Function at 0x48f5d0
Capabilities:
Get common file path
Get file system object information
Parse pe header

Disassembly:
push 0xffffffffffffffff
push 0x4b0196
mov eax, dword fs:[0]
push eax
mov eax, 0x2328
call fcn.0049ebb0
mov eax, dword [0x4c03a0]
xor eax, esp
mov dword [esp + 0x2324], eax
push ebx
push esi
push edi
mov eax, dword [0x4c03a0]
xor eax, esp
push eax
lea eax, [esp + 0x2338]
mov dword fs:[0], eax
mov ecx, dword [0x4dc210]
mov edx, dword [0x4c93a8]
lea eax, [esp + 0x284]
push eax
push 0x48c160
push ecx
push str.VIRSCAN
push edx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
test eax, eax
je 0x48fb47
lea ecx, [esp + 0x18]
call fcn.0043d260
mov dword [esp + 0x2340], 0
cmp dword [0x4dbca4], 0
je 0x48f697
lea eax, [esp + 0x1304]
push eax
lea ecx, [esp + 0xb08]
push ecx
mov ecx, 0x4e0c60
call fcn.00413520
lea edx, [esp + 0x1304]
push edx
lea eax, [esp + 0xb08]
push eax
lea ecx, [esp + 0x20]
call fcn.0043d000
lea ecx, [esp + 0x18]
call fcn.0043d140
jmp 0x48f70d
lea ecx, [esp + 0x124]
call fcn.004658e0
mov byte [esp + 0x2340], 1
push 0
lea ecx, [esp + 0x128]
push ecx
mov ecx, 0x4dff38
call fcn.0043f170
push 0
push 1
push 0
push 1
push 0
lea edx, [esp + 0x2c]
push edx
push 3
lea eax, [esp + 0x140]
push eax
call fcn.0045e440
test al, al
jne 0x48f6f9
mov byte [esp + 0x2340], al
lea ecx, [esp + 0x124]
call fcn.00465560
jmp 0x48fb33
mov byte [esp + 0x2340], 0
lea ecx, [esp + 0x124]
call fcn.00465560
lea ecx, [esp + 0xf04]
push ecx
push str.Rar_VRXXXXXX
call fcn.0047f110
test al, al
je 0x48fb33
lea edx, [esp + 0x1f34]
push edx
push 0x400
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
xor edi, edi
cmp dword [esp + 0x11c], edi
jbe 0x48f8e5
lea esp, [esp]
cmp dword [0x4dc1c0], 0
jne 0x48f8e5
lea eax, [esp + 0xf04]
push eax
call fcn.004acbe8
add esp, 4
push edi
lea ecx, [esp + 0x1308]
push ecx
lea ecx, [esp + 0x20]
call fcn.0043d090
push eax
call fcn.0044daf0
lea edx, [esp + 0xb04]
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
test cl, cl
jne 0x48f790
push 0
push 0
push 0
lea edx, [esp + 0xb10]
push edx
call fcn.00430520
test eax, eax
je 0x48f801
push 1
lea eax, [esp + 0xb08]
push eax
call fcn.0044e680
push 0
push 0
push 0
lea ecx, [esp + 0xb10]
push ecx
call fcn.00430520
test eax, eax
je 0x48f801
lea edx, [esp + 0xb04]
push edx
push 0x1f7
call fcn.0045be10
push eax
call fcn.0048cd40
add esp, 8
mov ecx, 0x4c93ac
call fcn.00428050
jmp 0x48f8cb
lea eax, [esp + 0xb04]
push eax
call fcn.004acbe8
add esp, 4
call fcn.0047b3d0
push 0x4e75f4
push edi
lea ecx, [esp + 0x130c]
push ecx
lea ecx, [esp + 0x24]
call fcn.0043d090
push eax
call fcn.0042fda0
push 0x4e79f4
push edi
lea edx, [esp + 0x130c]
push edx
lea ecx, [esp + 0x24]
call fcn.0043d090
add eax, 0x400
push eax
call fcn.0042fe30
cmp dword [0x4dbca4], 0
jne 0x48f876
push 0
push 1
push 0x4e79f4
push 0x4e75f4
mov ecx, 0x4e0c60
call fcn.00414490
mov eax, dword [0x4e0e68]
mov ecx, dword [0x4e8200]
mov dword [0x4e6194], eax
call fcn.004655e0
mov ecx, dword [0x4e81f4]
call fcn.004655e0
mov ecx, dword [0x4e81f4]
push 0x4b175c
call fcn.00465960
mov esi, dword [0x4f82c0]
push 1
push 0
mov ecx, 0x4e0c60
call fcn.004160e0
cmp esi, dword [0x4f82c0]
jne 0x48f8db
cmp dword [0x4db888], 0
jne 0x48f8e5
inc edi
cmp edi, dword [esp + 0x11c]
jb 0x48f750
jmp 0x48f8e5
mov dword [0x4db888], 1
xor bl, bl
cmp dword [0x4db888], 0
jne 0x48fb06
push 0
push 0
push 0x4e75f4
push 9
call fcn.00481ad0
lea ecx, [esp + 0x284]
push ecx
mov byte [esp + 0x17], al
call fcn.0047f8e0
push 0x543
call fcn.0045be10
push eax
call fcn.0047f8e0
lea edx, [esp + 0xf04]
push edx
call fcn.004acbe8
add esp, 4
lea eax, [esp + 0x684]
push eax
lea ebx, [esp + 0xf08]
call fcn.004867b0
push 0x2000
push 0x160
lea ecx, [esp + 0x12c]
push ecx
push 0
lea edx, [esp + 0x294]
push edx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov ecx, eax
shr ecx, 0x10
test ecx, ecx
jne 0x48fa6a
mov edx, 0x5a4d
cmp ax, dx
je 0x48f990
mov ecx, 0x4550
cmp ax, cx
jne 0x48fa6a
xor eax, eax
jmp 0x48f9a0
mov cl, byte [esp + eax + 0xf04]
mov byte [esp + eax + 0xb04], cl
inc eax
test cl, cl
jne 0x48f9a0
lea edx, [esp + 0xb04]
push edx
call fcn.0044df70
lea eax, [esp + 0xb04]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x48f9d0
sub eax, edx
mov esi, eax
call fcn.0049f4dd
push eax
lea eax, [esp + esi + 0xb08]
push str.__rar_scan_d.bat
push eax
call fcn.0049e635
lea ecx, [esp + 0xb10]
push 0x4b1ba8
push ecx
call fcn.0049fec8
mov esi, eax
add esp, 0x14
test esi, esi
je 0x48fa6a
cmp byte [esp + 0x284], 0x22
je 0x48fa25
lea edx, [esp + 0x284]
push edx
call fcn.00445900
lea eax, [esp + 0x684]
push eax
lea ecx, [esp + 0x288]
push ecx
push str.__s__s_r_n_echo._r_n_pause
push esi
call fcn.004a1cc1
push esi
call fcn.0049fba6
add esp, 0x14
xor eax, eax
jmp 0x48fa50
mov cl, byte [esp + eax + 0xb04]
mov byte [esp + eax + 0x284], cl
inc eax
test cl, cl
jne 0x48fa50
mov byte [esp + 0x684], cl
push 0
lea edx, [esp + 0x18]
push edx
push 0
push 0
lea eax, [esp + 0x694]
push eax
lea ecx, [esp + 0xf18]
push ecx
push 0
lea edx, [esp + 0x2a0]
push edx
call fcn.00496190
test al, al
jne 0x48fab3
lea eax, [esp + 0x284]
push eax
push 0x201
call fcn.0045be10
push eax
call fcn.0048cd40
add esp, 8
mov ecx, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xc8
push ecx
call esi
cmp eax, 0x102
jne 0x48faf7
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x4dc1c0], 0
jne 0x48faf7
push 0x14
call edi
call fcn.00445860
mov edx, dword [esp + 0x14]
push 0xc8
push edx
call esi
cmp eax, 0x102
je 0x48fad2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, byte [esp + 0x13]
lea ecx, [esp + 0x1f34]
push ecx
call fcn.004acbe8
add esp, 4
lea edx, [esp + 0xf04]
push edx
call fcn.0047f270
test bl, bl
je 0x48fb33
mov eax, dword [0x4db884]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [esp + 0x2340], 0xffffffff
lea ecx, [esp + 0x18]
call fcn.00401920
mov ecx, dword [esp + 0x2338]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2324]
xor ecx, esp
call fcn.0049e626
add esp, 0x2334
ret