Function at 0x49d260
Capabilities:
Get file system object information
Move file
Parse pe header
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4c6076
mov eax, dword fs:[0]
push eax
mov eax, 0x5d34
call fcn.004b1040
mov eax, dword [0x4da8f0]
xor eax, esp
mov dword [esp + 0x5d30], eax
push ebx
push esi
push edi
mov eax, dword [0x4da8f0]
xor eax, esp
push eax
lea eax, [esp + 0x5d44]
mov dword fs:[0], eax
mov ecx, dword [0x51c8dc]
mov edx, dword [0x508300]
lea eax, [esp + 0x18c]
push eax
push 0x499840
push ecx
push str.VIRSCAN
push edx
call dword [sym.imp.USER32.dll_DialogBoxParamW]
test eax, eax
je 0x49d8cd
lea ecx, [esp + 0x18]
call fcn.00445480
mov dword [esp + 0x5d4c], 0
cmp byte [0x51b789], 0
je 0x49d321
push 0x400
lea eax, [esp + 0x1544]
push eax
mov ecx, 0x5229e0
call fcn.00413320
lea ecx, [esp + 0x1540]
push ecx
lea ecx, [esp + 0x1c]
call fcn.004451d0
lea ecx, [esp + 0x18]
call fcn.00445300
mov ebx, 1
jmp 0x49d399
lea ecx, [esp + 0xe4]
call fcn.004710c0
mov ebx, 1
mov byte [esp + 0x5d4c], bl
push 0
lea edx, [esp + 0xe8]
push edx
mov ecx, 0x5220b8
call fcn.004469d0
push 0
push ebx
push 0
push ebx
push 0
lea eax, [esp + 0x2c]
push eax
push 3
lea ecx, [esp + 0x100]
push ecx
call fcn.00469720
test al, al
jne 0x49d385
mov byte [esp + 0x5d4c], al
lea ecx, [esp + 0xe4]
call fcn.00401bb0
jmp 0x49d8b9
mov byte [esp + 0x5d4c], 0
lea ecx, [esp + 0xe4]
call fcn.00401bb0
push 0
lea edx, [esp + 0x1d44]
push edx
push str.Rar_VR
call fcn.0048c720
test al, al
je 0x49d8b9
push 0x400
lea eax, [esp + 0x3544]
push eax
call fcn.0048cf70
xor edi, edi
mov byte [esp + 0x12], 0
cmp dword [esp + 0xcc], edi
jbe 0x49d564
jmp 0x49d3e0
cmp byte [0x51c858], 0
jne 0x49d564
lea ecx, [esp + 0x1d40]
push ecx
call fcn.0048cf50
push edi
lea edx, [esp + 0x2544]
push edx
lea ecx, [esp + 0x20]
call fcn.00445250
push eax
call fcn.00456820
lea edx, [esp + 0x1540]
lea esp, [esp]
movzx ecx, word [eax]
mov word [edx], cx
add eax, 2
add edx, 2
test cx, cx
jne 0x49d420
push 0
push 0
lea eax, [esp + 0x1548]
push eax
push 0
call fcn.00436280
test eax, eax
je 0x49d497
push ebx
lea ecx, [esp + 0x1544]
push ecx
call fcn.00456270
push 0
push 0
lea edx, [esp + 0x1548]
push edx
push 0
call fcn.00436280
test eax, eax
je 0x49d497
lea eax, [esp + 0x1540]
push eax
push 0x1f7
call fcn.004671c0
push eax
call fcn.0049a620
add esp, 8
mov ecx, 0x508304
call fcn.0042cce0
jmp 0x49d54d
lea ecx, [esp + 0x1540]
push ecx
call fcn.0048cf50
push ebx
call fcn.00488820
push 0x52aca2
push edi
lea edx, [esp + 0x2548]
push edx
lea ecx, [esp + 0x24]
call fcn.00445250
push eax
call fcn.004564e0
cmp byte [0x51b789], 0
jne 0x49d4e3
push 0
push 0
push 0x52aca2
mov ecx, 0x5229e0
call fcn.00416a50
cmp dword [0x522e04], 0
jne 0x49d4f5
cmp byte [0x522e0e], 0
je 0x49d4f9
mov byte [esp + 0x12], bl
mov eax, dword [0x522bec]
mov ecx, dword [0x52b4b0]
mov dword [0x528c34], eax
call fcn.00470d80
mov ecx, dword [0x52b4a4]
call fcn.00470d80
mov ecx, dword [0x52b4a4]
push 0x4c77ac
call fcn.00471160
mov esi, dword [0x5417d8]
push ebx
push 0
mov ecx, 0x5229e0
call fcn.00417e10
cmp esi, dword [0x5417d8]
jne 0x49d55e
cmp byte [0x51b788], 0
jne 0x49d564
add edi, ebx
cmp edi, dword [esp + 0xcc]
jb 0x49d3e0
jmp 0x49d564
mov byte [0x51b788], bl
cmp byte [0x51b788], 0
mov byte [esp + 0x13], 0
jne 0x49d7fd
push 0
push 0
push 0x52aca2
push 9
call fcn.0048f9f0
lea ecx, [esp + 0x18c]
push ecx
mov byte [esp + 0x17], al
call fcn.0048d380
push 0x543
call fcn.004671c0
push eax
call fcn.0048d380
lea edx, [esp + 0x1d40]
push edx
call fcn.0048cf50
lea eax, [esp + 0x98c]
push eax
lea ebx, [esp + 0x1d44]
call fcn.00493cb0
push 0x2000
push 0x2b4
lea ecx, [esp + 0x1294]
push ecx
push 0
lea edx, [esp + 0x19c]
push edx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov ecx, eax
shr ecx, 0x10
test ecx, ecx
jne 0x49d762
mov edx, 0x5a4d
cmp ax, dx
je 0x49d60f
mov ecx, 0x4550
cmp ax, cx
jne 0x49d762
xor eax, eax
jmp 0x49d620
movzx ecx, word [esp + eax + 0x1d40]
mov word [esp + eax + 0x1540], cx
add eax, 2
test cx, cx
jne 0x49d620
lea edx, [esp + 0x1540]
push edx
call fcn.004561a0
lea eax, [esp + 0x1540]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x49d650
sub eax, edx
sar eax, 1
mov esi, eax
call fcn.004b2085
push eax
lea eax, [esp + esi*2 + 0x1544]
push str.Rar_Scan_d.bat
push eax
mov edx, 0x400
call fcn.00483770
add esp, 0xc
push 0
push 0x4ca078
lea ecx, [esp + 0x1548]
push ecx
call fcn.00436260
mov esi, eax
test esi, esi
je 0x49d762
cmp word [esp + 0x18c], 0x22
je 0x49d6b7
lea edx, [esp + 0x18c]
push edx
call fcn.0044d0f0
lea eax, [esp + 0x98c]
push eax
lea ecx, [esp + 0x190]
push ecx
lea edx, [esp + 0x3d48]
push str.__s__s_r_n_echo._r_n_pause
push edx
mov edx, 0x1000
call fcn.00483770
add esp, 0x10
push 0x1000
lea eax, [esp + 0x2544]
push eax
lea ecx, [esp + 0x3d48]
push ecx
call fcn.00477f10
lea eax, [esp + 0x2540]
mov byte [esp + 0x353f], 0
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x49d710
sub eax, edx
push esi
push eax
lea edx, [esp + 0x2548]
push 1
push edx
call fcn.004b39f8
push esi
call fcn.004b3dae
add esp, 0x14
xor eax, eax
jmp 0x49d740
movzx ecx, word [esp + eax + 0x1540]
mov word [esp + eax + 0x18c], cx
add eax, 2
test cx, cx
jne 0x49d740
xor eax, eax
mov word [esp + 0x98c], ax
push 0
lea ecx, [esp + 0x18]
push ecx
push 0
lea edx, [esp + 0x998]
push edx
lea eax, [esp + 0x1d50]
push eax
lea ecx, [esp + 0x1a0]
push ecx
push 0
call fcn.004a36a0
test al, al
je 0x49d7e2
mov edx, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xc8
push edx
call esi
cmp eax, 0x102
jne 0x49d7d5
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ecx]
cmp byte [0x51c858], 0
jne 0x49d7d5
push 0x14
call edi
call fcn.0044d040
mov eax, dword [esp + 0x14]
push 0xc8
push eax
call esi
cmp eax, 0x102
je 0x49d7b0
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x49d7fd
lea edx, [esp + 0x18c]
push edx
push 0x201
call fcn.004671c0
push eax
call fcn.0049a620
add esp, 8
lea eax, [esp + 0x3540]
push eax
call fcn.0048cf50
cmp byte [esp + 0x12], 0
je 0x49d898
xor eax, eax
jmp 0x49d820
movzx ecx, word [esp + eax + 0x1d40]
mov word [esp + eax + 0x1540], cx
add eax, 2
test cx, cx
jne 0x49d820
lea ecx, [esp + 0x1540]
push ecx
call fcn.00456820
mov edx, 0x62
mov word [eax + 0xc], dx
lea eax, [esp + 0x1540]
push eax
call fcn.00435ac0
test al, al
jne 0x49d898
lea ecx, [esp + 0x1540]
push ecx
lea edx, [esp + 0x1d44]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x49d898
xor eax, eax
jmp 0x49d880
movzx ecx, word [esp + eax + 0x1540]
mov word [esp + eax + 0x1d40], cx
add eax, 2
test cx, cx
jne 0x49d880
lea eax, [esp + 0x1d40]
push eax
call fcn.0048cbc0
cmp byte [esp + 0x13], 0
je 0x49d8b9
mov ecx, dword [0x51b784]
push ecx
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [esp + 0x5d4c], 0xffffffff
lea ecx, [esp + 0x18]
call fcn.00415030
mov ecx, dword [esp + 0x5d44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x5d30]
xor ecx, esp
call fcn.004b102c
add esp, 0x5d40
ret