Function at 0x401410
Capabilities:
Create directory
Delete file
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c4
mov eax, dword [0x42d3e0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 0x1a
lea eax, [ebp - 0x62c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4014b5
push str.ZoomdataZoom.us.ini
lea eax, [ebp - 0x62c]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea eax, [ebp - 0x65c]
push eax
lea eax, [ebp - 0x62c]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wstat64i32]
add esp, 0x14
test eax, eax
jne 0x4014b5
lea eax, [ebp - 0x62c]
xorps xmm0, xmm0
push eax
push 8
lea eax, [ebp - 0x14]
push eax
push 0
push str.com.zoom.test.disable_crash_handler
push str.ZoomChat
movups xmmword [ebp - 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x4014b5
lea eax, [ebp - 0x14]
push 0x420d5c
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
add esp, 8
test eax, eax
sete al
test al, al
jne 0x401696
push 0
push 0x1a
lea eax, [ebp - 0x424]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x401696
push 0x420cd0
lea eax, [ebp - 0x424]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
push str.logs
lea eax, [ebp - 0x424]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0x18
lea eax, [ebp - 0x424]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x208
lea eax, [ebp - 0x21c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push 0
push str.zoomtest
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x401696
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x68
lea eax, [ebp - 0x6c4]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
lea eax, [ebp - 0x424]
mov dword [ebp - 0x6c0], str.Zoom.us
mov dword [ebp - 0x680], eax
mov eax, 0x68
push 0x100
mov word [ebp - 0x6c4], ax
lea eax, [ebp - 0x11c]
push 0
push eax
mov dword [ebp - 0x6bc], str.5.3.52879.0927
mov dword [ebp - 0x6b4], str.Zoom.us_Video_Meeting_0.9.2_Error_Report
mov dword [ebp - 0x6b8], str.support_zoom.us
mov dword [ebp - 0x130], 0x11c
mov dword [ebp - 0x124], 0
mov dword [ebp - 0x120], 0
call sub.VCRUNTIME140.dll_memset
add esp, 0x18
xor eax, eax
mov word [ebp - 0x1a], ax
mov dword [ebp - 0x18], eax
push 3
push 0x20
push 3
push 1
push 3
push 2
push eax
push eax
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push edx
push eax
push 0x23
lea eax, [ebp - 0x130]
mov dword [ebp - 0x12c], 6
mov ecx, 2
mov dword [ebp - 0x128], 0
push eax
mov word [ebp - 0x1c], cx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
mov dword [ebp - 0x6a8], 0
mov eax, dword [ebp - 0x690]
mov ecx, 5
cmovne ecx, dword [ebp + 8]
or eax, 0x807fff
test byte [ebp + 0xc], 1
mov dword [ebp - 0x684], ecx
mov dword [ebp - 0x690], eax
mov dword [ebp - 0x68c], str.https:__zoom.us_privacy_
je 0x40167c
or eax, 0x1000000
mov dword [ebp - 0x690], eax
lea eax, [ebp - 0x6c4]
push eax
call sub.zCrashReport.dll_Ordinal_7
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041c340
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
xor ecx, ebp
call fcn.0041c340
mov esp, ebp
pop ebp
ret