Function at 0x140010b70
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x140010b70
push rbp
push rsi
push rdi
sub rsp, 0x580
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0xf0
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14002c040]
xor rax, rbp
mov qword [rbp + 0x538], rax
lea rcx, [0x140034108]
call fcn.140001861
nop
mov qword [rbp + 8], 0
mov dword [rbp + 0x24], 0
mov dword [rbp + 0x44], 1
mov dword [rbp + 0x64], 1
lea rax, [rbp + 0x90]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov dword [rbp + 0x2b4], 0x208
lea rax, [rbp + 0x2e0]
lea rcx, str.79uK_HQBdM.c56Cn_ilk14Sv:0Gy8sa3JLXEgWT2Ipe_PhzAVfwOtYDFjrURmxZbNqo
mov rdi, rax
mov rsi, rcx
mov ecx, 0x8c
rep movsb byte [rdi], byte [rsi]
mov ecx, 0x5c
call qword [sym.imp.ucrtbased.dll_malloc]
mov qword [rbp + 0x388], rax
cmp qword [rbp + 0x388], 0
jne 0x140010c27
xor eax, eax
jmp 0x14001140f
mov eax, 2
imul rax, rax, 0x33
mov ecx, 2
imul rcx, rcx, 0x18
mov rdx, qword [rbp + 0x388]
movzx eax, word [rbp + rax + 0x2e0]
mov word [rdx + rcx], ax
mov eax, 2
imul rax, rax, 0x44
mov ecx, 2
imul rcx, rcx, 0xd
mov rdx, qword [rbp + 0x388]
movzx eax, word [rbp + rax + 0x2e0]
mov word [rdx + rcx], ax
mov eax, 2
imul rax, rax, 0x35
mov ecx, 2
imul rcx, rcx, 3
mov rdx, qword [rbp + 0x388]
movzx eax, word [rbp + rax + 0x2e0]
mov word [rdx + rcx], ax
mov eax, 2
imul rax, rax, 0x32
mov ecx, 2
imul rcx, rcx, 2
mov rdx, qword [rbp + 0x388]
movzx eax, word [rbp + rax + 0x2e0]
mov word [rdx + rcx], ax
mov eax, 2
imul rax, rax, 0x1e
mov ecx, 2
imul rcx, rcx, 0x19
mov rdx, qword [rbp + 0x388]
movzx eax, word [rbp + rax + 0x2e0]
mov word [rdx + rcx], ax
mov eax, 2
imul rax, rax, 0x3d
mov ecx, 2
imul rcx, rcx, 0x2a
mov rdx, qword [rbp + 0x388]
movzx eax, word [rbp + rax + 0x2e0]
mov word [rdx + rcx], ax
mov eax, 2
imul rax, rax, 0x36
mov ecx, 2
imul rcx, rcx, 0x12
mov rdx, qword [rbp + 0x388]
movzx eax, word [rbp + rax + 0x2e0]
mov word [rdx + rcx], ax
mov eax, 2
imul rax, rax, 0x2b
mov ecx, 2
imul rcx, rcx, 0x23
mov rdx, qword [rbp + 0x388]
movzx eax, word [rbp + rax + 0x2e0]
mov word [rdx + rcx], ax
mov eax, 2
imul rax, rax, 9
mov ecx, 2
imul rcx, rcx, 9
mov rdx, qword [rbp + 0x388]
movzx eax, word [rbp + rax + 0x2e0]
mov word [rdx + rcx], ax
mov eax, 2
imul rax, rax, 0x44
mov ecx, 2
imul rcx, rcx, 0x17
mov rdx, qword [rbp + 0x388]
movzx eax, word [rbp + rax + 0x2e0]
mov word [rdx + rcx], ax
mov eax, 2
imul rax, rax, 0x44
mov ecx, 2
imul rcx, rcx, 0x27
mov rdx, qword [rbp + 0x388]
movzx eax, word [rbp + rax + 0x2e0]
mov word [rdx + rcx], ax
mov eax, 2
imul rax, rax, 0x16
mov ecx, 2
imul rcx, rcx, 0
mov rdx, qword [rbp + 0x388]
movzx eax, word [rbp + rax + 0x2e0]
mov word [rdx + rcx], ax
mov eax, 2
imul rax, rax, 2
mov ecx, 2
imul rcx, rcx, 0x2b
mov rdx, qword [rbp + 0x388]
movzx eax, word [rbp + rax + 0x2e0]
mov word [rdx + rcx], ax
mov eax, 2
imul rax, rax, 0x11
mov ecx, 2
imul rcx, rcx, 0xa
mov rdx, qword [rbp + 0x388]
movzx eax, word [rbp + rax + 0x2e0]
mov word [rdx + rcx], ax
mov eax, 2
imul rax, rax, 0x3b
mov ecx, 2
imul rcx, rcx, 0x1e
mov rdx, qword [rbp + 0x388]
movzx eax, word [rbp + rax + 0x2e0]
mov word [rdx + rcx], ax
mov eax, 2
imul rax, rax, 0xb
mov ecx, 2
imul rcx, rcx, 0xb
mov rdx, qword [rbp + 0x388]
movzx eax, word [rbp + rax + 0x2e0]
mov word [rdx + rcx], ax
mov eax, 2
imul rax, rax, 0x26
mov ecx, 2
imul rcx, rcx, 0x13
mov rdx, qword [rbp + 0x388]
movzx eax, word [rbp + rax + 0x2e0]
mov word [rdx + rcx], ax
mov eax, 2
imul rax, rax, 0x2b
mov ecx, 2
imul rcx, rcx, 0x1f
mov rdx, qword [rbp + 0x388]
movzx eax, word [rbp + rax + 0x2e0]
mov word [rdx + rcx], ax
mov eax, 2
imul rax, rax, 0x31
mov ecx, 2
imul rcx, rcx, 0x22
mov rdx, qword [rbp + 0x388]
movzx eax, word [rbp + rax + 0x2e0]
mov word [rdx + rcx], ax
mov eax, 2
imul rax, rax, 0xf
mov ecx, 2
imul rcx, rcx, 0x15
mov rdx, qword [rbp + 0x388]
movzx eax, word [rbp + rax + 0x2e0]
mov word [rdx + rcx], ax
mov eax, 2
imul rax, rax, 0xf
mov ecx, 2
imul rcx, rcx, 0x28
mov rdx, qword [rbp + 0x388]
movzx eax, word [rbp + rax + 0x2e0]
mov word [rdx + rcx], ax
mov eax, 2
imul rax, rax, 0x44
mov ecx, 2
imul rcx, rcx, 0xf
mov rdx, qword [rbp + 0x388]
movzx eax, word [rbp + rax + 0x2e0]
mov word [rdx + rcx], ax
mov eax, 2
imul rax, rax, 8
mov ecx, 2
imul rcx, rcx, 0x16
mov rdx, qword [rbp + 0x388]
movzx eax, word [rbp + rax + 0x2e0]
mov word [rdx + rcx], ax
mov eax, 2
imul rax, rax, 0x35
mov ecx, 2
imul rcx, rcx, 0x11
mov rdx, qword [rbp + 0x388]
movzx eax, word [rbp + rax + 0x2e0]
mov word [rdx + rcx], ax
mov eax, 2
imul rax, rax, 0x32
mov ecx, 2
imul rcx, rcx, 0x10
mov rdx, qword [rbp + 0x388]
movzx eax, word [rbp + rax + 0x2e0]
mov word [rdx + rcx], ax
mov eax, 2
imul rax, rax, 0x33
mov ecx, 2
imul rcx, rcx, 4
mov rdx, qword [rbp + 0x388]
movzx eax, word [rbp + rax + 0x2e0]
mov word [rdx + rcx], ax
mov eax, 2
imul rax, rax, 0x3b
mov ecx, 2
imul rcx, rcx, 6
mov rdx, qword [rbp + 0x388]
movzx eax, word [rbp + rax + 0x2e0]
mov word [rdx + rcx], ax
mov eax, 2
imul rax, rax, 0x3b
mov ecx, 2
imul rcx, rcx, 0xc
mov rdx, qword [rbp + 0x388]
movzx eax, word [rbp + rax + 0x2e0]
mov word [rdx + rcx], ax
mov eax, 2
imul rax, rax, 0x36
mov ecx, 2
imul rcx, rcx, 8
mov rdx, qword [rbp + 0x388]
movzx eax, word [rbp + rax + 0x2e0]
mov word [rdx + rcx], ax
mov eax, 2
imul rax, rax, 0x3b
mov ecx, 2
imul rcx, rcx, 0x24
mov rdx, qword [rbp + 0x388]
movzx eax, word [rbp + rax + 0x2e0]
mov word [rdx + rcx], ax
mov eax, 2
imul rax, rax, 2
mov ecx, 2
imul rcx, rcx, 0x1c
mov rdx, qword [rbp + 0x388]
movzx eax, word [rbp + rax + 0x2e0]
mov word [rdx + rcx], ax
mov eax, 2
imul rax, rax, 0x44
mov ecx, 2
imul rcx, rcx, 1
mov rdx, qword [rbp + 0x388]
movzx eax, word [rbp + rax + 0x2e0]
mov word [rdx + rcx], ax
mov eax, 2
imul rax, rax, 0xf
mov ecx, 2
imul rcx, rcx, 0x20
mov rdx, qword [rbp + 0x388]
movzx eax, word [rbp + rax + 0x2e0]
mov word [rdx + rcx], ax
mov eax, 2
imul rax, rax, 0x1f
mov ecx, 2
imul rcx, rcx, 5
mov rdx, qword [rbp + 0x388]
movzx eax, word [rbp + rax + 0x2e0]
mov word [rdx + rcx], ax
mov eax, 2
imul rax, rax, 0x3b
mov ecx, 2
imul rcx, rcx, 0x1d
mov rdx, qword [rbp + 0x388]
movzx eax, word [rbp + rax + 0x2e0]
mov word [rdx + rcx], ax
mov eax, 2
imul rax, rax, 0x35
mov ecx, 2
imul rcx, rcx, 0x21
mov rdx, qword [rbp + 0x388]
movzx eax, word [rbp + rax + 0x2e0]
mov word [rdx + rcx], ax
mov eax, 2
imul rax, rax, 0x36
mov ecx, 2
imul rcx, rcx, 0x29
mov rdx, qword [rbp + 0x388]
movzx eax, word [rbp + rax + 0x2e0]
mov word [rdx + rcx], ax
mov eax, 2
imul rax, rax, 0xf
mov ecx, 2
imul rcx, rcx, 0x2c
mov rdx, qword [rbp + 0x388]
movzx eax, word [rbp + rax + 0x2e0]
mov word [rdx + rcx], ax
mov eax, 2
imul rax, rax, 0x11
mov ecx, 2
imul rcx, rcx, 0x14
mov rdx, qword [rbp + 0x388]
movzx eax, word [rbp + rax + 0x2e0]
mov word [rdx + rcx], ax
mov eax, 2
imul rax, rax, 0x36
mov ecx, 2
imul rcx, rcx, 0x1a
mov rdx, qword [rbp + 0x388]
movzx eax, word [rbp + rax + 0x2e0]
mov word [rdx + rcx], ax
mov eax, 2
imul rax, rax, 0x1e
mov ecx, 2
imul rcx, rcx, 0xe
mov rdx, qword [rbp + 0x388]
movzx eax, word [rbp + rax + 0x2e0]
mov word [rdx + rcx], ax
mov eax, 2
imul rax, rax, 0x1e
mov ecx, 2
imul rcx, rcx, 0x25
mov rdx, qword [rbp + 0x388]
movzx eax, word [rbp + rax + 0x2e0]
mov word [rdx + rcx], ax
mov eax, 2
imul rax, rax, 0x2b
mov ecx, 2
imul rcx, rcx, 7
mov rdx, qword [rbp + 0x388]
movzx eax, word [rbp + rax + 0x2e0]
mov word [rdx + rcx], ax
mov eax, 2
imul rax, rax, 0xe
mov ecx, 2
imul rcx, rcx, 0x1b
mov rdx, qword [rbp + 0x388]
movzx eax, word [rbp + rax + 0x2e0]
mov word [rdx + rcx], ax
mov eax, 2
imul rax, rax, 0x2d
xor ecx, ecx
mov rdx, qword [rbp + 0x388]
mov word [rdx + rax], cx
mov eax, 2
imul rax, rax, 0x11
mov ecx, 2
imul rcx, rcx, 0x26
mov rdx, qword [rbp + 0x388]
movzx eax, word [rbp + rax + 0x2e0]
mov word [rdx + rcx], ax
lea rax, [rbp + 8]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp + 0x388]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rbp + 0x24], eax
mov dword [rbp + 0x3a4], 0
jmp 0x140011301
mov eax, dword [rbp + 0x3a4]
inc eax
mov dword [rbp + 0x3a4], eax
cmp dword [rbp + 0x3a4], 0x2e
jge 0x140011320
movsxd rax, dword [rbp + 0x3a4]
xor ecx, ecx
mov rdx, qword [rbp + 0x388]
mov word [rdx + rax*2], cx
jmp 0x1400112f3
mov rcx, qword [rbp + 0x388]
call qword [sym.imp.ucrtbased.dll_free]
nop
cmp dword [rbp + 0x24], 0
jne 0x140011340
mov dword [rbp + 0x534], 1
jmp 0x14001134a
mov dword [rbp + 0x534], 0
mov eax, dword [rbp + 0x534]
mov dword [rbp + 0x44], eax
cmp dword [rbp + 0x44], 0
je 0x1400113bb
lea rax, [rbp + 0x2b4]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x90]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x64]
mov qword [rsp + 0x20], rax
mov r9d, 2
lea r8, str.Microsoft_Store
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov dword [rbp + 0x24], eax
cmp dword [rbp + 0x24], 0
jne 0x1400113a8
mov dword [rbp + 0x534], 1
jmp 0x1400113b2
mov dword [rbp + 0x534], 0
mov eax, dword [rbp + 0x534]
mov dword [rbp + 0x44], eax
cmp dword [rbp + 0x44], 0
je 0x1400113f2
lea rcx, [rbp + 0x90]
call qword [sym.imp.ucrtbased.dll_wcslen]
test rax, rax
jbe 0x1400113df
mov dword [rbp + 0x534], 1
jmp 0x1400113e9
mov dword [rbp + 0x534], 0
mov eax, dword [rbp + 0x534]
mov dword [rbp + 0x44], eax
cmp qword [rbp + 8], 0
je 0x14001140c
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov qword [rbp + 8], 0
mov eax, dword [rbp + 0x44]
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x140023ae0]
call fcn.1400016e5
mov rax, rdi
mov rcx, qword [rbp + 0x538]
xor rcx, rbp
call fcn.1400013e8
lea rsp, [rbp + 0x540]
pop rdi
pop rsi
pop rbp
ret