Function at 0x49c400
Capabilities:
Get file system object information
Move file
Parse pe header
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4c4ec6
mov eax, dword fs:[0]
push eax
mov eax, 0x5d34
call fcn.004b0000
mov eax, dword [0x4d98f0]
xor eax, esp
mov dword [esp + 0x5d30], eax
push ebx
push esi
push edi
mov eax, dword [0x4d98f0]
xor eax, esp
push eax
lea eax, [esp + 0x5d44]
mov dword fs:[0], eax
mov ecx, dword [0x51b8cc]
mov edx, dword [0x5072f0]
lea eax, [esp + 0x18c]
push eax
push 0x498a00
push ecx
push str.VIRSCAN
push edx
call dword [sym.imp.USER32.dll_DialogBoxParamW]
test eax, eax
je 0x49ca6d
lea ecx, [esp + 0x18]
call fcn.00444e80
mov dword [esp + 0x5d4c], 0
cmp byte [0x51a779], 0
je 0x49c4c1
push 0x400
lea eax, [esp + 0x1544]
push eax
mov ecx, 0x5219d0
call fcn.00413210
lea ecx, [esp + 0x1540]
push ecx
lea ecx, [esp + 0x1c]
call fcn.00444bd0
lea ecx, [esp + 0x18]
call fcn.00444d00
mov ebx, 1
jmp 0x49c539
lea ecx, [esp + 0xe4]
call fcn.00470340
mov ebx, 1
mov byte [esp + 0x5d4c], bl
push 0
lea edx, [esp + 0xe8]
push edx
mov ecx, 0x5210a8
call fcn.00446320
push 0
push ebx
push 0
push ebx
push 0
lea eax, [esp + 0x2c]
push eax
push 3
lea ecx, [esp + 0x100]
push ecx
call fcn.00468dc0
test al, al
jne 0x49c525
mov byte [esp + 0x5d4c], al
lea ecx, [esp + 0xe4]
call fcn.00401e20
jmp 0x49ca59
mov byte [esp + 0x5d4c], 0
lea ecx, [esp + 0xe4]
call fcn.00401e20
push 0
lea edx, [esp + 0x1d44]
push edx
push str.Rar_VR
call fcn.0048b8d0
test al, al
je 0x49ca59
push 0x400
lea eax, [esp + 0x3544]
push eax
call fcn.0048c120
xor edi, edi
mov byte [esp + 0x12], 0
cmp dword [esp + 0xcc], edi
jbe 0x49c704
jmp 0x49c580
cmp byte [0x51b848], 0
jne 0x49c704
lea ecx, [esp + 0x1d40]
push ecx
call fcn.0048c100
push edi
lea edx, [esp + 0x2544]
push edx
lea ecx, [esp + 0x20]
call fcn.00444c50
push eax
call fcn.00455e90
lea edx, [esp + 0x1540]
lea esp, [esp]
movzx ecx, word [eax]
mov word [edx], cx
add eax, 2
add edx, 2
test cx, cx
jne 0x49c5c0
push 0
push 0
lea eax, [esp + 0x1548]
push eax
push 0
call fcn.00435df0
test eax, eax
je 0x49c637
push ebx
lea ecx, [esp + 0x1544]
push ecx
call fcn.004558e0
push 0
push 0
lea edx, [esp + 0x1548]
push edx
push 0
call fcn.00435df0
test eax, eax
je 0x49c637
lea eax, [esp + 0x1540]
push eax
push 0x1f7
call fcn.00466860
push eax
call fcn.004997e0
add esp, 8
mov ecx, 0x5072f4
call fcn.0042caa0
jmp 0x49c6ed
lea ecx, [esp + 0x1540]
push ecx
call fcn.0048c100
push ebx
call fcn.004878e0
push 0x529c92
push edi
lea edx, [esp + 0x2548]
push edx
lea ecx, [esp + 0x24]
call fcn.00444c50
push eax
call fcn.00455b50
cmp byte [0x51a779], 0
jne 0x49c683
push 0
push 0
push 0x529c92
mov ecx, 0x5219d0
call fcn.004169e0
cmp dword [0x521df4], 0
jne 0x49c695
cmp byte [0x521dfe], 0
je 0x49c699
mov byte [esp + 0x12], bl
mov eax, dword [0x521bdc]
mov ecx, dword [0x52a4a0]
mov dword [0x527c24], eax
call fcn.00470000
mov ecx, dword [0x52a494]
call fcn.00470000
mov ecx, dword [0x52a494]
push 0x4c67ac
call fcn.004703e0
mov esi, dword [0x5407b0]
push ebx
push 0
mov ecx, 0x5219d0
call fcn.00417d90
cmp esi, dword [0x5407b0]
jne 0x49c6fe
cmp byte [0x51a778], 0
jne 0x49c704
add edi, ebx
cmp edi, dword [esp + 0xcc]
jb 0x49c580
jmp 0x49c704
mov byte [0x51a778], bl
cmp byte [0x51a778], 0
mov byte [esp + 0x13], 0
jne 0x49c99d
push 0
push 0
push 0x529c92
push 9
call fcn.0048eba0
lea ecx, [esp + 0x18c]
push ecx
mov byte [esp + 0x17], al
call fcn.0048c530
push 0x543
call fcn.00466860
push eax
call fcn.0048c530
lea edx, [esp + 0x1d40]
push edx
call fcn.0048c100
lea eax, [esp + 0x98c]
push eax
lea ebx, [esp + 0x1d44]
call fcn.00492e60
push 0x2000
push 0x2b4
lea ecx, [esp + 0x1294]
push ecx
push 0
lea edx, [esp + 0x19c]
push edx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov ecx, eax
shr ecx, 0x10
test ecx, ecx
jne 0x49c902
mov edx, 0x5a4d
cmp ax, dx
je 0x49c7af
mov ecx, 0x4550
cmp ax, cx
jne 0x49c902
xor eax, eax
jmp 0x49c7c0
movzx ecx, word [esp + eax + 0x1d40]
mov word [esp + eax + 0x1540], cx
add eax, 2
test cx, cx
jne 0x49c7c0
lea edx, [esp + 0x1540]
push edx
call fcn.00455810
lea eax, [esp + 0x1540]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x49c7f0
sub eax, edx
sar eax, 1
mov esi, eax
call fcn.004b1045
push eax
lea eax, [esp + esi*2 + 0x1544]
push str.Rar_Scan_d.bat
push eax
mov edx, 0x400
call fcn.00407130
add esp, 0xc
push 0
push 0x4c9050
lea ecx, [esp + 0x1548]
push ecx
call fcn.00435dd0
mov esi, eax
test esi, esi
je 0x49c902
cmp word [esp + 0x18c], 0x22
je 0x49c857
lea edx, [esp + 0x18c]
push edx
call fcn.0044ca80
lea eax, [esp + 0x98c]
push eax
lea ecx, [esp + 0x190]
push ecx
lea edx, [esp + 0x3d48]
push str.__s__s_r_n_echo._r_n_pause
push edx
mov edx, 0x1000
call fcn.00407130
add esp, 0x10
push 0x1000
lea eax, [esp + 0x2544]
push eax
lea ecx, [esp + 0x3d48]
push ecx
call fcn.004770a0
lea eax, [esp + 0x2540]
mov byte [esp + 0x353f], 0
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x49c8b0
sub eax, edx
push esi
push eax
lea edx, [esp + 0x2548]
push 1
push edx
call fcn.004b29b8
push esi
call fcn.004b2d6e
add esp, 0x14
xor eax, eax
jmp 0x49c8e0
movzx ecx, word [esp + eax + 0x1540]
mov word [esp + eax + 0x18c], cx
add eax, 2
test cx, cx
jne 0x49c8e0
xor eax, eax
mov word [esp + 0x98c], ax
push 0
lea ecx, [esp + 0x18]
push ecx
push 0
lea edx, [esp + 0x998]
push edx
lea eax, [esp + 0x1d50]
push eax
lea ecx, [esp + 0x1a0]
push ecx
push 0
call fcn.004a28e0
test al, al
je 0x49c982
mov edx, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xc8
push edx
call esi
cmp eax, 0x102
jne 0x49c975
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ecx]
cmp byte [0x51b848], 0
jne 0x49c975
push 0x14
call edi
call fcn.0044c9d0
mov eax, dword [esp + 0x14]
push 0xc8
push eax
call esi
cmp eax, 0x102
je 0x49c950
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x49c99d
lea edx, [esp + 0x18c]
push edx
push 0x201
call fcn.00466860
push eax
call fcn.004997e0
add esp, 8
lea eax, [esp + 0x3540]
push eax
call fcn.0048c100
cmp byte [esp + 0x12], 0
je 0x49ca38
xor eax, eax
jmp 0x49c9c0
movzx ecx, word [esp + eax + 0x1d40]
mov word [esp + eax + 0x1540], cx
add eax, 2
test cx, cx
jne 0x49c9c0
lea ecx, [esp + 0x1540]
push ecx
call fcn.00455e90
mov edx, 0x62
mov word [eax + 0xc], dx
lea eax, [esp + 0x1540]
push eax
call fcn.00435620
test al, al
jne 0x49ca38
lea ecx, [esp + 0x1540]
push ecx
lea edx, [esp + 0x1d44]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x49ca38
xor eax, eax
jmp 0x49ca20
movzx ecx, word [esp + eax + 0x1540]
mov word [esp + eax + 0x1d40], cx
add eax, 2
test cx, cx
jne 0x49ca20
lea eax, [esp + 0x1d40]
push eax
call fcn.0048bd70
cmp byte [esp + 0x13], 0
je 0x49ca59
mov ecx, dword [0x51a774]
push ecx
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [esp + 0x5d4c], 0xffffffff
lea ecx, [esp + 0x18]
call fcn.00414f50
mov ecx, dword [esp + 0x5d44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x5d30]
xor ecx, esp
call fcn.004affec
add esp, 0x5d40
ret