Function at 0x48ef20
Capabilities:
Get common file path
Get file system object information
Parse pe header

Disassembly:
push 0xffffffffffffffff
push 0x4afa36
mov eax, dword fs:[0]
push eax
mov eax, 0x2328
call fcn.0049e430
mov eax, dword [0x4c0390]
xor eax, esp
mov dword [esp + 0x2324], eax
push ebx
push esi
push edi
mov eax, dword [0x4c0390]
xor eax, esp
push eax
lea eax, [esp + 0x2338]
mov dword fs:[0], eax
mov ecx, dword [0x4dc1c8]
mov edx, dword [0x4c9360]
lea eax, [esp + 0x284]
push eax
push 0x48bfc0
push ecx
push str.VIRSCAN
push edx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
test eax, eax
je 0x48f497
lea ecx, [esp + 0x18]
call fcn.0043cf00
mov dword [esp + 0x2340], 0
cmp dword [0x4dbc5c], 0
je 0x48efe7
lea eax, [esp + 0x1304]
push eax
lea ecx, [esp + 0xb08]
push ecx
mov ecx, 0x4e0c08
call fcn.00413690
lea edx, [esp + 0x1304]
push edx
lea eax, [esp + 0xb08]
push eax
lea ecx, [esp + 0x20]
call fcn.0043ccb0
lea ecx, [esp + 0x18]
call fcn.0043cdf0
jmp 0x48f05d
lea ecx, [esp + 0x124]
call fcn.00465890
mov byte [esp + 0x2340], 1
push 0
lea ecx, [esp + 0x128]
push ecx
mov ecx, 0x4dfee0
call fcn.0043ee00
push 0
push 1
push 0
push 1
push 0
lea edx, [esp + 0x2c]
push edx
push 3
lea eax, [esp + 0x140]
push eax
call fcn.0045e3e0
test al, al
jne 0x48f049
mov byte [esp + 0x2340], al
lea ecx, [esp + 0x124]
call fcn.00465510
jmp 0x48f483
mov byte [esp + 0x2340], 0
lea ecx, [esp + 0x124]
call fcn.00465510
lea ecx, [esp + 0xf04]
push ecx
push str.Rar_VRXXXXXX
call fcn.0047f0a0
test al, al
je 0x48f483
lea edx, [esp + 0x1f34]
push edx
push 0x400
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
xor edi, edi
cmp dword [esp + 0x11c], edi
jbe 0x48f235
lea esp, [esp]
cmp dword [0x4dc178], 0
jne 0x48f235
lea eax, [esp + 0xf04]
push eax
call fcn.004ac458
add esp, 4
push edi
lea ecx, [esp + 0x1308]
push ecx
lea ecx, [esp + 0x20]
call fcn.0043cd40
push eax
call fcn.0044db30
lea edx, [esp + 0xb04]
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
test cl, cl
jne 0x48f0e0
push 0
push 0
push 0
lea edx, [esp + 0xb10]
push edx
call fcn.004301e0
test eax, eax
je 0x48f151
push 1
lea eax, [esp + 0xb08]
push eax
call fcn.0044e6c0
push 0
push 0
push 0
lea ecx, [esp + 0xb10]
push ecx
call fcn.004301e0
test eax, eax
je 0x48f151
lea edx, [esp + 0xb04]
push edx
push 0x1f7
call fcn.0045bde0
push eax
call fcn.0048e100
add esp, 8
mov ecx, 0x4c9364
call fcn.00427d40
jmp 0x48f21b
lea eax, [esp + 0xb04]
push eax
call fcn.004ac458
add esp, 4
call fcn.0047b360
push 0x4e758c
push edi
lea ecx, [esp + 0x130c]
push ecx
lea ecx, [esp + 0x24]
call fcn.0043cd40
push eax
call fcn.0042fa70
push 0x4e798c
push edi
lea edx, [esp + 0x130c]
push edx
lea ecx, [esp + 0x24]
call fcn.0043cd40
add eax, 0x400
push eax
call fcn.0042fb00
cmp dword [0x4dbc5c], 0
jne 0x48f1c6
push 0
push 1
push 0x4e798c
push 0x4e758c
mov ecx, 0x4e0c08
call fcn.004145d0
mov eax, dword [0x4e0e10]
mov ecx, dword [0x4e8198]
mov dword [0x4e613c], eax
call fcn.00465590
mov ecx, dword [0x4e818c]
call fcn.00465590
mov ecx, dword [0x4e818c]
push 0x4b175c
call fcn.00465910
mov esi, dword [0x4f8648]
push 1
push 0
mov ecx, 0x4e0c08
call fcn.00416240
cmp esi, dword [0x4f8648]
jne 0x48f22b
cmp dword [0x4db840], 0
jne 0x48f235
inc edi
cmp edi, dword [esp + 0x11c]
jb 0x48f0a0
jmp 0x48f235
mov dword [0x4db840], 1
xor bl, bl
cmp dword [0x4db840], 0
jne 0x48f456
push 0
push 0
push 0x4e758c
push 9
call fcn.00481a20
lea ecx, [esp + 0x284]
push ecx
mov byte [esp + 0x17], al
call fcn.0047f870
push 0x543
call fcn.0045bde0
push eax
call fcn.0047f870
lea edx, [esp + 0xf04]
push edx
call fcn.004ac458
add esp, 4
lea eax, [esp + 0x684]
push eax
lea ebx, [esp + 0xf08]
call fcn.00486670
push 0x2000
push 0x160
lea ecx, [esp + 0x12c]
push ecx
push 0
lea edx, [esp + 0x294]
push edx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov ecx, eax
shr ecx, 0x10
test ecx, ecx
jne 0x48f3ba
mov edx, 0x5a4d
cmp ax, dx
je 0x48f2e0
mov ecx, 0x4550
cmp ax, cx
jne 0x48f3ba
xor eax, eax
jmp 0x48f2f0
mov cl, byte [esp + eax + 0xf04]
mov byte [esp + eax + 0xb04], cl
inc eax
test cl, cl
jne 0x48f2f0
lea edx, [esp + 0xb04]
push edx
call fcn.0044dfb0
lea eax, [esp + 0xb04]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x48f320
sub eax, edx
mov esi, eax
call fcn.0049ed5d
push eax
lea eax, [esp + esi + 0xb08]
push str.__rar_scan_d.bat
push eax
call fcn.0049deb5
lea ecx, [esp + 0xb10]
push 0x4b1ba8
push ecx
call fcn.0049f748
mov esi, eax
add esp, 0x14
test esi, esi
je 0x48f3ba
cmp byte [esp + 0x284], 0x22
je 0x48f375
lea edx, [esp + 0x284]
push edx
call fcn.00445980
lea eax, [esp + 0x684]
push eax
lea ecx, [esp + 0x288]
push ecx
push str.__s__s_r_n_echo._r_n_pause
push esi
call fcn.004a159b
push esi
call fcn.0049f426
add esp, 0x14
xor eax, eax
jmp 0x48f3a0
mov cl, byte [esp + eax + 0xb04]
mov byte [esp + eax + 0x284], cl
inc eax
test cl, cl
jne 0x48f3a0
mov byte [esp + 0x684], cl
push 0
lea edx, [esp + 0x18]
push edx
push 0
push 0
lea eax, [esp + 0x694]
push eax
lea ecx, [esp + 0xf18]
push ecx
push 0
lea edx, [esp + 0x2a0]
push edx
call fcn.00495a90
test al, al
jne 0x48f403
lea eax, [esp + 0x284]
push eax
push 0x201
call fcn.0045bde0
push eax
call fcn.0048e100
add esp, 8
mov ecx, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xc8
push ecx
call esi
cmp eax, 0x102
jne 0x48f447
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x4dc178], 0
jne 0x48f447
push 0x14
call edi
call fcn.004458e0
mov edx, dword [esp + 0x14]
push 0xc8
push edx
call esi
cmp eax, 0x102
je 0x48f422
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, byte [esp + 0x13]
lea ecx, [esp + 0x1f34]
push ecx
call fcn.004ac458
add esp, 4
lea edx, [esp + 0xf04]
push edx
call fcn.0047f200
test bl, bl
je 0x48f483
mov eax, dword [0x4db83c]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [esp + 0x2340], 0xffffffff
lea ecx, [esp + 0x18]
call fcn.004144e0
mov ecx, dword [esp + 0x2338]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2324]
xor ecx, esp
call fcn.0049dea6
add esp, 0x2334
ret