Function at 0x4112ca
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
sub esp, 0x618
lea ebp, [esp - 4]
mov eax, dword [0x62ece4]
xor eax, ebp
mov dword [ebp + 0x618], eax
push 0x1c
mov eax, 0x5adb16
call fcn.00499ab7
lea eax, [ebp - 0x14]
push 0x23
push eax
call fcn.0041d5e1
lea eax, [ebp - 0x14]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.0041d134
add esp, 0xc
push str.CrystalIdea_SoftwareUninstall_Tool
lea ecx, [ebp - 0x14]
call fcn.0040d0c0
lea eax, [ebp - 0x14]
push eax
call fcn.0041d134
lea ecx, [ebp - 0x14]
mov dword [esp], str.DisabledAutoruns.dat
call fcn.0040d0c0
push ebx
push 0x80
push 3
push ebx
push ebx
push SysReAllocString
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x1c], eax
cmp eax, 0xffffffff
je 0x411549
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp byte [0x643648], bl
je 0x41138b
mov eax, dword [0x643644]
cmp eax, ebx
je 0x41138b
push esi
push dword [ebp - 0x14]
push str.File_opened:__s__size:__u
push 0x209
push str.CAutoRunItemsRegLoader::LoadDisabled
push ebx
push eax
call fcn.00402740
add esp, 0x1c
xor edx, edx
mov eax, esi
mov ecx, 0x314
div ecx
test edx, edx
jne 0x411514
cmp esi, ebx
jbe 0x41153e
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0x208
lea eax, [ebp + 0x410]
push ebx
push eax
call fcn.0049af70
push 0x410
lea eax, [ebp]
push ebx
push eax
call fcn.0049af70
add esp, 0x18
push ebx
lea eax, [ebp - 0x18]
push eax
push 0x104
lea eax, [ebp + 0x410]
push eax
push dword [ebp - 0x1c]
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], ebx
call edi
sub esi, dword [ebp - 0x18]
push ebx
lea eax, [ebp - 0x18]
push eax
push 0x208
lea eax, [ebp]
push eax
push dword [ebp - 0x1c]
call edi
sub esi, dword [ebp - 0x18]
push ebx
lea eax, [ebp - 0x18]
push eax
push 4
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x1c]
call edi
sub esi, dword [ebp - 0x18]
push ebx
lea eax, [ebp - 0x18]
push eax
push 4
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x1c]
call edi
sub esi, dword [ebp - 0x18]
push 0x3c
call fcn.0047b2c8
pop ecx
mov ecx, eax
mov dword [ebp - 0x10], ecx
mov byte [ebp - 4], 1
cmp ecx, ebx
je 0x41144d
call fcn.0040d80d
mov dword [ebp - 0x10], eax
jmp 0x411450
mov dword [ebp - 0x10], ebx
mov byte [ebp - 4], bl
cmp dword [ebp - 0x10], ebx
je 0x41150a
cmp byte [0x643648], bl
je 0x411490
mov eax, dword [0x643644]
cmp eax, ebx
je 0x411490
push dword [ebp - 0x20]
lea ecx, [ebp + 0x410]
push ecx
push str.Disabled_item_loaded:__s__X64:__d
push 0x22b
push str.CAutoRunItemsRegLoader::LoadDisabled
push ebx
push eax
call fcn.00402740
add esp, 0x1c
push ecx
lea eax, [ebp + 0x410]
mov ecx, esp
mov dword [ebp - 0x28], esp
push eax
call fcn.00408c50
mov ecx, dword [ebp - 0x10]
call fcn.0040d97a
push ecx
lea eax, [ebp + 0x410]
mov ecx, esp
mov dword [ebp - 0x28], esp
push eax
call fcn.00408c50
mov ecx, dword [ebp - 0x10]
call fcn.0040d9d8
push ecx
lea eax, [ebp]
mov ecx, esp
mov dword [ebp - 0x28], esp
push eax
call fcn.00408c50
mov ecx, dword [ebp - 0x10]
call fcn.0040e68b
push dword [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
call fcn.0040d792
mov ecx, dword [ebp - 0x10]
call fcn.0040d79c
cmp dword [ebp - 0x20], ebx
je 0x4114fb
mov ecx, dword [ebp - 0x10]
call fcn.0040d7e2
push dword [ebp - 0x10]
call fcn.0040e797
mov ecx, eax
call fcn.0041b8a6
cmp esi, ebx
ja 0x4113ac
jmp 0x41153e
cmp byte [0x643648], bl
je 0x41153e
mov eax, dword [0x643644]
cmp eax, ebx
je 0x41153e
push str.Failed_to_open_DisabledAutoruns.dat__wrong_size
push 0x23e
push str.CAutoRunItemsRegLoader::LoadDisabled
push ebx
push eax
call fcn.00402740
add esp, 0x14
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x411576
cmp byte [0x643648], bl
je 0x411576
mov eax, dword [0x643644]
cmp eax, ebx
je 0x411576
push dword [ebp - 0x14]
push str.File_open_fail:__s
push 0x245
push str.CAutoRunItemsRegLoader::LoadDisabled
push ebx
push eax
call fcn.00402740
add esp, 0x18
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00407130
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x618]
xor ecx, ebp
call fcn.00499aa8
add ebp, 0x61c
leave
ret