Function at 0x48b6a0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6143e0
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
push ebx
push esi
push edi
mov eax, dword [0x711ab8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor ebx, ebx
mov dword [ebp - 4], ebx
mov byte [ebp - 0x11], 1
mov byte [ebp - 4], 1
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov eax, dword [0x713dbc]
shl eax, 0x14
cdq
mov ecx, dword [ebp - 0x24]
cmp ecx, edx
jl 0x48b72a
jg 0x48b705
mov edx, dword [ebp - 0x28]
cmp edx, eax
jbe 0x48b72a
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x10]
call fcn.0040ba40
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
lea eax, [ebp + 0x10]
push eax
lea ecx, [ebp - 0x1c]
push ecx
call fcn.0040b930
mov byte [ebp - 4], 2
lea edi, [ebp - 0x1c]
call fcn.0040bd70
xor ecx, ecx
mov edx, 0x6d563c
mov esi, edi
call fcn.004301b0
or edi, 0xffffffff
cmp eax, edi
jne 0x48ba1c
xor ecx, ecx
mov edx, 0x6d5664
call fcn.004301b0
cmp eax, edi
jne 0x48ba1c
call fcn.00497e50
mov esi, eax
cmp esi, ebx
je 0x48b7c8
push ecx
mov edx, esp
mov dword [ebp - 0x20], esp
lea eax, [ebp + 0x10]
push eax
push edx
call fcn.0040b930
mov byte [ebp - 4], 3
mov byte [ebp - 4], 2
mov ecx, esi
call fcn.004a7f60
cmp al, bl
je 0x48ba1c
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
lea edx, [ebp + 0x10]
push edx
push ecx
call fcn.0040b930
mov byte [ebp - 4], 4
push esi
mov byte [ebp - 4], 2
call fcn.004a8300
cmp al, bl
jne 0x48ba1c
mov eax, dword [ebp + 8]
push eax
mov ebx, dword [0x729b74]
call fcn.004c2c10
test al, al
jne 0x48ba1c
lea ecx, [ebp - 0x18]
push ecx
call fcn.0040b700
mov byte [ebp - 4], 5
xor eax, eax
mov byte [ebp - 0x40], al
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
lea edi, [ebp - 0x58]
mov ebx, dword [ebp + 8]
lea esi, [ebp - 0x38]
call fcn.004c1320
cmp byte [ebp - 0x2c], 0
je 0x48b8e3
cmp byte [ebp - 0x40], 0
je 0x48b8e3
mov eax, dword [ebp - 0x54]
mov edi, dword [ebp - 0x44]
cmp eax, edi
jb 0x48b83a
ja 0x48b833
mov edx, dword [ebp - 0x58]
cmp edx, dword [ebp - 0x48]
jbe 0x48b83a
mov esi, dword [ebp - 0x58]
mov edi, eax
jmp 0x48b83d
mov esi, dword [ebp - 0x48]
lea eax, [ebp - 0x18]
push eax
push edi
push esi
mov ebx, dword [ebp - 0x34]
push ebx
mov ecx, dword [ebp - 0x38]
push ecx
mov edx, dword [ebp - 0x30]
push edx
mov ecx, dword [0x72a504]
call fcn.004d0520
test al, al
jne 0x48b907
lea eax, [ebp - 0x18]
push eax
push edi
push esi
push ebx
mov ecx, dword [ebp - 0x38]
push ecx
mov edx, dword [ebp - 0x30]
push edx
mov ecx, dword [0x72a508]
call fcn.004d0520
test al, al
jne 0x48b907
lea eax, [ebp - 0x18]
push eax
push edi
push esi
push ebx
mov ecx, dword [ebp - 0x38]
push ecx
mov edx, dword [ebp - 0x30]
push edx
mov ecx, dword [0x72a50c]
call fcn.004d0520
test al, al
jne 0x48b907
mov byte [ebp - 0x12], al
mov eax, dword [ebp + 0x14]
push eax
lea ecx, [ebp - 0x12]
push ecx
lea edx, [ebp + 0x10]
push edx
push 1
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00459330
push edi
push esi
push ebx
mov ecx, dword [ebp - 0x38]
push ecx
mov edx, dword [ebp - 0x30]
push edx
lea edx, [ebp - 0x18]
mov ecx, dword [0x72a508]
call fcn.004d03e0
jmp 0x48b907
cmp dword [0x71038c], 1
jl 0x48b907
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Realtime_error____i
push str.CThreatScanner::scanFileRealtime
push 1
call fcn.00579a92
add esp, 0x10
mov eax, dword [ebp - 0x18]
cmp dword [eax - 0xc], 0
jne 0x48b989
cmp dword [ebp - 0x24], 0
jl 0x48b989
jg 0x48b91e
cmp dword [ebp - 0x28], 0
jbe 0x48b989
cmp dword [0x713da0], 0
je 0x48b989
mov byte [ebp + 0xb], 0
lea ecx, [ebp + 0xb]
push ecx
push 0
mov edx, dword [ebp - 0x28]
push edx
mov edx, dword [ebp + 0x10]
lea ecx, [ebp + 0x14]
call fcn.0041e190
mov byte [ebp - 4], 6
lea ebx, [ebp - 0x18]
call fcn.0040dcb0
mov byte [ebp - 4], 5
lea ecx, [ebp + 0x14]
call fcn.0040b810
mov eax, dword [ebp - 0x18]
cmp dword [eax - 0xc], 0
je 0x48b989
push 0x6d56b0
lea ecx, [ebp + 8]
push ecx
mov ecx, ebx
call fcn.00424670
add esp, 8
mov byte [ebp - 4], 7
call fcn.0040dcb0
mov byte [ebp - 4], 5
lea ecx, [ebp + 8]
call fcn.0040b810
mov edx, dword [ebp - 0x18]
cmp dword [edx - 0xc], 0
je 0x48b9c1
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp + 8]
push ecx
call fcn.00433a20
add esp, 8
mov byte [ebp - 4], 8
mov eax, dword [eax]
mov edx, dword [ebp + 0xc]
push edx
call fcn.0040b430
mov byte [ebp - 4], 5
lea ecx, [ebp + 8]
call fcn.0040ba40
mov byte [ebp - 0x11], 0
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x14], 0
setne cl
movzx edx, cl
push edx
call fcn.00492d80
add esp, 4
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.0040b810
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.0040ba40
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x10]
call fcn.0040ba40
mov al, byte [ebp - 0x11]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.0040ba40
mov dword [ebp - 4], edi
lea ecx, [ebp + 0x10]
call fcn.0040ba40
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10