Function at 0x3407dfee
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x3413f8bd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x494
push edi
mov dword [ebp - 0x498], ecx
cmp dword [ebp + 0x18], 0
je 0x3407e022
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
cmp dword [ebp + 8], 0
je 0x3407e02e
cmp dword [ebp + 0x10], 0
jne 0x3407e035
xor eax, eax
jmp 0x3407e722
mov ecx, 0x341a3e58
call fcn.3408c1f3
test eax, eax
je 0x3407e08a
lea ecx, [ebp - 0x18]
call fcn.340994ba
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push str.CTSandboxMgr::InitSandboxRegistry_Class__s__Instance__s__RegFile__s__bRegUseIndex__lu__begin
push 0x34189788
push 8
push 0x341a3e5c
call fcn.34090e9e
add esp, 0x20
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.340994e1
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
lea edx, [ebp - 0x14]
push edx
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
cmp dword [ebp - 0x14], 0
je 0x3407e655
push 1
push 0x34189798
mov eax, dword [ebp - 0x14]
push eax
call fcn.340018c8
add esp, 0xc
push 1
push 0x341897bc
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.340018c8
add esp, 0xc
push 0x341a3cc8
lea ecx, [ebp - 0x1c]
call fcn.340a6b90
mov dword [ebp - 4], 1
mov edx, dword [ebp + 8]
push edx
push str.TSandbox__s
lea eax, [ebp - 0x1c]
push eax
call fcn.340aa2b0
add esp, 0xc
mov ecx, dword [ebp + 0x10]
push ecx
lea ecx, [ebp - 0x1c]
call fcn.340020c0
push eax
push reloc.WS2_32.dll_closesocket
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x3407e18a
mov ecx, 0x341a3e58
call fcn.3408c1f3
test eax, eax
je 0x3407e168
lea ecx, [ebp - 0x24]
call fcn.340994ba
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x20]
push edx
push str.CTSandboxMgr::InitSandboxRegistry_RegLoadKeyW_Fail__err__lu_
push 0x34189878
push 8
push 0x341a3e5c
call fcn.34090e9e
add esp, 0x14
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x24]
call fcn.340994e1
cmp dword [ebp + 0x18], 0
je 0x3407e176
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.340a7330
jmp 0x3407e623
mov dword [ebp - 0x10], 1
call fcn.340bb0b0
push eax
push 4
lea ecx, [ebp - 0x1c]
call fcn.340020c0
push eax
push reloc.WS2_32.dll_closesocket
call fcn.34001ad7
add esp, 0x10
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x3407e1ff
mov ecx, 0x341a3e58
call fcn.3408c1f3
test eax, eax
je 0x3407e1ff
lea ecx, [ebp - 0x28]
call fcn.340994ba
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x1c]
push eax
push str.CTSandboxMgr::InitSandboxRegistry_SetKeySecurity_Fail__strSubKey__s__err__lu_
push 0x34189924
push 8
push 0x341a3e5c
call fcn.34090e9e
add esp, 0x18
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.340994e1
cmp dword [ebp + 0xc], 0
je 0x3407e21e
push 0x34189934
lea ecx, [ebp - 0x1c]
call fcn.340a7f80
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x1c]
call fcn.340a7f80
call fcn.340bb0b0
push eax
push 4
lea ecx, [ebp - 0x1c]
call fcn.340020c0
push eax
push reloc.WS2_32.dll_closesocket
call fcn.34001ad7
add esp, 0x10
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x3407e28c
mov ecx, 0x341a3e58
call fcn.3408c1f3
test eax, eax
je 0x3407e28c
lea ecx, [ebp - 0x2c]
call fcn.340994ba
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x1c]
push eax
push 0x34189938
push 0x341899d4
push 8
push 0x341a3e5c
call fcn.34090e9e
add esp, 0x18
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.340994e1
cmp dword [ebp + 0x14], 0
jne 0x3407e60a
push str.USER
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x34]
push edx
call fcn.340a7aa0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x34]
call fcn.340020c0
push eax
push reloc.WS2_32.dll_closesocket
push 0
push reloc.WS2_32.dll_closesocket
call fcn.34001b77
add esp, 0x10
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x3407e315
mov ecx, 0x341a3e58
call fcn.3408c1f3
test eax, eax
je 0x3407e315
lea ecx, [ebp - 0x38]
call fcn.340994ba
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x20]
push eax
push str.CTSandboxMgr::InitSandboxRegistry_CopyKeySecurity_HKEY_USERS_Fail__err__lu_
push 0x34189a88
push 8
push 0x341a3e5c
call fcn.34090e9e
add esp, 0x14
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x38]
call fcn.340994e1
push str.MACHINE
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x30]
push edx
call fcn.340a7aa0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x30]
call fcn.340020c0
push eax
push reloc.WS2_32.dll_closesocket
push 0
push reloc.WS2_32.dll_bind
call fcn.34001b77
add esp, 0x10
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x3407e394
mov ecx, 0x341a3e58
call fcn.3408c1f3
test eax, eax
je 0x3407e394
lea ecx, [ebp - 0x3c]
call fcn.340994ba
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x20]
push eax
push str.CTSandboxMgr::InitSandboxRegistry_CopyKeySecurity_HKEY_LOCAL_MACHINE_Fail__err__lu_
push 0x34189b54
push 8
push 0x341a3e5c
call fcn.34090e9e
add esp, 0x14
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x3c]
call fcn.340994e1
mov word [ebp - 0x258], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x256]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 0x25c], 0x104
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x264], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x260], 0
mov dword [ebp - 0x26c], 0
xor ecx, ecx
mov dword [ebp - 0x268], ecx
lea edx, [ebp - 0x26c]
push edx
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x40]
push ecx
lea edx, [ebp - 0x4c]
push edx
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x264]
push ecx
lea edx, [ebp - 0x50]
push edx
lea eax, [ebp - 0x48]
push eax
push 0
lea ecx, [ebp - 0x25c]
push ecx
lea edx, [ebp - 0x258]
push edx
push reloc.WS2_32.dll_closesocket
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x3407e5e8
mov word [ebp - 0x474], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x472]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 0x478], 0
mov dword [ebp - 0x478], 0
jmp 0x3407e491
mov eax, dword [ebp - 0x478]
add eax, 1
mov dword [ebp - 0x478], eax
mov ecx, dword [ebp - 0x478]
cmp ecx, dword [ebp - 0x48]
jae 0x3407e5e8
mov dword [ebp - 0x47c], 0x104
lea edx, [ebp - 0x26c]
push edx
push 0
push 0
push 0
lea eax, [ebp - 0x47c]
push eax
lea ecx, [ebp - 0x474]
push ecx
mov edx, dword [ebp - 0x478]
push edx
push reloc.WS2_32.dll_closesocket
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x3407e5e3
push 9
push str.TSandbox_
lea eax, [ebp - 0x474]
push eax
call fcn.340bdc7c
add esp, 0xc
test eax, eax
je 0x3407e5e3
lea ecx, [ebp - 0x474]
push ecx
push str.USER_
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x494]
push eax
call fcn.340a7aa0
mov dword [ebp - 0x49c], eax
mov ecx, dword [ebp - 0x49c]
mov dword [ebp - 0x4a0], ecx
mov byte [ebp - 4], 9
mov edx, dword [ebp - 0x4a0]
push edx
lea eax, [ebp - 0x480]
push eax
call fcn.340a7aa0
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x494]
call fcn.340a7330
lea ecx, [ebp - 0x480]
call fcn.340020c0
push eax
push reloc.WS2_32.dll_closesocket
lea ecx, [ebp - 0x474]
push ecx
push reloc.WS2_32.dll_closesocket
call fcn.34001b77
add esp, 0x10
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x3407e5d4
mov ecx, 0x341a3e58
call fcn.3408c1f3
test eax, eax
je 0x3407e5d4
lea ecx, [ebp - 0x484]
call fcn.340994ba
mov byte [ebp - 4], 0xc
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x480]
push eax
push str.CTSandboxMgr::InitSandboxRegistry_CopyKeySecurity_HKEY_USERS_Fail__strKeyUserSub__s__err__lu_
push 0x34189c44
push 8
push 0x341a3e5c
call fcn.34090e9e
add esp, 0x18
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x484]
call fcn.340994e1
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x480]
call fcn.340a7330
jmp 0x3407e482
xor ecx, ecx
test ecx, ecx
jne 0x3407e394
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x30]
call fcn.340a7330
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x34]
call fcn.340a7330
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.340a7330
xor edx, edx
test edx, edx
jne 0x3407e0db
push 0
push 0x34189c54
mov eax, dword [ebp - 0x14]
push eax
call fcn.340018c8
add esp, 0xc
push 0
push 0x34189c78
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.340018c8
add esp, 0xc
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x3407e6c4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x488], eax
cmp dword [ebp + 0x18], 0
je 0x3407e672
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp - 0x488]
mov dword [eax], ecx
mov ecx, 0x341a3e58
call fcn.3408c1f3
test eax, eax
je 0x3407e6c4
lea ecx, [ebp - 0x48c]
call fcn.340994ba
mov dword [ebp - 4], 0xd
mov edx, dword [ebp - 0x488]
push edx
push str.CTSandboxMgr::InitSandboxRegistry_OpenProcessToken_fail_dwErr__lu_
push 0x34189d28
push 8
push 0x341a3e5c
call fcn.34090e9e
add esp, 0x14
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48c]
call fcn.340994e1
mov ecx, 0x341a3e58
call fcn.3408c1f3
test eax, eax
je 0x3407e71f
lea ecx, [ebp - 0x490]
call fcn.340994ba
mov dword [ebp - 4], 0xe
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push str.CTSandboxMgr::InitSandboxRegistry_Class__s__Instance__s__RegFile__s__bRegUseIndex__lu__end
push 0x34189df0
push 8
push 0x341a3e5c
call fcn.34090e9e
add esp, 0x20
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x490]
call fcn.340994e1
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
mov esp, ebp
pop ebp
ret 0x14