Function at 0x414036
Capabilities:
Set registry value

Disassembly:
push 0x60
mov eax, 0x4666d5
call fcn.00464982
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
mov edi, 0x2001f
mov dword [ebp - 4], ebx
push edi
push str.SoftwareClasses
push SysReAllocString
lea ecx, [ebp - 0x68]
call fcn.00408cbb
cmp byte [ebp + 8], bl
jne 0x4144b1
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
push ecx
push ecx
push edi
push ecx
push ecx
push str.zoommtg
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x50]
push dword [ebp - 0x68]
call fcn.00408c53
mov edi, eax
test edi, edi
jne 0x41444a
push ecx
push str.URL:Zoom_Launcher
push ebx
lea ecx, [ebp - 0x50]
call fcn.00408d87
push ecx
push 0x47a6ec
push str.URL_Protocol
lea ecx, [ebp - 0x50]
call fcn.00408d87
push 4
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], 1
push eax
push 4
push ebx
mov ebx, dword [ebp - 0x50]
push str.UseOriginalUrlEncoding
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor eax, eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
push ecx
push ecx
push 0x2001f
push ecx
push ecx
push str.DefaultIcon
push ebx
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 2
call fcn.00408c53
mov edi, eax
test edi, edi
jne 0x4141b1
push 0x47b540
lea ecx, [ebp - 0x28]
call fcn.0040a58e
mov byte [ebp - 4], 3
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x41412b
mov eax, dword [esi]
push dword [esi + 0x10]
lea ecx, [ebp - 0x28]
push eax
call fcn.0040b5aa
mov edi, 0x4799c8
push edi
call fcn.0043d5e8
pop ecx
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.0040b5aa
mov edi, str.Zoom.exe
push edi
call fcn.0043d5e8
pop ecx
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.0040b5aa
mov edi, 0x47b9b4
push edi
call fcn.0043d5e8
pop ecx
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.0040b5aa
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push ecx
cmovae eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x5c]
push eax
push 0
call fcn.00408d87
mov edi, dword [ebp - 0x5c]
test edi, edi
je 0x4141a3
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
mov dword [ebp - 0x5c], edi
and dword [ebp - 0x58], 0
lea ecx, [ebp - 0x28]
call fcn.0040acc1
jmp 0x414206
push 0x1ef
push str.c:jenkinsworkspaceClientClientWindows_releaseclient_srcinstallwindowsIncludeZoomRegUtil.cpp
push 2
lea ecx, [ebp - 0x44]
call fcn.0040c45a
mov byte [ebp - 4], 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push ecx
mov edx, str._RegZoomAppProtocol__failed_to_create_app_protocol_home__defaultIcon__ret:
mov ecx, 0x490290
call fcn.0040635c
pop ecx
mov ecx, eax
call fcn.00416564
push ecx
mov edx, 0x47b4e4
mov ecx, eax
call fcn.0040635c
pop ecx
mov ecx, eax
call fcn.0040719b
lea ecx, [ebp - 0x44]
call fcn.0040c5f9
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
push ecx
push ecx
push 0x2001f
push ecx
push ecx
push str.shell
push ebx
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 5
call fcn.00408c53
mov edi, eax
test edi, edi
jne 0x41436b
push ecx
push ecx
push 0x2001f
push ecx
push ecx
push str.open
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x1c]
call fcn.00408c53
mov edi, eax
test edi, edi
jne 0x414304
push ecx
push ecx
push 0x2001f
push ecx
push ecx
push str.command
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x1c]
call fcn.00408c53
test eax, eax
jne 0x414359
push 0x47b540
lea ecx, [ebp - 0x40]
call fcn.0040a58e
mov byte [ebp - 4], 6
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x414295
mov eax, dword [esi]
push dword [esi + 0x10]
lea ecx, [ebp - 0x40]
push eax
call fcn.0040b5aa
mov edi, 0x4799c8
push edi
call fcn.0043d5e8
pop ecx
push eax
push edi
lea ecx, [ebp - 0x40]
call fcn.0040b5aa
mov edi, str.Zoom.exe
push edi
call fcn.0043d5e8
pop ecx
push eax
push edi
lea ecx, [ebp - 0x40]
call fcn.0040b5aa
mov edi, str._____url_1_
push edi
call fcn.0043d5e8
pop ecx
push eax
push edi
lea ecx, [ebp - 0x40]
call fcn.0040b5aa
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
push ecx
cmovae eax, dword [ebp - 0x40]
lea ecx, [ebp - 0x1c]
push eax
push 0
call fcn.00408d87
lea ecx, [ebp - 0x40]
call fcn.0040acc1
jmp 0x414359
push 0x205
push str.c:jenkinsworkspaceClientClientWindows_releaseclient_srcinstallwindowsIncludeZoomRegUtil.cpp
push 2
lea ecx, [ebp - 0x44]
call fcn.0040c45a
mov byte [ebp - 4], 7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push ecx
mov edx, str._RegZoomAppProtocol__failed_to_create_app_protocol___shell_open_command__ret:
mov ecx, 0x490290
call fcn.0040635c
pop ecx
mov ecx, eax
call fcn.00416564
push ecx
mov edx, 0x47b4e4
mov ecx, eax
call fcn.0040635c
pop ecx
mov ecx, eax
call fcn.0040719b
lea ecx, [ebp - 0x44]
call fcn.0040c5f9
mov edi, dword [ebp - 0x1c]
test edi, edi
je 0x4143c3
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
jmp 0x4143c3
push 0x20a
push str.c:jenkinsworkspaceClientClientWindows_releaseclient_srcinstallwindowsIncludeZoomRegUtil.cpp
push 2
lea ecx, [ebp - 0x44]
call fcn.0040c45a
mov byte [ebp - 4], 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push ecx
mov edx, str._RegZoomAppProtocol__failed_to_create_app_protocol_shell__ret:
mov ecx, 0x490290
call fcn.0040635c
pop ecx
mov ecx, eax
call fcn.00416564
push ecx
mov edx, 0x47b4e4
mov ecx, eax
call fcn.0040635c
pop ecx
mov ecx, eax
call fcn.0040719b
lea ecx, [ebp - 0x44]
call fcn.0040c5f9
mov edi, dword [ebp - 0x1c]
test ebx, ebx
je 0x4143d0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
test edi, edi
je 0x4143db
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x5c]
test eax, eax
je 0x4143e9
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x4143f4
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], ebx
push ecx
push ecx
push 0x2001f
push ecx
push ecx
push str.SoftwareMicrosoftInternet_ExplorerProtocolExecutezoommtg
push SysReAllocString
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0xb
call fcn.00408c53
mov ebx, dword [ebp - 0x5c]
mov edi, eax
test edi, edi
jne 0x414522
push 4
lea eax, [ebp - 0x44]
xor edi, edi
push eax
push 4
push edi
push str.WarnOnOpen
push ebx
mov dword [ebp - 0x44], edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x414579
push 0x20f
push str.c:jenkinsworkspaceClientClientWindows_releaseclient_srcinstallwindowsIncludeZoomRegUtil.cpp
push 2
lea ecx, [ebp - 0x44]
call fcn.0040c45a
mov byte [ebp - 4], 9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push ecx
mov edx, str._RegZoomAppProtocol__failed_to_create_app_protocol_home__ret:
mov ecx, 0x490290
call fcn.0040635c
pop ecx
mov ecx, eax
call fcn.00416564
push ecx
mov edx, 0x47b4e4
mov ecx, eax
call fcn.0040635c
pop ecx
mov ecx, eax
call fcn.0040719b
lea ecx, [ebp - 0x44]
call fcn.0040c5f9
cmp dword [ebp - 0x50], 0
je 0x414661
push dword [ebp - 0x50]
jmp 0x41465b
push str.zoommtg
lea ecx, [ebp - 0x68]
call fcn.0041360f
mov edi, eax
test edi, edi
je 0x4143f6
push 0x216
push str.c:jenkinsworkspaceClientClientWindows_releaseclient_srcinstallwindowsIncludeZoomRegUtil.cpp
push 2
lea ecx, [ebp - 0x44]
call fcn.0040c45a
mov byte [ebp - 4], 0xa
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push ecx
mov edx, str._RegZoomAppProtocol__failed_to_RecurseDeleteKey__ret:
mov ecx, 0x490290
call fcn.0040635c
pop ecx
mov ecx, eax
call fcn.00416564
push ecx
mov edx, 0x47b4e4
mov ecx, eax
call fcn.0040635c
pop ecx
mov ecx, eax
call fcn.0040719b
lea ecx, [ebp - 0x44]
call fcn.0040c5f9
jmp 0x4143f6
push 0x236
push str.c:jenkinsworkspaceClientClientWindows_releaseclient_srcinstallwindowsIncludeZoomRegUtil.cpp
push 2
lea ecx, [ebp - 0x44]
call fcn.0040c45a
mov byte [ebp - 4], 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push ecx
mov edx, str._RegZoomAppProtocol__failed_to_set_WarnOnOpen:
mov ecx, 0x490290
call fcn.0040635c
pop ecx
mov ecx, eax
call fcn.00416564
push ecx
mov edx, 0x47b4e4
mov ecx, eax
call fcn.0040635c
pop ecx
mov ecx, eax
call fcn.0040719b
lea ecx, [ebp - 0x44]
call fcn.0040c5f9
xor edi, edi
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x48], edi
push ecx
push ecx
push 0x2001f
push ecx
push ecx
push str.SoftwareMicrosoftInternet_ExplorerLow_RightsElevationPolicyAFDA28A5_1B5F_4635_9877_73DF0D710C9A
push SysReAllocString
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0xd
call fcn.00408c53
mov edi, dword [ebp - 0x50]
mov dword [ebp - 0x44], eax
test eax, eax
jne 0x4145f4
push ecx
push str.Zoom.exe
push str.AppName
lea ecx, [ebp - 0x50]
call fcn.00408d87
cmp dword [esi + 0x14], 8
jb 0x4145c6
mov esi, dword [esi]
push ecx
push esi
push str.AppPath
lea ecx, [ebp - 0x50]
call fcn.00408d87
push 4
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], 3
push eax
push 4
push 0
push str.Policy
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x41464b
push 0x247
push str.c:jenkinsworkspaceClientClientWindows_releaseclient_srcinstallwindowsIncludeZoomRegUtil.cpp
push 2
lea ecx, [ebp - 0x6c]
call fcn.0040c45a
mov byte [ebp - 4], 0xe
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp - 0x44]
mov edx, str._RegZoomAppProtocol__failed_to_set_ElevationPolicy:
push ecx
mov ecx, 0x490290
call fcn.0040635c
pop ecx
mov ecx, eax
call fcn.00416564
push ecx
mov edx, 0x47b4e4
mov ecx, eax
call fcn.0040635c
pop ecx
mov ecx, eax
call fcn.0040719b
lea ecx, [ebp - 0x6c]
call fcn.0040c5f9
test edi, edi
je 0x414656
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x414661
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x68]
test eax, eax
je 0x41466f
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0046493d
ret