Function at 0x50e790
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x62678d
push eax
mov dword fs:[0], esp
sub esp, 0xdc0
push ebx
push ebp
push esi
push edi
mov ebx, ecx
call fcn.0050fbc0
mov ecx, ebx
call fcn.0050fb70
mov ecx, ebx
call fcn.0050f050
mov ecx, dword [ebx + 4]
xor edi, edi
cmp ecx, edi
mov ebp, 1
je 0x50e837
push ebp
call fcn.00437510
test eax, eax
jne 0x50e837
cmp dword [ebx + 8], edi
jne 0x50e7eb
mov eax, 4
jmp 0x50f028
mov eax, dword [ebx + 4]
cmp dword [eax + 0x30], edi
je 0x50e837
lea ecx, [esp + 0x14]
call fcn.004e6c50
mov ecx, dword [ebx + 4]
mov dword [esp + 0xdd8], edi
push ecx
lea ecx, [esp + 0x18]
call fcn.004e6c90
cmp eax, edi
mov dword [esp + 0xdd8], 0xffffffff
lea ecx, [esp + 0x14]
je 0x50e832
call fcn.004e6c80
mov eax, 4
jmp 0x50f028
call fcn.004e6c80
mov eax, dword [0x6cc708]
mov dword [esp + 0x24], eax
mov dword [esp + 0xdd8], ebp
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], eax
mov esi, dword [esp + 0xde8]
mov byte [esp + 0xdd8], 5
cmp esi, edi
je 0x50e88d
lea edx, [esp + 0x28]
lea eax, [esp + 0x1c]
push edx
lea ecx, [esp + 0x24]
push eax
lea edx, [esp + 0x20]
push ecx
lea eax, [esp + 0x30]
push edx
push eax
call fcn.0051ae90
add esp, 0x14
jmp 0x50e8eb
push str.www.internetdownloadmanager.com
lea ecx, [esp + 0x28]
call fcn.00602c5f
push 0x6bae28
lea ecx, [esp + 0x1c]
call fcn.00602c5f
push 0x6bae24
push 0x6bae20
push 0x6bae1c
push str.register
lea ecx, [esp + 0x30]
push str._s._s_s_s
push ecx
call fcn.005fb90b
add esp, 0x18
lea ecx, [esp + 0x1c]
push str.tcidm
call fcn.00602c5f
push str.azcfgped
lea ecx, [esp + 0x2c]
call fcn.00602c5f
lea ecx, [esp + 0x130]
call fcn.005a9a10
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x24]
push 0xffffffffffffffff
push edx
xor edx, edx
cmp esi, edi
push eax
setne dl
inc edx
push ecx
push edx
lea ecx, [esp + 0x144]
mov byte [esp + 0xdec], 6
call fcn.005b0d90
lea eax, [ebx + 0xc]
push 0x400
push eax
lea ecx, [esp + 0x158]
call fcn.005c5a70
cmp dword [ebx + 0x514], edi
je 0x50e97f
lea ecx, [esp + 0x130]
mov dword [esp + 0x134], edi
push ecx
mov byte [esp + 0xb49], 0
call fcn.0049ea50
mov eax, dword [esp + 0xa10]
add esp, 4
cmp eax, edi
jne 0x50e977
mov al, byte [esp + 0xb68]
test al, al
je 0x50e98d
mov dword [ebx + 0x518], ebp
jmp 0x50e98d
mov byte [esp + 0xb45], 1
mov dword [ebx + 0x518], edi
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
push edx
push eax
lea ecx, [esp + 0x138]
call fcn.005b0fb0
mov eax, dword [ebx + 8]
cmp eax, edi
je 0x50e9bb
mov ecx, dword [ebx + 0x51c]
mov dword [esp + 0x134], ebp
cmp ecx, edi
je 0x50e9c6
mov dword [esp + 0x134], 4
cmp eax, edi
je 0x50e9de
cmp dword [ebx + 0x51c], edi
jne 0x50e9de
mov ecx, dword [ebx + 4]
mov dword [esp + 0x130], ecx
jmp 0x50e9e5
mov dword [esp + 0x130], edi
mov eax, dword [ebx + 0x51c]
mov byte [esp + 0xb80], 1
cmp eax, edi
mov byte [esp + 0x2a7], 0
mov byte [esp + 0x465], 1
mov byte [esp + 0x466], 1
je 0x50ea17
mov byte [esp + 0x2dd], 1
push ebp
lea ecx, [esp + 0x134]
call fcn.005b1230
mov eax, dword [esp + 0xa04]
cmp eax, 3
je 0x50ea51
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
cmp eax, edi
je 0x50eb02
push 0xc8
call esi
mov eax, dword [esp + 0xa04]
cmp eax, 3
jne 0x50ea36
mov edx, dword [esp + 0x180]
push 0x6a728c
push edx
call fcn.005e7a3f
mov ebp, eax
add esp, 8
cmp ebp, edi
jne 0x50eba7
mov eax, dword [esp + 0x180]
push eax
call fcn.005e7e7e
add esp, 4
lea ecx, [esp + 0x130]
call fcn.005b3780
mov byte [esp + 0xdd8], 5
lea ecx, [esp + 0x130]
call fcn.005a9bc0
lea ecx, [esp + 0x28]
mov byte [esp + 0xdd8], 4
call fcn.00602ad6
lea ecx, [esp + 0x1c]
mov byte [esp + 0xdd8], 3
call fcn.00602ad6
lea ecx, [esp + 0x20]
mov byte [esp + 0xdd8], 2
call fcn.00602ad6
lea ecx, [esp + 0x18]
mov byte [esp + 0xdd8], 1
call fcn.00602ad6
lea ecx, [esp + 0x24]
mov dword [esp + 0xdd8], 0xffffffff
call fcn.00602ad6
mov eax, 4
jmp 0x50f028
mov eax, dword [esp + 0x180]
cmp eax, edi
je 0x50eb16
push eax
call fcn.005e7e7e
add esp, 4
lea ecx, [esp + 0x130]
call fcn.005b3780
mov al, byte [esp + 0x2dd]
mov byte [esp + 0xdd8], 5
test al, al
lea ecx, [esp + 0x130]
jne 0x50ea9b
call fcn.005a9bc0
lea ecx, [esp + 0x28]
mov byte [esp + 0xdd8], 4
call fcn.00602ad6
lea ecx, [esp + 0x1c]
mov byte [esp + 0xdd8], 3
call fcn.00602ad6
lea ecx, [esp + 0x20]
mov byte [esp + 0xdd8], 2
call fcn.00602ad6
lea ecx, [esp + 0x18]
mov byte [esp + 0xdd8], 1
call fcn.00602ad6
lea ecx, [esp + 0x24]
mov dword [esp + 0xdd8], 0xffffffff
call fcn.00602ad6
mov eax, 8
jmp 0x50f028
push ebp
call fcn.005fb24a
push eax
call fcn.005e8dc5
mov esi, eax
lea edi, [esi + 1]
push edi
call fcn.005feedc
mov edx, eax
mov ecx, edi
mov dword [esp + 0x20], edx
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push ebp
and ecx, 3
push esi
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x28]
push 1
push eax
call fcn.005e8cae
push ebp
mov dword [esp + 0x30], eax
call fcn.005e7858
mov ecx, dword [esp + 0x1a0]
push ecx
call fcn.005e7e7e
add esp, 0x24
lea ecx, [esp + 0x130]
call fcn.005b3780
mov edx, dword [esp + 0x14]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x30]
mov byte [edx + esi], 0
mov edx, 0x100
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x10]
cmp eax, edx
jae 0x50ec30
mov edx, eax
mov eax, dword [esp + 0x14]
mov ecx, edx
mov ebp, ecx
mov esi, eax
lea edi, [esp + 0x30]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0xde0]
mov ecx, edx
mov esi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [0x6d2704]
or ecx, 0xffffffff
mov edi, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push esi
lea ecx, [esp + 0x38]
push edx
push ecx
lea ecx, [ebx + 0x508]
call fcn.0044b990
lea ebp, [ebx + 0x43e]
lea esi, [esp + 0x30]
mov edi, ebp
mov dl, byte [esi]
mov cl, byte [edi]
mov al, dl
cmp dl, cl
jne 0x50ecbc
test al, al
je 0x50ecb8
mov cl, byte [esi + 1]
mov dl, byte [edi + 1]
mov al, cl
cmp cl, dl
jne 0x50ecbc
add esi, 2
add edi, 2
test al, al
jne 0x50ec94
xor eax, eax
jmp 0x50ecc1
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x50edb9
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebp, dword [sym.imp.USER32.dll_PostMessageA]
mov dword [esp + 0x10], eax
mov al, byte [esp + ecx + 0x32]
lea esi, [esp + ecx + 0x32]
test al, al
je 0x50ed78
lea edi, [ebx + 0x50c]
push edi
push 0x6a6920
push esi
call fcn.005e68f0
mov eax, dword [edi]
add esp, 0xc
test eax, eax
jle 0x50ed4e
mov dword [0x6d1744], eax
mov eax, dword [0x6d1444]
test eax, eax
je 0x50ed28
mov edx, dword [edi]
push edx
push 0x14a7
push 0x111
push eax
call ebp
jmp 0x50ed4e
mov eax, dword [0x6d12f4]
test eax, eax
je 0x50ed4e
mov ecx, dword [edi]
lea edx, [esp + 0x2c]
push 4
push edx
push 4
push 0
push str.nExpDt
push eax
mov dword [esp + 0x44], ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
inc ecx
add esi, ecx
cmp byte [esi], 0
je 0x50ed8d
add ebx, 0x510
push ebx
push 0x6a6920
push esi
call fcn.005e68f0
add esp, 0xc
jmp 0x50ed8d
mov eax, dword [0x6d12f4]
test eax, eax
je 0x50ed8d
push str.nExpDt
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, dword [0x6d1444]
test eax, eax
je 0x50edaa
push 1
push 0x149d
push 0x111
push eax
call ebp
jmp 0x50efab
mov dword [0x6d1414], 2
jmp 0x50efab
mov esi, dword [0x6d1af0]
lea eax, [esp + 0x30]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x50edeb
test cl, cl
je 0x50ede7
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x50edeb
add eax, 2
add esi, 2
test cl, cl
jne 0x50edc3
xor eax, eax
jmp 0x50edf0
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x50ee01
mov dword [esp + 0x10], 1
jmp 0x50efab
mov esi, dword [0x6d1aec]
lea eax, [esp + 0x30]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x50ee33
test cl, cl
je 0x50ee2f
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x50ee33
add eax, 2
add esi, 2
test cl, cl
jne 0x50ee0b
xor eax, eax
jmp 0x50ee38
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x50ee49
mov dword [esp + 0x10], 2
jmp 0x50efab
mov esi, dword [0x6d1ae4]
lea eax, [esp + 0x30]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x50ee7b
test cl, cl
je 0x50ee77
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x50ee7b
add eax, 2
add esi, 2
test cl, cl
jne 0x50ee53
xor eax, eax
jmp 0x50ee80
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x50ee91
mov dword [esp + 0x10], 7
jmp 0x50efab
mov esi, dword [0x6d1acc]
lea eax, [esp + 0x30]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x50eec3
test cl, cl
je 0x50eebf
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x50eec3
add eax, 2
add esi, 2
test cl, cl
jne 0x50ee9b
xor eax, eax
jmp 0x50eec8
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x50eed9
mov dword [esp + 0x10], 0xa
jmp 0x50efab
mov esi, dword [0x6d1ac8]
lea eax, [esp + 0x30]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x50ef0b
test cl, cl
je 0x50ef07
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x50ef0b
add eax, 2
add esi, 2
test cl, cl
jne 0x50eee3
xor eax, eax
jmp 0x50ef10
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x50ef21
mov dword [esp + 0x10], 0xb
jmp 0x50efab
mov esi, dword [0x6d1ac4]
lea eax, [esp + 0x30]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x50ef53
test cl, cl
je 0x50ef4f
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x50ef53
add eax, 2
add esi, 2
test cl, cl
jne 0x50ef2b
xor eax, eax
jmp 0x50ef58
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x50ef66
mov dword [esp + 0x10], 0xc
jmp 0x50efab
mov esi, dword [0x6d1ae8]
lea eax, [esp + 0x30]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x50ef98
test cl, cl
je 0x50ef94
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x50ef98
add eax, 2
add esi, 2
test cl, cl
jne 0x50ef70
xor eax, eax
jmp 0x50ef9d
sbb eax, eax
sbb eax, 0xffffffff
xor ecx, ecx
test eax, eax
setne cl
add ecx, 3
mov dword [esp + 0x10], ecx
mov edx, dword [esp + 0x14]
push edx
call fcn.005fef05
add esp, 4
lea ecx, [esp + 0x130]
mov byte [esp + 0xdd8], 5
call fcn.005a9bc0
lea ecx, [esp + 0x28]
mov byte [esp + 0xdd8], 4
call fcn.00602ad6
lea ecx, [esp + 0x1c]
mov byte [esp + 0xdd8], 3
call fcn.00602ad6
lea ecx, [esp + 0x20]
mov byte [esp + 0xdd8], 2
call fcn.00602ad6
lea ecx, [esp + 0x18]
mov byte [esp + 0xdd8], 1
call fcn.00602ad6
lea ecx, [esp + 0x24]
mov dword [esp + 0xdd8], 0xffffffff
call fcn.00602ad6
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xdd0]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xdcc
ret 0xc