Function at 0x50f4e0
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x62775d
push eax
mov dword fs:[0], esp
sub esp, 0xdc0
push ebx
push ebp
push esi
push edi
mov ebx, ecx
call fcn.00510910
mov ecx, ebx
call fcn.005108c0
mov ecx, ebx
call fcn.0050fda0
mov ecx, dword [ebx + 4]
xor edi, edi
cmp ecx, edi
mov ebp, 1
je 0x50f587
push ebp
call fcn.004378b0
test eax, eax
jne 0x50f587
cmp dword [ebx + 8], edi
jne 0x50f53b
mov eax, 4
jmp 0x50fd78
mov eax, dword [ebx + 4]
cmp dword [eax + 0x30], edi
je 0x50f587
lea ecx, [esp + 0x14]
call fcn.004e7a50
mov ecx, dword [ebx + 4]
mov dword [esp + 0xdd8], edi
push ecx
lea ecx, [esp + 0x18]
call fcn.004e7a90
cmp eax, edi
mov dword [esp + 0xdd8], 0xffffffff
lea ecx, [esp + 0x14]
je 0x50f582
call fcn.004e7a80
mov eax, 4
jmp 0x50fd78
call fcn.004e7a80
mov eax, dword [0x6cd768]
mov dword [esp + 0x24], eax
mov dword [esp + 0xdd8], ebp
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], eax
mov esi, dword [esp + 0xde8]
mov byte [esp + 0xdd8], 5
cmp esi, edi
je 0x50f5dd
lea edx, [esp + 0x28]
lea eax, [esp + 0x1c]
push edx
lea ecx, [esp + 0x24]
push eax
lea edx, [esp + 0x20]
push ecx
lea eax, [esp + 0x30]
push edx
push eax
call fcn.0051bdb0
add esp, 0x14
jmp 0x50f63b
push str.www.internetdownloadmanager.com
lea ecx, [esp + 0x28]
call fcn.00603bc5
push 0x6bbe48
lea ecx, [esp + 0x1c]
call fcn.00603bc5
push 0x6bbe44
push 0x6bbe40
push 0x6bbe3c
push str.register
lea ecx, [esp + 0x30]
push str._s._s_s_s
push ecx
call fcn.005fc86b
add esp, 0x18
lea ecx, [esp + 0x1c]
push str.tcidm
call fcn.00603bc5
push str.azcfgped
lea ecx, [esp + 0x2c]
call fcn.00603bc5
lea ecx, [esp + 0x130]
call fcn.005aa7f0
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x24]
push 0xffffffffffffffff
push edx
xor edx, edx
cmp esi, edi
push eax
setne dl
inc edx
push ecx
push edx
lea ecx, [esp + 0x144]
mov byte [esp + 0xdec], 6
call fcn.005b1b70
lea eax, [ebx + 0xc]
push 0x400
push eax
lea ecx, [esp + 0x158]
call fcn.005c6890
cmp dword [ebx + 0x514], edi
je 0x50f6cf
lea ecx, [esp + 0x130]
mov dword [esp + 0x134], edi
push ecx
mov byte [esp + 0xb49], 0
call fcn.0049f090
mov eax, dword [esp + 0xa10]
add esp, 4
cmp eax, edi
jne 0x50f6c7
mov al, byte [esp + 0xb68]
test al, al
je 0x50f6dd
mov dword [ebx + 0x518], ebp
jmp 0x50f6dd
mov byte [esp + 0xb45], 1
mov dword [ebx + 0x518], edi
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
push edx
push eax
lea ecx, [esp + 0x138]
call fcn.005b1d90
mov eax, dword [ebx + 8]
cmp eax, edi
je 0x50f70b
mov ecx, dword [ebx + 0x51c]
mov dword [esp + 0x134], ebp
cmp ecx, edi
je 0x50f716
mov dword [esp + 0x134], 4
cmp eax, edi
je 0x50f72e
cmp dword [ebx + 0x51c], edi
jne 0x50f72e
mov ecx, dword [ebx + 4]
mov dword [esp + 0x130], ecx
jmp 0x50f735
mov dword [esp + 0x130], edi
mov eax, dword [ebx + 0x51c]
mov byte [esp + 0xb80], 1
cmp eax, edi
mov byte [esp + 0x2a7], 0
mov byte [esp + 0x465], 1
mov byte [esp + 0x466], 1
je 0x50f767
mov byte [esp + 0x2dd], 1
push ebp
lea ecx, [esp + 0x134]
call fcn.005b2010
mov eax, dword [esp + 0xa04]
cmp eax, 3
je 0x50f7a1
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
cmp eax, edi
je 0x50f852
push 0xc8
call esi
mov eax, dword [esp + 0xa04]
cmp eax, 3
jne 0x50f786
mov edx, dword [esp + 0x180]
push 0x6a82ac
push edx
call fcn.005e885f
mov ebp, eax
add esp, 8
cmp ebp, edi
jne 0x50f8f7
mov eax, dword [esp + 0x180]
push eax
call fcn.005e8c9e
add esp, 4
lea ecx, [esp + 0x130]
call fcn.005b4560
mov byte [esp + 0xdd8], 5
lea ecx, [esp + 0x130]
call fcn.005aa9a0
lea ecx, [esp + 0x28]
mov byte [esp + 0xdd8], 4
call fcn.00603a3c
lea ecx, [esp + 0x1c]
mov byte [esp + 0xdd8], 3
call fcn.00603a3c
lea ecx, [esp + 0x20]
mov byte [esp + 0xdd8], 2
call fcn.00603a3c
lea ecx, [esp + 0x18]
mov byte [esp + 0xdd8], 1
call fcn.00603a3c
lea ecx, [esp + 0x24]
mov dword [esp + 0xdd8], 0xffffffff
call fcn.00603a3c
mov eax, 4
jmp 0x50fd78
mov eax, dword [esp + 0x180]
cmp eax, edi
je 0x50f866
push eax
call fcn.005e8c9e
add esp, 4
lea ecx, [esp + 0x130]
call fcn.005b4560
mov al, byte [esp + 0x2dd]
mov byte [esp + 0xdd8], 5
test al, al
lea ecx, [esp + 0x130]
jne 0x50f7eb
call fcn.005aa9a0
lea ecx, [esp + 0x28]
mov byte [esp + 0xdd8], 4
call fcn.00603a3c
lea ecx, [esp + 0x1c]
mov byte [esp + 0xdd8], 3
call fcn.00603a3c
lea ecx, [esp + 0x20]
mov byte [esp + 0xdd8], 2
call fcn.00603a3c
lea ecx, [esp + 0x18]
mov byte [esp + 0xdd8], 1
call fcn.00603a3c
lea ecx, [esp + 0x24]
mov dword [esp + 0xdd8], 0xffffffff
call fcn.00603a3c
mov eax, 8
jmp 0x50fd78
push ebp
call fcn.005fc1aa
push eax
call fcn.005e9be5
mov esi, eax
lea edi, [esi + 1]
push edi
call fcn.005ffe3f
mov edx, eax
mov ecx, edi
mov dword [esp + 0x20], edx
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push ebp
and ecx, 3
push esi
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x28]
push 1
push eax
call fcn.005e9ace
push ebp
mov dword [esp + 0x30], eax
call fcn.005e8678
mov ecx, dword [esp + 0x1a0]
push ecx
call fcn.005e8c9e
add esp, 0x24
lea ecx, [esp + 0x130]
call fcn.005b4560
mov edx, dword [esp + 0x14]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x30]
mov byte [edx + esi], 0
mov edx, 0x100
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x10]
cmp eax, edx
jae 0x50f980
mov edx, eax
mov eax, dword [esp + 0x14]
mov ecx, edx
mov ebp, ecx
mov esi, eax
lea edi, [esp + 0x30]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0xde0]
mov ecx, edx
mov esi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [0x6d376c]
or ecx, 0xffffffff
mov edi, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push esi
lea ecx, [esp + 0x38]
push edx
push ecx
lea ecx, [ebx + 0x508]
call fcn.0044bd30
lea ebp, [ebx + 0x43e]
lea esi, [esp + 0x30]
mov edi, ebp
mov dl, byte [esi]
mov cl, byte [edi]
mov al, dl
cmp dl, cl
jne 0x50fa0c
test al, al
je 0x50fa08
mov cl, byte [esi + 1]
mov dl, byte [edi + 1]
mov al, cl
cmp cl, dl
jne 0x50fa0c
add esi, 2
add edi, 2
test al, al
jne 0x50f9e4
xor eax, eax
jmp 0x50fa11
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x50fb09
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebp, dword [sym.imp.USER32.dll_PostMessageA]
mov dword [esp + 0x10], eax
mov al, byte [esp + ecx + 0x32]
lea esi, [esp + ecx + 0x32]
test al, al
je 0x50fac8
lea edi, [ebx + 0x50c]
push edi
push 0x6a7940
push esi
call fcn.005e7710
mov eax, dword [edi]
add esp, 0xc
test eax, eax
jle 0x50fa9e
mov dword [0x6d27ac], eax
mov eax, dword [0x6d24a4]
test eax, eax
je 0x50fa78
mov edx, dword [edi]
push edx
push 0x14a7
push 0x111
push eax
call ebp
jmp 0x50fa9e
mov eax, dword [0x6d2354]
test eax, eax
je 0x50fa9e
mov ecx, dword [edi]
lea edx, [esp + 0x2c]
push 4
push edx
push 4
push 0
push str.nExpDt
push eax
mov dword [esp + 0x44], ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
inc ecx
add esi, ecx
cmp byte [esi], 0
je 0x50fadd
add ebx, 0x510
push ebx
push 0x6a7940
push esi
call fcn.005e7710
add esp, 0xc
jmp 0x50fadd
mov eax, dword [0x6d2354]
test eax, eax
je 0x50fadd
push str.nExpDt
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, dword [0x6d24a4]
test eax, eax
je 0x50fafa
push 1
push 0x14bb
push 0x111
push eax
call ebp
jmp 0x50fcfb
mov dword [0x6d2474], 2
jmp 0x50fcfb
mov esi, dword [0x6d2b58]
lea eax, [esp + 0x30]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x50fb3b
test cl, cl
je 0x50fb37
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x50fb3b
add eax, 2
add esi, 2
test cl, cl
jne 0x50fb13
xor eax, eax
jmp 0x50fb40
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x50fb51
mov dword [esp + 0x10], 1
jmp 0x50fcfb
mov esi, dword [0x6d2b54]
lea eax, [esp + 0x30]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x50fb83
test cl, cl
je 0x50fb7f
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x50fb83
add eax, 2
add esi, 2
test cl, cl
jne 0x50fb5b
xor eax, eax
jmp 0x50fb88
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x50fb99
mov dword [esp + 0x10], 2
jmp 0x50fcfb
mov esi, dword [0x6d2b4c]
lea eax, [esp + 0x30]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x50fbcb
test cl, cl
je 0x50fbc7
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x50fbcb
add eax, 2
add esi, 2
test cl, cl
jne 0x50fba3
xor eax, eax
jmp 0x50fbd0
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x50fbe1
mov dword [esp + 0x10], 7
jmp 0x50fcfb
mov esi, dword [0x6d2b34]
lea eax, [esp + 0x30]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x50fc13
test cl, cl
je 0x50fc0f
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x50fc13
add eax, 2
add esi, 2
test cl, cl
jne 0x50fbeb
xor eax, eax
jmp 0x50fc18
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x50fc29
mov dword [esp + 0x10], 0xa
jmp 0x50fcfb
mov esi, dword [0x6d2b30]
lea eax, [esp + 0x30]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x50fc5b
test cl, cl
je 0x50fc57
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x50fc5b
add eax, 2
add esi, 2
test cl, cl
jne 0x50fc33
xor eax, eax
jmp 0x50fc60
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x50fc71
mov dword [esp + 0x10], 0xb
jmp 0x50fcfb
mov esi, dword [0x6d2b2c]
lea eax, [esp + 0x30]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x50fca3
test cl, cl
je 0x50fc9f
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x50fca3
add eax, 2
add esi, 2
test cl, cl
jne 0x50fc7b
xor eax, eax
jmp 0x50fca8
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x50fcb6
mov dword [esp + 0x10], 0xc
jmp 0x50fcfb
mov esi, dword [0x6d2b50]
lea eax, [esp + 0x30]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x50fce8
test cl, cl
je 0x50fce4
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x50fce8
add eax, 2
add esi, 2
test cl, cl
jne 0x50fcc0
xor eax, eax
jmp 0x50fced
sbb eax, eax
sbb eax, 0xffffffff
xor ecx, ecx
test eax, eax
setne cl
add ecx, 3
mov dword [esp + 0x10], ecx
mov edx, dword [esp + 0x14]
push edx
call fcn.005ffe68
add esp, 4
lea ecx, [esp + 0x130]
mov byte [esp + 0xdd8], 5
call fcn.005aa9a0
lea ecx, [esp + 0x28]
mov byte [esp + 0xdd8], 4
call fcn.00603a3c
lea ecx, [esp + 0x1c]
mov byte [esp + 0xdd8], 3
call fcn.00603a3c
lea ecx, [esp + 0x20]
mov byte [esp + 0xdd8], 2
call fcn.00603a3c
lea ecx, [esp + 0x18]
mov byte [esp + 0xdd8], 1
call fcn.00603a3c
lea ecx, [esp + 0x24]
mov dword [esp + 0xdd8], 0xffffffff
call fcn.00603a3c
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xdd0]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xdcc
ret 0xc