Function at 0x5257a0
Capabilities:
Delete registry value
Set registry value

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x64b9c8
push eax
mov eax, 0x4258
mov dword fs:[0], esp
call fcn.00609d40
push ebx
push ebp
push esi
push edi
mov ebx, ecx
call fcn.00526d10
mov ecx, ebx
call fcn.00526cc0
mov ecx, ebx
call fcn.005261a0
mov ecx, dword [ebx + 4]
xor edi, edi
cmp ecx, edi
mov ebp, 1
je 0x52584b
push ebp
call fcn.0043c8c0
test eax, eax
jne 0x5257f0
cmp dword [ebx + 8], edi
jne 0x5257ff
mov eax, 4
jmp 0x526182
mov eax, dword [ebx + 4]
cmp dword [eax + 0x30], edi
je 0x52584b
lea ecx, [esp + 0x10]
call fcn.004fbbd0
mov ecx, dword [ebx + 4]
mov dword [esp + 0x4270], edi
push ecx
lea ecx, [esp + 0x14]
call fcn.004fbc10
cmp eax, edi
mov dword [esp + 0x4270], 0xffffffff
lea ecx, [esp + 0x10]
je 0x525846
call fcn.004fbc00
mov eax, 4
jmp 0x526182
call fcn.004fbc00
mov eax, dword [0x6f7b78]
mov dword [esp + 0x24], eax
mov dword [esp + 0x4270], ebp
mov dword [esp + 0x28], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x1c], eax
mov esi, dword [esp + 0x4280]
mov byte [esp + 0x4270], 5
cmp esi, edi
je 0x5258a1
lea edx, [esp + 0x1c]
lea eax, [esp + 0x2c]
push edx
lea ecx, [esp + 0x24]
push eax
lea edx, [esp + 0x30]
push ecx
lea eax, [esp + 0x30]
push edx
push eax
call fcn.00533440
add esp, 0x14
jmp 0x5258ff
push str.www.internetdownloadmanager.com
lea ecx, [esp + 0x28]
call fcn.00622f13
push 0x6e59ec
lea ecx, [esp + 0x2c]
call fcn.00622f13
push 0x6e59e8
push 0x6e59e4
push 0x6e59e0
push str.register
lea ecx, [esp + 0x30]
push str._s._s_s_s
push ecx
call fcn.0061fae1
add esp, 0x18
lea ecx, [esp + 0x2c]
push str.tcidm
call fcn.00622f13
push str.azcfgped
lea ecx, [esp + 0x20]
call fcn.00622f13
lea ecx, [esp + 0x140]
call fcn.005c6b60
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
push 0xffffffffffffffff
push edx
xor edx, edx
cmp esi, edi
push eax
setne dl
inc edx
push ecx
push edx
lea ecx, [esp + 0x154]
mov byte [esp + 0x4284], 6
call fcn.005cf6d0
lea ecx, [esp + 0xe18]
call fcn.0057f400
lea eax, [esp + 0x30]
lea esi, [ebx + 0xc]
push eax
push 0x400
push esi
lea ecx, [esp + 0xe24]
mov byte [esp + 0x427c], 7
mov dword [esp + 0x40], edi
mov dword [esp + 0x3c], edi
call fcn.00592860
test eax, eax
je 0x5259a1
mov eax, dword [esp + 0x30]
cmp eax, edi
je 0x5259a1
cmp dword [esp + 0x34], edi
je 0x5259a1
push eax
lea ecx, [esp + 0x2d8]
push str.IDM_DataType_a1:_s
push ecx
mov byte [esp + 0x2dc], 1
call fcn.0061fae1
add esp, 0xc
jmp 0x5259b3
push 0x400
push esi
lea ecx, [esp + 0x168]
call fcn.005e6b30
mov eax, dword [esp + 0x30]
cmp eax, edi
je 0x5259c4
push eax
call fcn.00609aba
add esp, 4
push 0x6cc3d8
lea ecx, [esp + 0x234]
call fcn.00622f13
cmp dword [ebx + 0x514], edi
je 0x525a1a
lea edx, [esp + 0x140]
mov dword [esp + 0x144], edi
push edx
mov byte [esp + 0xb81], 0
call fcn.004b0640
mov eax, dword [esp + 0xa48]
add esp, 4
cmp eax, edi
jne 0x525a12
mov al, byte [esp + 0xba0]
test al, al
je 0x525a28
mov dword [ebx + 0x518], ebp
jmp 0x525a28
mov byte [esp + 0xb7d], 1
mov dword [ebx + 0x518], edi
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x2c]
push eax
push ecx
lea ecx, [esp + 0x148]
call fcn.005cf8f0
mov eax, dword [ebx + 8]
cmp eax, edi
je 0x525a56
mov ecx, dword [ebx + 0x51c]
mov dword [esp + 0x144], ebp
cmp ecx, edi
je 0x525a61
mov dword [esp + 0x144], 4
cmp eax, edi
je 0x525a79
cmp dword [ebx + 0x51c], edi
jne 0x525a79
mov edx, dword [ebx + 4]
mov dword [esp + 0x140], edx
jmp 0x525a80
mov dword [esp + 0x140], edi
mov eax, dword [ebx + 0x51c]
mov byte [esp + 0xbb8], 1
cmp eax, edi
mov byte [esp + 0x2b7], 0
mov byte [esp + 0x475], 1
mov byte [esp + 0x476], 1
je 0x525ab2
mov byte [esp + 0x2ee], 1
push ebp
lea ecx, [esp + 0x144]
call fcn.005cfb70
mov eax, dword [esp + 0xa3c]
cmp eax, 3
je 0x525aec
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
cmp eax, edi
je 0x525bb1
push 0xc8
call esi
mov eax, dword [esp + 0xa3c]
cmp eax, 3
jne 0x525ad1
mov eax, dword [esp + 0x190]
push 0x6cf428
push eax
call fcn.0060b21f
mov ebp, eax
add esp, 8
cmp ebp, edi
jne 0x525c6a
mov ecx, dword [esp + 0x190]
push ecx
call fcn.0060b6fb
add esp, 4
lea ecx, [esp + 0x140]
call fcn.005d21a0
mov byte [esp + 0x4270], 6
lea ecx, [esp + 0xe18]
call fcn.005ed570
lea ecx, [esp + 0x140]
mov byte [esp + 0x4270], 5
call fcn.005c6d50
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4270], 4
call fcn.00622d8a
lea ecx, [esp + 0x2c]
mov byte [esp + 0x4270], 3
call fcn.00622d8a
lea ecx, [esp + 0x20]
mov byte [esp + 0x4270], 2
call fcn.00622d8a
lea ecx, [esp + 0x28]
mov byte [esp + 0x4270], 1
call fcn.00622d8a
lea ecx, [esp + 0x24]
mov dword [esp + 0x4270], 0xffffffff
call fcn.00622d8a
mov eax, 4
jmp 0x526182
mov eax, dword [esp + 0x190]
cmp eax, edi
je 0x525bc5
push eax
call fcn.0060b6fb
add esp, 4
lea ecx, [esp + 0x140]
call fcn.005d21a0
mov al, byte [esp + 0x2ee]
mov byte [esp + 0x4270], 6
test al, al
lea ecx, [esp + 0xe18]
jne 0x525b36
call fcn.005ed570
lea ecx, [esp + 0x140]
mov byte [esp + 0x4270], 5
call fcn.005c6d50
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4270], 4
call fcn.00622d8a
lea ecx, [esp + 0x2c]
mov byte [esp + 0x4270], 3
call fcn.00622d8a
lea ecx, [esp + 0x20]
mov byte [esp + 0x4270], 2
call fcn.00622d8a
lea ecx, [esp + 0x28]
mov byte [esp + 0x4270], 1
call fcn.00622d8a
lea ecx, [esp + 0x24]
mov dword [esp + 0x4270], 0xffffffff
call fcn.00622d8a
mov eax, 8
jmp 0x526182
push ebp
call fcn.0061f3ea
push eax
call fcn.0060c78e
mov esi, eax
lea edi, [esi + 1]
push edi
call fcn.00622acb
mov edx, eax
mov ecx, edi
mov dword [esp + 0x1c], edx
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push ebp
and ecx, 3
push esi
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x24]
push 1
push eax
call fcn.0060c2bc
push ebp
mov dword [esp + 0x34], eax
call fcn.0060b038
mov ecx, dword [esp + 0x1b0]
push ecx
call fcn.0060b6fb
add esp, 0x24
lea ecx, [esp + 0x140]
call fcn.005d21a0
mov edx, dword [esp + 0x10]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x40]
mov byte [edx + esi], 0
mov edx, 0x100
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x14]
cmp eax, edx
jae 0x525cf3
mov edx, eax
mov eax, dword [esp + 0x10]
mov ecx, edx
mov ebp, ecx
mov esi, eax
lea edi, [esp + 0x40]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x4278]
mov ecx, edx
mov esi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [0x6fdfd4]
or ecx, 0xffffffff
mov edi, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push esi
lea ecx, [esp + 0x48]
push edx
push ecx
lea ecx, [ebx + 0x508]
call fcn.00451930
lea ebp, [ebx + 0x43e]
lea esi, [esp + 0x40]
mov edi, ebp
mov dl, byte [esi]
mov cl, byte [edi]
mov al, dl
cmp dl, cl
jne 0x525d7f
test al, al
je 0x525d7b
mov cl, byte [esi + 1]
mov dl, byte [edi + 1]
mov al, cl
cmp cl, dl
jne 0x525d7f
add esi, 2
add edi, 2
test al, al
jne 0x525d57
xor eax, eax
jmp 0x525d84
sbb eax, eax
sbb eax, 0xffffffff
xor eax, eax
jne 0x525eff
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x18], eax
mov al, byte [esp + ecx + 0x42]
lea esi, [esp + ecx + 0x42]
test al, al
je 0x525eba
lea edi, [ebx + 0x50c]
push edi
push 0x6d011c
push esi
call fcn.0060a0d0
mov eax, dword [edi]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
add esp, 0xc
test eax, eax
jle 0x525e11
mov dword [0x6fcfb0], eax
mov eax, dword [0x6fcc58]
test eax, eax
je 0x525def
mov edx, dword [edi]
push edx
push 0x14a7
push 0x111
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x525e11
mov eax, dword [0x6fcafc]
test eax, eax
je 0x525e11
mov ecx, dword [edi]
lea edx, [esp + 0x14]
push 4
push edx
push 4
push 0
push str.nExpDt
push eax
mov dword [esp + 0x2c], ecx
call ebp
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
inc ecx
add esi, ecx
cmp byte [esi], 0
je 0x525ecf
add ebx, 0x510
push ebx
push 0x6d011c
push esi
call fcn.0060a0d0
mov eax, dword [ebx]
add esp, 0xc
test eax, eax
jne 0x525e49
mov dword [ebx], 0xffffffff
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
inc ecx
add esi, ecx
cmp byte [esi], 0
je 0x525ecf
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0
push eax
push 0x6d011c
push esi
call fcn.0060a0d0
add esp, 0xc
cmp eax, 1
jne 0x525ecf
mov eax, dword [esp + 0x14]
test eax, eax
je 0x525ecf
lea ecx, [esp + 0x38]
push ecx
call fcn.0060b449
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x3c]
add esp, 4
lea ecx, [esp + 0x3c]
add eax, edx
mov edx, dword [0x6fcafc]
push 4
push ecx
push 4
push 0
push str.ptrk_scdt
push edx
mov dword [esp + 0x54], eax
call ebp
jmp 0x525ecf
mov eax, dword [0x6fcafc]
test eax, eax
je 0x525ecf
push str.nExpDt
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, dword [0x6fcc58]
test eax, eax
je 0x525ef0
push 1
push 0x14bb
push 0x111
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x5260f1
mov dword [0x6fcc28], 2
jmp 0x5260f1
mov esi, dword [0x6fd3c0]
lea eax, [esp + 0x40]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x525f31
test cl, cl
je 0x525f2d
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x525f31
add eax, 2
add esi, 2
test cl, cl
jne 0x525f09
xor eax, eax
jmp 0x525f36
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x525f47
mov dword [esp + 0x18], 1
jmp 0x5260f1
mov esi, dword [0x6fd3bc]
lea eax, [esp + 0x40]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x525f79
test cl, cl
je 0x525f75
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x525f79
add eax, 2
add esi, 2
test cl, cl
jne 0x525f51
xor eax, eax
jmp 0x525f7e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x525f8f
mov dword [esp + 0x18], 2
jmp 0x5260f1
mov esi, dword [0x6fd3b4]
lea eax, [esp + 0x40]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x525fc1
test cl, cl
je 0x525fbd
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x525fc1
add eax, 2
add esi, 2
test cl, cl
jne 0x525f99
xor eax, eax
jmp 0x525fc6
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x525fd7
mov dword [esp + 0x18], 7
jmp 0x5260f1
mov esi, dword [0x6fd39c]
lea eax, [esp + 0x40]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x526009
test cl, cl
je 0x526005
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x526009
add eax, 2
add esi, 2
test cl, cl
jne 0x525fe1
xor eax, eax
jmp 0x52600e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x52601f
mov dword [esp + 0x18], 0xa
jmp 0x5260f1
mov esi, dword [0x6fd398]
lea eax, [esp + 0x40]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x526051
test cl, cl
je 0x52604d
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x526051
add eax, 2
add esi, 2
test cl, cl
jne 0x526029
xor eax, eax
jmp 0x526056
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x526067
mov dword [esp + 0x18], 0xb
jmp 0x5260f1
mov esi, dword [0x6fd394]
lea eax, [esp + 0x40]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x526099
test cl, cl
je 0x526095
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x526099
add eax, 2
add esi, 2
test cl, cl
jne 0x526071
xor eax, eax
jmp 0x52609e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x5260ac
mov dword [esp + 0x18], 0xc
jmp 0x5260f1
mov esi, dword [0x6fd3b8]
lea eax, [esp + 0x40]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x5260de
test cl, cl
je 0x5260da
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x5260de
add eax, 2
add esi, 2
test cl, cl
jne 0x5260b6
xor eax, eax
jmp 0x5260e3
sbb eax, eax
sbb eax, 0xffffffff
xor ecx, ecx
test eax, eax
setne cl
add ecx, 3
mov dword [esp + 0x18], ecx
mov edx, dword [esp + 0x10]
push edx
call fcn.00622af4
add esp, 4
lea ecx, [esp + 0xe18]
mov byte [esp + 0x4270], 6
call fcn.005ed570
lea ecx, [esp + 0x140]
mov byte [esp + 0x4270], 5
call fcn.005c6d50
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4270], 4
call fcn.00622d8a
lea ecx, [esp + 0x2c]
mov byte [esp + 0x4270], 3
call fcn.00622d8a
lea ecx, [esp + 0x20]
mov byte [esp + 0x4270], 2
call fcn.00622d8a
lea ecx, [esp + 0x28]
mov byte [esp + 0x4270], 1
call fcn.00622d8a
lea ecx, [esp + 0x24]
mov dword [esp + 0x4270], 0xffffffff
call fcn.00622d8a
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x4268]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x4264
ret 0xc