Function at 0x401995
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
lea eax, [ebp - 8]
push edi
xor ebx, ebx
push eax
push 0xf003f
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsZones3
push SysReAllocString
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], 0x200
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4019d2
xor eax, eax
jmp 0x401c6a
mov esi, str.CurrentLevel
lea ecx, [ebp - 0x14]
push esi
call sub.MFC42.DLL_CString::CString_1
mov eax, dword [eax]
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push ebx
push ebx
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [ebp - 0x14]
mov edi, eax
call sub.MFC42.DLL_CString::CString
cmp edi, ebx
jne 0x401a11
mov eax, 0x11000
cmp dword [ebp - 0xc], eax
jne 0x401a21
push 1
pop ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x401c6a
push 4
mov dword [ebp - 4], eax
pop edi
lea eax, [ebp - 4]
push edi
push eax
push edi
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 8]
call esi
lea eax, [ebp - 4]
push edi
push eax
push edi
push ebx
push str.1001
push dword [ebp - 8]
mov dword [ebp - 4], 1
call esi
lea eax, [ebp - 4]
push edi
push eax
push edi
push ebx
push str.1200
push dword [ebp - 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push edi
push eax
push edi
push ebx
push str.1400
push dword [ebp - 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push edi
push eax
push edi
push ebx
push str.1402
push dword [ebp - 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push edi
push eax
push edi
push ebx
push str.1405
push dword [ebp - 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push edi
push eax
push edi
push ebx
push str.1407
push dword [ebp - 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push edi
push eax
push edi
push ebx
push str.1604
push dword [ebp - 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push edi
push eax
push edi
mov dword [ebp - 4], ebx
push ebx
push str.1606
push dword [ebp - 8]
call esi
lea eax, [ebp - 4]
push edi
push eax
push edi
push ebx
push str.1607
push dword [ebp - 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push edi
push eax
push edi
push ebx
push str.1608
push dword [ebp - 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push edi
push eax
push edi
push ebx
push str.1800
push dword [ebp - 8]
mov dword [ebp - 4], 1
call esi
lea eax, [ebp - 4]
push edi
push eax
push edi
push ebx
push str.1802
push dword [ebp - 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push edi
push eax
push edi
push ebx
push str.1803
push dword [ebp - 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push edi
push eax
push edi
push ebx
push str.1804
push dword [ebp - 8]
mov dword [ebp - 4], 1
call esi
lea eax, [ebp - 4]
push edi
push eax
push edi
push ebx
push str.1A00
push dword [ebp - 8]
mov dword [ebp - 4], 0x20000
call esi
lea eax, [ebp - 4]
push edi
push eax
push edi
push ebx
push str.1A02
push dword [ebp - 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push edi
push eax
push edi
mov dword [ebp - 4], ebx
push ebx
push str.1A03
push dword [ebp - 8]
call esi
lea eax, [ebp - 4]
push edi
push eax
push edi
push ebx
push str.1A06
push dword [ebp - 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push edi
push eax
push edi
push ebx
push str.1C00
push dword [ebp - 8]
mov dword [ebp - 4], 0x10000
call esi
lea eax, [ebp - 4]
push edi
push eax
push edi
push ebx
push str.1E05
push dword [ebp - 8]
mov dword [ebp - 4], 0x20000
call esi
lea eax, [ebp - 4]
push edi
push eax
push edi
push ebx
push str.2100
push dword [ebp - 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push edi
push eax
push edi
push ebx
push str.2101
push dword [ebp - 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push edi
push eax
push edi
push ebx
push str.2300
push dword [ebp - 8]
mov dword [ebp - 4], 1
call esi
lea eax, [ebp - 4]
push edi
push eax
push edi
push ebx
push str.2000
push dword [ebp - 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push edi
push eax
push edi
push ebx
push str.2004
push dword [ebp - 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push edi
push eax
push edi
mov dword [ebp - 4], ebx
push ebx
push str.2001
push dword [ebp - 8]
call esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret