Function at 0x47cf90
Capabilities:
Get file size
Query or enumerate registry key
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5f9509
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xbc
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x38], esi
call fcn.0047cd00
mov eax, dword [0x6c826c]
mov dword [esp + 0x24], eax
mov ecx, dword [esi + 0x24c]
xor ebx, ebx
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x60], ebx
mov edx, dword [ecx + 0x468]
lea eax, [esp + 0x24]
push edx
push str.SoftwareDownloadManager_ld
push eax
mov dword [esp + 0xe0], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
call fcn.005d838b
add esp, 0xc
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x74]
lea edx, [esp + 0x14]
push ecx
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push edx
push ebx
push 0xf003f
push ebx
push 0x6cc7b8
push ebx
push eax
push reloc.WS2_32.dll_accept
call ebp
test eax, eax
jne 0x47d7bb
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push ebx
lea edx, [esp + 0x1c]
push ebx
mov eax, dword [esp + 0x1c]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x47d7bb
mov ecx, dword [esp + 0x18]
inc ecx
push ecx
call fcn.005db95d
mov edi, eax
add esp, 4
cmp edi, ebx
mov dword [esp + 0x40], edi
jne 0x47d087
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x47d7bb
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
push edi
push ebx
push ebx
push 0x6a5058
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x47d0bc
push edi
call fcn.005db986
mov edx, dword [esp + 0x18]
add esp, 4
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x47d7bb
mov eax, dword [0x6c826c]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
lea edx, [esp + 0x44]
push ecx
push edx
push ebx
push ebx
push str.TPswitch
push eax
mov byte [esp + 0xec], 1
mov esi, 1
mov dword [esp + 0x30], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x47d0fe
mov esi, dword [esp + 0x44]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
lea edx, [esp + 0x44]
push ecx
push edx
push ebx
push ebx
push str.nAggrV
push eax
mov byte [esp + 0x37], bl
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x47d12b
cmp dword [esp + 0x44], ebx
setne byte [esp + 0x1f]
cmp esi, 4
je 0x47d1bd
cmp esi, 5
je 0x47d1bd
cmp byte [esp + 0x1f], bl
jne 0x47d1bd
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
lea edx, [esp + 0x5c]
push ecx
push edx
push ebx
push ebx
push str.FileSize
push eax
mov dword [esp + 0x30], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x47d184
push edi
call fcn.005db986
mov ecx, dword [esp + 0x18]
add esp, 4
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x47d7ab
mov eax, dword [esp + 0x5c]
mov ecx, dword [esp + 0x60]
mov edx, eax
or edx, ecx
jne 0x47d1ab
push edi
call fcn.005db986
mov eax, dword [esp + 0x18]
add esp, 4
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x47d7ab
mov edx, dword [esp + 0x38]
mov dword [edx + 0x230], eax
mov dword [edx + 0x234], ecx
jmp 0x47d225
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
lea edx, [esp + 0x48]
push ecx
push edx
push ebx
push ebx
push str.Duration
push eax
mov dword [esp + 0x30], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x47d1fe
push edi
call fcn.005db986
mov ecx, dword [esp + 0x18]
add esp, 4
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x47d7ab
fld qword [esp + 0x48]
fmul qword [0x61ac38]
call fcn.005c3408
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], edx
mov dword [ecx + 0x230], eax
mov dword [ecx + 0x234], edx
lea edx, [esp + 0x74]
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x30]
push edx
push eax
push ebx
push 0xf003f
push ebx
push 0x6cc7b8
push ebx
push str.ChList
push ecx
call ebp
test eax, eax
je 0x47d265
push edi
call fcn.005db986
mov edx, dword [esp + 0x18]
add esp, 4
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x47d7ab
cmp esi, 4
je 0x47d5e1
cmp esi, 5
je 0x47d5e1
cmp byte [esp + 0x1f], bl
je 0x47d3a0
lea ecx, [esp + 0x90]
call fcn.0053b230
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x90]
push eax
mov byte [esp + 0xd8], 2
call fcn.0053b7c0
mov ebp, dword [esp + 0xb0]
cmp ebp, ebx
je 0x47d387
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
cmp dword [ebp + 0x24], ebx
je 0x47d2e2
fld qword [ebp + 8]
fmul qword [0x61ac48]
call fcn.005c3408
or esi, 0xffffffff
mov edi, 0xffffffff
sub esi, eax
sbb edi, edx
jmp 0x47d2e9
mov esi, 1
xor edi, edi
mov eax, dword [ebp + 0x18]
push 0x18
cmp eax, 1
jne 0x47d321
call fcn.005db95d
add esp, 4
cmp eax, ebx
je 0x47d30f
mov dword [eax], ebx
mov dword [eax + 8], esi
mov dword [eax + 0x10], ebx
mov dword [eax + 4], ebx
mov dword [eax + 0xc], edi
jmp 0x47d311
xor eax, eax
mov ecx, dword [esp + 0x38]
cmp eax, ebx
mov dword [ecx + 0x250], eax
je 0x47d387
jmp 0x47d356
call fcn.005db95d
add esp, 4
cmp eax, ebx
je 0x47d349
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
add esi, ecx
mov dword [eax], ecx
adc edi, edx
mov dword [eax + 8], esi
mov dword [eax + 0x10], ebx
mov dword [eax + 4], edx
mov dword [eax + 0xc], edi
jmp 0x47d34b
xor eax, eax
mov edx, dword [esp + 0x20]
cmp eax, ebx
mov dword [edx + 0x10], eax
je 0x47d387
fld qword [ebp + 8]
fmul qword [0x61ac38]
mov dword [esp + 0x20], eax
call fcn.005c3408
mov esi, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov ebp, dword [ebp]
add esi, eax
adc ecx, edx
cmp ebp, ebx
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], ecx
jne 0x47d2c1
lea ecx, [esp + 0x90]
mov byte [esp + 0xd4], 1
call fcn.0053b280
jmp 0x47d782
mov edx, dword [esp + 0x30]
lea eax, [esp + 0x18]
lea ecx, [esp + 0x64]
push eax
push ecx
push ebx
push ebx
mov esi, 0x10
push 0x6a5020
push edx
mov dword [esp + 0x30], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x47d782
mov eax, dword [esp + 0x40]
push ebx
push ebx
push 3
push ebx
push 3
push connect
mov dword [esp + 0x30], esi
push eax
xor esi, esi
xor edi, edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x47d43b
lea ecx, [esp + 0x34]
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x47d414
cmp edi, ebx
jne 0x47d414
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jne 0x47d426
mov edx, dword [esp + 0x34]
push 1
push ebx
push ebx
push edx
call fcn.005c5810
add esi, eax
adc edi, edx
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, ebx
jg 0x47d43b
jl 0x47d437
cmp esi, ebx
jae 0x47d43b
xor esi, esi
xor edi, edi
push 0x18
call fcn.005db95d
add esp, 4
cmp eax, ebx
je 0x47d45e
sub esi, 1
mov dword [eax], ebx
sbb edi, ebx
mov dword [eax + 8], esi
mov dword [eax + 0x10], ebx
mov dword [eax + 4], ebx
mov dword [eax + 0xc], edi
jmp 0x47d460
xor eax, eax
mov ecx, dword [esp + 0x38]
cmp eax, ebx
mov dword [ecx + 0x250], eax
je 0x47d782
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x68]
cmp eax, 0xffffffff
je 0x47d782
push eax
lea edx, [esp + 0x7c]
push 0x6a0980
push edx
call fcn.005c3928
add esp, 0xc
lea eax, [esp + 0x18]
lea ecx, [esp + 0x64]
lea edx, [esp + 0x78]
push eax
mov eax, dword [esp + 0x34]
push ecx
push ebx
push ebx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x47d782
mov ecx, dword [0x6c826c]
mov dword [esp + 0x20], ecx
mov edx, dword [esp + 0x64]
mov eax, dword [esp + 0x40]
push edx
push eax
lea ecx, [esp + 0x28]
push str._s_ld
push ecx
mov byte [esp + 0xe4], 3
call fcn.005d838b
mov edx, dword [esp + 0x30]
add esp, 0x10
push ebx
push ebx
push 3
push ebx
push 3
push connect
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x47d595
lea eax, [esp + 0x34]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
xor ebp, ebp
cmp esi, 0xffffffff
jne 0x47d52d
cmp ebp, ebx
jne 0x47d52d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jne 0x47d5ab
mov ecx, dword [esp + 0x34]
push 1
push ebx
push ebx
push ecx
call fcn.005c5810
add esi, eax
push edi
adc ebp, edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x18
mov dword [esp + 0xd8], 3
call fcn.005db95d
add esp, 4
cmp eax, ebx
je 0x47d584
mov edi, dword [esp + 0x6c]
mov ecx, edi
add ecx, esi
mov esi, dword [esp + 0x70]
mov edx, esi
mov dword [eax], edi
adc edx, ebp
sub ecx, 1
sbb edx, ebx
mov dword [eax + 8], ecx
mov dword [eax + 0x10], ebx
mov dword [eax + 4], esi
mov dword [eax + 0xc], edx
jmp 0x47d586
xor eax, eax
mov edx, dword [esp + 0x28]
cmp eax, ebx
mov dword [edx + 0x10], eax
je 0x47d5cb
mov dword [esp + 0x28], eax
lea ecx, [esp + 0x20]
mov byte [esp + 0xd4], 1
call fcn.005df556
jmp 0x47d476
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x20]
mov dword [esp + 0xd4], 1
call fcn.005df556
jmp 0x47d782
lea ecx, [esp + 0x20]
mov byte [esp + 0xd4], 1
call fcn.005df556
jmp 0x47d782
mov edx, dword [esp + 0x30]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x18]
lea ecx, [esp + 0x48]
push eax
push ecx
push ebx
push ebx
push 0x6a5020
push edx
mov dword [esp + 0x30], 0x10
call ebp
test eax, eax
je 0x47d62d
push edi
call fcn.005db986
mov eax, dword [esp + 0x18]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 4
push eax
call esi
mov ecx, dword [esp + 0x30]
push ecx
call esi
jmp 0x47d7ab
mov dword [esp + 0x34], ebx
mov edx, dword [esp + 0x48]
lea eax, [esp + 0x78]
push edx
push str._dkf
push eax
xor esi, esi
xor edi, edi
call fcn.005c3928
add esp, 0xc
lea ecx, [esp + 0x20]
lea edx, [esp + 0x64]
lea eax, [esp + 0x78]
push ecx
mov ecx, dword [esp + 0x34]
push edx
push ebx
push ebx
push eax
push ecx
mov dword [esp + 0x38], 0x10
call ebp
cmp eax, ebx
jne 0x47d6b1
mov eax, dword [esp + 0x6c]
cmp eax, 0xffffffff
jne 0x47d69f
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x2c]
cmp ecx, eax
mov ecx, dword [esp + 0x50]
jl 0x47d6b1
jg 0x47d691
cmp dword [esp + 0x28], ecx
jbe 0x47d6b1
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
sub esi, ecx
sbb edi, eax
jmp 0x47d6b1
mov ecx, dword [esp + 0x50]
cmp eax, ecx
jbe 0x47d6ad
sub eax, ecx
mov esi, eax
jmp 0x47d6af
xor esi, esi
xor edi, edi
mov eax, dword [esp + 0x48]
push 0x18
cmp eax, ebx
jne 0x47d6f2
call fcn.005db95d
add esp, 4
cmp eax, ebx
je 0x47d6dc
sub esi, 1
mov dword [eax], ebx
sbb edi, ebx
mov dword [eax + 8], esi
mov dword [eax + 0x10], ebx
mov dword [eax + 4], ebx
mov dword [eax + 0xc], edi
jmp 0x47d6de
xor eax, eax
mov edx, dword [esp + 0x38]
cmp eax, ebx
mov dword [edx + 0x250], eax
je 0x47d782
jmp 0x47d734
call fcn.005db95d
add esp, 4
cmp eax, ebx
je 0x47d727
mov ebp, dword [esp + 0x50]
mov edx, ebx
mov ecx, ebp
mov dword [eax], ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add ecx, esi
adc edx, edi
sub ecx, 1
sbb edx, ebx
mov esi, ebx
mov dword [eax + 8], ecx
mov dword [eax + 0x10], ebx
mov dword [eax + 4], esi
mov dword [eax + 0xc], edx
jmp 0x47d729
xor eax, eax
mov ecx, dword [esp + 0x34]
cmp eax, ebx
mov dword [ecx + 0x10], eax
je 0x47d782
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x4c]
cmp eax, 0xffffffff
je 0x47d782
push eax
lea edx, [esp + 0x84]
push 0x6a0980
push edx
call fcn.005c3928
add esp, 0xc
lea eax, [esp + 0x20]
lea ecx, [esp + 0x48]
lea edx, [esp + 0x80]
push eax
mov eax, dword [esp + 0x34]
push ecx
push ebx
push ebx
push edx
push eax
mov dword [esp + 0x38], 0x10
call ebp
cmp eax, ebx
je 0x47d631
mov ecx, dword [esp + 0x40]
push ecx
call fcn.005db986
mov edx, dword [esp + 0x34]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 4
push edx
call esi
mov eax, dword [esp + 0x14]
push eax
call esi
mov ecx, dword [esp + 0x38]
mov byte [ecx + 0xc], 1
lea ecx, [esp + 0x3c]
mov byte [esp + 0xd4], bl
call fcn.005df556
lea ecx, [esp + 0x24]
mov dword [esp + 0xd4], 0xffffffff
call fcn.005df556
mov ecx, dword [esp + 0xcc]
pop edi
mov dword fs:[0], ecx
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret