Function at 0x49f440
Capabilities:
Create process on windows
Get common file path
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x7c
mov ecx, dword [0x547b6c]
mov word [esp + 0xc], cx
push ebx
push esi
lea eax, [ecx + 2]
mov word [esp + 0x16], ax
mov eax, dword [str.SoftwareMicrosoftWindowsCurrentVersionAppletsRegedit]
mov dword [esp + 0x18], eax
push edi
cmp ecx, 0xfffe
ja 0x49f692
lea eax, [esp + 0x14]
mov ecx, 0xfffffff7
push eax
lea eax, [esp + 0x38]
push eax
push 0
lea edx, [esp + 0x24]
call fcn.004b21d0
test eax, eax
js 0x49f692
push 0
push 0
push 0
push 0
lea eax, [esp + 0x44]
push eax
push 0x20006
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.ntdll.dll_NtCreateKey]
mov ecx, dword [esp + 0x14]
mov esi, eax
test ecx, ecx
je 0x49f4c4
push ecx
call dword [sym.imp.ntdll.dll_NtClose]
test esi, esi
js 0x49f692
mov ecx, dword [ebp + 0xc]
mov dword [esp + 0x2c], 0x10000e
mov dword [esp + 0x30], str.LastKey
call fcn.0049f2e0
mov esi, eax
lea eax, [esp + 0x2c]
mov ecx, dword [esi]
add ecx, 2
push ecx
push dword [esi + 4]
push 1
push 0
push eax
push dword [esp + 0x24]
call dword [sym.imp.ntdll.dll_NtSetValueKey]
or ebx, 0xffffffff
lea ecx, [esi - 8]
mov eax, ebx
lock xadd dword [ecx + 4], eax
dec eax
jne 0x49f517
call fcn.004a2a20
push dword [esp + 0x10]
call dword [sym.imp.ntdll.dll_NtClose]
push str._regedit.exe
call sym.ProcessHacker.exe_PhCountStringZ
push dword [0x54b7b4]
add eax, eax
mov dword [esp + 0x18], eax
lea esi, [eax + 0x208]
lea ecx, [esi + 0xa]
push ecx
call sym.ProcessHacker.exe_PhCreateObject
mov edi, eax
xor eax, eax
lea ecx, [edi + 8]
mov dword [edi + 4], ecx
mov dword [edi], esi
mov word [ecx + esi], ax
push dword [edi + 4]
push eax
push eax
push 0x24
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x49f596
push dword [edi + 4]
call sym.ProcessHacker.exe_PhCountStringZ
mov esi, dword [esp + 0x14]
add eax, eax
mov dword [edi], eax
shr eax, 1
lea ecx, [esi + 2]
push ecx
mov ecx, dword [edi + 4]
push str._regedit.exe
lea eax, [ecx + eax*2]
push eax
call fcn.004dd620
add esp, 0xc
add dword [edi], esi
jmp 0x49f5fd
lea ecx, [edi - 8]
mov eax, ebx
lock xadd dword [ecx + 4], eax
dec eax
jne 0x49f5a8
call fcn.004a2a20
push dword [0x54b7b4]
push 0x20
call sym.ProcessHacker.exe_PhCreateObject
mov edi, eax
xor ecx, ecx
lea eax, [edi + 8]
mov dword [edi + 4], eax
mov dword [edi], 0x16
mov word [eax + 0x16], cx
mov ecx, dword [edi + 4]
mov eax, dword [str.regedit.exe]
mov dword [ecx], eax
mov eax, dword [0x532c6c]
mov dword [ecx + 4], eax
mov eax, dword [0x532c70]
mov dword [ecx + 8], eax
mov eax, dword [0x532c74]
mov dword [ecx + 0xc], eax
mov eax, dword [0x532c78]
mov dword [ecx + 0x10], eax
mov ax, word [0x532c7c]
mov word [ecx + 0x14], ax
lea eax, [esp + 0x18]
push eax
call sym.ProcessHacker.exe_PhGetOwnTokenAttributes
mov esi, dword [edi + 4]
mov eax, dword [eax + 4]
and eax, 1
jne 0x49f674
push 0x38
lea eax, [esp + 0x54]
mov dword [esp + 0x50], 0x3c
push 0
push eax
call fcn.004dce30
mov eax, dword [ebp + 8]
add esp, 0xc
mov dword [esp + 0x54], eax
lea eax, [esp + 0x4c]
mov dword [esp + 0x5c], esi
mov dword [esp + 0x60], 0x5077f0
push eax
mov dword [esp + 0x54], 0x440
mov dword [esp + 0x6c], 1
mov dword [esp + 0x5c], str.runas
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x49f682
push dword [esp + 0x84]
call dword [sym.imp.ntdll.dll_NtClose]
jmp 0x49f682
push 0x5077f0
push esi
push dword [ebp + 8]
call sym.ProcessHacker.exe_PhShellExecute
lea ecx, [edi - 8]
lock xadd dword [ecx + 4], ebx
dec ebx
jne 0x49f692
call fcn.004a2a20
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8