Function at 0x40d086
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry value

Disassembly:
mov eax, 0x4108e0
call fcn.00410160
sub esp, 0xa40
push ebx
push esi
push edi
lea eax, [ebp - 0x844]
mov dword [ebp - 0x10], esp
xor edi, edi
push str.Download_with_IDM
push eax
mov dword [ebp - 4], edi
call sub.MSVCRT.dll_wcscpy
lea eax, [ebp - 0xa4c]
push str.Download_All_Links_with_IDM
push eax
call sub.MSVCRT.dll_wcscpy
lea eax, [ebp - 0x434]
push str.Download_FLV_video_content_with_IDM
push eax
call sub.MSVCRT.dll_wcscpy
lea eax, [ebp - 0x63c]
push str.Download_FLV_videos_with_IDM_from_10_last_requested
push eax
call sub.MSVCRT.dll_wcscpy
add esp, 0x20
lea eax, [ebp - 0x24]
mov esi, 0xf003f
mov ebx, 0x80000001
push eax
lea eax, [ebp - 0x1c]
push eax
push edi
push esi
push edi
push 0x41afe4
push edi
push str.SoftwareDownloadManagermenuExt
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40d178
lea eax, [ebp - 0x844]
push eax
push str.iedownl1_str
push dword [ebp - 0x1c]
call fcn.0040d3de
add esp, 0xc
lea eax, [ebp - 0xa4c]
push eax
push str.iedownlAll_str
push dword [ebp - 0x1c]
call fcn.0040d3de
add esp, 0xc
lea eax, [ebp - 0x434]
push eax
push str.iedownlFLV_str
push dword [ebp - 0x1c]
call fcn.0040d3de
add esp, 0xc
lea eax, [ebp - 0x63c]
push eax
push str.iedownl10FLV_str
push dword [ebp - 0x1c]
call fcn.0040d3de
add esp, 0xc
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x14]
push eax
push esi
push edi
push str.SoftwareMicrosoftInternet_ExplorerMenuExt_
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40d22a
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push str.Download_with_IDMan
push dword [ebp - 0x14]
call ebx
push str.IEExt.htm
lea eax, [ebp - 0x844]
push str.Download_with_IDM
push eax
push dword [ebp - 0x14]
call fcn.0040ceea
add esp, 0x10
lea eax, [ebp - 0xa4c]
push str.IEGetAll.htm
push str.Download_All_Links_with_IDM
push eax
push dword [ebp - 0x14]
call fcn.0040ceea
add esp, 0x10
lea eax, [ebp - 0x434]
push str.IEGetVL.htm
push str.Download_FLV_video_content_with_IDM
push eax
push dword [ebp - 0x14]
call fcn.0040ceea
add esp, 0x10
lea eax, [ebp - 0x63c]
push str.IEGetVL2.htm
push str.Download_FLV_videos_with_IDM_from_10_last_requested
push eax
push dword [ebp - 0x14]
call fcn.0040ceea
add esp, 0x10
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40d230
xor eax, eax
jmp 0x40d3cf
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea eax, [ebp - 0x14]
push eax
push esi
push edi
push str.SoftwareClassesPROTOCOLSName_Space_Handler_
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40d223
lea eax, [ebp - 0x18]
push edi
push eax
push edi
push esi
push edi
push edi
push edi
push str.http_
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40d283
push 0x419468
push dword [ebp - 0x18]
call ebx
push 0x419460
push dword [ebp - 0x18]
call ebx
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x18]
push edi
push eax
push edi
push esi
push edi
push edi
push edi
push str.ftp_
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40d2bc
push 0x419468
push dword [ebp - 0x18]
call ebx
push 0x419460
push dword [ebp - 0x18]
call ebx
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x18]
push edi
push eax
push edi
push esi
push edi
push edi
push edi
push str.https_
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40d2eb
push 0x419468
push dword [ebp - 0x18]
call ebx
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x14]
push eax
push esi
push edi
push str.SoftwareMicrosoftInternet_Explorer
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40d361
lea eax, [ebp - 0x20]
mov ebx, str.DownloadUI
push eax
lea eax, [ebp - 0x22c]
push eax
push edi
push edi
push ebx
push dword [ebp - 0x14]
mov dword [ebp - 0x20], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40d356
lea eax, [ebp - 0x22c]
push str.7D11E719_FF90_479C_B0D7_96EB43EE55D7
push eax
call sub.MSVCRT.dll_wcscmp
pop ecx
test eax, eax
pop ecx
jne 0x40d356
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40d366
mov ebx, str.DownloadUI
lea eax, [ebp - 0x14]
push eax
push esi
push edi
push str.SoftwareMicrosoftInternet_Explorer
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40d3cc
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x208
push eax
lea eax, [ebp - 0x22c]
push eax
push edi
push edi
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40d3c3
lea eax, [ebp - 0x22c]
push str.7D11E719_FF90_479C_B0D7_96EB43EE55D7
push eax
call sub.MSVCRT.dll_wcscmp
pop ecx
test eax, eax
pop ecx
jne 0x40d3c3
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
pop eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret