Function at 0x4c949f
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ecx
push ebx
push ebx
push ebx
push str.DISPLAY
call dword [sym.imp.GDI32.dll_CreateDCA]
mov esi, eax
push 0x18
push esi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push esi
mov dword [ebp - 0xc], eax
call dword [sym.imp.GDI32.dll_DeleteDC]
mov edi, dword [sym.imp.USER32.dll_FindWindowA]
push ebx
push str.RegEdit_RegEdit
call edi
mov esi, eax
test esi, esi
jne 0x4c9559
lea ecx, [ebp - 1]
call fcn.004266ae
push 0x38
lea eax, [ebp - 0x44]
mov dword [ebp - 0x48], 0x3c
push ebx
push eax
call fcn.004f1a90
add esp, 0xc
mov dword [ebp - 0x44], 0x40
lea eax, [ebp - 0x48]
mov dword [ebp - 0x3c], str.open
mov dword [ebp - 0x38], str.regedit.exe
mov dword [ebp - 0x2c], 1
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
push 0x4e20
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push str.RegEdit_RegEdit
call edi
mov esi, eax
call fcn.004267da
test esi, esi
jne 0x4c9559
xor eax, eax
jmp 0x4c96b8
push 5
push esi
call dword [sym.imp.USER32.dll_ShowWindowAsync]
mov ebx, dword [sym.imp.USER32.dll_SetForegroundWindow]
push esi
call ebx
push 0
push 0x55d68c
push 0
push esi
call dword [sym.imp.USER32.dll_FindWindowExA]
mov edi, eax
push edi
call ebx
push edi
call dword [sym.imp.USER32.dll_SetFocus]
test edi, edi
je 0x4c9552
push 0x1e
pop ebx
push 0
push 0x25
push 0x100
push edi
call dword [sym.imp.USER32.dll_SendMessageA]
sub ebx, 1
jne 0x4c958e
mov ebx, 0x100
cmp dword [ebp - 0xc], ebx
jbe 0x4c95b8
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0x27
push ebx
push edi
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [ebp - 8]
push 0x5c
push eax
call fcn.004f8a1f
pop ecx
pop ecx
lea ebx, [eax + 1]
mov eax, dword [ebp - 8]
jmp 0x4c963a
cmp byte [eax], 0
je 0x4c963e
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4c9552
mov eax, dword [ebp - 8]
push 0
mov al, byte [eax]
cmp al, 0x5c
jne 0x4c961c
push 0x27
push 0x100
push edi
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [ebp - 0xc], 0x100
jbe 0x4c9633
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4c9633
movsx eax, al
push eax
call fcn.004f88da
pop ecx
push eax
push 0x102
push edi
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp eax, ebx
jb 0x4c95d9
test ebx, ebx
je 0x4c96a7
push 0
push 0x55aafc
push 0
push esi
call dword [sym.imp.USER32.dll_FindWindowExA]
mov edi, eax
test edi, edi
je 0x4c9552
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push edi
call dword [sym.imp.USER32.dll_SetFocus]
push 0x190
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0x24
push 0x100
push edi
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x4c96a1
movsx eax, al
push 0
push eax
call fcn.004f88da
pop ecx
push eax
push 0x102
push edi
call dword [sym.imp.USER32.dll_SendMessageA]
inc ebx
mov al, byte [ebx]
test al, al
jne 0x4c9687
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push esi
call dword [sym.imp.USER32.dll_SetFocus]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret