Function at 0x47d170
Capabilities:
Get file size
Query or enumerate registry key
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5f9219
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xbc
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x38], esi
call fcn.0047cee0
mov eax, dword [0x6c826c]
mov dword [esp + 0x24], eax
mov ecx, dword [esi + 0x24c]
xor ebx, ebx
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x60], ebx
mov edx, dword [ecx + 0x468]
lea eax, [esp + 0x24]
push edx
push str.SoftwareDownloadManager_ld
push eax
mov dword [esp + 0xe0], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
call fcn.005d809b
add esp, 0xc
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x74]
lea edx, [esp + 0x14]
push ecx
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push edx
push ebx
push 0xf003f
push ebx
push 0x6cc7b8
push ebx
push eax
push reloc.WS2_32.dll_accept
call ebp
test eax, eax
jne 0x47d99b
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push ebx
lea edx, [esp + 0x1c]
push ebx
mov eax, dword [esp + 0x1c]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x47d99b
mov ecx, dword [esp + 0x18]
inc ecx
push ecx
call fcn.005db66d
mov edi, eax
add esp, 4
cmp edi, ebx
mov dword [esp + 0x40], edi
jne 0x47d267
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x47d99b
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
push edi
push ebx
push ebx
push 0x6a5058
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x47d29c
push edi
call fcn.005db696
mov edx, dword [esp + 0x18]
add esp, 4
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x47d99b
mov eax, dword [0x6c826c]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
lea edx, [esp + 0x44]
push ecx
push edx
push ebx
push ebx
push str.TPswitch
push eax
mov byte [esp + 0xec], 1
mov esi, 1
mov dword [esp + 0x30], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x47d2de
mov esi, dword [esp + 0x44]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
lea edx, [esp + 0x44]
push ecx
push edx
push ebx
push ebx
push str.nAggrV
push eax
mov byte [esp + 0x37], bl
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x47d30b
cmp dword [esp + 0x44], ebx
setne byte [esp + 0x1f]
cmp esi, 4
je 0x47d39d
cmp esi, 5
je 0x47d39d
cmp byte [esp + 0x1f], bl
jne 0x47d39d
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
lea edx, [esp + 0x5c]
push ecx
push edx
push ebx
push ebx
push str.FileSize
push eax
mov dword [esp + 0x30], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x47d364
push edi
call fcn.005db696
mov ecx, dword [esp + 0x18]
add esp, 4
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x47d98b
mov eax, dword [esp + 0x5c]
mov ecx, dword [esp + 0x60]
mov edx, eax
or edx, ecx
jne 0x47d38b
push edi
call fcn.005db696
mov eax, dword [esp + 0x18]
add esp, 4
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x47d98b
mov edx, dword [esp + 0x38]
mov dword [edx + 0x230], eax
mov dword [edx + 0x234], ecx
jmp 0x47d405
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
lea edx, [esp + 0x48]
push ecx
push edx
push ebx
push ebx
push str.Duration
push eax
mov dword [esp + 0x30], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x47d3de
push edi
call fcn.005db696
mov ecx, dword [esp + 0x18]
add esp, 4
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x47d98b
fld qword [esp + 0x48]
fmul qword [0x61ac38]
call fcn.005c3128
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], edx
mov dword [ecx + 0x230], eax
mov dword [ecx + 0x234], edx
lea edx, [esp + 0x74]
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x30]
push edx
push eax
push ebx
push 0xf003f
push ebx
push 0x6cc7b8
push ebx
push str.ChList
push ecx
call ebp
test eax, eax
je 0x47d445
push edi
call fcn.005db696
mov edx, dword [esp + 0x18]
add esp, 4
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x47d98b
cmp esi, 4
je 0x47d7c1
cmp esi, 5
je 0x47d7c1
cmp byte [esp + 0x1f], bl
je 0x47d580
lea ecx, [esp + 0x90]
call fcn.0053b010
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x90]
push eax
mov byte [esp + 0xd8], 2
call fcn.0053b5a0
mov ebp, dword [esp + 0xb0]
cmp ebp, ebx
je 0x47d567
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
cmp dword [ebp + 0x24], ebx
je 0x47d4c2
fld qword [ebp + 8]
fmul qword [0x61ac48]
call fcn.005c3128
or esi, 0xffffffff
mov edi, 0xffffffff
sub esi, eax
sbb edi, edx
jmp 0x47d4c9
mov esi, 1
xor edi, edi
mov eax, dword [ebp + 0x18]
push 0x18
cmp eax, 1
jne 0x47d501
call fcn.005db66d
add esp, 4
cmp eax, ebx
je 0x47d4ef
mov dword [eax], ebx
mov dword [eax + 8], esi
mov dword [eax + 0x10], ebx
mov dword [eax + 4], ebx
mov dword [eax + 0xc], edi
jmp 0x47d4f1
xor eax, eax
mov ecx, dword [esp + 0x38]
cmp eax, ebx
mov dword [ecx + 0x250], eax
je 0x47d567
jmp 0x47d536
call fcn.005db66d
add esp, 4
cmp eax, ebx
je 0x47d529
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
add esi, ecx
mov dword [eax], ecx
adc edi, edx
mov dword [eax + 8], esi
mov dword [eax + 0x10], ebx
mov dword [eax + 4], edx
mov dword [eax + 0xc], edi
jmp 0x47d52b
xor eax, eax
mov edx, dword [esp + 0x20]
cmp eax, ebx
mov dword [edx + 0x10], eax
je 0x47d567
fld qword [ebp + 8]
fmul qword [0x61ac38]
mov dword [esp + 0x20], eax
call fcn.005c3128
mov esi, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov ebp, dword [ebp]
add esi, eax
adc ecx, edx
cmp ebp, ebx
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], ecx
jne 0x47d4a1
lea ecx, [esp + 0x90]
mov byte [esp + 0xd4], 1
call fcn.0053b060
jmp 0x47d962
mov edx, dword [esp + 0x30]
lea eax, [esp + 0x18]
lea ecx, [esp + 0x64]
push eax
push ecx
push ebx
push ebx
mov esi, 0x10
push 0x6a5020
push edx
mov dword [esp + 0x30], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x47d962
mov eax, dword [esp + 0x40]
push ebx
push ebx
push 3
push ebx
push 3
push connect
mov dword [esp + 0x30], esi
push eax
xor esi, esi
xor edi, edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x47d61b
lea ecx, [esp + 0x34]
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x47d5f4
cmp edi, ebx
jne 0x47d5f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jne 0x47d606
mov edx, dword [esp + 0x34]
push 1
push ebx
push ebx
push edx
call fcn.005c5530
add esi, eax
adc edi, edx
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, ebx
jg 0x47d61b
jl 0x47d617
cmp esi, ebx
jae 0x47d61b
xor esi, esi
xor edi, edi
push 0x18
call fcn.005db66d
add esp, 4
cmp eax, ebx
je 0x47d63e
sub esi, 1
mov dword [eax], ebx
sbb edi, ebx
mov dword [eax + 8], esi
mov dword [eax + 0x10], ebx
mov dword [eax + 4], ebx
mov dword [eax + 0xc], edi
jmp 0x47d640
xor eax, eax
mov ecx, dword [esp + 0x38]
cmp eax, ebx
mov dword [ecx + 0x250], eax
je 0x47d962
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x68]
cmp eax, 0xffffffff
je 0x47d962
push eax
lea edx, [esp + 0x7c]
push 0x6a0974
push edx
call fcn.005c3648
add esp, 0xc
lea eax, [esp + 0x18]
lea ecx, [esp + 0x64]
lea edx, [esp + 0x78]
push eax
mov eax, dword [esp + 0x34]
push ecx
push ebx
push ebx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x47d962
mov ecx, dword [0x6c826c]
mov dword [esp + 0x20], ecx
mov edx, dword [esp + 0x64]
mov eax, dword [esp + 0x40]
push edx
push eax
lea ecx, [esp + 0x28]
push str._s_ld
push ecx
mov byte [esp + 0xe4], 3
call fcn.005d809b
mov edx, dword [esp + 0x30]
add esp, 0x10
push ebx
push ebx
push 3
push ebx
push 3
push connect
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x47d775
lea eax, [esp + 0x34]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
xor ebp, ebp
cmp esi, 0xffffffff
jne 0x47d70d
cmp ebp, ebx
jne 0x47d70d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jne 0x47d78b
mov ecx, dword [esp + 0x34]
push 1
push ebx
push ebx
push ecx
call fcn.005c5530
add esi, eax
push edi
adc ebp, edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x18
mov dword [esp + 0xd8], 3
call fcn.005db66d
add esp, 4
cmp eax, ebx
je 0x47d764
mov edi, dword [esp + 0x6c]
mov ecx, edi
add ecx, esi
mov esi, dword [esp + 0x70]
mov edx, esi
mov dword [eax], edi
adc edx, ebp
sub ecx, 1
sbb edx, ebx
mov dword [eax + 8], ecx
mov dword [eax + 0x10], ebx
mov dword [eax + 4], esi
mov dword [eax + 0xc], edx
jmp 0x47d766
xor eax, eax
mov edx, dword [esp + 0x28]
cmp eax, ebx
mov dword [edx + 0x10], eax
je 0x47d7ab
mov dword [esp + 0x28], eax
lea ecx, [esp + 0x20]
mov byte [esp + 0xd4], 1
call fcn.005df266
jmp 0x47d656
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x20]
mov dword [esp + 0xd4], 1
call fcn.005df266
jmp 0x47d962
lea ecx, [esp + 0x20]
mov byte [esp + 0xd4], 1
call fcn.005df266
jmp 0x47d962
mov edx, dword [esp + 0x30]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x18]
lea ecx, [esp + 0x48]
push eax
push ecx
push ebx
push ebx
push 0x6a5020
push edx
mov dword [esp + 0x30], 0x10
call ebp
test eax, eax
je 0x47d80d
push edi
call fcn.005db696
mov eax, dword [esp + 0x18]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 4
push eax
call esi
mov ecx, dword [esp + 0x30]
push ecx
call esi
jmp 0x47d98b
mov dword [esp + 0x34], ebx
mov edx, dword [esp + 0x48]
lea eax, [esp + 0x78]
push edx
push str._dkf
push eax
xor esi, esi
xor edi, edi
call fcn.005c3648
add esp, 0xc
lea ecx, [esp + 0x20]
lea edx, [esp + 0x64]
lea eax, [esp + 0x78]
push ecx
mov ecx, dword [esp + 0x34]
push edx
push ebx
push ebx
push eax
push ecx
mov dword [esp + 0x38], 0x10
call ebp
cmp eax, ebx
jne 0x47d891
mov eax, dword [esp + 0x6c]
cmp eax, 0xffffffff
jne 0x47d87f
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x2c]
cmp ecx, eax
mov ecx, dword [esp + 0x50]
jl 0x47d891
jg 0x47d871
cmp dword [esp + 0x28], ecx
jbe 0x47d891
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
sub esi, ecx
sbb edi, eax
jmp 0x47d891
mov ecx, dword [esp + 0x50]
cmp eax, ecx
jbe 0x47d88d
sub eax, ecx
mov esi, eax
jmp 0x47d88f
xor esi, esi
xor edi, edi
mov eax, dword [esp + 0x48]
push 0x18
cmp eax, ebx
jne 0x47d8d2
call fcn.005db66d
add esp, 4
cmp eax, ebx
je 0x47d8bc
sub esi, 1
mov dword [eax], ebx
sbb edi, ebx
mov dword [eax + 8], esi
mov dword [eax + 0x10], ebx
mov dword [eax + 4], ebx
mov dword [eax + 0xc], edi
jmp 0x47d8be
xor eax, eax
mov edx, dword [esp + 0x38]
cmp eax, ebx
mov dword [edx + 0x250], eax
je 0x47d962
jmp 0x47d914
call fcn.005db66d
add esp, 4
cmp eax, ebx
je 0x47d907
mov ebp, dword [esp + 0x50]
mov edx, ebx
mov ecx, ebp
mov dword [eax], ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add ecx, esi
adc edx, edi
sub ecx, 1
sbb edx, ebx
mov esi, ebx
mov dword [eax + 8], ecx
mov dword [eax + 0x10], ebx
mov dword [eax + 4], esi
mov dword [eax + 0xc], edx
jmp 0x47d909
xor eax, eax
mov ecx, dword [esp + 0x34]
cmp eax, ebx
mov dword [ecx + 0x10], eax
je 0x47d962
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x4c]
cmp eax, 0xffffffff
je 0x47d962
push eax
lea edx, [esp + 0x84]
push 0x6a0974
push edx
call fcn.005c3648
add esp, 0xc
lea eax, [esp + 0x20]
lea ecx, [esp + 0x48]
lea edx, [esp + 0x80]
push eax
mov eax, dword [esp + 0x34]
push ecx
push ebx
push ebx
push edx
push eax
mov dword [esp + 0x38], 0x10
call ebp
cmp eax, ebx
je 0x47d811
mov ecx, dword [esp + 0x40]
push ecx
call fcn.005db696
mov edx, dword [esp + 0x34]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 4
push edx
call esi
mov eax, dword [esp + 0x14]
push eax
call esi
mov ecx, dword [esp + 0x38]
mov byte [ecx + 0xc], 1
lea ecx, [esp + 0x3c]
mov byte [esp + 0xd4], bl
call fcn.005df266
lea ecx, [esp + 0x24]
mov dword [esp + 0xd4], 0xffffffff
call fcn.005df266
mov ecx, dword [esp + 0xcc]
pop edi
mov dword fs:[0], ecx
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret