Function at 0x5c6170
Capabilities:
Get file size
Query or enumerate registry value
Read file on windows
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x652a58
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x1950
call fcn.00609d40
push ebx
mov ebx, ecx
push esi
push edi
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x28], ebx
mov dword [ebp - 4], 0
mov eax, dword [ecx + 0xe0]
test eax, eax
je 0x5c6914
mov edx, dword [ecx + 0x2fc]
test edx, edx
jne 0x5c6914
mov edx, dword [eax]
test edx, edx
je 0x5c6914
cmp dword [eax + 4], 0x800
jl 0x5c6914
mov ecx, 0x200
xor eax, eax
lea edi, [ebp - 0x958]
lea esi, [ebp - 0x958]
rep stosd dword es:[edi], eax
mov ecx, 0x200
mov edi, edx
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
je 0x5c6914
mov edi, dword [ebx + 0xb0]
test edi, edi
mov dword [ebp - 0x2c], edi
je 0x5c6214
mov edi, dword [edi + 0x58]
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x4c], edi
mov byte [ebp - 0x11], 0
test edi, edi
je 0x5c6580
mov ecx, dword [edi + 0x10]
push 0
push 0
push 3
push 0
push 3
push 0x80000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
mov dword [ebp - 0x18], esi
je 0x5c6575
lea edx, [ebp - 0x30]
mov dword [ebp - 0x30], 0
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
jne 0x5c626f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x5c6565
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x24]
push 0
push edx
mov ecx, dword [eax + 0xc]
push 0
push esi
mov dword [ebp - 0x24], 0
mov ebx, dword [ecx + 0xe0]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x5c6327
mov ecx, 0x200
xor eax, eax
lea edi, [ebp - 0x958]
push 0
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [ebp - 0x38]
lea ecx, [ebp - 0x958]
push eax
push 0x800
push ecx
push esi
mov dword [ebp - 0x38], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x5c6327
mov ecx, dword [ebp - 0x38]
test ecx, ecx
je 0x5c6327
mov esi, dword [ebx]
test esi, esi
je 0x5c6327
mov edi, dword [ebx + 8]
mov eax, dword [ebx + 4]
inc edi
cmp ecx, eax
mov dword [ebx + 8], edi
jge 0x5c62eb
mov eax, ecx
mov ecx, eax
lea edi, [ebp - 0x958]
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x5c6327
mov ecx, dword [ebx + 0xc]
test ecx, ecx
je 0x5c6305
cmp eax, 0x40
jge 0x5c630c
cmp eax, 0x200
jl 0x5c6312
inc ecx
mov dword [ebx + 0xc], ecx
jmp 0x5c6323
mov eax, dword [ebx + 8]
dec eax
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x38]
cmp eax, 0x104
jbe 0x5c6327
mov byte [ebp - 0x11], 1
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x54]
mov dword [ebp - 0x34], 0x10
mov ecx, dword [eax + 0x60]
push ecx
push 0x6c9150
push edx
call fcn.0060a593
add esp, 0xc
lea eax, [ebp - 0x34]
lea ecx, [ebp - 0x48]
lea edx, [ebp - 0x54]
push eax
mov eax, dword [ebp - 0x28]
push ecx
push 0
mov ecx, dword [eax + 0x104]
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x5c6565
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [eax + 8]
mov esi, dword [eax + 0xc]
mov eax, dword [ebp - 0x40]
cmp eax, edx
jne 0x5c6389
cmp ecx, esi
je 0x5c6460
cmp ecx, esi
jg 0x5c639d
jl 0x5c6393
cmp eax, edx
jae 0x5c639d
sub edx, eax
sbb esi, ecx
mov eax, edx
mov ecx, esi
jmp 0x5c63a1
sub eax, edx
sbb ecx, esi
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0x24]
push 0
mov edx, dword [edx + 0xc]
push ecx
push eax
mov ebx, dword [edx + 0xe0]
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x5c645a
mov ecx, 0x200
xor eax, eax
lea edi, [ebp - 0x1960]
mov edx, dword [ebp - 0x18]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [ebp - 0x1c]
push 0
push eax
lea ecx, [ebp - 0x1960]
push 0x800
push ecx
push edx
mov dword [ebp - 0x1c], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x5c645a
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x5c645a
mov esi, dword [ebx]
test esi, esi
je 0x5c645a
mov edi, dword [ebx + 8]
mov eax, dword [ebx + 4]
inc edi
cmp ecx, eax
mov dword [ebx + 8], edi
jge 0x5c641e
mov eax, ecx
mov ecx, eax
lea edi, [ebp - 0x1960]
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x5c645a
mov ecx, dword [ebx + 0xc]
test ecx, ecx
je 0x5c6438
cmp eax, 0x40
jge 0x5c643f
cmp eax, 0x200
jl 0x5c6445
inc ecx
mov dword [ebx + 0xc], ecx
jmp 0x5c6456
mov eax, dword [ebx + 8]
dec eax
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x1c]
cmp eax, 0x104
jbe 0x5c645a
mov byte [ebp - 0x11], 1
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x40]
mov edx, dword [ebp - 0x2c]
mov esi, dword [edx]
test esi, esi
je 0x5c6565
mov edx, dword [esi + 0x50]
mov esi, dword [esi + 0x54]
cmp eax, edx
jne 0x5c647f
cmp ecx, esi
je 0x5c6565
mov edi, dword [ebp - 0x2c]
mov ebx, dword [edi + 8]
cmp ebx, edx
jne 0x5c6494
mov edi, dword [edi + 0xc]
cmp edi, esi
je 0x5c6565
cmp ecx, esi
jg 0x5c64a8
jl 0x5c649e
cmp eax, edx
jae 0x5c64a8
sub edx, eax
sbb esi, ecx
mov eax, edx
mov ecx, esi
jmp 0x5c64ac
sub eax, edx
sbb ecx, esi
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0x24]
push 0
mov edx, dword [edx + 0xc]
push ecx
push eax
mov ebx, dword [edx + 0xe0]
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x5c6565
mov ecx, 0x200
xor eax, eax
lea edi, [ebp - 0x115c]
mov edx, dword [ebp - 0x18]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [ebp - 0x20]
push 0
push eax
lea ecx, [ebp - 0x115c]
push 0x800
push ecx
push edx
mov dword [ebp - 0x20], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x5c6565
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x5c6565
mov esi, dword [ebx]
test esi, esi
je 0x5c6565
mov edi, dword [ebx + 8]
mov eax, dword [ebx + 4]
inc edi
cmp ecx, eax
mov dword [ebx + 8], edi
jge 0x5c6529
mov eax, ecx
mov ecx, eax
lea edi, [ebp - 0x115c]
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x5c6565
mov ecx, dword [ebx + 0xc]
test ecx, ecx
je 0x5c6543
cmp eax, 0x40
jge 0x5c654a
cmp eax, 0x200
jl 0x5c6550
inc ecx
mov dword [ebx + 0xc], ecx
jmp 0x5c6561
mov eax, dword [ebx + 8]
dec eax
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x20]
cmp eax, 0x104
jbe 0x5c6565
mov byte [ebp - 0x11], 1
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x28]
mov edi, dword [edi + 0x58]
mov dword [ebp - 0x2c], edi
jmp 0x5c621b
mov eax, dword [ebx + 0xf4]
test eax, eax
je 0x5c6761
mov eax, dword [ebx + 0x238]
test eax, eax
je 0x5c65af
push eax
lea ecx, [ebp - 0x154]
push str.SoftwareDownloadManager_ldChList
push ecx
call fcn.0060a593
add esp, 0xc
jmp 0x5c65d1
mov edx, dword [ebx + 0x154]
mov eax, dword [ebx + 0x150]
push edx
push eax
lea ecx, [ebp - 0x154]
push str.SoftwareDownloadManagerGrabberStsProjects_ld_ldChList
push ecx
call fcn.0060a593
add esp, 0x10
xor esi, esi
cmp esi, 0xffffffff
je 0x5c6761
push esi
lea edx, [ebp - 0x54]
push 0x6c9150
push edx
call fcn.0060a593
add esp, 0xc
lea eax, [ebp - 0x34]
lea ecx, [ebp - 0x48]
lea edx, [ebp - 0x54]
push eax
mov eax, dword [ebx + 0x104]
push ecx
push 0
push 0
push edx
push eax
mov dword [ebp - 0x34], 0x10
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x5c6761
test esi, esi
je 0x5c6759
mov ecx, dword [ebx + 0xb0]
push esi
lea eax, [ebp - 0x568]
mov edx, dword [ecx + 0x10]
push edx
push str._s_d
push eax
call fcn.0060aac7
add esp, 0x10
lea ecx, [ebp - 0x568]
push 0
push 0
push 3
push 0
push 3
push 0x80000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x1c], eax
je 0x5c6759
lea edx, [ebp - 0x24]
mov dword [ebp - 0x24], 0
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
jne 0x5c668e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x5c674c
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x30]
push 0
push edx
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp - 0x1c]
push 0
push eax
mov ebx, dword [ecx + 0xe0]
mov dword [ebp - 0x30], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x5c674c
mov ecx, 0x200
xor eax, eax
lea edi, [ebp - 0x115c]
push 0
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x20]
lea edx, [ebp - 0x115c]
stosb byte es:[edi], al
mov eax, dword [ebp - 0x1c]
push ecx
push 0x800
push edx
push eax
mov dword [ebp - 0x20], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x5c674c
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x5c674c
mov esi, dword [ebx]
test esi, esi
je 0x5c674c
mov edi, dword [ebx + 8]
mov eax, dword [ebx + 4]
inc edi
cmp ecx, eax
mov dword [ebx + 8], edi
jge 0x5c6710
mov eax, ecx
mov ecx, eax
lea edi, [ebp - 0x115c]
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x5c674c
mov ecx, dword [ebx + 0xc]
test ecx, ecx
je 0x5c672a
cmp eax, 0x40
jge 0x5c6731
cmp eax, 0x200
jl 0x5c6737
inc ecx
mov dword [ebx + 0xc], ecx
jmp 0x5c6748
mov eax, dword [ebx + 8]
dec eax
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x20]
cmp eax, 0x104
jbe 0x5c674c
mov byte [ebp - 0x11], 1
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebp - 0x28]
mov esi, dword [ebp - 0x44]
jmp 0x5c65d3
mov al, byte [ebp - 0x11]
test al, al
je 0x5c6914
push str.Some_chunks_matched_with_start_of_file__Deleting_all__except_first._n
mov ecx, ebx
call fcn.005c4640
mov ecx, dword [0x6f7b78]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebx + 0xb0]
mov esi, dword [ebp - 0x4c]
xor edi, edi
mov byte [ebp - 4], 1
mov dword [edx + 0x58], edi
jmp 0x5c6797
xor edi, edi
cmp esi, edi
je 0x5c6852
mov ecx, dword [esi]
cmp ecx, edi
je 0x5c67aa
mov eax, dword [ecx]
call dword [eax + 0xc]
mov ecx, dword [esi + 0x10]
push ecx
call fcn.0060b6fb
add esp, 4
cmp eax, 0xffffffff
jne 0x5c67f4
mov edx, dword [esi + 0x10]
lea ecx, [ebp - 0x20]
push edx
call fcn.00622e4a
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x18]
push eax
push str.Could_not_delete_temp_file__s_n
push ecx
mov byte [ebp - 4], 2
call fcn.0061fae1
mov edx, dword [ebp - 0x18]
add esp, 0xc
mov ecx, ebx
push edx
call fcn.005c4640
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x20]
jmp 0x5c682b
mov eax, dword [esi + 0x10]
lea ecx, [ebp - 0x1c]
push eax
call fcn.00622e4a
mov ecx, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
push ecx
push str.Deleting_temp_file__s_n
push edx
mov byte [ebp - 4], 3
call fcn.0061fae1
mov eax, dword [ebp - 0x18]
add esp, 0xc
mov ecx, ebx
push eax
call fcn.005c4640
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.00622d8a
mov edi, esi
mov esi, dword [esi + 0x58]
test edi, edi
je 0x5c6795
mov ecx, edi
call fcn.005671a0
push edi
call fcn.00622af4
add esp, 4
jmp 0x5c6795
lea ecx, [ebx + 0x28]
call fcn.005652e0
mov eax, dword [ebx + 0x104]
cmp eax, edi
je 0x5c6888
lea ecx, [ebp - 0x48]
push 0x10
push ecx
push edi
push edi
push 0x6d1064
push eax
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x44], 0xffffffff
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebx + 0xb0]
mov dword [ebx + 0xc8], edi
cmp eax, edi
mov dword [ebx + 0xcc], edi
mov dword [ebx + 0xf4], edi
je 0x5c68f0
mov dword [eax + 0x58], edi
mov edx, dword [ebx + 0xb0]
mov edx, dword [edx]
cmp edx, edi
je 0x5c6908
mov eax, dword [edx + 0x4c]
mov ecx, dword [edx + 0x48]
cmp eax, edi
jl 0x5c68ca
jg 0x5c68c3
cmp ecx, edi
jbe 0x5c68ca
sub ecx, 1
sbb eax, edi
jmp 0x5c68ce
xor ecx, ecx
xor eax, eax
mov dword [edx + 0x60], ecx
mov dword [edx + 0x64], eax
mov eax, dword [ebx + 0xb0]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x68]
mov dword [ebx + 0x1c0], edx
mov eax, dword [ecx + 0x6c]
mov dword [ebx + 0x1c4], eax
jmp 0x5c6908
mov dword [ebx + 0x1c0], edi
mov dword [ebx + 0x188], edi
mov dword [ebx + 0x1c4], edi
mov dword [ebx + 0x18c], edi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0
call fcn.00622d8a
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret