Function at 0x43afd0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48b256
mov eax, dword fs:[0]
push eax
mov eax, 0x20074
call fcn.00473d00
mov eax, dword [0x4bc1dc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push 0
push 0
push 3
push 0
push 3
push connect
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
mov dword [ebp - 0x20030], ebx
cmp ebx, 0xffffffff
jne 0x43b032
xor al, al
jmp 0x43b251
push 0x4bda08
mov dword [ebp - 0x20058], 0x4bda08
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp - 0x20048]
mov dword [ebp - 4], 0
push eax
push ebx
mov dword [0x4bde30], 4
mov byte [ebp - 0x20025], 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
lea ecx, [ebp - 0x20025]
mov dword [ebp - 0x2004c], eax
push ecx
push 0
push 0x3e8
push dword [ebp - 0x20048]
push eax
call fcn.00473940
push eax
push str.Converting_boot_time_event_data
push esi
lea ecx, [ebp - 0x20080]
call fcn.0040c5c0
cmp byte [ebp - 0x20025], 0
xorps xmm0, xmm0
mov byte [ebp - 4], 1
movlpd qword [ebp - 0x2003c], xmm0
jne 0x43b224
mov eax, dword [ebp - 0x20038]
mov dword [ebp - 0x2002c], eax
mov eax, dword [ebp - 0x2003c]
mov dword [ebp - 0x20034], eax
jmp 0x43b0e0
push 0
push dword [0x4bde3c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x43b224
push 0
lea eax, [ebp - 0x20014]
push eax
push 0x20000
lea eax, [ebp - 0x20010]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x43b224
mov eax, dword [ebp - 0x20014]
test eax, eax
je 0x43b224
xor ebx, ebx
cmp eax, 0x34
jb 0x43b21e
lea edi, [ebp - 0x20010]
add edi, ebx
mov eax, dword [edi + 0x2c]
lea edx, [edi + 0x34]
movzx ecx, word [edi + 0x28]
lea esi, [eax + ecx*4]
sub esi, edi
add esi, edx
lea eax, [esi + ebx]
mov dword [ebp - 0x20038], eax
cmp eax, dword [ebp - 0x20014]
ja 0x43b1ab
push esi
push edi
call fcn.0043b6a0
mov eax, dword [ebp - 0x20034]
add esp, 8
mov ecx, dword [ebp - 0x2002c]
add eax, esi
mov dword [ebp - 0x20034], eax
adc ecx, 0
push 0
push 0x3e8
push ecx
push eax
mov dword [ebp - 0x2002c], ecx
call fcn.00473940
mov ebx, dword [ebp - 0x20038]
mov dword [ebp - 0x2007c], eax
mov eax, dword [ebp - 0x20014]
sub eax, ebx
cmp eax, 0x34
jae 0x43b133
test ebx, ebx
je 0x43b21e
push 0
mov ecx, 0x4bda08
call fcn.004185c0
sub ebx, dword [ebp - 0x20014]
lea ecx, [ebp - 0x20040]
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, ebx
mov ebx, dword [ebp - 0x20030]
push 1
cdq
push ecx
push eax
push ebx
mov dword [ebp - 0x20044], eax
mov dword [ebp - 0x20040], edx
call esi
push 1
lea eax, [ebp - 0x20050]
push eax
push 0
push ebx
call esi
cmp byte [ebp - 0x20025], 0
mov dword [ebp - 0x20034], eax
mov dword [ebp - 0x20054], eax
mov eax, dword [ebp - 0x20050]
mov dword [ebp - 0x2002c], eax
je 0x43b0e0
jmp 0x43b224
mov ebx, dword [ebp - 0x20030]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x20080]
mov dword [0x4bde30], 0
mov byte [ebp - 4], 0
call fcn.0040c710
push 0x4bda08
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00470e77
mov esp, ebp
pop ebp
ret