Function at 0x476610
Capabilities:
Create directory
Create process on windows

Disassembly:
mov eax, 0x1118
call fcn.004a5e30
mov eax, dword [0x4c4004]
xor eax, esp
mov dword [esp + 0x1114], eax
mov eax, dword [esp + 0x111c]
push ebx
push esi
push edi
mov dword [esp + 0x14], eax
mov ebx, ecx
mov eax, dword [esp + 0x1130]
push str.Kernel32.dll
mov dword [esp + 0x1c], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, eax
test esi, esi
jne 0x476677
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x476691
push str.Wow64DisableWow64FsRedirection
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x47668e
lea ecx, [esp + 0xc]
push ecx
call eax
push esi
call edi
xor eax, eax
push 0xc6
push eax
mov word [esp + 0x60], ax
lea eax, [esp + 0x62]
push eax
call fcn.0048e880
xor eax, eax
push 0x7fe
push eax
mov word [esp + 0x934], ax
lea eax, [esp + 0x936]
push eax
call fcn.0048e880
add esp, 0x18
lea eax, [esp + 0x920]
push 0x4def98
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
mov esi, dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [esp + 0x920]
push str.undo_
push eax
call esi
push dword [esp + 0x10]
lea eax, [esp + 0x924]
push eax
call esi
lea eax, [esp + 0x920]
push eax
call fcn.00496d2b
lea eax, [esp + 0x924]
push eax
call fcn.00492383
mov eax, dword [0x4bf860]
movq xmm0, qword [str._A__E]
mov dword [esp + 0x130], eax
mov ax, word [0x4bf864]
push 0x7f2
mov word [esp + 0x138], ax
lea eax, [esp + 0x13a]
push 0
push eax
movq qword [esp + 0x134], xmm0
call fcn.0048e880
add esp, 0x14
lea eax, [esp + 0x120]
push dword [esp + 0x14]
push eax
call esi
push 0xa
push 0x64
lea eax, [esp + 0x60]
push eax
push 0
call fcn.004927cc
add esp, 4
push eax
call fcn.0048f70e
add esp, 0x10
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x124]
push eax
call esi
push 0x4af95c
lea eax, [esp + 0x124]
push eax
call esi
push 0xa
push 0x64
lea eax, [esp + 0x60]
push eax
push dword [esp + 0x1138]
call fcn.0048f70e
add esp, 0x10
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x124]
push eax
call esi
push str..reg__
lea eax, [esp + 0x124]
push eax
call esi
cmp ebx, 0x80000000
jne 0x4767e7
push str.HKEY_CLASSES_ROOT_
jmp 0x476812
cmp ebx, 0x80000002
jne 0x4767f6
push str.HKEY_LOCAL_MACHINE_
jmp 0x476812
cmp ebx, 0x80000001
jne 0x476805
push str.HKEY_CURRENT_USER_
jmp 0x476812
cmp ebx, 0x80000003
jne 0x47681c
push str.HKEY_USERS_
lea eax, [esp + 0x124]
push eax
call esi
push dword [esp + 0x18]
lea eax, [esp + 0x124]
push eax
call esi
push 0x4b4920
lea eax, [esp + 0x124]
push eax
call esi
mov eax, dword [0x4def88]
xorps xmm0, xmm0
mov dword [esp + 0x24], eax
lea eax, [esp + 0x120]
mov dword [esp + 0x30], eax
mov eax, dword [0x4deb64]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x1c]
push eax
movlpd qword [esp + 0x44], xmm0
movlpd qword [esp + 0x4c], xmm0
movlpd qword [esp + 0x54], xmm0
mov dword [esp + 0x20], 0x3c
mov dword [esp + 0x24], 0x40
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], str.regedit.exe
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push 0xffffffffffffffff
push dword [esp + 0x58]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, dword [esp + 0xc]
test ebx, ebx
je 0x4768f2
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
jne 0x4768dc
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x4768f2
push str.Wow64RevertWow64FsRedirection
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4768ef
push ebx
call eax
push esi
call edi
mov ecx, dword [esp + 0x1120]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0048d925
add esp, 0x1118
ret