Function at 0x140003200
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push r12
push r15
sub rsp, 0x830
mov rax, qword [0x140026008]
xor rax, rsp
mov qword [rsp + 0x820], rax
mov rbx, qword [0x140028008]
test rbx, rbx
je 0x140003584
call fcn.140004f00
test al, al
je 0x140003584
mov rax, qword [0x140028048]
lea r8, [rsp + 0x30]
xor r12d, r12d
xor edx, edx
mov rcx, rbx
mov dword [rsp + 0x30], r12d
mov r15d, r12d
call qword [0x1400193d0]
test eax, eax
jne 0x140003275
mov ecx, dword [rsp + 0x30]
lea rdx, [0x140022018]
call fcn.140005090
mov r15, rax
mov ecx, dword [rsp + 0x30]
test ecx, ecx
je 0x14000328a
mov rax, qword [0x140028030]
call qword [0x1400193d0]
test r15, r15
je 0x140003584
mov qword [rsp + 0x850], rbp
mov rbx, r15
mov qword [rsp + 0x858], rsi
mov qword [rsp + 0x860], rdi
lea rdi, str.5.0.0.1
mov qword [rsp + 0x868], r14
xor r14b, r14b
mov edx, 0x2e
mov rcx, rbx
call fcn.1400076c4
mov rbp, rax
test rax, rax
jne 0x1400032f3
mov rax, 0xffffffffffffffff
nop dword [rax]
cmp word [rbx + rax*2 + 2], r12w
lea rax, [rax + 1]
jne 0x1400032e0
lea rbp, [rbx + rax*2]
mov r14b, 1
mov edx, 0x2e
mov rcx, rdi
call fcn.1400076c4
mov rsi, rax
test rax, rax
jne 0x140003323
mov rax, 0xffffffffffffffff
nop
cmp word [rdi + rax*2 + 2], r12w
lea rax, [rax + 1]
jne 0x140003310
lea rsi, [rdi + rax*2]
mov r14b, 1
mov rdx, rbp
mov rcx, rbx
sub rdx, rbx
sar rdx, 1
call fcn.1400053b0
mov rdx, rsi
mov rcx, rdi
sub rdx, rdi
mov ebx, eax
sar rdx, 1
call fcn.1400053b0
cmp ebx, eax
ja 0x140003362
jb 0x14000347d
lea rbx, [rbp + 2]
lea rdi, [rsi + 2]
test r14b, r14b
je 0x1400032c0
mov dil, 1
call fcn.140005490
test al, al
jne 0x140003551
lea rax, [rsp + 0x40]
mov qword [rsp + 0x40], r12
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftwareZoomUMXPerInstall
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000348c
mov rbx, qword [rsp + 0x40]
test rbx, rbx
je 0x14000349c
xor edx, edx
mov dword [rsp + 0x34], r12d
mov r8d, 0x7d0
lea rcx, [rsp + 0x50]
call fcn.140007a90
lea rax, [rsp + 0x38]
mov dword [rsp + 0x38], 0x7ce
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x50]
xor r8d, r8d
lea rdx, str.allowdowngrade
mov qword [rsp + 0x20], rax
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140003485
cmp dword [rsp + 0x34], 1
jne 0x140003485
cmp dword [rsp + 0x38], r12d
je 0x140003485
lea rcx, [rsp + 0x50]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r12w
jne 0x140003421
test rax, rax
je 0x14000349c
lea rbx, [rax + rax]
lea rcx, [rbx + 2]
call fcn.14000cd78
mov rsi, rax
test rax, rax
je 0x14000349c
mov r8, rbx
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.14000a130
lea rdx, [0x140021a88]
mov word [rbx + rsi], r12w
mov rcx, rsi
call fcn.14000aa5c
mov rcx, rsi
mov ebx, eax
call fcn.14000cd64
test ebx, ebx
je 0x140003551
jmp 0x14000349c
xor dil, dil
jmp 0x140003365
mov rcx, qword [rsp + 0x40]
jmp 0x140003496
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14000349c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r14b, r14b
lea rbx, str.6.2.50939
mov rdi, r15
nop dword [rax]
mov edx, 0x2e
mov rcx, rbx
call fcn.1400076c4
mov rbp, rax
test rax, rax
jne 0x1400034e3
mov rax, 0xffffffffffffffff
nop dword [rax]
cmp word [rbx + rax*2 + 2], r12w
lea rax, [rax + 1]
jne 0x1400034d0
lea rbp, [rbx + rax*2]
mov r14b, 1
mov edx, 0x2e
mov rcx, rdi
call fcn.1400076c4
mov rsi, rax
test rax, rax
jne 0x140003513
mov rax, 0xffffffffffffffff
nop
cmp word [rdi + rax*2 + 2], r12w
lea rax, [rax + 1]
jne 0x140003500
lea rsi, [rdi + rax*2]
mov r14b, 1
mov rdx, rbp
mov rcx, rbx
sub rdx, rbx
sar rdx, 1
call fcn.1400053b0
mov rdx, rsi
mov rcx, rdi
sub rdx, rdi
mov ebx, eax
sar rdx, 1
call fcn.1400053b0
cmp ebx, eax
ja 0x14000354e
jb 0x14000357f
lea rbx, [rbp + 2]
lea rdi, [rsi + 2]
test r14b, r14b
je 0x1400034b0
xor dil, dil
mov rcx, r15
call fcn.14000cd64
mov r14, qword [rsp + 0x868]
movzx eax, dil
mov rdi, qword [rsp + 0x860]
mov rsi, qword [rsp + 0x858]
mov rbp, qword [rsp + 0x850]
jmp 0x140003586
mov dil, 1
jmp 0x140003551
xor al, al
mov rcx, qword [rsp + 0x820]
xor rcx, rsp
call fcn.140005df0
add rsp, 0x830
pop r15
pop r12
pop rbx
ret