Function at 0x54aea0
Capabilities:
Get file size
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x62b03b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xb4
push ebx
mov ebx, ecx
push esi
push edi
mov eax, dword [ebx + 0xdc]
mov dword [ebp - 0x10], esp
test eax, eax
mov dword [ebp - 0x7c], ebx
je 0x54b360
mov eax, dword [0x6cd768]
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], eax
mov ecx, dword [ebx + 0x94]
lea edx, [ebp - 0x14]
inc ecx
mov byte [ebp - 4], 1
push ecx
push str.insert_from_reg__ID___d_n
push edx
call fcn.005fc86b
mov eax, dword [ebp - 0x14]
add esp, 0xc
mov ecx, ebx
push eax
call fcn.005427e0
mov ecx, dword [ebx + 0x94]
lea edx, [ebp - 0x44]
inc ecx
mov dword [ebp - 0x48], 0x10
push ecx
push 0x6a10e4
push edx
call fcn.005e7bd3
add esp, 0xc
lea eax, [ebp - 0x48]
lea ecx, [ebp - 0x3c]
lea edx, [ebp - 0x44]
push eax
mov eax, dword [ebx + 0xdc]
push ecx
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x54b354
mov ecx, dword [ebp - 0x38]
push 0x70
mov dword [ebp - 0x58], ecx
call fcn.005ffe3f
mov ecx, eax
add esp, 4
mov dword [ebp - 0x28], ecx
test ecx, ecx
mov byte [ebp - 4], 2
je 0x54af79
call fcn.0054c9c0
mov edi, eax
jmp 0x54af7b
xor edi, edi
test edi, edi
mov dword [ebp - 0x2c], edi
mov byte [ebp - 4], 1
je 0x54b354
mov edx, dword [ebx + 0xd4]
mov dword [edi + 0x64], edx
mov eax, dword [ebx + 0xdc]
mov dword [edi + 0x68], eax
mov ecx, dword [ebx + 0x88]
mov edx, dword [ecx + 0x10]
push edx
call fcn.005e71bf
lea eax, [eax + eax + 0x14]
push eax
call fcn.005ffe3f
mov esi, eax
add esp, 8
test esi, esi
mov dword [ebp - 0x18], esi
jne 0x54afd6
mov ecx, edi
call fcn.0054ca10
push edi
call fcn.005ffe68
add esp, 4
jmp 0x54b354
mov edx, dword [ebx + 0x94]
mov ecx, dword [ebx + 0x98]
inc edx
mov eax, edx
mov dword [ebx + 0x94], edx
cmp ecx, eax
jge 0x54aff5
mov dword [ebx + 0x98], eax
mov dword [edi + 0x60], eax
mov edx, dword [ebx + 0x88]
mov ecx, dword [ebx + 0x94]
mov eax, dword [edx + 0x10]
push ecx
push eax
push str._s_d
push esi
call fcn.005e8107
add esp, 0x10
mov ecx, edi
push esi
call fcn.0054caa0
test eax, eax
je 0x54b041
mov ecx, edi
call fcn.0054ca10
push edi
call fcn.005ffe68
add esp, 4
push esi
call fcn.005ffe68
add esp, 4
jmp 0x54b354
push 0
push 0
push 3
push 0
push 1
push bind
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x1c], eax
je 0x54b108
lea ecx, [ebp - 0x80]
mov edx, eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
mov dword [ebp - 0x20], 0
cmp esi, 0xffffffff
jne 0x54b0b6
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x54b0b6
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x54b0b6
push eax
lea eax, [ebp - 0x14]
push str.Error_during_GetFileSize____errcode___ld._n
push eax
call fcn.005fc86b
mov ecx, dword [ebp - 0x14]
add esp, 0xc
push ecx
mov ecx, ebx
call fcn.005427e0
xor esi, esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
jmp 0x54b0d2
mov edx, dword [ebp - 0x80]
push 1
push 0
push 0
push edx
call fcn.005e9a70
add esi, eax
mov eax, dword [ebp - 0x20]
adc eax, edx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or esi, dword [ebp - 0x20]
je 0x54b134
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0xb0]
mov eax, dword [eax + 0x24]
cmp eax, 1
je 0x54b0fb
cmp eax, 2
je 0x54b0fb
test eax, eax
jne 0x54b16d
mov ecx, dword [ebp - 0x18]
push ecx
mov ecx, esi
call fcn.0054ee90
jmp 0x54b143
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
lea ecx, [ebp - 0x14]
push str.Error_opening_file__ls_to_get_size__errcode___ld._n
push ecx
call fcn.005fc86b
mov edx, dword [ebp - 0x14]
add esp, 0x10
mov ecx, ebx
push edx
call fcn.005427e0
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 0x18]
push eax
lea ecx, [esi + 0x10]
call fcn.00555c00
test eax, eax
je 0x54b17b
mov esi, dword [ebp - 0x18]
push eax
push esi
lea ecx, [ebp - 0x14]
push str.Error_opening_file__ls__errcode___ld._n
push ecx
call fcn.005fc86b
mov edx, dword [ebp - 0x14]
add esp, 0x10
mov ecx, ebx
push edx
call fcn.005427e0
jmp 0x54b023
mov edx, dword [ebp - 0x18]
lea ecx, [esi + 0x10]
push edx
call fcn.00555dd0
jmp 0x54b143
mov dword [edi], esi
mov eax, dword [esi + 0xb0]
mov eax, dword [eax + 0x24]
cmp eax, 4
je 0x54b1a8
cmp eax, 5
je 0x54b1a8
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
add ecx, edx
mov edx, dword [ebp - 0x30]
mov dword [esi + 0x50], ecx
adc edx, eax
mov dword [esi + 0x54], edx
jmp 0x54b1c5
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x24]
mov dword [edi + 0x1c], eax
mov eax, dword [ebp - 0x30]
mov ecx, eax
mov dword [edi + 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [esi + 0x50], edx
sar ecx, 0x1f
mov dword [esi + 0x54], eax
mov eax, dword [ebp - 0x38]
cmp eax, 0xffffffff
jne 0x54b28a
mov ecx, dword [ebx + 0x98]
mov dword [ebx + 0xcc], 0
mov dword [ebx + 0x94], ecx
mov edx, dword [esi + 0xb0]
mov byte [ebp + 0xb], 0
mov eax, dword [edx + 0x24]
cmp eax, 4
je 0x54b1fe
cmp eax, 5
jne 0x54b245
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x78]
push eax
push str._dkf
push ecx
call fcn.005e7bd3
add esp, 0xc
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x68]
lea ecx, [ebp - 0x78]
push edx
mov edx, dword [ebx + 0xdc]
push eax
push 0
push 0
push ecx
push edx
mov dword [ebp - 0x1c], 0x10
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x54b245
cmp dword [ebp - 0x60], 0xffffffff
jne 0x54b245
mov byte [ebp + 0xb], 1
mov eax, dword [ebx + 0x88]
mov edx, dword [esi + 0x50]
mov ecx, dword [eax]
mov eax, dword [ecx + 0x48]
cmp edx, eax
mov ecx, dword [ecx + 0x4c]
jne 0x54b261
mov edx, dword [esi + 0x54]
cmp edx, ecx
je 0x54b279
mov dl, byte [ebp + 0xb]
test dl, dl
jne 0x54b279
sub eax, 1
sbb ecx, 0
mov dword [esi + 0x60], eax
mov dword [esi + 0x64], ecx
jmp 0x54b52b
push str.The_last_chunk_is_full._n
mov ecx, ebx
call fcn.005427e0
jmp 0x54b318
push eax
lea ecx, [ebp - 0x44]
push 0x6a10e4
push ecx
call fcn.005e7bd3
add esp, 0xc
lea edx, [ebp - 0x48]
lea eax, [ebp - 0x3c]
lea ecx, [ebp - 0x44]
push edx
mov edx, dword [ebx + 0xdc]
push eax
push 0
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x54b375
push eax
lea eax, [ebp - 0x14]
push str.error_reading_registry__d_n
push eax
call fcn.005fc86b
mov ecx, dword [ebp - 0x14]
add esp, 0xc
push ecx
mov ecx, ebx
call fcn.005427e0
mov edx, dword [ebx + 0x98]
mov eax, dword [ebx + 0x88]
mov dword [ebx + 0xcc], 0
mov dword [ebx + 0x94], edx
mov ecx, dword [eax]
mov edx, dword [esi + 0x50]
mov eax, dword [ecx + 0x48]
cmp edx, eax
mov ecx, dword [ecx + 0x4c]
jne 0x54b268
mov edx, dword [esi + 0x54]
cmp edx, ecx
jne 0x54b268
mov eax, dword [ebp - 0x18]
push eax
call fcn.005ffe68
mov ecx, dword [ebx + 0x8c]
add esp, 4
mov edx, dword [ecx + 0x58]
lea ecx, [esi + 0x10]
mov dword [edi + 0x58], edx
mov eax, dword [ebx + 0x8c]
mov dword [eax + 0x58], edi
mov dword [ebx + 0x8c], edi
mov dword [edi + 0x14], 1
call fcn.00555be0
mov dword [edi], 0
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0
call fcn.00603a3c
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
mov edx, ecx
sub edx, 1
mov dword [esi + 0x60], edx
mov edx, dword [ebp - 0x3c]
sbb eax, 0
dec edx
mov dword [esi + 0x64], eax
mov dword [ebx + 0x94], edx
mov eax, dword [esi + 0xb0]
mov eax, dword [eax + 0x24]
cmp eax, 4
je 0x54b3aa
cmp eax, 5
jne 0x54b52b
mov dword [edi + 0x20], ecx
mov ecx, dword [ebp - 0x3c]
mov dword [edi + 0x28], ecx
mov eax, dword [ebp - 0x3c]
lea edx, [ebp - 0xc0]
push 0xa
push edx
push eax
call fcn.005e8872
mov ecx, dword [ebx + 0x88]
mov dword [ebp - 0x1c], eax
add esp, 0xc
lea eax, [edi + 0x2c]
mov edx, dword [ecx + 0x10]
mov ecx, 0x6a112c
test ecx, ecx
mov dword [ebp + 8], edx
mov dword [ebp - 0x28], eax
je 0x54b52b
mov eax, edx
test eax, eax
je 0x54b52b
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x54b52b
xor edi, edi
push edi
push ecx
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x6c], edi
mov word [ebp - 0x70], di
call fcn.00402e00
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x64]
push edx
mov byte [ebp - 4], 3
mov dword [ebp - 0x64], edi
mov dword [ebp - 0x5c], edi
mov word [ebp - 0x60], di
call fcn.00402410
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x54]
push eax
mov byte [ebp - 4], 4
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x4c], edi
mov word [ebp - 0x50], di
call fcn.00402410
mov ecx, dword [ebp - 0x28]
mov byte [ebp - 4], 5
call fcn.00401070
mov eax, dword [ebp - 0x64]
cmp eax, edi
jne 0x54b45f
lea eax, [ebp - 0x60]
mov ecx, dword [ebp - 0x54]
cmp ecx, edi
mov edi, ecx
jne 0x54b46b
lea edi, [ebp - 0x50]
mov ecx, dword [ebp - 0x6c]
push eax
mov dword [ebp + 8], ecx
call fcn.005e71bf
mov edx, eax
push edi
mov dword [ebp - 0x28], edx
call fcn.005e71bf
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x28]
add ecx, edx
lea eax, [eax + ecx + 3]
mov dword [ebp - 0x28], eax
add eax, eax
push eax
mov dword [ebp + 8], eax
call fcn.005ffe3f
mov edi, dword [ebp - 0x2c]
mov edx, eax
add esp, 0xc
test edx, edx
mov dword [edi + 0x2c], edx
je 0x54b507
mov ecx, dword [ebp + 8]
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebp - 0x54]
test eax, eax
mov edx, eax
jne 0x54b4cc
lea edx, [ebp - 0x50]
mov ecx, dword [ebp - 0x64]
test ecx, ecx
jne 0x54b4d6
lea ecx, [ebp - 0x60]
mov eax, dword [ebp - 0x74]
test eax, eax
jne 0x54b4e0
lea eax, [ebp - 0x70]
push edx
push ecx
mov ecx, dword [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x28]
mov edx, dword [ecx + 0x2c]
lea edi, [ecx + 0x2c]
push eax
push edx
call fcn.005e714f
mov eax, dword [edi]
push eax
call fcn.005e71bf
mov dword [edi + 8], eax
mov edi, dword [ebp - 0x2c]
add esp, 0x18
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 4
call fcn.00401070
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 3
call fcn.00401070
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 1
call fcn.00401070
xor eax, eax
mov dword [esi + 0x68], eax
mov dword [esi + 0x6c], eax
mov ecx, dword [edi + 0x20]
mov eax, dword [esi + 0x94]
mov edx, dword [edi + 0x1c]
push ecx
mov ecx, dword [eax + 4]
push edx
push ecx
mov ecx, dword [esi + 0x60]
mov edx, dword [eax]
mov eax, dword [esi + 0x64]
push edx
mov edx, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x24]
push ecx
mov ecx, dword [ebp - 0x18]
push edx
mov edx, dword [edi]
push eax
push ecx
mov eax, dword [edx + 0x54]
push eax
lea eax, [ebp - 0x14]
mov ecx, dword [edx + 0x50]
mov edx, dword [edi + 0x60]
push ecx
push edx
push str.new_listitem_id_d__startpos_I64d__file__ls___ndwnl_I64d__endpos_I64d__ttdwnl_I64d_nsttm_ld__etm_ld_n
push eax
call fcn.005fc86b
mov ecx, dword [ebp - 0x14]
add esp, 0x38
push ecx
mov ecx, ebx
call fcn.005427e0
mov edx, dword [ebp - 0x18]
push edx
call fcn.005ffe68
mov eax, dword [ebx + 0x8c]
add esp, 4
mov ecx, dword [eax + 0x58]
mov eax, dword [ebp - 0x58]
mov dword [edi + 0x58], ecx
mov edx, dword [ebx + 0x8c]
cmp eax, 0xffffffff
mov dword [edx + 0x58], edi
mov dword [esi + 0x90], edi
mov dword [ebx + 0x8c], edi
je 0x54b5c4
push eax
push edi
mov ecx, ebx
call fcn.0054b7a0
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0
call fcn.00603a3c
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4