Function at 0x40dac7
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry value

Disassembly:
mov eax, 0x411544
call fcn.00410db0
sub esp, 0xa40
push ebx
push esi
push edi
lea eax, [ebp - 0x844]
mov dword [ebp - 0x10], esp
xor edi, edi
push str.Download_with_IDM
push eax
mov dword [ebp - 4], edi
call sub.MSVCRT.dll_wcscpy
lea eax, [ebp - 0xa4c]
push str.Download_All_Links_with_IDM
push eax
call sub.MSVCRT.dll_wcscpy
lea eax, [ebp - 0x434]
push str.Download_FLV_video_content_with_IDM
push eax
call sub.MSVCRT.dll_wcscpy
lea eax, [ebp - 0x63c]
push str.Download_FLV_videos_with_IDM_from_10_last_requested
push eax
call sub.MSVCRT.dll_wcscpy
add esp, 0x20
lea eax, [ebp - 0x24]
mov esi, 0xf003f
mov ebx, 0x80000001
push eax
lea eax, [ebp - 0x1c]
push eax
push edi
push esi
push edi
push 0x41c4f4
push edi
push str.SoftwareDownloadManagermenuExt
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40dbb9
lea eax, [ebp - 0x844]
push eax
push str.iedownl1_str
push dword [ebp - 0x1c]
call fcn.0040de1f
add esp, 0xc
lea eax, [ebp - 0xa4c]
push eax
push str.iedownlAll_str
push dword [ebp - 0x1c]
call fcn.0040de1f
add esp, 0xc
lea eax, [ebp - 0x434]
push eax
push str.iedownlFLV_str
push dword [ebp - 0x1c]
call fcn.0040de1f
add esp, 0xc
lea eax, [ebp - 0x63c]
push eax
push str.iedownl10FLV_str
push dword [ebp - 0x1c]
call fcn.0040de1f
add esp, 0xc
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x14]
push eax
push esi
push edi
push str.SoftwareMicrosoftInternet_ExplorerMenuExt_
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40dc6b
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push str.Download_with_IDMan
push dword [ebp - 0x14]
call ebx
push str.IEExt.htm
lea eax, [ebp - 0x844]
push str.Download_with_IDM
push eax
push dword [ebp - 0x14]
call fcn.0040d92b
add esp, 0x10
lea eax, [ebp - 0xa4c]
push str.IEGetAll.htm
push str.Download_All_Links_with_IDM
push eax
push dword [ebp - 0x14]
call fcn.0040d92b
add esp, 0x10
lea eax, [ebp - 0x434]
push str.IEGetVL.htm
push str.Download_FLV_video_content_with_IDM
push eax
push dword [ebp - 0x14]
call fcn.0040d92b
add esp, 0x10
lea eax, [ebp - 0x63c]
push str.IEGetVL2.htm
push str.Download_FLV_videos_with_IDM_from_10_last_requested
push eax
push dword [ebp - 0x14]
call fcn.0040d92b
add esp, 0x10
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40dc71
xor eax, eax
jmp 0x40de10
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea eax, [ebp - 0x14]
push eax
push esi
push edi
push str.SoftwareClassesPROTOCOLSName_Space_Handler_
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40dc64
lea eax, [ebp - 0x18]
push edi
push eax
push edi
push esi
push edi
push edi
push edi
push str.http_
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40dcc4
push 0x41a7bc
push dword [ebp - 0x18]
call ebx
push 0x41a7b4
push dword [ebp - 0x18]
call ebx
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x18]
push edi
push eax
push edi
push esi
push edi
push edi
push edi
push str.ftp_
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40dcfd
push 0x41a7bc
push dword [ebp - 0x18]
call ebx
push 0x41a7b4
push dword [ebp - 0x18]
call ebx
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x18]
push edi
push eax
push edi
push esi
push edi
push edi
push edi
push str.https_
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40dd2c
push 0x41a7bc
push dword [ebp - 0x18]
call ebx
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x14]
push eax
push esi
push edi
push str.SoftwareMicrosoftInternet_Explorer
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40dda2
lea eax, [ebp - 0x20]
mov ebx, str.DownloadUI
push eax
lea eax, [ebp - 0x22c]
push eax
push edi
push edi
push ebx
push dword [ebp - 0x14]
mov dword [ebp - 0x20], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40dd97
lea eax, [ebp - 0x22c]
push str.7D11E719_FF90_479C_B0D7_96EB43EE55D7
push eax
call sub.MSVCRT.dll_wcscmp
pop ecx
test eax, eax
pop ecx
jne 0x40dd97
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40dda7
mov ebx, str.DownloadUI
lea eax, [ebp - 0x14]
push eax
push esi
push edi
push str.SoftwareMicrosoftInternet_Explorer
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40de0d
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x208
push eax
lea eax, [ebp - 0x22c]
push eax
push edi
push edi
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40de04
lea eax, [ebp - 0x22c]
push str.7D11E719_FF90_479C_B0D7_96EB43EE55D7
push eax
call sub.MSVCRT.dll_wcscmp
pop ecx
test eax, eax
pop ecx
jne 0x40de04
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
pop eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret