Function at 0x1800c1550
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x590
mov qword [rsp + 0x568], 0xfffffffffffffffe
mov rax, qword [0x18021dd90]
xor rax, rsp
mov qword [rsp + 0x580], rax
cmp qword [rsp + 0x5c8], 0
je 0x1800c15a3
mov rax, qword [rsp + 0x5c8]
mov dword [rax], 0
cmp qword [rsp + 0x5a8], 0
je 0x1800c15b9
cmp qword [rsp + 0x5b8], 0
jne 0x1800c15c0
xor eax, eax
jmp 0x1800c1ebc
lea rcx, [0x1802386e0]
call fcn.1800d4dd0
test eax, eax
je 0x1800c1637
lea rcx, [rsp + 0x6c]
call fcn.1800e5040
nop
mov eax, dword [rsp + 0x5c0]
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x5b8]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x5b0]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x5a8]
mov qword [rsp + 0x20], rax
lea r9, str.CTSandboxMgr::InitSandboxRegistry_Class__s__Instance__s__RegFile__s__bRegUseIndex__lu__begin
lea r8, str.InitReg
mov edx, 8
lea rcx, [0x1802386e8]
call fcn.1800db240
nop
lea rcx, [rsp + 0x6c]
call fcn.1800e5070
mov dword [rsp + 0x68], 0
mov qword [rsp + 0x60], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x60]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
cmp qword [rsp + 0x60], 0
je 0x1800c1dbc
mov r8d, 1
lea rdx, str.SeBackupPrivilege
mov rcx, qword [rsp + 0x60]
call fcn.180001b30
mov r8d, 1
lea rdx, str.SeRestorePrivilege
mov rcx, qword [rsp + 0x60]
call fcn.180001b30
lea rdx, [0x1801a6e60]
lea rcx, [rsp + 0x78]
call fcn.1800e9640
nop
mov r8, qword [rsp + 0x5a8]
lea rdx, str.TSandbox__s
lea rcx, [rsp + 0x78]
call fcn.1800e6ce0
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x538], rax
mov r8, qword [rsp + 0x5b8]
mov rdx, qword [rsp + 0x538]
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
mov dword [rsp + 0x70], eax
cmp dword [rsp + 0x70], 0
je 0x1800c1776
lea rcx, [0x1802386e0]
call fcn.1800d4dd0
test eax, eax
je 0x1800c174e
lea rcx, [rsp + 0x80]
call fcn.1800e5040
nop
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x20], eax
lea r9, str.CTSandboxMgr::InitSandboxRegistry_RegLoadKeyW_Fail__err__lu_
lea r8, str.InitReg
mov edx, 8
lea rcx, [0x1802386e8]
call fcn.1800db240
nop
lea rcx, [rsp + 0x80]
call fcn.1800e5070
cmp qword [rsp + 0x5c8], 0
je 0x1800c1767
mov rax, qword [rsp + 0x5c8]
mov ecx, dword [rsp + 0x70]
mov dword [rax], ecx
lea rcx, [rsp + 0x78]
call fcn.1800e5c00
jmp 0x1800c1d87
mov dword [rsp + 0x68], 1
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x540], rax
call fcn.1800f67e0
mov r9, rax
mov r8d, 4
mov rdx, qword [rsp + 0x540]
mov rcx, 0xffffffff80000003
call fcn.180001e10
mov dword [rsp + 0x70], eax
cmp dword [rsp + 0x70], 0
je 0x1800c1815
lea rcx, [0x1802386e0]
call fcn.1800d4dd0
test eax, eax
je 0x1800c1815
lea rcx, [rsp + 0x84]
call fcn.1800e5040
nop
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
lea r9, str.CTSandboxMgr::InitSandboxRegistry_SetKeySecurity_Fail__strSubKey__s__err__lu_
lea r8, str.InitReg
mov edx, 8
lea rcx, [0x1802386e8]
call fcn.1800db240
nop
lea rcx, [rsp + 0x84]
call fcn.1800e5070
cmp qword [rsp + 0x5b0], 0
je 0x1800c1843
lea rdx, [0x1801b4ff8]
lea rcx, [rsp + 0x78]
call fcn.1800e5f20
mov rdx, qword [rsp + 0x5b0]
lea rcx, [rsp + 0x78]
call fcn.1800e5f20
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x548], rax
call fcn.1800f67e0
mov r9, rax
mov r8d, 4
mov rdx, qword [rsp + 0x548]
mov rcx, 0xffffffff80000003
call fcn.180001e10
mov dword [rsp + 0x70], eax
cmp dword [rsp + 0x70], 0
je 0x1800c18da
lea rcx, [0x1802386e0]
call fcn.1800d4dd0
test eax, eax
je 0x1800c18da
lea rcx, [rsp + 0x88]
call fcn.1800e5040
nop
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
lea r9, str.CTSandboxMgr::InitSandboxRegistry_SetKeySecurity_Fail__strSubKey__s__err__lu_
lea r8, str.InitReg
mov edx, 8
lea rcx, [0x1802386e8]
call fcn.1800db240
nop
lea rcx, [rsp + 0x88]
call fcn.1800e5070
cmp dword [rsp + 0x5c0], 0
jne 0x1800c1d73
lea r8, str.USER
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x90]
call fcn.1800e9930
nop
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x550], rax
mov r9, qword [rsp + 0x550]
mov r8, 0xffffffff80000003
xor edx, edx
mov rcx, 0xffffffff80000003
call fcn.180001f30
mov dword [rsp + 0x70], eax
cmp dword [rsp + 0x70], 0
je 0x1800c198d
lea rcx, [0x1802386e0]
call fcn.1800d4dd0
test eax, eax
je 0x1800c198d
lea rcx, [rsp + 0xa0]
call fcn.1800e5040
nop
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x20], eax
lea r9, str.CTSandboxMgr::InitSandboxRegistry_CopyKeySecurity_HKEY_USERS_Fail__err__lu_
lea r8, str.InitReg
mov edx, 8
lea rcx, [0x1802386e8]
call fcn.1800db240
nop
lea rcx, [rsp + 0xa0]
call fcn.1800e5070
lea r8, str.MACHINE
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x98]
call fcn.1800e9930
nop
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x558], rax
mov r9, qword [rsp + 0x558]
mov r8, 0xffffffff80000003
xor edx, edx
mov rcx, 0xffffffff80000002
call fcn.180001f30
mov dword [rsp + 0x70], eax
cmp dword [rsp + 0x70], 0
je 0x1800c1a32
lea rcx, [0x1802386e0]
call fcn.1800d4dd0
test eax, eax
je 0x1800c1a32
lea rcx, [rsp + 0xa4]
call fcn.1800e5040
nop
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x20], eax
lea r9, str.CTSandboxMgr::InitSandboxRegistry_CopyKeySecurity_HKEY_LOCAL_MACHINE_Fail__err__lu_
lea r8, str.InitReg
mov edx, 8
lea rcx, [0x1802386e8]
call fcn.1800db240
nop
lea rcx, [rsp + 0xa4]
call fcn.1800e5070
xor eax, eax
mov word [rsp + 0xd0], ax
lea rax, [rsp + 0xd2]
mov rdi, rax
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
mov dword [rsp + 0xb0], 0x104
mov dword [rsp + 0xb8], 0
mov dword [rsp + 0x2e0], 0
mov dword [rsp + 0xac], 0
mov dword [rsp + 0x2f4], 0
mov dword [rsp + 0x2f0], 0
mov dword [rsp + 0xb4], 0
mov dword [rsp + 0xa8], 0
mov dword [rsp + 0x2e8], 0
lea rax, [rsp + 0x2ec]
mov rdi, rax
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
lea rax, [rsp + 0x2e8]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0xb4]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x2f0]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x2f4]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xac]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x2e0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rsp + 0xb0]
lea rdx, [rsp + 0xd0]
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov dword [rsp + 0x70], eax
cmp dword [rsp + 0x70], 0
jne 0x1800c1d4d
xor eax, eax
mov word [rsp + 0x300], ax
lea rax, [rsp + 0x302]
mov rdi, rax
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
mov dword [rsp + 0x2f8], 0
mov dword [rsp + 0x2f8], 0
jmp 0x1800c1ba4
mov eax, dword [rsp + 0x2f8]
inc eax
mov dword [rsp + 0x2f8], eax
mov eax, dword [rsp + 0xb8]
cmp dword [rsp + 0x2f8], eax
jae 0x1800c1d4d
mov dword [rsp + 0x510], 0x104
lea rax, [rsp + 0x2e8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x510]
lea r8, [rsp + 0x300]
mov edx, dword [rsp + 0x2f8]
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [rsp + 0x70], eax
cmp dword [rsp + 0x70], 0
jne 0x1800c1d48
mov r8d, 9
lea rdx, str.TSandbox_
lea rcx, [rsp + 0x300]
call fcn.1800fb284
test eax, eax
je 0x1800c1d48
lea r8, str.USER_
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x530]
call fcn.1800e9930
mov qword [rsp + 0x570], rax
mov rax, qword [rsp + 0x570]
mov qword [rsp + 0x578], rax
lea r8, [rsp + 0x300]
mov rdx, qword [rsp + 0x578]
lea rcx, [rsp + 0x518]
call fcn.1800e9930
nop
lea rcx, [rsp + 0x530]
call fcn.1800e5c00
mov rax, qword [rsp + 0x518]
mov qword [rsp + 0x560], rax
mov r9, qword [rsp + 0x560]
mov r8, 0xffffffff80000003
lea rdx, [rsp + 0x300]
mov rcx, 0xffffffff80000003
call fcn.180001f30
mov dword [rsp + 0x70], eax
cmp dword [rsp + 0x70], 0
je 0x1800c1d3b
lea rcx, [0x1802386e0]
call fcn.1800d4dd0
test eax, eax
je 0x1800c1d3b
lea rcx, [rsp + 0x520]
call fcn.1800e5040
nop
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x518]
mov qword [rsp + 0x20], rax
lea r9, str.CTSandboxMgr::InitSandboxRegistry_CopyKeySecurity_HKEY_USERS_Fail__strKeyUserSub__s__err__lu_
lea r8, str.InitReg
mov edx, 8
lea rcx, [0x1802386e8]
call fcn.1800db240
nop
lea rcx, [rsp + 0x520]
call fcn.1800e5070
nop
lea rcx, [rsp + 0x518]
call fcn.1800e5c00
jmp 0x1800c1b94
xor eax, eax
test eax, eax
jne 0x1800c1a32
lea rcx, [rsp + 0x98]
call fcn.1800e5c00
nop
lea rcx, [rsp + 0x90]
call fcn.1800e5c00
nop
lea rcx, [rsp + 0x78]
call fcn.1800e5c00
xor eax, eax
test eax, eax
jne 0x1800c169b
xor r8d, r8d
lea rdx, str.SeBackupPrivilege
mov rcx, qword [rsp + 0x60]
call fcn.180001b30
xor r8d, r8d
lea rdx, str.SeRestorePrivilege
mov rcx, qword [rsp + 0x60]
call fcn.180001b30
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800c1e3b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x524], eax
cmp qword [rsp + 0x5c8], 0
je 0x1800c1de5
mov rax, qword [rsp + 0x5c8]
mov ecx, dword [rsp + 0x524]
mov dword [rax], ecx
lea rcx, [0x1802386e0]
call fcn.1800d4dd0
test eax, eax
je 0x1800c1e3b
lea rcx, [rsp + 0x528]
call fcn.1800e5040
nop
mov eax, dword [rsp + 0x524]
mov dword [rsp + 0x20], eax
lea r9, str.CTSandboxMgr::InitSandboxRegistry_OpenProcessToken_fail_dwErr__lu_
lea r8, str.InitReg
mov edx, 8
lea rcx, [0x1802386e8]
call fcn.1800db240
nop
lea rcx, [rsp + 0x528]
call fcn.1800e5070
lea rcx, [0x1802386e0]
call fcn.1800d4dd0
test eax, eax
je 0x1800c1eb8
lea rcx, [rsp + 0x52c]
call fcn.1800e5040
nop
mov eax, dword [rsp + 0x5c0]
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x5b8]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x5b0]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x5a8]
mov qword [rsp + 0x20], rax
lea r9, str.CTSandboxMgr::InitSandboxRegistry_Class__s__Instance__s__RegFile__s__bRegUseIndex__lu__end
lea r8, str.InitReg
mov edx, 8
lea rcx, [0x1802386e8]
call fcn.1800db240
nop
lea rcx, [rsp + 0x52c]
call fcn.1800e5070
mov eax, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x580]
xor rcx, rsp
call fcn.1800f98f0
add rsp, 0x590
pop rdi
ret