Function at 0x4ec9f0
Capabilities:
Get file system object information
Move file
Parse pe header
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8510]
mov eax, 0x8510
call fcn.00507730
push 0xffffffffffffffff
push 0x53dc99
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x5755c4]
xor eax, ebp
mov dword [ebp + 0x850c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp]
push eax
push 0x4ed050
push dword [0x57cf9c]
push str.VIRSCAN
push dword [0x5b76d8]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
test eax, eax
je 0x4ed01e
lea ecx, [ebp - 0x40]
call fcn.00443d10
mov dword [ebp - 4], 0
cmp byte [0x57dfb4], 0
je 0x4eca97
push 0x800
lea eax, [ebp + 0x750c]
mov ecx, 0x5a6670
push eax
call fcn.004065d0
lea eax, [ebp + 0x750c]
push eax
lea ecx, [ebp - 0x40]
call fcn.00444500
jmp 0x4ecb46
lea ecx, [ebp + 0x34ac]
call fcn.0049dc70
mov byte [ebp - 4], 1
lea eax, [ebp + 0x34ac]
push 1
push eax
mov ecx, 0x5a9378
call fcn.004477c0
push 0
push 0
push 0xa
lea eax, [ebp - 0x40]
push eax
push 3
lea eax, [ebp + 0x34ac]
push eax
call fcn.004b33e0
test al, al
jne 0x4ecb11
mov byte [ebp - 4], al
mov ecx, dword [ebp + 0x34ac]
test ecx, ecx
je 0x4ed00f
cmp byte [ebp + 0x34bc], al
je 0x4ecb03
mov eax, dword [ebp + 0x34b4]
add eax, eax
push eax
push ecx
call fcn.0049b220
mov ecx, dword [ebp + 0x34ac]
push ecx
call fcn.00524aa2
add esp, 4
jmp 0x4ed00f
mov byte [ebp - 4], 0
mov ecx, dword [ebp + 0x34ac]
test ecx, ecx
je 0x4ecb46
cmp byte [ebp + 0x34bc], 0
je 0x4ecb3d
mov eax, dword [ebp + 0x34b4]
add eax, eax
push eax
push ecx
call fcn.0049b220
mov ecx, dword [ebp + 0x34ac]
push ecx
call fcn.00524aa2
add esp, 4
cmp dword [ebp - 0x3c], 0
jne 0x4ecb74
push 0x30
push 0x35f
call fcn.00497960
push eax
push 0x35e
call fcn.00497960
push eax
push dword [0x57cf9c]
call fcn.004d8380
jmp 0x4ed00f
push 0
push 0x800
lea eax, [ebp + 0x650c]
push eax
push str.Rar_VR
call fcn.004d6f80
test al, al
je 0x4ed00f
push 0x800
lea eax, [ebp + 0x550c]
push eax
call fcn.004d7f20
xor edi, edi
xor bh, bh
cmp dword [ebp - 0x3c], edi
jbe 0x4ecd1c
cmp byte [0x57dfb6], 0
jne 0x4ecd1c
lea eax, [ebp + 0x650c]
push eax
call fcn.004d8860
push 0x800
push edi
lea eax, [ebp + 0x2100]
push eax
lea ecx, [ebp - 0x40]
call fcn.00444010
push eax
call fcn.00486220
push eax
lea eax, [ebp + 0x750c]
push eax
call fcn.0049dc20
push 0
push 0
lea eax, [ebp + 0x750c]
push eax
call fcn.00475640
test eax, eax
je 0x4ecc52
push 1
lea eax, [ebp + 0x750c]
push eax
call fcn.00485f50
push 0
push 0
lea eax, [ebp + 0x750c]
push eax
call fcn.00475640
test eax, eax
je 0x4ecc52
lea eax, [ebp + 0x750c]
push eax
push 0x1f7
call fcn.00497960
push eax
call fcn.004dcc30
add esp, 8
mov ecx, 0x5b77e4
call fcn.0046e910
jmp 0x4ecd09
lea eax, [ebp + 0x750c]
push eax
call fcn.004d8860
push 1
call fcn.004d1ed0
push 0x800
push 0x598eea
push edi
lea eax, [ebp + 0x2100]
push eax
lea ecx, [ebp - 0x40]
call fcn.00444010
push eax
call fcn.00484690
cmp byte [0x57dfb4], 0
jne 0x4ecca1
push 0
push 0
push 0x598eea
mov ecx, 0x5a6670
call fcn.004074c0
cmp byte [0x5a69ac], 0
jne 0x4eccb3
cmp byte [0x5a68fb], 0
je 0x4eccb5
mov bh, 1
mov eax, dword [0x5a6674]
mov ecx, 0x59a00c
mov dword [0x593e90], eax
call fcn.0049def0
mov ecx, 0x599eec
call fcn.0049def0
push 0x541db4
mov ecx, 0x599eec
call fcn.0049dd10
call fcn.004dd3f0
push 1
push 0
mov ecx, 0x5a6670
mov esi, eax
call fcn.00406100
call fcn.004dd3f0
cmp esi, eax
jne 0x4ecd15
cmp byte [0x57dfb7], 0
jne 0x4ecd1c
inc edi
cmp edi, dword [ebp - 0x3c]
jb 0x4ecbb2
jmp 0x4ecd1c
mov byte [0x57dfb7], 1
xor bl, bl
cmp byte [0x57dfb7], bl
jne 0x4ecf7d
push 0
push 0
push 0x598eea
push 0xb
call fcn.004da270
mov bl, al
lea eax, [ebp]
push eax
push 0x550e44
call fcn.004d89d0
add esp, 8
push 0x543
call fcn.00497960
push eax
call fcn.004d89d0
add esp, 4
lea eax, [ebp + 0x650c]
push eax
call fcn.004d8860
lea eax, [ebp + 0x650c]
push eax
push 0x880
lea eax, [ebp + 0x1000]
push eax
call fcn.004e6ad0
push 0x2000
push 0x2b4
lea eax, [ebp + 0x31f8]
push eax
push 0
lea eax, [ebp]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov ecx, eax
shr ecx, 0x10
test ecx, ecx
jne 0x4ecef0
mov ecx, 0x5a4d
cmp ax, cx
je 0x4ecdc6
mov ecx, 0x4550
cmp ax, cx
jne 0x4ecef0
push 0x800
lea eax, [ebp + 0x650c]
push eax
lea eax, [ebp + 0x750c]
push eax
call fcn.0049dc20
push 0x800
lea eax, [ebp + 0x750c]
push eax
call fcn.00484610
lea esi, [ebp + 0x750c]
lea ecx, [esi + 2]
jmp 0x4ece00
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x4ece00
sub esi, ecx
sar esi, 1
call fcn.00524816
push eax
mov eax, 0x800
sub eax, esi
push str.Rar_Scan_d.bat
push eax
lea eax, [ebp + 0x750c]
lea eax, [eax + esi*2]
push eax
call fcn.00402930
add esp, 0x10
lea eax, [ebp + 0x750c]
push 0x5421b8
push eax
call fcn.00476380
mov esi, eax
test esi, esi
je 0x4ecef0
cmp word [ebp], 0x22
je 0x4ece64
push 0x800
lea eax, [ebp]
push eax
call fcn.004b77a0
lea eax, [ebp + 0x1000]
push eax
lea eax, [ebp]
push eax
push str.__s__s_r_n_echo._r_n_pause
lea eax, [ebp + 0x350c]
push 0x1000
push eax
call fcn.00402930
add esp, 0x14
lea eax, [ebp + 0x21f4]
push 0x1000
push eax
lea eax, [ebp + 0x350c]
push eax
call fcn.004a0f90
lea ecx, [ebp + 0x21f4]
mov byte [ebp + 0x31f3], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4eceb0
push esi
sub ecx, edx
lea eax, [ebp + 0x21f4]
push ecx
push 1
push eax
call fcn.00525e32
push esi
call fcn.00525a4d
add esp, 0x14
lea eax, [ebp + 0x750c]
push 0x800
push eax
lea eax, [ebp]
push eax
call fcn.0049dc20
xor eax, eax
mov word [ebp + 0x1000], ax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp + 0x1000]
push eax
lea eax, [ebp + 0x650c]
push eax
lea eax, [ebp]
push eax
push 0
call fcn.004f3fb0
test al, al
je 0x4ecf66
push 0xc8
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4ecf5b
lea ebx, [ebx]
cmp byte [0x57dfb6], 0
jne 0x4ecf5b
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.0044e4d0
push 0xc8
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x4ecf30
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4ecf7d
lea eax, [ebp]
push eax
push 0x201
call fcn.00497960
push eax
call fcn.004dcc30
add esp, 8
lea eax, [ebp + 0x550c]
push eax
call fcn.004d8860
test bh, bh
je 0x4ecffa
push 0x800
lea eax, [ebp + 0x650c]
push eax
lea eax, [ebp + 0x750c]
push eax
call fcn.0049dc20
lea eax, [ebp + 0x750c]
push eax
call fcn.00486220
mov ecx, 0x62
mov word [eax + 0xc], cx
lea eax, [ebp + 0x750c]
push eax
call fcn.004750c0
test al, al
jne 0x4ecffa
lea eax, [ebp + 0x750c]
push eax
lea eax, [ebp + 0x650c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x4ecffa
push 0x800
lea eax, [ebp + 0x750c]
push eax
lea eax, [ebp + 0x650c]
push eax
call fcn.0049dc20
lea eax, [ebp + 0x650c]
push eax
call fcn.004d6350
test bl, bl
je 0x4ed00f
call fcn.004da9e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.00443f20
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x850c]
xor ecx, ebp
call fcn.00507712
lea esp, [ebp + 0x8510]
pop ebp
ret