Function at 0x180066020
Capabilities:
Impersonate user
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2fc8]
mov eax, 0x30c8
call fcn.18006ece0
sub rsp, rax
mov rbx, qword [rbp + 0x3028]
lea eax, [rcx + 0x6c1]
mov dword [rsp + 0x74], eax
mov rsi, r8
mov rdi, rdx
mov r13d, ecx
cmp ecx, eax
jae case.0x1800660c7.148
mov r12, qword [rbp + 0x3028]
lea r8, [0x180000000]
mov r15, qword [rbp + 0x3028]
mov edx, 1
lea r9d, [rdx + 1]
xor r14d, r14d
cmp r13d, 0x19c
ja 0x1800662e4
je 0x180066248
lea eax, [r13 - 0x8b]
cmp eax, 0xfb
ja case.0x18006630a.422
movzx eax, byte [r8 + rax + 0x668e8]
mov ecx, dword [r8 + rax*4 + 0x668bc]
add rcx, r8
jmp rcx
mov rax, qword [0x1800d5920]
lea rcx, [rsp + 0x50]
xor edx, edx
mov qword [rsp + 0x50], rax
mov r8d, 0x10b
mov qword [rsp + 0x78], r14
call fcn.180037720
mov edx, 1
test rax, rax
jne 0x180066845
mov rax, qword [rsi]
mov edi, edx
mov qword [rsp + 0x78], rdx
test rax, rax
je 0x180066845
nop dword [rax]
mov rax, qword [rax + 0x18]
inc rdi
test rax, rax
jne 0x180066110
mov qword [rsp + 0x78], rdi
jmp 0x180066845
mov qword [rbp - 0x60], r14
jmp case.0x18006630a.422
mov rbx, qword [rsp + 0x78]
jmp case.0x18006630a.422
xor edx, edx
lea rcx, [rbp - 0x40]
mov r8d, 0x800
call fcn.180070440
lea rcx, [rbp + 0x1fc0]
mov r8d, 0x800
lea rdx, [rbp - 0x40]
call fcn.180070030
xor edx, edx
lea rcx, [rbp - 0x40]
mov r8d, 0x800
call fcn.180070440
lea rcx, [rbp + 0x17c0]
mov r8d, 0x800
lea rdx, [rbp - 0x40]
call fcn.180070030
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, 1
lea r9, [rsp + 0x50]
mov word [rbp + 0x3010], ax
lea rdx, [rbp + 0x3010]
mov rax, qword [rsi]
lea rcx, [rbp + 0x27c0]
mov r8d, 0x10c
mov qword [rsp + 0x50], rax
call fcn.180059270
jmp 0x180066840
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r14
mov qword [rbp - 0x78], r14
jmp case.0x18006630a.422
xor edx, edx
lea rcx, [rbp + 0x7c0]
mov r8d, 0x800
call fcn.180070440
xor edx, edx
lea rcx, [rbp + 0xfc0]
mov r8d, 0x800
call fcn.180070440
jmp 0x180066840
mov r12, r14
mov r15, r14
jmp case.0x18006630a.422
xor edx, edx
mov qword [rbp - 0x80], r14
mov r8d, 0x800
mov dword [rbp + 0x3028], r14d
lea rcx, [rbp - 0x40]
call fcn.180070440
lea rcx, [rbp + 0x27c0]
mov r8d, 0x800
lea rdx, [rbp - 0x40]
call fcn.180070030
jmp 0x180066840
mov rax, qword [rsi]
lea r9, [rbp + 0x3010]
mov word [rbp + 0x3010], dx
lea rcx, [rsp + 0x60]
xor edx, edx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x20], r14
lea r8d, [rdx + 0x28]
call fcn.180068730
movsxd rdi, eax
lea r9, [rsp + 0x50]
mov eax, 2
mov qword [rsp + 0x60], rdi
mov word [rbp + 0x3010], ax
lea rdx, [rbp + 0x3010]
mov rax, qword [rsi]
lea rcx, [rbp + 0x7c0]
mov r8d, 0x10c
mov qword [rsp + 0x50], rax
call fcn.180059270
mov rax, qword [rsi]
lea r9, [rsp + 0x50]
mov edi, 3
mov qword [rsp + 0x50], rax
mov r8d, 0x10c
mov word [rbp + 0x3010], di
lea rdx, [rbp + 0x3010]
lea rcx, [rbp + 0xfc0]
call fcn.180059270
jmp 0x180066840
lea eax, [r13 - 0x19f]
cmp eax, 0xb6
ja case.0x18006630a.422
movzx eax, byte [r8 + rax + 0x66a04]
mov ecx, dword [r8 + rax*4 + 0x669e4]
add rcx, r8
jmp rcx
mov rax, qword [rsp + 0x60]
lea rcx, [rsp + 0x50]
xor edx, edx
mov qword [rsp + 0x50], rax
lea r8d, [rdx + 0x12]
call fcn.180014600
lea rcx, [rbp - 0x78]
mov r9d, 0x20019
mov qword [rsp + 0x20], rcx
lea rdx, [rbp + 0x7c0]
mov rcx, rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180066840
mov rcx, qword [rbp - 0x78]
lea r9, [rsp + 0x70]
mov qword [rsp + 0x28], r14
lea rdx, [rbp + 0xfc0]
xor r8d, r8d
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180066840
mov eax, dword [rsp + 0x70]
lea rdx, [rsp + 0x68]
mov ecx, 0xb0
mov qword [rsp + 0x68], rax
call fcn.180027a20
mov qword [rsp + 0x68], rax
jmp 0x180066840
mov rax, qword [rsi]
lea rdx, [rbp + 0x3010]
mov word [rbp + 0x3010], r9w
lea rcx, [rbp + 0x1fc0]
lea r9, [rbp + 0x3028]
mov qword [rbp + 0x3028], rax
mov r8d, 0x10c
call fcn.180059270
mov rax, qword [rsi]
lea r9, [rbp + 0x3028]
mov edi, 3
mov qword [rbp + 0x3028], rax
mov r8d, 0x10c
mov word [rbp + 0x3010], di
lea rdx, [rbp + 0x3010]
lea rcx, [rbp + 0x17c0]
call fcn.180059270
lea rax, [rbp - 0x80]
mov r9d, edi
mov qword [rsp + 0x28], rax
lea r8, [rbp + 0x17c0]
lea rdx, [rbp + 0x1fc0]
mov dword [rsp + 0x20], r14d
lea rcx, [rbp + 0x27c0]
call qword [sym.imp.ADVAPI32.dll_LogonUserW]
mov dword [rbp + 0x3028], eax
jmp 0x180066840
mov rax, qword [rsi]
lea rcx, [rsp + 0x50]
xor edx, edx
mov word [rbp + 0x3010], r9w
lea r9, [rbp + 0x3010]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x20], r14
lea r8d, [rdx + 0x28]
call fcn.180068730
cmp dword [rdi], 0
movsxd r14, eax
mov qword [rsp + 0x58], r14
je 0x1800664ac
mov rax, qword [rbp - 0x58]
xor r9d, r9d
mov dword [rbp + 0x3010], eax
xor r8d, r8d
lea rax, [rbp + 0x3010]
xor edx, edx
mov qword [rsp + 0x28], rax
mov ecx, 0xb4
mov qword [rsp + 0x20], r9
call fcn.180052ca0
mov rsi, rax
mov qword [rsp + 0x50], rax
jmp 0x1800664b5
mov rsi, qword [rbp - 0x58]
mov qword [rsp + 0x50], rsi
mov rcx, rsi
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x180066840
mov edi, 0x7c
nop dword [rax + rax]
cmp edi, 0x235
ja 0x1800666e5
je 0x1800665cc
cmp edi, 0x7c
je 0x1800665a4
cmp edi, 0x10f
je 0x18006655f
cmp edi, 0x1a2
jne 0x180066790
bt r14, 0xa
jae 0x18006652a
xor edx, edx
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetSystemMenu]
test rax, rax
je 0x18006652a
mov edx, 0xf060
mov r8d, 1
mov rcx, rax
call qword [sym.imp.USER32.dll_EnableMenuItem]
bt r14, 0xb
jae 0x180066790
xor edx, edx
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetSystemMenu]
test rax, rax
je 0x180066790
xor r8d, r8d
mov edx, 0xf060
mov rcx, rax
call qword [sym.imp.USER32.dll_EnableMenuItem]
jmp 0x180066790
mov rcx, r15
movzx eax, r14b
bts rcx, 0x11
and al, 0x80
mov rax, r14
cmove rcx, r15
and eax, 0x100
mov rdx, rcx
btr rdx, 0x10
test rax, rax
mov rax, r14
cmove rdx, rcx
and eax, 0x200
mov r15, rdx
bts r15, 0x10
test rax, rax
cmove r15, rdx
jmp 0x180066790
mov edx, 0xfffffff0
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowLongW]
movsxd r12, eax
movzx eax, r14b
mov r15, r12
btr r15, 0x11
and al, 0x40
cmove r15, r12
jmp 0x180066790
bt r14, 0xc
jae 0x180066790
cmp qword [0x1800c5708], 0
je 0x180066870
cmp qword [0x1800c5388], 0
jne 0x180066605
mov r9d, 0xfa
lea r8, [0x1800c5388]
xor edx, edx
xor ecx, ecx
call fcn.180012ac0
xor ecx, ecx
lea r8, [rbp - 0x60]
mov eax, 1
mov qword [rbp - 0x70], rcx
mov qword [rbp - 0x68], rax
mov r9d, 0x86
lea rax, [rsp + 0x50]
xor edx, edx
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x38], rax
lea rax, [0x1800c5388]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp - 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
call fcn.180061fc0
test eax, eax
jne 0x180066790
xor r9d, r9d
mov dword [rsp + 0x20], 0x105
xor r8d, r8d
lea rcx, [0x1800c5388]
xor edx, edx
call fcn.18000eda0
mov qword [rbp - 0x60], rax
mov rdx, rax
test rax, rax
je 0x180066870
xor r9d, r9d
mov r8d, 0x95
lea r14d, [r9 + 1]
nop word [rax + rax]
mov ecx, r8d
sub ecx, 0x95
je 0x1800666c8
sub ecx, r14d
je 0x1800666c2
cmp ecx, r14d
jne 0x1800666cf
mov rax, qword [0x1800c5708]
mov qword [rdx + 8], rax
jmp 0x1800666cf
mov qword [rdx + 0x10], r9
jmp 0x1800666cf
mov qword [rdx], rsi
mov qword [rdx + 0x18], r14
inc r8d
cmp r8d, 0x98
jb 0x1800666a0
mov r14, qword [rsp + 0x58]
jmp 0x180066790
cmp edi, 0x2c8
je 0x180066740
cmp edi, 0x35b
jne 0x180066790
cmp r15, r12
je 0x180066790
mov r8d, r15d
mov edx, 0xfffffff0
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetWindowLongW]
test eax, eax
je 0x180066870
xor eax, eax
mov dword [rsp + 0x30], 0x27
mov dword [rsp + 0x28], eax
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], eax
xor edx, edx
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x180066790
bt r14, 0xd
jae 0x180066790
cmp qword [0x1800c5708], 0
je 0x180066790
cmp qword [0x1800c5388], 0
je 0x180066790
mov eax, 1
mov qword [rbp - 0x70], 0
mov qword [rbp - 0x68], rax
lea r8, [rsp + 0x50]
lea rax, [rbp - 0x68]
mov r9d, 0xa6
lea rdx, [rbp - 0x70]
mov qword [rsp + 0x20], rax
lea rcx, [0x1800c5388]
call fcn.180043740
add edi, 0x93
cmp edi, 0x3ee
jb 0x1800664d0
jmp 0x180066840
mov dword [rbp + 0x3010], r14d
jmp 0x180066821
mov rax, qword [rsi]
lea r9, [rbp + 0x3010]
mov word [rbp + 0x3010], dx
lea rcx, [rsp + 0x58]
xor edx, edx
mov qword [rbp - 0x50], r14
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x20], r14
lea r8d, [rdx + 0x28]
call fcn.180068730
cdqe
mov qword [rbp - 0x58], rax
jmp 0x180066840
mov edi, dword [rbp + 0x3028]
test edi, edi
je 0x180066804
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x180066804
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x80], r14
mov dword [rbp + 0x3010], edi
jmp 0x180066821
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, qword [rsp + 0x68]
mov dword [rbp + 0x3010], eax
mov rax, qword [rsi]
lea rdx, [rbp + 0x3010]
mov r8d, 0x92
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x58]
call fcn.18004ff10
mov edx, 1
lea r8, [0x180000000]
mov r9d, 2
add r13d, 0x5b
cmp r13d, dword [rsp + 0x74]
jae case.0x1800660c7.148
mov rsi, qword [rbp + 0x3020]
mov rdi, qword [rbp + 0x3018]
jmp 0x18006608b
mov rax, qword [rbp + 0x3020]
lea rdx, [rbp + 0x3010]
mov r8d, 0x92
mov dword [rbp + 0x3010], 0xfffffffe
lea rcx, [rbp + 0x3028]
mov rax, qword [rax]
mov qword [rbp + 0x3028], rax
call fcn.18004ff10
mov rax, rbx
add rsp, 0x30c8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret