Function at 0x4944b0
Capabilities:
Accept command line arguments
Check os version
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x4aff4b
mov eax, dword fs:[0]
push eax
sub esp, 0xc28
mov eax, dword [0x4c0390]
xor eax, esp
mov dword [esp + 0xc24], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4c0390]
xor eax, esp
push eax
lea eax, [esp + 0xc3c]
mov dword fs:[0], eax
mov edi, dword [esp + 0xc4c]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
movzx eax, word [esi]
xor bl, bl
test ax, ax
je 0x49452c
test bl, bl
jne 0x494515
movzx eax, ax
push eax
call fcn.00464c90
test al, al
jne 0x49452c
cmp word [esi], 0x22
jne 0x494520
test bl, bl
sete bl
movzx eax, word [esi + 2]
add esi, 2
test ax, ax
jne 0x494504
movzx ecx, word [esi]
push ecx
call fcn.00464c90
test al, al
je 0x494551
lea esp, [esp]
movzx edx, word [esi + 2]
add esi, 2
push edx
call fcn.00464c90
test al, al
jne 0x494540
push 0x4dbcb8
mov dword [0x4dbcb8], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push 0x8005
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
call fcn.00464610
mov ecx, 0x4e2eb0
call fcn.0041c020
mov byte [0x4dbd55], 0
mov dword [0x4db838], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
push 0
push 1
push 0
mov dword [0x4dc1c4], eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push str.WMUser_DisplayError
mov dword [0x4dc160], eax
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
push str.General
mov dword [0x4db844], eax
call fcn.00456240
test al, al
lea eax, [esp + 0x438]
sete bl
push eax
mov byte [esp + 0x1b], bl
call fcn.0044dbb0
lea ecx, [esp + 0x438]
push ecx
call fcn.0044d9b0
xor eax, eax
mov edi, edi
mov cl, byte [esp + eax + 0x438]
mov byte [eax + 0x4db848], cl
inc eax
test cl, cl
jne 0x4945f0
mov eax, 0x4db848
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x494608
mov edx, dword [str.rar.log]
mov ecx, dword [0x4b1dc0]
mov dword [eax], edx
push 0
mov dword [eax + 4], ecx
push edi
mov ecx, 0x4c9390
call fcn.0045b9a0
push str.winrar.lng
mov ecx, 0x4c9370
call fcn.0045b740
push edi
call fcn.00493350
test eax, eax
je 0x494d01
lea ecx, [esp + 0x1c]
call fcn.00484320
mov dword [esp + 0xc44], 0
mov dword [0x4c935c], edi
call fcn.0047d3a0
call fcn.0047b2f0
push str.CLSIDDDF7D820_8355_11CF_B357_444553540000
push 0x80000000
call fcn.004559c0
call fcn.00490ba0
call fcn.00490d40
push str.WinRAR_Busy
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push 0
push str.WinRarWindow
mov dword [0x4dc17c], eax
call dword [sym.imp.USER32.dll_FindWindowA]
push 0
push edi
push 0
push 0
push 0x80000000
push 0x80000000
push 0x80000000
push 0x80000000
push 0x6cf0000
push 0x4b2da4
push str.WinRarWindow
mov ebp, eax
push 0x10
mov dword [esp + 0x48], ebp
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x4dc1c8], eax
test eax, eax
je 0x494ced
push eax
mov ecx, 0x4c9370
call fcn.0045a490
push 0
call fcn.004903c0
call fcn.00490a40
test bl, bl
je 0x49471b
push 1
push 0
call fcn.0041f700
mov byte [esp + 0x16], 1
test al, al
je 0x494720
mov byte [esp + 0x16], 0
push 0x110
push 0
push 0x4e2860
call fcn.0049e680
add esp, 0xc
push esi
call fcn.0048f690
mov bl, al
test bl, bl
je 0x494745
call fcn.0047b000
push 0x4e2eb0
mov ecx, 0x4dc400
call fcn.00416320
xor eax, eax
jmp 0x494760
mov cl, byte [eax + 0x4e75ac]
mov byte [eax + 0x4dbd60], cl
inc eax
test cl, cl
jne 0x494760
lea edx, [esp + 0x24]
xor eax, eax
push edx
push esi
mov byte [0x4e75ac], cl
mov dword [0x4e5778], eax
mov dword [0x4dbc60], eax
call fcn.0048f7a0
movzx eax, word [esp + 0x24]
push eax
call fcn.0049ef56
add esp, 4
mov edi, eax
push edi
push str.AFUM
call fcn.0046da20
test eax, eax
jne 0x4947b2
call fcn.00476d00
push edi
push 0x4b5a5c
call fcn.0046da20
test eax, eax
je 0x4947d5
mov ecx, dword [0x4e81b0]
call fcn.004650d0
test bl, bl
je 0x4947d5
call fcn.00481c20
push esi
call fcn.00493b70
call fcn.00490470
cmp byte [0x4e5349], 0
je 0x494831
push 0x4e5349
call fcn.0044d530
cmp eax, 0x4e5349
jne 0x49481c
push 0x4e5349
call fcn.0044d530
push 0x4db848
mov esi, eax
call fcn.0044d530
mov cl, byte [esi]
mov byte [eax], cl
inc esi
inc eax
test cl, cl
jne 0x494810
jmp 0x494831
xor eax, eax
mov edi, edi
mov cl, byte [eax + 0x4e5349]
mov byte [eax + 0x4db848], cl
inc eax
test cl, cl
jne 0x494820
mov ecx, dword [0x4dc1c8]
push 0
push 0
push 0x403
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [0x4dc1c8], 0
je 0x494a29
cmp byte [0x4e697b], 0
jne 0x494c79
xor bl, bl
cmp byte [0x4e75ac], bl
je 0x494bd6
push 0x4e79ac
push 0x4e75ac
call fcn.0042f940
cmp eax, 0xffffffff
je 0x494889
test al, 0x10
je 0x494889
mov bl, 1
cmp byte [0x4e75ac], 0
je 0x494bbc
test bl, bl
jne 0x494bc0
push 0
push str.ReuseWindow
push str.General
call fcn.00456400
test eax, eax
je 0x4949d2
test ebp, ebp
je 0x4949d2
push 0x400
lea edx, [esp + 0x3c]
push edx
call fcn.0047de30
lea eax, [esp + 0x38]
push eax
call fcn.0044d9b0
lea eax, [esp + 0x38]
dec eax
lea ecx, [ecx]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4948e0
mov ecx, dword [str.Rar_]
mov dl, byte [0x4b5a58]
mov dword [eax], ecx
mov byte [eax + 4], dl
lea eax, [esp + 0x38]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x494900
sub eax, edx
push eax
lea eax, [esp + 0x3c]
push eax
push 0x4e75ac
call fcn.00464b90
test eax, eax
je 0x4949d2
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push str.RarArchiveName
push 0x400
push 0
push 0x8000004
push 0
push 0xffffffffffffffff
call ebp
mov ebx, dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push 0x400
push 0
push 0
mov esi, eax
push 2
push esi
call ebx
mov edi, eax
push edi
push 0x4e75ac
call fcn.0042f9c0
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push str.RarArchiveNameW
push 0x800
push 0
push 0x8000004
push 0
push 0xffffffffffffffff
call ebp
push 0x800
push 0
push 0
mov edi, eax
push 2
push edi
call ebx
mov ebp, eax
push ebp
push 0x4e79ac
call fcn.0042fa50
push ebp
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
push 0x7ae964f1
push 0xd489ac5e
push 0x401
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
setne bl
call esi
push edi
call esi
mov ebp, dword [esp + 0x18]
cmp byte [0x4e75ac], 0
je 0x4949e5
mov ecx, 0x4e75ac
call fcn.004908b0
test bl, bl
jne 0x494b99
push 0x4e79ac
push 0x4e75ac
mov ecx, 0x4dfef0
call fcn.00442c50
test al, al
je 0x494b99
cmp dword [0x4dbc5c], 0
jne 0x494a29
cmp dword [0x4dbd50], 0
je 0x494b87
mov ecx, 0x4dfef0
call fcn.004418b0
push ebp
push 0x10000
push 0x48c7b0
call fcn.0049f1a8
mov edx, dword [0x4dc1c8]
add esp, 0xc
push edx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x494a5b
test ebp, ebp
setne al
movzx ecx, al
push ecx
call fcn.00490730
mov edx, dword [0x4dc1c8]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
call fcn.004904c0
cmp byte [esp + 0x16], 0
je 0x494a9e
cmp byte [esp + 0x17], 0
je 0x494a9e
push str.Setup
call fcn.00456240
test al, al
jne 0x494a9e
push 0x4b2bc0
call fcn.0043aa30
test al, al
jne 0x494a9e
push 6
call fcn.0041f4f0
push 0
push str.ExportedSettings
push 0x4b1914
call fcn.00456400
test eax, eax
je 0x494ab8
call fcn.0041f400
push 0
push str.WizardMode
push str.General
call fcn.00456400
test eax, eax
je 0x494af2
mov eax, dword [0x4dc1c8]
push eax
call fcn.00498de0
test al, al
je 0x494af2
cmp dword [0x4dbd50], 0
jne 0x494af2
mov ecx, dword [0x4dc1c8]
push ecx
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0
call fcn.00493480
test al, al
jne 0x494af2
mov ecx, 0x4dc1cc
call fcn.00495040
call fcn.00486550
mov edx, dword [0x4dc160]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [0x4dbd55], 1
xor esi, esi
lea ebx, [ebx]
cmp dword [0x4db838], 0
jle 0x494b46
push 0x64
call edi
dec esi
cmp esi, 0xc8
jl 0x494b30
mov eax, dword [0x4dc160]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x4dbc58], 0
je 0x494cd0
mov dword [0x4dbc58], 0xffffffff
xor esi, esi
cmp dword [0x4dbc58], 0
je 0x494ced
push 0x64
call edi
inc esi
cmp esi, 0xa
jl 0x494b6b
jmp 0x494ced
mov edx, dword [0x4dc1c8]
push edx
call dword [sym.imp.USER32.dll_DestroyWindow]
jmp 0x494a29
call fcn.004866c0
mov dword [esp + 0xc44], 0xffffffff
lea ecx, [esp + 0x1c]
call fcn.004843b0
mov eax, 1
jmp 0x494d03
test bl, bl
je 0x494bd6
mov ecx, 0x4e75ac
call fcn.004908b0
push 0
push 0x4e75ac
jmp 0x494c57
push 1
push str.RestoreFolder
push str.General
call fcn.00456400
push 0x400
push 0x4b1914
test eax, eax
je 0x494c12
lea eax, [esp + 0x40]
push eax
push str.LastFolder
push str.General
call fcn.004563a0
push 0
lea ecx, [esp + 0x3c]
push ecx
jmp 0x494c57
lea edx, [esp + 0x840]
push edx
push str.StartFolder
push str.Paths
call fcn.004563a0
push 0x400
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x840]
push ecx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [esp + 0x38], 0
mov byte [esp + 0x437], 0
je 0x494c5c
push 0
lea edx, [esp + 0x3c]
push edx
call fcn.0047efc0
push 0
push 0
mov ecx, 0x4dfef0
call fcn.00440f30
mov ecx, 0x4dfee0
call fcn.00406ff0
jmp 0x494a29
push 0x4e2860
call fcn.00494110
call fcn.004866c0
cmp dword [0x4dbc60], 1
jne 0x494a29
push 0
push str.WinRarWindow
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
sete al
movzx ecx, al
push ecx
push 1
call fcn.0048a0a0
mov esi, dword [0x4c9364]
mov dword [esp + 0xc44], 0xffffffff
lea ecx, [esp + 0x1c]
call fcn.004843b0
mov eax, esi
jmp 0x494d03
push 0
push str.WinRarWindow
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
sete cl
movzx edx, cl
push edx
push 1
call fcn.0048a0a0
mov dword [esp + 0xc44], 0xffffffff
lea ecx, [esp + 0x1c]
call fcn.004843b0
xor eax, eax
mov ecx, dword [esp + 0xc3c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xc24]
xor ecx, esp
call fcn.0049e0c6
add esp, 0xc34
ret 0x10