Function at 0x494300
Capabilities:
Accept command line arguments
Check os version
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x4afd1b
mov eax, dword fs:[0]
push eax
sub esp, 0xc28
mov eax, dword [0x4c0390]
xor eax, esp
mov dword [esp + 0xc24], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4c0390]
xor eax, esp
push eax
lea eax, [esp + 0xc3c]
mov dword fs:[0], eax
mov edi, dword [esp + 0xc4c]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
movzx eax, word [esi]
xor bl, bl
test ax, ax
je 0x49437c
test bl, bl
jne 0x494365
movzx eax, ax
push eax
call fcn.00465150
test al, al
jne 0x49437c
cmp word [esi], 0x22
jne 0x494370
test bl, bl
sete bl
movzx eax, word [esi + 2]
add esi, 2
test ax, ax
jne 0x494354
movzx ecx, word [esi]
push ecx
call fcn.00465150
test al, al
je 0x4943a1
lea esp, [esp]
movzx edx, word [esi + 2]
add esi, 2
push edx
call fcn.00465150
test al, al
jne 0x494390
push 0x4dbcb8
mov dword [0x4dbcb8], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push 0x8005
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
call fcn.00464ad0
mov ecx, 0x4e2ea0
call fcn.0041c150
mov byte [0x4dbd55], 0
mov dword [0x4db838], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
push 0
push 1
push 0
mov dword [0x4dc1c4], eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push str.WMUser_DisplayError
mov dword [0x4dc160], eax
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
push 0x4b1b9c
mov dword [0x4db844], eax
call fcn.004567a0
test al, al
lea eax, [esp + 0x438]
sete bl
push eax
mov byte [esp + 0x1b], bl
call fcn.0044e1b0
lea ecx, [esp + 0x438]
push ecx
call fcn.0044dfb0
xor eax, eax
mov edi, edi
mov cl, byte [esp + eax + 0x438]
mov byte [eax + 0x4db848], cl
inc eax
test cl, cl
jne 0x494440
mov eax, 0x4db848
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x494458
mov edx, dword [str.rar.log]
mov ecx, dword [0x4b1dc0]
mov dword [eax], edx
push 0
mov dword [eax + 4], ecx
push edi
mov ecx, 0x4c9390
call fcn.0045be90
push str.winrar.lng
mov ecx, 0x4c9370
call fcn.0045bc30
push edi
call fcn.004931a0
test eax, eax
je 0x494b51
lea ecx, [esp + 0x1c]
call fcn.00484720
mov dword [esp + 0xc44], 0
mov dword [0x4c935c], edi
call fcn.0047d840
call fcn.0047b7a0
push str.CLSIDDDF7D820_8355_11CF_B357_444553540000
push 0x80000000
call fcn.00455f20
call fcn.00490c70
call fcn.00490e10
push str.WinRAR_Busy
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push 0
push str.WinRarWindow
mov dword [0x4dc17c], eax
call dword [sym.imp.USER32.dll_FindWindowA]
push 0
push edi
push 0
push 0
push 0x80000000
push 0x80000000
push 0x80000000
push 0x80000000
push 0x6cf0000
push 0x4b2da4
push str.WinRarWindow
mov ebp, eax
push 0x10
mov dword [esp + 0x48], ebp
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x4dc1c8], eax
test eax, eax
je 0x494b3d
push eax
mov ecx, 0x4c9370
call fcn.0045a980
push 0
call fcn.00490490
call fcn.00490b10
test bl, bl
je 0x49456b
push 1
push 0
call fcn.0041f820
mov byte [esp + 0x16], 1
test al, al
je 0x494570
mov byte [esp + 0x16], 0
push 0x110
push 0
push 0x4e2850
call fcn.0049e460
add esp, 0xc
push esi
call fcn.0048f540
mov bl, al
test bl, bl
je 0x494595
call fcn.0047b4b0
push 0x4e2ea0
mov ecx, 0x4dc400
call fcn.004164f0
xor eax, eax
jmp 0x4945b0
mov cl, byte [eax + 0x4e758c]
mov byte [eax + 0x4dbd60], cl
inc eax
test cl, cl
jne 0x4945b0
lea edx, [esp + 0x24]
xor eax, eax
push edx
push esi
mov byte [0x4e758c], cl
mov dword [0x4e5768], eax
mov dword [0x4dbc60], eax
call fcn.0048f650
movzx eax, word [esp + 0x24]
push eax
call fcn.0049ed36
add esp, 4
mov edi, eax
push edi
push str.AFUM
call fcn.0046ded0
test eax, eax
jne 0x494602
call fcn.004771b0
push edi
push 0x4b5a60
call fcn.0046ded0
test eax, eax
je 0x494625
mov ecx, dword [0x4e8190]
call fcn.00465590
test bl, bl
je 0x494625
call fcn.00482090
push esi
call fcn.004939c0
call fcn.00490540
cmp byte [0x4e5339], 0
je 0x494681
push 0x4e5339
call fcn.0044db30
cmp eax, 0x4e5339
jne 0x49466c
push 0x4e5339
call fcn.0044db30
push 0x4db848
mov esi, eax
call fcn.0044db30
mov cl, byte [esi]
mov byte [eax], cl
inc esi
inc eax
test cl, cl
jne 0x494660
jmp 0x494681
xor eax, eax
mov edi, edi
mov cl, byte [eax + 0x4e5339]
mov byte [eax + 0x4db848], cl
inc eax
test cl, cl
jne 0x494670
mov ecx, dword [0x4dc1c8]
push 0
push 0
push 0x403
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [0x4dc1c8], 0
je 0x494879
cmp byte [0x4e695b], 0
jne 0x494ac9
xor bl, bl
cmp byte [0x4e758c], bl
je 0x494a26
push 0x4e798c
push 0x4e758c
call fcn.0042f9f0
cmp eax, 0xffffffff
je 0x4946d9
test al, 0x10
je 0x4946d9
mov bl, 1
cmp byte [0x4e758c], 0
je 0x494a0c
test bl, bl
jne 0x494a10
push 0
push str.ReuseWindow
push 0x4b1b9c
call fcn.00456960
test eax, eax
je 0x494822
test ebp, ebp
je 0x494822
push 0x400
lea edx, [esp + 0x3c]
push edx
call fcn.0047e2d0
lea eax, [esp + 0x38]
push eax
call fcn.0044dfb0
lea eax, [esp + 0x38]
dec eax
lea ecx, [ecx]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x494730
mov ecx, dword [str.Rar_]
mov dl, byte [0x4b5a5c]
mov dword [eax], ecx
mov byte [eax + 4], dl
lea eax, [esp + 0x38]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x494750
sub eax, edx
push eax
lea eax, [esp + 0x3c]
push eax
push 0x4e758c
call fcn.00465050
test eax, eax
je 0x494822
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push str.RarArchiveName
push 0x400
push 0
push 0x8000004
push 0
push 0xffffffffffffffff
call ebp
mov ebx, dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push 0x400
push 0
push 0
mov esi, eax
push 2
push esi
call ebx
mov edi, eax
push edi
push 0x4e758c
call fcn.0042fa70
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push str.RarArchiveNameW
push 0x800
push 0
push 0x8000004
push 0
push 0xffffffffffffffff
call ebp
push 0x800
push 0
push 0
mov edi, eax
push 2
push edi
call ebx
mov ebp, eax
push ebp
push 0x4e798c
call fcn.0042fb00
push ebp
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
push 0x7ae964f1
push 0xd489ac5e
push 0x401
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
setne bl
call esi
push edi
call esi
mov ebp, dword [esp + 0x18]
cmp byte [0x4e758c], 0
je 0x494835
mov ecx, 0x4e758c
call fcn.00490980
test bl, bl
jne 0x4949e9
push 0x4e798c
push 0x4e758c
mov ecx, 0x4dfee0
call fcn.00442ce0
test al, al
je 0x4949e9
cmp dword [0x4dbc5c], 0
jne 0x494879
cmp dword [0x4dbd50], 0
je 0x4949d7
mov ecx, 0x4dfee0
call fcn.00441940
push ebp
push 0x10000
push 0x48cb70
call fcn.0049ef88
mov edx, dword [0x4dc1c8]
add esp, 0xc
push edx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x4948ab
test ebp, ebp
setne al
movzx ecx, al
push ecx
call fcn.00490800
mov edx, dword [0x4dc1c8]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
call fcn.00490590
cmp byte [esp + 0x16], 0
je 0x4948ee
cmp byte [esp + 0x17], 0
je 0x4948ee
push str.Setup
call fcn.004567a0
test al, al
jne 0x4948ee
push 0x4b2bc0
call fcn.0043aaf0
test al, al
jne 0x4948ee
push 6
call fcn.0041f610
push 0
push str.ExportedSettings
push 0x4b1914
call fcn.00456960
test eax, eax
je 0x494908
call fcn.0041f520
push 0
push str.WizardMode
push 0x4b1b9c
call fcn.00456960
test eax, eax
je 0x494942
mov eax, dword [0x4dc1c8]
push eax
call fcn.00498bf0
test al, al
je 0x494942
cmp dword [0x4dbd50], 0
jne 0x494942
mov ecx, dword [0x4dc1c8]
push ecx
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0
call fcn.004932d0
test al, al
jne 0x494942
mov ecx, 0x4dc1cc
call fcn.00494ea0
call fcn.00486950
mov edx, dword [0x4dc160]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [0x4dbd55], 1
xor esi, esi
lea ebx, [ebx]
cmp dword [0x4db838], 0
jle 0x494996
push 0x64
call edi
dec esi
cmp esi, 0xc8
jl 0x494980
mov eax, dword [0x4dc160]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x4dbc58], 0
je 0x494b20
mov dword [0x4dbc58], 0xffffffff
xor esi, esi
cmp dword [0x4dbc58], 0
je 0x494b3d
push 0x64
call edi
inc esi
cmp esi, 0xa
jl 0x4949bb
jmp 0x494b3d
mov edx, dword [0x4dc1c8]
push edx
call dword [sym.imp.USER32.dll_DestroyWindow]
jmp 0x494879
call fcn.00486ac0
mov dword [esp + 0xc44], 0xffffffff
lea ecx, [esp + 0x1c]
call fcn.004847b0
mov eax, 1
jmp 0x494b53
test bl, bl
je 0x494a26
mov ecx, 0x4e758c
call fcn.00490980
push 0
push 0x4e758c
jmp 0x494aa7
push 1
push str.RestoreFolder
push 0x4b1b9c
call fcn.00456960
push 0x400
push 0x4b1914
test eax, eax
je 0x494a62
lea eax, [esp + 0x40]
push eax
push str.LastFolder
push 0x4b1b9c
call fcn.00456900
push 0
lea ecx, [esp + 0x3c]
push ecx
jmp 0x494aa7
lea edx, [esp + 0x840]
push edx
push str.StartFolder
push 0x4b192c
call fcn.00456900
push 0x400
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x840]
push ecx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [esp + 0x38], 0
mov byte [esp + 0x437], 0
je 0x494aac
push 0
lea edx, [esp + 0x3c]
push edx
call fcn.0047f460
push 0
push 0
mov ecx, 0x4dfee0
call fcn.00440fc0
mov ecx, 0x4dfed0
call fcn.00406fb0
jmp 0x494879
push 0x4e2850
call fcn.00493f60
call fcn.00486ac0
cmp dword [0x4dbc60], 1
jne 0x494879
push 0
push str.WinRarWindow
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
sete al
movzx ecx, al
push ecx
push 1
call fcn.0048a490
mov esi, dword [0x4c9364]
mov dword [esp + 0xc44], 0xffffffff
lea ecx, [esp + 0x1c]
call fcn.004847b0
mov eax, esi
jmp 0x494b53
push 0
push str.WinRarWindow
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
sete cl
movzx edx, cl
push edx
push 1
call fcn.0048a490
mov dword [esp + 0xc44], 0xffffffff
lea ecx, [esp + 0x1c]
call fcn.004847b0
xor eax, eax
mov ecx, dword [esp + 0xc3c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xc24]
xor ecx, esp
call fcn.0049dea6
add esp, 0xc34
ret 0x10