Function at 0x50dd00
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x626bcd
push eax
mov dword fs:[0], esp
sub esp, 0xdc0
push ebx
push ebp
push esi
push edi
mov ebx, ecx
call fcn.0050f120
mov ecx, ebx
call fcn.0050f0e0
mov ecx, ebx
call fcn.0050e5c0
mov ecx, dword [ebx + 4]
xor edi, edi
cmp ecx, edi
mov ebp, 1
je 0x50dda7
push ebp
call fcn.004375d0
test eax, eax
jne 0x50dda7
cmp dword [ebx + 8], edi
jne 0x50dd5b
mov eax, 4
jmp 0x50e598
mov eax, dword [ebx + 4]
cmp dword [eax + 0x30], edi
je 0x50dda7
lea ecx, [esp + 0x14]
call fcn.004e6e60
mov ecx, dword [ebx + 4]
mov dword [esp + 0xdd8], edi
push ecx
lea ecx, [esp + 0x18]
call fcn.004e6ea0
cmp eax, edi
mov dword [esp + 0xdd8], 0xffffffff
lea ecx, [esp + 0x14]
je 0x50dda2
call fcn.004e6e90
mov eax, 4
jmp 0x50e598
call fcn.004e6e90
mov eax, dword [0x6f175c]
mov dword [esp + 0x24], eax
mov dword [esp + 0xdd8], ebp
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], eax
mov esi, dword [esp + 0xde8]
mov byte [esp + 0xdd8], 5
cmp esi, edi
je 0x50ddfd
lea edx, [esp + 0x28]
lea eax, [esp + 0x1c]
push edx
lea ecx, [esp + 0x24]
push eax
lea edx, [esp + 0x20]
push ecx
lea eax, [esp + 0x30]
push edx
push eax
call fcn.0051a2c0
add esp, 0x14
jmp 0x50de5b
push str.www.internetdownloadmanager.com
lea ecx, [esp + 0x28]
call fcn.00601a55
push 0x6dfe3c
lea ecx, [esp + 0x1c]
call fcn.00601a55
push 0x6dfe38
push 0x6dfe34
push 0x6dfe30
push str.register
lea ecx, [esp + 0x30]
push str._s._s_s_s
push ecx
call fcn.005fa6fb
add esp, 0x18
lea ecx, [esp + 0x1c]
push str.tcidm
call fcn.00601a55
push str.azcfgped
lea ecx, [esp + 0x2c]
call fcn.00601a55
lea ecx, [esp + 0x130]
call fcn.005a86d0
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x24]
push 0xffffffffffffffff
push edx
xor edx, edx
cmp esi, edi
push eax
setne dl
inc edx
push ecx
push edx
lea ecx, [esp + 0x144]
mov byte [esp + 0xdec], 6
call fcn.005afae0
lea eax, [ebx + 0xc]
push 0x400
push eax
lea ecx, [esp + 0x158]
call fcn.005c4850
cmp dword [ebx + 0x514], edi
je 0x50deef
lea ecx, [esp + 0x130]
mov dword [esp + 0x134], edi
push ecx
mov byte [esp + 0xb49], 0
call fcn.0049ecd0
mov eax, dword [esp + 0xa10]
add esp, 4
cmp eax, edi
jne 0x50dee7
mov al, byte [esp + 0xb68]
test al, al
je 0x50defd
mov dword [ebx + 0x518], ebp
jmp 0x50defd
mov byte [esp + 0xb45], 1
mov dword [ebx + 0x518], edi
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
push edx
push eax
lea ecx, [esp + 0x138]
call fcn.005afd00
mov eax, dword [ebx + 8]
cmp eax, edi
je 0x50df2b
mov ecx, dword [ebx + 0x51c]
mov dword [esp + 0x134], ebp
cmp ecx, edi
je 0x50df36
mov dword [esp + 0x134], 4
cmp eax, edi
je 0x50df4e
cmp dword [ebx + 0x51c], edi
jne 0x50df4e
mov ecx, dword [ebx + 4]
mov dword [esp + 0x130], ecx
jmp 0x50df55
mov dword [esp + 0x130], edi
mov eax, dword [ebx + 0x51c]
mov byte [esp + 0xb80], 1
cmp eax, edi
mov byte [esp + 0x2a7], 0
mov byte [esp + 0x465], 1
mov byte [esp + 0x466], 1
je 0x50df87
mov byte [esp + 0x2dd], 1
push ebp
lea ecx, [esp + 0x134]
call fcn.005aff80
mov eax, dword [esp + 0xa04]
cmp eax, 3
je 0x50dfc1
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
cmp eax, edi
je 0x50e072
push 0xc8
call esi
mov eax, dword [esp + 0xa04]
cmp eax, 3
jne 0x50dfa6
mov edx, dword [esp + 0x180]
push 0x6cc290
push edx
call fcn.005e683f
mov ebp, eax
add esp, 8
cmp ebp, edi
jne 0x50e117
mov eax, dword [esp + 0x180]
push eax
call fcn.005e6c7e
add esp, 4
lea ecx, [esp + 0x130]
call fcn.005b24c0
mov byte [esp + 0xdd8], 5
lea ecx, [esp + 0x130]
call fcn.005a8880
lea ecx, [esp + 0x28]
mov byte [esp + 0xdd8], 4
call fcn.006018cc
lea ecx, [esp + 0x1c]
mov byte [esp + 0xdd8], 3
call fcn.006018cc
lea ecx, [esp + 0x20]
mov byte [esp + 0xdd8], 2
call fcn.006018cc
lea ecx, [esp + 0x18]
mov byte [esp + 0xdd8], 1
call fcn.006018cc
lea ecx, [esp + 0x24]
mov dword [esp + 0xdd8], 0xffffffff
call fcn.006018cc
mov eax, 4
jmp 0x50e598
mov eax, dword [esp + 0x180]
cmp eax, edi
je 0x50e086
push eax
call fcn.005e6c7e
add esp, 4
lea ecx, [esp + 0x130]
call fcn.005b24c0
mov al, byte [esp + 0x2dd]
mov byte [esp + 0xdd8], 5
test al, al
lea ecx, [esp + 0x130]
jne 0x50e00b
call fcn.005a8880
lea ecx, [esp + 0x28]
mov byte [esp + 0xdd8], 4
call fcn.006018cc
lea ecx, [esp + 0x1c]
mov byte [esp + 0xdd8], 3
call fcn.006018cc
lea ecx, [esp + 0x20]
mov byte [esp + 0xdd8], 2
call fcn.006018cc
lea ecx, [esp + 0x18]
mov byte [esp + 0xdd8], 1
call fcn.006018cc
lea ecx, [esp + 0x24]
mov dword [esp + 0xdd8], 0xffffffff
call fcn.006018cc
mov eax, 8
jmp 0x50e598
push ebp
call fcn.005fa03a
push eax
call fcn.005e7bc5
mov esi, eax
lea edi, [esi + 1]
push edi
call fcn.005fdccd
mov edx, eax
mov ecx, edi
mov dword [esp + 0x20], edx
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push ebp
and ecx, 3
push esi
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x28]
push 1
push eax
call fcn.005e7aae
push ebp
mov dword [esp + 0x30], eax
call fcn.005e6658
mov ecx, dword [esp + 0x1a0]
push ecx
call fcn.005e6c7e
add esp, 0x24
lea ecx, [esp + 0x130]
call fcn.005b24c0
mov edx, dword [esp + 0x14]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x30]
mov byte [edx + esi], 0
mov edx, 0x100
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x10]
cmp eax, edx
jae 0x50e1a0
mov edx, eax
mov eax, dword [esp + 0x14]
mov ecx, edx
mov ebp, ecx
mov esi, eax
lea edi, [esp + 0x30]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0xde0]
mov ecx, edx
mov esi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [0x6f774c]
or ecx, 0xffffffff
mov edi, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push esi
lea ecx, [esp + 0x38]
push edx
push ecx
lea ecx, [ebx + 0x508]
call fcn.0044b8b0
lea ebp, [ebx + 0x43e]
lea esi, [esp + 0x30]
mov edi, ebp
mov dl, byte [esi]
mov cl, byte [edi]
mov al, dl
cmp dl, cl
jne 0x50e22c
test al, al
je 0x50e228
mov cl, byte [esi + 1]
mov dl, byte [edi + 1]
mov al, cl
cmp cl, dl
jne 0x50e22c
add esi, 2
add edi, 2
test al, al
jne 0x50e204
xor eax, eax
jmp 0x50e231
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x50e329
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebp, dword [sym.imp.USER32.dll_PostMessageA]
mov dword [esp + 0x10], eax
mov al, byte [esp + ecx + 0x32]
lea esi, [esp + ecx + 0x32]
test al, al
je 0x50e2e8
lea edi, [ebx + 0x50c]
push edi
push 0x6cb938
push esi
call fcn.005e55f0
mov eax, dword [edi]
add esp, 0xc
test eax, eax
jle 0x50e2be
mov dword [0x6f67a0], eax
mov eax, dword [0x6f64a4]
test eax, eax
je 0x50e298
mov edx, dword [edi]
push edx
push 0x14a7
push 0x111
push eax
call ebp
jmp 0x50e2be
mov eax, dword [0x6f6360]
test eax, eax
je 0x50e2be
mov ecx, dword [edi]
lea edx, [esp + 0x2c]
push 4
push edx
push 4
push 0
push str.nExpDt
push eax
mov dword [esp + 0x44], ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
inc ecx
add esi, ecx
cmp byte [esi], 0
je 0x50e2fd
add ebx, 0x510
push ebx
push 0x6cb938
push esi
call fcn.005e55f0
add esp, 0xc
jmp 0x50e2fd
mov eax, dword [0x6f6360]
test eax, eax
je 0x50e2fd
push str.nExpDt
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, dword [0x6f64a4]
test eax, eax
je 0x50e31a
push 1
push 0x149d
push 0x111
push eax
call ebp
jmp 0x50e51b
mov dword [0x6f6474], 2
jmp 0x50e51b
mov esi, dword [0x6f6b38]
lea eax, [esp + 0x30]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x50e35b
test cl, cl
je 0x50e357
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x50e35b
add eax, 2
add esi, 2
test cl, cl
jne 0x50e333
xor eax, eax
jmp 0x50e360
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x50e371
mov dword [esp + 0x10], 1
jmp 0x50e51b
mov esi, dword [0x6f6b34]
lea eax, [esp + 0x30]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x50e3a3
test cl, cl
je 0x50e39f
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x50e3a3
add eax, 2
add esi, 2
test cl, cl
jne 0x50e37b
xor eax, eax
jmp 0x50e3a8
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x50e3b9
mov dword [esp + 0x10], 2
jmp 0x50e51b
mov esi, dword [0x6f6b2c]
lea eax, [esp + 0x30]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x50e3eb
test cl, cl
je 0x50e3e7
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x50e3eb
add eax, 2
add esi, 2
test cl, cl
jne 0x50e3c3
xor eax, eax
jmp 0x50e3f0
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x50e401
mov dword [esp + 0x10], 7
jmp 0x50e51b
mov esi, dword [0x6f6b14]
lea eax, [esp + 0x30]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x50e433
test cl, cl
je 0x50e42f
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x50e433
add eax, 2
add esi, 2
test cl, cl
jne 0x50e40b
xor eax, eax
jmp 0x50e438
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x50e449
mov dword [esp + 0x10], 0xa
jmp 0x50e51b
mov esi, dword [0x6f6b10]
lea eax, [esp + 0x30]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x50e47b
test cl, cl
je 0x50e477
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x50e47b
add eax, 2
add esi, 2
test cl, cl
jne 0x50e453
xor eax, eax
jmp 0x50e480
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x50e491
mov dword [esp + 0x10], 0xb
jmp 0x50e51b
mov esi, dword [0x6f6b0c]
lea eax, [esp + 0x30]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x50e4c3
test cl, cl
je 0x50e4bf
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x50e4c3
add eax, 2
add esi, 2
test cl, cl
jne 0x50e49b
xor eax, eax
jmp 0x50e4c8
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x50e4d6
mov dword [esp + 0x10], 0xc
jmp 0x50e51b
mov esi, dword [0x6f6b30]
lea eax, [esp + 0x30]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x50e508
test cl, cl
je 0x50e504
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x50e508
add eax, 2
add esi, 2
test cl, cl
jne 0x50e4e0
xor eax, eax
jmp 0x50e50d
sbb eax, eax
sbb eax, 0xffffffff
xor ecx, ecx
test eax, eax
setne cl
add ecx, 3
mov dword [esp + 0x10], ecx
mov edx, dword [esp + 0x14]
push edx
call fcn.005fdcf6
add esp, 4
lea ecx, [esp + 0x130]
mov byte [esp + 0xdd8], 5
call fcn.005a8880
lea ecx, [esp + 0x28]
mov byte [esp + 0xdd8], 4
call fcn.006018cc
lea ecx, [esp + 0x1c]
mov byte [esp + 0xdd8], 3
call fcn.006018cc
lea ecx, [esp + 0x20]
mov byte [esp + 0xdd8], 2
call fcn.006018cc
lea ecx, [esp + 0x18]
mov byte [esp + 0xdd8], 1
call fcn.006018cc
lea ecx, [esp + 0x24]
mov dword [esp + 0xdd8], 0xffffffff
call fcn.006018cc
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xdd0]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xdcc
ret 0xc