Function at 0x4f4bd0
Capabilities:
Check if file exists
Create process on windows
Get file attributes
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x74
push 0xffffffffffffffff
push 0x655b98
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x758898]
xor eax, ebp
mov dword [ebp + 0x70], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor ebx, ebx
cmp dword [0x75dbc0], ebx
jne 0x4f4ecc
mov dword [ebp - 4], ebx
mov esi, 1
mov dword [ebp + 8], esi
mov dword [ebp - 0x1c], 4
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x18]
push ecx
push ebx
push ebx
push str.RunIEMonitor2
mov edx, dword [0x75dbe4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4f4c4e
mov esi, dword [ebp - 0x18]
mov dword [ebp + 8], esi
jmp 0x4f4cd2
cmp dword [ebp + 0x7c], ebx
jne 0x4f4cda
cmp dword [0x75dbb8], ebx
je 0x4f4cda
mov dword [ebp + 4], esi
mov ecx, 0x75de90
call fcn.00417a90
cmp eax, 2
je 0x4f4c9e
cmp eax, 0xc
je 0x4f4c9e
cmp eax, 0x12
je 0x4f4c9e
cmp eax, 0x13
je 0x4f4c9e
cmp eax, 0x14
je 0x4f4c9e
cmp eax, 0x15
je 0x4f4c9e
cmp eax, 0xf
je 0x4f4c9e
cmp eax, 0x11
je 0x4f4c9e
cmp eax, 0x10
je 0x4f4c9e
cmp eax, 3
jne 0x4f4cb7
push 0x67bacc
call fcn.00410c30
add esp, 4
test eax, eax
jne 0x4f4cb7
mov dword [ebp + 4], ebx
xor esi, esi
mov dword [ebp + 8], esi
push 4
lea eax, [ebp + 4]
push eax
push 4
push ebx
push str.RunIEMonitor2
mov ecx, dword [0x75dbe4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp esi, ebx
je 0x4f4ec5
mov dword [ebp + 0x18], ebx
mov dword [ebp + 0x20], ebx
xor edx, edx
mov word [ebp + 0x1c], dx
mov byte [ebp - 4], 1
mov eax, dword [0x75dc58]
cmp eax, ebx
jne 0x4f4cf8
mov eax, 0x75dc5c
push ebx
push str.IEMonitor.exe
push eax
push 0x678de0
lea ecx, [ebp + 0x18]
call fcn.00402310
mov eax, dword [ebp + 0x18]
cmp eax, ebx
jne 0x4f4d16
lea eax, [ebp + 0x1c]
push eax
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call esi
cmp eax, 0xffffffff
je 0x4f4eb9
mov dword [ebp], ebx
mov dword [ebp + 0x24], ebx
mov dword [ebp + 0x2c], ebx
xor eax, eax
mov word [ebp + 0x28], ax
mov byte [ebp - 4], 2
mov eax, dword [0x75dc58]
cmp eax, ebx
jne 0x4f4d49
mov eax, 0x75dc5c
push ebx
push eax
push str._sidmmkb.dll
lea ecx, [ebp + 0x24]
call fcn.004021a0
mov eax, dword [ebp + 0x24]
cmp eax, ebx
jne 0x4f4d62
lea eax, [ebp + 0x28]
push eax
call esi
cmp eax, 0xffffffff
je 0x4f4eed
mov eax, dword [ebp + 0x24]
cmp eax, ebx
jne 0x4f4d78
lea eax, [ebp + 0x28]
push 0x40
lea ecx, [ebp + 0x30]
push ecx
push eax
call fcn.00411230
add esp, 0xc
test eax, eax
je 0x4f4eed
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x14], ebx
push 0x6a0440
lea edx, [ebp + 0x30]
push edx
call fcn.006232f0
add esp, 8
mov esi, eax
cmp esi, ebx
je 0x4f4eed
mov byte [esi], 0
lea eax, [ebp + 0x30]
push eax
call fcn.006223c1
mov edi, eax
mov dword [ebp - 0x20], edi
inc esi
push 0x6a0440
push esi
call fcn.006232f0
add esp, 0xc
test eax, eax
je 0x4f4de5
mov byte [eax], 0
push esi
call fcn.006223c1
add esp, 4
mov ebx, eax
mov dword [ebp - 0x14], ebx
cmp edi, 6
jg 0x4f4df9
jne 0x4f4eeb
cmp ebx, 0x24
jle 0x4f4eeb
mov eax, dword [ebp + 0x24]
test eax, eax
jne 0x4f4e03
lea eax, [ebp + 0x28]
push eax
call fcn.004f49d0
add esp, 4
test eax, eax
je 0x4f4eeb
mov dword [ebp], 1
push 0x44
xor esi, esi
push esi
lea ecx, [ebp - 0x74]
push ecx
call fcn.00621270
add esp, 0xc
mov dword [ebp - 0x74], 0x44
mov dword [ebp - 0x48], 0x81
xor edx, edx
mov word [ebp - 0x44], dx
mov dword [ebp + 0xc], esi
mov dword [ebp + 0x14], esi
xor eax, eax
mov word [ebp + 0x10], ax
mov byte [ebp - 4], 3
mov eax, dword [ebp + 0x18]
cmp eax, esi
jne 0x4f4e5a
lea eax, [ebp + 0x1c]
push esi
push eax
push str.__s_
lea ecx, [ebp + 0xc]
call fcn.004021a0
mov eax, dword [ebp + 0xc]
cmp eax, esi
jne 0x4f4e73
lea eax, [ebp + 0x10]
lea ecx, [ebp - 0x30]
push ecx
lea edx, [ebp - 0x74]
push edx
push esi
push esi
push 0x30
push 1
push esi
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, esi
je 0x4f4ea1
mov eax, dword [ebp - 0x2c]
push eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov ecx, dword [ebp - 0x30]
push ecx
call esi
mov byte [ebp - 4], 2
lea ecx, [ebp + 0xc]
call fcn.00401210
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x24]
call fcn.00401210
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x18]
call fcn.00401210
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x70]
xor ecx, ebp
call fcn.00620b8d
add ebp, 0x74
mov esp, ebp
pop ebp
ret
xor ebx, ebx
cmp dword [ebp + 0x7c], ebx
je 0x4f4f10
push 0x50000
push 0x678d88
push str.Its_impossible_to_start_monitoring_process_for_IE_based_browsers_because_several_IDM_components_are_damaged_or_incompatible._r_n_r_nPlease_redownload_the_latest_IDM_installation_file_and_reinstall_IDM._Please_reboot_your_computer_after_IDM_installation_if_required.
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call fcn.00473680
add esp, 0x10
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x24]
call fcn.00401210
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x18]
call fcn.00401210
jmp 0x4f4ecc