Function at 0x4898ec
Capabilities:
Get common file path
Get file system object information
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 5
add esp, 0xfffff004
push eax
dec eax
jne 0x4898f5
mov eax, dword [ebp - 4]
add esp, 0xfffffb58
push ebx
push esi
push edi
mov edi, 0x4c3188
mov eax, 0x4b6ce0
call fcn.004a0204
lea edx, [ebp - 0xaac]
push edx
push 0x48470a
push dword [0x4cfe34]
push str.VIRSCAN
push dword [0x4bb918]
call sub.USER32.DLL_DialogBoxParamA
test eax, eax
jne 0x489954
mov ecx, dword [ebp - 0x228]
mov dword fs:[0], ecx
mov eax, ecx
jmp 0x489eed
mov word [ebp - 0x218], 8
lea eax, [ebp - 0x10c]
call fcn.0046318c
add dword [ebp - 0x20c], 6
mov word [ebp - 0x218], 0x14
cmp dword [0x4d27d4], 0
je 0x4899be
lea ecx, [ebp - 0x1ebc]
lea edx, [ebp - 0x16bc]
mov eax, 0x4d0b94
call fcn.00458d64
lea ecx, [ebp - 0x1ebc]
lea edx, [ebp - 0x16bc]
lea eax, [ebp - 0x10c]
call fcn.00463434
lea eax, [ebp - 0x10c]
call fcn.00463538
jmp 0x489a91
mov word [ebp - 0x218], 0x20
lea eax, [ebp - 0x204]
call fcn.00410634
add dword [ebp - 0x20c], 4
mov word [ebp - 0x218], 0x2c
lea edx, [ebp - 0x204]
mov eax, 0x4cfe48
xor ecx, ecx
call fcn.00460a34
push 0
push 1
push 0
push 1
push 0
lea ecx, [ebp - 0x10c]
lea eax, [ebp - 0x204]
mov edx, 2
call fcn.0046794c
test al, al
jne 0x489a71
sub dword [ebp - 0x20c], 4
lea eax, [ebp - 0x204]
mov edx, 2
call fcn.0041070c
dec dword [ebp - 0x20c]
dec dword [ebp - 0x20c]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.0043ed58
sub dword [ebp - 0x20c], 4
lea eax, [ebp - 0x10c]
mov edx, 2
call fcn.0041070c
mov ecx, dword [ebp - 0x228]
mov dword fs:[0], ecx
jmp 0x489eed
sub dword [ebp - 0x20c], 4
lea eax, [ebp - 0x204]
mov edx, 2
call fcn.0041070c
mov word [ebp - 0x218], 0x14
lea edx, [ebp - 0x22bc]
mov eax, str.Rar_VRXXXXXX
call fcn.004667e4
test al, al
jne 0x489ae7
dec dword [ebp - 0x20c]
dec dword [ebp - 0x20c]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.0043ed58
sub dword [ebp - 0x20c], 4
lea eax, [ebp - 0x10c]
mov edx, 2
call fcn.0041070c
mov ecx, dword [ebp - 0x228]
mov dword fs:[0], ecx
jmp 0x489eed
lea eax, [ebp - 0x26bc]
push eax
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
mov word [ebp - 0x218], 0x14
xor ebx, ebx
jmp 0x489c8e
lea eax, [ebp - 0x22bc]
push eax
call fcn.004a186c
pop ecx
lea ecx, [ebp - 0x36ec]
lea eax, [ebp - 0x10c]
mov edx, ebx
call fcn.00463494
lea eax, [ebp - 0x36ec]
call fcn.0040c4d0
push eax
lea edx, [ebp - 0x2abc]
push edx
call fcn.0049fdd4
add esp, 8
lea eax, [ebp - 0x2abc]
xor ecx, ecx
xor edx, edx
call fcn.0040a440
test eax, eax
je 0x489b9f
lea eax, [ebp - 0x2abc]
mov dl, 1
call fcn.0040cfb4
lea eax, [ebp - 0x2abc]
xor ecx, ecx
xor edx, edx
call fcn.0040a440
test eax, eax
je 0x489b9f
lea eax, [ebp - 0x2abc]
push eax
mov eax, 0x1f7
call fcn.00413388
push eax
call fcn.0048a820
add esp, 8
mov eax, 0x4bb2e4
call fcn.0042ed78
jmp 0x489c8d
lea edx, [ebp - 0x2abc]
push edx
call fcn.004a186c
pop ecx
call fcn.0044b01c
lea ecx, [ebp - 0x431c]
lea eax, [ebp - 0x10c]
mov edx, ebx
call fcn.00463494
lea eax, [ebp - 0x431c]
lea edx, [edi + 0x4700]
call fcn.0040adf8
lea ecx, [ebp - 0x4f4c]
lea eax, [ebp - 0x10c]
mov edx, ebx
call fcn.00463494
lea eax, [ebp - 0x4f4c]
lea edx, [edi + 0x4b00]
add eax, 0x400
call fcn.0040ae48
cmp dword [0x4d27d4], 0
jne 0x489c21
push 1
push 0
lea ecx, [edi + 0x4b00]
lea edx, [edi + 0x4700]
mov eax, 0x4d0b94
call fcn.00457674
mov ecx, dword [0x4d0d9c]
mov dword [edi + 0x32b0], ecx
mov eax, dword [edi + 0x530c]
call fcn.00410788
mov eax, dword [edi + 0x5300]
call fcn.00410788
mov edx, str.cth
mov eax, dword [edi + 0x5300]
call fcn.004107b8
call fcn.0048aa5c
mov esi, eax
mov word [ebp - 0x218], 0x14
mov eax, 0x4d0b94
mov cl, 1
xor edx, edx
call fcn.00454664
call fcn.0048aa5c
cmp esi, eax
je 0x489c84
mov dword [0x4d27e8], 1
cmp dword [0x4d27e8], 0
jne 0x489ca0
inc ebx
cmp ebx, dword [ebp - 8]
jae 0x489ca0
cmp dword [0x4d27e4], 0
je 0x489b08
xor ebx, ebx
cmp dword [0x4d27e8], 0
jne 0x489e89
push 0
lea edx, [edi + 0x4700]
xor ecx, ecx
mov eax, 9
call fcn.00476300
mov ebx, eax
lea eax, [ebp - 0xaac]
call fcn.00478308
mov eax, 0x543
call fcn.00413388
call fcn.00478308
lea edx, [ebp - 0x22bc]
push edx
call fcn.004a186c
pop ecx
lea edx, [ebp - 0x22bc]
lea eax, [ebp - 0x6ac]
call fcn.004852be
push 0x2000
lea ecx, [ebp - 0x50ac]
push 0x160
push ecx
lea eax, [ebp - 0xaac]
push 0
push eax
call sub.SHELL32.DLL_SHGetFileInfoA
mov edx, eax
shr edx, 0x10
test dx, dx
jne 0x489d3e
mov ecx, eax
and cx, 0xffff
cmp cx, 0x5a4d
je 0x489d42
and ax, 0xffff
cmp ax, 0x4550
je 0x489d42
xor eax, eax
jmp 0x489d47
mov eax, 1
test al, al
je 0x489e0b
lea edx, [ebp - 0x22bc]
push edx
lea ecx, [ebp - 0x54ac]
push ecx
call fcn.0049fdd4
add esp, 8
lea eax, [ebp - 0x54ac]
call fcn.0040ca00
call fcn.004a82c8
push eax
push str.__rar_scan_d.bat
lea edx, [ebp - 0x54ac]
push edx
call fcn.0049fe04
pop ecx
lea ecx, [ebp - 0x54ac]
add eax, ecx
push eax
call fcn.004a2e18
add esp, 0xc
push 0x4b61a6
lea eax, [ebp - 0x54ac]
push eax
call fcn.004a1e14
add esp, 8
mov esi, eax
test esi, esi
je 0x489e0b
xor eax, eax
mov al, byte [ebp - 0xaac]
cmp eax, 0x22
je 0x489dcb
lea eax, [ebp - 0xaac]
call fcn.00480930
lea edx, [ebp - 0x6ac]
push edx
lea ecx, [ebp - 0xaac]
push ecx
push str.__s__s_r_n_echo._r_n_pause
push esi
call fcn.004a1e48
add esp, 0x10
push esi
call fcn.004a191c
pop ecx
lea eax, [ebp - 0x54ac]
push eax
lea edx, [ebp - 0xaac]
push edx
call fcn.0049fdd4
add esp, 8
mov byte [ebp - 0x6ac], 0
lea ecx, [ebp - 0x6ac]
push ecx
push 0
push 0
lea eax, [ebp - 0x22c]
push eax
push 0
lea ecx, [ebp - 0x22bc]
lea eax, [ebp - 0xaac]
xor edx, edx
call fcn.0046d1b8
test al, al
jne 0x489e5e
lea ecx, [ebp - 0xaac]
mov eax, 0x201
push ecx
call fcn.00413388
push eax
call fcn.0048a820
add esp, 8
jmp 0x489e5e
push 0x14
call sub.KERNEL32.DLL_Sleep
call fcn.00480728
push 0xc8
push dword [ebp - 0x22c]
call sub.KERNEL32.DLL_WaitForSingleObject
cmp eax, 0x102
jne 0x489e7e
cmp dword [0x4d27e4], 0
je 0x489e52
push dword [ebp - 0x22c]
call sub.KERNEL32.DLL_CloseHandle
lea edx, [ebp - 0x26bc]
push edx
call fcn.004a186c
pop ecx
lea eax, [ebp - 0x22bc]
call fcn.004669fc
test bl, bl
je 0x489eb0
push dword [0x4cfe40]
call sub.USER32.DLL_DestroyWindow
dec dword [ebp - 0x20c]
dec dword [ebp - 0x20c]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.0043ed58
sub dword [ebp - 0x20c], 4
lea eax, [ebp - 0x10c]
mov edx, 2
call fcn.0041070c
mov ecx, dword [ebp - 0x228]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret