Function at 0x1400030f0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push r12
push r15
sub rsp, 0x830
mov rax, qword [0x140025008]
xor rax, rsp
mov qword [rsp + 0x820], rax
mov rbx, qword [0x140027008]
test rbx, rbx
je 0x140003474
call fcn.140004bc0
test al, al
je 0x140003474
mov rax, qword [0x140027048]
lea r8, [rsp + 0x30]
xor r12d, r12d
xor edx, edx
mov rcx, rbx
mov dword [rsp + 0x30], r12d
mov r15d, r12d
call qword [0x1400183c0]
test eax, eax
jne 0x14000315e
mov ecx, dword [rsp + 0x30]
call fcn.140004d30
mov r15, rax
mov ecx, dword [rsp + 0x30]
test ecx, ecx
je 0x140003173
mov rax, qword [0x140027030]
call qword [0x1400183c0]
test r15, r15
je 0x140003474
mov qword [rsp + 0x850], rbp
mov rbx, r15
mov qword [rsp + 0x858], rsi
mov qword [rsp + 0x860], rdi
lea rdi, str.5.0.0.1
mov qword [rsp + 0x868], r14
xor r14b, r14b
nop dword [rax]
mov edx, 0x2e
mov rcx, rbx
call fcn.1400072c4
mov rbp, rax
test rax, rax
jne 0x1400031e3
mov rax, 0xffffffffffffffff
nop dword [rax]
cmp word [rbx + rax*2 + 2], r12w
lea rax, [rax + 1]
jne 0x1400031d0
lea rbp, [rbx + rax*2]
mov r14b, 1
mov edx, 0x2e
mov rcx, rdi
call fcn.1400072c4
mov rsi, rax
test rax, rax
jne 0x140003213
mov rax, 0xffffffffffffffff
nop
cmp word [rdi + rax*2 + 2], r12w
lea rax, [rax + 1]
jne 0x140003200
lea rsi, [rdi + rax*2]
mov r14b, 1
mov rdx, rbp
mov rcx, rbx
sub rdx, rbx
sar rdx, 1
call fcn.140005050
mov rdx, rsi
mov rcx, rdi
sub rdx, rdi
mov ebx, eax
sar rdx, 1
call fcn.140005050
cmp ebx, eax
ja 0x140003252
jb 0x14000336d
lea rbx, [rbp + 2]
lea rdi, [rsi + 2]
test r14b, r14b
je 0x1400031b0
mov dil, 1
call fcn.140005130
test al, al
jne 0x140003441
lea rax, [rsp + 0x40]
mov qword [rsp + 0x40], r12
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftwareZoomUMXPerInstall
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000337c
mov rbx, qword [rsp + 0x40]
test rbx, rbx
je 0x14000338c
xor edx, edx
mov dword [rsp + 0x34], r12d
mov r8d, 0x7d0
lea rcx, [rsp + 0x50]
call fcn.140007690
lea rax, [rsp + 0x38]
mov dword [rsp + 0x38], 0x7ce
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x50]
xor r8d, r8d
lea rdx, str.allowdowngrade
mov qword [rsp + 0x20], rax
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140003375
cmp dword [rsp + 0x34], 1
jne 0x140003375
cmp dword [rsp + 0x38], r12d
je 0x140003375
lea rcx, [rsp + 0x50]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r12w
jne 0x140003311
test rax, rax
je 0x14000338c
lea rbx, [rax + rax]
lea rcx, [rbx + 2]
call fcn.14000c8f8
mov rsi, rax
test rax, rax
je 0x14000338c
mov r8, rbx
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.140009d30
lea rdx, [0x140020a08]
mov word [rbx + rsi], r12w
mov rcx, rsi
call fcn.14000a65c
mov rcx, rsi
mov ebx, eax
call fcn.14000c8e4
test ebx, ebx
je 0x140003441
jmp 0x14000338c
xor dil, dil
jmp 0x140003255
mov rcx, qword [rsp + 0x40]
jmp 0x140003386
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14000338c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r14b, r14b
lea rbx, str.5.17.34827
mov rdi, r15
nop dword [rax]
mov edx, 0x2e
mov rcx, rbx
call fcn.1400072c4
mov rbp, rax
test rax, rax
jne 0x1400033d3
mov rax, 0xffffffffffffffff
nop dword [rax]
cmp word [rbx + rax*2 + 2], r12w
lea rax, [rax + 1]
jne 0x1400033c0
lea rbp, [rbx + rax*2]
mov r14b, 1
mov edx, 0x2e
mov rcx, rdi
call fcn.1400072c4
mov rsi, rax
test rax, rax
jne 0x140003403
mov rax, 0xffffffffffffffff
nop
cmp word [rdi + rax*2 + 2], r12w
lea rax, [rax + 1]
jne 0x1400033f0
lea rsi, [rdi + rax*2]
mov r14b, 1
mov rdx, rbp
mov rcx, rbx
sub rdx, rbx
sar rdx, 1
call fcn.140005050
mov rdx, rsi
mov rcx, rdi
sub rdx, rdi
mov ebx, eax
sar rdx, 1
call fcn.140005050
cmp ebx, eax
ja 0x14000343e
jb 0x14000346f
lea rbx, [rbp + 2]
lea rdi, [rsi + 2]
test r14b, r14b
je 0x1400033a0
xor dil, dil
mov rcx, r15
call fcn.14000c8e4
mov r14, qword [rsp + 0x868]
movzx eax, dil
mov rdi, qword [rsp + 0x860]
mov rsi, qword [rsp + 0x858]
mov rbp, qword [rsp + 0x850]
jmp 0x140003476
mov dil, 1
jmp 0x140003441
xor al, al
mov rcx, qword [rsp + 0x820]
xor rcx, rsp
call fcn.1400059f0
add rsp, 0x830
pop r15
pop r12
pop rbx
ret