Function at 0x4bfdd0
Capabilities:
Connect to http server
Create http request
Initialize winsock library
Query or enumerate registry value
Read data from internet
Receive data
Receive data on socket
Send data
Send http request
Send http request with host header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58aa58
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x330
push ebx
push esi
push edi
xor esi, esi
mov ebx, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], esi
call fcn.004c0550
mov ecx, ebx
call fcn.004c0510
mov ecx, ebx
call fcn.004c0290
lea eax, [ebx + 0x200]
push eax
call fcn.00434a80
add esp, 4
test al, al
je 0x4bfea0
lea eax, [ebx + 0x1ce]
push eax
call fcn.00434dc0
add esp, 4
test al, al
je 0x4bfea0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x1ac]
mov dword [ebp - 0x28], esi
rep stosd dword es:[edi], eax
mov ecx, dword [ebx + 4]
mov dword [ebp - 0x14], esi
cmp ecx, esi
je 0x4bfebd
push 1
call fcn.004232f0
cmp eax, esi
jne 0x4bfebd
cmp dword [ebx + 8], esi
jne 0x4bfe78
mov eax, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea ecx, [ebp - 0x1c]
call fcn.0049edb0
mov ecx, dword [ebx + 4]
mov byte [ebp - 4], 1
push ecx
lea ecx, [ebp - 0x1c]
call fcn.0049edf0
cmp eax, esi
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
je 0x4bfeb8
call fcn.0049ede0
mov eax, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.0049ede0
lea edx, [ebp - 0x24]
push edx
push 0xf003f
push esi
push str.SoftwareDownloadManager_
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4bfffd
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x14]
push eax
push ecx
push esi
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push str.UseHttpProxy
push edx
mov dword [ebp - 0x20], 4
call esi
test eax, eax
jne 0x4bfffd
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x4c0008
lea eax, [ebp - 0x33c]
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
lea ecx, [ebp - 0x18]
push ecx
mov ecx, ebx
call fcn.004c0650
test eax, eax
je 0x4bfff1
mov ecx, 0x10
xor eax, eax
lea edi, [ebp - 0x6c]
lea edx, [ebp - 0x20]
rep stosd dword es:[edi], eax
mov ecx, 0x10
lea edi, [ebp - 0xac]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 0x24]
lea eax, [ebp - 0x6c]
push edx
xor edi, edi
push eax
push edi
push edi
push str.HttpUserName
push ecx
mov dword [ebp - 0x20], 0x40
call esi
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0xac]
push edx
push str.HttpEncPassword
push str.HttpPasword
push 0x40
push eax
call fcn.00523280
mov eax, dword [ebp - 0x18]
add esp, 0x14
lea ecx, [ebp - 0xac]
lea edx, [ebp - 0x6c]
push ecx
push edx
push eax
mov ecx, ebx
call fcn.004c0920
cmp eax, edi
je 0x4c00c0
mov ecx, dword [ebp - 0x18]
push 0xb4
push ecx
mov ecx, ebx
call fcn.004c0af0
cmp eax, edi
je 0x4c00c0
mov edx, dword [ebp - 0x18]
mov ecx, ebx
push edx
call fcn.004c0be0
cmp eax, edi
je 0x4c00c0
mov ecx, dword [ebp - 0x18]
push edi
lea eax, [ebp - 0x1ac]
push 0x100
push eax
push ecx
call sub.WSOCK32.dll_recv
test eax, eax
jg 0x4bfff8
mov dword [ebp - 0x14], 0
call sub.WSOCK32.dll_WSACleanup
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x4c00f3
push 0
push 0x63e040
push 0x63e040
push 1
push str.IDMan_4.1
call dword [sym.imp.WININET.dll_InternetOpenA]
push 0
push 0
push 3
push str.azcfgped
push str.tcidm
push 0x50
push str.www.internetdownloadmanager.com
push eax
mov dword [ebx + 0x29c], eax
call dword [sym.imp.WININET.dll_InternetConnectA]
push 0
push 0x84000000
push 0
push 0x63e040
push 0x63e040
push str._data_395012712_register.cgi
push str.POST
push eax
mov dword [ebx + 0x2a0], eax
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov edx, eax
mov edi, str.Host:_www.internetdownloadmanager.com_r_nAccept:___r_nContent_Type:_text_html_r_nAuthorization:_Basic_dGNpZG06YXpjZmdwZWQ
or ecx, 0xffffffff
xor eax, eax
mov dword [ebx + 0x2a4], edx
push 0xa1000000
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.Host:_www.internetdownloadmanager.com_r_nAccept:___r_nContent_Type:_text_html_r_nAuthorization:_Basic_dGNpZG06YXpjZmdwZWQ
push edx
call dword [sym.imp.WININET.dll_HttpAddRequestHeadersA]
mov eax, dword [ebx + 0x2a4]
lea edx, [ebx + 0xc]
push 0x190
push edx
push 0
push 0
push eax
call dword [sym.imp.WININET.dll_HttpSendRequestA]
test eax, eax
jne 0x4c00c8
mov esi, 4
jmp 0x4c0236
mov dword [ebp - 0x14], edi
jmp 0x4bfff8
mov eax, dword [ebx + 0x2a4]
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 0x1ac]
push 0x100
push edx
push eax
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x4c00f3
mov esi, 4
jmp 0x4c0236
mov ecx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov edx, ecx
lea esi, [ebp - 0x1ac]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edx, dword [0x63f560]
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ebp - 0x1ac]
push ecx
push edx
push 0x100
push eax
lea ecx, [ebx + 0x298]
call fcn.0042ead0
lea esi, [ebx + 0x1ce]
lea eax, [ebp - 0x1ac]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4c0168
test cl, cl
je 0x4c0164
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4c0168
add eax, 2
add esi, 2
test cl, cl
jne 0x4c0144
xor eax, eax
jmp 0x4c016d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4c0178
xor esi, esi
jmp 0x4c0236
mov esi, str.tygh12Ggb45_t4_gr5
lea eax, [ebp - 0x1ac]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4c01a7
test cl, cl
je 0x4c01a3
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4c01a7
add eax, 2
add esi, 2
test cl, cl
jne 0x4c0183
xor eax, eax
jmp 0x4c01ac
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4c01b7
mov esi, 1
jmp 0x4c0236
mov esi, str.4gh_hf4dg7_6d8s
lea eax, [ebp - 0x1ac]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4c01e6
test cl, cl
je 0x4c01e2
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4c01e6
add eax, 2
add esi, 2
test cl, cl
jne 0x4c01c2
xor eax, eax
jmp 0x4c01eb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4c01f6
mov esi, 2
jmp 0x4c0236
mov esi, str.5tresg778Xgf8BN78_4g
lea eax, [ebp - 0x1ac]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4c0225
test cl, cl
je 0x4c0221
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4c0225
add eax, 2
add esi, 2
test cl, cl
jne 0x4c0201
xor eax, eax
jmp 0x4c022a
sbb eax, eax
sbb eax, 0xffffffff
xor ecx, ecx
test eax, eax
setne cl
add ecx, 3
mov esi, ecx
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x4c0276
mov edx, dword [ebx + 0x2a4]
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
push edx
call edi
mov eax, dword [ebx + 0x2a0]
push eax
call edi
mov ecx, dword [ebx + 0x29c]
push ecx
call edi
jmp 0x4c0276
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8