Function at 0x4a1520
Capabilities:
Create thread
Query environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x1818]
mov eax, 0x1818
call fcn.004b0000
push 0xffffffffffffffff
push 0x4c5128
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x4d98f0]
xor eax, ebp
mov dword [ebp + 0x1814], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 0x1820]
push 1
call fcn.00470b80
push 0x8005
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
call fcn.0046f400
mov ecx, 0x5238d0
call fcn.0041faf0
xor edi, edi
mov byte [0x51b849], 0
mov dword [0x51a770], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x51b8c8], eax
push edi
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x51b830], eax
push str.WMUser_DisplayError
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov dword [0x51a77c], eax
push str.General
call fcn.00460380
test al, al
sete byte [ebp - 0x12]
lea eax, [ebp + 0x800]
push eax
call fcn.00456690
lea ecx, [ebp + 0x800]
push ecx
call fcn.00455810
xor eax, eax
jmp 0x4a15f0
movzx ecx, word [ebp + eax + 0x800]
mov word [eax + 0x51a780], cx
add eax, 2
cmp cx, di
jne 0x4a15f0
mov eax, 0x51a780
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4a1610
sub eax, edx
sar eax, 1
push 0x1000000
lea edx, [eax*2 + 0x51a780]
push edx
push str.rar.log
call fcn.004770e0
push edi
push esi
mov ecx, 0x50732c
call fcn.00466920
push str.winrar.lng
mov ecx, 0x50730c
call fcn.004665d0
push esi
call fcn.004a0720
test eax, eax
je 0x4a1cf3
lea ecx, [ebp - 0x20]
call fcn.00491ab0
mov dword [ebp - 4], edi
mov dword [0x5072ec], esi
mov ecx, 0x5219d0
call fcn.004169c0
call fcn.004892c0
call fcn.00487d40
call fcn.0049d370
call fcn.0049d540
push str.WinRAR_Busy
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x51b8c4], eax
push edi
push str.WinRarWindow
mov ebx, dword [sym.imp.USER32.dll_FindWindowW]
call ebx
mov dword [ebp - 0x18], eax
push edi
push esi
push edi
push edi
push 0x80000000
push 0x80000000
push 0x80000000
push 0x80000000
push 0x6cf0000
push 0x4c886c
push str.WinRarWindow
push 0x10
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [0x51b8cc], eax
cmp eax, edi
je 0x4a1ce4
push eax
mov ecx, 0x50730c
call fcn.00465640
push edi
call fcn.0049cdb0
call fcn.0049d2c0
cmp byte [ebp - 0x12], 0
je 0x4a1719
push 1
push edi
call fcn.00421d60
test al, al
mov byte [ebp - 0x11], 1
je 0x4a171d
mov byte [ebp - 0x11], 0
lea eax, [ebp + 0x1800]
push eax
call fcn.0049cca0
movzx ecx, word [ebp + 0x1800]
push ecx
call fcn.00477720
movzx esi, ax
push 0xd0
push edi
push 0x522f10
call fcn.004b0470
add esp, 0xc
push edi
push edi
mov ecx, 0x5238d0
call fcn.0041fc80
cmp si, di
je 0x4a17c6
cmp byte [0x5248e0], 0
jne 0x4a17c6
push esi
push str.AFUMD
call fcn.004b0bd2
add esp, 8
test eax, eax
jne 0x4a1787
cmp si, 0x43
jne 0x4a17a3
cmp word [ebp + 0x1802], di
jne 0x4a17a3
call fcn.00487a80
cmp si, 0x44
je 0x4a1798
cmp si, 0x43
jne 0x4a17cc
xor edx, edx
mov word [0x5240e0], dx
jmp 0x4a17cc
cmp byte [0x5248e0], 0
jne 0x4a17c6
push esi
push 0x4ce174
call fcn.004b0bd2
add esp, 8
test eax, eax
je 0x4a17c6
push edi
call fcn.0048f2e0
jmp 0x4a17cc
push edi
call fcn.004878e0
push edi
push edi
mov ecx, 0x5238d0
call fcn.0041fc80
push 0x5238d0
mov ecx, 0x51bd00
call fcn.004153f0
xor eax, eax
lea esp, [esp]
movzx ecx, word [eax + 0x529c92]
mov word [eax + 0x51b030], cx
add eax, 2
cmp cx, di
jne 0x4a17f0
xor eax, eax
mov word [0x529c92], ax
mov dword [0x51af94], edi
mov byte [ebp - 4], 1
call fcn.004a0e00
mov dword [ebp - 4], edi
cmp byte [0x528c2e], 0
jne 0x4a1ce4
mov ecx, dword [0x51b8cc]
push ecx
call fcn.0049ce60
cmp byte [0x526ded], 0
je 0x4a186d
push 0x526ded
call fcn.00455e10
push 0x1000000
push 0x51a780
cmp eax, 0x526ded
jne 0x4a1863
call fcn.00455e90
push eax
push 0x526ded
call fcn.004770e0
push edi
push edi
push 0x8003
mov edx, dword [0x51b8cc]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x51b8cc], edi
je 0x4a1a1d
cmp byte [0x528c62], 0
jne 0x4a1c66
xor bl, bl
cmp word [0x529c92], di
je 0x4a1bc7
push 0x529c92
push edi
call fcn.004356b0
cmp eax, 0xffffffff
je 0x4a18bf
test al, 0x10
je 0x4a18bf
mov bl, 1
cmp word [0x529c92], di
je 0x4a1baf
test bl, bl
jne 0x4a1bb3
push edi
push str.ReuseWindow
push str.General
call fcn.004604a0
test eax, eax
je 0x4a19e6
cmp dword [ebp - 0x18], edi
je 0x4a19e6
push 0x400
lea eax, [ebp + 0x1000]
push eax
call fcn.0048af00
lea ecx, [ebp + 0x1000]
push ecx
call fcn.00455810
lea eax, [ebp + 0x1000]
add eax, 0xfffffffe
jmp 0x4a1920
mov cx, word [eax + 2]
add eax, 2
cmp cx, di
jne 0x4a1920
mov edx, dword [str.Rar_]
mov dword [eax], edx
mov ecx, dword [0x4cc6c8]
mov dword [eax + 4], ecx
mov dx, word [0x4cc6cc]
mov word [eax + 8], dx
lea eax, [ebp + 0x1000]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4a1951
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp + 0x1000]
push eax
push 0x529c92
call fcn.00477530
test eax, eax
je 0x4a19e6
push str.RarArchiveWideName
push 0x800
push 0
push 0x8000004
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
push 0x800
push 0
push 0
push 2
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
push edi
push 0x529c92
call fcn.00455b50
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push 0x7ae964f1
push 0xd489ac5e
push 0x8001
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
setne bl
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
jne 0x4a1b91
push 0x529c92
mov ecx, 0x5210a8
call fcn.0044a0e0
test al, al
je 0x4a1b91
cmp byte [0x51a779], 0
jne 0x4a1a1d
cmp dword [0x51b020], 0
je 0x4a1b7f
mov ecx, 0x5210a8
call fcn.0044a650
mov esi, dword [ebp - 0x18]
push esi
push 0x10000
push 0x49a190
call fcn.004b127b
add esp, 0xc
mov eax, dword [0x51b8cc]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x4a1a51
test esi, esi
setne cl
movzx edx, cl
push edx
call fcn.0049d070
mov eax, dword [0x51b8cc]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
cmp byte [ebp - 0x11], 0
je 0x4a1a8c
cmp byte [ebp - 0x12], 0
je 0x4a1a8c
push str.Setup
call fcn.00460380
test al, al
jne 0x4a1a8c
push 0x4c8644
call fcn.00442600
test al, al
jne 0x4a1a8c
push 6
call fcn.00421b50
push 0
push str.ExportedSettings
push 0x4c6d80
call fcn.004604a0
test eax, eax
je 0x4a1aa6
call fcn.00421a50
push 0
push 1
call fcn.00460a20
push 0
push str.WizardMode
push str.General
call fcn.004604a0
test eax, eax
je 0x4a1af0
mov ecx, dword [0x51b8cc]
push ecx
call fcn.004a5bd0
test al, al
je 0x4a1af0
cmp dword [0x51b020], 0
jne 0x4a1af0
mov edx, dword [0x51b8cc]
push edx
call dword [sym.imp.USER32.dll_DestroyWindow]
lea ebx, [ebx]
push 0
push 0
call fcn.004a0880
test al, al
jne 0x4a1af0
mov ecx, 0x5210a4
call fcn.004a1ef0
call fcn.00493160
mov eax, dword [0x51b830]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov byte [0x51b849], 1
xor esi, esi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x51a770], 0
jle 0x4a1b3d
push 0x64
call edi
dec esi
cmp esi, 0xc8
jl 0x4a1b27
mov ecx, dword [0x51b830]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x51af90], 0
je 0x4a1cbd
mov dword [0x51af90], 0xffffffff
xor esi, esi
cmp dword [0x51af90], 0
je 0x4a1cda
push 0x64
call edi
inc esi
cmp esi, 0xa
jl 0x4a1b63
jmp 0x4a1cda
mov edx, dword [0x51b8cc]
push edx
call dword [sym.imp.USER32.dll_DestroyWindow]
jmp 0x4a1a1d
call fcn.004932e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00491b20
mov eax, 1
jmp 0x4a1d24
test bl, bl
je 0x4a1bc7
push 0x529c92
call fcn.0049d120
push 0x529c92
jmp 0x4a1c47
push 1
push str.RestoreFolder
push str.General
call fcn.004604a0
push 0x400
push 0x4c6d80
test eax, eax
je 0x4a1c05
lea eax, [ebp + 0x1000]
push eax
push str.LastFolder
push str.General
call fcn.00460470
lea ecx, [ebp + 0x1000]
push ecx
jmp 0x4a1c47
lea edx, [ebp]
push edx
push str.StartFolder
push str.Paths
call fcn.00460470
push 0x400
lea eax, [ebp + 0x1000]
push eax
lea ecx, [ebp]
push ecx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor edx, edx
mov word [ebp + 0x17fe], dx
cmp word [ebp + 0x1000], di
je 0x4a1c4c
lea eax, [ebp + 0x1000]
push eax
call fcn.0048b020
push edi
mov ecx, 0x5210a8
call fcn.00448c00
mov ecx, 0x521098
call fcn.004076d0
jmp 0x4a1a1d
push 0x522f10
call fcn.004a1170
call fcn.004932e0
cmp dword [0x51af94], 1
jne 0x4a1a1d
push edi
push str.WinRarWindow
call ebx
test eax, eax
sete cl
movzx edx, cl
push edx
push 1
call fcn.004995e0
mov ecx, 0x507300
call fcn.0041d4c0
mov esi, dword [0x5072f4]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00491b20
mov eax, esi
jmp 0x4a1d24
push 0
push str.WinRarWindow
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
sete dl
movzx eax, dl
push eax
push 1
call fcn.004995e0
mov ecx, 0x507300
call fcn.0041d4c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00491b20
xor eax, eax
jmp 0x4a1d24
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1814]
xor ecx, ebp
call fcn.004affec
add ebp, 0x1818
mov esp, ebp
pop ebp
ret 0x10