Function at 0x100044b0
Capabilities:
Get file size
Get file version info
Read file on windows

Disassembly:
sub esp, 0x2b4
mov eax, dword [0x1001803c]
xor eax, esp
mov dword [esp + 0x2b0], eax
mov eax, dword [esp + 0x2b8]
push ebp
push esi
mov esi, edx
push edi
lea edx, [esp + 0x44]
push edx
xor ebp, ebp
push esi
mov dword [esp + 0x48], eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x4c], ebp
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
mov dword [esp + 0x38], edi
cmp edi, ebp
ja 0x1000450d
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x2b0]
xor ecx, esp
call fcn.100065f6
add esp, 0x2b4
ret
push ebx
push edi
call fcn.1000667a
add esp, 4
mov ebx, eax
push ebx
push edi
push ebp
push esi
mov dword [esp + 0x2c], ebx
call sub.VERSION.dll_GetFileVersionInfoW
push edi
call fcn.1000667a
add esp, 4
mov dword [esp + 0x14], eax
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x44]
push ecx
push str.VarFileInfoTranslation
push ebx
mov dword [esp + 0x34], ebp
mov dword [esp + 0x40], ebp
call sub.VERSION.dll_VerQueryValueA
cmp dword [esp + 0x2d4], 3
mov eax, dword [esp + 0x38]
mov dword [esp + 0x34], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x2c], ebp
jne 0x1000459a
test byte [esp + 0x2d0], 0x10
je 0x1000459a
cmp eax, ebp
jne 0x1000459a
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x2cc]
push 2
push 5
push edx
mov ebx, str.FakeFile.D
call fcn.10002380
add esp, 0xc
jmp 0x10004c37
xor esi, esi
mov dword [esp + 0x10], esi
test eax, 0xfffffffc
jbe 0x100047c0
jmp 0x100045b0
mov ebp, dword [esp + 0x3c]
xor ebx, ebx
jmp 0x100045c0
mov eax, dword [ebx*4 + 0x10018f90]
push eax
mov eax, dword [esp + 0x44]
movzx ecx, word [eax + esi*4 + 2]
movzx edx, word [eax + esi*4]
push ecx
push edx
push str.StringFileInfo_04x_04x_s
mov ecx, 0x64
lea edi, [esp + 0x208]
call fcn.100010c0
add esp, 0x10
lea eax, [esp + 0x34]
push eax
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x24]
push ecx
mov edx, edi
push edx
push eax
call sub.VERSION.dll_VerQueryValueA
cmp dword [esp + 0x34], 0
jbe 0x1000479e
cmp ebx, 1
ja 0x1000469e
lea edi, [esp + 0x194]
test ebx, ebx
je 0x1000462d
lea edi, [esp + 0xcc]
mov ecx, dword [esp + 0x20]
push ecx
mov ecx, 0x64
call fcn.100010c0
add esp, 4
test ebx, ebx
jne 0x10004650
lea esi, [esp + 0x24]
lea eax, [esp + 0x194]
jmp 0x1000465b
lea esi, [esp + 0x30]
lea eax, [esp + 0xcc]
mov ecx, 0x64
xor edx, edx
cmp byte [eax], dl
je 0x1000466e
inc eax
sub ecx, 1
jne 0x10004662
jmp 0x10004672
test ecx, ecx
jne 0x10004677
mov edx, 0x80070057
test esi, esi
je 0x10004690
test edx, edx
jl 0x1000468a
mov eax, 0x64
sub eax, ecx
mov dword [esi], eax
jmp 0x10004690
mov dword [esi], 0
test edx, edx
jge 0x1000469e
test esi, esi
je 0x1000469e
mov dword [esi], 0
cmp ebx, 3
jne 0x100046cd
mov ecx, dword [esp + 0x20]
push ecx
lea ecx, [ebx + 0x61]
lea edi, [esp + 0x260]
call fcn.100010c0
add esp, 4
lea ecx, [ebx + 0x61]
mov eax, edi
nop
cmp byte [eax], 0
je 0x10004703
inc eax
sub ecx, 1
jne 0x100046c0
jmp 0x10004703
cmp ebx, 6
jne 0x10004703
mov edx, dword [esp + 0x20]
push edx
lea ecx, [ebx + 0x5e]
lea edi, [esp + 0x134]
call fcn.100010c0
add esp, 4
lea ecx, [ebx + 0x5e]
mov eax, edi
mov edi, edi
cmp byte [eax], 0
je 0x10004722
inc eax
sub ecx, 1
jne 0x100046f0
mov dword [esp + 0x28], 0
cmp dword [esp + 0x2c], 0
jne 0x10004733
mov eax, dword [esp + 0x20]
mov edi, dword [esp + 0x14]
push eax
mov ecx, ebp
call fcn.100010c0
add esp, 4
jmp 0x10004796
test ecx, ecx
je 0x100046fb
mov eax, 0x64
sub eax, ecx
mov dword [esp + 0x28], eax
jmp 0x10004703
cmp ebp, 0x7fffffff
ja 0x10004796
mov esi, dword [esp + 0x14]
mov ecx, ebp
mov eax, esi
cmp byte [eax], 0
je 0x10004750
inc eax
sub ecx, 1
jne 0x10004743
jmp 0x10004769
test ecx, ecx
je 0x10004769
mov eax, ebp
sub eax, ecx
mov edx, ebp
sub edx, eax
lea ecx, [eax + esi]
mov eax, 0x100164fc
call fcn.10001ef0
mov ecx, ebp
mov eax, esi
lea ecx, [ecx]
cmp byte [eax], 0
je 0x1000477d
inc eax
sub ecx, 1
jne 0x10004770
jmp 0x10004796
test ecx, ecx
je 0x10004796
mov eax, ebp
sub eax, ecx
mov edx, ebp
mov ecx, esi
sub edx, eax
add ecx, eax
mov eax, dword [esp + 0x20]
call fcn.10001ef0
inc dword [esp + 0x2c]
mov esi, dword [esp + 0x10]
inc ebx
cmp ebx, 0xc
jb 0x100045c0
mov edx, dword [esp + 0x38]
inc esi
shr edx, 2
mov dword [esp + 0x10], esi
cmp esi, edx
jb 0x100045b0
mov ebp, dword [esp + 0x30]
cmp dword [esp + 0x2d4], 1
jne 0x100048f0
cmp dword [esp + 0x28], 4
jne 0x10004828
cmp byte [esp + 0x131], 0x2e
jne 0x10004828
mov dl, byte [esp + 0x130]
mov al, dl
sub al, 0x30
cmp al, 9
ja 0x10004828
mov cl, byte [esp + 0x132]
mov al, cl
sub al, 0x30
cmp al, 9
ja 0x10004828
mov al, byte [esp + 0x133]
mov bl, al
sub bl, 0x30
cmp bl, 9
ja 0x10004828
cmp dl, 0x31
jne 0x100048b3
cmp cl, 0x30
jne 0x100048b3
cmp al, cl
jne 0x100048b3
mov ebx, dword [esp + 0x44]
push 0
push ebx
mov dword [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
lea edi, [eax - 0x2710]
cmp edi, 0x1388
jbe 0x10004850
mov edi, 0x1388
push edi
call fcn.1000667a
add esp, 4
push 0
push 0
push 0x2710
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x10004874
xor eax, eax
jmp 0x1000488a
push 0
lea ecx, [esp + 0x2c]
push ecx
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
neg eax
sbb eax, eax
and eax, esi
mov edx, dword [0x1001a344]
mov ecx, dword [edx + 0x3c]
mov edx, dword [esp + 0x28]
cmp edx, ecx
jbe 0x100048f0
push ecx
mov ecx, dword [0x1001a2f8]
mov ecx, dword [ecx + 0x3c]
push ecx
push edx
call fcn.10005be0
add esp, 0xc
test eax, eax
je 0x100048f0
mov edx, dword [esp + 0x2d8]
push edx
push str.Worm.Shortcut__d_
mov ecx, 0x40
lea edi, [esp + 0x94]
call fcn.100010c0
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x2d4]
push 2
push 1
push eax
mov ebx, edi
call fcn.10002380
add esp, 0x14
jmp 0x10004c37
cmp dword [esp + 0x24], 0
jbe 0x10004973
lea ecx, [esp + 0x24]
push ecx
lea ebx, [esp + 0x14]
lea esi, [esp + 0x198]
call fcn.10005a50
mov edx, dword [esp + 0x14]
mov al, byte [esp + edx + 0x197]
sub al, 0x30
add esp, 4
cmp al, 9
ja 0x10004973
mov eax, esi
push 0x10016514
push eax
mov eax, 0x64
call fcn.10005b20
add esp, 8
test eax, eax
jbe 0x10004973
mov ecx, dword [esp + 0x14]
push ecx
call fcn.10006605
mov edx, dword [esp + 0x20]
push edx
call fcn.10006605
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x2d4]
push 2
push 5
push eax
mov ebx, str.New_Heur.Fake_File_
call fcn.10002380
add esp, 0x14
jmp 0x10004c37
test ebp, ebp
jbe 0x10004b10
lea ecx, [esp + 0x24]
push ecx
lea ebx, [esp + 0x14]
lea esi, [esp + 0xd0]
call fcn.10005a50
mov edx, dword [esp + 0x14]
mov al, byte [esp + edx + 0xcf]
mov esi, dword [esp + 0x28]
sub al, 0x30
add esp, 4
cmp al, 9
ja 0x10004a09
mov al, byte [esp + esi + 0xcb]
sub al, 0x30
cmp al, 9
ja 0x10004a09
lea eax, [esp + 0xcc]
push 0x1001652c
push eax
mov eax, 0x64
call fcn.10005b20
add esp, 8
test eax, eax
jbe 0x10004a09
mov ecx, dword [esp + 0x14]
push ecx
call fcn.10006605
mov edx, dword [esp + 0x20]
push edx
call fcn.10006605
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x2d4]
push 2
push 5
push eax
mov ebx, str.New_Heur.Fake_Image_
call fcn.10002380
add esp, 0x14
jmp 0x10004c37
mov cl, byte [esp + esi + 0xcb]
lea eax, [esp + esi + 0xcb]
cmp cl, 0x73
je 0x10004a21
cmp cl, 0x53
jne 0x10004a24
mov byte [eax], 0
mov ebx, dword [0x1001a2f0]
mov ecx, dword [0x1001a0e0]
mov esi, ebx
add ecx, ebx
cmp esi, ecx
jae 0x10004b16
lea edi, [ebp + 1]
nop
mov edx, dword [0x1001a2fc]
mov eax, dword [edx + esi*4]
push eax
lea ecx, [esp + 0xd0]
push edi
push ecx
call fcn.10005e60
add esp, 0xc
test eax, eax
jne 0x10004a77
mov ebx, dword [0x1001a2f0]
mov edx, dword [0x1001a0e0]
inc esi
add edx, ebx
cmp esi, edx
jb 0x10004a40
jmp 0x10004b16
mov eax, dword [esp + 0x14]
push eax
call fcn.10006605
mov ecx, dword [esp + 0x20]
push ecx
call fcn.10006605
mov edx, dword [0x1001a2fc]
mov eax, dword [edx + esi*4]
push eax
mov ecx, 0x40
lea edi, [esp + 0x58]
call fcn.100010c0
add esp, 0xc
mov ecx, 0x40
mov eax, edi
lea ecx, [ecx]
cmp byte [eax], 0
je 0x10004b03
inc eax
sub ecx, 1
jne 0x10004ab0
xor ebx, ebx
lea esi, [esp + 0x4c]
call fcn.100059e0
mov ecx, esi
push ecx
push str.New_Heur.Fake__s_
mov ecx, 0x40
lea edi, [esp + 0x94]
mov byte [esp + eax + 0x54], 0
call fcn.100010c0
mov edx, dword [esp + 0x20]
mov esi, dword [esp + 0x2d4]
push 2
push 5
push edx
mov ebx, edi
call fcn.10002380
add esp, 0x14
jmp 0x10004c37
test ecx, ecx
je 0x10004abb
mov ebx, 0x40
sub ebx, ecx
jmp 0x10004abd
mov ebx, dword [0x1001a2f0]
cmp dword [esp + 0x2c], 0
mov esi, dword [esp + 0x14]
jbe 0x10004c22
test esi, esi
je 0x10004b4f
mov edx, dword [esp + 0x3c]
cmp edx, 0x7fffffff
ja 0x10004b4f
mov ecx, edx
mov eax, esi
lea esp, [esp]
cmp byte [eax], 0
je 0x10004c50
inc eax
sub ecx, 1
jne 0x10004b40
xor edx, edx
xor ecx, ecx
xor ebp, ebp
test edx, edx
jbe 0x10004b7e
lea esp, [esp]
mov al, byte [ecx + esi]
cmp al, 0x20
jb 0x10004b79
cmp al, 0x7f
jae 0x10004b79
cmp al, 0x61
jb 0x10004b75
cmp al, 0x7a
ja 0x10004b75
sub al, 0x20
mov byte [esi + ebp], al
inc ebp
inc ecx
cmp ecx, edx
jb 0x10004b60
xor eax, eax
mov dword [esp + 0x10], eax
test ebx, ebx
jbe 0x10004c22
lea esp, [esp]
mov ecx, dword [0x1001a2fc]
mov ebx, dword [ecx + eax*4]
test ebx, ebx
je 0x10004bb3
mov ecx, 0x400
mov eax, ebx
cmp byte [eax], 0
je 0x10004c5f
inc eax
sub ecx, 1
jne 0x10004ba4
xor edi, edi
push edi
call fcn.1000667a
push edi
mov esi, eax
push ebx
push esi
call fcn.1000d900
add esp, 0x10
xor edx, edx
xor ecx, ecx
test edi, edi
jbe 0x10004bee
mov al, byte [edx + esi]
cmp al, 0x20
jb 0x10004be9
cmp al, 0x7f
jae 0x10004be9
cmp al, 0x61
jb 0x10004be5
cmp al, 0x7a
ja 0x10004be5
sub al, 0x20
mov byte [ecx + esi], al
inc ecx
inc edx
cmp edx, edi
jb 0x10004bd0
mov ebx, dword [esp + 0x14]
push ecx
push esi
push ebp
mov eax, ebx
call fcn.10005be0
push esi
mov edi, eax
call fcn.10006605
add esp, 0x10
test edi, edi
jne 0x10004c73
mov eax, dword [esp + 0x10]
inc eax
mov dword [esp + 0x10], eax
cmp eax, dword [0x1001a2f0]
jb 0x10004b90
mov esi, ebx
push esi
call fcn.10006605
mov edx, dword [esp + 0x20]
push edx
call fcn.10006605
add esp, 8
xor eax, eax
mov ecx, dword [esp + 0x2c0]
pop ebx
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.100065f6
add esp, 0x2b4
ret
test ecx, ecx
je 0x10004b4f
sub edx, ecx
jmp 0x10004b51
test ecx, ecx
je 0x10004bb3
mov edi, 0x400
sub edi, ecx
jmp 0x10004bb5
push ebx
call fcn.10006605
mov edx, dword [esp + 0x20]
push edx
call fcn.10006605
mov eax, dword [0x1001a2fc]
mov ecx, dword [esp + 0x18]
mov edx, dword [eax + ecx*4]
push edx
mov ecx, 0x40
lea edi, [esp + 0x58]
call fcn.100010c0
add esp, 0xc
mov ecx, 0x40
mov eax, edi
cmp byte [eax], 0
je 0x10004cfb
inc eax
sub ecx, 1
jne 0x10004ca8
xor ebx, ebx
lea esi, [esp + 0x4c]
call fcn.100059e0
mov byte [esp + eax + 0x4c], 0
mov eax, esi
push eax
push str.New_Heur.Variant__s_
mov ecx, 0x40
lea edi, [esp + 0x94]
call fcn.100010c0
mov ecx, dword [esp + 0x20]
mov esi, dword [esp + 0x2d4]
push 2
push 5
push ecx
mov ebx, edi
call fcn.10002380
add esp, 0x14
jmp 0x10004c37
test ecx, ecx
je 0x10004cb3
mov ebx, 0x40
sub ebx, ecx
jmp 0x10004cb5