Function at 0x413fd6
Capabilities:
Set registry value

Disassembly:
push 0x60
mov eax, 0x465e65
call fcn.00464112
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
mov edi, 0x2001f
mov dword [ebp - 4], ebx
push edi
push str.SoftwareClasses
push SysReAllocString
lea ecx, [ebp - 0x68]
call fcn.00408c5b
cmp byte [ebp + 8], bl
jne 0x414451
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
push ecx
push ecx
push edi
push ecx
push ecx
push str.zoommtg
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x50]
push dword [ebp - 0x68]
call fcn.00408bf3
mov edi, eax
test edi, edi
jne 0x4143ea
push ecx
push str.URL:Zoom_Launcher
push ebx
lea ecx, [ebp - 0x50]
call fcn.00408d27
push ecx
push 0x47a6bc
push str.URL_Protocol
lea ecx, [ebp - 0x50]
call fcn.00408d27
push 4
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], 1
push eax
push 4
push ebx
mov ebx, dword [ebp - 0x50]
push str.UseOriginalUrlEncoding
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor eax, eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
push ecx
push ecx
push 0x2001f
push ecx
push ecx
push str.DefaultIcon
push ebx
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 2
call fcn.00408bf3
mov edi, eax
test edi, edi
jne 0x414151
push 0x47b4f8
lea ecx, [ebp - 0x28]
call fcn.0040a52e
mov byte [ebp - 4], 3
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x4140cb
mov eax, dword [esi]
push dword [esi + 0x10]
lea ecx, [ebp - 0x28]
push eax
call fcn.0040b54a
mov edi, 0x4799a0
push edi
call fcn.0043cd78
pop ecx
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.0040b54a
mov edi, str.Zoom.exe
push edi
call fcn.0043cd78
pop ecx
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.0040b54a
mov edi, 0x47b96c
push edi
call fcn.0043cd78
pop ecx
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.0040b54a
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push ecx
cmovae eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x5c]
push eax
push 0
call fcn.00408d27
mov edi, dword [ebp - 0x5c]
test edi, edi
je 0x414143
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
mov dword [ebp - 0x5c], edi
and dword [ebp - 0x58], 0
lea ecx, [ebp - 0x28]
call fcn.0040ac61
jmp 0x4141a6
push 0x181
push str.C:jenkinsworkspacezoomciWindows_releaseclient_srcinstallwindowsIncludeZoomRegUtil.cpp
push 2
lea ecx, [ebp - 0x44]
call fcn.0040c3fa
mov byte [ebp - 4], 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push ecx
mov edx, str._RegZoomAppProtocol__failed_to_create_app_protocol_home__defaultIcon__ret:
mov ecx, 0x490270
call fcn.004062fc
pop ecx
mov ecx, eax
call fcn.00416046
push ecx
mov edx, 0x47b49c
mov ecx, eax
call fcn.004062fc
pop ecx
mov ecx, eax
call fcn.0040713b
lea ecx, [ebp - 0x44]
call fcn.0040c599
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
push ecx
push ecx
push 0x2001f
push ecx
push ecx
push str.shell
push ebx
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 5
call fcn.00408bf3
mov edi, eax
test edi, edi
jne 0x41430b
push ecx
push ecx
push 0x2001f
push ecx
push ecx
push str.open
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x1c]
call fcn.00408bf3
mov edi, eax
test edi, edi
jne 0x4142a4
push ecx
push ecx
push 0x2001f
push ecx
push ecx
push str.command
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x1c]
call fcn.00408bf3
test eax, eax
jne 0x4142f9
push 0x47b4f8
lea ecx, [ebp - 0x40]
call fcn.0040a52e
mov byte [ebp - 4], 6
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x414235
mov eax, dword [esi]
push dword [esi + 0x10]
lea ecx, [ebp - 0x40]
push eax
call fcn.0040b54a
mov edi, 0x4799a0
push edi
call fcn.0043cd78
pop ecx
push eax
push edi
lea ecx, [ebp - 0x40]
call fcn.0040b54a
mov edi, str.Zoom.exe
push edi
call fcn.0043cd78
pop ecx
push eax
push edi
lea ecx, [ebp - 0x40]
call fcn.0040b54a
mov edi, str._____url_1_
push edi
call fcn.0043cd78
pop ecx
push eax
push edi
lea ecx, [ebp - 0x40]
call fcn.0040b54a
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
push ecx
cmovae eax, dword [ebp - 0x40]
lea ecx, [ebp - 0x1c]
push eax
push 0
call fcn.00408d27
lea ecx, [ebp - 0x40]
call fcn.0040ac61
jmp 0x4142f9
push 0x197
push str.C:jenkinsworkspacezoomciWindows_releaseclient_srcinstallwindowsIncludeZoomRegUtil.cpp
push 2
lea ecx, [ebp - 0x44]
call fcn.0040c3fa
mov byte [ebp - 4], 7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push ecx
mov edx, str._RegZoomAppProtocol__failed_to_create_app_protocol___shell_open_command__ret:
mov ecx, 0x490270
call fcn.004062fc
pop ecx
mov ecx, eax
call fcn.00416046
push ecx
mov edx, 0x47b49c
mov ecx, eax
call fcn.004062fc
pop ecx
mov ecx, eax
call fcn.0040713b
lea ecx, [ebp - 0x44]
call fcn.0040c599
mov edi, dword [ebp - 0x1c]
test edi, edi
je 0x414363
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
jmp 0x414363
push 0x19c
push str.C:jenkinsworkspacezoomciWindows_releaseclient_srcinstallwindowsIncludeZoomRegUtil.cpp
push 2
lea ecx, [ebp - 0x44]
call fcn.0040c3fa
mov byte [ebp - 4], 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push ecx
mov edx, str._RegZoomAppProtocol__failed_to_create_app_protocol_shell__ret:
mov ecx, 0x490270
call fcn.004062fc
pop ecx
mov ecx, eax
call fcn.00416046
push ecx
mov edx, 0x47b49c
mov ecx, eax
call fcn.004062fc
pop ecx
mov ecx, eax
call fcn.0040713b
lea ecx, [ebp - 0x44]
call fcn.0040c599
mov edi, dword [ebp - 0x1c]
test ebx, ebx
je 0x414370
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
test edi, edi
je 0x41437b
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x5c]
test eax, eax
je 0x414389
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x414394
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], ebx
push ecx
push ecx
push 0x2001f
push ecx
push ecx
push str.SoftwareMicrosoftInternet_ExplorerProtocolExecutezoommtg
push SysReAllocString
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0xb
call fcn.00408bf3
mov ebx, dword [ebp - 0x5c]
mov edi, eax
test edi, edi
jne 0x4144c2
push 4
lea eax, [ebp - 0x44]
xor edi, edi
push eax
push 4
push edi
push str.WarnOnOpen
push ebx
mov dword [ebp - 0x44], edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x414519
push 0x1a1
push str.C:jenkinsworkspacezoomciWindows_releaseclient_srcinstallwindowsIncludeZoomRegUtil.cpp
push 2
lea ecx, [ebp - 0x44]
call fcn.0040c3fa
mov byte [ebp - 4], 9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push ecx
mov edx, str._RegZoomAppProtocol__failed_to_create_app_protocol_home__ret:
mov ecx, 0x490270
call fcn.004062fc
pop ecx
mov ecx, eax
call fcn.00416046
push ecx
mov edx, 0x47b49c
mov ecx, eax
call fcn.004062fc
pop ecx
mov ecx, eax
call fcn.0040713b
lea ecx, [ebp - 0x44]
call fcn.0040c599
cmp dword [ebp - 0x50], 0
je 0x414601
push dword [ebp - 0x50]
jmp 0x4145fb
push str.zoommtg
lea ecx, [ebp - 0x68]
call fcn.004135af
mov edi, eax
test edi, edi
je 0x414396
push 0x1a8
push str.C:jenkinsworkspacezoomciWindows_releaseclient_srcinstallwindowsIncludeZoomRegUtil.cpp
push 2
lea ecx, [ebp - 0x44]
call fcn.0040c3fa
mov byte [ebp - 4], 0xa
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push ecx
mov edx, str._RegZoomAppProtocol__failed_to_RecurseDeleteKey__ret:
mov ecx, 0x490270
call fcn.004062fc
pop ecx
mov ecx, eax
call fcn.00416046
push ecx
mov edx, 0x47b49c
mov ecx, eax
call fcn.004062fc
pop ecx
mov ecx, eax
call fcn.0040713b
lea ecx, [ebp - 0x44]
call fcn.0040c599
jmp 0x414396
push 0x1c8
push str.C:jenkinsworkspacezoomciWindows_releaseclient_srcinstallwindowsIncludeZoomRegUtil.cpp
push 2
lea ecx, [ebp - 0x44]
call fcn.0040c3fa
mov byte [ebp - 4], 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push ecx
mov edx, str._RegZoomAppProtocol__failed_to_set_WarnOnOpen:
mov ecx, 0x490270
call fcn.004062fc
pop ecx
mov ecx, eax
call fcn.00416046
push ecx
mov edx, 0x47b49c
mov ecx, eax
call fcn.004062fc
pop ecx
mov ecx, eax
call fcn.0040713b
lea ecx, [ebp - 0x44]
call fcn.0040c599
xor edi, edi
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x48], edi
push ecx
push ecx
push 0x2001f
push ecx
push ecx
push str.SoftwareMicrosoftInternet_ExplorerLow_RightsElevationPolicyAFDA28A5_1B5F_4635_9877_73DF0D710C9A
push SysReAllocString
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0xd
call fcn.00408bf3
mov edi, dword [ebp - 0x50]
mov dword [ebp - 0x44], eax
test eax, eax
jne 0x414594
push ecx
push str.Zoom.exe
push str.AppName
lea ecx, [ebp - 0x50]
call fcn.00408d27
cmp dword [esi + 0x14], 8
jb 0x414566
mov esi, dword [esi]
push ecx
push esi
push str.AppPath
lea ecx, [ebp - 0x50]
call fcn.00408d27
push 4
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], 3
push eax
push 4
push 0
push str.Policy
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x4145eb
push 0x1d9
push str.C:jenkinsworkspacezoomciWindows_releaseclient_srcinstallwindowsIncludeZoomRegUtil.cpp
push 2
lea ecx, [ebp - 0x6c]
call fcn.0040c3fa
mov byte [ebp - 4], 0xe
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp - 0x44]
mov edx, str._RegZoomAppProtocol__failed_to_set_ElevationPolicy:
push ecx
mov ecx, 0x490270
call fcn.004062fc
pop ecx
mov ecx, eax
call fcn.00416046
push ecx
mov edx, 0x47b49c
mov ecx, eax
call fcn.004062fc
pop ecx
mov ecx, eax
call fcn.0040713b
lea ecx, [ebp - 0x6c]
call fcn.0040c599
test edi, edi
je 0x4145f6
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x414601
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x68]
test eax, eax
je 0x41460f
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.004640cd
ret