Function at 0x1800c1030
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x590
mov qword [rsp + 0x568], 0xfffffffffffffffe
mov rax, qword [0x18021dd90]
xor rax, rsp
mov qword [rsp + 0x580], rax
cmp qword [rsp + 0x5c8], 0
je 0x1800c1083
mov rax, qword [rsp + 0x5c8]
mov dword [rax], 0
cmp qword [rsp + 0x5a8], 0
je 0x1800c1099
cmp qword [rsp + 0x5b8], 0
jne 0x1800c10a0
xor eax, eax
jmp 0x1800c199c
lea rcx, [0x1802386e0]
call fcn.1800d48a0
test eax, eax
je 0x1800c1117
lea rcx, [rsp + 0x6c]
call fcn.1800e4b10
nop
mov eax, dword [rsp + 0x5c0]
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x5b8]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x5b0]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x5a8]
mov qword [rsp + 0x20], rax
lea r9, str.CTSandboxMgr::InitSandboxRegistry_Class__s__Instance__s__RegFile__s__bRegUseIndex__lu__begin
lea r8, str.InitReg
mov edx, 8
lea rcx, [0x1802386e8]
call fcn.1800dad10
nop
lea rcx, [rsp + 0x6c]
call fcn.1800e4b40
mov dword [rsp + 0x68], 0
mov qword [rsp + 0x60], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x60]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
cmp qword [rsp + 0x60], 0
je 0x1800c189c
mov r8d, 1
lea rdx, str.SeBackupPrivilege
mov rcx, qword [rsp + 0x60]
call fcn.180001b30
mov r8d, 1
lea rdx, str.SeRestorePrivilege
mov rcx, qword [rsp + 0x60]
call fcn.180001b30
lea rdx, [0x1801a6e60]
lea rcx, [rsp + 0x78]
call fcn.1800e9110
nop
mov r8, qword [rsp + 0x5a8]
lea rdx, str.TSandbox__s
lea rcx, [rsp + 0x78]
call fcn.1800e67b0
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x538], rax
mov r8, qword [rsp + 0x5b8]
mov rdx, qword [rsp + 0x538]
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
mov dword [rsp + 0x70], eax
cmp dword [rsp + 0x70], 0
je 0x1800c1256
lea rcx, [0x1802386e0]
call fcn.1800d48a0
test eax, eax
je 0x1800c122e
lea rcx, [rsp + 0x80]
call fcn.1800e4b10
nop
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x20], eax
lea r9, str.CTSandboxMgr::InitSandboxRegistry_RegLoadKeyW_Fail__err__lu_
lea r8, str.InitReg
mov edx, 8
lea rcx, [0x1802386e8]
call fcn.1800dad10
nop
lea rcx, [rsp + 0x80]
call fcn.1800e4b40
cmp qword [rsp + 0x5c8], 0
je 0x1800c1247
mov rax, qword [rsp + 0x5c8]
mov ecx, dword [rsp + 0x70]
mov dword [rax], ecx
lea rcx, [rsp + 0x78]
call fcn.1800e56d0
jmp 0x1800c1867
mov dword [rsp + 0x68], 1
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x540], rax
call fcn.1800f62b0
mov r9, rax
mov r8d, 4
mov rdx, qword [rsp + 0x540]
mov rcx, 0xffffffff80000003
call fcn.180001e10
mov dword [rsp + 0x70], eax
cmp dword [rsp + 0x70], 0
je 0x1800c12f5
lea rcx, [0x1802386e0]
call fcn.1800d48a0
test eax, eax
je 0x1800c12f5
lea rcx, [rsp + 0x84]
call fcn.1800e4b10
nop
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
lea r9, str.CTSandboxMgr::InitSandboxRegistry_SetKeySecurity_Fail__strSubKey__s__err__lu_
lea r8, str.InitReg
mov edx, 8
lea rcx, [0x1802386e8]
call fcn.1800dad10
nop
lea rcx, [rsp + 0x84]
call fcn.1800e4b40
cmp qword [rsp + 0x5b0], 0
je 0x1800c1323
lea rdx, [0x1801b4ff8]
lea rcx, [rsp + 0x78]
call fcn.1800e59f0
mov rdx, qword [rsp + 0x5b0]
lea rcx, [rsp + 0x78]
call fcn.1800e59f0
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x548], rax
call fcn.1800f62b0
mov r9, rax
mov r8d, 4
mov rdx, qword [rsp + 0x548]
mov rcx, 0xffffffff80000003
call fcn.180001e10
mov dword [rsp + 0x70], eax
cmp dword [rsp + 0x70], 0
je 0x1800c13ba
lea rcx, [0x1802386e0]
call fcn.1800d48a0
test eax, eax
je 0x1800c13ba
lea rcx, [rsp + 0x88]
call fcn.1800e4b10
nop
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
lea r9, str.CTSandboxMgr::InitSandboxRegistry_SetKeySecurity_Fail__strSubKey__s__err__lu_
lea r8, str.InitReg
mov edx, 8
lea rcx, [0x1802386e8]
call fcn.1800dad10
nop
lea rcx, [rsp + 0x88]
call fcn.1800e4b40
cmp dword [rsp + 0x5c0], 0
jne 0x1800c1853
lea r8, str.USER
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x90]
call fcn.1800e9400
nop
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x550], rax
mov r9, qword [rsp + 0x550]
mov r8, 0xffffffff80000003
xor edx, edx
mov rcx, 0xffffffff80000003
call fcn.180001f30
mov dword [rsp + 0x70], eax
cmp dword [rsp + 0x70], 0
je 0x1800c146d
lea rcx, [0x1802386e0]
call fcn.1800d48a0
test eax, eax
je 0x1800c146d
lea rcx, [rsp + 0xa0]
call fcn.1800e4b10
nop
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x20], eax
lea r9, str.CTSandboxMgr::InitSandboxRegistry_CopyKeySecurity_HKEY_USERS_Fail__err__lu_
lea r8, str.InitReg
mov edx, 8
lea rcx, [0x1802386e8]
call fcn.1800dad10
nop
lea rcx, [rsp + 0xa0]
call fcn.1800e4b40
lea r8, str.MACHINE
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x98]
call fcn.1800e9400
nop
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x558], rax
mov r9, qword [rsp + 0x558]
mov r8, 0xffffffff80000003
xor edx, edx
mov rcx, 0xffffffff80000002
call fcn.180001f30
mov dword [rsp + 0x70], eax
cmp dword [rsp + 0x70], 0
je 0x1800c1512
lea rcx, [0x1802386e0]
call fcn.1800d48a0
test eax, eax
je 0x1800c1512
lea rcx, [rsp + 0xa4]
call fcn.1800e4b10
nop
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x20], eax
lea r9, str.CTSandboxMgr::InitSandboxRegistry_CopyKeySecurity_HKEY_LOCAL_MACHINE_Fail__err__lu_
lea r8, str.InitReg
mov edx, 8
lea rcx, [0x1802386e8]
call fcn.1800dad10
nop
lea rcx, [rsp + 0xa4]
call fcn.1800e4b40
xor eax, eax
mov word [rsp + 0xd0], ax
lea rax, [rsp + 0xd2]
mov rdi, rax
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
mov dword [rsp + 0xb0], 0x104
mov dword [rsp + 0xb8], 0
mov dword [rsp + 0x2e0], 0
mov dword [rsp + 0xac], 0
mov dword [rsp + 0x2f4], 0
mov dword [rsp + 0x2f0], 0
mov dword [rsp + 0xb4], 0
mov dword [rsp + 0xa8], 0
mov dword [rsp + 0x2e8], 0
lea rax, [rsp + 0x2ec]
mov rdi, rax
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
lea rax, [rsp + 0x2e8]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0xb4]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x2f0]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x2f4]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xac]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x2e0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rsp + 0xb0]
lea rdx, [rsp + 0xd0]
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov dword [rsp + 0x70], eax
cmp dword [rsp + 0x70], 0
jne 0x1800c182d
xor eax, eax
mov word [rsp + 0x300], ax
lea rax, [rsp + 0x302]
mov rdi, rax
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
mov dword [rsp + 0x2f8], 0
mov dword [rsp + 0x2f8], 0
jmp 0x1800c1684
mov eax, dword [rsp + 0x2f8]
inc eax
mov dword [rsp + 0x2f8], eax
mov eax, dword [rsp + 0xb8]
cmp dword [rsp + 0x2f8], eax
jae 0x1800c182d
mov dword [rsp + 0x510], 0x104
lea rax, [rsp + 0x2e8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x510]
lea r8, [rsp + 0x300]
mov edx, dword [rsp + 0x2f8]
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [rsp + 0x70], eax
cmp dword [rsp + 0x70], 0
jne 0x1800c1828
mov r8d, 9
lea rdx, str.TSandbox_
lea rcx, [rsp + 0x300]
call fcn.1800fad54
test eax, eax
je 0x1800c1828
lea r8, str.USER_
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x530]
call fcn.1800e9400
mov qword [rsp + 0x570], rax
mov rax, qword [rsp + 0x570]
mov qword [rsp + 0x578], rax
lea r8, [rsp + 0x300]
mov rdx, qword [rsp + 0x578]
lea rcx, [rsp + 0x518]
call fcn.1800e9400
nop
lea rcx, [rsp + 0x530]
call fcn.1800e56d0
mov rax, qword [rsp + 0x518]
mov qword [rsp + 0x560], rax
mov r9, qword [rsp + 0x560]
mov r8, 0xffffffff80000003
lea rdx, [rsp + 0x300]
mov rcx, 0xffffffff80000003
call fcn.180001f30
mov dword [rsp + 0x70], eax
cmp dword [rsp + 0x70], 0
je 0x1800c181b
lea rcx, [0x1802386e0]
call fcn.1800d48a0
test eax, eax
je 0x1800c181b
lea rcx, [rsp + 0x520]
call fcn.1800e4b10
nop
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x518]
mov qword [rsp + 0x20], rax
lea r9, str.CTSandboxMgr::InitSandboxRegistry_CopyKeySecurity_HKEY_USERS_Fail__strKeyUserSub__s__err__lu_
lea r8, str.InitReg
mov edx, 8
lea rcx, [0x1802386e8]
call fcn.1800dad10
nop
lea rcx, [rsp + 0x520]
call fcn.1800e4b40
nop
lea rcx, [rsp + 0x518]
call fcn.1800e56d0
jmp 0x1800c1674
xor eax, eax
test eax, eax
jne 0x1800c1512
lea rcx, [rsp + 0x98]
call fcn.1800e56d0
nop
lea rcx, [rsp + 0x90]
call fcn.1800e56d0
nop
lea rcx, [rsp + 0x78]
call fcn.1800e56d0
xor eax, eax
test eax, eax
jne 0x1800c117b
xor r8d, r8d
lea rdx, str.SeBackupPrivilege
mov rcx, qword [rsp + 0x60]
call fcn.180001b30
xor r8d, r8d
lea rdx, str.SeRestorePrivilege
mov rcx, qword [rsp + 0x60]
call fcn.180001b30
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800c191b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x524], eax
cmp qword [rsp + 0x5c8], 0
je 0x1800c18c5
mov rax, qword [rsp + 0x5c8]
mov ecx, dword [rsp + 0x524]
mov dword [rax], ecx
lea rcx, [0x1802386e0]
call fcn.1800d48a0
test eax, eax
je 0x1800c191b
lea rcx, [rsp + 0x528]
call fcn.1800e4b10
nop
mov eax, dword [rsp + 0x524]
mov dword [rsp + 0x20], eax
lea r9, str.CTSandboxMgr::InitSandboxRegistry_OpenProcessToken_fail_dwErr__lu_
lea r8, str.InitReg
mov edx, 8
lea rcx, [0x1802386e8]
call fcn.1800dad10
nop
lea rcx, [rsp + 0x528]
call fcn.1800e4b40
lea rcx, [0x1802386e0]
call fcn.1800d48a0
test eax, eax
je 0x1800c1998
lea rcx, [rsp + 0x52c]
call fcn.1800e4b10
nop
mov eax, dword [rsp + 0x5c0]
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x5b8]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x5b0]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x5a8]
mov qword [rsp + 0x20], rax
lea r9, str.CTSandboxMgr::InitSandboxRegistry_Class__s__Instance__s__RegFile__s__bRegUseIndex__lu__end
lea r8, str.InitReg
mov edx, 8
lea rcx, [0x1802386e8]
call fcn.1800dad10
nop
lea rcx, [rsp + 0x52c]
call fcn.1800e4b40
mov eax, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x580]
xor rcx, rsp
call fcn.1800f93c0
add rsp, 0x590
pop rdi
ret