Function at 0x495400
Capabilities:
Get file system object information
Parse pe header
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4b6d96
mov eax, dword fs:[0]
push eax
mov eax, 0x5d34
call fcn.004a4490
mov eax, dword [0x4ca3b0]
xor eax, esp
mov dword [esp + 0x5d30], eax
push ebx
push esi
push edi
mov eax, dword [0x4ca3b0]
xor eax, esp
push eax
lea eax, [esp + 0x5d44]
mov dword fs:[0], eax
mov ecx, dword [0x4e8cd4]
mov edx, dword [0x4d56b0]
lea eax, [esp + 0x18c]
push eax
push 0x491910
push ecx
push str.VIRSCAN
push edx
call dword [sym.imp.USER32.dll_DialogBoxParamW]
test eax, eax
je 0x4959b3
lea ecx, [esp + 0x18]
call fcn.0043eef0
mov dword [esp + 0x5d4c], 0
cmp byte [0x4e7b89], 0
je 0x4954bc
push 0x400
lea eax, [esp + 0x1544]
push eax
mov ecx, 0x4eeda0
call fcn.00412f80
lea ecx, [esp + 0x1540]
push ecx
lea ecx, [esp + 0x1c]
call fcn.0043ec40
lea ecx, [esp + 0x18]
call fcn.0043ed70
jmp 0x495532
lea ecx, [esp + 0xe4]
call fcn.0046a800
mov byte [esp + 0x5d4c], 1
push 0
lea edx, [esp + 0xe8]
push edx
mov ecx, 0x4ee478
call fcn.00440380
push 0
push 1
push 0
push 1
push 0
lea eax, [esp + 0x2c]
push eax
push 3
lea ecx, [esp + 0x100]
push ecx
call fcn.00462fc0
test al, al
jne 0x49551e
mov byte [esp + 0x5d4c], al
lea ecx, [esp + 0xe4]
call fcn.00401b00
jmp 0x49599f
mov byte [esp + 0x5d4c], 0
lea ecx, [esp + 0xe4]
call fcn.00401b00
lea edx, [esp + 0x1d40]
push edx
push str.Rar_VRXXXXXX
call fcn.00484a20
test al, al
je 0x49599f
push 0x400
lea eax, [esp + 0x3544]
push eax
call fcn.004850e0
xor edi, edi
cmp dword [esp + 0xcc], edi
jbe 0x4956df
lea ecx, [ecx]
cmp byte [0x4e8c4c], 0
jne 0x4956df
lea ecx, [esp + 0x1d40]
push ecx
call fcn.004850c0
push edi
lea edx, [esp + 0x2544]
push edx
lea ecx, [esp + 0x20]
call fcn.0043ecc0
push eax
call fcn.004515b0
lea edx, [esp + 0x1540]
lea esp, [esp]
movzx ecx, word [eax]
mov word [edx], cx
add eax, 2
add edx, 2
test cx, cx
jne 0x4955b0
push 0
push 0
lea eax, [esp + 0x1548]
push eax
push 0
call fcn.00431bd0
test eax, eax
je 0x495628
push 1
lea ecx, [esp + 0x1544]
push ecx
call fcn.004510a0
push 0
push 0
lea edx, [esp + 0x1548]
push edx
push 0
call fcn.00431bd0
test eax, eax
je 0x495628
lea eax, [esp + 0x1540]
push eax
push 0x1f7
call fcn.00460a30
push eax
call fcn.004926f0
add esp, 8
mov ecx, 0x4d56b4
call fcn.00428cd0
jmp 0x4956c8
lea ecx, [esp + 0x1540]
push ecx
call fcn.004850c0
call fcn.00480dd0
push 0x4f701c
push edi
lea edx, [esp + 0x2548]
push edx
lea ecx, [esp + 0x24]
call fcn.0043ecc0
push eax
call fcn.00451270
cmp byte [0x4e7b89], 0
jne 0x495673
push 0
push 1
push 0x4f701c
mov ecx, 0x4eeda0
call fcn.00416180
mov eax, dword [0x4eefac]
mov ecx, dword [0x4f7828]
mov dword [0x4f4fbc], eax
call fcn.0046a4c0
mov ecx, dword [0x4f781c]
call fcn.0046a4c0
mov ecx, dword [0x4f781c]
push 0x4b877c
call fcn.0046a8a0
mov esi, dword [0x5115d8]
push 1
push 0
mov ecx, 0x4eeda0
call fcn.00417860
cmp esi, dword [0x5115d8]
jne 0x4956d8
cmp byte [0x4e7b88], 0
jne 0x4956df
inc edi
cmp edi, dword [esp + 0xcc]
jb 0x495570
jmp 0x4956df
mov byte [0x4e7b88], 1
xor bl, bl
cmp byte [0x4e7b88], bl
jne 0x495974
push 0
push 0
push 0x4f701c
push 9
call fcn.00487af0
lea ecx, [esp + 0x18c]
push ecx
mov byte [esp + 0x17], al
call fcn.00485490
push 0x543
call fcn.00460a30
push eax
call fcn.00485490
lea edx, [esp + 0x1d40]
push edx
call fcn.004850c0
lea eax, [esp + 0x98c]
push eax
lea ebx, [esp + 0x1d44]
call fcn.0048bcc0
push 0x2000
push 0x2b4
lea ecx, [esp + 0x1294]
push ecx
push 0
lea edx, [esp + 0x19c]
push edx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov ecx, eax
shr ecx, 0x10
test ecx, ecx
jne 0x4958d2
mov edx, 0x5a4d
cmp ax, dx
je 0x495786
mov ecx, 0x4550
cmp ax, cx
jne 0x4958d2
xor eax, eax
jmp 0x495790
movzx ecx, word [esp + eax + 0x1d40]
mov word [esp + eax + 0x1540], cx
add eax, 2
test cx, cx
jne 0x495790
lea edx, [esp + 0x1540]
push edx
call fcn.00451050
lea eax, [esp + 0x1540]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4957c0
sub eax, edx
sar eax, 1
mov esi, eax
call fcn.004a4f95
push eax
lea eax, [esp + esi*2 + 0x1544]
push str.__rar_scan_d.bat
push eax
mov edx, 0x400
call fcn.0046b810
add esp, 0xc
push 0
push 0x4b8e04
lea ecx, [esp + 0x1548]
push ecx
call fcn.00431b90
mov esi, eax
test esi, esi
je 0x4958d2
cmp word [esp + 0x18c], 0x22
je 0x495827
lea edx, [esp + 0x18c]
push edx
call fcn.00446b30
lea eax, [esp + 0x98c]
push eax
lea ecx, [esp + 0x190]
push ecx
lea edx, [esp + 0x3d48]
push str.__s__s_r_n_echo._r_n_pause
push edx
mov edx, 0x1000
call fcn.0046b810
add esp, 0x10
push 0x1000
lea eax, [esp + 0x2544]
push eax
lea ecx, [esp + 0x3d48]
push ecx
call fcn.00472810
lea eax, [esp + 0x2540]
mov byte [esp + 0x353f], 0
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x495880
sub eax, edx
push esi
push eax
lea edx, [esp + 0x2548]
push 1
push edx
call fcn.004a5f54
push esi
call fcn.004a5d25
add esp, 0x14
xor eax, eax
jmp 0x4958b0
movzx ecx, word [esp + eax + 0x1540]
mov word [esp + eax + 0x18c], cx
add eax, 2
test cx, cx
jne 0x4958b0
xor eax, eax
mov word [esp + 0x98c], ax
push 0
lea ecx, [esp + 0x18]
push ecx
push 0
lea edx, [esp + 0x998]
push edx
lea eax, [esp + 0x1d50]
push eax
lea ecx, [esp + 0x1a0]
push ecx
push 0
call fcn.0049ba40
test al, al
jne 0x495919
lea edx, [esp + 0x18c]
push edx
push 0x201
call fcn.00460a30
push eax
call fcn.004926f0
add esp, 8
mov eax, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xc8
push eax
call esi
cmp eax, 0x102
jne 0x495965
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x495940
cmp byte [0x4e8c4c], 0
jne 0x495965
push 0x14
call edi
call fcn.00446a80
mov ecx, dword [esp + 0x14]
push 0xc8
push ecx
call esi
cmp eax, 0x102
je 0x495940
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, byte [esp + 0x13]
lea eax, [esp + 0x3540]
push eax
call fcn.004850c0
lea ecx, [esp + 0x1d40]
push ecx
call fcn.00484e00
test bl, bl
je 0x49599f
mov edx, dword [0x4e7b84]
push edx
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [esp + 0x5d4c], 0xffffffff
lea ecx, [esp + 0x18]
call fcn.00414660
mov ecx, dword [esp + 0x5d44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x5d30]
xor ecx, esp
call fcn.004a3c63
add esp, 0x5d40
ret