Function at 0x4a2380
Capabilities:
Create thread
Query environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x1818]
mov eax, 0x1818
call fcn.004b1040
push 0xffffffffffffffff
push 0x4c62d8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x4da8f0]
xor eax, ebp
mov dword [ebp + 0x1814], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 0x1820]
push 1
call fcn.00471900
push 0x8005
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
call fcn.00470130
mov ecx, 0x5248e0
call fcn.0041fc80
xor edi, edi
mov byte [0x51c859], 0
mov dword [0x51b780], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x51c8d8], eax
push edi
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x51c840], eax
push str.WMUser_DisplayError
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov dword [0x51b78c], eax
push 0x4c7f2c
call fcn.00460dc0
test al, al
sete byte [ebp - 0x12]
lea eax, [ebp + 0x800]
push eax
call fcn.00457020
lea ecx, [ebp + 0x800]
push ecx
call fcn.004561a0
xor eax, eax
jmp 0x4a2450
movzx ecx, word [ebp + eax + 0x800]
mov word [eax + 0x51b790], cx
add eax, 2
cmp cx, di
jne 0x4a2450
mov eax, 0x51b790
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4a2470
sub eax, edx
sar eax, 1
push 0x1000000
lea edx, [eax*2 + 0x51b790]
push edx
push str.rar.log
call fcn.00477f50
push edi
push esi
mov ecx, 0x50833c
call fcn.00467280
push str.winrar.lng
mov ecx, 0x50831c
call fcn.00466f20
push esi
call fcn.004a1580
test eax, eax
je 0x4a2b53
lea ecx, [ebp - 0x20]
call fcn.00492900
mov dword [ebp - 4], edi
mov dword [0x5082fc], esi
mov ecx, 0x5229e0
call fcn.00416a30
call fcn.0048a200
call fcn.00488c80
call fcn.0049e1d0
call fcn.0049e3a0
push str.WinRAR_Busy
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x51c8d4], eax
push edi
push str.WinRarWindow
mov ebx, dword [sym.imp.USER32.dll_FindWindowW]
call ebx
mov dword [ebp - 0x18], eax
push edi
push esi
push edi
push edi
push 0x80000000
push 0x80000000
push 0x80000000
push 0x80000000
push 0x6cf0000
push 0x4c9898
push str.WinRarWindow
push 0x10
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [0x51c8dc], eax
cmp eax, edi
je 0x4a2b44
push eax
mov ecx, 0x50831c
call fcn.00465f90
push edi
call fcn.0049dc10
call fcn.0049e120
cmp byte [ebp - 0x12], 0
je 0x4a2579
push 1
push edi
call fcn.00421ef0
test al, al
mov byte [ebp - 0x11], 1
je 0x4a257d
mov byte [ebp - 0x11], 0
lea eax, [ebp + 0x1800]
push eax
call fcn.0049db00
movzx ecx, word [ebp + 0x1800]
push ecx
call fcn.004785b0
movzx esi, ax
push 0xd0
push edi
push 0x523f20
call fcn.004b14b0
add esp, 0xc
push edi
push edi
mov ecx, 0x5248e0
call fcn.0041fe10
cmp si, di
je 0x4a2626
cmp byte [0x5258f0], 0
jne 0x4a2626
push esi
push str.AFUMD
call fcn.004b1c12
add esp, 8
test eax, eax
jne 0x4a25e7
cmp si, 0x43
jne 0x4a2603
cmp word [ebp + 0x1802], di
jne 0x4a2603
call fcn.004889c0
cmp si, 0x44
je 0x4a25f8
cmp si, 0x43
jne 0x4a262c
xor edx, edx
mov word [0x5250f0], dx
jmp 0x4a262c
cmp byte [0x5258f0], 0
jne 0x4a2626
push esi
push 0x4cf204
call fcn.004b1c12
add esp, 8
test eax, eax
je 0x4a2626
push edi
call fcn.00490130
jmp 0x4a262c
push edi
call fcn.00488820
push edi
push edi
mov ecx, 0x5248e0
call fcn.0041fe10
push 0x5248e0
mov ecx, 0x51cd10
call fcn.00415460
xor eax, eax
lea esp, [esp]
movzx ecx, word [eax + 0x52aca2]
mov word [eax + 0x51c040], cx
add eax, 2
cmp cx, di
jne 0x4a2650
xor eax, eax
mov word [0x52aca2], ax
mov dword [0x51bfa4], edi
mov byte [ebp - 4], 1
call fcn.004a1c60
mov dword [ebp - 4], edi
cmp byte [0x529c3e], 0
jne 0x4a2b44
mov ecx, dword [0x51c8dc]
push ecx
call fcn.0049dcc0
cmp byte [0x527dff], 0
je 0x4a26cd
push 0x527dff
call fcn.004567a0
push 0x1000000
push 0x51b790
cmp eax, 0x527dff
jne 0x4a26c3
call fcn.00456820
push eax
push 0x527dff
call fcn.00477f50
push edi
push edi
push 0x8003
mov edx, dword [0x51c8dc]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x51c8dc], edi
je 0x4a287d
cmp byte [0x529c72], 0
jne 0x4a2ac6
xor bl, bl
cmp word [0x52aca2], di
je 0x4a2a27
push 0x52aca2
push edi
call fcn.00435b40
cmp eax, 0xffffffff
je 0x4a271f
test al, 0x10
je 0x4a271f
mov bl, 1
cmp word [0x52aca2], di
je 0x4a2a0f
test bl, bl
jne 0x4a2a13
push edi
push str.ReuseWindow
push 0x4c7f2c
call fcn.00460ee0
test eax, eax
je 0x4a2846
cmp dword [ebp - 0x18], edi
je 0x4a2846
push 0x400
lea eax, [ebp + 0x1000]
push eax
call fcn.0048bd60
lea ecx, [ebp + 0x1000]
push ecx
call fcn.004561a0
lea eax, [ebp + 0x1000]
add eax, 0xfffffffe
jmp 0x4a2780
mov cx, word [eax + 2]
add eax, 2
cmp cx, di
jne 0x4a2780
mov edx, dword [str.Rar_]
mov dword [eax], edx
mov ecx, dword [0x4cd758]
mov dword [eax + 4], ecx
mov dx, word [0x4cd75c]
mov word [eax + 8], dx
lea eax, [ebp + 0x1000]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4a27b1
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp + 0x1000]
push eax
push 0x52aca2
call fcn.004783c0
test eax, eax
je 0x4a2846
push str.RarArchiveWideName
push 0x800
push 0
push 0x8000004
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
push 0x800
push 0
push 0
push 2
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
push edi
push 0x52aca2
call fcn.004564e0
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push 0x7ae964f1
push 0xd489ac5e
push 0x8001
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
setne bl
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
jne 0x4a29f1
push 0x52aca2
mov ecx, 0x5220b8
call fcn.0044a780
test al, al
je 0x4a29f1
cmp byte [0x51b789], 0
jne 0x4a287d
cmp dword [0x51c030], 0
je 0x4a29df
mov ecx, 0x5220b8
call fcn.0044acf0
mov esi, dword [ebp - 0x18]
push esi
push 0x10000
push 0x49afd0
call fcn.004b22bb
add esp, 0xc
mov eax, dword [0x51c8dc]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x4a28b1
test esi, esi
setne cl
movzx edx, cl
push edx
call fcn.0049ded0
mov eax, dword [0x51c8dc]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
cmp byte [ebp - 0x11], 0
je 0x4a28ec
cmp byte [ebp - 0x12], 0
je 0x4a28ec
push 0x4c7df0
call fcn.00460dc0
test al, al
jne 0x4a28ec
push 0x4c9670
call fcn.00442c30
test al, al
jne 0x4a28ec
push 6
call fcn.00421ce0
push 0
push str.ExportedSettings
push 0x4c79a8
call fcn.00460ee0
test eax, eax
je 0x4a2906
call fcn.00421be0
push 0
push 1
call fcn.00461460
push 0
push str.WizardMode
push 0x4c7f2c
call fcn.00460ee0
test eax, eax
je 0x4a2950
mov ecx, dword [0x51c8dc]
push ecx
call fcn.004a6c00
test al, al
je 0x4a2950
cmp dword [0x51c030], 0
jne 0x4a2950
mov edx, dword [0x51c8dc]
push edx
call dword [sym.imp.USER32.dll_DestroyWindow]
lea ebx, [ebx]
push 0
push 0
call fcn.004a16e0
test al, al
jne 0x4a2950
mov ecx, 0x5220b4
call fcn.004a2c00
call fcn.00493fb0
mov eax, dword [0x51c840]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov byte [0x51c859], 1
xor esi, esi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x51b780], 0
jle 0x4a299d
push 0x64
call edi
dec esi
cmp esi, 0xc8
jl 0x4a2987
mov ecx, dword [0x51c840]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x51bfa0], 0
je 0x4a2b1d
mov dword [0x51bfa0], 0xffffffff
xor esi, esi
cmp dword [0x51bfa0], 0
je 0x4a2b3a
push 0x64
call edi
inc esi
cmp esi, 0xa
jl 0x4a29c3
jmp 0x4a2b3a
mov edx, dword [0x51c8dc]
push edx
call dword [sym.imp.USER32.dll_DestroyWindow]
jmp 0x4a287d
call fcn.00494130
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00492970
mov eax, 1
jmp 0x4a2b84
test bl, bl
je 0x4a2a27
push 0x52aca2
call fcn.0049df80
push 0x52aca2
jmp 0x4a2aa7
push 1
push str.RestoreFolder
push 0x4c7f2c
call fcn.00460ee0
push 0x400
push 0x4c79a8
test eax, eax
je 0x4a2a65
lea eax, [ebp + 0x1000]
push eax
push str.LastFolder
push 0x4c7f2c
call fcn.00460eb0
lea ecx, [ebp + 0x1000]
push ecx
jmp 0x4a2aa7
lea edx, [ebp]
push edx
push str.StartFolder
push 0x4c7a48
call fcn.00460eb0
push 0x400
lea eax, [ebp + 0x1000]
push eax
lea ecx, [ebp]
push ecx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor edx, edx
mov word [ebp + 0x17fe], dx
cmp word [ebp + 0x1000], di
je 0x4a2aac
lea eax, [ebp + 0x1000]
push eax
call fcn.0048be70
push edi
mov ecx, 0x5220b8
call fcn.004492b0
mov ecx, 0x5220a8
call fcn.004076c0
jmp 0x4a287d
push 0x523f20
call fcn.004a1fd0
call fcn.00494130
cmp dword [0x51bfa4], 1
jne 0x4a287d
push edi
push str.WinRarWindow
call ebx
test eax, eax
sete cl
movzx edx, cl
push edx
push 1
call fcn.0049a420
mov ecx, 0x508310
call fcn.0041d640
mov esi, dword [0x508304]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00492970
mov eax, esi
jmp 0x4a2b84
push 0
push str.WinRarWindow
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
sete dl
movzx eax, dl
push eax
push 1
call fcn.0049a420
mov ecx, 0x508310
call fcn.0041d640
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00492970
xor eax, eax
jmp 0x4a2b84
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1814]
xor ecx, ebp
call fcn.004b102c
add ebp, 0x1818
mov esp, ebp
pop ebp
ret 0x10