Function at 0x180003110
Capabilities:
Enumerate processes
Get session user name
Get user security identifier
Query or enumerate registry value
Set registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x440]
sub rsp, 0x540
mov qword [rbp - 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x580], rbx
mov rax, qword [0x180030048]
xor rax, rsp
mov qword [rbp + 0x430], rax
mov rdi, r8
mov qword [rbp - 0x68], r8
mov r13, rdx
mov qword [rsp + 0x70], rdx
mov r14d, 0x1000
call fcn.1800029b0
mov rcx, rax
test rax, rax
je 0x180003742
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x58], rbx
movdqa xmm0, xmmword [0x180022cf0]
movdqu xmmword [rbp - 0x38], xmm0
xor eax, eax
mov r12d, eax
lea r15, [rax - 1]
nop word [rax + rax]
mov rsi, rax
mov qword [rbp - 0x50], rax
mov dword [rbp - 0x48], eax
mov qword [rbp - 0x40], rax
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rbp + r12*8 - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ecx, ecx
test eax, eax
jne 0x1800032d9
mov eax, ecx
mov rsi, qword [rsp + 0x78]
mov qword [rbp - 0x50], rsi
mov dword [rbp - 0x48], 0x100
test ecx, ecx
jne 0x1800032d9
test r14d, r14d
js 0x180003758
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, r14d
or eax, ecx
jge 0x180003225
mov edx, r14d
lea rcx, [rsp + 0x58]
call fcn.180004250
mov rbx, qword [rsp + 0x58]
lea eax, [r14 + r14]
mov dword [rsp + 0x60], eax
xor eax, eax
mov r14d, eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x64]
xor r8d, r8d
lea rdx, str.UserSID
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x1800032a8
mov eax, dword [rsp + 0x64]
dec eax
cmp eax, 1
jbe 0x180003271
mov edi, 0xd
jmp 0x1800032a8
mov ecx, dword [rsp + 0x60]
test rbx, rbx
je 0x18000329e
test ecx, ecx
je 0x180003297
test cl, 1
jne 0x180003290
mov eax, ecx
shr rax, 1
cmp word [rbx + rax*2 - 2], r14w
je 0x18000329e
mov edi, 0xd
jmp 0x1800032a8
xor eax, eax
mov word [rbx], ax
jmp 0x1800032a0
xor eax, eax
mov r14d, ecx
shr r14d, 1
mov edi, eax
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.18000d370
test eax, eax
js 0x18000374d
cmp eax, dword [rbx - 0xc]
jg 0x18000374d
mov dword [rbx - 0x10], eax
cdqe
xor ecx, ecx
mov word [rbx + rax*2], cx
test edi, edi
jne 0x1800032d9
cmp dword [rbx - 0x10], ecx
jne 0x18000334c
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], 0
je 0x18000332a
cmp dword [rdx + 0x10], 0
jge 0x1800032fe
cmp dword [rbx - 0xc], 0
jl 0x180003763
mov dword [rbx - 0x10], ecx
mov word [rbx], cx
jmp 0x18000332a
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x180003314
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x58], rbx
mov rsi, qword [rbp - 0x50]
test rsi, rsi
je 0x180003338
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc r12
cmp r12, 2
je 0x180003390
mov rdi, qword [rbp - 0x68]
xor eax, eax
jmp 0x1800031a0
lea rcx, [rbx - 0x18]
call fcn.180001660
add rax, 0x18
mov qword [r13], rax
test rsi, rsi
je 0x18000336c
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lock xadd dword [rbx - 8], r15d
sub r15d, 1
jg 0x18000370a
mov rcx, qword [rbx - 0x18]
mov r8, qword [rcx]
lea rdx, [rbx - 0x18]
call qword [r8 + 8]
jmp 0x18000370a
xor r12d, r12d
mov qword [rbp - 0x80], r12
mov r14d, r12d
xor edx, edx
mov r8d, 0x234
lea rcx, [rbp - 0x1c]
call fcn.18000abd0
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1800033de
mov dword [rbp - 0x20], 0x238
lea rdx, [rbp - 0x20]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x180003430
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rbx - 0x10], 0
je 0x1800036df
mov rsi, r12
mov r14, qword [rbp - 0x68]
nop
mov rdi, qword [rbp + rsi*8 - 0x38]
mov qword [rbp - 0x60], r12
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0xf013f
xor r8d, r8d
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18000363f
mov rdi, qword [rbp - 0x60]
jmp 0x180003684
lea rdx, str.explorer.exe
lea rcx, [rbp + 0xc]
call fcn.18000d5f0
test eax, eax
je 0x180003456
lea rdx, [rbp - 0x20]
mov rcx, rsi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x180003488
jmp 0x180003430
mov r8d, dword [rbp - 0x18]
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
lea r8, [rbp - 0x80]
mov edx, 0xf01ff
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov r14d, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14d, r14d
je 0x1800033de
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x1800033de
mov dword [rsp + 0x68], 0x104
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x220]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x1800033de
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
test eax, eax
je 0x1800033de
mov dword [rsp + 0x54], r12d
mov dword [rsp + 0x50], r12d
call fcn.1800029b0
mov rcx, rax
test rax, rax
je 0x18000376e
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x78], rbx
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x54]
xor r8d, r8d
lea rdx, [rbp + 0x220]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov ecx, dword [rsp + 0x54]
call fcn.18000d92c
mov rdi, rax
test rax, rax
jne 0x18000356a
lea rdx, [rbx - 0x18]
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x180003560
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rsp + 0x58]
jmp 0x1800033de
mov eax, dword [rsp + 0x50]
lea edx, [rax + rax]
test edx, edx
js 0x180003779
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edx
or eax, ecx
jge 0x180003597
lea rcx, [rbp - 0x78]
call fcn.180004250
mov rbx, qword [rbp - 0x78]
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x54]
mov r8, rdi
lea rdx, [rbp + 0x220]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov esi, eax
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.18000d370
test eax, eax
js 0x180003737
cmp eax, dword [rbx - 0xc]
jg 0x180003737
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], r12w
test esi, esi
je 0x180003632
lea rdx, [rbp - 0x70]
mov rcx, rdi
call sub.ADVAPI32.dll_ConvertSidToStringSidW
mov rdx, qword [rbp - 0x70]
test rdx, rdx
jne 0x18000360e
mov eax, r12d
jmp 0x18000361b
mov rax, r15
inc rax
cmp word [rdx + rax*2], 0
jne 0x180003611
mov r8d, eax
lea rcx, [rsp + 0x58]
call fcn.180004be0
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rdi
call fcn.18000d924
jmp 0x180003546
mov qword [rsp + 0x70], r12
lea rax, [rbp - 0x58]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1800036d2
mov rdi, qword [rsp + 0x70]
mov rax, r15
nop word [rax + rax]
lea rax, [rax + 1]
cmp word [rbx + rax*2], 0
jne 0x180003690
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, str.UserSID
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rdi, rdi
je 0x1800036d2
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc rsi
cmp rsi, 2
jne 0x1800033f0
lea rcx, [rbx - 0x18]
call fcn.180001660
add rax, 0x18
mov qword [r13], rax
lock xadd dword [rbx - 8], r15d
sub r15d, 1
jg 0x18000370a
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
lea rdx, [rbx - 0x18]
call qword [rax + 8]
mov rax, r13
mov rcx, qword [rbp + 0x430]
xor rcx, rsp
call fcn.180009290
mov rbx, qword [rsp + 0x580]
add rsp, 0x540
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80070057
call fcn.180001600
nop
mov ecx, 0x80004005
call fcn.180001600
nop
mov ecx, 0x80070057
call fcn.180001600
int3
mov ecx, 0x80070057
call fcn.180001600
int3
mov ecx, 0x80070057
call fcn.180001600
nop
mov ecx, 0x80004005
call fcn.180001600
nop
mov ecx, 0x80070057
call fcn.180001600
int3