Function at 0x54a0f0
Capabilities:
Get file size
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x62a04b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xb4
push ebx
mov ebx, ecx
push esi
push edi
mov eax, dword [ebx + 0xdc]
mov dword [ebp - 0x10], esp
test eax, eax
mov dword [ebp - 0x7c], ebx
je 0x54a5b0
mov eax, dword [0x6cc708]
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], eax
mov ecx, dword [ebx + 0x94]
lea edx, [ebp - 0x14]
inc ecx
mov byte [ebp - 4], 1
push ecx
push str.insert_from_reg__ID___d_n
push edx
call fcn.005fb90b
mov eax, dword [ebp - 0x14]
add esp, 0xc
mov ecx, ebx
push eax
call fcn.00541a30
mov ecx, dword [ebx + 0x94]
lea edx, [ebp - 0x44]
inc ecx
mov dword [ebp - 0x48], 0x10
push ecx
push 0x6a00e4
push edx
call fcn.005e6db3
add esp, 0xc
lea eax, [ebp - 0x48]
lea ecx, [ebp - 0x3c]
lea edx, [ebp - 0x44]
push eax
mov eax, dword [ebx + 0xdc]
push ecx
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x54a5a4
mov ecx, dword [ebp - 0x38]
push 0x70
mov dword [ebp - 0x58], ecx
call fcn.005feedc
mov ecx, eax
add esp, 4
mov dword [ebp - 0x28], ecx
test ecx, ecx
mov byte [ebp - 4], 2
je 0x54a1c9
call fcn.0054bc10
mov edi, eax
jmp 0x54a1cb
xor edi, edi
test edi, edi
mov dword [ebp - 0x2c], edi
mov byte [ebp - 4], 1
je 0x54a5a4
mov edx, dword [ebx + 0xd4]
mov dword [edi + 0x64], edx
mov eax, dword [ebx + 0xdc]
mov dword [edi + 0x68], eax
mov ecx, dword [ebx + 0x88]
mov edx, dword [ecx + 0x10]
push edx
call fcn.005e639f
lea eax, [eax + eax + 0x14]
push eax
call fcn.005feedc
mov esi, eax
add esp, 8
test esi, esi
mov dword [ebp - 0x18], esi
jne 0x54a226
mov ecx, edi
call fcn.0054bc60
push edi
call fcn.005fef05
add esp, 4
jmp 0x54a5a4
mov edx, dword [ebx + 0x94]
mov ecx, dword [ebx + 0x98]
inc edx
mov eax, edx
mov dword [ebx + 0x94], edx
cmp ecx, eax
jge 0x54a245
mov dword [ebx + 0x98], eax
mov dword [edi + 0x60], eax
mov edx, dword [ebx + 0x88]
mov ecx, dword [ebx + 0x94]
mov eax, dword [edx + 0x10]
push ecx
push eax
push str._s_d
push esi
call fcn.005e72e7
add esp, 0x10
mov ecx, edi
push esi
call fcn.0054bcf0
test eax, eax
je 0x54a291
mov ecx, edi
call fcn.0054bc60
push edi
call fcn.005fef05
add esp, 4
push esi
call fcn.005fef05
add esp, 4
jmp 0x54a5a4
push 0
push 0
push 3
push 0
push 1
push bind
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x1c], eax
je 0x54a358
lea ecx, [ebp - 0x80]
mov edx, eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
mov dword [ebp - 0x20], 0
cmp esi, 0xffffffff
jne 0x54a306
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x54a306
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x54a306
push eax
lea eax, [ebp - 0x14]
push str.Error_during_GetFileSize____errcode___ld._n
push eax
call fcn.005fb90b
mov ecx, dword [ebp - 0x14]
add esp, 0xc
push ecx
mov ecx, ebx
call fcn.00541a30
xor esi, esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
jmp 0x54a322
mov edx, dword [ebp - 0x80]
push 1
push 0
push 0
push edx
call fcn.005e8c50
add esi, eax
mov eax, dword [ebp - 0x20]
adc eax, edx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or esi, dword [ebp - 0x20]
je 0x54a384
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0xb0]
mov eax, dword [eax + 0x24]
cmp eax, 1
je 0x54a34b
cmp eax, 2
je 0x54a34b
test eax, eax
jne 0x54a3bd
mov ecx, dword [ebp - 0x18]
push ecx
mov ecx, esi
call fcn.0054e0e0
jmp 0x54a393
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
lea ecx, [ebp - 0x14]
push str.Error_opening_file__ls_to_get_size__errcode___ld._n
push ecx
call fcn.005fb90b
mov edx, dword [ebp - 0x14]
add esp, 0x10
mov ecx, ebx
push edx
call fcn.00541a30
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 0x18]
push eax
lea ecx, [esi + 0x10]
call fcn.00554e50
test eax, eax
je 0x54a3cb
mov esi, dword [ebp - 0x18]
push eax
push esi
lea ecx, [ebp - 0x14]
push str.Error_opening_file__ls__errcode___ld._n
push ecx
call fcn.005fb90b
mov edx, dword [ebp - 0x14]
add esp, 0x10
mov ecx, ebx
push edx
call fcn.00541a30
jmp 0x54a273
mov edx, dword [ebp - 0x18]
lea ecx, [esi + 0x10]
push edx
call fcn.00555020
jmp 0x54a393
mov dword [edi], esi
mov eax, dword [esi + 0xb0]
mov eax, dword [eax + 0x24]
cmp eax, 4
je 0x54a3f8
cmp eax, 5
je 0x54a3f8
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
add ecx, edx
mov edx, dword [ebp - 0x30]
mov dword [esi + 0x50], ecx
adc edx, eax
mov dword [esi + 0x54], edx
jmp 0x54a415
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x24]
mov dword [edi + 0x1c], eax
mov eax, dword [ebp - 0x30]
mov ecx, eax
mov dword [edi + 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [esi + 0x50], edx
sar ecx, 0x1f
mov dword [esi + 0x54], eax
mov eax, dword [ebp - 0x38]
cmp eax, 0xffffffff
jne 0x54a4da
mov ecx, dword [ebx + 0x98]
mov dword [ebx + 0xcc], 0
mov dword [ebx + 0x94], ecx
mov edx, dword [esi + 0xb0]
mov byte [ebp + 0xb], 0
mov eax, dword [edx + 0x24]
cmp eax, 4
je 0x54a44e
cmp eax, 5
jne 0x54a495
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x78]
push eax
push str._dkf
push ecx
call fcn.005e6db3
add esp, 0xc
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x68]
lea ecx, [ebp - 0x78]
push edx
mov edx, dword [ebx + 0xdc]
push eax
push 0
push 0
push ecx
push edx
mov dword [ebp - 0x1c], 0x10
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x54a495
cmp dword [ebp - 0x60], 0xffffffff
jne 0x54a495
mov byte [ebp + 0xb], 1
mov eax, dword [ebx + 0x88]
mov edx, dword [esi + 0x50]
mov ecx, dword [eax]
mov eax, dword [ecx + 0x48]
cmp edx, eax
mov ecx, dword [ecx + 0x4c]
jne 0x54a4b1
mov edx, dword [esi + 0x54]
cmp edx, ecx
je 0x54a4c9
mov dl, byte [ebp + 0xb]
test dl, dl
jne 0x54a4c9
sub eax, 1
sbb ecx, 0
mov dword [esi + 0x60], eax
mov dword [esi + 0x64], ecx
jmp 0x54a77b
push str.The_last_chunk_is_full._n
mov ecx, ebx
call fcn.00541a30
jmp 0x54a568
push eax
lea ecx, [ebp - 0x44]
push 0x6a00e4
push ecx
call fcn.005e6db3
add esp, 0xc
lea edx, [ebp - 0x48]
lea eax, [ebp - 0x3c]
lea ecx, [ebp - 0x44]
push edx
mov edx, dword [ebx + 0xdc]
push eax
push 0
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x54a5c5
push eax
lea eax, [ebp - 0x14]
push str.error_reading_registry__d_n
push eax
call fcn.005fb90b
mov ecx, dword [ebp - 0x14]
add esp, 0xc
push ecx
mov ecx, ebx
call fcn.00541a30
mov edx, dword [ebx + 0x98]
mov eax, dword [ebx + 0x88]
mov dword [ebx + 0xcc], 0
mov dword [ebx + 0x94], edx
mov ecx, dword [eax]
mov edx, dword [esi + 0x50]
mov eax, dword [ecx + 0x48]
cmp edx, eax
mov ecx, dword [ecx + 0x4c]
jne 0x54a4b8
mov edx, dword [esi + 0x54]
cmp edx, ecx
jne 0x54a4b8
mov eax, dword [ebp - 0x18]
push eax
call fcn.005fef05
mov ecx, dword [ebx + 0x8c]
add esp, 4
mov edx, dword [ecx + 0x58]
lea ecx, [esi + 0x10]
mov dword [edi + 0x58], edx
mov eax, dword [ebx + 0x8c]
mov dword [eax + 0x58], edi
mov dword [ebx + 0x8c], edi
mov dword [edi + 0x14], 1
call fcn.00554e30
mov dword [edi], 0
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0
call fcn.00602ad6
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
mov edx, ecx
sub edx, 1
mov dword [esi + 0x60], edx
mov edx, dword [ebp - 0x3c]
sbb eax, 0
dec edx
mov dword [esi + 0x64], eax
mov dword [ebx + 0x94], edx
mov eax, dword [esi + 0xb0]
mov eax, dword [eax + 0x24]
cmp eax, 4
je 0x54a5fa
cmp eax, 5
jne 0x54a77b
mov dword [edi + 0x20], ecx
mov ecx, dword [ebp - 0x3c]
mov dword [edi + 0x28], ecx
mov eax, dword [ebp - 0x3c]
lea edx, [ebp - 0xc0]
push 0xa
push edx
push eax
call fcn.005e7a52
mov ecx, dword [ebx + 0x88]
mov dword [ebp - 0x1c], eax
add esp, 0xc
lea eax, [edi + 0x2c]
mov edx, dword [ecx + 0x10]
mov ecx, 0x6a012c
test ecx, ecx
mov dword [ebp + 8], edx
mov dword [ebp - 0x28], eax
je 0x54a77b
mov eax, edx
test eax, eax
je 0x54a77b
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x54a77b
xor edi, edi
push edi
push ecx
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x6c], edi
mov word [ebp - 0x70], di
call fcn.00402e00
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x64]
push edx
mov byte [ebp - 4], 3
mov dword [ebp - 0x64], edi
mov dword [ebp - 0x5c], edi
mov word [ebp - 0x60], di
call fcn.00402410
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x54]
push eax
mov byte [ebp - 4], 4
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x4c], edi
mov word [ebp - 0x50], di
call fcn.00402410
mov ecx, dword [ebp - 0x28]
mov byte [ebp - 4], 5
call fcn.00401070
mov eax, dword [ebp - 0x64]
cmp eax, edi
jne 0x54a6af
lea eax, [ebp - 0x60]
mov ecx, dword [ebp - 0x54]
cmp ecx, edi
mov edi, ecx
jne 0x54a6bb
lea edi, [ebp - 0x50]
mov ecx, dword [ebp - 0x6c]
push eax
mov dword [ebp + 8], ecx
call fcn.005e639f
mov edx, eax
push edi
mov dword [ebp - 0x28], edx
call fcn.005e639f
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x28]
add ecx, edx
lea eax, [eax + ecx + 3]
mov dword [ebp - 0x28], eax
add eax, eax
push eax
mov dword [ebp + 8], eax
call fcn.005feedc
mov edi, dword [ebp - 0x2c]
mov edx, eax
add esp, 0xc
test edx, edx
mov dword [edi + 0x2c], edx
je 0x54a757
mov ecx, dword [ebp + 8]
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebp - 0x54]
test eax, eax
mov edx, eax
jne 0x54a71c
lea edx, [ebp - 0x50]
mov ecx, dword [ebp - 0x64]
test ecx, ecx
jne 0x54a726
lea ecx, [ebp - 0x60]
mov eax, dword [ebp - 0x74]
test eax, eax
jne 0x54a730
lea eax, [ebp - 0x70]
push edx
push ecx
mov ecx, dword [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x28]
mov edx, dword [ecx + 0x2c]
lea edi, [ecx + 0x2c]
push eax
push edx
call fcn.005e632f
mov eax, dword [edi]
push eax
call fcn.005e639f
mov dword [edi + 8], eax
mov edi, dword [ebp - 0x2c]
add esp, 0x18
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 4
call fcn.00401070
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 3
call fcn.00401070
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 1
call fcn.00401070
xor eax, eax
mov dword [esi + 0x68], eax
mov dword [esi + 0x6c], eax
mov ecx, dword [edi + 0x20]
mov eax, dword [esi + 0x94]
mov edx, dword [edi + 0x1c]
push ecx
mov ecx, dword [eax + 4]
push edx
push ecx
mov ecx, dword [esi + 0x60]
mov edx, dword [eax]
mov eax, dword [esi + 0x64]
push edx
mov edx, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x24]
push ecx
mov ecx, dword [ebp - 0x18]
push edx
mov edx, dword [edi]
push eax
push ecx
mov eax, dword [edx + 0x54]
push eax
lea eax, [ebp - 0x14]
mov ecx, dword [edx + 0x50]
mov edx, dword [edi + 0x60]
push ecx
push edx
push str.new_listitem_id_d__startpos_I64d__file__ls___ndwnl_I64d__endpos_I64d__ttdwnl_I64d_nsttm_ld__etm_ld_n
push eax
call fcn.005fb90b
mov ecx, dword [ebp - 0x14]
add esp, 0x38
push ecx
mov ecx, ebx
call fcn.00541a30
mov edx, dword [ebp - 0x18]
push edx
call fcn.005fef05
mov eax, dword [ebx + 0x8c]
add esp, 4
mov ecx, dword [eax + 0x58]
mov eax, dword [ebp - 0x58]
mov dword [edi + 0x58], ecx
mov edx, dword [ebx + 0x8c]
cmp eax, 0xffffffff
mov dword [edx + 0x58], edi
mov dword [esi + 0x90], edi
mov dword [ebx + 0x8c], edi
je 0x54a814
push eax
push edi
mov ecx, ebx
call fcn.0054a9f0
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0
call fcn.00602ad6
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4