Function at 0x41615e
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x473b7d
mov eax, dword fs:[0]
push eax
mov eax, 0x8060
call fcn.004662a0
mov eax, dword [0x49d874]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x8068], edi
mov dword [ebp - 0x8064], edi
mov dword [ebp - 0x8060], edi
push 0x2011f
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
push eax
xor dl, dl
mov dword [ebp - 4], edi
lea ecx, [ebp - 0x8068]
call fcn.00412025
add esp, 0xc
test eax, eax
jne 0x416648
cmp dword [esi + 0x10], edi
jne 0x41650e
push 0x8000
lea eax, [ebp - 0x8014]
mov dword [ebp - 0x8050], edi
push edi
push eax
call fcn.00469380
add esp, 0xc
mov dword [ebp - 0x8054], 0x3fff
lea ecx, [ebp - 0x802c]
mov dword [ebp - 0x805c], edi
push str.Zoom.exe
call fcn.0040639f
push 8
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x802c]
mov eax, dword [ebp - 0x801c]
lea edx, [ebp - 0x802c]
pop ebx
cmp dword [ebp - 0x8018], ebx
cmovae ecx, dword [ebp - 0x802c]
cmovae edx, dword [ebp - 0x802c]
push edx
lea eax, [ecx + eax*2]
lea ecx, [ebp - 0x802c]
cmovae ecx, dword [ebp - 0x802c]
push eax
push ecx
lea ecx, [ebp - 0x8058]
call fcn.00411c72
mov esi, dword [ebp - 0x8068]
lea eax, [ebp - 0x805c]
add esp, 0xc
push edi
push edi
push eax
push edi
lea eax, [ebp - 0x8054]
push eax
lea eax, [ebp - 0x8014]
push eax
push edi
jmp 0x41647f
cmp dword [ebp - 0x805c], 1
je 0x4162aa
mov eax, dword [ebp - 0x8050]
inc eax
mov dword [ebp - 0x8054], 0x3fff
mov dword [ebp - 0x8050], eax
jmp 0x416466
push dword [ebp - 0x8054]
xor eax, eax
mov dword [ebp - 0x8044], edi
mov word [ebp - 0x8044], ax
lea ecx, [ebp - 0x8044]
lea eax, [ebp - 0x8014]
mov dword [ebp - 0x8034], edi
push eax
mov dword [ebp - 0x8030], 7
call fcn.004042fa
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x8044]
cmp dword [ebp - 0x8030], ebx
lea edx, [ebp - 0x8044]
mov eax, dword [ebp - 0x8034]
cmovae ecx, dword [ebp - 0x8044]
cmovae edx, dword [ebp - 0x8044]
push edx
lea eax, [ecx + eax*2]
lea ecx, [ebp - 0x8044]
cmovae ecx, dword [ebp - 0x8044]
push eax
push ecx
lea ecx, [ebp - 0x806c]
call fcn.00411c72
mov edx, dword [ebp - 0x8044]
lea eax, [ebp - 0x802c]
add esp, 0xc
mov dword [ebp - 0x8048], edx
cmp dword [ebp - 0x8018], ebx
lea ecx, [ebp - 0x8044]
mov dword [ebp - 0x8054], 0x3fff
cmovae eax, dword [ebp - 0x802c]
push dword [ebp - 0x801c]
cmp dword [ebp - 0x8030], ebx
push eax
cmovae ecx, edx
mov edx, dword [ebp - 0x8034]
push ecx
call fcn.00416683
add esp, 0xc
cmp eax, 0xffffffff
je 0x4164a4
cmp dword [ebp - 0x8030], ebx
lea eax, [ebp - 0x8044]
cmovae eax, dword [ebp - 0x8048]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push 0x69b
push str.c:jenkinsworkspaceClientClientWindows_releasewin_common_srcinstallerIncludeZoomRegUtil.cpp
push edi
lea ecx, [ebp - 0x8058]
mov esi, eax
call fcn.0040808d
mov byte [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push ecx
mov edx, str._UnregCompatibilityMode__traversal_erasing_value_ret:
mov ecx, 0x49f3a0
call fcn.00403a1c
pop ecx
mov ecx, eax
call fcn.00411296
push ecx
mov edx, 0x48793c
mov ecx, eax
call fcn.00403a1c
pop ecx
mov ecx, eax
call fcn.0040217e
lea ecx, [ebp - 0x8058]
call fcn.0040822b
test esi, esi
jne 0x41649e
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x8030]
cmp eax, ebx
jb 0x41645a
mov ecx, dword [ebp - 0x8044]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x804c], eax
mov dword [ebp - 0x8048], ecx
cmp eax, 0x1000
jb 0x416451
lea eax, [ebp - 0x804c]
push eax
lea eax, [ebp - 0x8048]
push eax
call fcn.0040149b
mov eax, dword [ebp - 0x804c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x8048]
push eax
push ecx
call fcn.00465474
pop ecx
pop ecx
mov esi, dword [ebp - 0x8068]
mov eax, dword [ebp - 0x8050]
push edi
push edi
lea ecx, [ebp - 0x805c]
push ecx
push edi
lea ecx, [ebp - 0x8054]
push ecx
lea ecx, [ebp - 0x8014]
push ecx
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x416285
lea ecx, [ebp - 0x802c]
call fcn.004042cc
jmp 0x416635
mov esi, dword [ebp - 0x8068]
mov eax, dword [ebp - 0x8050]
mov ecx, dword [ebp - 0x8044]
inc eax
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x8030]
mov dword [ebp - 0x8050], eax
cmp edx, ebx
jb 0x416466
lea eax, [edx*2 + 2]
mov dword [ebp - 0x804c], ecx
mov dword [ebp - 0x8048], eax
cmp eax, 0x1000
jb 0x416500
lea eax, [ebp - 0x8048]
push eax
lea eax, [ebp - 0x804c]
push eax
call fcn.0040149b
mov eax, dword [ebp - 0x8048]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x804c]
push eax
push ecx
call fcn.00465474
pop ecx
pop ecx
jmp 0x416460
push esi
lea ecx, [ebp - 0x802c]
mov dword [ebp - 0x802c], edi
mov dword [ebp - 0x801c], edi
mov dword [ebp - 0x8018], edi
call fcn.00406bc2
mov esi, 0x485444
mov byte [ebp - 4], 4
push esi
call fcn.0044c8a9
pop ecx
push eax
push esi
lea ecx, [ebp - 0x802c]
call fcn.00404346
mov esi, str.Zoom.exe
push esi
call fcn.0044c8a9
pop ecx
push eax
push esi
lea ecx, [ebp - 0x802c]
call fcn.00404346
push 8
pop ebx
cmp dword [ebp - 0x8018], ebx
lea eax, [ebp - 0x802c]
cmovae eax, dword [ebp - 0x802c]
push eax
push dword [ebp - 0x8068]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push 0x6ab
push str.c:jenkinsworkspaceClientClientWindows_releasewin_common_srcinstallerIncludeZoomRegUtil.cpp
push edi
lea ecx, [ebp - 0x8058]
mov esi, eax
call fcn.0040808d
mov byte [ebp - 4], 5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push ecx
mov edx, str._UnregCompatibilityMode__Directly_delete_value_ret:
mov ecx, 0x49f3a0
call fcn.00403a1c
pop ecx
mov ecx, eax
call fcn.00411296
push ecx
mov edx, 0x48793c
mov ecx, eax
call fcn.00403a1c
pop ecx
mov ecx, eax
call fcn.0040217e
lea ecx, [ebp - 0x8058]
call fcn.0040822b
mov eax, dword [ebp - 0x8018]
cmp eax, ebx
jb 0x416635
mov ecx, dword [ebp - 0x802c]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x8048], eax
mov dword [ebp - 0x804c], ecx
cmp eax, 0x1000
jb 0x41662c
lea eax, [ebp - 0x8048]
push eax
lea eax, [ebp - 0x804c]
push eax
call fcn.0040149b
mov eax, dword [ebp - 0x8048]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x804c]
push eax
push ecx
call fcn.00465474
pop ecx
pop ecx
mov eax, dword [ebp - 0x8068]
test eax, eax
je 0x416659
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x41664e
mov edi, dword [ebp - 0x8068]
test edi, edi
je 0x416659
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00465436
leave
ret