Function at 0x46194a
Capabilities:
Get file size

Disassembly:
push 0x54
mov eax, 0x5ccff3
call fcn.0058ec5e
xor ebx, ebx
mov dword [ebp - 4], ebx
mov byte [ebp - 0x11], 1
mov byte [ebp - 4], 1
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
lea eax, [ebp - 0x28]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov eax, dword [0x6c79e0]
shl eax, 0x14
cdq
mov ecx, dword [ebp - 0x24]
cmp ecx, edx
jl 0x4619a2
jg 0x46198f
mov ecx, dword [ebp - 0x28]
cmp ecx, eax
jbe 0x4619a2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x10]
call fcn.004085f6
mov al, 1
jmp 0x461d59
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00408586
mov byte [ebp - 4], 2
lea eax, [ebp - 0x1c]
call fcn.00408807
push 0x68cd50
xor ecx, ecx
lea esi, [ebp - 0x1c]
call fcn.0042b6cc
or edi, 0xffffffff
cmp eax, edi
jne 0x461d61
push 0x68cd78
xor ecx, ecx
call fcn.0042b6cc
cmp eax, edi
jne 0x461d61
push str._threattank
xor ecx, ecx
call fcn.0042b6cc
cmp eax, edi
jne 0x461d61
call fcn.0046a19a
mov esi, eax
cmp esi, ebx
je 0x461a56
push ecx
mov eax, esp
mov dword [ebp - 0x20], esp
lea ecx, [ebp + 0x10]
push ecx
push eax
call fcn.00408586
mov byte [ebp - 4], 3
mov byte [ebp - 4], 2
mov ecx, esi
call fcn.004756e3
cmp al, bl
je 0x461d61
push ecx
mov eax, esp
mov dword [ebp - 0x20], esp
lea ecx, [ebp + 0x10]
push ecx
push eax
call fcn.00408586
mov byte [ebp - 4], 4
mov byte [ebp - 4], 2
mov ecx, esi
call fcn.004758a7
cmp al, bl
jne 0x461d61
push dword [ebp + 8]
call fcn.0048b000
test al, al
jne 0x461d61
lea eax, [ebp - 0x18]
push eax
call fcn.0040844d
mov byte [ebp - 4], 5
mov byte [ebp - 0x48], bl
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
lea edi, [ebp - 0x60]
mov ebx, dword [ebp + 8]
lea esi, [ebp - 0x38]
call fcn.00487df0
xor ebx, ebx
cmp byte [ebp - 0x2c], bl
je 0x461b06
cmp byte [ebp - 0x48], bl
je 0x461b06
mov edi, dword [ebp - 0x5c]
cmp edi, dword [ebp - 0x4c]
jb 0x461ab3
ja 0x461aae
mov eax, dword [ebp - 0x60]
cmp eax, dword [ebp - 0x50]
jbe 0x461ab3
mov esi, dword [ebp - 0x60]
jmp 0x461ab9
mov esi, dword [ebp - 0x50]
mov edi, dword [ebp - 0x4c]
lea eax, [ebp - 0x18]
push eax
push edi
push esi
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push dword [ebp - 0x30]
call fcn.0049e540
cmp al, bl
jne 0x461b2a
mov byte [ebp - 0x12], bl
push dword [ebp + 0x14]
lea eax, [ebp - 0x12]
push eax
lea eax, [ebp + 0x10]
push eax
push dword [ebp - 0x24]
push dword [ebp - 0x28]
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call fcn.00434167
push edi
push esi
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push dword [ebp - 0x30]
lea ecx, [ebp - 0x18]
call fcn.0049e3e0
jmp 0x461b2a
cmp dword [0x6c438c], 1
jl 0x461b2a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Realtime_error____i
push str.CThreatScanner::scanFileRealtime
push 1
call fcn.00540a02
add esp, 0x10
mov eax, dword [ebp - 0x18]
cmp dword [eax - 0xc], ebx
jne 0x461ba4
cmp dword [ebp - 0x24], ebx
jl 0x461ba4
jg 0x461b3e
cmp dword [ebp - 0x28], ebx
jbe 0x461ba4
cmp dword [0x6c79c4], ebx
je 0x461ba4
mov byte [ebp + 0x17], bl
lea eax, [ebp + 0x17]
push eax
push ebx
push dword [ebp - 0x28]
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp + 0x10]
call fcn.00411618
mov byte [ebp - 4], 6
lea edi, [ebp - 0x18]
call fcn.004084d8
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x20]
call fcn.004084b5
mov eax, dword [ebp - 0x18]
cmp dword [eax - 0xc], ebx
je 0x461ba4
push 0x68cde0
lea eax, [ebp + 0x14]
push eax
mov esi, edi
call fcn.0041683c
pop ecx
pop ecx
mov byte [ebp - 4], 7
call fcn.004084d8
mov byte [ebp - 4], 5
lea ecx, [ebp + 0x14]
call fcn.004084b5
mov eax, dword [ebp - 0x18]
cmp dword [eax - 0xc], ebx
jne 0x461bf4
cmp dword [ebp - 0x24], ebx
jl 0x461bf4
jg 0x461bb8
cmp dword [ebp - 0x28], ebx
jbe 0x461bf4
push dword [ebp - 0x28]
lea eax, [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
call fcn.0044461f
mov byte [ebp - 4], 8
lea edi, [ebp - 0x18]
call fcn.004084d8
mov byte [ebp - 4], 5
lea ecx, [ebp + 0x14]
call fcn.004084b5
mov eax, dword [ebp - 0x18]
cmp dword [eax - 0xc], ebx
je 0x461bf4
push str.Ransomware.
mov eax, edi
push eax
call fcn.0042b29b
cmp byte [ebp + 0x18], bl
je 0x461cfb
mov eax, dword [ebp - 0x18]
cmp dword [eax - 0xc], ebx
jne 0x461cfb
lea eax, [ebp + 0x14]
push eax
mov ecx, dword [ebp + 8]
call fcn.00487690
pop ecx
mov byte [ebp - 4], 9
lea eax, [ebp + 0x14]
call fcn.004170c4
test al, al
jne 0x461ced
lea eax, [ebp + 0x14]
push eax
lea eax, [ebp + 8]
push eax
call fcn.004b5ce0
pop ecx
pop ecx
mov byte [ebp - 4], 0xa
mov eax, dword [ebp + 8]
cmp dword [eax - 0xc], ebx
je 0x461ce1
lea eax, [ebp - 0x58]
push eax
call fcn.0040fdb0
mov byte [ebp - 4], 0xb
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x58]
call fcn.0042c5a5
mov byte [ebp + 0x1b], bl
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp + 0x1b]
lea edx, [ebp - 0x58]
call fcn.0042a667
pop ecx
mov byte [ebp - 4], 0xc
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x34]
test eax, 0xfffffffc
je 0x461cc7
xor edi, edi
lea esi, [ebp - 0x40]
call fcn.0041e10a
mov eax, dword [eax]
cmp dword [eax - 0xc], 1
jle 0x461cc7
push str..XEDR
call fcn.0041e10a
lea ecx, [ebp + 0x18]
push ecx
mov esi, eax
call fcn.0041683c
pop ecx
pop ecx
mov byte [ebp - 4], 0xd
lea edi, [ebp - 0x18]
call fcn.004084d8
mov byte [ebp - 4], 0xc
lea ecx, [ebp + 0x18]
call fcn.004084b5
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x40]
push eax
call fcn.0040fde8
mov byte [ebp - 4], 0xa
lea eax, [ebp - 0x58]
push eax
call fcn.0040fde8
mov byte [ebp - 4], 9
lea ecx, [ebp + 8]
call fcn.004084b5
mov byte [ebp - 4], 5
lea ebx, [ebp + 0x14]
call fcn.004170a7
xor ebx, ebx
mov eax, dword [ebp - 0x18]
cmp dword [eax - 0xc], ebx
je 0x461d2f
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp + 0x18]
push eax
call fcn.00420afa
pop ecx
pop ecx
mov byte [ebp - 4], 0xe
push dword [eax]
push dword [ebp + 0xc]
call fcn.00409bc2
mov byte [ebp - 4], 5
lea ecx, [ebp + 0x18]
call fcn.004085f6
mov byte [ebp - 0x11], bl
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.004084b5
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.004085f6
mov dword [ebp - 4], ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x10]
call fcn.004085f6
mov al, byte [ebp - 0x11]
call fcn.0058ed03
ret 0x14
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.004085f6
mov dword [ebp - 4], edi
jmp 0x461993