Function at 0x7d27c060
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
push rsi
push rdi
push r13
lea rbp, [rsp - 0x2d8]
sub rsp, 0x3d8
mov esi, r8d
mov rdi, rcx
call fcn.7d278850
xor edx, edx
mov rcx, rdi
call fcn.7d2213f2
mov r13, rax
test rax, rax
jne 0x7d27c0b2
lea ecx, [rax + 6]
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0x3d8
pop r13
pop rdi
pop rsi
pop rbp
ret
mov qword [rsp + 0x400], rbx
mov qword [rsp + 0x3d0], r12
xor r12d, r12d
mov qword [rsp + 0x3c8], r14
mov qword [rsp + 0x3c0], r15
or r15, 0xffffffffffffffff
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], r12
test esi, esi
jne 0x7d27c0f4
mov ebx, r12d
jmp 0x7d27c3a8
cmp esi, 0xffffffff
jne 0x7d27c32f
cmp byte [0x7d2abfa8], r12b
lea rdx, str.DisplayName
mov eax, 0x58
lea rcx, [rsp + 0x30]
mov ebx, 0x44
cmovne ebx, eax
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rax, [rbp + 0x318]
mov r8d, 2
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x50]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x20], 0x200
mov rcx, r13
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
test eax, eax
js 0x7d27c169
cmp dword [rbp - 0x4c], 1
jne 0x7d27c169
cmp dword [rbp - 0x48], r12d
je 0x7d27c169
mov word [rbp + 0x1a4], r12w
jmp 0x7d27c16e
mov word [rbp - 0x44], r12w
lea rcx, [rbp - 0x44]
mov rax, r15
nop word [rax + rax]
cmp word [rcx + rax*2 + 2], r12w
lea rax, [rax + 1]
jne 0x7d27c180
lea ecx, [rax*2 + 2]
mov dword [rbp + 0x318], ecx
call fcn.7d2212da
mov r8d, dword [rbp + 0x318]
lea rdx, [rbp - 0x44]
mov rcx, rax
mov qword [rsp + 0x60], rax
call sub.ntdll.dll_memcpy
add ebx, dword [rbp + 0x318]
lea rdx, str.ImagePath
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rax, [rbp + 0x318]
mov r8d, 2
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x50]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x20], 0x200
mov rcx, r13
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
test eax, eax
js 0x7d27c218
cmp dword [rbp - 0x48], r12d
je 0x7d27c218
mov eax, dword [rbp - 0x4c]
dec eax
cmp eax, 1
ja 0x7d27c218
mov word [rbp + 0x1a4], r12w
jmp 0x7d27c21d
mov word [rbp - 0x44], r12w
mov ecx, 0x12
call fcn.7d2212da
mov r8d, 9
mov qword [rsp + 0x58], rax
mov rdx, rax
lea rcx, [rbp - 0x44]
mov r14, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [rbp + 0x318], eax
cmp eax, 9
jbe 0x7d27c28a
mov rcx, r14
call fcn.7d221938
mov ecx, dword [rbp + 0x318]
lea ecx, [rcx*2 + 0x10]
call fcn.7d2212da
mov r8d, dword [rbp + 0x318]
lea rcx, [rbp - 0x44]
add r8d, 8
mov qword [rsp + 0x58], rax
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [rbp + 0x318], eax
lea rdx, str.ObjectName
lea rcx, [rsp + 0x30]
lea ebx, [rbx + rax*2]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rax, [rbp + 0x318]
mov r8d, 2
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x50]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x20], 0x200
mov rcx, r13
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
test eax, eax
js 0x7d27c2e5
cmp dword [rbp - 0x4c], 1
jne 0x7d27c2e5
cmp dword [rbp - 0x48], r12d
je 0x7d27c2e5
mov word [rbp + 0x1a4], r12w
jmp 0x7d27c2ea
mov word [rbp - 0x44], r12w
lea rcx, [rbp - 0x44]
mov rax, r15
cmp word [rcx + rax*2 + 2], r12w
lea rax, [rax + 1]
jne 0x7d27c2f1
lea ecx, [rax*2 + 2]
mov dword [rbp + 0x318], ecx
call fcn.7d2212da
mov r8d, dword [rbp + 0x318]
lea rdx, [rbp - 0x44]
mov rcx, rax
mov qword [rsp + 0x68], rax
call sub.ntdll.dll_memcpy
add ebx, dword [rbp + 0x318]
jmp 0x7d27c3a8
cmp esi, 1
jne 0x7d27c361
mov rax, r15
nop word [rax + rax]
cmp word [rdi + rax*2 + 2], r12w
lea rax, [rax + 1]
jne 0x7d27c340
cmp byte [0x7d2abfa8], r12b
lea ebx, [rax*2 + 0xa]
je 0x7d27c3a8
add ebx, 4
jmp 0x7d27c3a8
cmp esi, 2
jne 0x7d27c37b
cmp byte [0x7d2abfa8], r12b
mov ebx, 0x28
je 0x7d27c3a8
mov ebx, 0x34
jmp 0x7d27c3a8
lea eax, [rsi - 3]
cmp eax, 1
jbe 0x7d27c3a3
cmp esi, 7
je 0x7d27c3a3
mov rcx, r13
call qword [sym.imp.ntdll.dll_NtClose]
mov ecx, 0x7c
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x7d27cb9c
mov ebx, 4
lea ecx, [rbx + 0x70]
mov dword [rbp + 0x318], ecx
call fcn.7d221988
mov ecx, dword [rbp + 0x318]
mov r14, rax
mov r8, rbx
mov qword [rsp + 0x40], rbx
xor edx, edx
mov dword [rax], ecx
mov dword [rax + 4], r12d
lea r12, [r14 + 0x30]
mov dword [rax + 0x2c], ebx
mov rcx, r12
xor eax, eax
mov qword [r14 + 8], rax
mov qword [r14 + 0x10], rax
mov qword [r14 + 0x18], rax
mov qword [r14 + 0x20], rax
mov dword [r14 + 0x28], eax
call sub.ntdll.dll_memset
lea rdx, str.Type
mov dword [r14 + 0xc], 1
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rax, [rbp + 0x318]
mov r8d, 2
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x50]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x20], 0x200
mov rcx, r13
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
test eax, eax
js 0x7d27c451
cmp dword [rbp - 0x4c], 4
jne 0x7d27c451
cmp dword [rbp - 0x48], 4
jne 0x7d27c451
mov eax, dword [rbp - 0x44]
mov dword [r14 + 8], eax
test byte [r14 + 8], 0x30
je 0x7d27c984
cmp dword [rbp + 0x308], 0
je 0x7d27c984
lea rdx, str.SBIE_CurrentState
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rax, [rbp + 0x318]
mov r8d, 2
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x50]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x20], 0x200
mov rcx, r13
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
test eax, eax
js 0x7d27c7d0
cmp dword [rbp - 0x4c], 4
jne 0x7d27c7d0
cmp dword [rbp - 0x48], 4
jne 0x7d27c7d0
mov ebx, dword [rbp - 0x44]
mov dword [rsp + 0x48], ebx
cmp ebx, 2
jne 0x7d27c53c
lea rdx, str.SBIE_StartTicks
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rax, [rbp + 0x318]
mov r8d, ebx
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x50]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x20], 0x200
mov rcx, r13
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
test eax, eax
js 0x7d27c7cb
cmp dword [rbp - 0x4c], 4
jne 0x7d27c7cb
cmp dword [rbp - 0x48], 4
jne 0x7d27c7cb
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [rbp - 0x44]
cmp eax, 0x1f40
ja 0x7d27c7cb
jmp 0x7d27c545
cmp ebx, 1
je 0x7d27c7cb
lea rdx, str.SBIE_ProcessId
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rax, [rbp + 0x318]
mov r8d, 2
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x50]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x20], 0x200
mov rcx, r13
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
test eax, eax
js 0x7d27c7cb
cmp dword [rbp - 0x4c], 4
jne 0x7d27c7cb
cmp dword [rbp - 0x48], 4
jne 0x7d27c7cb
mov esi, dword [rbp - 0x44]
lea rax, [rsp + 0x4c]
mov ecx, esi
mov dword [rsp + 0x50], esi
xor r9d, r9d
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x200]
lea rdx, [rbp + 0x1b0]
call sym.imfsbDll.dll_SbieApi_QueryProcess
test eax, eax
js 0x7d27c7ba
mov eax, dword [0x7d2abf9c]
cmp dword [rsp + 0x4c], eax
jne 0x7d27c7ba
mov rdx, qword [0x7d2abf58]
lea rcx, [rbp + 0x1b0]
call sub.ntdll.dll__wcsicmp
test eax, eax
jne 0x7d27c7ba
lea edx, [rax + 0x2e]
lea rcx, [rbp + 0x200]
call sub.ntdll.dll_wcsrchr
test rax, rax
je 0x7d27c614
xor ecx, ecx
mov word [rax], cx
lea rdx, str.ImagePath
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rax, [rbp + 0x318]
mov r8d, 2
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x50]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x20], 0x200
mov rcx, r13
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
test eax, eax
js 0x7d27c7ba
cmp dword [rbp - 0x48], 0
je 0x7d27c7ba
mov eax, dword [rbp - 0x4c]
dec eax
cmp eax, 1
ja 0x7d27c7ba
xor eax, eax
lea rcx, [rbp - 0x44]
mov word [rbp + 0x1a4], ax
lea edx, [rax + 0x5c]
call sub.ntdll.dll_wcsrchr
mov rbx, rax
test rax, rax
jne 0x7d27c6a9
lea edx, [rax + 0x22]
lea rcx, [rbp - 0x44]
call sub.ntdll.dll_wcsrchr
mov rbx, rax
test rax, rax
jne 0x7d27c6a9
lea rbx, [rbp - 0x44]
jmp 0x7d27c6ad
add rbx, 2
mov edx, 0x22
mov rcx, rbx
call sub.ntdll.dll_wcsrchr
test rax, rax
jne 0x7d27c6cf
lea edx, [rax + 0x20]
mov rcx, rbx
call sub.ntdll.dll_wcsrchr
test rax, rax
je 0x7d27c6d4
xor ecx, ecx
mov word [rax], cx
mov edx, 0x2e
mov rcx, rbx
call sub.ntdll.dll_wcsrchr
test rax, rax
je 0x7d27c6eb
xor ecx, ecx
mov word [rax], cx
lea rdx, [rbp + 0x200]
mov rcx, rbx
call sub.ntdll.dll__wcsicmp
test eax, eax
jne 0x7d27c707
mov dword [r14 + 0x24], esi
jmp 0x7d27c7b6
mov rax, qword [str.SandboxieBITS.exe]
mov rdx, qword [str.bits]
mov qword [rsp + 0x78], rax
mov rax, qword [str.cryptsvc]
mov qword [rbp - 0x80], rax
mov rax, qword [str.__a_]
mov qword [rbp - 0x78], rax
mov rax, qword [str.wuauserv]
mov qword [rbp - 0x70], rax
mov rax, qword [str.SandboxieWUAU.exe]
mov qword [rbp - 0x68], rax
xor eax, eax
mov qword [rsp + 0x70], rdx
mov qword [rbp - 0x60], rax
test rdx, rdx
je 0x7d27c7b6
lea rsi, [rsp + 0x78]
nop dword [rax + rax]
mov rcx, rdi
call sub.ntdll.dll__wcsicmp
test eax, eax
jne 0x7d27c79c
mov rbx, qword [rsi]
lea edx, [rax + 0x2e]
mov rcx, rbx
call sub.ntdll.dll_wcsrchr
sub rax, rbx
lea rcx, [rbp + 0x200]
sar rax, 1
mov rdx, rbx
mov r8d, eax
mov dword [rbp + 0x318], eax
call sub.ntdll.dll__wcsnicmp
test eax, eax
je 0x7d27c7ae
mov rax, qword [rsi + 8]
add rsi, 0x10
mov rdx, rax
test rax, rax
jne 0x7d27c760
jmp 0x7d27c7b6
mov eax, dword [rsp + 0x50]
mov dword [r14 + 0x24], eax
mov ebx, dword [rsp + 0x48]
cmp dword [r14 + 0x24], 0
mov esi, dword [rbp + 0x310]
je 0x7d27c7cb
mov dword [r14 + 0xc], ebx
mov rbx, qword [rsp + 0x40]
lea rdx, str.SBIE_Win32ExitCode
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rax, [rbp + 0x318]
mov r8d, 2
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x50]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x20], 0x200
mov rcx, r13
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
test eax, eax
js 0x7d27c825
cmp dword [rbp - 0x4c], 4
jne 0x7d27c825
cmp dword [rbp - 0x48], 4
jne 0x7d27c825
mov eax, dword [rbp - 0x44]
mov dword [r14 + 0x14], eax
lea rdx, str.SBIE_ServiceSpecificExitCode
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rax, [rbp + 0x318]
mov r8d, 2
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x50]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x20], 0x200
mov rcx, r13
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
test eax, eax
js 0x7d27c87a
cmp dword [rbp - 0x4c], 4
jne 0x7d27c87a
cmp dword [rbp - 0x48], 4
jne 0x7d27c87a
mov eax, dword [rbp - 0x44]
mov dword [r14 + 0x18], eax
cmp dword [r14 + 0xc], 1
je 0x7d27c984
lea rdx, str.SBIE_ControlsAccepted
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rax, [rbp + 0x318]
mov r8d, 2
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x50]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x20], 0x200
mov rcx, r13
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
test eax, eax
js 0x7d27c8da
cmp dword [rbp - 0x4c], 4
jne 0x7d27c8da
cmp dword [rbp - 0x48], 4
jne 0x7d27c8da
mov eax, dword [rbp - 0x44]
mov dword [r14 + 0x10], eax
lea rdx, str.SBIE_CheckPoint
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rax, [rbp + 0x318]
mov r8d, 2
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x50]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x20], 0x200
mov rcx, r13
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
test eax, eax
js 0x7d27c92f
cmp dword [rbp - 0x4c], 4
jne 0x7d27c92f
cmp dword [rbp - 0x48], 4
jne 0x7d27c92f
mov eax, dword [rbp - 0x44]
mov dword [r14 + 0x1c], eax
lea rdx, str.SBIE_WaitHint
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rax, [rbp + 0x318]
mov r8d, 2
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x50]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x20], 0x200
mov rcx, r13
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
test eax, eax
js 0x7d27c984
cmp dword [rbp - 0x4c], 4
jne 0x7d27c984
cmp dword [rbp - 0x48], 4
jne 0x7d27c984
mov eax, dword [rbp - 0x44]
mov dword [r14 + 0x20], eax
mov r8, rbx
xor edx, edx
mov rcx, r12
call sub.ntdll.dll_memset
cmp esi, 0xffffffff
jne 0x7d27cb54
mov r8, qword [rsp + 0x60]
lea rbx, [r12 + 0x42]
lea rax, [r12 + 0x40]
sub rax, r12
mov qword [r12 + 0x28], rax
mov qword [r12 + 0x18], rax
xor eax, eax
mov word [r12 + 0x40], ax
mov word [rbx], ax
add rbx, 2
test r8, r8
je 0x7d27ca1c
mov rdx, rbx
mov rcx, r8
sub rdx, r8
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rcx]
mov word [rcx + rdx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x7d27c9e0
mov rax, rbx
sub rax, r12
mov qword [r12 + 0x38], rax
mov rax, r15
nop
cmp word [rbx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x7d27ca00
lea rbx, [rbx + rax*2]
mov rcx, r8
add rbx, 2
call fcn.7d221938
mov r8, qword [rsp + 0x58]
test r8, r8
je 0x7d27ca6d
mov rdx, rbx
mov rcx, r8
sub rdx, r8
nop
movzx eax, word [rcx]
mov word [rcx + rdx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x7d27ca30
mov rax, rbx
sub rax, r12
mov qword [r12 + 0x10], rax
nop dword [rax + rax]
cmp word [rbx + r15*2 + 2], 0
lea r15, [r15 + 1]
jne 0x7d27ca50
lea rbx, [rbx + r15*2]
mov rcx, r8
add rbx, 2
call fcn.7d221938
mov r8, qword [rsp + 0x68]
test r8, r8
je 0x7d27caa0
mov rdx, rbx
mov rcx, r8
sub rdx, r8
movzx eax, word [rcx]
mov word [rcx + rdx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x7d27ca80
sub rbx, r12
mov rcx, r8
mov qword [r12 + 0x30], rbx
call fcn.7d221938
mov eax, dword [r14 + 8]
lea rdx, str.Start
lea rcx, [rsp + 0x30]
mov dword [r12], eax
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rax, [rbp + 0x318]
mov r8d, 2
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x50]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x20], 0x200
mov rcx, r13
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
test eax, eax
js 0x7d27cafd
cmp dword [rbp - 0x4c], 4
jne 0x7d27cafd
cmp dword [rbp - 0x48], 4
jne 0x7d27cafd
mov eax, dword [rbp - 0x44]
mov dword [r14 + 0x34], eax
lea rdx, str.ErrorControl
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rax, [rbp + 0x318]
mov r8d, 2
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x50]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x20], 0x200
mov rcx, r13
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
test eax, eax
js 0x7d27cb90
cmp dword [rbp - 0x4c], 4
jne 0x7d27cb90
cmp dword [rbp - 0x48], 4
jne 0x7d27cb90
mov eax, dword [rbp - 0x44]
mov dword [r14 + 0x38], eax
jmp 0x7d27cb90
cmp esi, 1
jne 0x7d27cb90
cmp byte [0x7d2abfa8], 0
mov eax, 8
mov ecx, 0xc
cmovne eax, ecx
mov qword [r12], rax
sub rax, rdi
lea rcx, [rax + r12]
nop dword [rax + rax]
movzx eax, word [rdi]
mov word [rdi + rcx], ax
lea rdi, [rdi + 2]
test ax, ax
jne 0x7d27cb80
mov rcx, r13
call qword [sym.imp.ntdll.dll_NtClose]
mov rax, r14
mov r14, qword [rsp + 0x3c8]
mov r12, qword [rsp + 0x3d0]
mov rbx, qword [rsp + 0x400]
mov r15, qword [rsp + 0x3c0]
add rsp, 0x3d8
pop r13
pop rdi
pop rsi
pop rbp
ret