Function at 0x4c5900
Capabilities:
Get file system object information
Move file
Parse pe header
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4ff956
mov eax, dword fs:[0]
push eax
mov eax, 0x858c
call fcn.004e6b50
mov eax, dword [0x519bc0]
xor eax, esp
mov dword [esp + 0x8588], eax
push ebx
push esi
push edi
mov eax, dword [0x519bc0]
xor eax, esp
push eax
lea eax, [esp + 0x859c]
mov dword fs:[0], eax
mov ecx, dword [0x53f484]
mov edx, dword [0x531154]
lea eax, [esp + 0x3b0]
push eax
push 0x4c03b0
push ecx
push str.VIRSCAN
push edx
call dword [sym.imp.USER32.dll_DialogBoxParamW]
test eax, eax
je 0x4c5f6c
lea ecx, [esp + 0x18]
call fcn.0048fb30
mov dword [esp + 0x85a4], 0
cmp byte [0x53d329], 0
je 0x4c59c1
push 0x800
lea eax, [esp + 0x44b4]
push eax
mov ecx, 0x54be08
call fcn.0047b190
lea ecx, [esp + 0x44b0]
push ecx
lea ecx, [esp + 0x1c]
call fcn.0048fd50
lea ecx, [esp + 0x18]
call fcn.0048fa50
mov ebx, 1
jmp 0x4c5a3a
lea ecx, [esp + 0xa0]
call fcn.00469a70
mov ebx, 1
mov byte [esp + 0x85a4], bl
push ebx
lea edx, [esp + 0xa4]
push edx
mov ecx, 0x549cb8
call fcn.00493e30
push 0
push 0
push ebx
push 0
push ebx
push 0
lea eax, [esp + 0x30]
push eax
push 3
lea ecx, [esp + 0xc0]
push ecx
call fcn.0049fe80
test al, al
jne 0x4c5a26
mov byte [esp + 0x85a4], al
lea ecx, [esp + 0xa0]
call fcn.0041e100
jmp 0x4c5f58
mov byte [esp + 0x85a4], 0
lea ecx, [esp + 0xa0]
call fcn.0041e100
push 0
push 0x800
lea edx, [esp + 0x34b8]
push edx
push str.Rar_VR
call fcn.004b4490
test al, al
je 0x4c5f58
push 0x800
lea eax, [esp + 0x759c]
push eax
call fcn.004b4e40
xor edi, edi
mov byte [esp + 0x12], 0
cmp dword [esp + 0x84], edi
jbe 0x4c5c02
cmp byte [0x53e3e9], 0
jne 0x4c5c02
lea ecx, [esp + 0x34b0]
push ecx
call fcn.004b4de0
push edi
lea edx, [esp + 0x44b4]
push edx
lea ecx, [esp + 0x20]
call fcn.0048fc20
push eax
call fcn.004534c0
lea edx, [esp + 0x24b0]
lea ebx, [ebx]
movzx ecx, word [eax]
mov word [edx], cx
add eax, 2
add edx, 2
test cx, cx
jne 0x4c5ac0
push 0
push 0
lea eax, [esp + 0x24b8]
push eax
call fcn.004458a0
test eax, eax
je 0x4c5b33
push ebx
lea ecx, [esp + 0x24b4]
push ecx
call fcn.00452eb0
push 0
push 0
lea edx, [esp + 0x24b8]
push edx
call fcn.004458a0
test eax, eax
je 0x4c5b33
lea eax, [esp + 0x24b0]
push eax
push 0x1f7
call fcn.00463400
push eax
call fcn.004c2ab0
add esp, 8
mov ecx, 0x531158
call fcn.0043f4b0
jmp 0x4c5beb
lea ecx, [esp + 0x24b0]
push ecx
call fcn.004b4de0
push ebx
call fcn.004b0320
push 0x800
push 0x55abfa
push edi
lea edx, [esp + 0x44bc]
push edx
lea ecx, [esp + 0x28]
call fcn.0048fc20
push eax
call fcn.00453d10
cmp byte [0x53d329], 0
jne 0x4c5b84
push 0
push 0
push 0x55abfa
mov ecx, 0x54be08
call fcn.0047c7b0
cmp byte [0x54c194], 0
jne 0x4c5b96
cmp byte [0x54c0e3], 0
je 0x4c5b9a
mov byte [esp + 0x12], bl
mov eax, dword [0x54be0c]
mov ecx, 0x55bd10
mov dword [0x557ba8], eax
call fcn.004698b0
mov ecx, 0x55bbfc
call fcn.004698b0
push 0x502a28
mov ecx, 0x55bbfc
call fcn.004698e0
mov esi, dword [0x575d10]
push ebx
push 0
mov ecx, 0x54be08
call fcn.0047d470
cmp esi, dword [0x575d10]
jne 0x4c5bfc
cmp byte [0x53d328], 0
jne 0x4c5c02
add edi, ebx
cmp edi, dword [esp + 0x84]
jb 0x4c5a81
jmp 0x4c5c02
mov byte [0x53d328], bl
cmp byte [0x53d328], 0
mov byte [esp + 0x13], 0
jne 0x4c5e9d
push 0
push 0
push 0x55abfa
push 0xa
call fcn.004b7e20
lea ecx, [esp + 0x3b0]
push ecx
push 0x5037a8
mov byte [esp + 0x1b], al
call fcn.004b56e0
add esp, 8
push 0x543
call fcn.00463400
push eax
call fcn.004b56e0
add esp, 4
lea edx, [esp + 0x34b0]
push edx
call fcn.004b4de0
lea eax, [esp + 0x13b0]
push eax
lea ebx, [esp + 0x34b4]
call fcn.004bbbe0
push 0x2000
push 0x2b4
lea ecx, [esp + 0x104]
push ecx
push 0
lea edx, [esp + 0x3c0]
push edx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov ecx, eax
shr ecx, 0x10
test ecx, ecx
jne 0x4c5dfd
mov edx, 0x5a4d
cmp ax, dx
je 0x4c5cb8
mov ecx, 0x4550
cmp ax, cx
jne 0x4c5dfd
xor eax, eax
lea ebx, [ebx]
movzx ecx, word [esp + eax + 0x34b0]
mov word [esp + eax + 0x24b0], cx
add eax, 2
test cx, cx
jne 0x4c5cc0
push 0x800
lea edx, [esp + 0x24b4]
push edx
call fcn.00452c60
lea eax, [esp + 0x24b0]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4c5cf4
sub eax, edx
sar eax, 1
mov esi, eax
call fcn.004ea4fa
push eax
lea eax, [esp + esi*2 + 0x24b4]
push str.Rar_Scan_d.bat
mov edx, 0x800
sub edx, esi
push eax
call fcn.004a63e0
add esp, 0xc
push 0x503b68
lea ecx, [esp + 0x24b4]
push ecx
call fcn.004452a0
mov esi, eax
test esi, esi
je 0x4c5dfd
cmp word [esp + 0x3b0], 0x22
je 0x4c5d60
push 0x800
lea edx, [esp + 0x3b4]
push edx
call fcn.004a3cf0
lea eax, [esp + 0x13b0]
push eax
lea ecx, [esp + 0x3b4]
push ecx
lea edx, [esp + 0x55a0]
push str.__s__s_r_n_echo._r_n_pause
push edx
mov edx, 0x1000
call fcn.004a63e0
add esp, 0x10
push 0x1000
lea eax, [esp + 0x44b4]
push eax
lea ecx, [esp + 0x55a0]
push ecx
call fcn.0046c6c0
lea eax, [esp + 0x44b0]
mov byte [esp + 0x54af], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4c5db6
sub eax, edx
push esi
push eax
lea edx, [esp + 0x44b8]
push 1
push edx
call fcn.004eb049
push esi
call fcn.004eae6b
add esp, 0x14
push 0x800
lea eax, [esp + 0x24b4]
push eax
lea ecx, [esp + 0x3b8]
push ecx
call fcn.004694b0
xor edx, edx
mov word [esp + 0x13b0], dx
push 0
lea eax, [esp + 0x18]
push eax
push 0
lea ecx, [esp + 0x13bc]
push ecx
lea edx, [esp + 0x34c0]
push edx
lea eax, [esp + 0x3c4]
push eax
push 0
call fcn.004c9ee0
test al, al
je 0x4c5e82
mov ecx, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xc8
push ecx
call esi
cmp eax, 0x102
jne 0x4c5e75
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4c5e50
cmp byte [0x53e3e9], 0
jne 0x4c5e75
push 0x14
call edi
call fcn.00497940
mov edx, dword [esp + 0x14]
push 0xc8
push edx
call esi
cmp eax, 0x102
je 0x4c5e50
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4c5e9d
lea ecx, [esp + 0x3b0]
push ecx
push 0x201
call fcn.00463400
push eax
call fcn.004c2ab0
add esp, 8
lea edx, [esp + 0x7598]
push edx
call fcn.004b4de0
cmp byte [esp + 0x12], 0
je 0x4c5f38
xor eax, eax
jmp 0x4c5ec0
movzx ecx, word [esp + eax + 0x34b0]
mov word [esp + eax + 0x24b0], cx
add eax, 2
test cx, cx
jne 0x4c5ec0
lea eax, [esp + 0x24b0]
push eax
call fcn.004534c0
lea edx, [esp + 0x24b0]
mov ecx, 0x62
push edx
mov word [eax + 0xc], cx
call fcn.00445470
test al, al
jne 0x4c5f38
lea eax, [esp + 0x24b0]
push eax
lea ecx, [esp + 0x34b4]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x4c5f38
xor eax, eax
jmp 0x4c5f20
movzx ecx, word [esp + eax + 0x24b0]
mov word [esp + eax + 0x34b0], cx
add eax, 2
test cx, cx
jne 0x4c5f20
lea edx, [esp + 0x34b0]
push edx
call fcn.004b4a70
cmp byte [esp + 0x13], 0
je 0x4c5f58
mov eax, dword [0x53d324]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [esp + 0x85a4], 0xffffffff
lea ecx, [esp + 0x18]
call fcn.0047bce0
mov ecx, dword [esp + 0x859c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x8588]
xor ecx, esp
call fcn.004e6b3a
add esp, 0x8598
ret