Function at 0x4a03c0
Capabilities:
Create thread
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x4c428b
mov eax, dword fs:[0]
push eax
mov eax, 0x1828
call fcn.004af5f0
mov eax, dword [0x4d8620]
xor eax, esp
mov dword [esp + 0x1824], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4d8620]
xor eax, esp
push eax
lea eax, [esp + 0x183c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x184c]
push 1
call fcn.004701f0
push 0x8005
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
call fcn.0046e9f0
mov ecx, 0x52fee8
call fcn.0041ee00
xor edi, edi
mov byte [0x527e59], 0
mov dword [0x526d80], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push edi
push edi
push 1
push edi
mov dword [0x527ed8], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push str.WMUser_DisplayError
mov dword [0x527e40], eax
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
push str.General
mov dword [0x526d8c], eax
call fcn.0045fab0
test al, al
lea eax, [esp + 0x838]
sete bl
push eax
mov byte [esp + 0x1b], bl
call fcn.00456340
lea ecx, [esp + 0x838]
push ecx
call fcn.004554c0
xor eax, eax
movzx ecx, word [esp + eax + 0x838]
mov word [eax + 0x526d90], cx
add eax, 2
cmp cx, di
jne 0x4a0490
mov eax, 0x526d90
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4a04b0
sub eax, edx
sar eax, 1
push 0x1000000
lea edx, [eax*2 + 0x526d90]
push edx
push str.rar.log
call fcn.00477960
push edi
push esi
mov ecx, 0x51393c
call fcn.00465f80
push str.winrar.lng
mov ecx, 0x51391c
call fcn.00465c30
push esi
call fcn.0049f5c0
test eax, eax
je 0x4a0b94
lea ecx, [esp + 0x1c]
call fcn.004908e0
mov dword [esp + 0x1844], edi
mov ecx, 0x52dfe8
mov dword [0x5138fc], esi
call fcn.004166c0
call fcn.004881b0
call fcn.00486c60
call fcn.0049c120
call fcn.0049c2f0
push str.WinRAR_Busy
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
push edi
push str.WinRarWindow
mov dword [0x527ed4], eax
call dword [sym.imp.USER32.dll_FindWindowW]
push edi
push esi
push edi
push edi
push 0x80000000
push 0x80000000
push 0x80000000
push 0x80000000
push 0x6cf0000
push 0x4c7efc
push str.WinRarWindow
push 0x10
mov dword [esp + 0x48], eax
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [0x527edc], eax
cmp eax, edi
je 0x4a0b80
push eax
mov ecx, 0x51391c
call fcn.00464ca0
push edi
call fcn.0049bb60
call fcn.0049c070
test bl, bl
je 0x4a05bc
push 1
push edi
call fcn.00421040
mov byte [esp + 0x16], 1
test al, al
je 0x4a05c1
mov byte [esp + 0x16], 0
lea eax, [esp + 0x24]
push eax
call fcn.0049ba50
movzx ecx, word [esp + 0x24]
push ecx
call fcn.00477fa0
push 0xd0
push edi
push 0x52f528
movzx esi, ax
call fcn.004af620
add esp, 0xc
push edi
push edi
mov ecx, 0x52fee8
call fcn.0041ef70
cmp si, di
je 0x4a0664
cmp byte [0x530ef8], 0
jne 0x4a0664
push esi
push str.AFUMD
call fcn.004afd82
add esp, 8
test eax, eax
jne 0x4a0625
cmp si, 0x43
jne 0x4a0641
cmp word [esp + 0x26], di
jne 0x4a0641
call fcn.004869a0
cmp si, 0x44
je 0x4a0636
cmp si, 0x43
jne 0x4a0669
xor edx, edx
mov word [0x5306f8], dx
jmp 0x4a0669
cmp byte [0x530ef8], 0
jne 0x4a0664
push esi
push 0x4cd164
call fcn.004afd82
add esp, 8
test eax, eax
je 0x4a0664
push edi
call fcn.0048e100
jmp 0x4a0669
call fcn.00486850
push edi
push edi
mov ecx, 0x52fee8
call fcn.0041ef70
push 0x52fee8
mov ecx, 0x528310
call fcn.00415010
xor eax, eax
jmp 0x4a0690
movzx ecx, word [eax + 0x5362aa]
mov word [eax + 0x527640], cx
add eax, 2
cmp cx, di
jne 0x4a0690
xor eax, eax
mov word [0x5362aa], ax
mov dword [0x5275a4], edi
call fcn.0049fca0
cmp byte [0x535246], 0
jne 0x4a0b80
mov ecx, dword [0x527edc]
push ecx
call fcn.0049bc10
cmp byte [0x533405], 0
je 0x4a0706
push 0x533405
call fcn.00455ac0
push 0x1000000
push 0x526d90
cmp eax, 0x533405
jne 0x4a06fc
call fcn.00455b40
push eax
push 0x533405
call fcn.00477960
mov edx, dword [0x527edc]
mov ebp, dword [sym.imp.USER32.dll_SendMessageW]
push edi
push edi
push 0x8003
push edx
call ebp
cmp dword [0x527edc], edi
je 0x4a08ac
cmp byte [0x535279], 0
jne 0x4a0af8
xor bl, bl
cmp word [0x5362aa], 0
je 0x4a0a59
push 0x5362aa
push 0
call fcn.004324b0
cmp eax, 0xffffffff
je 0x4a075c
test al, 0x10
je 0x4a075c
mov bl, 1
cmp word [0x5362aa], 0
je 0x4a0a44
test bl, bl
jne 0x4a0a48
push 0
push str.ReuseWindow
push str.General
call fcn.0045fbd0
test eax, eax
je 0x4a0875
cmp dword [esp + 0x18], 0
je 0x4a0875
push 0x400
lea eax, [esp + 0x3c]
push eax
call fcn.00489d10
lea ecx, [esp + 0x38]
push ecx
call fcn.004554c0
lea eax, [esp + 0x38]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x4a07b6
mov edx, dword [str.Rar_]
mov ecx, dword [0x4cb6a4]
mov dword [eax], edx
mov dx, word [0x4cb6a8]
mov dword [eax + 4], ecx
mov word [eax + 8], dx
lea eax, [esp + 0x38]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4a07e5
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x3c]
push eax
push 0x5362aa
call fcn.00477db0
test eax, eax
je 0x4a0875
push str.RarArchiveWideName
push 0x800
push 0
push 0x8000004
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push 0x800
push 0
push 0
mov esi, eax
push 2
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
push edi
push 0x5362aa
call fcn.00455800
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
push 0x7ae964f1
push 0xd489ac5e
push 0x8001
push ecx
call ebp
test eax, eax
push esi
setne bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
jne 0x4a0a21
push 0x5362aa
mov ecx, 0x52d6c0
call fcn.004485c0
test al, al
je 0x4a0a21
cmp byte [0x526d89], 0
jne 0x4a08ac
cmp dword [0x527630], 0
je 0x4a0a0f
mov ecx, 0x52d6c0
call fcn.00448b20
mov esi, dword [esp + 0x18]
push esi
push 0x10000
push 0x498fa0
call fcn.004b043b
mov eax, dword [0x527edc]
add esp, 0xc
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x4a08e1
test esi, esi
setne cl
movzx edx, cl
push edx
call fcn.0049be20
mov eax, dword [0x527edc]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
cmp byte [esp + 0x16], 0
je 0x4a091e
cmp byte [esp + 0x17], 0
je 0x4a091e
push str.Setup
call fcn.0045fab0
test al, al
jne 0x4a091e
push 0x4c7cd4
call fcn.00440b00
test al, al
jne 0x4a091e
push 6
call fcn.00420e30
push 0
push str.ExportedSettings
push 0x4c5d70
call fcn.0045fbd0
test eax, eax
je 0x4a0938
call fcn.00420d30
push 0
push 1
call fcn.00460150
push 0
push str.WizardMode
push str.General
call fcn.0045fbd0
test eax, eax
je 0x4a0980
mov ecx, dword [0x527edc]
push ecx
call fcn.004a4a40
test al, al
je 0x4a0980
cmp dword [0x527630], 0
jne 0x4a0980
mov edx, dword [0x527edc]
push edx
call dword [sym.imp.USER32.dll_DestroyWindow]
lea esp, [esp]
push 0
push 0
call fcn.0049f720
test al, al
jne 0x4a0980
mov ecx, 0x52d6bc
call fcn.004a0d50
call fcn.00491f80
mov eax, dword [0x527e40]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [0x527e59], 1
xor esi, esi
cmp dword [0x526d80], 0
jle 0x4a09cd
push 0x64
call edi
dec esi
cmp esi, 0xc8
jl 0x4a09b7
mov ecx, dword [0x527e40]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x5275a0], 0
je 0x4a0b59
mov dword [0x5275a0], 0xffffffff
xor esi, esi
cmp dword [0x5275a0], 0
je 0x4a0b76
push 0x64
call edi
inc esi
cmp esi, 0xa
jl 0x4a09f3
jmp 0x4a0b76
mov edx, dword [0x527edc]
push edx
call dword [sym.imp.USER32.dll_DestroyWindow]
jmp 0x4a08ac
call fcn.00492110
mov dword [esp + 0x1844], 0xffffffff
lea ecx, [esp + 0x1c]
call fcn.00490950
mov eax, 1
jmp 0x4a0b96
test bl, bl
je 0x4a0a59
push 0x5362aa
call fcn.0049bed0
push 0x5362aa
jmp 0x4a0ad8
push 1
push str.RestoreFolder
push str.General
call fcn.0045fbd0
push 0x400
push 0x4c5d70
test eax, eax
je 0x4a0a93
lea eax, [esp + 0x40]
push eax
push str.LastFolder
push str.General
call fcn.0045fba0
lea ecx, [esp + 0x38]
push ecx
jmp 0x4a0ad8
lea edx, [esp + 0x1040]
push edx
push str.StartFolder
push str.Paths
call fcn.0045fba0
push 0x400
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x1040]
push ecx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor edx, edx
mov word [esp + 0x836], dx
cmp word [esp + 0x38], dx
je 0x4a0add
lea eax, [esp + 0x38]
push eax
call fcn.00489e20
push 0
mov ecx, 0x52d6c0
call fcn.00447100
mov ecx, 0x52d6b0
call fcn.00407470
jmp 0x4a08ac
push 0x52f528
call fcn.004a0010
call fcn.00492110
cmp dword [0x5275a4], 1
jne 0x4a08ac
push 0
push str.WinRarWindow
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
sete cl
movzx edx, cl
push edx
push 1
call fcn.004983f0
mov ecx, 0x513910
call fcn.0041c810
mov esi, dword [0x513904]
mov dword [esp + 0x1844], 0xffffffff
lea ecx, [esp + 0x1c]
call fcn.00490950
mov eax, esi
jmp 0x4a0b96
push 0
push str.WinRarWindow
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
sete dl
movzx eax, dl
push eax
push 1
call fcn.004983f0
mov ecx, 0x513910
call fcn.0041c810
mov dword [esp + 0x1844], 0xffffffff
lea ecx, [esp + 0x1c]
call fcn.00490950
xor eax, eax
mov ecx, dword [esp + 0x183c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1824]
xor ecx, esp
call fcn.004aedbb
add esp, 0x1834
ret 0x10