Function at 0x4f44f0
Capabilities:
Check if file exists
Create process on windows
Get file attributes
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x74
push 0xffffffffffffffff
push 0x655278
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x758898]
xor eax, ebp
mov dword [ebp + 0x70], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor ebx, ebx
cmp dword [0x75dbc0], ebx
jne 0x4f47ec
mov dword [ebp - 4], ebx
mov esi, 1
mov dword [ebp + 8], esi
mov dword [ebp - 0x1c], 4
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x18]
push ecx
push ebx
push ebx
push str.RunIEMonitor2
mov edx, dword [0x75dbe4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4f456e
mov esi, dword [ebp - 0x18]
mov dword [ebp + 8], esi
jmp 0x4f45f2
cmp dword [ebp + 0x7c], ebx
jne 0x4f45fa
cmp dword [0x75dbb8], ebx
je 0x4f45fa
mov dword [ebp + 4], esi
mov ecx, 0x75de90
call fcn.00417b20
cmp eax, 2
je 0x4f45be
cmp eax, 0xc
je 0x4f45be
cmp eax, 0x12
je 0x4f45be
cmp eax, 0x13
je 0x4f45be
cmp eax, 0x14
je 0x4f45be
cmp eax, 0x15
je 0x4f45be
cmp eax, 0xf
je 0x4f45be
cmp eax, 0x11
je 0x4f45be
cmp eax, 0x10
je 0x4f45be
cmp eax, 3
jne 0x4f45d7
push 0x67bacc
call fcn.00410ae0
add esp, 4
test eax, eax
jne 0x4f45d7
mov dword [ebp + 4], ebx
xor esi, esi
mov dword [ebp + 8], esi
push 4
lea eax, [ebp + 4]
push eax
push 4
push ebx
push str.RunIEMonitor2
mov ecx, dword [0x75dbe4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp esi, ebx
je 0x4f47e5
mov dword [ebp + 0x18], ebx
mov dword [ebp + 0x20], ebx
xor edx, edx
mov word [ebp + 0x1c], dx
mov byte [ebp - 4], 1
mov eax, dword [0x75dc58]
cmp eax, ebx
jne 0x4f4618
mov eax, 0x75dc5c
push ebx
push str.IEMonitor.exe
push eax
push 0x678de0
lea ecx, [ebp + 0x18]
call fcn.00402320
mov eax, dword [ebp + 0x18]
cmp eax, ebx
jne 0x4f4636
lea eax, [ebp + 0x1c]
push eax
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call esi
cmp eax, 0xffffffff
je 0x4f47d9
mov dword [ebp], ebx
mov dword [ebp + 0x24], ebx
mov dword [ebp + 0x2c], ebx
xor eax, eax
mov word [ebp + 0x28], ax
mov byte [ebp - 4], 2
mov eax, dword [0x75dc58]
cmp eax, ebx
jne 0x4f4669
mov eax, 0x75dc5c
push ebx
push eax
push str._sidmmkb.dll
lea ecx, [ebp + 0x24]
call fcn.004021b0
mov eax, dword [ebp + 0x24]
cmp eax, ebx
jne 0x4f4682
lea eax, [ebp + 0x28]
push eax
call esi
cmp eax, 0xffffffff
je 0x4f480d
mov eax, dword [ebp + 0x24]
cmp eax, ebx
jne 0x4f4698
lea eax, [ebp + 0x28]
push 0x40
lea ecx, [ebp + 0x30]
push ecx
push eax
call fcn.004110e0
add esp, 0xc
test eax, eax
je 0x4f480d
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x14], ebx
push 0x6a03a8
lea edx, [ebp + 0x30]
push edx
call fcn.006228d0
add esp, 8
mov esi, eax
cmp esi, ebx
je 0x4f480d
mov byte [esi], 0
lea eax, [ebp + 0x30]
push eax
call fcn.006219a1
mov edi, eax
mov dword [ebp - 0x20], edi
inc esi
push 0x6a03a8
push esi
call fcn.006228d0
add esp, 0xc
test eax, eax
je 0x4f4705
mov byte [eax], 0
push esi
call fcn.006219a1
add esp, 4
mov ebx, eax
mov dword [ebp - 0x14], ebx
cmp edi, 6
jg 0x4f4719
jne 0x4f480b
cmp ebx, 0x24
jle 0x4f480b
mov eax, dword [ebp + 0x24]
test eax, eax
jne 0x4f4723
lea eax, [ebp + 0x28]
push eax
call fcn.004f42f0
add esp, 4
test eax, eax
je 0x4f480b
mov dword [ebp], 1
push 0x44
xor esi, esi
push esi
lea ecx, [ebp - 0x74]
push ecx
call fcn.00620850
add esp, 0xc
mov dword [ebp - 0x74], 0x44
mov dword [ebp - 0x48], 0x81
xor edx, edx
mov word [ebp - 0x44], dx
mov dword [ebp + 0xc], esi
mov dword [ebp + 0x14], esi
xor eax, eax
mov word [ebp + 0x10], ax
mov byte [ebp - 4], 3
mov eax, dword [ebp + 0x18]
cmp eax, esi
jne 0x4f477a
lea eax, [ebp + 0x1c]
push esi
push eax
push str.__s_
lea ecx, [ebp + 0xc]
call fcn.004021b0
mov eax, dword [ebp + 0xc]
cmp eax, esi
jne 0x4f4793
lea eax, [ebp + 0x10]
lea ecx, [ebp - 0x30]
push ecx
lea edx, [ebp - 0x74]
push edx
push esi
push esi
push 0x30
push 1
push esi
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, esi
je 0x4f47c1
mov eax, dword [ebp - 0x2c]
push eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov ecx, dword [ebp - 0x30]
push ecx
call esi
mov byte [ebp - 4], 2
lea ecx, [ebp + 0xc]
call fcn.00401210
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x24]
call fcn.00401210
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x18]
call fcn.00401210
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x70]
xor ecx, ebp
call fcn.0062016f
add ebp, 0x74
mov esp, ebp
pop ebp
ret
xor ebx, ebx
cmp dword [ebp + 0x7c], ebx
je 0x4f4830
push 0x50000
push 0x678d88
push str.Its_impossible_to_start_monitoring_process_for_IE_based_browsers_because_several_IDM_components_are_damaged_or_incompatible._r_n_r_nPlease_redownload_the_latest_IDM_installation_file_and_reinstall_IDM._Please_reboot_your_computer_after_IDM_installation_if_required.
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call fcn.004734a0
add esp, 0x10
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x24]
call fcn.00401210
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x18]
call fcn.00401210
jmp 0x4f47ec