Function at 0x40da6f
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry value

Disassembly:
mov eax, 0x4114f4
call fcn.00410d60
sub esp, 0xa40
push ebx
push esi
push edi
lea eax, [ebp - 0x844]
mov dword [ebp - 0x10], esp
xor edi, edi
push str.Download_with_IDM
push eax
mov dword [ebp - 4], edi
call sub.MSVCRT.dll_wcscpy
lea eax, [ebp - 0xa4c]
push str.Download_All_Links_with_IDM
push eax
call sub.MSVCRT.dll_wcscpy
lea eax, [ebp - 0x434]
push str.Download_FLV_video_content_with_IDM
push eax
call sub.MSVCRT.dll_wcscpy
lea eax, [ebp - 0x63c]
push str.Download_FLV_videos_with_IDM_from_10_last_requested
push eax
call sub.MSVCRT.dll_wcscpy
add esp, 0x20
lea eax, [ebp - 0x24]
mov esi, 0xf003f
mov ebx, 0x80000001
push eax
lea eax, [ebp - 0x1c]
push eax
push edi
push esi
push edi
push 0x41c4f4
push edi
push str.SoftwareDownloadManagermenuExt
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40db61
lea eax, [ebp - 0x844]
push eax
push str.iedownl1_str
push dword [ebp - 0x1c]
call fcn.0040ddc7
add esp, 0xc
lea eax, [ebp - 0xa4c]
push eax
push str.iedownlAll_str
push dword [ebp - 0x1c]
call fcn.0040ddc7
add esp, 0xc
lea eax, [ebp - 0x434]
push eax
push str.iedownlFLV_str
push dword [ebp - 0x1c]
call fcn.0040ddc7
add esp, 0xc
lea eax, [ebp - 0x63c]
push eax
push str.iedownl10FLV_str
push dword [ebp - 0x1c]
call fcn.0040ddc7
add esp, 0xc
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x14]
push eax
push esi
push edi
push str.SoftwareMicrosoftInternet_ExplorerMenuExt_
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40dc13
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push str.Download_with_IDMan
push dword [ebp - 0x14]
call ebx
push str.IEExt.htm
lea eax, [ebp - 0x844]
push str.Download_with_IDM
push eax
push dword [ebp - 0x14]
call fcn.0040d8d3
add esp, 0x10
lea eax, [ebp - 0xa4c]
push str.IEGetAll.htm
push str.Download_All_Links_with_IDM
push eax
push dword [ebp - 0x14]
call fcn.0040d8d3
add esp, 0x10
lea eax, [ebp - 0x434]
push str.IEGetVL.htm
push str.Download_FLV_video_content_with_IDM
push eax
push dword [ebp - 0x14]
call fcn.0040d8d3
add esp, 0x10
lea eax, [ebp - 0x63c]
push str.IEGetVL2.htm
push str.Download_FLV_videos_with_IDM_from_10_last_requested
push eax
push dword [ebp - 0x14]
call fcn.0040d8d3
add esp, 0x10
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40dc19
xor eax, eax
jmp 0x40ddb8
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea eax, [ebp - 0x14]
push eax
push esi
push edi
push str.SoftwareClassesPROTOCOLSName_Space_Handler_
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40dc0c
lea eax, [ebp - 0x18]
push edi
push eax
push edi
push esi
push edi
push edi
push edi
push str.http_
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40dc6c
push 0x41a7bc
push dword [ebp - 0x18]
call ebx
push 0x41a7b4
push dword [ebp - 0x18]
call ebx
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x18]
push edi
push eax
push edi
push esi
push edi
push edi
push edi
push str.ftp_
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40dca5
push 0x41a7bc
push dword [ebp - 0x18]
call ebx
push 0x41a7b4
push dword [ebp - 0x18]
call ebx
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x18]
push edi
push eax
push edi
push esi
push edi
push edi
push edi
push str.https_
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40dcd4
push 0x41a7bc
push dword [ebp - 0x18]
call ebx
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x14]
push eax
push esi
push edi
push str.SoftwareMicrosoftInternet_Explorer
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40dd4a
lea eax, [ebp - 0x20]
mov ebx, str.DownloadUI
push eax
lea eax, [ebp - 0x22c]
push eax
push edi
push edi
push ebx
push dword [ebp - 0x14]
mov dword [ebp - 0x20], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40dd3f
lea eax, [ebp - 0x22c]
push str.7D11E719_FF90_479C_B0D7_96EB43EE55D7
push eax
call sub.MSVCRT.dll_wcscmp
pop ecx
test eax, eax
pop ecx
jne 0x40dd3f
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40dd4f
mov ebx, str.DownloadUI
lea eax, [ebp - 0x14]
push eax
push esi
push edi
push str.SoftwareMicrosoftInternet_Explorer
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40ddb5
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x208
push eax
lea eax, [ebp - 0x22c]
push eax
push edi
push edi
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40ddac
lea eax, [ebp - 0x22c]
push str.7D11E719_FF90_479C_B0D7_96EB43EE55D7
push eax
call sub.MSVCRT.dll_wcscmp
pop ecx
test eax, eax
pop ecx
jne 0x40ddac
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
pop eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret