Function at 0x412531
Capabilities:
Set registry value

Disassembly:
push 0x60
mov eax, 0x462ed8
call fcn.00461432
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
mov edi, 0x2001f
mov dword [ebp - 4], ebx
push edi
push str.SoftwareClasses
push SysReAllocString
lea ecx, [ebp - 0x68]
call fcn.0040872b
cmp byte [ebp + 8], bl
jne 0x4129b4
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
push ecx
push ecx
push edi
push ecx
push ecx
push str.zoommtg
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x50]
push dword [ebp - 0x68]
call fcn.004086c3
mov edi, eax
test edi, edi
jne 0x41294d
push ecx
push str.URL:Zoom_Launcher
push ebx
lea ecx, [ebp - 0x50]
call fcn.004087f7
push ecx
push 0x4764dc
push str.URL_Protocol
lea ecx, [ebp - 0x50]
call fcn.004087f7
push 4
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], 1
push eax
push 4
push ebx
mov ebx, dword [ebp - 0x50]
push str.UseOriginalUrlEncoding
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor eax, eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
push ecx
push ecx
push 0x2001f
push ecx
push ecx
push str.DefaultIcon
push ebx
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 2
call fcn.004086c3
mov edi, eax
test edi, edi
jne 0x4126af
push 0x4772e0
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.0040aa0b
mov byte [ebp - 4], 3
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x412634
mov eax, dword [esi]
push dword [esi + 0x10]
lea ecx, [ebp - 0x28]
push eax
call fcn.0040b2aa
push 0x4757d8
lea ecx, [ebp - 0x28]
call fcn.0040a1bb
push str.Zoom.exe
lea ecx, [ebp - 0x28]
call fcn.0040a1bb
push 0x477774
lea ecx, [ebp - 0x28]
call fcn.0040a1bb
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push ecx
cmovae eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x5c]
push eax
push edi
call fcn.004087f7
mov eax, dword [ebp - 0x5c]
test eax, eax
je 0x412690
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x58], edi
cmp eax, 8
jb 0x412706
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x28]
call fcn.004031ab
pop ecx
pop ecx
jmp 0x412706
push 0x181
push str.C:zoomcodeEP_2017Client_srcinstallwindowsIncludeZoomRegUtil.cpp
push 2
lea ecx, [ebp - 0x44]
call fcn.0040c17a
mov byte [ebp - 4], 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push ecx
mov edx, str._RegZoomAppProtocol__failed_to_create_app_protocol_home__defaultIcon__ret:
mov ecx, 0x48b190
call fcn.00405dcc
pop ecx
mov ecx, eax
call fcn.00414d8e
push ecx
mov edx, 0x477284
mov ecx, eax
call fcn.00405dcc
pop ecx
mov ecx, eax
call fcn.00406c0b
lea ecx, [ebp - 0x44]
call fcn.0040c319
xor edi, edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
push ecx
push ecx
push 0x2001f
push ecx
push ecx
push str.shell
push ebx
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 5
call fcn.004086c3
mov edi, eax
test edi, edi
jne 0x41286e
push ecx
push ecx
push 0x2001f
push ecx
push ecx
push str.open
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x1c]
call fcn.004086c3
mov edi, eax
test edi, edi
jne 0x412807
push ecx
push ecx
push 0x2001f
push ecx
push ecx
push str.command
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x1c]
call fcn.004086c3
test eax, eax
jne 0x41285c
and dword [ebp - 0x30], eax
lea ecx, [ebp - 0x40]
push 0x4772e0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
call fcn.0040aa0b
mov byte [ebp - 4], 6
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x4127a1
mov eax, dword [esi]
push dword [esi + 0x10]
lea ecx, [ebp - 0x40]
push eax
call fcn.0040b2aa
push 0x4757d8
lea ecx, [ebp - 0x40]
call fcn.0040a1bb
push str.Zoom.exe
lea ecx, [ebp - 0x40]
call fcn.0040a1bb
push str._____url_1_
lea ecx, [ebp - 0x40]
call fcn.0040a1bb
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
push ecx
cmovae eax, dword [ebp - 0x40]
lea ecx, [ebp - 0x1c]
push eax
push 0
call fcn.004087f7
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x41285c
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x40]
call fcn.004031ab
pop ecx
pop ecx
jmp 0x41285c
push 0x197
push str.C:zoomcodeEP_2017Client_srcinstallwindowsIncludeZoomRegUtil.cpp
push 2
lea ecx, [ebp - 0x44]
call fcn.0040c17a
mov byte [ebp - 4], 7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push ecx
mov edx, str._RegZoomAppProtocol__failed_to_create_app_protocol___shell_open_command__ret:
mov ecx, 0x48b190
call fcn.00405dcc
pop ecx
mov ecx, eax
call fcn.00414d8e
push ecx
mov edx, 0x477284
mov ecx, eax
call fcn.00405dcc
pop ecx
mov ecx, eax
call fcn.00406c0b
lea ecx, [ebp - 0x44]
call fcn.0040c319
mov edi, dword [ebp - 0x1c]
test edi, edi
je 0x4128c6
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
jmp 0x4128c6
push 0x19c
push str.C:zoomcodeEP_2017Client_srcinstallwindowsIncludeZoomRegUtil.cpp
push 2
lea ecx, [ebp - 0x44]
call fcn.0040c17a
mov byte [ebp - 4], 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push ecx
mov edx, str._RegZoomAppProtocol__failed_to_create_app_protocol_shell__ret:
mov ecx, 0x48b190
call fcn.00405dcc
pop ecx
mov ecx, eax
call fcn.00414d8e
push ecx
mov edx, 0x477284
mov ecx, eax
call fcn.00405dcc
pop ecx
mov ecx, eax
call fcn.00406c0b
lea ecx, [ebp - 0x44]
call fcn.0040c319
mov edi, dword [ebp - 0x1c]
test ebx, ebx
je 0x4128d3
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
test edi, edi
je 0x4128de
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x5c]
test eax, eax
je 0x4128ec
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x4128f7
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], ebx
push ecx
push ecx
push 0x2001f
push ecx
push ecx
push str.SoftwareMicrosoftInternet_ExplorerProtocolExecutezoommtg
push SysReAllocString
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0xb
call fcn.004086c3
mov ebx, dword [ebp - 0x5c]
mov edi, eax
test edi, edi
jne 0x412a25
push 4
lea eax, [ebp - 0x44]
xor edi, edi
push eax
push 4
push edi
push str.WarnOnOpen
push ebx
mov dword [ebp - 0x44], edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x412a7c
push 0x1a1
push str.C:zoomcodeEP_2017Client_srcinstallwindowsIncludeZoomRegUtil.cpp
push 2
lea ecx, [ebp - 0x44]
call fcn.0040c17a
mov byte [ebp - 4], 9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push ecx
mov edx, str._RegZoomAppProtocol__failed_to_create_app_protocol_home__ret:
mov ecx, 0x48b190
call fcn.00405dcc
pop ecx
mov ecx, eax
call fcn.00414d8e
push ecx
mov edx, 0x477284
mov ecx, eax
call fcn.00405dcc
pop ecx
mov ecx, eax
call fcn.00406c0b
lea ecx, [ebp - 0x44]
call fcn.0040c319
cmp dword [ebp - 0x50], 0
je 0x412b64
push dword [ebp - 0x50]
jmp 0x412b5e
push str.zoommtg
lea ecx, [ebp - 0x68]
call fcn.00411b12
mov edi, eax
test edi, edi
je 0x4128f9
push 0x1a8
push str.C:zoomcodeEP_2017Client_srcinstallwindowsIncludeZoomRegUtil.cpp
push 2
lea ecx, [ebp - 0x44]
call fcn.0040c17a
mov byte [ebp - 4], 0xa
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push ecx
mov edx, str._RegZoomAppProtocol__failed_to_RecurseDeleteKey__ret:
mov ecx, 0x48b190
call fcn.00405dcc
pop ecx
mov ecx, eax
call fcn.00414d8e
push ecx
mov edx, 0x477284
mov ecx, eax
call fcn.00405dcc
pop ecx
mov ecx, eax
call fcn.00406c0b
lea ecx, [ebp - 0x44]
call fcn.0040c319
jmp 0x4128f9
push 0x1c4
push str.C:zoomcodeEP_2017Client_srcinstallwindowsIncludeZoomRegUtil.cpp
push 2
lea ecx, [ebp - 0x44]
call fcn.0040c17a
mov byte [ebp - 4], 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push ecx
mov edx, str._RegZoomAppProtocol__failed_to_set_WarnOnOpen:
mov ecx, 0x48b190
call fcn.00405dcc
pop ecx
mov ecx, eax
call fcn.00414d8e
push ecx
mov edx, 0x477284
mov ecx, eax
call fcn.00405dcc
pop ecx
mov ecx, eax
call fcn.00406c0b
lea ecx, [ebp - 0x44]
call fcn.0040c319
xor edi, edi
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x48], edi
push ecx
push ecx
push 0x2001f
push ecx
push ecx
push str.SoftwareMicrosoftInternet_ExplorerLow_RightsElevationPolicyAFDA28A5_1B5F_4635_9877_73DF0D710C9A
push SysReAllocString
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0xd
call fcn.004086c3
mov edi, dword [ebp - 0x50]
mov dword [ebp - 0x44], eax
test eax, eax
jne 0x412af7
push ecx
push str.Zoom.exe
push str.AppName
lea ecx, [ebp - 0x50]
call fcn.004087f7
cmp dword [esi + 0x14], 8
jb 0x412ac9
mov esi, dword [esi]
push ecx
push esi
push str.AppPath
lea ecx, [ebp - 0x50]
call fcn.004087f7
push 4
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], 3
push eax
push 4
push 0
push str.Policy
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x412b4e
push 0x1d5
push str.C:zoomcodeEP_2017Client_srcinstallwindowsIncludeZoomRegUtil.cpp
push 2
lea ecx, [ebp - 0x6c]
call fcn.0040c17a
mov byte [ebp - 4], 0xe
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp - 0x44]
mov edx, str._RegZoomAppProtocol__failed_to_set_ElevationPolicy:
push ecx
mov ecx, 0x48b190
call fcn.00405dcc
pop ecx
mov ecx, eax
call fcn.00414d8e
push ecx
mov edx, 0x477284
mov ecx, eax
call fcn.00405dcc
pop ecx
mov ecx, eax
call fcn.00406c0b
lea ecx, [ebp - 0x6c]
call fcn.0040c319
test edi, edi
je 0x412b59
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x412b64
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x68]
test eax, eax
je 0x412b72
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.004613ed
ret