Function at 0x1400036c0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x7f0]
sub rsp, 0x8f0
mov rax, qword [0x140025008]
xor rax, rsp
mov qword [rbp + 0x7e0], rax
mov rbx, qword [0x140027008]
mov eax, 0xa
lea rsi, [rax - 0xb]
test rbx, rbx
je 0x140003724
mov rax, rsi
nop dword [rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x140003710
add rax, 0xa
je 0x140003b1f
lea r15, [rax*2 + 2]
mov rcx, r15
call fcn.14000c8f8
mov r14, rax
test rax, rax
je 0x140003b1f
movups xmm0, xmmword [str._package__]
mov rdi, rax
mov rcx, r15
xor eax, eax
rep stosb byte [rdi], al
mov eax, dword [0x140020d20]
movups xmmword [r14], xmm0
mov dword [r14 + 0x10], eax
test rbx, rbx
je 0x14000378a
mov r8, rsi
nop word [rax + rax]
inc r8
cmp word [rbx + r8*2], 0
jne 0x140003770
add r8, r8
lea rcx, [r14 + 0x14]
mov rdx, rbx
call fcn.140009d30
mov rax, rsi
nop dword [rax]
inc rax
cmp word [r14 + rax*2], 0
jne 0x140003790
add rax, 0xd
je 0x140003b17
lea r15, [rax*2 + 2]
mov rcx, r15
call fcn.14000c8f8
mov rbx, rax
test rax, rax
je 0x140003b17
mov rdi, rax
mov rcx, r15
xor eax, eax
rep stosb byte [rdi], al
mov rdi, rsi
nop
inc rdi
cmp word [r14 + rdi*2], ax
jne 0x1400037d0
add rdi, rdi
mov rdx, r14
mov r8, rdi
mov rcx, rbx
call fcn.140009d30
movups xmm0, xmmword [str.___norestart]
mov rcx, r14
movzx eax, word [0x140020d40]
movsd xmm1, qword [0x140020d38]
movups xmmword [rdi + rbx], xmm0
movsd qword [rdi + rbx + 0x10], xmm1
mov word [rdi + rbx + 0x18], ax
call fcn.14000c8e4
cmp dword [0x140027000], 0
je 0x140003893
mov rax, rsi
inc rax
cmp word [rbx + rax*2], 0
jne 0x140003824
add rax, 4
je 0x140003aea
lea r15, [rax*2 + 2]
mov rcx, r15
call fcn.14000c8f8
mov r14, rax
test rax, rax
je 0x140003aea
mov rdi, rax
mov rcx, r15
xor eax, eax
rep stosb byte [rdi], al
nop
cmp word [rbx + rsi*2 + 2], ax
lea rsi, [rsi + 1]
jne 0x140003860
lea rdi, [rsi + rsi]
mov rdx, rbx
mov r8, rdi
mov rcx, r14
call fcn.140009d30
mov rax, qword [str._qn]
mov rcx, rbx
mov qword [rdi + r14], rax
call fcn.14000c8e4
mov rbx, r14
lea rax, str.enableupdate
xor r14d, r14d
mov qword [rsp + 0x50], rax
lea r15, str.AllowDowngrade
lea rax, str.ZoomAutoUpdate
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x58], rax
lea rdx, str.SoftwareZoomUMXPerInstall
lea rax, str.autostart
mov qword [rbp + 8], r15
mov qword [rsp + 0x60], rax
lea r9d, [r14 + 1]
lea rax, str.ZoomAutoStart
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x68], rax
xor r8d, r8d
lea rax, str.nodesktopshortcut
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x70], rax
lea rax, str.ZNoDesktopShortCut
mov qword [rsp + 0x78], rax
lea rax, str.ssohost
mov qword [rbp - 0x80], rax
lea rax, str.ZSSOHOST
mov qword [rbp - 0x78], rax
lea rax, str.zInstallOption
mov qword [rbp - 0x70], rax
lea rax, str.ZoomInstallOption
mov qword [rbp - 0x68], rax
lea rax, str.zconfig
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
lea rax, str.silentstart
mov qword [rbp - 0x50], rax
lea rax, str.ZSILENTSTART
mov qword [rbp - 0x48], rax
lea rax, str.zrecommend
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
lea rax, str.znocptservice
mov qword [rbp - 0x30], rax
lea rax, str.DisableAdvancedSharingService
mov qword [rbp - 0x28], rax
lea rax, str.firewallstart
mov qword [rbp - 0x20], rax
lea rax, str.FirewallPortStart
mov qword [rbp - 0x18], rax
lea rax, str.firewallend
mov qword [rbp - 0x10], rax
lea rax, str.FirewallPortEnd
mov qword [rbp - 8], rax
lea rax, str.allowdowngrade
mov qword [rbp], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400039f8
lea rax, [rsp + 0x40]
mov r9d, 0x201
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareZoomUMXPerInstall
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140003a81
mov rsi, r14
lea rdi, [rsp + 0x58]
xor edx, edx
mov dword [rsp + 0x30], r14d
mov r8d, 0x7d0
lea rcx, [rbp + 0x10]
call fcn.140007690
mov rdx, qword [rdi - 8]
lea rax, [rsp + 0x34]
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
xor r8d, r8d
lea rax, [rbp + 0x10]
mov dword [rsp + 0x34], 0x7ce
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140003a6f
cmp dword [rsp + 0x30], 1
jne 0x140003a6f
cmp dword [rsp + 0x34], r14d
je 0x140003a6f
mov rdx, qword [rdi]
lea r8, [rbp + 0x10]
lea rcx, [rsp + 0x38]
call fcn.1400034a0
test al, al
je 0x140003a7c
inc rsi
add rdi, 0x10
cmp rsi, 0xc
jb 0x140003a00
mov r14, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140003a91
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.140005130
test al, al
je 0x140003ac3
test r14, r14
je 0x140003aaf
mov rdx, r15
mov rcx, r14
call fcn.140006f40
test rax, rax
jne 0x140003ac3
lea r8, [0x140020a08]
mov rdx, r15
lea rcx, [rsp + 0x38]
call fcn.1400034a0
lea r8, str.true
lea rdx, str.ZLAUNCHAPP
lea rcx, [rsp + 0x38]
call fcn.1400034a0
mov rdi, qword [rsp + 0x38]
test rdi, rdi
jne 0x140003aef
test rbx, rbx
je 0x140003b1f
mov rcx, rbx
jmp 0x140003b1a
mov rdx, rdi
mov rcx, rbx
call fcn.140004910
mov rsi, rax
test rbx, rbx
je 0x140003b0a
mov rcx, rbx
call fcn.14000c8e4
mov rcx, rdi
call fcn.14000c8e4
mov rax, rsi
jmp 0x140003b21
mov rcx, r14
call fcn.14000c8e4
xor eax, eax
mov rcx, qword [rbp + 0x7e0]
xor rcx, rsp
call fcn.1400059f0
lea r11, [rsp + 0x8f0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret