MSNightmare/LegacyHive ? reverse-engineered prompt

I want a Windows only security research tool for the LegacyHive issue that helps me verify in a lab whether a machine is affected, without turning it into a general purpose privilege escalation or hive loading utility.

It should take test account details I provide, check whether another user’s usrclass.dat could end up mounted under the current user classes root, and then clearly log what happened, what registry location was involved, and whether the behavior matches the vulnerability. Please keep it stripped down, with strong safety checks, obvious cleanup, and guardrails so it only works with lab accounts and bails out on anything unexpected.

Also give me simple build and run instructions, basic usage help, and comments in the code so I can follow what it’s doing. Look up current Windows docs online if you need to.