Function at 0x44e746
Capabilities:
Get file size

Disassembly:
push 0x4c
mov eax, 0x5bcc6f
call fcn.00580e9e
xor ebx, ebx
mov dword [ebp - 4], ebx
mov byte [ebp - 0x11], 1
mov byte [ebp - 4], 1
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
lea eax, [ebp - 0x28]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov eax, dword [0x6b29e0]
shl eax, 0x14
cdq
mov ecx, dword [ebp - 0x24]
cmp ecx, edx
jl 0x44e79e
jg 0x44e78b
mov ecx, dword [ebp - 0x28]
cmp ecx, eax
jbe 0x44e79e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x10]
call fcn.004085a2
mov al, 1
jmp 0x44ea07
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00408532
mov byte [ebp - 4], 2
lea eax, [ebp - 0x1c]
call fcn.004087b3
push str.protocolfilters.dll
xor ecx, ecx
lea esi, [ebp - 0x1c]
call fcn.00426385
or edi, 0xffffffff
cmp eax, edi
jne 0x44ea0f
push str.nfapi.dll
xor ecx, ecx
call fcn.00426385
cmp eax, edi
jne 0x44ea0f
call fcn.00456612
mov esi, eax
cmp esi, ebx
je 0x44e83e
push ecx
mov eax, esp
mov dword [ebp - 0x20], esp
lea ecx, [ebp + 0x10]
push ecx
push eax
call fcn.00408532
mov byte [ebp - 4], 3
mov byte [ebp - 4], 2
mov ecx, esi
call fcn.00460ecf
cmp al, bl
je 0x44ea0f
push ecx
mov eax, esp
mov dword [ebp - 0x20], esp
lea ecx, [ebp + 0x10]
push ecx
push eax
call fcn.00408532
mov byte [ebp - 4], 4
mov byte [ebp - 4], 2
mov ecx, esi
call fcn.00461093
cmp al, bl
jne 0x44ea0f
push dword [ebp + 8]
mov ebx, dword [0x6c8328]
call fcn.00472860
test al, al
jne 0x44ea0f
lea eax, [ebp - 0x18]
push eax
call fcn.004083f9
mov byte [ebp - 4], 5
xor eax, eax
mov byte [ebp - 0x40], al
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
lea edi, [ebp - 0x58]
mov ebx, dword [ebp + 8]
lea esi, [ebp - 0x38]
call fcn.0046f910
xor ebx, ebx
cmp byte [ebp - 0x2c], bl
je 0x44e8f8
cmp byte [ebp - 0x40], bl
je 0x44e8f8
mov edi, dword [ebp - 0x54]
cmp edi, dword [ebp - 0x44]
jb 0x44e8a3
ja 0x44e89e
mov eax, dword [ebp - 0x58]
cmp eax, dword [ebp - 0x48]
jbe 0x44e8a3
mov esi, dword [ebp - 0x58]
jmp 0x44e8a9
mov esi, dword [ebp - 0x48]
mov edi, dword [ebp - 0x44]
lea eax, [ebp - 0x18]
push eax
push edi
push esi
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push dword [ebp - 0x30]
call fcn.00485c70
cmp al, bl
jne 0x44e91c
mov byte [ebp - 0x12], bl
push dword [ebp + 0x14]
lea eax, [ebp - 0x12]
push eax
lea eax, [ebp + 0x10]
push eax
push 1
push dword [ebp - 0x24]
push dword [ebp - 0x28]
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call fcn.0042ddf0
push edi
push esi
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push dword [ebp - 0x30]
lea ecx, [ebp - 0x18]
call fcn.00485b10
jmp 0x44e91c
cmp dword [0x6af38c], 1
jl 0x44e91c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Realtime_error____i
push str.CThreatScanner::scanFileRealtime
push 1
call fcn.00532962
add esp, 0x10
mov eax, dword [ebp - 0x18]
cmp dword [eax - 0xc], ebx
jne 0x44e996
cmp dword [ebp - 0x24], ebx
jl 0x44e996
jg 0x44e930
cmp dword [ebp - 0x28], ebx
jbe 0x44e996
cmp dword [0x6b29c4], ebx
je 0x44e996
mov byte [ebp + 0xb], bl
lea eax, [ebp + 0xb]
push eax
push ebx
push dword [ebp - 0x28]
lea eax, [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
call fcn.0040fb52
mov byte [ebp - 4], 6
lea edi, [ebp - 0x18]
call fcn.00408484
mov byte [ebp - 4], 5
lea ecx, [ebp + 0x14]
call fcn.00408461
mov eax, dword [ebp - 0x18]
cmp dword [eax - 0xc], ebx
je 0x44e996
push 0x67b5fc
lea eax, [ebp + 8]
push eax
mov esi, edi
call fcn.004135f4
pop ecx
pop ecx
mov byte [ebp - 4], 7
call fcn.00408484
mov byte [ebp - 4], 5
lea ecx, [ebp + 8]
call fcn.00408461
mov eax, dword [ebp - 0x18]
cmp dword [eax - 0xc], ebx
je 0x44e9ca
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp + 8]
push eax
call fcn.0041bece
pop ecx
pop ecx
mov byte [ebp - 4], 8
push dword [eax]
push dword [ebp + 0xc]
call fcn.00409a2b
mov byte [ebp - 4], 5
lea ecx, [ebp + 8]
call fcn.004085a2
mov byte [ebp - 0x11], bl
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x14], ebx
setne al
movzx eax, al
push eax
call fcn.00452af5
pop ecx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.00408461
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.004085a2
mov dword [ebp - 4], ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x10]
call fcn.004085a2
mov al, byte [ebp - 0x11]
call fcn.00580f43
ret 0x10
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.004085a2
mov dword [ebp - 4], edi
jmp 0x44e78f