Function at 0x46e250
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5de610
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
push ebx
push esi
push edi
mov eax, dword [0x6d26f8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor ebx, ebx
mov dword [ebp - 4], ebx
mov byte [ebp - 0x11], 1
mov byte [ebp - 4], 1
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov eax, dword [0x6d49e0]
shl eax, 0x14
cdq
mov ecx, dword [ebp - 0x24]
cmp ecx, edx
jl 0x46e2da
jg 0x46e2b5
mov edx, dword [ebp - 0x28]
cmp edx, eax
jbe 0x46e2da
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x10]
call fcn.0040b950
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
lea eax, [ebp + 0x10]
push eax
lea ecx, [ebp - 0x1c]
push ecx
call fcn.0040b840
mov byte [ebp - 4], 2
lea edi, [ebp - 0x1c]
call fcn.0040bc80
xor ecx, ecx
mov edx, str.protocolfilters.dll
mov esi, edi
call fcn.00437bc0
or edi, 0xffffffff
cmp eax, edi
jne 0x46e574
xor ecx, ecx
mov edx, str.nfapi.dll
call fcn.00437bc0
cmp eax, edi
jne 0x46e574
call fcn.004798f0
mov esi, eax
cmp esi, ebx
je 0x46e378
push ecx
mov edx, esp
mov dword [ebp - 0x20], esp
lea eax, [ebp + 0x10]
push eax
push edx
call fcn.0040b840
mov byte [ebp - 4], 3
mov byte [ebp - 4], 2
mov ecx, esi
call fcn.004863b0
cmp al, bl
je 0x46e574
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
lea edx, [ebp + 0x10]
push edx
push ecx
call fcn.0040b840
mov byte [ebp - 4], 4
push esi
mov byte [ebp - 4], 2
call fcn.004867a0
cmp al, bl
jne 0x46e574
mov eax, dword [ebp + 8]
push eax
mov ebx, dword [0x6ea328]
call fcn.0049aed0
test al, al
jne 0x46e574
lea ecx, [ebp - 0x18]
push ecx
call fcn.0040b610
mov byte [ebp - 4], 5
xor eax, eax
mov byte [ebp - 0x40], al
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
lea edi, [ebp - 0x58]
mov ebx, dword [ebp + 8]
lea esi, [ebp - 0x38]
call fcn.004991f0
cmp byte [ebp - 0x2c], 0
je 0x46e43b
cmp byte [ebp - 0x40], 0
je 0x46e43b
mov eax, dword [ebp - 0x54]
mov edi, dword [ebp - 0x44]
cmp eax, edi
jb 0x46e3e2
ja 0x46e3db
mov edx, dword [ebp - 0x58]
cmp edx, dword [ebp - 0x48]
jbe 0x46e3e2
mov esi, dword [ebp - 0x58]
mov edi, eax
jmp 0x46e3e5
mov esi, dword [ebp - 0x48]
lea eax, [ebp - 0x18]
push eax
push edi
push esi
mov ebx, dword [ebp - 0x34]
push ebx
mov ecx, dword [ebp - 0x38]
push ecx
mov edx, dword [ebp - 0x30]
push edx
call fcn.004a9a10
test al, al
jne 0x46e45f
mov byte [ebp - 0x12], al
mov eax, dword [ebp + 0x14]
push eax
lea ecx, [ebp - 0x12]
push ecx
lea edx, [ebp + 0x10]
push edx
push 1
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00443d70
push edi
push esi
push ebx
mov ecx, dword [ebp - 0x38]
push ecx
mov edx, dword [ebp - 0x30]
push edx
lea ecx, [ebp - 0x18]
call fcn.004a98d0
jmp 0x46e45f
cmp dword [0x6d138c], 1
jl 0x46e45f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Realtime_error____i
push str.CThreatScanner::scanFileRealtime
push 1
call fcn.00552bc2
add esp, 0x10
mov eax, dword [ebp - 0x18]
cmp dword [eax - 0xc], 0
jne 0x46e4e1
cmp dword [ebp - 0x24], 0
jl 0x46e4e1
jg 0x46e476
cmp dword [ebp - 0x28], 0
jbe 0x46e4e1
cmp dword [0x6d49c4], 0
je 0x46e4e1
mov byte [ebp + 0xb], 0
lea ecx, [ebp + 0xb]
push ecx
push 0
mov edx, dword [ebp - 0x28]
push edx
mov edx, dword [ebp + 0x10]
lea ecx, [ebp + 0x14]
call fcn.00417570
mov byte [ebp - 4], 6
lea ebx, [ebp - 0x18]
call fcn.0040d9a0
mov byte [ebp - 4], 5
lea ecx, [ebp + 0x14]
call fcn.0040b720
mov eax, dword [ebp - 0x18]
cmp dword [eax - 0xc], 0
je 0x46e4e1
push 0x69d5f4
lea ecx, [ebp + 8]
push ecx
mov ecx, ebx
call fcn.0041c860
add esp, 8
mov byte [ebp - 4], 7
call fcn.0040d9a0
mov byte [ebp - 4], 5
lea ecx, [ebp + 8]
call fcn.0040b720
mov edx, dword [ebp - 0x18]
cmp dword [edx - 0xc], 0
je 0x46e519
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp + 8]
push ecx
call fcn.00429380
add esp, 8
mov byte [ebp - 4], 8
mov eax, dword [eax]
mov edx, dword [ebp + 0xc]
push edx
call fcn.0040b340
mov byte [ebp - 4], 5
lea ecx, [ebp + 8]
call fcn.0040b950
mov byte [ebp - 0x11], 0
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x14], 0
setne cl
movzx edx, cl
push edx
call fcn.00474fd0
add esp, 4
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.0040b720
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.0040b950
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x10]
call fcn.0040b950
mov al, byte [ebp - 0x11]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.0040b950
mov dword [ebp - 4], edi
lea ecx, [ebp + 0x10]
call fcn.0040b950
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10