push rbp
push rdi
push r12
lea rbp, [rsp - 0x50]
sub rsp, 0x150
mov r8, qword [0x14023df18]
mov rdi, rdx
mov word [rsp + 0x48], r8w
mov r12, rcx
lea eax, [r8 + 2]
mov word [rsp + 0x4a], ax
mov rax, qword [str.SoftwareMicrosoftWindowsCurrentVersionAppletsRegedit]
mov qword [rsp + 0x50], rax
cmp r8, 0xfffe
ja 0x1400f5768
xor r8d, r8d
lea rax, [rsp + 0x40]
lea r9, [rbp - 8]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x48]
lea rcx, [r8 - 9]
call fcn.14011ab40
test eax, eax
js 0x1400f5768
mov qword [rsp + 0x170], rbx
lea r8, [rbp - 8]
mov qword [rsp + 0x140], r13
lea rcx, [rbp + 0x88]
xor r13d, r13d
xor r9d, r9d
mov qword [rsp + 0x30], r13
mov edx, 0x20006
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
call qword [sym.imp.ntdll.dll_NtCreateKey]
mov rcx, qword [rsp + 0x40]
mov ebx, eax
test rcx, rcx
je 0x1400f5546
nop dword [rax + rax]
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
js 0x1400f5758
mov qword [rsp + 0x148], rsi
mov rcx, rdi
mov qword [rsp + 0x138], r14
mov qword [rsp + 0x130], r15
call fcn.1400f51c0
mov rdx, qword [0x14023e030]
mov rbx, rax
mov word [rsp + 0x58], dx
mov r8d, dword [rax]
mov rax, qword [rax + 8]
lea ecx, [rdx + 2]
mov word [rsp + 0x5a], cx
add r8d, 2
mov rcx, qword [str.LastKey]
mov qword [rsp + 0x60], rcx
cmp rdx, 0xfffe
ja 0x1400f55ce
mov rcx, qword [rbp + 0x88]
lea rdx, [rsp + 0x58]
mov dword [rsp + 0x28], r8d
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtSetValueKey]
mov rcx, qword [rbp + 0x88]
call qword [sym.imp.ntdll.dll_NtClose]
mov edi, 0xffffffff
lea rcx, [rbx - 0x10]
mov eax, edi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400f55f5
call fcn.1400fbcc0
mov rsi, qword [0x1402447d8]
nop dword [rax]
test rsi, rsi
je 0x1400f560e
mov r14, qword [0x1402447d0]
jmp 0x1400f5640
mov esi, 0x7ffe0030
mov ecx, esi
call sym.ProcessHacker.exe_PhCountStringZ
add rax, rax
cmp word [rax + 0x7ffe002e], 0x5c
lea r14, [rax - 2]
cmovne r14, rax
mov qword [0x1402447d0], r14
lock or dword [rsp], r13d
mov qword [0x1402447d8], rsi
mov rbx, qword [0x14023e010]
mov rdx, qword [0x1402418e8]
add rbx, r14
lea rcx, [rbx + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov r8, r14
mov rdx, rsi
mov r15, rax
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov word [rcx + rbx], r13w
mov rcx, qword [rax + 8]
call fcn.140188690
mov rcx, qword [r15 + 8]
mov r8, qword [0x14023e010]
add rcx, r14
mov rdx, qword [str._regedit.exe]
call fcn.140188690
lea rcx, [rbp - 0x20]
call sym.ProcessHacker.exe_PhGetOwnTokenAttributes
mov r14, qword [rsp + 0x138]
mov rsi, qword [rsp + 0x148]
mov ecx, dword [rax + 8]
mov rax, qword [r15 + 8]
and ecx, 1
je 0x1400f56cb
xor r8d, r8d
mov rdx, rax
mov rcx, r12
call sym.ProcessHacker.exe_PhShellExecute
jmp 0x1400f573d
xorps xmm0, xmm0
mov dword [rsp + 0x70], 0x70
movups xmmword [rbp - 0x7c], xmm0
xor ecx, ecx
mov qword [rbp - 0x78], rax
movups xmmword [rsp + 0x74], xmm0
lea rax, str.runas
mov qword [rbp - 0x2c], rcx
movups xmmword [rbp - 0x6c], xmm0
mov dword [rbp - 0x24], ecx
lea rcx, [rsp + 0x70]
mov qword [rbp - 0x80], rax
movups xmmword [rbp - 0x5c], xmm0
mov qword [rbp - 0x70], r13
movups xmmword [rbp - 0x4c], xmm0
mov dword [rsp + 0x74], 0x440
movups xmmword [rbp - 0x3c], xmm0
mov dword [rbp - 0x60], 1
mov qword [rsp + 0x78], r12
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x1400f573d
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x1400f573d
call qword [sym.imp.ntdll.dll_NtClose]
lea rcx, [r15 - 0x10]
lock xadd dword [rcx + 8], edi
mov r15, qword [rsp + 0x130]
cmp edi, 1
jne 0x1400f5758
call fcn.1400fbcc0
mov rbx, qword [rsp + 0x170]
mov r13, qword [rsp + 0x140]
add rsp, 0x150
pop r12
pop rdi
pop rbp
ret