Function at 0x40124d
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x90c
mov eax, dword [0x430090]
xor eax, esp
mov dword [esp + 0x908], eax
push ebx
push esi
push edi
call fcn.00403b71
and dword [esp + 0x80], 0
mov dword [esp + 0x9c], 1
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [esp + 0x80]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
xor edi, edi
lea ecx, [esp + 0x84]
push str._user_path
mov ebx, eax
mov dword [esp + 0x1c], edi
call fcn.00401ab6
mov ecx, dword [esp + 0x80]
lea eax, [esp + 0x84]
push eax
lea ecx, [ebx + ecx*4]
push ecx
push ebx
call fcn.00403cd6
add esp, 0xc
lea ecx, [esp + 0x84]
mov esi, eax
call fcn.00401ade
push esi
call fcn.004058d0
lea ecx, [esp + 0x88]
mov dword [esp], str._bin_path
call fcn.00401ab6
lea eax, [esp + 0x84]
push eax
mov eax, dword [esp + 0x84]
lea eax, [ebx + eax*4]
push eax
push ebx
call fcn.00403cd6
add esp, 0xc
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x84]
call fcn.00401ade
push str._product
lea ecx, [esp + 0xac]
call fcn.00401ab6
mov ecx, dword [esp + 0x80]
lea eax, [esp + 0xa8]
push eax
lea eax, [ebx + ecx*4]
push eax
push ebx
call fcn.00403cd6
add esp, 0xc
mov dword [esp + 0x1c], eax
lea ecx, [esp + 0xa8]
call fcn.00401ade
call fcn.00402554
push 0x208
mov dword [esp + 0xa4], eax
lea eax, [esp + 0x104]
push edi
push eax
call fcn.0040d070
add esp, 0xc
lea eax, [esp + 0x100]
push 0x104
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str.ZoomCptService
call fcn.00403132
pop ecx
push edi
mov ecx, eax
mov dword [0x4321d0], eax
call fcn.00403387
test ebx, ebx
je 0x401a81
push str._install
lea ecx, [esp + 0x24]
call fcn.00401ab6
mov eax, dword [esp + 0x80]
mov byte [esp + 0xa4], 0
push dword [esp + 0xa4]
lea edi, [ebx + eax*4]
lea eax, [esp + 0x24]
push eax
push edi
push ebx
call fcn.00401d08
add esp, 0x10
lea ecx, [esp + 0x20]
mov esi, eax
call fcn.00401ade
cmp esi, edi
je 0x401791
cmp dword [esp + 0xa0], 0
mov byte [esp + 0x13], 1
je 0x40160d
and dword [esp + 0xa4], 0
lea eax, [esp + 0xa4]
push eax
lea eax, [esp + 0x104]
push eax
call fcn.004025d2
pop ecx
pop ecx
test eax, eax
je 0x40144b
lea eax, [esp + 0x100]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea esi, [esp + 0x100]
jmp 0x401521
and dword [esp + 0xa0], 0
lea eax, [esp + 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
push 0x208
lea eax, [esp + 0x30c]
push 0
push eax
call fcn.0040d070
push 0x40
lea eax, [esp + 0xd0]
push 0
push eax
call fcn.0040d070
mov ecx, dword [0x4321d0]
lea eax, [esp + 0x320]
add esp, 0x18
push eax
push dword [esp + 0x20]
push dword [esp + 0xa8]
call fcn.00403225
test al, al
je 0x4014e8
lea eax, [esp + 0xc0]
push eax
push dword [esp + 0x18]
call fcn.00401f42
pop ecx
pop ecx
test eax, eax
je 0x4014e8
lea eax, [esp + 0xc0]
push eax
lea eax, [esp + 0x30c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea esi, [esp + 0x308]
jmp 0x4014ec
mov esi, dword [esp + 0x18]
push esi
call fcn.00402325
push dword [0x42c3e8]
call fcn.00404622
pop ecx
pop ecx
test al, al
jne 0x40150a
push esi
call fcn.004022b2
pop ecx
push dword [0x42c3f8]
call fcn.00404622
pop ecx
test al, al
jne 0x401521
push esi
call fcn.00402285
pop ecx
push esi
call fcn.004027d6
pop ecx
test eax, eax
je 0x401564
mov ecx, dword [0x4321d0]
call fcn.0040344a
test al, al
je 0x40154c
mov ecx, dword [0x4321d0]
call fcn.004037dd
and al, 1
mov byte [esp + 0x13], al
push esi
call fcn.0040230e
xor edx, edx
cmp eax, 1
pop ecx
movzx ecx, byte [esp + 0x13]
cmove edx, ecx
mov byte [esp + 0x13], dl
mov ecx, dword [0x4321d0]
call fcn.00403400
test al, al
jne 0x4015cb
call fcn.00404e19
mov ecx, eax
call fcn.00404f37
cmp dword [eax + 0x14], 8
jb 0x401587
mov eax, dword [eax]
push eax
push str._user_path
lea eax, [esp + 0x518]
push str._s___s_
push eax
call fcn.00401b82
mov ecx, dword [0x4321d0]
lea eax, [esp + 0x520]
add esp, 0x10
push eax
push str.Enable_Zoom_meeting_participants_to_control_your_desktop._If_this_service_is_stopped_or_disabled__remote_users_wont_control_any_applications_running_at_a_High_Integrity_level.
push str.Zoom_Sharing_Service
call fcn.004034ce
mov cl, byte [esp + 0x13]
and cl, al
mov byte [esp + 0x13], cl
jmp 0x4015cf
mov cl, byte [esp + 0x13]
test cl, cl
je 0x4015f1
mov ecx, dword [0x4321d0]
call fcn.0040344a
test al, al
jne 0x4015f1
mov ecx, dword [0x4321d0]
call fcn.00403737
and byte [esp + 0x13], al
push esi
call fcn.004027bb
pop ecx
test eax, eax
je 0x401603
push esi
call fcn.00402128
pop ecx
cmp byte [esp + 0x13], 0
jmp 0x4019c2
mov ecx, dword [0x4321d0]
call fcn.0040344a
test al, al
je 0x40171b
push dword [0x4321d0]
xor eax, eax
lea edi, [esp + 0xac]
stosd dword es:[edi], eax
lea ecx, [esp + 0xac]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.00402f3a
xor eax, eax
lea edi, [esp + 0x84]
stosd dword es:[edi], eax
xor ebx, ebx
push 0x200
push ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x310]
push eax
call fcn.0040d070
lea eax, [esp + 0x10c]
push eax
push str._bin_path
push dword [esp + 0x30]
lea eax, [esp + 0x320]
push str._product
push str._install
push str._s__s__s__s___s_
push eax
call fcn.00401ba1
add esp, 0x28
lea eax, [esp + 0x84]
lea ecx, [esp + 0xa8]
push 1
push ebx
push ebx
push 1
push eax
lea eax, [esp + 0x31c]
push eax
lea eax, [esp + 0x118]
push eax
push 2
call fcn.00403646
test al, al
je 0x401701
cmp dword [esp + 0x84], ebx
je 0x401701
push 0x7530
push dword [esp + 0x88]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4016f4
lea eax, [esp + 0x9c]
push eax
push dword [esp + 0x88]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [esp + 0x84]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x9c]
lea ecx, [esp + 0xa8]
call fcn.00402f96
mov eax, esi
jmp 0x401a9a
push str._elevate
lea ecx, [esp + 0x24]
call fcn.00401ab6
mov eax, dword [esp + 0x80]
mov byte [esp + 0x14], 0
push dword [esp + 0x14]
lea edi, [ebx + eax*4]
lea eax, [esp + 0x24]
push eax
push edi
push ebx
call fcn.00401d08
add esp, 0x10
lea ecx, [esp + 0x20]
mov esi, eax
call fcn.00401ade
cmp esi, edi
jne 0x401a81
movaps xmm0, xmmword [0x42c480]
sub esp, 0x10
lea esi, [esp + 0x94]
movups xmmword [esp + 0x94], xmm0
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.0040237f
add esp, 0x10
mov dword [esp + 0x9c], eax
jmp 0x401a81
push str._uninstall
lea ecx, [esp + 0x24]
call fcn.00401ab6
mov eax, dword [esp + 0x80]
mov byte [esp + 0x14], 0
push dword [esp + 0x14]
lea edi, [ebx + eax*4]
lea eax, [esp + 0x24]
push eax
push edi
push ebx
call fcn.00401d08
add esp, 0x10
lea ecx, [esp + 0x20]
mov esi, eax
call fcn.00401ade
cmp esi, edi
je 0x40192a
cmp dword [esp + 0xa0], 0
mov ecx, dword [0x4321d0]
je 0x40180e
call fcn.004037dd
test al, al
je 0x401a81
mov ecx, dword [0x4321d0]
call fcn.0040388c
test al, al
je 0x401a81
call fcn.0040297b
jmp 0x401785
call fcn.0040344a
test al, al
je 0x4018c8
push dword [0x4321d0]
xor eax, eax
lea edi, [esp + 0xac]
stosd dword es:[edi], eax
lea ecx, [esp + 0xac]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.00402f3a
xor eax, eax
lea edi, [esp + 0x84]
stosd dword es:[edi], eax
lea ecx, [esp + 0xa8]
push 1
push 0
push 0
stosd dword es:[edi], eax
push 1
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x94]
push eax
push str._uninstall
lea eax, [esp + 0x118]
push eax
push 2
call fcn.00403646
test al, al
je 0x4018b7
cmp dword [esp + 0x84], 0
je 0x4018b7
push 0x7530
push dword [esp + 0x88]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4018aa
lea eax, [esp + 0x9c]
push eax
push dword [esp + 0x88]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [esp + 0x84]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0xa8]
call fcn.00402f96
jmp 0x401a81
push str._elevate
lea ecx, [esp + 0x3c]
call fcn.00401ab6
mov eax, dword [esp + 0x80]
mov byte [esp + 0x14], 0
push dword [esp + 0x14]
lea edi, [ebx + eax*4]
lea eax, [esp + 0x3c]
push eax
push edi
push ebx
call fcn.00401d08
add esp, 0x10
lea ecx, [esp + 0x38]
mov esi, eax
call fcn.00401ade
cmp esi, edi
jne 0x401a81
call fcn.004011f2
test al, al
je 0x401920
movaps xmm0, xmmword [0x42c490]
jmp 0x401765
call fcn.00401e12
jmp 0x401a81
push str._start
lea ecx, [esp + 0x3c]
call fcn.00401ab6
mov eax, dword [esp + 0x80]
mov byte [esp + 0x14], 0
push dword [esp + 0x14]
lea edi, [ebx + eax*4]
lea eax, [esp + 0x3c]
push eax
push edi
push ebx
call fcn.00401d08
add esp, 0x10
lea ecx, [esp + 0x38]
mov esi, eax
call fcn.00401ade
cmp esi, edi
je 0x401976
mov ecx, dword [0x4321d0]
call fcn.00403737
jmp 0x4019c0
push str._stop
lea ecx, [esp + 0x3c]
call fcn.00401ab6
mov eax, dword [esp + 0x80]
mov byte [esp + 0x14], 0
push dword [esp + 0x14]
lea edi, [ebx + eax*4]
lea eax, [esp + 0x3c]
push eax
push edi
push ebx
call fcn.00401d08
add esp, 0x10
lea ecx, [esp + 0x38]
mov esi, eax
call fcn.00401ade
cmp esi, edi
je 0x4019d5
mov ecx, dword [0x4321d0]
call fcn.004037dd
test al, al
je 0x401a81
and dword [esp + 0x9c], 0
jmp 0x401a81
push str._update
lea ecx, [esp + 0x54]
call fcn.00401ab6
mov eax, dword [esp + 0x80]
mov byte [esp + 0x14], 0
push dword [esp + 0x14]
lea edi, [ebx + eax*4]
lea eax, [esp + 0x54]
push eax
push edi
push ebx
call fcn.00401d08
add esp, 0x10
lea ecx, [esp + 0x50]
mov esi, eax
call fcn.00401ade
cmp esi, edi
je 0x401a81
push str._update
lea ecx, [esp + 0x6c]
call fcn.00401ab6
lea eax, [esp + 0x68]
push eax
mov eax, dword [esp + 0x84]
lea eax, [ebx + eax*4]
push eax
push ebx
call fcn.00403cd6
add esp, 0xc
lea ecx, [esp + 0x68]
mov esi, eax
call fcn.00401ade
test esi, esi
je 0x401a81
push esi
call fcn.00413074
pop ecx
sub eax, 1
je 0x401a79
sub eax, 1
je 0x401a70
sub eax, 1
jne 0x401a81
push eax
call fcn.00402128
push 0
call fcn.0040230e
pop ecx
jmp 0x401a80
push 0
call fcn.0040230e
jmp 0x401a80
push 0
call fcn.00402128
pop ecx
mov ecx, dword [0x4321d0]
call fcn.00403887
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [esp + 0x9c]
mov ecx, dword [esp + 0x914]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040b168
mov esp, ebp
pop ebp
ret 0x10