Function at 0x1800c1dd0
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x590
mov qword [rsp + 0x568], 0xfffffffffffffffe
mov rax, qword [0x180222e50]
xor rax, rsp
mov qword [rsp + 0x580], rax
cmp qword [rsp + 0x5c8], 0
je 0x1800c1e23
mov rax, qword [rsp + 0x5c8]
mov dword [rax], 0
cmp qword [rsp + 0x5a8], 0
je 0x1800c1e39
cmp qword [rsp + 0x5b8], 0
jne 0x1800c1e40
xor eax, eax
jmp 0x1800c273c
lea rcx, [0x18023d830]
call fcn.1800d5710
test eax, eax
je 0x1800c1eb7
lea rcx, [rsp + 0x6c]
call fcn.1800e7690
nop
mov eax, dword [rsp + 0x5c0]
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x5b8]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x5b0]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x5a8]
mov qword [rsp + 0x20], rax
lea r9, str.CTSandboxMgr::InitSandboxRegistry_Class__s__Instance__s__RegFile__s__bRegUseIndex__lu__begin
lea r8, str.InitReg
mov edx, 8
lea rcx, [0x18023d838]
call fcn.1800dbb80
nop
lea rcx, [rsp + 0x6c]
call fcn.1800e76c0
mov dword [rsp + 0x68], 0
mov qword [rsp + 0x60], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x60]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
cmp qword [rsp + 0x60], 0
je 0x1800c263c
mov r8d, 1
lea rdx, str.SeBackupPrivilege
mov rcx, qword [rsp + 0x60]
call fcn.180001b30
mov r8d, 1
lea rdx, str.SeRestorePrivilege
mov rcx, qword [rsp + 0x60]
call fcn.180001b30
lea rdx, [0x1801a9e70]
lea rcx, [rsp + 0x78]
call fcn.1800ebc90
nop
mov r8, qword [rsp + 0x5a8]
lea rdx, str.TSandbox__s
lea rcx, [rsp + 0x78]
call fcn.1800e9330
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x538], rax
mov r8, qword [rsp + 0x5b8]
mov rdx, qword [rsp + 0x538]
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
mov dword [rsp + 0x70], eax
cmp dword [rsp + 0x70], 0
je 0x1800c1ff6
lea rcx, [0x18023d830]
call fcn.1800d5710
test eax, eax
je 0x1800c1fce
lea rcx, [rsp + 0x80]
call fcn.1800e7690
nop
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x20], eax
lea r9, str.CTSandboxMgr::InitSandboxRegistry_RegLoadKeyW_Fail__err__lu_
lea r8, str.InitReg
mov edx, 8
lea rcx, [0x18023d838]
call fcn.1800dbb80
nop
lea rcx, [rsp + 0x80]
call fcn.1800e76c0
cmp qword [rsp + 0x5c8], 0
je 0x1800c1fe7
mov rax, qword [rsp + 0x5c8]
mov ecx, dword [rsp + 0x70]
mov dword [rax], ecx
lea rcx, [rsp + 0x78]
call fcn.1800e8250
jmp 0x1800c2607
mov dword [rsp + 0x68], 1
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x540], rax
call fcn.1800f8e30
mov r9, rax
mov r8d, 4
mov rdx, qword [rsp + 0x540]
mov rcx, 0xffffffff80000003
call fcn.180001e10
mov dword [rsp + 0x70], eax
cmp dword [rsp + 0x70], 0
je 0x1800c2095
lea rcx, [0x18023d830]
call fcn.1800d5710
test eax, eax
je 0x1800c2095
lea rcx, [rsp + 0x84]
call fcn.1800e7690
nop
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
lea r9, str.CTSandboxMgr::InitSandboxRegistry_SetKeySecurity_Fail__strSubKey__s__err__lu_
lea r8, str.InitReg
mov edx, 8
lea rcx, [0x18023d838]
call fcn.1800dbb80
nop
lea rcx, [rsp + 0x84]
call fcn.1800e76c0
cmp qword [rsp + 0x5b0], 0
je 0x1800c20c3
lea rdx, [0x1801b8028]
lea rcx, [rsp + 0x78]
call fcn.1800e8570
mov rdx, qword [rsp + 0x5b0]
lea rcx, [rsp + 0x78]
call fcn.1800e8570
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x548], rax
call fcn.1800f8e30
mov r9, rax
mov r8d, 4
mov rdx, qword [rsp + 0x548]
mov rcx, 0xffffffff80000003
call fcn.180001e10
mov dword [rsp + 0x70], eax
cmp dword [rsp + 0x70], 0
je 0x1800c215a
lea rcx, [0x18023d830]
call fcn.1800d5710
test eax, eax
je 0x1800c215a
lea rcx, [rsp + 0x88]
call fcn.1800e7690
nop
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
lea r9, str.CTSandboxMgr::InitSandboxRegistry_SetKeySecurity_Fail__strSubKey__s__err__lu_
lea r8, str.InitReg
mov edx, 8
lea rcx, [0x18023d838]
call fcn.1800dbb80
nop
lea rcx, [rsp + 0x88]
call fcn.1800e76c0
cmp dword [rsp + 0x5c0], 0
jne 0x1800c25f3
lea r8, str.USER
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x90]
call fcn.1800ebf80
nop
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x550], rax
mov r9, qword [rsp + 0x550]
mov r8, 0xffffffff80000003
xor edx, edx
mov rcx, 0xffffffff80000003
call fcn.180001f30
mov dword [rsp + 0x70], eax
cmp dword [rsp + 0x70], 0
je 0x1800c220d
lea rcx, [0x18023d830]
call fcn.1800d5710
test eax, eax
je 0x1800c220d
lea rcx, [rsp + 0xa0]
call fcn.1800e7690
nop
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x20], eax
lea r9, str.CTSandboxMgr::InitSandboxRegistry_CopyKeySecurity_HKEY_USERS_Fail__err__lu_
lea r8, str.InitReg
mov edx, 8
lea rcx, [0x18023d838]
call fcn.1800dbb80
nop
lea rcx, [rsp + 0xa0]
call fcn.1800e76c0
lea r8, str.MACHINE
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x98]
call fcn.1800ebf80
nop
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x558], rax
mov r9, qword [rsp + 0x558]
mov r8, 0xffffffff80000003
xor edx, edx
mov rcx, 0xffffffff80000002
call fcn.180001f30
mov dword [rsp + 0x70], eax
cmp dword [rsp + 0x70], 0
je 0x1800c22b2
lea rcx, [0x18023d830]
call fcn.1800d5710
test eax, eax
je 0x1800c22b2
lea rcx, [rsp + 0xa4]
call fcn.1800e7690
nop
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x20], eax
lea r9, str.CTSandboxMgr::InitSandboxRegistry_CopyKeySecurity_HKEY_LOCAL_MACHINE_Fail__err__lu_
lea r8, str.InitReg
mov edx, 8
lea rcx, [0x18023d838]
call fcn.1800dbb80
nop
lea rcx, [rsp + 0xa4]
call fcn.1800e76c0
xor eax, eax
mov word [rsp + 0xd0], ax
lea rax, [rsp + 0xd2]
mov rdi, rax
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
mov dword [rsp + 0xb0], 0x104
mov dword [rsp + 0xb8], 0
mov dword [rsp + 0x2e0], 0
mov dword [rsp + 0xac], 0
mov dword [rsp + 0x2f4], 0
mov dword [rsp + 0x2f0], 0
mov dword [rsp + 0xb4], 0
mov dword [rsp + 0xa8], 0
mov dword [rsp + 0x2e8], 0
lea rax, [rsp + 0x2ec]
mov rdi, rax
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
lea rax, [rsp + 0x2e8]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0xb4]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x2f0]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x2f4]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xac]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x2e0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rsp + 0xb0]
lea rdx, [rsp + 0xd0]
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov dword [rsp + 0x70], eax
cmp dword [rsp + 0x70], 0
jne 0x1800c25cd
xor eax, eax
mov word [rsp + 0x300], ax
lea rax, [rsp + 0x302]
mov rdi, rax
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
mov dword [rsp + 0x2f8], 0
mov dword [rsp + 0x2f8], 0
jmp 0x1800c2424
mov eax, dword [rsp + 0x2f8]
inc eax
mov dword [rsp + 0x2f8], eax
mov eax, dword [rsp + 0xb8]
cmp dword [rsp + 0x2f8], eax
jae 0x1800c25cd
mov dword [rsp + 0x510], 0x104
lea rax, [rsp + 0x2e8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x510]
lea r8, [rsp + 0x300]
mov edx, dword [rsp + 0x2f8]
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [rsp + 0x70], eax
cmp dword [rsp + 0x70], 0
jne 0x1800c25c8
mov r8d, 9
lea rdx, str.TSandbox_
lea rcx, [rsp + 0x300]
call fcn.1800fd9e8
test eax, eax
je 0x1800c25c8
lea r8, str.USER_
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x530]
call fcn.1800ebf80
mov qword [rsp + 0x570], rax
mov rax, qword [rsp + 0x570]
mov qword [rsp + 0x578], rax
lea r8, [rsp + 0x300]
mov rdx, qword [rsp + 0x578]
lea rcx, [rsp + 0x518]
call fcn.1800ebf80
nop
lea rcx, [rsp + 0x530]
call fcn.1800e8250
mov rax, qword [rsp + 0x518]
mov qword [rsp + 0x560], rax
mov r9, qword [rsp + 0x560]
mov r8, 0xffffffff80000003
lea rdx, [rsp + 0x300]
mov rcx, 0xffffffff80000003
call fcn.180001f30
mov dword [rsp + 0x70], eax
cmp dword [rsp + 0x70], 0
je 0x1800c25bb
lea rcx, [0x18023d830]
call fcn.1800d5710
test eax, eax
je 0x1800c25bb
lea rcx, [rsp + 0x520]
call fcn.1800e7690
nop
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x518]
mov qword [rsp + 0x20], rax
lea r9, str.CTSandboxMgr::InitSandboxRegistry_CopyKeySecurity_HKEY_USERS_Fail__strKeyUserSub__s__err__lu_
lea r8, str.InitReg
mov edx, 8
lea rcx, [0x18023d838]
call fcn.1800dbb80
nop
lea rcx, [rsp + 0x520]
call fcn.1800e76c0
nop
lea rcx, [rsp + 0x518]
call fcn.1800e8250
jmp 0x1800c2414
xor eax, eax
test eax, eax
jne 0x1800c22b2
lea rcx, [rsp + 0x98]
call fcn.1800e8250
nop
lea rcx, [rsp + 0x90]
call fcn.1800e8250
nop
lea rcx, [rsp + 0x78]
call fcn.1800e8250
xor eax, eax
test eax, eax
jne 0x1800c1f1b
xor r8d, r8d
lea rdx, str.SeBackupPrivilege
mov rcx, qword [rsp + 0x60]
call fcn.180001b30
xor r8d, r8d
lea rdx, str.SeRestorePrivilege
mov rcx, qword [rsp + 0x60]
call fcn.180001b30
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800c26bb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x524], eax
cmp qword [rsp + 0x5c8], 0
je 0x1800c2665
mov rax, qword [rsp + 0x5c8]
mov ecx, dword [rsp + 0x524]
mov dword [rax], ecx
lea rcx, [0x18023d830]
call fcn.1800d5710
test eax, eax
je 0x1800c26bb
lea rcx, [rsp + 0x528]
call fcn.1800e7690
nop
mov eax, dword [rsp + 0x524]
mov dword [rsp + 0x20], eax
lea r9, str.CTSandboxMgr::InitSandboxRegistry_OpenProcessToken_fail_dwErr__lu_
lea r8, str.InitReg
mov edx, 8
lea rcx, [0x18023d838]
call fcn.1800dbb80
nop
lea rcx, [rsp + 0x528]
call fcn.1800e76c0
lea rcx, [0x18023d830]
call fcn.1800d5710
test eax, eax
je 0x1800c2738
lea rcx, [rsp + 0x52c]
call fcn.1800e7690
nop
mov eax, dword [rsp + 0x5c0]
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x5b8]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x5b0]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x5a8]
mov qword [rsp + 0x20], rax
lea r9, str.CTSandboxMgr::InitSandboxRegistry_Class__s__Instance__s__RegFile__s__bRegUseIndex__lu__end
lea r8, str.InitReg
mov edx, 8
lea rcx, [0x18023d838]
call fcn.1800dbb80
nop
lea rcx, [rsp + 0x52c]
call fcn.1800e76c0
mov eax, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x580]
xor rcx, rsp
call fcn.1800fbf40
add rsp, 0x590
pop rdi
ret