Function at 0x5141b0
Capabilities:
Get file system object information
Move file
Parse pe header

Disassembly:
push ebp
lea ebp, [esp - 0x9258]
mov eax, 0x9258
call fcn.00530230
push 0xffffffffffffffff
push 0x554cfe
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x58cb30]
xor eax, ebp
mov dword [ebp + 0x9254], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp]
push eax
push 0x5147e0
push dword [0x5933dc]
push str.VIRSCAN
push dword [0x5d3758]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
test eax, eax
je 0x5147ae
lea ecx, [ebp - 0x38]
call fcn.00459ca0
mov dword [ebp - 4], 0
cmp byte [0x5943f4], 0
je 0x514254
push 0x800
lea eax, [ebp + 0x21f8]
mov ecx, 0x5c3bd0
push eax
call fcn.004099c0
lea eax, [ebp + 0x21f8]
push eax
lea ecx, [ebp - 0x38]
call fcn.0045a260
jmp 0x5142c8
lea ecx, [ebp + 0x31f8]
call fcn.004bdb30
mov byte [ebp - 4], 1
lea eax, [ebp + 0x31f8]
push 1
push eax
mov ecx, 0x5c6810
call fcn.0045d3c0
push 0
push 0
push 0xa
lea eax, [ebp - 0x38]
push eax
push 3
lea eax, [ebp + 0x31f8]
push eax
call fcn.004d4680
test al, al
jne 0x5142b1
mov byte [ebp - 4], al
mov eax, dword [ebp + 0x31f8]
test eax, eax
je 0x51479f
push eax
call fcn.0053867f
add esp, 4
jmp 0x51479f
mov byte [ebp - 4], 0
mov eax, dword [ebp + 0x31f8]
test eax, eax
je 0x5142c8
push eax
call fcn.0053867f
add esp, 4
cmp dword [ebp - 0x34], 0
jne 0x5142f8
push 0x35f
call fcn.004b7300
push 0x35e
mov esi, eax
call fcn.004b7300
push 0x30
push esi
push eax
push dword [0x5933dc]
call fcn.004feae0
jmp 0x51479f
push 0
push 0x800
lea eax, [ebp + 0x8254]
push eax
push str.Rar_VR
call fcn.004fd650
test al, al
je 0x51479f
push 0x800
lea eax, [ebp + 0x5254]
push eax
call fcn.004fe630
xor edi, edi
xor bh, bh
cmp dword [ebp - 0x34], edi
jbe 0x5144aa
jmp 0x514340
cmp byte [0x5943f6], 0
jne 0x5144aa
lea eax, [ebp + 0x8254]
push eax
call fcn.004ff060
push 0x800
push edi
lea eax, [ebp + 0x2100]
push eax
lea ecx, [ebp - 0x38]
call fcn.00459e70
push eax
call fcn.004a3770
push eax
lea eax, [ebp + 0x6254]
push eax
call fcn.004bdae0
push 0
push 0
lea eax, [ebp + 0x6254]
push eax
call fcn.00491b40
test eax, eax
je 0x5143e0
push 1
lea eax, [ebp + 0x6254]
push eax
call fcn.004a34a0
push 0
push 0
lea eax, [ebp + 0x6254]
push eax
call fcn.00491b40
test eax, eax
je 0x5143e0
lea eax, [ebp + 0x6254]
push eax
push 0x1f7
call fcn.004b7300
push eax
call fcn.005037c0
add esp, 8
mov ecx, 0x5d381c
call fcn.004885d0
jmp 0x514497
lea eax, [ebp + 0x6254]
push eax
call fcn.004ff060
push 1
call fcn.004f8320
push 0x800
push 0x5b332a
push edi
lea eax, [ebp + 0x2100]
push eax
lea ecx, [ebp - 0x38]
call fcn.00459e70
push eax
call fcn.004a18e0
cmp byte [0x5943f4], 0
jne 0x51442f
push 0
push 0
push 0x5b332a
mov ecx, 0x5c3bd0
call fcn.0040ab00
cmp byte [0x5c3f2c], 0
jne 0x514441
cmp byte [0x5c3e7b], 0
je 0x514443
mov bh, 1
mov eax, dword [0x5c3bd4]
mov ecx, 0x5b4440
mov dword [0x5ae2c8], eax
call fcn.004bddc0
mov ecx, 0x5b432c
call fcn.004bddc0
push 0x5588cc
mov ecx, 0x5b432c
call fcn.004bdbd0
call fcn.00504050
push 1
push 0
mov ecx, 0x5c3bd0
mov esi, eax
call fcn.00409480
call fcn.00504050
cmp esi, eax
jne 0x5144a3
cmp byte [0x5943f7], 0
jne 0x5144aa
inc edi
cmp edi, dword [ebp - 0x34]
jb 0x514340
jmp 0x5144aa
mov byte [0x5943f7], 1
xor bl, bl
cmp byte [0x5943f7], bl
jne 0x51470d
push 0
push 0
push 0x5b332a
push 0xb
call fcn.00500d00
mov bl, al
lea eax, [ebp]
push eax
push 0x568e54
call fcn.004ff3f0
add esp, 8
push 0x543
call fcn.004b7300
push eax
call fcn.004ff3f0
add esp, 4
lea eax, [ebp + 0x8254]
push eax
call fcn.004ff060
lea eax, [ebp + 0x8254]
push eax
push 0x880
lea eax, [ebp + 0x1000]
push eax
call fcn.0050e030
push 0x2000
push 0x2b4
lea eax, [ebp + 0x6fa0]
push eax
push 0
lea eax, [ebp]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov ecx, eax
shr ecx, 0x10
test ecx, ecx
jne 0x514680
movzx eax, ax
mov ecx, 0x5a4d
cmp ax, cx
je 0x514557
mov ecx, 0x4550
cmp ax, cx
jne 0x514680
push 0x800
lea eax, [ebp + 0x8254]
push eax
lea eax, [ebp + 0x7254]
push eax
call fcn.004bdae0
push 0x800
lea eax, [ebp + 0x7254]
push eax
call fcn.004a1860
lea esi, [ebp + 0x7254]
lea ecx, [esi + 2]
lea esp, [esp]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x514590
sub esi, ecx
sar esi, 1
call fcn.00538625
push eax
mov eax, 0x800
sub eax, esi
push str.Rar_Scan_d.bat
push eax
lea eax, [ebp + 0x7254]
lea eax, [eax + esi*2]
push eax
call fcn.00404ce0
add esp, 0x10
lea eax, [ebp + 0x7254]
push 0x558d34
push eax
call fcn.004928f0
mov esi, eax
test esi, esi
je 0x514680
cmp word [ebp], 0x22
je 0x5145f4
push 0x800
lea eax, [ebp]
push eax
call fcn.004d8b80
lea eax, [ebp + 0x1000]
push eax
lea eax, [ebp]
push eax
push str.__s__s_r_n_echo._r_n_pause
lea eax, [ebp + 0x3254]
push 0x1000
push eax
call fcn.00404ce0
add esp, 0x14
lea eax, [ebp + 0x21f8]
push 0x1000
push eax
lea eax, [ebp + 0x3254]
push eax
call fcn.004c1790
lea ecx, [ebp + 0x21f8]
mov byte [ebp + 0x31f7], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x514640
push esi
sub ecx, edx
lea eax, [ebp + 0x21f8]
push ecx
push 1
push eax
call fcn.00539653
push esi
call fcn.005391cd
add esp, 0x14
lea eax, [ebp + 0x7254]
push 0x800
push eax
lea eax, [ebp]
push eax
call fcn.004bdae0
xor eax, eax
mov word [ebp + 0x1000], ax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp + 0x1000]
push eax
lea eax, [ebp + 0x8254]
push eax
lea eax, [ebp]
push eax
push 0
call fcn.0051b9c0
test al, al
je 0x5146f6
push 0xc8
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x5146eb
lea ebx, [ebx]
cmp byte [0x5943f6], 0
jne 0x5146eb
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00463b70
push 0xc8
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x5146c0
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x51470d
lea eax, [ebp]
push eax
push 0x201
call fcn.004b7300
push eax
call fcn.005037c0
add esp, 8
lea eax, [ebp + 0x5254]
push eax
call fcn.004ff060
test bh, bh
je 0x51478a
push 0x800
lea eax, [ebp + 0x8254]
push eax
lea eax, [ebp + 0x7254]
push eax
call fcn.004bdae0
lea eax, [ebp + 0x7254]
push eax
call fcn.004a3770
mov ecx, 0x62
mov word [eax + 0xc], cx
lea eax, [ebp + 0x7254]
push eax
call fcn.00491350
test al, al
jne 0x51478a
lea eax, [ebp + 0x7254]
push eax
lea eax, [ebp + 0x8254]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x51478a
push 0x800
lea eax, [ebp + 0x7254]
push eax
lea eax, [ebp + 0x8254]
push eax
call fcn.004bdae0
lea eax, [ebp + 0x8254]
push eax
call fcn.004fc940
test bl, bl
je 0x51479f
call fcn.005015c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.00459e00
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x9254]
xor ecx, ebp
call fcn.00530218
lea esp, [ebp + 0x9258]
pop ebp
ret