Function at 0x4f5430
Capabilities:
Get file size
Query or enumerate registry value
Read file on windows
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x559fd0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x19e4
call fcn.0051cbf0
push ebx
mov ebx, ecx
push esi
push edi
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x30], ebx
mov dword [ebp - 4], 0
mov eax, dword [eax + 0x1c0]
test eax, eax
je 0x4f5b4e
mov edx, dword [eax]
test edx, edx
je 0x4f5b4e
cmp dword [eax + 4], 0x800
jl 0x4f5b4e
mov ecx, 0x200
xor eax, eax
lea edi, [ebp - 0x9ec]
lea esi, [ebp - 0x9ec]
rep stosd dword es:[edi], eax
mov edi, edx
mov ecx, 0x200
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
je 0x4f5b4e
mov edi, dword [ebx + 0x5c]
test edi, edi
mov dword [ebp - 0x24], edi
je 0x4f54c3
mov edi, dword [edi + 0x1c]
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x54], edi
mov byte [ebp - 0x11], 0
test edi, edi
je 0x4f582f
mov eax, dword [edi + 0x10]
push 0
push 0
push 3
push 0
push 3
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
mov dword [ebp - 0x18], esi
je 0x4f5824
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x34], 0
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
jne 0x4f551e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4f5814
mov edx, dword [ebp - 0x30]
lea ecx, [ebp - 0x1c]
push 0
push ecx
mov eax, dword [edx + 0xc]
push 0
push esi
mov dword [ebp - 0x1c], 0
mov ebx, dword [eax + 0x1c0]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x4f55d6
mov ecx, 0x200
xor eax, eax
lea edi, [ebp - 0x9ec]
lea edx, [ebp - 0x2c]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
push 0
push edx
lea eax, [ebp - 0x9ec]
push 0x800
push eax
push esi
mov dword [ebp - 0x2c], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4f55d6
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x4f55d6
mov esi, dword [ebx]
test esi, esi
je 0x4f55d6
mov edi, dword [ebx + 8]
mov eax, dword [ebx + 4]
inc edi
cmp ecx, eax
mov dword [ebx + 8], edi
jge 0x4f559a
mov eax, ecx
mov ecx, eax
lea edi, [ebp - 0x9ec]
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x4f55d6
mov ecx, dword [ebx + 0xc]
test ecx, ecx
je 0x4f55b4
cmp eax, 0x40
jge 0x4f55bb
cmp eax, 0x200
jl 0x4f55c1
inc ecx
mov dword [ebx + 0xc], ecx
jmp 0x4f55d2
mov eax, dword [ebx + 8]
dec eax
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x2c]
cmp eax, 0x104
jbe 0x4f55d6
mov byte [ebp - 0x11], 1
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x50]
mov dword [ebp - 0x38], 0x10
mov ecx, dword [eax + 0x24]
push ecx
push 0x597df0
push edx
call fcn.0051d0e8
add esp, 0xc
lea eax, [ebp - 0x38]
lea ecx, [ebp - 0x48]
lea edx, [ebp - 0x50]
push eax
mov eax, dword [ebp - 0x30]
push ecx
push 0
mov ecx, dword [eax + 0x9c]
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4f5814
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [eax + 8]
mov esi, dword [eax + 0xc]
mov eax, dword [ebp - 0x40]
cmp eax, edx
jne 0x4f5638
cmp ecx, esi
je 0x4f570f
cmp ecx, esi
jg 0x4f564c
jl 0x4f5642
cmp eax, edx
jae 0x4f564c
sub edx, eax
sbb esi, ecx
mov eax, edx
mov ecx, esi
jmp 0x4f5650
sub eax, edx
sbb ecx, esi
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x1c]
push 0
mov edx, dword [edx + 0xc]
push ecx
push eax
mov ebx, dword [edx + 0x1c0]
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x4f5709
mov ecx, 0x200
xor eax, eax
lea edi, [ebp - 0x19f4]
mov edx, dword [ebp - 0x18]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [ebp - 0x20]
push 0
push eax
lea ecx, [ebp - 0x19f4]
push 0x800
push ecx
push edx
mov dword [ebp - 0x20], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4f5709
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x4f5709
mov esi, dword [ebx]
test esi, esi
je 0x4f5709
mov edi, dword [ebx + 8]
mov eax, dword [ebx + 4]
inc edi
cmp ecx, eax
mov dword [ebx + 8], edi
jge 0x4f56cd
mov eax, ecx
mov ecx, eax
lea edi, [ebp - 0x19f4]
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x4f5709
mov ecx, dword [ebx + 0xc]
test ecx, ecx
je 0x4f56e7
cmp eax, 0x40
jge 0x4f56ee
cmp eax, 0x200
jl 0x4f56f4
inc ecx
mov dword [ebx + 0xc], ecx
jmp 0x4f5705
mov eax, dword [ebx + 8]
dec eax
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x20]
cmp eax, 0x104
jbe 0x4f5709
mov byte [ebp - 0x11], 1
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x40]
mov edx, dword [ebp - 0x24]
mov esi, dword [edx]
test esi, esi
je 0x4f5814
mov edx, dword [esi + 0x20]
mov esi, dword [esi + 0x24]
cmp eax, edx
jne 0x4f572e
cmp ecx, esi
je 0x4f5814
mov edi, dword [ebp - 0x24]
mov ebx, dword [edi + 8]
cmp ebx, edx
jne 0x4f5743
mov edi, dword [edi + 0xc]
cmp edi, esi
je 0x4f5814
cmp ecx, esi
jg 0x4f5757
jl 0x4f574d
cmp eax, edx
jae 0x4f5757
sub edx, eax
sbb esi, ecx
mov eax, edx
mov ecx, esi
jmp 0x4f575b
sub eax, edx
sbb ecx, esi
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x1c]
push 0
mov edx, dword [edx + 0xc]
push ecx
push eax
mov ebx, dword [edx + 0x1c0]
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x4f5814
mov ecx, 0x200
xor eax, eax
lea edi, [ebp - 0x11f0]
mov edx, dword [ebp - 0x18]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [ebp - 0x28]
push 0
push eax
lea ecx, [ebp - 0x11f0]
push 0x800
push ecx
push edx
mov dword [ebp - 0x28], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4f5814
mov ecx, dword [ebp - 0x28]
test ecx, ecx
je 0x4f5814
mov esi, dword [ebx]
test esi, esi
je 0x4f5814
mov edi, dword [ebx + 8]
mov eax, dword [ebx + 4]
inc edi
cmp ecx, eax
mov dword [ebx + 8], edi
jge 0x4f57d8
mov eax, ecx
mov ecx, eax
lea edi, [ebp - 0x11f0]
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x4f5814
mov ecx, dword [ebx + 0xc]
test ecx, ecx
je 0x4f57f2
cmp eax, 0x40
jge 0x4f57f9
cmp eax, 0x200
jl 0x4f57ff
inc ecx
mov dword [ebx + 0xc], ecx
jmp 0x4f5810
mov eax, dword [ebx + 8]
dec eax
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x28]
cmp eax, 0x104
jbe 0x4f5814
mov byte [ebp - 0x11], 1
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x24]
mov ebx, dword [ebp - 0x30]
mov edi, dword [edi + 0x1c]
mov dword [ebp - 0x24], edi
jmp 0x4f54ca
mov eax, dword [ebx + 0x8c]
test eax, eax
je 0x4f5a41
mov eax, dword [ebx + 0x290]
test eax, eax
je 0x4f585e
push eax
lea ecx, [ebp - 0xb4]
push str.SoftwareDownloadManager_ldChList
push ecx
call fcn.0051d0e8
add esp, 0xc
jmp 0x4f5880
mov edx, dword [ebx + 0x1e8]
mov eax, dword [ebx + 0x1e4]
push edx
push eax
lea ecx, [ebp - 0xb4]
push str.SoftwareDownloadManagerGrabberStsProjects_ld_ldChList
push ecx
call fcn.0051d0e8
add esp, 0x10
mov edx, dword [ebx + 0x5c]
lea ecx, [ebp - 0x18]
mov eax, dword [edx + 0x10]
push eax
call fcn.00537b72
mov byte [ebp - 4], 1
xor esi, esi
cmp esi, 0xffffffff
je 0x4f5a35
push esi
lea ecx, [ebp - 0x50]
push 0x597df0
push ecx
call fcn.0051d0e8
add esp, 0xc
lea edx, [ebp - 0x38]
lea eax, [ebp - 0x48]
lea ecx, [ebp - 0x50]
push edx
mov edx, dword [ebx + 0x9c]
push eax
push 0
push 0
push ecx
push edx
mov dword [ebp - 0x38], 0x10
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4f5a35
test esi, esi
je 0x4f5a2d
mov eax, dword [0x5b5ecc]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x18]
push esi
push ecx
lea edx, [ebp - 0x2c]
push str._s_d
push edx
mov byte [ebp - 4], 2
call fcn.0053091a
mov eax, dword [ebp - 0x2c]
add esp, 0x10
push 0
push 0
push 3
push 0
push 3
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x20], eax
je 0x4f5a21
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
xor ecx, ecx
cmp eax, 0xffffffff
jne 0x4f5956
test ecx, ecx
jne 0x4f5956
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4f5a14
mov edx, dword [ebp - 0x30]
lea ecx, [ebp - 0x34]
push 0
push ecx
mov eax, dword [edx + 0xc]
mov edx, dword [ebp - 0x20]
push 0
push edx
mov ebx, dword [eax + 0x1c0]
mov dword [ebp - 0x34], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x4f5a14
mov ecx, 0x200
xor eax, eax
lea edi, [ebp - 0x11f0]
mov edx, dword [ebp - 0x20]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [ebp - 0x28]
push 0
push eax
lea ecx, [ebp - 0x11f0]
push 0x800
push ecx
push edx
mov dword [ebp - 0x28], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4f5a14
mov ecx, dword [ebp - 0x28]
test ecx, ecx
je 0x4f5a14
mov esi, dword [ebx]
test esi, esi
je 0x4f5a14
mov edi, dword [ebx + 8]
mov eax, dword [ebx + 4]
inc edi
cmp ecx, eax
mov dword [ebx + 8], edi
jge 0x4f59d8
mov eax, ecx
mov ecx, eax
lea edi, [ebp - 0x11f0]
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x4f5a14
mov ecx, dword [ebx + 0xc]
test ecx, ecx
je 0x4f59f2
cmp eax, 0x40
jge 0x4f59f9
cmp eax, 0x200
jl 0x4f59ff
inc ecx
mov dword [ebx + 0xc], ecx
jmp 0x4f5a10
mov eax, dword [ebx + 8]
dec eax
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x28]
cmp eax, 0x104
jbe 0x4f5a14
mov byte [ebp - 0x11], 1
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebp - 0x30]
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.00537b04
mov esi, dword [ebp - 0x44]
jmp 0x4f5895
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0
call fcn.00537b04
mov al, byte [ebp - 0x11]
test al, al
je 0x4f5b4e
push str.Some_chunks_matched_with_start_of_file__Deleting_all__except_first._n
mov ecx, ebx
call fcn.004f4240
mov esi, dword [ebp - 0x54]
xor edi, edi
cmp esi, edi
je 0x4f5ac5
mov ecx, dword [esi]
cmp ecx, edi
je 0x4f5a6c
mov edx, dword [ecx]
call dword [edx + 8]
mov eax, dword [esi + 0x10]
push eax
call fcn.0051de13
mov ecx, dword [esi + 0x10]
add esp, 4
cmp eax, 0xffffffff
push ecx
jne 0x4f5a88
push str.Could_not_delete_temp_file__s_n
jmp 0x4f5a8d
push str.Deleting_temp_file__s_n
lea edx, [ebp - 0x1e8]
push edx
call fcn.0051d0e8
add esp, 0xc
lea eax, [ebp - 0x1e8]
mov ecx, ebx
push eax
call fcn.004f4240
mov edi, esi
mov esi, dword [esi + 0x1c]
test edi, edi
je 0x4f5a5b
mov ecx, edi
call fcn.004c6e30
push edi
call fcn.005380ca
add esp, 4
jmp 0x4f5a5b
lea ecx, [ebx + 0x48]
call fcn.004c5950
mov eax, dword [ebx + 0x9c]
cmp eax, edi
je 0x4f5afb
lea ecx, [ebp - 0x48]
push 0x10
push ecx
push edi
push edi
push 0x59d84c
push eax
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x44], 0xffffffff
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebx + 0x5c]
mov dword [ebx + 0x70], edi
cmp eax, edi
mov dword [ebx + 0x74], edi
mov dword [ebx + 0x8c], edi
je 0x4f5b5f
mov dword [eax + 0x1c], edi
mov edx, dword [ebx + 0x5c]
mov edx, dword [edx]
mov eax, dword [edx + 0x1c]
mov ecx, dword [edx + 0x18]
cmp eax, edi
jl 0x4f5b2d
jg 0x4f5b26
cmp ecx, edi
jbe 0x4f5b2d
sub ecx, 1
sbb eax, edi
jmp 0x4f5b31
xor ecx, ecx
xor eax, eax
mov dword [edx + 0x30], ecx
mov dword [edx + 0x34], eax
mov eax, dword [ebx + 0x5c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x38]
mov dword [ebx + 0x218], edx
mov eax, dword [ecx + 0x3c]
mov dword [ebx + 0x21c], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
mov dword [ebx + 0x218], edi
mov dword [ebx + 0x21c], edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret