Function at 0x4154b0
Capabilities:
Persist via run registry key

Disassembly:
push 0x464
mov eax, 0x4668d2
call fcn.00464982
mov dword [ebp - 0x470], edx
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x464], ebx
mov dword [ebp - 0x460], ebx
mov dword [ebp - 0x45c], ebx
push 0x2001f
push 0x47c420
push SysReAllocString
lea ecx, [ebp - 0x464]
mov dword [ebp - 4], ebx
call fcn.00408cbb
test eax, eax
jne 0x415742
push esi
lea ecx, [ebp - 0x454]
mov dword [ebp - 0x444], ebx
mov dword [ebp - 0x440], ebx
call fcn.0040ada7
mov esi, 0x4799c8
inc ebx
push esi
mov byte [ebp - 4], bl
call fcn.0043d5e8
pop ecx
push eax
push esi
lea ecx, [ebp - 0x454]
call fcn.0040b5aa
mov esi, str.Zoom.exe
push esi
call fcn.0043d5e8
pop ecx
push eax
push esi
lea ecx, [ebp - 0x454]
call fcn.0040b5aa
push 0x410
lea eax, [ebp - 0x424]
push 0
push eax
call fcn.0045e110
and dword [ebp - 0x42c], 0
xor eax, eax
add esp, 0xc
mov dword [ebp - 0x458], 0x208
mov dword [ebp - 0x428], 7
mov word [ebp - 0x43c], ax
lea eax, [ebp - 0x458]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x424]
push eax
push str.Zoom
lea ecx, [ebp - 0x464]
call fcn.00408d17
test eax, eax
jne 0x4155ce
lea eax, [ebp - 0x424]
push eax
call fcn.0043d5e8
pop ecx
push eax
lea eax, [ebp - 0x424]
push eax
lea ecx, [ebp - 0x43c]
call fcn.0040ad3b
mov eax, dword [ebp - 0x42c]
mov edi, dword [ebp - 0x440]
mov esi, dword [ebp - 0x428]
test eax, eax
je 0x4156d7
cmp edi, 8
lea edx, [ebp - 0x454]
lea ecx, [ebp - 0x43c]
cmovae edx, dword [ebp - 0x454]
cmp esi, 8
mov dword [ebp - 0x458], edx
cmovae ecx, dword [ebp - 0x43c]
mov dword [ebp - 0x46c], ecx
cmp dword [ebp - 0x444], eax
ja 0x415689
cmp dword [ebp - 0x444], 0
je 0x4156d7
sub eax, dword [ebp - 0x444]
mov esi, ecx
inc eax
lea eax, [ecx + eax*2]
mov dword [ebp - 0x468], eax
sub eax, esi
sar eax, 1
je 0x415689
movzx ecx, word [edx]
cmp word [esi], cx
je 0x415653
add esi, 2
sub eax, 1
jne 0x415644
jmp 0x415689
test esi, esi
je 0x415689
push dword [ebp - 0x444]
push edx
push esi
call fcn.00408ac2
add esp, 0xc
test eax, eax
je 0x41567c
mov edx, dword [ebp - 0x458]
add esi, 2
mov eax, dword [ebp - 0x468]
jmp 0x41563b
sub esi, dword [ebp - 0x46c]
sar esi, 1
cmp esi, 0xffffffff
jne 0x4156d1
mov edi, str.__backgroundtrue
push edi
call fcn.0043d5e8
mov esi, dword [ebp - 0x428]
cmp esi, 8
mov edx, dword [ebp - 0x42c]
pop ecx
push eax
lea ecx, [ebp - 0x43c]
cmovae ecx, dword [ebp - 0x43c]
push edi
push ecx
call fcn.00416666
add esp, 0xc
cmp eax, 0xffffffff
je 0x4156c9
mov eax, dword [ebp - 0x470]
mov byte [eax], bl
mov edi, dword [ebp - 0x440]
jmp 0x4156d9
mov esi, dword [ebp - 0x428]
xor bl, bl
cmp esi, 8
jb 0x4156f9
lea eax, [esi*2 + 2]
push eax
push dword [ebp - 0x43c]
call fcn.00403711
mov edi, dword [ebp - 0x440]
pop ecx
pop ecx
and dword [ebp - 0x42c], 0
xor eax, eax
mov word [ebp - 0x43c], ax
push 7
pop esi
mov dword [ebp - 0x428], esi
cmp edi, 8
jb 0x41572c
lea eax, [edi*2 + 2]
push eax
push dword [ebp - 0x454]
call fcn.00403711
pop ecx
pop ecx
and dword [ebp - 0x444], 0
xor eax, eax
mov dword [ebp - 0x440], esi
mov word [ebp - 0x454], ax
cmp dword [ebp - 0x464], 0
je 0x415757
push dword [ebp - 0x464]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
call fcn.0046493d
ret