Function at 0x5375d0
Capabilities:
Get file size
Query or enumerate registry value
Read file on windows
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ac790
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x1a84
call fcn.0056ae30
push ebx
mov ebx, ecx
push esi
push edi
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x30], ebx
mov dword [ebp - 4], 0
mov eax, dword [eax + 0xe0]
test eax, eax
je 0x537cf4
mov edx, dword [eax]
test edx, edx
je 0x537cf4
cmp dword [eax + 4], 0x800
jl 0x537cf4
mov ecx, 0x200
xor eax, eax
lea edi, [ebp - 0xa8c]
lea esi, [ebp - 0xa8c]
rep stosd dword es:[edi], eax
mov edi, edx
mov ecx, 0x200
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
je 0x537cf4
mov edi, dword [ebx + 0x68]
test edi, edi
mov dword [ebp - 0x2c], edi
je 0x537663
mov edi, dword [edi + 0x30]
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x4c], edi
mov byte [ebp - 0x11], 0
test edi, edi
je 0x5379cf
mov eax, dword [edi + 0x10]
push 0
push 0
push 3
push 0
push 3
push closesocket
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
mov dword [ebp - 0x18], esi
je 0x5379c4
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x34], 0
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
jne 0x5376be
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x5379b4
mov edx, dword [ebp - 0x30]
lea ecx, [ebp - 0x1c]
push 0
push ecx
mov eax, dword [edx + 0xc]
push 0
push esi
mov dword [ebp - 0x1c], 0
mov ebx, dword [eax + 0xe0]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x537776
mov ecx, 0x200
xor eax, eax
lea edi, [ebp - 0xa8c]
lea edx, [ebp - 0x28]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
push 0
push edx
lea eax, [ebp - 0xa8c]
push 0x800
push eax
push esi
mov dword [ebp - 0x28], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x537776
mov ecx, dword [ebp - 0x28]
test ecx, ecx
je 0x537776
mov esi, dword [ebx]
test esi, esi
je 0x537776
mov edi, dword [ebx + 8]
mov eax, dword [ebx + 4]
inc edi
cmp ecx, eax
mov dword [ebx + 8], edi
jge 0x53773a
mov eax, ecx
mov ecx, eax
lea edi, [ebp - 0xa8c]
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x537776
mov ecx, dword [ebx + 0xc]
test ecx, ecx
je 0x537754
cmp eax, 0x40
jge 0x53775b
cmp eax, 0x200
jl 0x537761
inc ecx
mov dword [ebx + 0xc], ecx
jmp 0x537772
mov eax, dword [ebx + 8]
dec eax
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x28]
cmp eax, 0x104
jbe 0x537776
mov byte [ebp - 0x11], 1
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x54]
mov dword [ebp - 0x38], 0x10
mov ecx, dword [eax + 0x38]
push ecx
push 0x636fe4
push edx
call fcn.0056b4da
add esp, 0xc
lea eax, [ebp - 0x38]
lea ecx, [ebp - 0x48]
lea edx, [ebp - 0x54]
push eax
mov eax, dword [ebp - 0x30]
push ecx
push 0
mov ecx, dword [eax + 0xbc]
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x5379b4
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [eax + 8]
mov esi, dword [eax + 0xc]
mov eax, dword [ebp - 0x40]
cmp eax, edx
jne 0x5377d8
cmp ecx, esi
je 0x5378af
cmp ecx, esi
jg 0x5377ec
jl 0x5377e2
cmp eax, edx
jae 0x5377ec
sub edx, eax
sbb esi, ecx
mov eax, edx
mov ecx, esi
jmp 0x5377f0
sub eax, edx
sbb ecx, esi
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x1c]
push 0
mov edx, dword [edx + 0xc]
push ecx
push eax
mov ebx, dword [edx + 0xe0]
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x5378a9
mov ecx, 0x200
xor eax, eax
lea edi, [ebp - 0x1a94]
mov edx, dword [ebp - 0x18]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [ebp - 0x24]
push 0
push eax
lea ecx, [ebp - 0x1a94]
push 0x800
push ecx
push edx
mov dword [ebp - 0x24], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x5378a9
mov ecx, dword [ebp - 0x24]
test ecx, ecx
je 0x5378a9
mov esi, dword [ebx]
test esi, esi
je 0x5378a9
mov edi, dword [ebx + 8]
mov eax, dword [ebx + 4]
inc edi
cmp ecx, eax
mov dword [ebx + 8], edi
jge 0x53786d
mov eax, ecx
mov ecx, eax
lea edi, [ebp - 0x1a94]
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x5378a9
mov ecx, dword [ebx + 0xc]
test ecx, ecx
je 0x537887
cmp eax, 0x40
jge 0x53788e
cmp eax, 0x200
jl 0x537894
inc ecx
mov dword [ebx + 0xc], ecx
jmp 0x5378a5
mov eax, dword [ebx + 8]
dec eax
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x24]
cmp eax, 0x104
jbe 0x5378a9
mov byte [ebp - 0x11], 1
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x40]
mov edx, dword [ebp - 0x2c]
mov esi, dword [edx]
test esi, esi
je 0x5379b4
mov edx, dword [esi + 0x20]
mov esi, dword [esi + 0x24]
cmp eax, edx
jne 0x5378ce
cmp ecx, esi
je 0x5379b4
mov edi, dword [ebp - 0x2c]
mov ebx, dword [edi + 8]
cmp ebx, edx
jne 0x5378e3
mov edi, dword [edi + 0xc]
cmp edi, esi
je 0x5379b4
cmp ecx, esi
jg 0x5378f7
jl 0x5378ed
cmp eax, edx
jae 0x5378f7
sub edx, eax
sbb esi, ecx
mov eax, edx
mov ecx, esi
jmp 0x5378fb
sub eax, edx
sbb ecx, esi
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x1c]
push 0
mov edx, dword [edx + 0xc]
push ecx
push eax
mov ebx, dword [edx + 0xe0]
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x5379b4
mov ecx, 0x200
xor eax, eax
lea edi, [ebp - 0x1290]
mov edx, dword [ebp - 0x18]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [ebp - 0x20]
push 0
push eax
lea ecx, [ebp - 0x1290]
push 0x800
push ecx
push edx
mov dword [ebp - 0x20], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x5379b4
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x5379b4
mov esi, dword [ebx]
test esi, esi
je 0x5379b4
mov edi, dword [ebx + 8]
mov eax, dword [ebx + 4]
inc edi
cmp ecx, eax
mov dword [ebx + 8], edi
jge 0x537978
mov eax, ecx
mov ecx, eax
lea edi, [ebp - 0x1290]
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x5379b4
mov ecx, dword [ebx + 0xc]
test ecx, ecx
je 0x537992
cmp eax, 0x40
jge 0x537999
cmp eax, 0x200
jl 0x53799f
inc ecx
mov dword [ebx + 0xc], ecx
jmp 0x5379b0
mov eax, dword [ebx + 8]
dec eax
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x20]
cmp eax, 0x104
jbe 0x5379b4
mov byte [ebp - 0x11], 1
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x30]
mov edi, dword [edi + 0x30]
mov dword [ebp - 0x2c], edi
jmp 0x53766a
mov eax, dword [ebx + 0xac]
test eax, eax
je 0x537be1
mov eax, dword [ebx + 0x1c0]
test eax, eax
je 0x5379fe
push eax
lea ecx, [ebp - 0x288]
push str.SoftwareDownloadManager_ldChList
push ecx
call fcn.0056b4da
add esp, 0xc
jmp 0x537a20
mov edx, dword [ebx + 0x10c]
mov eax, dword [ebx + 0x108]
push edx
push eax
lea ecx, [ebp - 0x288]
push str.SoftwareDownloadManagerGrabberStsProjects_ld_ldChList
push ecx
call fcn.0056b4da
add esp, 0x10
mov edx, dword [ebx + 0x68]
lea ecx, [ebp - 0x18]
mov eax, dword [edx + 0x10]
push eax
call fcn.00586ba1
mov byte [ebp - 4], 1
xor esi, esi
cmp esi, 0xffffffff
je 0x537bd5
push esi
lea ecx, [ebp - 0x54]
push 0x636fe4
push ecx
call fcn.0056b4da
add esp, 0xc
lea edx, [ebp - 0x38]
lea eax, [ebp - 0x48]
lea ecx, [ebp - 0x54]
push edx
mov edx, dword [ebx + 0xbc]
push eax
push 0
push 0
push ecx
push edx
mov dword [ebp - 0x38], 0x10
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x537bd5
test esi, esi
je 0x537bcd
mov eax, dword [0x65ca8c]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x18]
push esi
push ecx
lea edx, [ebp - 0x28]
push str._s_d
push edx
mov byte [ebp - 4], 2
call fcn.0057f8fb
mov eax, dword [ebp - 0x28]
add esp, 0x10
push 0
push 0
push 3
push 0
push 3
push closesocket
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x24], eax
je 0x537bc1
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
xor ecx, ecx
cmp eax, 0xffffffff
jne 0x537af6
test ecx, ecx
jne 0x537af6
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x537bb4
mov edx, dword [ebp - 0x30]
lea ecx, [ebp - 0x34]
push 0
push ecx
mov eax, dword [edx + 0xc]
mov edx, dword [ebp - 0x24]
push 0
push edx
mov ebx, dword [eax + 0xe0]
mov dword [ebp - 0x34], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x537bb4
mov ecx, 0x200
xor eax, eax
lea edi, [ebp - 0x1290]
mov edx, dword [ebp - 0x24]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [ebp - 0x20]
push 0
push eax
lea ecx, [ebp - 0x1290]
push 0x800
push ecx
push edx
mov dword [ebp - 0x20], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x537bb4
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x537bb4
mov esi, dword [ebx]
test esi, esi
je 0x537bb4
mov edi, dword [ebx + 8]
mov eax, dword [ebx + 4]
inc edi
cmp ecx, eax
mov dword [ebx + 8], edi
jge 0x537b78
mov eax, ecx
mov ecx, eax
lea edi, [ebp - 0x1290]
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x537bb4
mov ecx, dword [ebx + 0xc]
test ecx, ecx
je 0x537b92
cmp eax, 0x40
jge 0x537b99
cmp eax, 0x200
jl 0x537b9f
inc ecx
mov dword [ebx + 0xc], ecx
jmp 0x537bb0
mov eax, dword [ebx + 8]
dec eax
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x20]
cmp eax, 0x104
jbe 0x537bb4
mov byte [ebp - 0x11], 1
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebp - 0x30]
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00586b33
mov esi, dword [ebp - 0x44]
jmp 0x537a35
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0
call fcn.00586b33
mov al, byte [ebp - 0x11]
test al, al
je 0x537cf4
push str.Some_chunks_matched_with_start_of_file__Deleting_all__except_first._n
mov ecx, ebx
call fcn.00535f00
mov esi, dword [ebp - 0x4c]
xor edi, edi
cmp esi, edi
je 0x537c65
mov ecx, dword [esi]
cmp ecx, edi
je 0x537c0c
mov edx, dword [ecx]
call dword [edx + 8]
mov eax, dword [esi + 0x10]
push eax
call fcn.0056cd51
mov ecx, dword [esi + 0x10]
add esp, 4
cmp eax, 0xffffffff
push ecx
jne 0x537c28
push str.Could_not_delete_temp_file__s_n
jmp 0x537c2d
push str.Deleting_temp_file__s_n
lea edx, [ebp - 0x188]
push edx
call fcn.0056b4da
add esp, 0xc
lea eax, [ebp - 0x188]
mov ecx, ebx
push eax
call fcn.00535f00
mov edi, esi
mov esi, dword [esi + 0x30]
test edi, edi
je 0x537bfb
mov ecx, edi
call fcn.004f6be0
push edi
call fcn.00582ef5
add esp, 4
jmp 0x537bfb
lea ecx, [ebx + 0x48]
call fcn.004f55e0
mov eax, dword [ebx + 0xbc]
cmp eax, edi
je 0x537c9b
lea ecx, [ebp - 0x48]
push 0x10
push ecx
push edi
push edi
push 0x63d538
push eax
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x44], 0xffffffff
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebx + 0x68]
mov dword [ebx + 0x80], edi
cmp eax, edi
mov dword [ebx + 0x84], edi
mov dword [ebx + 0xac], edi
je 0x537d05
mov dword [eax + 0x30], edi
mov edx, dword [ebx + 0x68]
mov edx, dword [edx]
mov eax, dword [edx + 0x1c]
mov ecx, dword [edx + 0x18]
cmp eax, edi
jl 0x537cd3
jg 0x537ccc
cmp ecx, edi
jbe 0x537cd3
sub ecx, 1
sbb eax, edi
jmp 0x537cd7
xor ecx, ecx
xor eax, eax
mov dword [edx + 0x30], ecx
mov dword [edx + 0x34], eax
mov eax, dword [ebx + 0x68]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x38]
mov dword [ebx + 0x148], edx
mov eax, dword [ecx + 0x3c]
mov dword [ebx + 0x14c], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
mov dword [ebx + 0x148], edi
mov dword [ebx + 0x120], edi
mov dword [ebx + 0x14c], edi
mov dword [ebx + 0x124], edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret