Function at 0x1400037d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x7f0]
sub rsp, 0x8f0
mov rax, qword [0x140026008]
xor rax, rsp
mov qword [rbp + 0x7e0], rax
mov rbx, qword [0x140028008]
mov eax, 0xa
lea rsi, [rax - 0xb]
test rbx, rbx
je 0x140003834
mov rax, rsi
nop dword [rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x140003820
add rax, 0xa
je 0x140003c2f
lea r15, [rax*2 + 2]
mov rcx, r15
call fcn.14000cd78
mov r14, rax
test rax, rax
je 0x140003c2f
movups xmm0, xmmword [str._package__]
mov rdi, rax
mov rcx, r15
xor eax, eax
rep stosb byte [rdi], al
mov eax, dword [0x140021d98]
movups xmmword [r14], xmm0
mov dword [r14 + 0x10], eax
test rbx, rbx
je 0x14000389a
mov r8, rsi
nop word [rax + rax]
inc r8
cmp word [rbx + r8*2], 0
jne 0x140003880
add r8, r8
lea rcx, [r14 + 0x14]
mov rdx, rbx
call fcn.14000a130
mov rax, rsi
nop dword [rax]
inc rax
cmp word [r14 + rax*2], 0
jne 0x1400038a0
add rax, 0xd
je 0x140003c27
lea r15, [rax*2 + 2]
mov rcx, r15
call fcn.14000cd78
mov rbx, rax
test rax, rax
je 0x140003c27
mov rdi, rax
mov rcx, r15
xor eax, eax
rep stosb byte [rdi], al
mov rdi, rsi
nop
inc rdi
cmp word [r14 + rdi*2], ax
jne 0x1400038e0
add rdi, rdi
mov rdx, r14
mov r8, rdi
mov rcx, rbx
call fcn.14000a130
movups xmm0, xmmword [str.___norestart]
mov rcx, r14
movzx eax, word [0x140021db8]
movsd xmm1, qword [0x140021db0]
movups xmmword [rdi + rbx], xmm0
movsd qword [rdi + rbx + 0x10], xmm1
mov word [rdi + rbx + 0x18], ax
call fcn.14000cd64
cmp dword [0x140028000], 0
je 0x1400039a3
mov rax, rsi
inc rax
cmp word [rbx + rax*2], 0
jne 0x140003934
add rax, 4
je 0x140003bfa
lea r15, [rax*2 + 2]
mov rcx, r15
call fcn.14000cd78
mov r14, rax
test rax, rax
je 0x140003bfa
mov rdi, rax
mov rcx, r15
xor eax, eax
rep stosb byte [rdi], al
nop
cmp word [rbx + rsi*2 + 2], ax
lea rsi, [rsi + 1]
jne 0x140003970
lea rdi, [rsi + rsi]
mov rdx, rbx
mov r8, rdi
mov rcx, r14
call fcn.14000a130
mov rax, qword [str._qn]
mov rcx, rbx
mov qword [rdi + r14], rax
call fcn.14000cd64
mov rbx, r14
lea rax, str.enableupdate
xor r14d, r14d
mov qword [rsp + 0x50], rax
lea r15, str.AllowDowngrade
lea rax, str.ZoomAutoUpdate
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x58], rax
lea rdx, str.SoftwareZoomUMXPerInstall
lea rax, str.autostart
mov qword [rbp + 8], r15
mov qword [rsp + 0x60], rax
lea r9d, [r14 + 1]
lea rax, str.ZoomAutoStart
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x68], rax
xor r8d, r8d
lea rax, str.nodesktopshortcut
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x70], rax
lea rax, str.ZNoDesktopShortCut
mov qword [rsp + 0x78], rax
lea rax, str.ssohost
mov qword [rbp - 0x80], rax
lea rax, str.ZSSOHOST
mov qword [rbp - 0x78], rax
lea rax, str.zInstallOption
mov qword [rbp - 0x70], rax
lea rax, str.ZoomInstallOption
mov qword [rbp - 0x68], rax
lea rax, str.zconfig
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
lea rax, str.silentstart
mov qword [rbp - 0x50], rax
lea rax, str.ZSILENTSTART
mov qword [rbp - 0x48], rax
lea rax, str.zrecommend
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
lea rax, str.znocptservice
mov qword [rbp - 0x30], rax
lea rax, str.DisableAdvancedSharingService
mov qword [rbp - 0x28], rax
lea rax, str.firewallstart
mov qword [rbp - 0x20], rax
lea rax, str.FirewallPortStart
mov qword [rbp - 0x18], rax
lea rax, str.firewallend
mov qword [rbp - 0x10], rax
lea rax, str.FirewallPortEnd
mov qword [rbp - 8], rax
lea rax, str.allowdowngrade
mov qword [rbp], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140003b08
lea rax, [rsp + 0x40]
mov r9d, 0x201
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareZoomUMXPerInstall
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140003b91
mov rsi, r14
lea rdi, [rsp + 0x58]
xor edx, edx
mov dword [rsp + 0x30], r14d
mov r8d, 0x7d0
lea rcx, [rbp + 0x10]
call fcn.140007a90
mov rdx, qword [rdi - 8]
lea rax, [rsp + 0x34]
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
xor r8d, r8d
lea rax, [rbp + 0x10]
mov dword [rsp + 0x34], 0x7ce
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140003b7f
cmp dword [rsp + 0x30], 1
jne 0x140003b7f
cmp dword [rsp + 0x34], r14d
je 0x140003b7f
mov rdx, qword [rdi]
lea r8, [rbp + 0x10]
lea rcx, [rsp + 0x38]
call fcn.1400035b0
test al, al
je 0x140003b8c
inc rsi
add rdi, 0x10
cmp rsi, 0xc
jb 0x140003b10
mov r14, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140003ba1
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.140005490
test al, al
je 0x140003bd3
test r14, r14
je 0x140003bbf
mov rdx, r15
mov rcx, r14
call fcn.140007340
test rax, rax
jne 0x140003bd3
lea r8, [0x140021a88]
mov rdx, r15
lea rcx, [rsp + 0x38]
call fcn.1400035b0
lea r8, str.true
lea rdx, str.ZLAUNCHAPP
lea rcx, [rsp + 0x38]
call fcn.1400035b0
mov rdi, qword [rsp + 0x38]
test rdi, rdi
jne 0x140003bff
test rbx, rbx
je 0x140003c2f
mov rcx, rbx
jmp 0x140003c2a
mov rdx, rdi
mov rcx, rbx
call fcn.140004c50
mov rsi, rax
test rbx, rbx
je 0x140003c1a
mov rcx, rbx
call fcn.14000cd64
mov rcx, rdi
call fcn.14000cd64
mov rax, rsi
jmp 0x140003c31
mov rcx, r14
call fcn.14000cd64
xor eax, eax
mov rcx, qword [rbp + 0x7e0]
xor rcx, rsp
call fcn.140005df0
lea r11, [rsp + 0x8f0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret