Function at 0x4868f0
Capabilities:
Get common file path
Get file system object information
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 5
add esp, 0xfffff004
push eax
dec eax
jne 0x4868f9
mov eax, dword [ebp - 4]
add esp, 0xfffffb58
push ebx
push esi
push edi
mov edi, 0x4bba40
mov eax, 0x4af638
call fcn.004992ac
lea edx, [ebp - 0xaac]
push edx
push 0x481906
push dword [0x4c6eec]
push str.VIRSCAN
push dword [0x4b41d0]
call sub.USER32.DLL_DialogBoxParamA
test eax, eax
jne 0x486958
mov ecx, dword [ebp - 0x228]
mov dword fs:[0], ecx
mov eax, ecx
jmp 0x486efe
mov word [ebp - 0x218], 8
lea eax, [ebp - 0x10c]
call fcn.00460f64
add dword [ebp - 0x20c], 6
mov word [ebp - 0x218], 0x14
cmp dword [0x4c988c], 0
je 0x4869c2
lea ecx, [ebp - 0x1ebc]
lea edx, [ebp - 0x16bc]
mov eax, 0x4c7c4c
call fcn.00457d7c
lea ecx, [ebp - 0x1ebc]
lea edx, [ebp - 0x16bc]
lea eax, [ebp - 0x10c]
call fcn.0046120c
lea eax, [ebp - 0x10c]
call fcn.00461310
jmp 0x486a95
mov word [ebp - 0x218], 0x20
lea eax, [ebp - 0x204]
call fcn.0040fdcc
add dword [ebp - 0x20c], 4
mov word [ebp - 0x218], 0x2c
lea edx, [ebp - 0x204]
mov eax, 0x4c6f00
xor ecx, ecx
call fcn.0045e814
push 0
push 1
push 0
push 1
push 0
lea ecx, [ebp - 0x10c]
lea eax, [ebp - 0x204]
mov edx, 2
call fcn.004651b4
test al, al
jne 0x486a75
sub dword [ebp - 0x20c], 4
lea eax, [ebp - 0x204]
mov edx, 2
call fcn.0040fea4
dec dword [ebp - 0x20c]
dec dword [ebp - 0x20c]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.0043dac4
sub dword [ebp - 0x20c], 4
lea eax, [ebp - 0x10c]
mov edx, 2
call fcn.0040fea4
mov ecx, dword [ebp - 0x228]
mov dword fs:[0], ecx
jmp 0x486efe
sub dword [ebp - 0x20c], 4
lea eax, [ebp - 0x204]
mov edx, 2
call fcn.0040fea4
mov word [ebp - 0x218], 0x14
lea edx, [ebp - 0x22bc]
mov eax, str.Rar_VRXXXXXX
call fcn.00464330
test al, al
jne 0x486aeb
dec dword [ebp - 0x20c]
dec dword [ebp - 0x20c]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.0043dac4
sub dword [ebp - 0x20c], 4
lea eax, [ebp - 0x10c]
mov edx, 2
call fcn.0040fea4
mov ecx, dword [ebp - 0x228]
mov dword fs:[0], ecx
jmp 0x486efe
lea eax, [ebp - 0x26bc]
push eax
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
mov word [ebp - 0x218], 0x14
xor ebx, ebx
jmp 0x486c92
lea eax, [ebp - 0x22bc]
push eax
call fcn.0049a80c
pop ecx
lea ecx, [ebp - 0x36ec]
lea eax, [ebp - 0x10c]
mov edx, ebx
call fcn.0046126c
lea eax, [ebp - 0x36ec]
call fcn.0040be48
push eax
lea edx, [ebp - 0x2abc]
push edx
call fcn.00498e7c
add esp, 8
lea eax, [ebp - 0x2abc]
xor ecx, ecx
xor edx, edx
call fcn.0040a37c
test eax, eax
je 0x486ba3
lea eax, [ebp - 0x2abc]
mov dl, 1
call fcn.0040c818
lea eax, [ebp - 0x2abc]
xor ecx, ecx
xor edx, edx
call fcn.0040a37c
test eax, eax
je 0x486ba3
lea eax, [ebp - 0x2abc]
push eax
mov eax, 0x1f7
call fcn.004129c8
push eax
call fcn.00487828
add esp, 8
mov eax, 0x4b3b9c
call fcn.0042dd14
jmp 0x486c91
lea edx, [ebp - 0x2abc]
push edx
call fcn.0049a80c
pop ecx
call fcn.00449c20
lea ecx, [ebp - 0x431c]
lea eax, [ebp - 0x10c]
mov edx, ebx
call fcn.0046126c
lea eax, [ebp - 0x431c]
lea edx, [edi + 0x3f00]
call fcn.0040acd8
lea ecx, [ebp - 0x4f4c]
lea eax, [ebp - 0x10c]
mov edx, ebx
call fcn.0046126c
lea eax, [ebp - 0x4f4c]
lea edx, [edi + 0x4300]
add eax, 0x400
call fcn.0040ad28
cmp dword [0x4c988c], 0
jne 0x486c25
push 1
push 0
lea ecx, [edi + 0x4300]
lea edx, [edi + 0x3f00]
mov eax, 0x4c7c4c
call fcn.004567bc
mov ecx, dword [0x4c7e54]
mov dword [edi + 0x2ab0], ecx
mov eax, dword [edi + 0x4b0c]
call fcn.0040ff20
mov eax, dword [edi + 0x4b00]
call fcn.0040ff20
mov edx, str.cth
mov eax, dword [edi + 0x4b00]
call fcn.0040ff50
call fcn.00487a64
mov esi, eax
mov word [ebp - 0x218], 0x14
mov eax, 0x4c7c4c
mov cl, 1
xor edx, edx
call fcn.00452bdc
call fcn.00487a64
cmp esi, eax
je 0x486c88
mov dword [0x4c98a0], 1
cmp dword [0x4c98a0], 0
jne 0x486ca4
inc ebx
cmp ebx, dword [ebp - 8]
jae 0x486ca4
cmp dword [0x4c989c], 0
je 0x486b0c
xor ebx, ebx
cmp dword [0x4c98a0], 0
jne 0x486e8b
push 0
lea edx, [edi + 0x3f00]
xor ecx, ecx
mov eax, 9
call fcn.004735f4
mov ebx, eax
lea eax, [ebp - 0xaac]
call fcn.004755b8
mov eax, 0x543
call fcn.004129c8
call fcn.004755b8
lea edx, [ebp - 0x22bc]
push edx
call fcn.0049a80c
pop ecx
lea edx, [ebp - 0x22bc]
lea eax, [ebp - 0x6ac]
call fcn.0048241a
push 0x2000
lea ecx, [ebp - 0x50ac]
push 0x160
push ecx
lea eax, [ebp - 0xaac]
push 0
push eax
call sub.SHELL32.DLL_SHGetFileInfoA
mov edx, eax
shr edx, 0x10
test dx, dx
jne 0x486d42
mov ecx, eax
and cx, 0xffff
cmp cx, 0x5a4d
je 0x486d46
and ax, 0xffff
cmp ax, 0x4550
je 0x486d46
xor eax, eax
jmp 0x486d4b
mov eax, 1
test al, al
je 0x486e0f
lea edx, [ebp - 0x22bc]
push edx
lea ecx, [ebp - 0x54ac]
push ecx
call fcn.00498e7c
add esp, 8
lea eax, [ebp - 0x54ac]
call fcn.0040c35c
call fcn.004a127c
push eax
push str.__rar_scan_d.bat
lea edx, [ebp - 0x54ac]
push edx
call fcn.00498eac
pop ecx
lea ecx, [ebp - 0x54ac]
add eax, ecx
push eax
call fcn.0049bdcc
add esp, 0xc
push 0x4aeb1e
lea eax, [ebp - 0x54ac]
push eax
call fcn.0049adac
add esp, 8
mov esi, eax
test esi, esi
je 0x486e0f
xor eax, eax
mov al, byte [ebp - 0xaac]
cmp eax, 0x22
je 0x486dcf
lea eax, [ebp - 0xaac]
call fcn.0047dbac
lea edx, [ebp - 0x6ac]
push edx
lea ecx, [ebp - 0xaac]
push ecx
push str.__s__s_r_n_echo._r_n_pause
push esi
call fcn.0049ade0
add esp, 0x10
push esi
call fcn.0049a8b4
pop ecx
lea eax, [ebp - 0x54ac]
push eax
lea edx, [ebp - 0xaac]
push edx
call fcn.00498e7c
add esp, 8
mov byte [ebp - 0x6ac], 0
lea ecx, [ebp - 0x6ac]
lea eax, [ebp - 0x22c]
push ecx
push 0
push eax
lea eax, [ebp - 0xaac]
push 0
lea ecx, [ebp - 0x22bc]
xor edx, edx
call fcn.0046a8f0
test al, al
jne 0x486e60
lea ecx, [ebp - 0xaac]
mov eax, 0x201
push ecx
call fcn.004129c8
push eax
call fcn.00487828
add esp, 8
jmp 0x486e60
push 0x14
call sub.KERNEL32.DLL_Sleep
call fcn.0047d98c
push 0xc8
push dword [ebp - 0x22c]
call sub.KERNEL32.DLL_WaitForSingleObject
cmp eax, 0x102
jne 0x486e80
cmp dword [0x4c989c], 0
je 0x486e54
push dword [ebp - 0x22c]
call sub.KERNEL32.DLL_CloseHandle
lea edx, [ebp - 0x26bc]
push edx
call fcn.0049a80c
pop ecx
lea eax, [ebp - 0x22bc]
call fcn.004644f8
test al, al
je 0x486eb2
lea eax, [ebp - 0x22bc]
call fcn.00463ca0
test bl, bl
je 0x486ec1
push dword [0x4c6ef8]
call sub.USER32.DLL_DestroyWindow
dec dword [ebp - 0x20c]
dec dword [ebp - 0x20c]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.0043dac4
sub dword [ebp - 0x20c], 4
lea eax, [ebp - 0x10c]
mov edx, 2
call fcn.0040fea4
mov ecx, dword [ebp - 0x228]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret