Function at 0x40c037
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x164]
sub esp, 0x1e4
mov eax, dword [0x41c380]
push esi
push edi
xor edi, edi
mov dword [ebp + 0x160], eax
xor esi, esi
inc esi
push 3
pop eax
mov ecx, 0x20000
mov dword [ebp + 0x4c], edi
mov dword [ebp + 0x58], edi
mov dword [ebp - 0x78], str.1001
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], str.1004
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], str.1201
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], str.1206
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], str.1209
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], str.1405
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x48], str.1406
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], str.1407
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], str.1607
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], str.1800
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], str.1804
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], str.1806
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], str.1809
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], str.1a00
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], str.1a04
mov dword [ebp - 4], eax
mov dword [ebp], str.1a05
mov dword [ebp + 4], esi
mov dword [ebp + 8], str.1c00
mov dword [ebp + 0xc], 0x10000
mov dword [ebp + 0x10], str.1e05
mov dword [ebp + 0x14], ecx
mov dword [ebp + 0x18], str.2101
mov dword [ebp + 0x1c], edi
mov dword [ebp + 0x20], str.2102
mov dword [ebp + 0x24], eax
mov dword [ebp + 0x28], str.2200
mov dword [ebp + 0x2c], eax
mov dword [ebp + 0x30], str.2201
mov dword [ebp + 0x34], eax
mov dword [ebp + 0x38], str.2301
mov dword [ebp + 0x3c], edi
mov dword [ebp + 0x40], edi
mov dword [ebp + 0x44], edi
call fcn.00408529
cmp eax, 6
jne 0x40c162
mov dword [ebp - 0x64], edi
lea eax, [ebp + 0x5c]
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsZones2_
push eax
call fcn.0040c7a0
pop ecx
pop ecx
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp + 0x58]
push eax
push edi
push 0xf003f
push edi
push 0x417459
push edi
lea eax, [ebp + 0x5c]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40c225
lea eax, [ebp + 0x48]
push eax
lea eax, [ebp + 0x54]
push eax
lea eax, [ebp - 0x7c]
push eax
push edi
push str.CurrentLevel
push dword [ebp + 0x58]
mov dword [ebp + 0x54], edi
mov dword [ebp + 0x48], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp dword [ebp + 0x54], 0x11000
ja 0x40c222
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp + 0x50], edi
mov eax, dword [ebp + 0x50]
shl eax, 3
mov ecx, dword [ebp + eax - 0x78]
cmp ecx, edi
je 0x40c203
mov eax, dword [ebp + eax - 0x74]
push 4
mov dword [ebp + 0x54], eax
lea eax, [ebp + 0x54]
push eax
push 4
push edi
push ecx
push dword [ebp + 0x58]
call ebx
inc dword [ebp + 0x50]
cmp dword [ebp + 0x50], 0x18
jb 0x40c1d6
push 4
lea eax, [ebp + 0x54]
push eax
push 4
push edi
push str.CurrentLevel
push dword [ebp + 0x58]
mov dword [ebp + 0x54], 0x11000
call ebx
test eax, eax
pop ebx
jne 0x40c225
mov dword [ebp + 0x4c], esi
cmp dword [ebp + 0x58], edi
pop edi
pop esi
je 0x40c235
push dword [ebp + 0x58]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x160]
mov eax, dword [ebp + 0x4c]
call fcn.0040c95c
add ebp, 0x164
leave
ret