Function at 0x4673f0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ab493
mov eax, dword fs:[0]
push eax
sub esp, 0x670
mov eax, dword [0x4de880]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x674], ecx
mov ax, word [0x4b79b4]
mov word [ebp - 0x634], ax
push 0x206
push 0
lea ecx, [ebp - 0x632]
push ecx
call fcn.0043ff60
add esp, 0xc
mov dx, word [0x4b79b8]
mov word [ebp - 0x424], dx
push 0x206
push 0
lea eax, [ebp - 0x422]
push eax
call fcn.0043ff60
add esp, 0xc
push 0x207
lea ecx, [ebp - 0x634]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
lea edx, [ebp - 0x634]
push edx
call fcn.0041b430
add esp, 8
lea ecx, [ebp - 0x634]
sub eax, ecx
sar eax, 1
push eax
lea edx, [ebp - 0x634]
push edx
lea eax, [ebp - 0x424]
push eax
call fcn.004449a0
add esp, 0xc
lea ecx, [ebp - 0x424]
push ecx
call fcn.0043fc6b
add esp, 4
mov word [ebp + eax*2 - 0x424], 0
push str._avt.db
lea edx, [ebp - 0x424]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0
push 0
push 3
push 0
push 1
push SysReAllocStringLen
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x428], eax
mov dword [ebp - 0x42c], 0
cmp dword [ebp - 0x428], 0xffffffff
je 0x46765e
push 0
mov ecx, dword [ebp - 0x428]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x638], eax
mov dword [ebp - 0x63c], 0
mov dword [ebp - 0x65c], 0
cmp dword [ebp - 0x638], 0
jbe 0x4675a4
mov edx, dword [ebp - 0x638]
add edx, 1
push edx
call fcn.00422e0b
add esp, 4
mov dword [ebp - 0x664], eax
mov eax, dword [ebp - 0x664]
mov dword [ebp - 0x42c], eax
mov ecx, dword [ebp - 0x638]
push ecx
push 0
mov edx, dword [ebp - 0x42c]
push edx
call fcn.0043ff60
add esp, 0xc
push 0
lea eax, [ebp - 0x63c]
push eax
mov ecx, dword [ebp - 0x638]
push ecx
mov edx, dword [ebp - 0x42c]
push edx
mov eax, dword [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 0x428]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x638]
cmp edx, dword [ebp - 0x63c]
je 0x4675c4
jmp 0x4676d9
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x668], esp
push 0x4b79cc
call fcn.004021a0
mov dword [ebp - 0x678], eax
lea ecx, [ebp - 0x658]
call fcn.00406570
mov dword [ebp - 0x67c], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x674]
add eax, 0x48
push eax
mov ecx, dword [ebp - 0x638]
push ecx
mov edx, dword [ebp - 0x42c]
push edx
lea ecx, [ebp - 0x658]
call fcn.004a4750
mov dword [ebp - 0x65c], eax
cmp dword [ebp - 0x65c], 0
je 0x46764c
push 0
mov ecx, dword [ebp - 0x674]
add ecx, 0x48
call fcn.00406350
mov ecx, dword [ebp - 0x674]
mov dword [ecx + 0x58], eax
mov ecx, 0x4e4710
call fcn.0041af40
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x658]
call fcn.00406550
mov ecx, 0x4e4710
call fcn.00406730
movzx edx, al
test edx, edx
jne 0x4676bb
push 0x1fa0
call fcn.00422e0b
add esp, 4
mov dword [ebp - 0x66c], eax
mov eax, dword [ebp - 0x66c]
mov dword [ebp - 0x660], eax
push str.HOTSPOT_WINDIR_Test_r_nHOTSPOT_WINDIR_past_FP_check_r_nHOTSPOT_WINDIR__r_nHOTSPOT_WINDIR_Web_r_nHOTSPOT_WINDIR_Media_r_nHOTSPOT_WINDIR_Help_r_nHOTSPOT_WINDIR_Fonts_r_nHOTSPOT_WINDIR_Tasks_r_nHOTSPOT_WINDIR_Debug_r_nHOTSPOT_WINDIR_System_r_nHOTSPOT_WINDIR_Display_r_nHOTSPOT_WINDIR_DebugUserMode_r_nHOTSPOT_WINDIR_Downloaded_Program_Files__REC2_r_nHOTSPOT_SYSDIR__r_nHOTSPOT_SYSDIR_MsDts_r_nHOTSPOT_SYSDIR_Com_r_nHOTSPOT_SYSDIR_Inf_r_nHOTSPOT_SYSDIR_oobe_r_nHOTSPOT_SYSDIR_wins_r_nHOTSPOT_SYSDIR_Wbem_r_nHOTSPOT_SYSDIR_Config_r_nHOTSPOT_SYSDIR__service_r_nHOTSPOT_SYSDIR_ShellExt_r_nHOTSPOT_SYSDIR_Drivers_r_nHOTSPOT_SYSDIR_Driversetc_r_nHOTSPOT_SYSDIR_KazaaBackupFiles_r_nHOTSPOT_SYSDIR_ConfigSystemProfile_r_nHOTSPOT_SYSDIR_ConfigSystemProfileApplication_Data_r_nHOTSPOT_SYSDIR_Config_systemprofileStart_MenuProgramsStartup_r_nHOTSPOT_ROOTDRIVE__r_nHOTSPOT_ROOTDRIVE_Temp_r_nHOTSPOT_ROOTDRIVE_Temps_r_nHOTSPOT_ROOTDRIVE_Downloads_r_nHOTSPOT_ROOTDRIVE_Recycler__REC2_r_nHOTSPOT_ROOTDRIVE_Backup_Drivers_r_nHOTSPOT_ROOTDRIVE_My_Downloads_r_nHOTSPOT_TEMP___REC3_r_nHOTSPOT_USERROOT__r_nHOTSPOT_USERROOT_DocumentsSettings_r_nHOTSPOT_USERROOT_Local_Settings_r_nHOTSPOT_USERROOT_Local_SettingsApplication_Data_r_nHOTSPOT_USERROOT_Local_SettingsApplication_DataMicrosoftInternet_Explorer_r_nHOTSPOT_USERROOT_Local_SettingsTemporary_Internet_Files__REC2_r_nHOTSPOT_APPDATA__r_nHOTSPOT_APPDATA_Microsoft_r_nHOTSPOT_APPDATA_MicrosoftDr_Watson_r_nHOTSPOT_APPDATA_MicrosoftOfficeSystem_r_nHOTSPOT_APPDATA_MicrosoftPCTools_r_nHOTSPOT_APPDATA_MicrosoftWindows_r_nHOTSPOT_APPDATA_MicrosoftDtsc_r_nHOTSPOT_COMMONFILES__r_nHOTSPOT_COMMONFILES_System_r_nHOTSPOT_COMMONFILES_Plugin_r_nHOTSPOT_COMMONFILES_Companion_Wizard_r_nHOTSPOT_COMMONFILES_Microsoft_Shared_r_nHOTSPOT_COMMONFILES_Microsoft_SharedHTMLView_r_nHOTSPOT_COMMONFILES_Microsoft_SharedMSInfo_r_nHOTSPOT_COMMONFILES_Microsoft_SharedSystem_r_nHOTSPOT_COMMONFILES_Microsoft_SharedWeb_Folders_r_nHOTSPOT_PROGRAMFILES__r_nHOTSPOT_PROGRAMFILES_NetMeeting_r_nHOTSPOT_PROGRAMFILES_Microsoft_OfficeSystem_r_nHOTSPOT_PROGRAMFILES_Windows_NT_r_nHOTSPOT_PROGRAMFILES_Windows_Media_Player_r_nHOTSPOT_PROGRAMFILES_Outlook_r_nHOTSPOT_PROGRAMFILES_outlook_Express_r_nHOTSPOT_PROGRAMFILES_Mozilla_Firefox_r_nHOTSPOT_PROGRAMFILES_Mozilla_FirefoxComponents_r_nHOTSPOT_PROGRAMFILES_Mozilla_FirefoxPlugins_r_nHOTSPOT_PROGRAMFILES_Internet_Explorer_r_nHOTSPOT_PROGRAMFILES_Internet_ExplorerPlugins_r_nHOTSPOT_APPDATA_MozillaFirefoxProfilesmain_r_nHOTSPOT_DAS__r_nHOTSPOT_DESKTOP__r_nHOTSPOT_STARTMENU_ProgramsStartup
mov ecx, dword [ebp - 0x660]
push ecx
call fcn.00440120
add esp, 8
mov edx, dword [ebp - 0x674]
mov eax, dword [ebp - 0x660]
mov dword [edx + 0x58], eax
mov ecx, 0x4e4710
call fcn.0041af40
mov ecx, dword [ebp - 0x674]
mov edx, dword [ecx + 0x58]
push edx
mov ecx, 0x4e4710
call fcn.0041aee0
mov ecx, 0x4e4710
call fcn.00477260
cmp dword [ebp - 0x42c], 0
je 0x4676fd
mov eax, dword [ebp - 0x42c]
mov dword [ebp - 0x670], eax
mov ecx, dword [ebp - 0x670]
push ecx
call fcn.00422e10
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043f9e9
mov esp, ebp
pop ebp
ret