Function at 0x48f070
Capabilities:
Get common file path
Get file system object information
Parse pe header

Disassembly:
push 0xffffffffffffffff
push 0x4afc66
mov eax, dword fs:[0]
push eax
mov eax, 0x2328
call fcn.0049e650
mov eax, dword [0x4c0390]
xor eax, esp
mov dword [esp + 0x2324], eax
push ebx
push esi
push edi
mov eax, dword [0x4c0390]
xor eax, esp
push eax
lea eax, [esp + 0x2338]
mov dword fs:[0], eax
mov ecx, dword [0x4dc1c8]
mov edx, dword [0x4c9360]
lea eax, [esp + 0x284]
push eax
push 0x48bc00
push ecx
push str.VIRSCAN
push edx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
test eax, eax
je 0x48f5e7
lea ecx, [esp + 0x18]
call fcn.0043ce50
mov dword [esp + 0x2340], 0
cmp dword [0x4dbc5c], 0
je 0x48f137
lea eax, [esp + 0x1304]
push eax
lea ecx, [esp + 0xb08]
push ecx
mov ecx, 0x4e0c18
call fcn.004134e0
lea edx, [esp + 0x1304]
push edx
lea eax, [esp + 0xb08]
push eax
lea ecx, [esp + 0x20]
call fcn.0043cc00
lea ecx, [esp + 0x18]
call fcn.0043cd40
jmp 0x48f1ad
lea ecx, [esp + 0x124]
call fcn.004653d0
mov byte [esp + 0x2340], 1
push 0
lea ecx, [esp + 0x128]
push ecx
mov ecx, 0x4dfef0
call fcn.0043ed70
push 0
push 1
push 0
push 1
push 0
lea edx, [esp + 0x2c]
push edx
push 3
lea eax, [esp + 0x140]
push eax
call fcn.0045df10
test al, al
jne 0x48f199
mov byte [esp + 0x2340], al
lea ecx, [esp + 0x124]
call fcn.00465050
jmp 0x48f5d3
mov byte [esp + 0x2340], 0
lea ecx, [esp + 0x124]
call fcn.00465050
lea ecx, [esp + 0xf04]
push ecx
push str.Rar_VRXXXXXX
call fcn.0047ec00
test al, al
je 0x48f5d3
lea edx, [esp + 0x1f34]
push edx
push 0x400
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
xor edi, edi
cmp dword [esp + 0x11c], edi
jbe 0x48f385
lea esp, [esp]
cmp dword [0x4dc178], 0
jne 0x48f385
lea eax, [esp + 0xf04]
push eax
call fcn.004ac688
add esp, 4
push edi
lea ecx, [esp + 0x1308]
push ecx
lea ecx, [esp + 0x20]
call fcn.0043cc90
push eax
call fcn.0044d530
lea edx, [esp + 0xb04]
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
test cl, cl
jne 0x48f230
push 0
push 0
push 0
lea edx, [esp + 0xb10]
push edx
call fcn.00430130
test eax, eax
je 0x48f2a1
push 1
lea eax, [esp + 0xb08]
push eax
call fcn.0044e0c0
push 0
push 0
push 0
lea ecx, [esp + 0xb10]
push ecx
call fcn.00430130
test eax, eax
je 0x48f2a1
lea edx, [esp + 0xb04]
push edx
push 0x1f7
call fcn.0045b8f0
push eax
call fcn.0048c7e0
add esp, 8
mov ecx, 0x4c9364
call fcn.00427c70
jmp 0x48f36b
lea eax, [esp + 0xb04]
push eax
call fcn.004ac688
add esp, 4
call fcn.0047aeb0
push 0x4e75ac
push edi
lea ecx, [esp + 0x130c]
push ecx
lea ecx, [esp + 0x24]
call fcn.0043cc90
push eax
call fcn.0042f9c0
push 0x4e79ac
push edi
lea edx, [esp + 0x130c]
push edx
lea ecx, [esp + 0x24]
call fcn.0043cc90
add eax, 0x400
push eax
call fcn.0042fa50
cmp dword [0x4dbc5c], 0
jne 0x48f316
push 0
push 1
push 0x4e79ac
push 0x4e75ac
mov ecx, 0x4e0c18
call fcn.00414420
mov eax, dword [0x4e0e20]
mov ecx, dword [0x4e81b8]
mov dword [0x4e614c], eax
call fcn.004650d0
mov ecx, dword [0x4e81ac]
call fcn.004650d0
mov ecx, dword [0x4e81ac]
push 0x4b175c
call fcn.00465450
mov esi, dword [0x4f8278]
push 1
push 0
mov ecx, 0x4e0c18
call fcn.00416070
cmp esi, dword [0x4f8278]
jne 0x48f37b
cmp dword [0x4db840], 0
jne 0x48f385
inc edi
cmp edi, dword [esp + 0x11c]
jb 0x48f1f0
jmp 0x48f385
mov dword [0x4db840], 1
xor bl, bl
cmp dword [0x4db840], 0
jne 0x48f5a6
push 0
push 0
push 0x4e75ac
push 9
call fcn.00481590
lea ecx, [esp + 0x284]
push ecx
mov byte [esp + 0x17], al
call fcn.0047f3d0
push 0x543
call fcn.0045b8f0
push eax
call fcn.0047f3d0
lea edx, [esp + 0xf04]
push edx
call fcn.004ac688
add esp, 4
lea eax, [esp + 0x684]
push eax
lea ebx, [esp + 0xf08]
call fcn.00486270
push 0x2000
push 0x160
lea ecx, [esp + 0x12c]
push ecx
push 0
lea edx, [esp + 0x294]
push edx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov ecx, eax
shr ecx, 0x10
test ecx, ecx
jne 0x48f50a
mov edx, 0x5a4d
cmp ax, dx
je 0x48f430
mov ecx, 0x4550
cmp ax, cx
jne 0x48f50a
xor eax, eax
jmp 0x48f440
mov cl, byte [esp + eax + 0xf04]
mov byte [esp + eax + 0xb04], cl
inc eax
test cl, cl
jne 0x48f440
lea edx, [esp + 0xb04]
push edx
call fcn.0044d9b0
lea eax, [esp + 0xb04]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x48f470
sub eax, edx
mov esi, eax
call fcn.0049ef7d
push eax
lea eax, [esp + esi + 0xb08]
push str.__rar_scan_d.bat
push eax
call fcn.0049e0d5
lea ecx, [esp + 0xb10]
push 0x4b1ba8
push ecx
call fcn.0049f968
mov esi, eax
add esp, 0x14
test esi, esi
je 0x48f50a
cmp byte [esp + 0x284], 0x22
je 0x48f4c5
lea edx, [esp + 0x284]
push edx
call fcn.004453e0
lea eax, [esp + 0x684]
push eax
lea ecx, [esp + 0x288]
push ecx
push str.__s__s_r_n_echo._r_n_pause
push esi
call fcn.004a16b1
push esi
call fcn.0049f646
add esp, 0x14
xor eax, eax
jmp 0x48f4f0
mov cl, byte [esp + eax + 0xb04]
mov byte [esp + eax + 0x284], cl
inc eax
test cl, cl
jne 0x48f4f0
mov byte [esp + 0x684], cl
push 0
lea edx, [esp + 0x18]
push edx
push 0
push 0
lea eax, [esp + 0x694]
push eax
lea ecx, [esp + 0xf18]
push ecx
push 0
lea edx, [esp + 0x2a0]
push edx
call fcn.00495c30
test al, al
jne 0x48f553
lea eax, [esp + 0x284]
push eax
push 0x201
call fcn.0045b8f0
push eax
call fcn.0048c7e0
add esp, 8
mov ecx, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xc8
push ecx
call esi
cmp eax, 0x102
jne 0x48f597
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x4dc178], 0
jne 0x48f597
push 0x14
call edi
call fcn.00445340
mov edx, dword [esp + 0x14]
push 0xc8
push edx
call esi
cmp eax, 0x102
je 0x48f572
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, byte [esp + 0x13]
lea ecx, [esp + 0x1f34]
push ecx
call fcn.004ac688
add esp, 4
lea edx, [esp + 0xf04]
push edx
call fcn.0047ed60
test bl, bl
je 0x48f5d3
mov eax, dword [0x4db83c]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [esp + 0x2340], 0xffffffff
lea ecx, [esp + 0x18]
call fcn.00414330
mov ecx, dword [esp + 0x2338]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2324]
xor ecx, esp
call fcn.0049e0c6
add esp, 0x2334
ret