Function at 0x4a0cc0
Capabilities:
Create thread
Query environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x1818]
mov eax, 0x1818
call fcn.004af740
push 0xffffffffffffffff
push 0x4c4808
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x4d88f0]
xor eax, ebp
mov dword [ebp + 0x1814], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 0x1820]
push 1
call fcn.00470300
push 0x8005
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
call fcn.0046eb80
mov ecx, 0x5228d0
call fcn.0041f3c0
xor edi, edi
mov byte [0x51a849], 0
mov dword [0x519770], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x51a8c8], eax
push edi
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x51a830], eax
push str.WMUser_DisplayError
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov dword [0x51977c], eax
push 0x4c5f2c
call fcn.0045fb20
test al, al
sete byte [ebp - 0x12]
lea eax, [ebp + 0x800]
push eax
call fcn.00455f40
lea ecx, [ebp + 0x800]
push ecx
call fcn.004550c0
xor eax, eax
jmp 0x4a0d90
movzx ecx, word [ebp + eax + 0x800]
mov word [eax + 0x519780], cx
add eax, 2
cmp cx, di
jne 0x4a0d90
mov eax, 0x519780
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4a0db0
sub eax, edx
sar eax, 1
push 0x1000000
lea edx, [eax*2 + 0x519780]
push edx
push str.rar.log
call fcn.00476860
push edi
push esi
mov ecx, 0x50632c
call fcn.004660b0
push str.winrar.lng
mov ecx, 0x50630c
call fcn.00465d60
push esi
call fcn.0049fec0
test eax, eax
je 0x4a1493
lea ecx, [ebp - 0x20]
call fcn.00491250
mov dword [ebp - 4], edi
mov dword [0x5062ec], esi
mov ecx, 0x5209d0
call fcn.004169b0
call fcn.00488a50
call fcn.004874d0
call fcn.0049cb10
call fcn.0049cce0
push str.WinRAR_Busy
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x51a8c4], eax
push edi
push str.WinRarWindow
mov ebx, dword [sym.imp.USER32.dll_FindWindowW]
call ebx
mov dword [ebp - 0x18], eax
push edi
push esi
push edi
push edi
push 0x80000000
push 0x80000000
push 0x80000000
push 0x80000000
push 0x6cf0000
push 0x4c786c
push str.WinRarWindow
push 0x10
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [0x51a8cc], eax
cmp eax, edi
je 0x4a1484
push eax
mov ecx, 0x50630c
call fcn.00464dd0
push edi
call fcn.0049c550
call fcn.0049ca60
cmp byte [ebp - 0x12], 0
je 0x4a0eb9
push 1
push edi
call fcn.00421610
test al, al
mov byte [ebp - 0x11], 1
je 0x4a0ebd
mov byte [ebp - 0x11], 0
lea eax, [ebp + 0x1800]
push eax
call fcn.0049c440
movzx ecx, word [ebp + 0x1800]
push ecx
call fcn.00476ea0
movzx esi, ax
push 0xd0
push edi
push 0x521f10
call fcn.004afbb0
add esp, 0xc
push edi
push edi
mov ecx, 0x5228d0
call fcn.0041f530
cmp si, di
je 0x4a0f66
cmp byte [0x5238e0], 0
jne 0x4a0f66
push esi
push str.AFUMD
call fcn.004b0312
add esp, 8
test eax, eax
jne 0x4a0f27
cmp si, 0x43
jne 0x4a0f43
cmp word [ebp + 0x1802], di
jne 0x4a0f43
call fcn.00487210
cmp si, 0x44
je 0x4a0f38
cmp si, 0x43
jne 0x4a0f6c
xor edx, edx
mov word [0x5230e0], dx
jmp 0x4a0f6c
cmp byte [0x5238e0], 0
jne 0x4a0f66
push esi
push 0x4cd174
call fcn.004b0312
add esp, 8
test eax, eax
je 0x4a0f66
push edi
call fcn.0048ea50
jmp 0x4a0f6c
push edi
call fcn.00487070
push edi
push edi
mov ecx, 0x5228d0
call fcn.0041f530
push 0x5228d0
mov ecx, 0x51ad00
call fcn.004153e0
xor eax, eax
lea esp, [esp]
movzx ecx, word [eax + 0x528c92]
mov word [eax + 0x51a030], cx
add eax, 2
cmp cx, di
jne 0x4a0f90
xor eax, eax
mov word [0x528c92], ax
mov dword [0x519f94], edi
mov byte [ebp - 4], 1
call fcn.004a05a0
mov dword [ebp - 4], edi
cmp byte [0x527c2e], 0
jne 0x4a1484
mov ecx, dword [0x51a8cc]
push ecx
call fcn.0049c600
cmp byte [0x525ded], 0
je 0x4a100d
push 0x525ded
call fcn.004556c0
push 0x1000000
push 0x519780
cmp eax, 0x525ded
jne 0x4a1003
call fcn.00455740
push eax
push 0x525ded
call fcn.00476860
push edi
push edi
push 0x8003
mov edx, dword [0x51a8cc]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x51a8cc], edi
je 0x4a11bd
cmp byte [0x527c61], 0
jne 0x4a1406
xor bl, bl
cmp word [0x528c92], di
je 0x4a1367
push 0x528c92
push edi
call fcn.00434fb0
cmp eax, 0xffffffff
je 0x4a105f
test al, 0x10
je 0x4a105f
mov bl, 1
cmp word [0x528c92], di
je 0x4a134f
test bl, bl
jne 0x4a1353
push edi
push str.ReuseWindow
push 0x4c5f2c
call fcn.0045fc40
test eax, eax
je 0x4a1186
cmp dword [ebp - 0x18], edi
je 0x4a1186
push 0x400
lea eax, [ebp + 0x1000]
push eax
call fcn.0048a680
lea ecx, [ebp + 0x1000]
push ecx
call fcn.004550c0
lea eax, [ebp + 0x1000]
add eax, 0xfffffffe
jmp 0x4a10c0
mov cx, word [eax + 2]
add eax, 2
cmp cx, di
jne 0x4a10c0
mov edx, dword [str.Rar_]
mov dword [eax], edx
mov ecx, dword [0x4cb6c8]
mov dword [eax + 4], ecx
mov dx, word [0x4cb6cc]
mov word [eax + 8], dx
lea eax, [ebp + 0x1000]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4a10f1
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp + 0x1000]
push eax
push 0x528c92
call fcn.00476cb0
test eax, eax
je 0x4a1186
push str.RarArchiveWideName
push 0x800
push 0
push 0x8000004
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
push 0x800
push 0
push 0
push 2
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
push edi
push 0x528c92
call fcn.00455400
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push 0x7ae964f1
push 0xd489ac5e
push 0x8001
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
setne bl
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
jne 0x4a1331
push 0x528c92
mov ecx, 0x5200a8
call fcn.004499f0
test al, al
je 0x4a1331
cmp byte [0x519779], 0
jne 0x4a11bd
cmp dword [0x51a020], 0
je 0x4a131f
mov ecx, 0x5200a8
call fcn.00449f60
mov esi, dword [ebp - 0x18]
push esi
push 0x10000
push 0x499930
call fcn.004b09bb
add esp, 0xc
mov eax, dword [0x51a8cc]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x4a11f1
test esi, esi
setne cl
movzx edx, cl
push edx
call fcn.0049c810
mov eax, dword [0x51a8cc]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
cmp byte [ebp - 0x11], 0
je 0x4a122c
cmp byte [ebp - 0x12], 0
je 0x4a122c
push 0x4c5df0
call fcn.0045fb20
test al, al
jne 0x4a122c
push 0x4c7644
call fcn.00441f20
test al, al
jne 0x4a122c
push 6
call fcn.00421400
push 0
push str.ExportedSettings
push 0x4c5d80
call fcn.0045fc40
test eax, eax
je 0x4a1246
call fcn.00421300
push 0
push 1
call fcn.004601c0
push 0
push str.WizardMode
push 0x4c5f2c
call fcn.0045fc40
test eax, eax
je 0x4a1290
mov ecx, dword [0x51a8cc]
push ecx
call fcn.004a5360
test al, al
je 0x4a1290
cmp dword [0x51a020], 0
jne 0x4a1290
mov edx, dword [0x51a8cc]
push edx
call dword [sym.imp.USER32.dll_DestroyWindow]
lea ebx, [ebx]
push 0
push 0
call fcn.004a0020
test al, al
jne 0x4a1290
mov ecx, 0x5200a4
call fcn.004a1680
call fcn.00492910
mov eax, dword [0x51a830]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov byte [0x51a849], 1
xor esi, esi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x519770], 0
jle 0x4a12dd
push 0x64
call edi
dec esi
cmp esi, 0xc8
jl 0x4a12c7
mov ecx, dword [0x51a830]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x519f90], 0
je 0x4a145d
mov dword [0x519f90], 0xffffffff
xor esi, esi
cmp dword [0x519f90], 0
je 0x4a147a
push 0x64
call edi
inc esi
cmp esi, 0xa
jl 0x4a1303
jmp 0x4a147a
mov edx, dword [0x51a8cc]
push edx
call dword [sym.imp.USER32.dll_DestroyWindow]
jmp 0x4a11bd
call fcn.00492a90
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.004912c0
mov eax, 1
jmp 0x4a14c4
test bl, bl
je 0x4a1367
push 0x528c92
call fcn.0049c8c0
push 0x528c92
jmp 0x4a13e7
push 1
push str.RestoreFolder
push 0x4c5f2c
call fcn.0045fc40
push 0x400
push 0x4c5d80
test eax, eax
je 0x4a13a5
lea eax, [ebp + 0x1000]
push eax
push str.LastFolder
push 0x4c5f2c
call fcn.0045fc10
lea ecx, [ebp + 0x1000]
push ecx
jmp 0x4a13e7
lea edx, [ebp]
push edx
push str.StartFolder
push 0x4c5a44
call fcn.0045fc10
push 0x400
lea eax, [ebp + 0x1000]
push eax
lea ecx, [ebp]
push ecx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor edx, edx
mov word [ebp + 0x17fe], dx
cmp word [ebp + 0x1000], di
je 0x4a13ec
lea eax, [ebp + 0x1000]
push eax
call fcn.0048a790
push edi
mov ecx, 0x5200a8
call fcn.00448520
mov ecx, 0x520098
call fcn.004076d0
jmp 0x4a11bd
push 0x521f10
call fcn.004a0910
call fcn.00492a90
cmp dword [0x519f94], 1
jne 0x4a11bd
push edi
push str.WinRarWindow
call ebx
test eax, eax
sete cl
movzx edx, cl
push edx
push 1
call fcn.00498d80
mov ecx, 0x506300
call fcn.0041cdb0
mov esi, dword [0x5062f4]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.004912c0
mov eax, esi
jmp 0x4a14c4
push 0
push str.WinRarWindow
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
sete dl
movzx eax, dl
push eax
push 1
call fcn.00498d80
mov ecx, 0x506300
call fcn.0041cdb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.004912c0
xor eax, eax
jmp 0x4a14c4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1814]
xor ecx, ebp
call fcn.004af72c
add ebp, 0x1818
mov esp, ebp
pop ebp
ret 0x10