Function at 0x4804f0
Capabilities:
Get file size
Query or enumerate registry key
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5fd969
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xbc
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x38], esi
call fcn.00480260
mov eax, dword [0x6cc564]
mov dword [esp + 0x24], eax
mov ecx, dword [esi + 0x24c]
xor ebx, ebx
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x60], ebx
mov edx, dword [ecx + 0x468]
lea eax, [esp + 0x24]
push edx
push str.SoftwareDownloadManager_ld
push eax
mov dword [esp + 0xe0], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
call fcn.005dc6eb
add esp, 0xc
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x74]
lea edx, [esp + 0x14]
push ecx
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push edx
push ebx
push 0xf003f
push ebx
push 0x6d0ab8
push ebx
push eax
push reloc.WS2_32.dll_accept
call ebp
test eax, eax
jne 0x480d1b
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push ebx
lea edx, [esp + 0x1c]
push ebx
mov eax, dword [esp + 0x1c]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x480d1b
mov ecx, dword [esp + 0x18]
inc ecx
push ecx
call fcn.005dfcbc
mov edi, eax
add esp, 4
cmp edi, ebx
mov dword [esp + 0x40], edi
jne 0x4805e7
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x480d1b
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
push edi
push ebx
push ebx
push 0x6a90f0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x48061c
push edi
call fcn.005dfce5
mov edx, dword [esp + 0x18]
add esp, 4
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x480d1b
mov eax, dword [0x6cc564]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
lea edx, [esp + 0x44]
push ecx
push edx
push ebx
push ebx
push str.TPswitch
push eax
mov byte [esp + 0xec], 1
mov esi, 1
mov dword [esp + 0x30], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x48065e
mov esi, dword [esp + 0x44]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
lea edx, [esp + 0x44]
push ecx
push edx
push ebx
push ebx
push str.nAggrV
push eax
mov byte [esp + 0x37], bl
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x48068b
cmp dword [esp + 0x44], ebx
setne byte [esp + 0x1f]
cmp esi, 4
je 0x48071d
cmp esi, 5
je 0x48071d
cmp byte [esp + 0x1f], bl
jne 0x48071d
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
lea edx, [esp + 0x5c]
push ecx
push edx
push ebx
push ebx
push str.FileSize
push eax
mov dword [esp + 0x30], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4806e4
push edi
call fcn.005dfce5
mov ecx, dword [esp + 0x18]
add esp, 4
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x480d0b
mov eax, dword [esp + 0x5c]
mov ecx, dword [esp + 0x60]
mov edx, eax
or edx, ecx
jne 0x48070b
push edi
call fcn.005dfce5
mov eax, dword [esp + 0x18]
add esp, 4
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x480d0b
mov edx, dword [esp + 0x38]
mov dword [edx + 0x230], eax
mov dword [edx + 0x234], ecx
jmp 0x480785
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
lea edx, [esp + 0x48]
push ecx
push edx
push ebx
push ebx
push str.Duration
push eax
mov dword [esp + 0x30], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x48075e
push edi
call fcn.005dfce5
mov ecx, dword [esp + 0x18]
add esp, 4
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x480d0b
fld qword [esp + 0x48]
fmul qword [0x61ec38]
call fcn.005c7778
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], edx
mov dword [ecx + 0x230], eax
mov dword [ecx + 0x234], edx
lea edx, [esp + 0x74]
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x30]
push edx
push eax
push ebx
push 0xf003f
push ebx
push 0x6d0ab8
push ebx
push str.ChList
push ecx
call ebp
test eax, eax
je 0x4807c5
push edi
call fcn.005dfce5
mov edx, dword [esp + 0x18]
add esp, 4
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x480d0b
cmp esi, 4
je 0x480b41
cmp esi, 5
je 0x480b41
cmp byte [esp + 0x1f], bl
je 0x480900
lea ecx, [esp + 0x90]
call fcn.0053eb60
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x90]
push eax
mov byte [esp + 0xd8], 2
call fcn.0053f0f0
mov ebp, dword [esp + 0xb0]
cmp ebp, ebx
je 0x4808e7
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
cmp dword [ebp + 0x24], ebx
je 0x480842
fld qword [ebp + 8]
fmul qword [0x61ec48]
call fcn.005c7778
or esi, 0xffffffff
mov edi, 0xffffffff
sub esi, eax
sbb edi, edx
jmp 0x480849
mov esi, 1
xor edi, edi
mov eax, dword [ebp + 0x18]
push 0x18
cmp eax, 1
jne 0x480881
call fcn.005dfcbc
add esp, 4
cmp eax, ebx
je 0x48086f
mov dword [eax], ebx
mov dword [eax + 8], esi
mov dword [eax + 0x10], ebx
mov dword [eax + 4], ebx
mov dword [eax + 0xc], edi
jmp 0x480871
xor eax, eax
mov ecx, dword [esp + 0x38]
cmp eax, ebx
mov dword [ecx + 0x250], eax
je 0x4808e7
jmp 0x4808b6
call fcn.005dfcbc
add esp, 4
cmp eax, ebx
je 0x4808a9
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
add esi, ecx
mov dword [eax], ecx
adc edi, edx
mov dword [eax + 8], esi
mov dword [eax + 0x10], ebx
mov dword [eax + 4], edx
mov dword [eax + 0xc], edi
jmp 0x4808ab
xor eax, eax
mov edx, dword [esp + 0x20]
cmp eax, ebx
mov dword [edx + 0x10], eax
je 0x4808e7
fld qword [ebp + 8]
fmul qword [0x61ec38]
mov dword [esp + 0x20], eax
call fcn.005c7778
mov esi, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov ebp, dword [ebp]
add esi, eax
adc ecx, edx
cmp ebp, ebx
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], ecx
jne 0x480821
lea ecx, [esp + 0x90]
mov byte [esp + 0xd4], 1
call fcn.0053ebb0
jmp 0x480ce2
mov edx, dword [esp + 0x30]
lea eax, [esp + 0x18]
lea ecx, [esp + 0x64]
push eax
push ecx
push ebx
push ebx
mov esi, 0x10
push 0x6a90b8
push edx
mov dword [esp + 0x30], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x480ce2
mov eax, dword [esp + 0x40]
push ebx
push ebx
push 3
push ebx
push 3
push connect
mov dword [esp + 0x30], esi
push eax
xor esi, esi
xor edi, edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x48099b
lea ecx, [esp + 0x34]
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x480974
cmp edi, ebx
jne 0x480974
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jne 0x480986
mov edx, dword [esp + 0x34]
push 1
push ebx
push ebx
push edx
call fcn.005c9b80
add esi, eax
adc edi, edx
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, ebx
jg 0x48099b
jl 0x480997
cmp esi, ebx
jae 0x48099b
xor esi, esi
xor edi, edi
push 0x18
call fcn.005dfcbc
add esp, 4
cmp eax, ebx
je 0x4809be
sub esi, 1
mov dword [eax], ebx
sbb edi, ebx
mov dword [eax + 8], esi
mov dword [eax + 0x10], ebx
mov dword [eax + 4], ebx
mov dword [eax + 0xc], edi
jmp 0x4809c0
xor eax, eax
mov ecx, dword [esp + 0x38]
cmp eax, ebx
mov dword [ecx + 0x250], eax
je 0x480ce2
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x68]
cmp eax, 0xffffffff
je 0x480ce2
push eax
lea edx, [esp + 0x7c]
push 0x6a4a10
push edx
call fcn.005c7c98
add esp, 0xc
lea eax, [esp + 0x18]
lea ecx, [esp + 0x64]
lea edx, [esp + 0x78]
push eax
mov eax, dword [esp + 0x34]
push ecx
push ebx
push ebx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x480ce2
mov ecx, dword [0x6cc564]
mov dword [esp + 0x20], ecx
mov edx, dword [esp + 0x64]
mov eax, dword [esp + 0x40]
push edx
push eax
lea ecx, [esp + 0x28]
push str._s_ld
push ecx
mov byte [esp + 0xe4], 3
call fcn.005dc6eb
mov edx, dword [esp + 0x30]
add esp, 0x10
push ebx
push ebx
push 3
push ebx
push 3
push connect
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x480af5
lea eax, [esp + 0x34]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
xor ebp, ebp
cmp esi, 0xffffffff
jne 0x480a8d
cmp ebp, ebx
jne 0x480a8d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jne 0x480b0b
mov ecx, dword [esp + 0x34]
push 1
push ebx
push ebx
push ecx
call fcn.005c9b80
add esi, eax
push edi
adc ebp, edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x18
mov dword [esp + 0xd8], 3
call fcn.005dfcbc
add esp, 4
cmp eax, ebx
je 0x480ae4
mov edi, dword [esp + 0x6c]
mov ecx, edi
add ecx, esi
mov esi, dword [esp + 0x70]
mov edx, esi
mov dword [eax], edi
adc edx, ebp
sub ecx, 1
sbb edx, ebx
mov dword [eax + 8], ecx
mov dword [eax + 0x10], ebx
mov dword [eax + 4], esi
mov dword [eax + 0xc], edx
jmp 0x480ae6
xor eax, eax
mov edx, dword [esp + 0x28]
cmp eax, ebx
mov dword [edx + 0x10], eax
je 0x480b2b
mov dword [esp + 0x28], eax
lea ecx, [esp + 0x20]
mov byte [esp + 0xd4], 1
call fcn.005e38b9
jmp 0x4809d6
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x20]
mov dword [esp + 0xd4], 1
call fcn.005e38b9
jmp 0x480ce2
lea ecx, [esp + 0x20]
mov byte [esp + 0xd4], 1
call fcn.005e38b9
jmp 0x480ce2
mov edx, dword [esp + 0x30]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x18]
lea ecx, [esp + 0x48]
push eax
push ecx
push ebx
push ebx
push 0x6a90b8
push edx
mov dword [esp + 0x30], 0x10
call ebp
test eax, eax
je 0x480b8d
push edi
call fcn.005dfce5
mov eax, dword [esp + 0x18]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 4
push eax
call esi
mov ecx, dword [esp + 0x30]
push ecx
call esi
jmp 0x480d0b
mov dword [esp + 0x34], ebx
mov edx, dword [esp + 0x48]
lea eax, [esp + 0x78]
push edx
push str._dkf
push eax
xor esi, esi
xor edi, edi
call fcn.005c7c98
add esp, 0xc
lea ecx, [esp + 0x20]
lea edx, [esp + 0x64]
lea eax, [esp + 0x78]
push ecx
mov ecx, dword [esp + 0x34]
push edx
push ebx
push ebx
push eax
push ecx
mov dword [esp + 0x38], 0x10
call ebp
cmp eax, ebx
jne 0x480c11
mov eax, dword [esp + 0x6c]
cmp eax, 0xffffffff
jne 0x480bff
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x2c]
cmp ecx, eax
mov ecx, dword [esp + 0x50]
jl 0x480c11
jg 0x480bf1
cmp dword [esp + 0x28], ecx
jbe 0x480c11
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
sub esi, ecx
sbb edi, eax
jmp 0x480c11
mov ecx, dword [esp + 0x50]
cmp eax, ecx
jbe 0x480c0d
sub eax, ecx
mov esi, eax
jmp 0x480c0f
xor esi, esi
xor edi, edi
mov eax, dword [esp + 0x48]
push 0x18
cmp eax, ebx
jne 0x480c52
call fcn.005dfcbc
add esp, 4
cmp eax, ebx
je 0x480c3c
sub esi, 1
mov dword [eax], ebx
sbb edi, ebx
mov dword [eax + 8], esi
mov dword [eax + 0x10], ebx
mov dword [eax + 4], ebx
mov dword [eax + 0xc], edi
jmp 0x480c3e
xor eax, eax
mov edx, dword [esp + 0x38]
cmp eax, ebx
mov dword [edx + 0x250], eax
je 0x480ce2
jmp 0x480c94
call fcn.005dfcbc
add esp, 4
cmp eax, ebx
je 0x480c87
mov ebp, dword [esp + 0x50]
mov edx, ebx
mov ecx, ebp
mov dword [eax], ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add ecx, esi
adc edx, edi
sub ecx, 1
sbb edx, ebx
mov esi, ebx
mov dword [eax + 8], ecx
mov dword [eax + 0x10], ebx
mov dword [eax + 4], esi
mov dword [eax + 0xc], edx
jmp 0x480c89
xor eax, eax
mov ecx, dword [esp + 0x34]
cmp eax, ebx
mov dword [ecx + 0x10], eax
je 0x480ce2
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x4c]
cmp eax, 0xffffffff
je 0x480ce2
push eax
lea edx, [esp + 0x84]
push 0x6a4a10
push edx
call fcn.005c7c98
add esp, 0xc
lea eax, [esp + 0x20]
lea ecx, [esp + 0x48]
lea edx, [esp + 0x80]
push eax
mov eax, dword [esp + 0x34]
push ecx
push ebx
push ebx
push edx
push eax
mov dword [esp + 0x38], 0x10
call ebp
cmp eax, ebx
je 0x480b91
mov ecx, dword [esp + 0x40]
push ecx
call fcn.005dfce5
mov edx, dword [esp + 0x34]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 4
push edx
call esi
mov eax, dword [esp + 0x14]
push eax
call esi
mov ecx, dword [esp + 0x38]
mov byte [ecx + 0xc], 1
lea ecx, [esp + 0x3c]
mov byte [esp + 0xd4], bl
call fcn.005e38b9
lea ecx, [esp + 0x24]
mov dword [esp + 0xd4], 0xffffffff
call fcn.005e38b9
mov ecx, dword [esp + 0xcc]
pop edi
mov dword fs:[0], ecx
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret