Function at 0x47d990
Capabilities:
Delete file
Get common file path
Write file on windows

Disassembly:
sub esp, 0xcf4
mov eax, dword [0x4c03a0]
xor eax, esp
mov dword [esp + 0xcf0], eax
push ebx
xor ebx, ebx
push esi
push edi
cmp byte [esp + 0xd0c], bl
je 0x47d9ca
cmp byte [0x4e4308], bl
je 0x47da33
cmp dword [0x4f6348], ebx
je 0x47da33
mov byte [0x4e4308], bl
jmp 0x47da33
push 1
call fcn.0047b480
mov al, byte [esp + 0xd08]
mov dword [0x4e57c4], 3
cmp al, bl
je 0x47d9eb
mov byte [0x4e57fb], al
mov dword [0x4dbcf8], ebx
mov dword [0x4dbcfc], ebx
cmp dword [0x4dbca4], ebx
jne 0x47db81
mov eax, dword [0x4e81f4]
push 1
push eax
mov ecx, 0x4dff38
call fcn.0043f170
cmp byte [0x4e0b56], bl
je 0x47da33
mov ecx, dword [0x4e81f4]
cmp dword [ecx + 0x30], 1
jbe 0x47da33
mov dword [0x4e57c0], 5
cmp dword [0x4dbca4], ebx
jne 0x47db81
cmp byte [0x4e75f4], bl
jne 0x47db81
mov esi, 0x4e79f4
mov edi, 0x4e75f4
mov byte [esp + 0xd04], bl
call fcn.00479470
push ebx
push edi
call fcn.0044e680
push 0x400
push 0x4b1914
lea edx, [esp + 0x104]
push edx
push str.DefFolder
push str.Compression
call fcn.004568e0
cmp byte [esp + 0xfc], bl
jne 0x47dabe
cmp byte [0x4e0b56], bl
je 0x47db5f
lea eax, [esp + 0xfc]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
cmp byte [esp + 0xfc], bl
je 0x47db5f
lea ecx, [esp + 0xfc]
push ecx
call fcn.0044df70
push 0x1000000
lea edx, [esp + 0x500]
push edx
lea eax, [esp + 0x104]
push eax
call fcn.0046d830
mov eax, 0x4e75f4
mov edx, eax
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x47daf0
lea edi, [esp + 0xfc]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x47db01
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor eax, eax
jmp 0x47db20
mov cl, byte [esp + eax + 0xfc]
mov byte [eax + 0x4e75f4], cl
inc eax
cmp cl, bl
jne 0x47db20
cmp word [0x4e79f4], bx
je 0x47db5f
push 0x4e79f4
lea ecx, [esp + 0x500]
push ecx
call fcn.0046db90
lea edx, [esp + 0x4fc]
push edx
push 0x4e79f4
call fcn.0046db30
cmp byte [0x4e3308], bl
mov eax, dword [0x4e6194]
setne cl
push eax
movzx edx, cl
push edx
push 0x4e79f4
push 0x4e75f4
call fcn.00479610
cmp dword [0x4e57c0], ebx
jne 0x47db93
mov dword [0x4e57c0], 4
cmp dword [0x4dbca4], ebx
je 0x47dc89
mov esi, dword [0x4e0e68]
cmp esi, ebx
je 0x47dbd4
cmp esi, 1
je 0x47dbd4
push 0x30
push 0x65
call fcn.0045be10
push eax
push 0x1fd
call fcn.0045be10
push eax
mov eax, dword [0x4dc210]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x47deb6
push 0x4e79f4
push 0x4e75f4
mov ecx, 0x4e0c60
call fcn.00413520
push 0x4e4b10
push 0x4e4710
mov ecx, 0x4e0c60
call fcn.004134e0
cmp byte [0x4e4710], bl
je 0x47dc0e
push 0x4e4710
call fcn.0044df70
cmp word [0x4e4b10], bx
je 0x47dc3a
push 0x4e4b10
call fcn.004652f0
test al, al
je 0x47dc30
xor ecx, ecx
mov word [0x4e4b10], cx
jmp 0x47dc3a
push 0x4e4b10
call fcn.0044d930
lea edx, [esp + 0xc]
push edx
mov ecx, 0x4e0c60
mov byte [0x4e57ff], bl
call fcn.00413570
mov eax, dword [esp + 0x1c]
mov dword [0x4e6194], eax
cmp esi, ebx
jne 0x47dc62
cmp dword [esp + 0x64], ebx
je 0x47dc6f
mov ecx, dword [esp + 0x90]
mov dword [0x4e57b0], ecx
cmp dword [esp + 0x7c], ebx
je 0x47dc83
mov edx, 0x2a
mov word [0x4e3308], dx
jmp 0x47dc89
mov byte [0x4e3308], bl
mov eax, dword [0x4dc210]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov ecx, dword [esp + 0xd04]
neg eax
sbb eax, eax
and eax, dword [0x4dc210]
push ebx
push ecx
push eax
call fcn.0047d680
test al, al
je 0x47de97
mov eax, dword [0x4f6350]
cmp eax, 1
je 0x47dcc5
cmp eax, 2
jne 0x47dd18
mov edx, dword [0x4f635c]
mov eax, dword [0x4f6358]
mov ecx, dword [0x4f6354]
push edx
push eax
push ecx
lea edx, [esp + 0xb8]
push str._dd_dh_dm
push edx
call fcn.0049e635
add esp, 0x14
cmp dword [0x4f6350], 1
jne 0x47dd06
lea eax, [esp + 0xac]
push eax
mov ecx, 0x4e5854
jmp 0x47dd13
lea ecx, [esp + 0xac]
push ecx
mov ecx, 0x4e5878
call fcn.004683f0
mov edi, dword [0x4f6348]
cmp edi, ebx
je 0x47dd5e
push 0x4e4308
push str.Rar_CMXXXXXX
call fcn.0047f030
mov esi, eax
cmp esi, ebx
je 0x47dd7b
mov eax, edi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x47dd40
push esi
sub eax, edx
push eax
push 1
push edi
call fcn.0049fd82
push esi
call fcn.0049fba6
add esp, 0x14
jmp 0x47dd7b
cmp dword [0x4dbca4], ebx
je 0x47dd7b
cmp dword [esp + 0x7c], ebx
je 0x47dd7b
cmp byte [0x4e3308], 0x2a
jne 0x47dd7b
mov byte [0x4e3308], bl
mov edx, dword [0x4e81f4]
cmp dword [edx + 0x30], ebx
jne 0x47ddac
push 0x30
push 0x65
call fcn.0045be10
push eax
push 0x14b
call fcn.0045be10
push eax
mov eax, dword [0x4dc210]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x47de97
cmp byte [0x4e5310], bl
setne cl
mov byte [0x4dc244], cl
mov ecx, 0x4dc218
call fcn.00464fc0
cmp byte [0x4f6362], bl
je 0x47ddd4
call fcn.0047ce50
jmp 0x47dde6
movzx edx, byte [0x4e699a]
push edx
mov ecx, 0x4e0c60
call fcn.00415390
cmp dword [0x4f6348], ebx
je 0x47ddf9
push 0x4e4308
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [0x4dbca8], 1
je 0x47de97
cmp dword [0x4dbca4], ebx
je 0x47de1a
mov ecx, 0x4dff38
call fcn.004428f0
jmp 0x47de97
cmp byte [0x4e57fb], bl
je 0x47de2c
mov ecx, 0x4dff10
call fcn.0046b3f0
lea eax, [esp + 0xfc]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [esp + 0xfc]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x47de50
sub eax, edx
push eax
push 0x4e75f4
lea ecx, [esp + 0x104]
push ecx
call fcn.004650a0
push 0x4e79f4
test eax, eax
jne 0x47de88
call fcn.0044db70
push eax
push 0x4e75f4
call fcn.0044daf0
push eax
jmp 0x47de8d
push 0x4e75f4
mov ecx, 0x4dff38
call fcn.004413b0
mov edx, dword [0x4f6348]
push edx
call fcn.0049efc5
add esp, 4
mov ecx, 0x4dc218
mov byte [0x4dc244], bl
call fcn.00464fc0
mov ecx, dword [esp + 0xcfc]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0049e626
add esp, 0xcf4
ret 0xc