Function at 0x1400341b0
Capabilities:
Impersonate user
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x90
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
xor esi, esi
mov dword [rsp + 0xc8], esi
mov qword [r11 - 0x80], 0xffffffff80000001
xor ebx, ebx
mov dword [r11 + 0x20], 1
mov byte [rsp + 0x30], bl
xor eax, eax
mov dword [rsp + 0x31], eax
mov dword [r11 + 0x18], 5
xor edi, edi
xor r14d, r14d
mov edx, ecx
lea rcx, [0x1400e0890]
call fcn.14003a760
test rax, rax
je 0x1400344bf
mov rcx, rax
call fcn.140047180
bt eax, 0x16
jae 0x14003437f
mov ecx, 0x104
call fcn.14007de00
mov rdi, rax
test rax, rax
je 0x14003436e
xor edx, edx
mov r8d, 0x104
mov rcx, rax
call fcn.14007cd30
xor r11d, r11d
mov qword [rsp + 0x50], r11
mov qword [rsp + 0x58], r11
mov qword [rsp + 0x60], r11
mov qword [rsp + 0x68], r11
mov qword [rsp + 0x70], r11
mov qword [rsp + 0x78], r11
mov qword [rsp + 0x80], r11
mov qword [rsp + 0xc8], r11
mov rdx, rdi
lea rcx, [rsp + 0xc8]
call fcn.14002ece0
test eax, eax
jne 0x1400342a6
lea rcx, str.ImpersonateTheUser__GetCurrentUserInfo_failed
call fcn.14000cbb0
jmp 0x140034356
mov rbx, qword [rsp + 0xc8]
test rbx, rbx
jne 0x1400342c4
lea rcx, str.ImpersonateTheUser__GetCurrentUserInfo_returns_NULL_hToken
call fcn.14000cbb0
jmp 0x14003437f
mov dword [rsp + 0x50], 0x38
mov qword [rsp + 0x58], rdi
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.USERENV.dll_LoadUserProfileA]
test eax, eax
jne 0x140034302
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Fail_to_LoadUserProfile___d
call fcn.14000cbb0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140034356
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x140034330
lea rcx, str.ImpersonateLoggedOnUser_success_n
call fcn.14000cbb0
mov r14d, 1
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x38], rax
jmp 0x14003437f
lea rcx, str.Fail_to_impersonate
call fcn.14000cbb0
mov rdx, qword [rsp + 0x80]
mov rcx, rbx
call qword [sym.imp.USERENV.dll_UnloadUserProfile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.IsSetModeAfterRebootNeeded__ImpersonateTheUser_failed_n
call fcn.14000cbb0
jmp 0x1400344b0
lea rcx, str.IsSetModeAfterRebootNeeded__new_char__MAX_PATH__failed_n
call fcn.14000cbb0
jmp 0x1400344bd
xor r13d, r13d
lea rcx, str.IsSetModeAfterRebootNeeded__Access_Registry_n
call fcn.14000cbb0
lea r11, [rsp + 0x40]
mov qword [rsp + 0x20], r11
lea r9d, [r13 + 1]
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionControls_FolderDisplay
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov r12d, eax
test eax, eax
je 0x140034416
lea rcx, str.IsSetModeAfterRebootNeeded__impersonating_current_user_n
call fcn.14000cbb0
lea rdx, [rsp + 0x38]
mov ecx, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
test eax, eax
jne 0x140034403
mov r13d, 1
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, r13d
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionControls_FolderDisplay
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov r12d, eax
test r12d, r12d
je 0x140034416
lea rcx, str.IsSetModeAfterRebootNeeded__Fail_to_get_DynaSettingsChange_n
call fcn.14000cbb0
jmp 0x14003446b
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xd8]
xor r8d, r8d
lea rdx, str.DynaSettingsChange
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140034460
lea esi, [rax + 1]
movzx eax, byte [rsp + 0x30]
cmp al, 0x31
je 0x14003445e
cmp al, 0x33
jne 0x140034460
xor esi, esi
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r13d, r13d
je 0x14003447b
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r14d, r14d
je 0x1400344b0
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
test eax, eax
jne 0x140034496
lea rcx, str.__Failed_to_revert_
call fcn.14000cbb0
mov rdx, qword [rsp + 0x80]
mov rcx, rbx
call qword [sym.imp.USERENV.dll_UnloadUserProfile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rdi, rdi
je 0x1400344bd
mov rcx, rdi
call fcn.14007ddf8
mov eax, esi
mov rbx, qword [rsp + 0xc0]
add rsp, 0x90
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret