Function at 0x495f40
Capabilities:
Get file system object information
Parse pe header
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4b88b6
mov eax, dword fs:[0]
push eax
mov eax, 0x5d34
call fcn.004a5100
mov eax, dword [0x4cc3b0]
xor eax, esp
mov dword [esp + 0x5d30], eax
push ebx
push esi
push edi
mov eax, dword [0x4cc3b0]
xor eax, esp
push eax
lea eax, [esp + 0x5d44]
mov dword fs:[0], eax
mov ecx, dword [0x4eacd4]
mov edx, dword [0x4d76b0]
lea eax, [esp + 0x18c]
push eax
push 0x492470
push ecx
push str.VIRSCAN
push edx
call dword [sym.imp.USER32.dll_DialogBoxParamW]
test eax, eax
je 0x4964f3
lea ecx, [esp + 0x18]
call fcn.0043f400
mov dword [esp + 0x5d4c], 0
cmp byte [0x4e9b89], 0
je 0x495ffc
push 0x400
lea eax, [esp + 0x1544]
push eax
mov ecx, 0x4f0da0
call fcn.004130e0
lea ecx, [esp + 0x1540]
push ecx
lea ecx, [esp + 0x1c]
call fcn.0043f150
lea ecx, [esp + 0x18]
call fcn.0043f280
jmp 0x496072
lea ecx, [esp + 0xe4]
call fcn.0046afd0
mov byte [esp + 0x5d4c], 1
push 0
lea edx, [esp + 0xe8]
push edx
mov ecx, 0x4f0478
call fcn.00440890
push 0
push 1
push 0
push 1
push 0
lea eax, [esp + 0x2c]
push eax
push 3
lea ecx, [esp + 0x100]
push ecx
call fcn.00463760
test al, al
jne 0x49605e
mov byte [esp + 0x5d4c], al
lea ecx, [esp + 0xe4]
call fcn.00401b00
jmp 0x4964df
mov byte [esp + 0x5d4c], 0
lea ecx, [esp + 0xe4]
call fcn.00401b00
lea edx, [esp + 0x1d40]
push edx
push str.Rar_VRXXXXXX
call fcn.00485420
test al, al
je 0x4964df
push 0x400
lea eax, [esp + 0x3544]
push eax
call fcn.00485b10
xor edi, edi
cmp dword [esp + 0xcc], edi
jbe 0x49621f
lea ecx, [ecx]
cmp byte [0x4eac4c], 0
jne 0x49621f
lea ecx, [esp + 0x1d40]
push ecx
call fcn.00485af0
push edi
lea edx, [esp + 0x2544]
push edx
lea ecx, [esp + 0x20]
call fcn.0043f1d0
push eax
call fcn.00451c30
lea edx, [esp + 0x1540]
lea esp, [esp]
movzx ecx, word [eax]
mov word [edx], cx
add eax, 2
add edx, 2
test cx, cx
jne 0x4960f0
push 0
push 0
lea eax, [esp + 0x1548]
push eax
push 0
call fcn.004320a0
test eax, eax
je 0x496168
push 1
lea ecx, [esp + 0x1544]
push ecx
call fcn.00451720
push 0
push 0
lea edx, [esp + 0x1548]
push edx
push 0
call fcn.004320a0
test eax, eax
je 0x496168
lea eax, [esp + 0x1540]
push eax
push 0x1f7
call fcn.004611c0
push eax
call fcn.00493250
add esp, 8
mov ecx, 0x4d76b4
call fcn.00428fb0
jmp 0x496208
lea ecx, [esp + 0x1540]
push ecx
call fcn.00485af0
call fcn.004816c0
push 0x4f901c
push edi
lea edx, [esp + 0x2548]
push edx
lea ecx, [esp + 0x24]
call fcn.0043f1d0
push eax
call fcn.004518f0
cmp byte [0x4e9b89], 0
jne 0x4961b3
push 0
push 1
push 0x4f901c
mov ecx, 0x4f0da0
call fcn.00416320
mov eax, dword [0x4f0fac]
mov ecx, dword [0x4f9828]
mov dword [0x4f6fbc], eax
call fcn.0046ac90
mov ecx, dword [0x4f981c]
call fcn.0046ac90
mov ecx, dword [0x4f981c]
push 0x4ba77c
call fcn.0046b070
mov esi, dword [0x5135e0]
push 1
push 0
mov ecx, 0x4f0da0
call fcn.00417a60
cmp esi, dword [0x5135e0]
jne 0x496218
cmp byte [0x4e9b88], 0
jne 0x49621f
inc edi
cmp edi, dword [esp + 0xcc]
jb 0x4960b0
jmp 0x49621f
mov byte [0x4e9b88], 1
xor bl, bl
cmp byte [0x4e9b88], bl
jne 0x4964b4
push 0
push 0
push 0x4f901c
push 9
call fcn.004885c0
lea ecx, [esp + 0x18c]
push ecx
mov byte [esp + 0x17], al
call fcn.00485f20
push 0x543
call fcn.004611c0
push eax
call fcn.00485f20
lea edx, [esp + 0x1d40]
push edx
call fcn.00485af0
lea eax, [esp + 0x98c]
push eax
lea ebx, [esp + 0x1d44]
call fcn.0048c810
push 0x2000
push 0x2b4
lea ecx, [esp + 0x1294]
push ecx
push 0
lea edx, [esp + 0x19c]
push edx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov ecx, eax
shr ecx, 0x10
test ecx, ecx
jne 0x496412
mov edx, 0x5a4d
cmp ax, dx
je 0x4962c6
mov ecx, 0x4550
cmp ax, cx
jne 0x496412
xor eax, eax
jmp 0x4962d0
movzx ecx, word [esp + eax + 0x1d40]
mov word [esp + eax + 0x1540], cx
add eax, 2
test cx, cx
jne 0x4962d0
lea edx, [esp + 0x1540]
push edx
call fcn.004516d0
lea eax, [esp + 0x1540]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x496300
sub eax, edx
sar eax, 1
mov esi, eax
call fcn.004a5c05
push eax
lea eax, [esp + esi*2 + 0x1544]
push str.__rar_scan_d.bat
push eax
mov edx, 0x400
call fcn.004a29f0
add esp, 0xc
push 0
push 0x4bae08
lea ecx, [esp + 0x1548]
push ecx
call fcn.00432060
mov esi, eax
test esi, esi
je 0x496412
cmp word [esp + 0x18c], 0x22
je 0x496367
lea edx, [esp + 0x18c]
push edx
call fcn.00447160
lea eax, [esp + 0x98c]
push eax
lea ecx, [esp + 0x190]
push ecx
lea edx, [esp + 0x3d48]
push str.__s__s_r_n_echo._r_n_pause
push edx
mov edx, 0x1000
call fcn.004a29f0
add esp, 0x10
push 0x1000
lea eax, [esp + 0x2544]
push eax
lea ecx, [esp + 0x3d48]
push ecx
call fcn.00473010
lea eax, [esp + 0x2540]
mov byte [esp + 0x353f], 0
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4963c0
sub eax, edx
push esi
push eax
lea edx, [esp + 0x2548]
push 1
push edx
call fcn.004a6bc4
push esi
call fcn.004a6995
add esp, 0x14
xor eax, eax
jmp 0x4963f0
movzx ecx, word [esp + eax + 0x1540]
mov word [esp + eax + 0x18c], cx
add eax, 2
test cx, cx
jne 0x4963f0
xor eax, eax
mov word [esp + 0x98c], ax
push 0
lea ecx, [esp + 0x18]
push ecx
push 0
lea edx, [esp + 0x998]
push edx
lea eax, [esp + 0x1d50]
push eax
lea ecx, [esp + 0x1a0]
push ecx
push 0
call fcn.0049c600
test al, al
jne 0x496459
lea edx, [esp + 0x18c]
push edx
push 0x201
call fcn.004611c0
push eax
call fcn.00493250
add esp, 8
mov eax, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xc8
push eax
call esi
cmp eax, 0x102
jne 0x4964a5
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x496480
cmp byte [0x4eac4c], 0
jne 0x4964a5
push 0x14
call edi
call fcn.004470b0
mov ecx, dword [esp + 0x14]
push 0xc8
push ecx
call esi
cmp eax, 0x102
je 0x496480
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, byte [esp + 0x13]
lea eax, [esp + 0x3540]
push eax
call fcn.00485af0
lea ecx, [esp + 0x1d40]
push ecx
call fcn.00485830
test bl, bl
je 0x4964df
mov edx, dword [0x4e9b84]
push edx
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [esp + 0x5d4c], 0xffffffff
lea ecx, [esp + 0x18]
call fcn.004147f0
mov ecx, dword [esp + 0x5d44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x5d30]
xor ecx, esp
call fcn.004a48d3
add esp, 0x5d40
ret