Function at 0x496160
Capabilities:
Get file system object information
Parse pe header
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4b8b26
mov eax, dword fs:[0]
push eax
mov eax, 0x5d34
call fcn.004a5370
mov eax, dword [0x4cc3b0]
xor eax, esp
mov dword [esp + 0x5d30], eax
push ebx
push esi
push edi
mov eax, dword [0x4cc3b0]
xor eax, esp
push eax
lea eax, [esp + 0x5d44]
mov dword fs:[0], eax
mov ecx, dword [0x4eacd4]
mov edx, dword [0x4d76b0]
lea eax, [esp + 0x18c]
push eax
push 0x4926c0
push ecx
push str.VIRSCAN
push edx
call dword [sym.imp.USER32.dll_DialogBoxParamW]
test eax, eax
je 0x496713
lea ecx, [esp + 0x18]
call fcn.0043f460
mov dword [esp + 0x5d4c], 0
cmp byte [0x4e9b89], 0
je 0x49621c
push 0x400
lea eax, [esp + 0x1544]
push eax
mov ecx, 0x4f0dd0
call fcn.004130a0
lea ecx, [esp + 0x1540]
push ecx
lea ecx, [esp + 0x1c]
call fcn.0043f1b0
lea ecx, [esp + 0x18]
call fcn.0043f2e0
jmp 0x496292
lea ecx, [esp + 0xe4]
call fcn.0046b1a0
mov byte [esp + 0x5d4c], 1
push 0
lea edx, [esp + 0xe8]
push edx
mov ecx, 0x4f04a8
call fcn.004408f0
push 0
push 1
push 0
push 1
push 0
lea eax, [esp + 0x2c]
push eax
push 3
lea ecx, [esp + 0x100]
push ecx
call fcn.004638a0
test al, al
jne 0x49627e
mov byte [esp + 0x5d4c], al
lea ecx, [esp + 0xe4]
call fcn.00401ab0
jmp 0x4966ff
mov byte [esp + 0x5d4c], 0
lea ecx, [esp + 0xe4]
call fcn.00401ab0
lea edx, [esp + 0x1d40]
push edx
push str.Rar_VRXXXXXX
call fcn.00485640
test al, al
je 0x4966ff
push 0x400
lea eax, [esp + 0x3544]
push eax
call fcn.00485d40
xor edi, edi
cmp dword [esp + 0xcc], edi
jbe 0x49643f
lea ecx, [ecx]
cmp byte [0x4eac4c], 0
jne 0x49643f
lea ecx, [esp + 0x1d40]
push ecx
call fcn.00485d20
push edi
lea edx, [esp + 0x2544]
push edx
lea ecx, [esp + 0x20]
call fcn.0043f230
push eax
call fcn.00451c20
lea edx, [esp + 0x1540]
lea esp, [esp]
movzx ecx, word [eax]
mov word [edx], cx
add eax, 2
add edx, 2
test cx, cx
jne 0x496310
push 0
push 0
lea eax, [esp + 0x1548]
push eax
push 0
call fcn.004320b0
test eax, eax
je 0x496388
push 1
lea ecx, [esp + 0x1544]
push ecx
call fcn.00451710
push 0
push 0
lea edx, [esp + 0x1548]
push edx
push 0
call fcn.004320b0
test eax, eax
je 0x496388
lea eax, [esp + 0x1540]
push eax
push 0x1f7
call fcn.00461310
push eax
call fcn.004934b0
add esp, 8
mov ecx, 0x4d76b4
call fcn.00428fc0
jmp 0x496428
lea ecx, [esp + 0x1540]
push ecx
call fcn.00485d20
call fcn.00481910
push 0x4f907c
push edi
lea edx, [esp + 0x2548]
push edx
lea ecx, [esp + 0x24]
call fcn.0043f230
push eax
call fcn.004518e0
cmp byte [0x4e9b89], 0
jne 0x4963d3
push 0
push 1
push 0x4f907c
mov ecx, 0x4f0dd0
call fcn.004162e0
mov eax, dword [0x4f0fdc]
mov ecx, dword [0x4f9888]
mov dword [0x4f701c], eax
call fcn.0046ae60
mov ecx, dword [0x4f987c]
call fcn.0046ae60
mov ecx, dword [0x4f987c]
push 0x4ba77c
call fcn.0046b240
mov esi, dword [0x512a68]
push 1
push 0
mov ecx, 0x4f0dd0
call fcn.00417a70
cmp esi, dword [0x512a68]
jne 0x496438
cmp byte [0x4e9b88], 0
jne 0x49643f
inc edi
cmp edi, dword [esp + 0xcc]
jb 0x4962d0
jmp 0x49643f
mov byte [0x4e9b88], 1
xor bl, bl
cmp byte [0x4e9b88], bl
jne 0x4966d4
push 0
push 0
push 0x4f907c
push 9
call fcn.00488810
lea ecx, [esp + 0x18c]
push ecx
mov byte [esp + 0x17], al
call fcn.00486150
push 0x543
call fcn.00461310
push eax
call fcn.00486150
lea edx, [esp + 0x1d40]
push edx
call fcn.00485d20
lea eax, [esp + 0x98c]
push eax
lea ebx, [esp + 0x1d44]
call fcn.0048ca60
push 0x2000
push 0x2b4
lea ecx, [esp + 0x1294]
push ecx
push 0
lea edx, [esp + 0x19c]
push edx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov ecx, eax
shr ecx, 0x10
test ecx, ecx
jne 0x496632
mov edx, 0x5a4d
cmp ax, dx
je 0x4964e6
mov ecx, 0x4550
cmp ax, cx
jne 0x496632
xor eax, eax
jmp 0x4964f0
movzx ecx, word [esp + eax + 0x1d40]
mov word [esp + eax + 0x1540], cx
add eax, 2
test cx, cx
jne 0x4964f0
lea edx, [esp + 0x1540]
push edx
call fcn.004516c0
lea eax, [esp + 0x1540]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x496520
sub eax, edx
sar eax, 1
mov esi, eax
call fcn.004a5e75
push eax
lea eax, [esp + esi*2 + 0x1544]
push str.__rar_scan_d.bat
push eax
mov edx, 0x400
call fcn.0049c820
add esp, 0xc
push 0
push 0x4bae08
lea ecx, [esp + 0x1548]
push ecx
call fcn.00432070
mov esi, eax
test esi, esi
je 0x496632
cmp word [esp + 0x18c], 0x22
je 0x496587
lea edx, [esp + 0x18c]
push edx
call fcn.004471c0
lea eax, [esp + 0x98c]
push eax
lea ecx, [esp + 0x190]
push ecx
lea edx, [esp + 0x3d48]
push str.__s__s_r_n_echo._r_n_pause
push edx
mov edx, 0x1000
call fcn.0049c820
add esp, 0x10
push 0x1000
lea eax, [esp + 0x2544]
push eax
lea ecx, [esp + 0x3d48]
push ecx
call fcn.004731f0
lea eax, [esp + 0x2540]
mov byte [esp + 0x353f], 0
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4965e0
sub eax, edx
push esi
push eax
lea edx, [esp + 0x2548]
push 1
push edx
call fcn.004a6e34
push esi
call fcn.004a6c05
add esp, 0x14
xor eax, eax
jmp 0x496610
movzx ecx, word [esp + eax + 0x1540]
mov word [esp + eax + 0x18c], cx
add eax, 2
test cx, cx
jne 0x496610
xor eax, eax
mov word [esp + 0x98c], ax
push 0
lea ecx, [esp + 0x18]
push ecx
push 0
lea edx, [esp + 0x998]
push edx
lea eax, [esp + 0x1d50]
push eax
lea ecx, [esp + 0x1a0]
push ecx
push 0
call fcn.0049c840
test al, al
jne 0x496679
lea edx, [esp + 0x18c]
push edx
push 0x201
call fcn.00461310
push eax
call fcn.004934b0
add esp, 8
mov eax, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xc8
push eax
call esi
cmp eax, 0x102
jne 0x4966c5
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4966a0
cmp byte [0x4eac4c], 0
jne 0x4966c5
push 0x14
call edi
call fcn.00447110
mov ecx, dword [esp + 0x14]
push 0xc8
push ecx
call esi
cmp eax, 0x102
je 0x4966a0
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, byte [esp + 0x13]
lea eax, [esp + 0x3540]
push eax
call fcn.00485d20
lea ecx, [esp + 0x1d40]
push ecx
call fcn.00485a50
test bl, bl
je 0x4966ff
mov edx, dword [0x4e9b84]
push edx
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [esp + 0x5d4c], 0xffffffff
lea ecx, [esp + 0x18]
call fcn.004147b0
mov ecx, dword [esp + 0x5d44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x5d30]
xor ecx, esp
call fcn.004a4b43
add esp, 0x5d40
ret