Function at 0x40d30d
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry value

Disassembly:
mov eax, 0x410c08
call fcn.00410480
sub esp, 0xa40
push ebx
push esi
push edi
lea eax, [ebp - 0x844]
mov dword [ebp - 0x10], esp
xor edi, edi
push str.Download_with_IDM
push eax
mov dword [ebp - 4], edi
call sub.MSVCRT.dll_wcscpy
lea eax, [ebp - 0xa4c]
push str.Download_All_Links_with_IDM
push eax
call sub.MSVCRT.dll_wcscpy
lea eax, [ebp - 0x434]
push str.Download_FLV_video_content_with_IDM
push eax
call sub.MSVCRT.dll_wcscpy
lea eax, [ebp - 0x63c]
push str.Download_FLV_videos_with_IDM_from_10_last_requested
push eax
call sub.MSVCRT.dll_wcscpy
add esp, 0x20
lea eax, [ebp - 0x24]
mov esi, 0xf003f
mov ebx, 0x80000001
push eax
lea eax, [ebp - 0x1c]
push eax
push edi
push esi
push edi
push 0x41b124
push edi
push str.SoftwareDownloadManagermenuExt
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40d3ff
lea eax, [ebp - 0x844]
push eax
push str.iedownl1_str
push dword [ebp - 0x1c]
call fcn.0040d665
add esp, 0xc
lea eax, [ebp - 0xa4c]
push eax
push str.iedownlAll_str
push dword [ebp - 0x1c]
call fcn.0040d665
add esp, 0xc
lea eax, [ebp - 0x434]
push eax
push str.iedownlFLV_str
push dword [ebp - 0x1c]
call fcn.0040d665
add esp, 0xc
lea eax, [ebp - 0x63c]
push eax
push str.iedownl10FLV_str
push dword [ebp - 0x1c]
call fcn.0040d665
add esp, 0xc
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x14]
push eax
push esi
push edi
push str.SoftwareMicrosoftInternet_ExplorerMenuExt_
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40d4b1
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push str.Download_with_IDMan
push dword [ebp - 0x14]
call ebx
push str.IEExt.htm
lea eax, [ebp - 0x844]
push str.Download_with_IDM
push eax
push dword [ebp - 0x14]
call fcn.0040d171
add esp, 0x10
lea eax, [ebp - 0xa4c]
push str.IEGetAll.htm
push str.Download_All_Links_with_IDM
push eax
push dword [ebp - 0x14]
call fcn.0040d171
add esp, 0x10
lea eax, [ebp - 0x434]
push str.IEGetVL.htm
push str.Download_FLV_video_content_with_IDM
push eax
push dword [ebp - 0x14]
call fcn.0040d171
add esp, 0x10
lea eax, [ebp - 0x63c]
push str.IEGetVL2.htm
push str.Download_FLV_videos_with_IDM_from_10_last_requested
push eax
push dword [ebp - 0x14]
call fcn.0040d171
add esp, 0x10
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40d4b7
xor eax, eax
jmp 0x40d656
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea eax, [ebp - 0x14]
push eax
push esi
push edi
push str.SoftwareClassesPROTOCOLSName_Space_Handler_
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40d4aa
lea eax, [ebp - 0x18]
push edi
push eax
push edi
push esi
push edi
push edi
push edi
push str.http_
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40d50a
push 0x419524
push dword [ebp - 0x18]
call ebx
push 0x41951c
push dword [ebp - 0x18]
call ebx
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x18]
push edi
push eax
push edi
push esi
push edi
push edi
push edi
push str.ftp_
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40d543
push 0x419524
push dword [ebp - 0x18]
call ebx
push 0x41951c
push dword [ebp - 0x18]
call ebx
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x18]
push edi
push eax
push edi
push esi
push edi
push edi
push edi
push str.https_
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40d572
push 0x419524
push dword [ebp - 0x18]
call ebx
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x14]
push eax
push esi
push edi
push str.SoftwareMicrosoftInternet_Explorer
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40d5e8
lea eax, [ebp - 0x20]
mov ebx, str.DownloadUI
push eax
lea eax, [ebp - 0x22c]
push eax
push edi
push edi
push ebx
push dword [ebp - 0x14]
mov dword [ebp - 0x20], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40d5dd
lea eax, [ebp - 0x22c]
push str.7D11E719_FF90_479C_B0D7_96EB43EE55D7
push eax
call sub.MSVCRT.dll_wcscmp
pop ecx
test eax, eax
pop ecx
jne 0x40d5dd
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40d5ed
mov ebx, str.DownloadUI
lea eax, [ebp - 0x14]
push eax
push esi
push edi
push str.SoftwareMicrosoftInternet_Explorer
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40d653
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x208
push eax
lea eax, [ebp - 0x22c]
push eax
push edi
push edi
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40d64a
lea eax, [ebp - 0x22c]
push str.7D11E719_FF90_479C_B0D7_96EB43EE55D7
push eax
call sub.MSVCRT.dll_wcscmp
pop ecx
test eax, eax
pop ecx
jne 0x40d64a
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
pop eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret