RegLoadAppKey is documented to load keys in a location which can't be enumerated and also non-guessable. However it's possible to enumerate loaded hives and find ones which can be written to which might lead to elevation of privilege.
50c93d6edf7373f14720ed5465ad2648ccee020f4b5cd9cc0c2668913eeff08c