Function at 0x1400036c0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x7f0]
sub rsp, 0x8f0
mov rax, qword [0x140025008]
xor rax, rsp
mov qword [rbp + 0x7e0], rax
mov rbx, qword [0x140027008]
mov eax, 0xa
lea rsi, [rax - 0xb]
test rbx, rbx
je 0x140003724
mov rax, rsi
nop dword [rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x140003710
add rax, 0xa
je 0x140003aff
lea r15, [rax*2 + 2]
mov rcx, r15
call fcn.14000c8d8
mov r14, rax
test rax, rax
je 0x140003aff
movups xmm0, xmmword [str._package__]
mov rdi, rax
mov rcx, r15
xor eax, eax
rep stosb byte [rdi], al
mov eax, dword [0x140020d20]
movups xmmword [r14], xmm0
mov dword [r14 + 0x10], eax
test rbx, rbx
je 0x14000378a
mov r8, rsi
nop word [rax + rax]
inc r8
cmp word [rbx + r8*2], 0
jne 0x140003770
add r8, r8
lea rcx, [r14 + 0x14]
mov rdx, rbx
call fcn.140009d10
mov rax, rsi
nop dword [rax]
inc rax
cmp word [r14 + rax*2], 0
jne 0x140003790
add rax, 0xd
je 0x140003af7
lea r15, [rax*2 + 2]
mov rcx, r15
call fcn.14000c8d8
mov rbx, rax
test rax, rax
je 0x140003af7
mov rdi, rax
mov rcx, r15
xor eax, eax
rep stosb byte [rdi], al
mov rdi, rsi
nop
inc rdi
cmp word [r14 + rdi*2], ax
jne 0x1400037d0
add rdi, rdi
mov rdx, r14
mov r8, rdi
mov rcx, rbx
call fcn.140009d10
movups xmm0, xmmword [str.___norestart]
mov rcx, r14
movzx eax, word [0x140020d40]
movsd xmm1, qword [0x140020d38]
movups xmmword [rdi + rbx], xmm0
movsd qword [rdi + rbx + 0x10], xmm1
mov word [rdi + rbx + 0x18], ax
call fcn.14000c8c4
cmp dword [0x140027000], 0
je 0x140003893
mov rax, rsi
inc rax
cmp word [rbx + rax*2], 0
jne 0x140003824
add rax, 4
je 0x140003aca
lea r15, [rax*2 + 2]
mov rcx, r15
call fcn.14000c8d8
mov r14, rax
test rax, rax
je 0x140003aca
mov rdi, rax
mov rcx, r15
xor eax, eax
rep stosb byte [rdi], al
nop
cmp word [rbx + rsi*2 + 2], ax
lea rsi, [rsi + 1]
jne 0x140003860
lea rdi, [rsi + rsi]
mov rdx, rbx
mov r8, rdi
mov rcx, r14
call fcn.140009d10
mov rax, qword [str._qn]
mov rcx, rbx
mov qword [rdi + r14], rax
call fcn.14000c8c4
mov rbx, r14
lea rax, str.enableupdate
xor r14d, r14d
mov qword [rsp + 0x50], rax
lea r15, str.AllowDowngrade
lea rax, str.ZoomAutoUpdate
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x58], rax
lea rdx, str.SoftwareZoomUMXPerInstall
lea rax, str.autostart
mov qword [rbp + 8], r15
mov qword [rsp + 0x60], rax
lea r9d, [r14 + 1]
lea rax, str.ZoomAutoStart
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x68], rax
xor r8d, r8d
lea rax, str.nodesktopshortcut
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x70], rax
lea rax, str.ZNoDesktopShortCut
mov qword [rsp + 0x78], rax
lea rax, str.ssohost
mov qword [rbp - 0x80], rax
lea rax, str.ZSSOHOST
mov qword [rbp - 0x78], rax
lea rax, str.zInstallOption
mov qword [rbp - 0x70], rax
lea rax, str.ZoomInstallOption
mov qword [rbp - 0x68], rax
lea rax, str.zconfig
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
lea rax, str.silentstart
mov qword [rbp - 0x50], rax
lea rax, str.ZSILENTSTART
mov qword [rbp - 0x48], rax
lea rax, str.zrecommend
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
lea rax, str.znocptservice
mov qword [rbp - 0x30], rax
lea rax, str.DisableAdvancedSharingService
mov qword [rbp - 0x28], rax
lea rax, str.firewallstart
mov qword [rbp - 0x20], rax
lea rax, str.FirewallPortStart
mov qword [rbp - 0x18], rax
lea rax, str.firewallend
mov qword [rbp - 0x10], rax
lea rax, str.FirewallPortEnd
mov qword [rbp - 8], rax
lea rax, str.allowdowngrade
mov qword [rbp], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140003a61
mov esi, r14d
lea rdi, [rsp + 0x58]
nop word [rax + rax]
xor edx, edx
mov dword [rsp + 0x30], r14d
mov r8d, 0x7d0
lea rcx, [rbp + 0x10]
call fcn.140007670
mov rdx, qword [rdi - 8]
lea rax, [rsp + 0x34]
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
xor r8d, r8d
lea rax, [rbp + 0x10]
mov dword [rsp + 0x34], 0x7ce
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140003a4f
cmp dword [rsp + 0x30], 1
jne 0x140003a4f
cmp dword [rsp + 0x34], r14d
je 0x140003a4f
mov rdx, qword [rdi]
lea r8, [rbp + 0x10]
lea rcx, [rsp + 0x38]
call fcn.1400034a0
test al, al
je 0x140003a5c
inc rsi
add rdi, 0x10
cmp rsi, 0xc
jb 0x1400039e0
mov r14, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140003a71
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.140005110
test al, al
je 0x140003aa3
test r14, r14
je 0x140003a8f
mov rdx, r15
mov rcx, r14
call fcn.140006f20
test rax, rax
jne 0x140003aa3
lea r8, [0x140020a08]
mov rdx, r15
lea rcx, [rsp + 0x38]
call fcn.1400034a0
lea r8, str.true
lea rdx, str.ZLAUNCHAPP
lea rcx, [rsp + 0x38]
call fcn.1400034a0
mov rdi, qword [rsp + 0x38]
test rdi, rdi
jne 0x140003acf
test rbx, rbx
je 0x140003aff
mov rcx, rbx
jmp 0x140003afa
mov rdx, rdi
mov rcx, rbx
call fcn.1400048f0
mov rsi, rax
test rbx, rbx
je 0x140003aea
mov rcx, rbx
call fcn.14000c8c4
mov rcx, rdi
call fcn.14000c8c4
mov rax, rsi
jmp 0x140003b01
mov rcx, r14
call fcn.14000c8c4
xor eax, eax
mov rcx, qword [rbp + 0x7e0]
xor rcx, rsp
call fcn.1400059d0
lea r11, [rsp + 0x8f0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret