Function at 0x1800033a0
Capabilities:
Enumerate processes
Get session user name
Get user security identifier
Query or enumerate registry value
Set registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x440]
sub rsp, 0x540
mov qword [rbp - 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x580], rbx
mov rax, qword [0x18002f048]
xor rax, rsp
mov qword [rbp + 0x430], rax
mov rdi, r8
mov qword [rbp - 0x68], r8
mov r13, rdx
mov qword [rsp + 0x70], rdx
mov r14d, 0x1000
call fcn.180002c40
mov rcx, rax
test rax, rax
je 0x1800039d2
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x58], rbx
movdqa xmm0, xmmword [0x180021cc0]
movdqu xmmword [rbp - 0x38], xmm0
xor eax, eax
mov r12d, eax
lea r15, [rax - 1]
nop word [rax + rax]
mov rsi, rax
mov qword [rbp - 0x50], rax
mov dword [rbp - 0x48], eax
mov qword [rbp - 0x40], rax
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rbp + r12*8 - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ecx, ecx
test eax, eax
jne 0x180003569
mov eax, ecx
mov rsi, qword [rsp + 0x78]
mov qword [rbp - 0x50], rsi
mov dword [rbp - 0x48], 0x100
test ecx, ecx
jne 0x180003569
test r14d, r14d
js 0x1800039e8
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, r14d
or eax, ecx
jge 0x1800034b5
mov edx, r14d
lea rcx, [rsp + 0x58]
call fcn.180004d30
mov rbx, qword [rsp + 0x58]
lea eax, [r14 + r14]
mov dword [rsp + 0x60], eax
xor eax, eax
mov r14d, eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x64]
xor r8d, r8d
lea rdx, str.UserSID
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x180003538
mov eax, dword [rsp + 0x64]
dec eax
cmp eax, 1
jbe 0x180003501
mov edi, 0xd
jmp 0x180003538
mov ecx, dword [rsp + 0x60]
test rbx, rbx
je 0x18000352e
test ecx, ecx
je 0x180003527
test cl, 1
jne 0x180003520
mov eax, ecx
shr rax, 1
cmp word [rbx + rax*2 - 2], r14w
je 0x18000352e
mov edi, 0xd
jmp 0x180003538
xor eax, eax
mov word [rbx], ax
jmp 0x180003530
xor eax, eax
mov r14d, ecx
shr r14d, 1
mov edi, eax
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.18000e100
test eax, eax
js 0x1800039dd
cmp eax, dword [rbx - 0xc]
jg 0x1800039dd
mov dword [rbx - 0x10], eax
cdqe
xor ecx, ecx
mov word [rbx + rax*2], cx
test edi, edi
jne 0x180003569
cmp dword [rbx - 0x10], ecx
jne 0x1800035dc
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], 0
je 0x1800035ba
cmp dword [rdx + 0x10], 0
jge 0x18000358e
cmp dword [rbx - 0xc], 0
jl 0x1800039f3
mov dword [rbx - 0x10], ecx
mov word [rbx], cx
jmp 0x1800035ba
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1800035a4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x58], rbx
mov rsi, qword [rbp - 0x50]
test rsi, rsi
je 0x1800035c8
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc r12
cmp r12, 2
je 0x180003620
mov rdi, qword [rbp - 0x68]
xor eax, eax
jmp 0x180003430
lea rcx, [rbx - 0x18]
call fcn.180001750
add rax, 0x18
mov qword [r13], rax
test rsi, rsi
je 0x1800035fc
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lock xadd dword [rbx - 8], r15d
sub r15d, 1
jg 0x18000399a
mov rcx, qword [rbx - 0x18]
mov r8, qword [rcx]
lea rdx, [rbx - 0x18]
call qword [r8 + 8]
jmp 0x18000399a
xor r12d, r12d
mov qword [rbp - 0x80], r12
mov r14d, r12d
xor edx, edx
mov r8d, 0x234
lea rcx, [rbp - 0x1c]
call fcn.18000b960
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x18000366e
mov dword [rbp - 0x20], 0x238
lea rdx, [rbp - 0x20]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x1800036c0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rbx - 0x10], 0
je 0x18000396f
mov rsi, r12
mov r14, qword [rbp - 0x68]
nop
mov rdi, qword [rbp + rsi*8 - 0x38]
mov qword [rbp - 0x60], r12
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0xf013f
xor r8d, r8d
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1800038cf
mov rdi, qword [rbp - 0x60]
jmp 0x180003914
lea rdx, str.explorer.exe
lea rcx, [rbp + 0xc]
call fcn.18000e380
test eax, eax
je 0x1800036e6
lea rdx, [rbp - 0x20]
mov rcx, rsi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x180003718
jmp 0x1800036c0
mov r8d, dword [rbp - 0x18]
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
lea r8, [rbp - 0x80]
mov edx, 0xf01ff
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov r14d, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14d, r14d
je 0x18000366e
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x18000366e
mov dword [rsp + 0x68], 0x104
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x220]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x18000366e
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
test eax, eax
je 0x18000366e
mov dword [rsp + 0x54], r12d
mov dword [rsp + 0x50], r12d
call fcn.180002c40
mov rcx, rax
test rax, rax
je 0x1800039fe
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x78], rbx
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x54]
xor r8d, r8d
lea rdx, [rbp + 0x220]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov ecx, dword [rsp + 0x54]
call fcn.18000e6bc
mov rdi, rax
test rax, rax
jne 0x1800037fa
lea rdx, [rbx - 0x18]
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1800037f0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rsp + 0x58]
jmp 0x18000366e
mov eax, dword [rsp + 0x50]
lea edx, [rax + rax]
test edx, edx
js 0x180003a09
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edx
or eax, ecx
jge 0x180003827
lea rcx, [rbp - 0x78]
call fcn.180004d30
mov rbx, qword [rbp - 0x78]
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x54]
mov r8, rdi
lea rdx, [rbp + 0x220]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov esi, eax
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.18000e100
test eax, eax
js 0x1800039c7
cmp eax, dword [rbx - 0xc]
jg 0x1800039c7
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], r12w
test esi, esi
je 0x1800038c2
lea rdx, [rbp - 0x70]
mov rcx, rdi
call sub.ADVAPI32.dll_ConvertSidToStringSidW
mov rdx, qword [rbp - 0x70]
test rdx, rdx
jne 0x18000389e
mov eax, r12d
jmp 0x1800038ab
mov rax, r15
inc rax
cmp word [rdx + rax*2], 0
jne 0x1800038a1
mov r8d, eax
lea rcx, [rsp + 0x58]
call fcn.1800056c0
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rdi
call fcn.18000e6b4
jmp 0x1800037d6
mov qword [rsp + 0x70], r12
lea rax, [rbp - 0x58]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x180003962
mov rdi, qword [rsp + 0x70]
mov rax, r15
nop word [rax + rax]
lea rax, [rax + 1]
cmp word [rbx + rax*2], 0
jne 0x180003920
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, str.UserSID
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rdi, rdi
je 0x180003962
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc rsi
cmp rsi, 2
jne 0x180003680
lea rcx, [rbx - 0x18]
call fcn.180001750
add rax, 0x18
mov qword [r13], rax
lock xadd dword [rbx - 8], r15d
sub r15d, 1
jg 0x18000399a
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
lea rdx, [rbx - 0x18]
call qword [rax + 8]
mov rax, r13
mov rcx, qword [rbp + 0x430]
xor rcx, rsp
call fcn.18000a020
mov rbx, qword [rsp + 0x580]
add rsp, 0x540
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80070057
call fcn.1800016f0
nop
mov ecx, 0x80004005
call fcn.1800016f0
nop
mov ecx, 0x80070057
call fcn.1800016f0
int3
mov ecx, 0x80070057
call fcn.1800016f0
int3
mov ecx, 0x80070057
call fcn.1800016f0
nop
mov ecx, 0x80004005
call fcn.1800016f0
nop
mov ecx, 0x80070057
call fcn.1800016f0
int3