Function at 0x4af620
Capabilities:
Get file system object information
Move file
Parse pe header
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4d5b86
mov eax, dword fs:[0]
push eax
mov eax, 0x84f4
call fcn.004c0c80
mov eax, dword [0x4eb984]
xor eax, esp
mov dword [esp + 0x84f0], eax
push ebx
push esi
push edi
mov eax, dword [0x4eb984]
xor eax, esp
push eax
lea eax, [esp + 0x8504]
mov dword fs:[0], eax
mov ecx, dword [0x535584]
mov edx, dword [0x51f7e4]
lea eax, [esp + 0x3b0]
push eax
push 0x4ab7e0
push ecx
push str.VIRSCAN
push edx
call dword [sym.imp.USER32.dll_DialogBoxParamW]
test eax, eax
je 0x4afc8c
lea ecx, [esp + 0x18]
call fcn.0044b5e0
mov dword [esp + 0x850c], 0
cmp byte [0x533431], 0
je 0x4af6e1
push 0x800
lea eax, [esp + 0x44b4]
push eax
mov ecx, 0x541ef0
call fcn.00415140
lea ecx, [esp + 0x44b0]
push ecx
lea ecx, [esp + 0x1c]
call fcn.0044b360
lea ecx, [esp + 0x18]
call fcn.0044b500
mov ebx, 1
jmp 0x4af758
lea ecx, [esp + 0xa0]
call fcn.0047f4c0
mov ebx, 1
mov byte [esp + 0x850c], bl
push ebx
lea edx, [esp + 0xa4]
push edx
mov ecx, 0x53fdc8
call fcn.0044cf70
push 0
push ebx
push 0
push ebx
push 0
lea eax, [esp + 0x2c]
push eax
push 3
lea ecx, [esp + 0xbc]
push ecx
call fcn.00477840
test al, al
jne 0x4af744
mov byte [esp + 0x850c], al
lea ecx, [esp + 0xa0]
call fcn.0040bde0
jmp 0x4afc78
mov byte [esp + 0x850c], 0
lea ecx, [esp + 0xa0]
call fcn.0040bde0
push 0
push 0x800
lea edx, [esp + 0x34b8]
push edx
push str.Rar_VR
call fcn.0049eb60
test al, al
je 0x4afc78
push 0x800
lea eax, [esp + 0x7504]
push eax
call fcn.0049f5a0
xor edi, edi
mov byte [esp + 0x12], 0
cmp dword [esp + 0x84], edi
jbe 0x4af922
nop
cmp byte [0x535500], 0
jne 0x4af922
lea ecx, [esp + 0x34b0]
push ecx
call fcn.0049f540
push edi
lea edx, [esp + 0x44b4]
push edx
lea ecx, [esp + 0x20]
call fcn.0044b3e0
push eax
call fcn.00460330
lea edx, [esp + 0x24b0]
lea esp, [esp]
movzx ecx, word [eax]
mov word [edx], cx
add eax, 2
add edx, 2
test cx, cx
jne 0x4af7e0
push 0
push 0
lea eax, [esp + 0x24b8]
push eax
call fcn.0043d090
test eax, eax
je 0x4af853
push ebx
lea ecx, [esp + 0x24b4]
push ecx
call fcn.00460070
push 0
push 0
lea edx, [esp + 0x24b8]
push edx
call fcn.0043d090
test eax, eax
je 0x4af853
lea eax, [esp + 0x24b0]
push eax
push 0x1f7
call fcn.004750b0
push eax
call fcn.004ac840
add esp, 8
mov ecx, 0x51f7e8
call fcn.00433750
jmp 0x4af90b
lea ecx, [esp + 0x24b0]
push ecx
call fcn.0049f540
push ebx
call fcn.0049aa70
push 0x800
push 0x550d52
push edi
lea edx, [esp + 0x44bc]
push edx
lea ecx, [esp + 0x28]
call fcn.0044b3e0
push eax
call fcn.00461910
cmp byte [0x533431], 0
jne 0x4af8a4
push 0
push 0
push 0x550d52
mov ecx, 0x541ef0
call fcn.00418720
cmp dword [0x5422e0], 0
jne 0x4af8b6
cmp byte [0x5422ea], 0
je 0x4af8ba
mov byte [esp + 0x12], bl
mov eax, dword [0x5420fc]
mov ecx, 0x551e68
mov dword [0x54dcf0], eax
call fcn.0047f300
mov ecx, 0x551d54
call fcn.0047f300
push 0x4d7800
mov ecx, 0x551d54
call fcn.0047f330
mov esi, dword [0x575e88]
push ebx
push 0
mov ecx, 0x541ef0
call fcn.00419ae0
cmp esi, dword [0x575e88]
jne 0x4af91c
cmp byte [0x533430], 0
jne 0x4af922
add edi, ebx
cmp edi, dword [esp + 0x84]
jb 0x4af7a0
jmp 0x4af922
mov byte [0x533430], bl
cmp byte [0x533430], 0
mov byte [esp + 0x13], 0
jne 0x4afbbd
push 0
push 0
push 0x550d52
push 9
call fcn.004a20a0
lea ecx, [esp + 0x3b0]
push ecx
push 0x4d7c40
mov byte [esp + 0x1b], al
call fcn.0049f9b0
add esp, 8
push 0x543
call fcn.004750b0
push eax
call fcn.0049f9b0
add esp, 4
lea edx, [esp + 0x34b0]
push edx
call fcn.0049f540
lea eax, [esp + 0x13b0]
push eax
lea ebx, [esp + 0x34b4]
call fcn.004a5df0
push 0x2000
push 0x2b4
lea ecx, [esp + 0x104]
push ecx
push 0
lea edx, [esp + 0x3c0]
push edx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov ecx, eax
shr ecx, 0x10
test ecx, ecx
jne 0x4afb1d
mov edx, 0x5a4d
cmp ax, dx
je 0x4af9d8
mov ecx, 0x4550
cmp ax, cx
jne 0x4afb1d
xor eax, eax
lea ebx, [ebx]
movzx ecx, word [esp + eax + 0x34b0]
mov word [esp + eax + 0x24b0], cx
add eax, 2
test cx, cx
jne 0x4af9e0
push 0x800
lea edx, [esp + 0x24b4]
push edx
call fcn.0045fed0
lea eax, [esp + 0x24b0]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4afa14
sub eax, edx
sar eax, 1
mov esi, eax
call fcn.004c2695
push eax
lea eax, [esp + esi*2 + 0x24b4]
push str.Rar_Scan_d.bat
mov edx, 0x800
sub edx, esi
push eax
call fcn.00495190
add esp, 0xc
push 0x4d83b4
lea ecx, [esp + 0x24b4]
push ecx
call fcn.0043c890
mov esi, eax
test esi, esi
je 0x4afb1d
cmp word [esp + 0x3b0], 0x22
je 0x4afa80
push 0x800
lea edx, [esp + 0x3b4]
push edx
call fcn.00453510
lea eax, [esp + 0x13b0]
push eax
lea ecx, [esp + 0x3b4]
push ecx
lea edx, [esp + 0x5508]
push str.__s__s_r_n_echo._r_n_pause
push edx
mov edx, 0x1000
call fcn.00495190
add esp, 0x10
push 0x1000
lea eax, [esp + 0x44b4]
push eax
lea ecx, [esp + 0x5508]
push ecx
call fcn.00486550
lea eax, [esp + 0x44b0]
mov byte [esp + 0x54af], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4afad6
sub eax, edx
push esi
push eax
lea edx, [esp + 0x44b8]
push 1
push edx
call fcn.004c3690
push esi
call fcn.004c34b2
add esp, 0x14
push 0x800
lea eax, [esp + 0x24b4]
push eax
lea ecx, [esp + 0x3b8]
push ecx
call fcn.0047ef70
xor edx, edx
mov word [esp + 0x13b0], dx
push 0
lea eax, [esp + 0x18]
push eax
push 0
lea ecx, [esp + 0x13bc]
push ecx
lea edx, [esp + 0x34c0]
push edx
lea eax, [esp + 0x3c4]
push eax
push 0
call fcn.004b3c10
test al, al
je 0x4afba2
mov ecx, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xc8
push ecx
call esi
cmp eax, 0x102
jne 0x4afb95
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4afb70
cmp byte [0x535500], 0
jne 0x4afb95
push 0x14
call edi
call fcn.00453460
mov edx, dword [esp + 0x14]
push 0xc8
push edx
call esi
cmp eax, 0x102
je 0x4afb70
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4afbbd
lea ecx, [esp + 0x3b0]
push ecx
push 0x201
call fcn.004750b0
push eax
call fcn.004ac840
add esp, 8
lea edx, [esp + 0x7500]
push edx
call fcn.0049f540
cmp byte [esp + 0x12], 0
je 0x4afc58
xor eax, eax
jmp 0x4afbe0
movzx ecx, word [esp + eax + 0x34b0]
mov word [esp + eax + 0x24b0], cx
add eax, 2
test cx, cx
jne 0x4afbe0
lea eax, [esp + 0x24b0]
push eax
call fcn.00460330
lea edx, [esp + 0x24b0]
mov ecx, 0x62
push edx
mov word [eax + 0xc], cx
call fcn.0043ca60
test al, al
jne 0x4afc58
lea eax, [esp + 0x24b0]
push eax
lea ecx, [esp + 0x34b4]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x4afc58
xor eax, eax
jmp 0x4afc40
movzx ecx, word [esp + eax + 0x24b0]
mov word [esp + eax + 0x34b0], cx
add eax, 2
test cx, cx
jne 0x4afc40
lea edx, [esp + 0x34b0]
push edx
call fcn.0049f1d0
cmp byte [esp + 0x13], 0
je 0x4afc78
mov eax, dword [0x53342c]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [esp + 0x850c], 0xffffffff
lea ecx, [esp + 0x18]
call fcn.00417860
mov ecx, dword [esp + 0x8504]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x84f0]
xor ecx, esp
call fcn.004c0c62
add esp, 0x8500
ret