Function at 0x44ef6f
Capabilities:
Get file size

Disassembly:
push 0x7c
mov eax, 0x5c38d9
call fcn.0058708e
xor esi, esi
mov dword [ebp - 4], esi
mov byte [ebp - 0x11], 1
mov byte [ebp - 4], 1
mov eax, dword [ebp + 0xc]
call fcn.00473a10
mov edi, eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x30], edi
mov byte [ebp - 4], 2
or ebx, 0xffffffff
cmp edi, ebx
jne 0x44efb9
mov byte [ebp - 4], 1
mov dword [ebp - 4], ebx
lea ecx, [ebp + 0xc]
call fcn.00408559
mov al, 1
jmp 0x44f414
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x3c], esi
lea eax, [ebp - 0x40]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov eax, dword [0x6c83dc]
shl eax, 0x14
cdq
mov ecx, dword [ebp - 0x3c]
cmp ecx, edx
jl 0x44eff0
jg 0x44efe3
mov ecx, dword [ebp - 0x40]
cmp ecx, eax
jbe 0x44eff0
mov byte [ebp - 4], 1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x44efa7
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.004084e9
mov byte [ebp - 4], 3
lea eax, [ebp - 0x1c]
call fcn.0040876a
push str.protocolfilters.dll
xor ecx, ecx
lea esi, [ebp - 0x1c]
call fcn.004260a9
cmp eax, ebx
jne 0x44f41c
push str.nfapi.dll
xor ecx, ecx
call fcn.004260a9
cmp eax, ebx
jne 0x44f41c
push str.vibraniumupdater
xor ecx, ecx
call fcn.004260a9
cmp eax, ebx
jne 0x44f41c
push str.vibranium_as
xor ecx, ecx
call fcn.004260a9
cmp eax, ebx
jne 0x44f41c
push str.vibranium_ts
xor ecx, ecx
call fcn.004260a9
cmp eax, ebx
jne 0x44f41c
push str._scandeep
xor ecx, ecx
call fcn.004260a9
cmp eax, ebx
jne 0x44f41c
call fcn.004571f2
mov esi, eax
test esi, esi
je 0x44f0dd
push ecx
mov eax, esp
mov dword [ebp - 0x28], esp
lea ecx, [ebp + 0xc]
push ecx
push eax
call fcn.004084e9
mov byte [ebp - 4], 4
mov byte [ebp - 4], 3
mov ecx, esi
call fcn.00463f0c
test al, al
je 0x44f41c
push ecx
mov eax, esp
mov dword [ebp - 0x28], esp
lea ecx, [ebp + 0xc]
push ecx
push eax
call fcn.004084e9
mov byte [ebp - 4], 5
mov byte [ebp - 4], 3
mov ecx, esi
call fcn.004640d0
test al, al
jne 0x44f41c
push edi
mov ebx, dword [0x6ddd34]
call fcn.00476fa0
test al, al
je 0x44f10d
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1c]
call fcn.00408559
mov byte [ebp - 4], 1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 4], 0xffffffff
jmp 0x44efaa
lea eax, [ebp - 0x18]
push eax
call fcn.004083b0
mov byte [ebp - 4], 6
xor eax, eax
mov byte [ebp - 0x70], al
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
lea edi, [ebp - 0x88]
mov ebx, dword [ebp - 0x2c]
lea esi, [ebp - 0x50]
call fcn.00474190
cmp byte [ebp - 0x44], 0
je 0x44f393
cmp byte [ebp - 0x70], 0
je 0x44f393
mov ecx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x74]
cmp ecx, eax
jb 0x44f17e
ja 0x44f170
mov edx, dword [ebp - 0x88]
cmp edx, dword [ebp - 0x78]
jbe 0x44f17e
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], ecx
jmp 0x44f187
mov ecx, dword [ebp - 0x78]
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
push dword [ebp - 0x48]
mov ecx, dword [0x6de644]
call fcn.004896e0
xor esi, esi
mov eax, dword [ebp - 0x18]
cmp dword [eax - 0xc], esi
jne 0x44f1f3
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
push dword [ebp - 0x48]
mov ecx, dword [0x6de648]
call fcn.004896e0
mov eax, dword [ebp - 0x18]
cmp dword [eax - 0xc], esi
jne 0x44f1f3
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
push dword [ebp - 0x48]
mov ecx, dword [0x6de64c]
call fcn.004896e0
mov eax, dword [ebp - 0x18]
cmp dword [eax - 0xc], esi
jne 0x44f395
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x2c]
call fcn.00473a30
pop ecx
mov byte [ebp - 4], 7
lea eax, [ebp - 0x28]
call fcn.00426650
test al, al
jne 0x44f387
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.004a09e0
pop ecx
pop ecx
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x20]
cmp dword [eax - 0xc], esi
je 0x44f37b
lea eax, [ebp - 0x80]
push eax
call fcn.00413a77
mov byte [ebp - 4], 9
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x80]
call fcn.00426c70
mov byte [ebp - 0x12], 0
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x12]
lea edx, [ebp - 0x80]
call fcn.0042504d
pop ecx
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0x58]
sub eax, dword [ebp - 0x5c]
test eax, 0xfffffffc
je 0x44f361
xor edi, edi
lea esi, [ebp - 0x68]
call fcn.00413f62
mov eax, dword [eax]
cmp dword [eax - 0xc], 1
jle 0x44f361
call fcn.00413f62
lea edi, [ebp - 0x18]
call fcn.0040843b
push 0x682b04
lea eax, [ebp - 0x24]
push eax
call fcn.004083d7
mov byte [ebp - 4], 0xb
mov eax, edi
push eax
lea eax, [ebp - 0x24]
call fcn.00475400
pop ecx
mov bl, al
neg bl
sbb bl, bl
inc bl
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x24]
call fcn.00408418
test bl, bl
je 0x44f301
push 0x682b08
lea eax, [ebp - 0x24]
push eax
mov esi, edi
call fcn.00413787
pop ecx
pop ecx
mov byte [ebp - 4], 0xc
call fcn.0040843b
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x24]
call fcn.00408418
push str.Heur.
xor ecx, ecx
lea esi, [ebp - 0x18]
call fcn.00419eda
test eax, eax
jne 0x44f344
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x20]
call fcn.0045d9f5
pop ecx
mov byte [ebp - 4], 0xd
mov eax, dword [ebp - 0x24]
cmp dword [eax - 0xc], 0
je 0x44f338
lea eax, [ebp - 0x24]
mov edi, esi
call fcn.0040843b
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x24]
call fcn.00408418
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
push dword [ebp - 0x48]
lea edx, [ebp - 0x18]
mov ecx, dword [0x6de64c]
call fcn.00489580
mov byte [ebp - 4], 9
lea eax, [ebp - 0x68]
push eax
call fcn.00413f38
mov byte [ebp - 4], 8
lea eax, [ebp - 0x80]
push eax
call fcn.00413f38
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x20]
call fcn.00408418
mov byte [ebp - 4], 6
lea ebx, [ebp - 0x28]
call fcn.00426633
xor esi, esi
mov eax, dword [ebp - 0x18]
cmp dword [eax - 0xc], esi
je 0x44f3ca
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0041baa0
pop ecx
pop ecx
mov byte [ebp - 4], 0xe
push dword [eax]
push dword [ebp + 8]
call fcn.00409a0d
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x28]
call fcn.00408559
mov byte [ebp - 0x11], 0
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], esi
setne al
movzx eax, al
push eax
call fcn.004533c1
pop ecx
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x18]
call fcn.00408418
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1c]
call fcn.00408559
mov byte [ebp - 4], 1
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.00408559
mov al, byte [ebp - 0x11]
call fcn.00587133
ret 8
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1c]
call fcn.00408559
jmp 0x44efe3