Function at 0x1228edbe
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1234bfbd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x494
push edi
mov dword [ebp - 0x498], ecx
cmp dword [ebp + 0x18], 0
je 0x1228edf2
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
cmp dword [ebp + 8], 0
je 0x1228edfe
cmp dword [ebp + 0x10], 0
jne 0x1228ee05
xor eax, eax
jmp 0x1228f4f2
mov ecx, 0x123af970
call fcn.1229c4e3
test eax, eax
je 0x1228ee5a
lea ecx, [ebp - 0x18]
call fcn.122a7faa
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push str.CTSandboxMgr::InitSandboxRegistry_Class__s__Instance__s__RegFile__s__bRegUseIndex__lu__begin
push 0x12395aa0
push 8
push 0x123af974
call fcn.122a118e
add esp, 0x20
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.122a7fd1
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
lea edx, [ebp - 0x14]
push edx
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
cmp dword [ebp - 0x14], 0
je 0x1228f425
push 1
push 0x12395ab0
mov eax, dword [ebp - 0x14]
push eax
call fcn.122118c8
add esp, 0xc
push 1
push 0x12395ad4
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.122118c8
add esp, 0xc
push 0x123af7e0
lea ecx, [ebp - 0x1c]
call fcn.122b55a0
mov dword [ebp - 4], 1
mov edx, dword [ebp + 8]
push edx
push str.TSandbox__s
lea eax, [ebp - 0x1c]
push eax
call fcn.122b8cc0
add esp, 0xc
mov ecx, dword [ebp + 0x10]
push ecx
lea ecx, [ebp - 0x1c]
call fcn.12212010
push eax
push reloc.WS2_32.dll_closesocket
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x1228ef5a
mov ecx, 0x123af970
call fcn.1229c4e3
test eax, eax
je 0x1228ef38
lea ecx, [ebp - 0x24]
call fcn.122a7faa
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x20]
push edx
push str.CTSandboxMgr::InitSandboxRegistry_RegLoadKeyW_Fail__err__lu_
push 0x12395b90
push 8
push 0x123af974
call fcn.122a118e
add esp, 0x14
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x24]
call fcn.122a7fd1
cmp dword [ebp + 0x18], 0
je 0x1228ef46
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.122b5d40
jmp 0x1228f3f3
mov dword [ebp - 0x10], 1
call fcn.122c8310
push eax
push 4
lea ecx, [ebp - 0x1c]
call fcn.12212010
push eax
push reloc.WS2_32.dll_closesocket
call fcn.12211ad7
add esp, 0x10
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x1228efcf
mov ecx, 0x123af970
call fcn.1229c4e3
test eax, eax
je 0x1228efcf
lea ecx, [ebp - 0x28]
call fcn.122a7faa
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x1c]
push eax
push str.CTSandboxMgr::InitSandboxRegistry_SetKeySecurity_Fail__strSubKey__s__err__lu_
push 0x12395c3c
push 8
push 0x123af974
call fcn.122a118e
add esp, 0x18
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.122a7fd1
cmp dword [ebp + 0xc], 0
je 0x1228efee
push 0x12395c4c
lea ecx, [ebp - 0x1c]
call fcn.122b6990
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x1c]
call fcn.122b6990
call fcn.122c8310
push eax
push 4
lea ecx, [ebp - 0x1c]
call fcn.12212010
push eax
push reloc.WS2_32.dll_closesocket
call fcn.12211ad7
add esp, 0x10
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x1228f05c
mov ecx, 0x123af970
call fcn.1229c4e3
test eax, eax
je 0x1228f05c
lea ecx, [ebp - 0x2c]
call fcn.122a7faa
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x1c]
push eax
push 0x12395c50
push 0x12395cec
push 8
push 0x123af974
call fcn.122a118e
add esp, 0x18
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.122a7fd1
cmp dword [ebp + 0x14], 0
jne 0x1228f3da
push str.USER
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x34]
push edx
call fcn.122b64b0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x34]
call fcn.12212010
push eax
push reloc.WS2_32.dll_closesocket
push 0
push reloc.WS2_32.dll_closesocket
call fcn.12211b77
add esp, 0x10
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x1228f0e5
mov ecx, 0x123af970
call fcn.1229c4e3
test eax, eax
je 0x1228f0e5
lea ecx, [ebp - 0x38]
call fcn.122a7faa
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x20]
push eax
push str.CTSandboxMgr::InitSandboxRegistry_CopyKeySecurity_HKEY_USERS_Fail__err__lu_
push 0x12395da0
push 8
push 0x123af974
call fcn.122a118e
add esp, 0x14
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x38]
call fcn.122a7fd1
push str.MACHINE
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x30]
push edx
call fcn.122b64b0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x30]
call fcn.12212010
push eax
push reloc.WS2_32.dll_closesocket
push 0
push reloc.WS2_32.dll_bind
call fcn.12211b77
add esp, 0x10
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x1228f164
mov ecx, 0x123af970
call fcn.1229c4e3
test eax, eax
je 0x1228f164
lea ecx, [ebp - 0x3c]
call fcn.122a7faa
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x20]
push eax
push str.CTSandboxMgr::InitSandboxRegistry_CopyKeySecurity_HKEY_LOCAL_MACHINE_Fail__err__lu_
push 0x12395e6c
push 8
push 0x123af974
call fcn.122a118e
add esp, 0x14
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x3c]
call fcn.122a7fd1
mov word [ebp - 0x258], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x256]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 0x25c], 0x104
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x264], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x260], 0
mov dword [ebp - 0x26c], 0
xor ecx, ecx
mov dword [ebp - 0x268], ecx
lea edx, [ebp - 0x26c]
push edx
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x40]
push ecx
lea edx, [ebp - 0x4c]
push edx
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x264]
push ecx
lea edx, [ebp - 0x50]
push edx
lea eax, [ebp - 0x48]
push eax
push 0
lea ecx, [ebp - 0x25c]
push ecx
lea edx, [ebp - 0x258]
push edx
push reloc.WS2_32.dll_closesocket
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x1228f3b8
mov word [ebp - 0x474], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x472]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 0x478], 0
mov dword [ebp - 0x478], 0
jmp 0x1228f261
mov eax, dword [ebp - 0x478]
add eax, 1
mov dword [ebp - 0x478], eax
mov ecx, dword [ebp - 0x478]
cmp ecx, dword [ebp - 0x48]
jae 0x1228f3b8
mov dword [ebp - 0x47c], 0x104
lea edx, [ebp - 0x26c]
push edx
push 0
push 0
push 0
lea eax, [ebp - 0x47c]
push eax
lea ecx, [ebp - 0x474]
push ecx
mov edx, dword [ebp - 0x478]
push edx
push reloc.WS2_32.dll_closesocket
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x1228f3b3
push 9
push str.TSandbox_
lea eax, [ebp - 0x474]
push eax
call fcn.122caedc
add esp, 0xc
test eax, eax
je 0x1228f3b3
lea ecx, [ebp - 0x474]
push ecx
push str.USER_
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x494]
push eax
call fcn.122b64b0
mov dword [ebp - 0x49c], eax
mov ecx, dword [ebp - 0x49c]
mov dword [ebp - 0x4a0], ecx
mov byte [ebp - 4], 9
mov edx, dword [ebp - 0x4a0]
push edx
lea eax, [ebp - 0x480]
push eax
call fcn.122b64b0
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x494]
call fcn.122b5d40
lea ecx, [ebp - 0x480]
call fcn.12212010
push eax
push reloc.WS2_32.dll_closesocket
lea ecx, [ebp - 0x474]
push ecx
push reloc.WS2_32.dll_closesocket
call fcn.12211b77
add esp, 0x10
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x1228f3a4
mov ecx, 0x123af970
call fcn.1229c4e3
test eax, eax
je 0x1228f3a4
lea ecx, [ebp - 0x484]
call fcn.122a7faa
mov byte [ebp - 4], 0xc
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x480]
push eax
push str.CTSandboxMgr::InitSandboxRegistry_CopyKeySecurity_HKEY_USERS_Fail__strKeyUserSub__s__err__lu_
push 0x12395f5c
push 8
push 0x123af974
call fcn.122a118e
add esp, 0x18
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x484]
call fcn.122a7fd1
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x480]
call fcn.122b5d40
jmp 0x1228f252
xor ecx, ecx
test ecx, ecx
jne 0x1228f164
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x30]
call fcn.122b5d40
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x34]
call fcn.122b5d40
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.122b5d40
xor edx, edx
test edx, edx
jne 0x1228eeab
push 0
push 0x12395f6c
mov eax, dword [ebp - 0x14]
push eax
call fcn.122118c8
add esp, 0xc
push 0
push 0x12395f90
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.122118c8
add esp, 0xc
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1228f494
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x488], eax
cmp dword [ebp + 0x18], 0
je 0x1228f442
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp - 0x488]
mov dword [eax], ecx
mov ecx, 0x123af970
call fcn.1229c4e3
test eax, eax
je 0x1228f494
lea ecx, [ebp - 0x48c]
call fcn.122a7faa
mov dword [ebp - 4], 0xd
mov edx, dword [ebp - 0x488]
push edx
push str.CTSandboxMgr::InitSandboxRegistry_OpenProcessToken_fail_dwErr__lu_
push 0x12396040
push 8
push 0x123af974
call fcn.122a118e
add esp, 0x14
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48c]
call fcn.122a7fd1
mov ecx, 0x123af970
call fcn.1229c4e3
test eax, eax
je 0x1228f4ef
lea ecx, [ebp - 0x490]
call fcn.122a7faa
mov dword [ebp - 4], 0xe
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push str.CTSandboxMgr::InitSandboxRegistry_Class__s__Instance__s__RegFile__s__bRegUseIndex__lu__end
push 0x12396108
push 8
push 0x123af974
call fcn.122a118e
add esp, 0x20
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x490]
call fcn.122a7fd1
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
mov esp, ebp
pop ebp
ret 0x14