Function at 0x4be970
Capabilities:
Get file system object information
Move file
Parse pe header
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4f7c36
mov eax, dword fs:[0]
push eax
mov eax, 0x858c
call fcn.004df2e0
mov eax, dword [0x50fb70]
xor eax, esp
mov dword [esp + 0x8588], eax
push ebx
push esi
push edi
mov eax, dword [0x50fb70]
xor eax, esp
push eax
lea eax, [esp + 0x859c]
mov dword fs:[0], eax
mov ecx, dword [0x5354dc]
mov edx, dword [0x5275b4]
lea eax, [esp + 0x3b0]
push eax
push 0x4ba770
push ecx
push str.VIRSCAN
push edx
call dword [sym.imp.USER32.dll_DialogBoxParamW]
test eax, eax
je 0x4befdc
lea ecx, [esp + 0x18]
call fcn.0048b5e0
mov dword [esp + 0x85a4], 0
cmp byte [0x533389], 0
je 0x4bea31
push 0x800
lea eax, [esp + 0x44b4]
push eax
mov ecx, 0x541e38
call fcn.00478250
lea ecx, [esp + 0x44b0]
push ecx
lea ecx, [esp + 0x1c]
call fcn.0048b800
lea ecx, [esp + 0x18]
call fcn.0048b500
mov ebx, 1
jmp 0x4beaaa
lea ecx, [esp + 0xa0]
call fcn.00466ea0
mov ebx, 1
mov byte [esp + 0x85a4], bl
push ebx
lea edx, [esp + 0xa4]
push edx
mov ecx, 0x53fd10
call fcn.0048f5b0
push 0
push 0
push ebx
push 0
push ebx
push 0
lea eax, [esp + 0x30]
push eax
push 3
lea ecx, [esp + 0xc0]
push ecx
call fcn.00499a60
test al, al
jne 0x4bea96
mov byte [esp + 0x85a4], al
lea ecx, [esp + 0xa0]
call fcn.0041cb40
jmp 0x4befc8
mov byte [esp + 0x85a4], 0
lea ecx, [esp + 0xa0]
call fcn.0041cb40
push 0
push 0x800
lea edx, [esp + 0x34b8]
push edx
push str.Rar_VR
call fcn.004adc90
test al, al
je 0x4befc8
push 0x800
lea eax, [esp + 0x759c]
push eax
call fcn.004ae690
xor edi, edi
mov byte [esp + 0x12], 0
cmp dword [esp + 0x84], edi
jbe 0x4bec72
cmp byte [0x535458], 0
jne 0x4bec72
lea ecx, [esp + 0x34b0]
push ecx
call fcn.004ae630
push edi
lea edx, [esp + 0x44b4]
push edx
lea ecx, [esp + 0x20]
call fcn.0048b6d0
push eax
call fcn.00450f20
lea edx, [esp + 0x24b0]
lea ebx, [ebx]
movzx ecx, word [eax]
mov word [edx], cx
add eax, 2
add edx, 2
test cx, cx
jne 0x4beb30
push 0
push 0
lea eax, [esp + 0x24b8]
push eax
call fcn.00443620
test eax, eax
je 0x4beba3
push ebx
lea ecx, [esp + 0x24b4]
push ecx
call fcn.00450c00
push 0
push 0
lea edx, [esp + 0x24b8]
push edx
call fcn.00443620
test eax, eax
je 0x4beba3
lea eax, [esp + 0x24b0]
push eax
push 0x1f7
call fcn.004610c0
push eax
call fcn.004bbb10
add esp, 8
mov ecx, 0x5275b8
call fcn.0043d530
jmp 0x4bec5b
lea ecx, [esp + 0x24b0]
push ecx
call fcn.004ae630
push ebx
call fcn.004a9c20
push 0x800
push 0x550b7a
push edi
lea edx, [esp + 0x44bc]
push edx
lea ecx, [esp + 0x28]
call fcn.0048b6d0
push eax
call fcn.00451c30
cmp byte [0x533389], 0
jne 0x4bebf4
push 0
push 0
push 0x550b7a
mov ecx, 0x541e38
call fcn.004796e0
cmp byte [0x542124], 0
jne 0x4bec06
cmp byte [0x542073], 0
je 0x4bec0a
mov byte [esp + 0x12], bl
mov eax, dword [0x541e3c]
mov ecx, 0x551c90
mov dword [0x54db28], eax
call fcn.00466ce0
mov ecx, 0x551b7c
call fcn.00466ce0
push 0x4fa890
mov ecx, 0x551b7c
call fcn.00466d10
mov esi, dword [0x56abd8]
push ebx
push 0
mov ecx, 0x541e38
call fcn.0047a360
cmp esi, dword [0x56abd8]
jne 0x4bec6c
cmp byte [0x533388], 0
jne 0x4bec72
add edi, ebx
cmp edi, dword [esp + 0x84]
jb 0x4beaf1
jmp 0x4bec72
mov byte [0x533388], bl
cmp byte [0x533388], 0
mov byte [esp + 0x13], 0
jne 0x4bef0d
push 0
push 0
push 0x550b7a
push 9
call fcn.004b1320
lea ecx, [esp + 0x3b0]
push ecx
push 0x4fb5b8
mov byte [esp + 0x1b], al
call fcn.004aec30
add esp, 8
push 0x543
call fcn.004610c0
push eax
call fcn.004aec30
add esp, 4
lea edx, [esp + 0x34b0]
push edx
call fcn.004ae630
lea eax, [esp + 0x13b0]
push eax
lea ebx, [esp + 0x34b4]
call fcn.004b50f0
push 0x2000
push 0x2b4
lea ecx, [esp + 0x104]
push ecx
push 0
lea edx, [esp + 0x3c0]
push edx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov ecx, eax
shr ecx, 0x10
test ecx, ecx
jne 0x4bee6d
mov edx, 0x5a4d
cmp ax, dx
je 0x4bed28
mov ecx, 0x4550
cmp ax, cx
jne 0x4bee6d
xor eax, eax
lea ebx, [ebx]
movzx ecx, word [esp + eax + 0x34b0]
mov word [esp + eax + 0x24b0], cx
add eax, 2
test cx, cx
jne 0x4bed30
push 0x800
lea edx, [esp + 0x24b4]
push edx
call fcn.00450a60
lea eax, [esp + 0x24b0]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4bed64
sub eax, edx
sar eax, 1
mov esi, eax
call fcn.004e2daa
push eax
lea eax, [esp + esi*2 + 0x24b4]
push str.Rar_Scan_d.bat
mov edx, 0x800
sub edx, esi
push eax
call fcn.00493540
add esp, 0xc
push 0x4fb9fc
lea ecx, [esp + 0x24b4]
push ecx
call fcn.00443120
mov esi, eax
test esi, esi
je 0x4bee6d
cmp word [esp + 0x3b0], 0x22
je 0x4bedd0
push 0x800
lea edx, [esp + 0x3b4]
push edx
call fcn.0049d8d0
lea eax, [esp + 0x13b0]
push eax
lea ecx, [esp + 0x3b4]
push ecx
lea edx, [esp + 0x55a0]
push str.__s__s_r_n_echo._r_n_pause
push edx
mov edx, 0x1000
call fcn.00493540
add esp, 0x10
push 0x1000
lea eax, [esp + 0x44b4]
push eax
lea ecx, [esp + 0x55a0]
push ecx
call fcn.004697e0
lea eax, [esp + 0x44b0]
mov byte [esp + 0x54af], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4bee26
sub eax, edx
push esi
push eax
lea edx, [esp + 0x44b8]
push 1
push edx
call fcn.004e3fae
push esi
call fcn.004e0841
add esp, 0x14
push 0x800
lea eax, [esp + 0x24b4]
push eax
lea ecx, [esp + 0x3b8]
push ecx
call fcn.00466930
xor edx, edx
mov word [esp + 0x13b0], dx
push 0
lea eax, [esp + 0x18]
push eax
push 0
lea ecx, [esp + 0x13bc]
push ecx
lea edx, [esp + 0x34c0]
push edx
lea eax, [esp + 0x3c4]
push eax
push 0
call fcn.004c2de0
test al, al
je 0x4beef2
mov ecx, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xc8
push ecx
call esi
cmp eax, 0x102
jne 0x4beee5
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4beec0
cmp byte [0x535458], 0
jne 0x4beee5
push 0x14
call edi
call fcn.00492ef0
mov edx, dword [esp + 0x14]
push 0xc8
push edx
call esi
cmp eax, 0x102
je 0x4beec0
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4bef0d
lea ecx, [esp + 0x3b0]
push ecx
push 0x201
call fcn.004610c0
push eax
call fcn.004bbb10
add esp, 8
lea edx, [esp + 0x7598]
push edx
call fcn.004ae630
cmp byte [esp + 0x12], 0
je 0x4befa8
xor eax, eax
jmp 0x4bef30
movzx ecx, word [esp + eax + 0x34b0]
mov word [esp + eax + 0x24b0], cx
add eax, 2
test cx, cx
jne 0x4bef30
lea eax, [esp + 0x24b0]
push eax
call fcn.00450f20
lea edx, [esp + 0x24b0]
mov ecx, 0x62
push edx
mov word [eax + 0xc], cx
call fcn.004432f0
test al, al
jne 0x4befa8
lea eax, [esp + 0x24b0]
push eax
lea ecx, [esp + 0x34b4]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x4befa8
xor eax, eax
jmp 0x4bef90
movzx ecx, word [esp + eax + 0x24b0]
mov word [esp + eax + 0x34b0], cx
add eax, 2
test cx, cx
jne 0x4bef90
lea edx, [esp + 0x34b0]
push edx
call fcn.004ae2c0
cmp byte [esp + 0x13], 0
je 0x4befc8
mov eax, dword [0x533384]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [esp + 0x85a4], 0xffffffff
lea ecx, [esp + 0x18]
call fcn.004789a0
mov ecx, dword [esp + 0x859c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x8588]
xor ecx, esp
call fcn.004df2c4
add esp, 0x8598
ret