Function at 0x495040
Capabilities:
Get file system object information
Parse pe header
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4b6ad6
mov eax, dword fs:[0]
push eax
mov eax, 0x5d34
call fcn.004a4220
mov eax, dword [0x4ca3b0]
xor eax, esp
mov dword [esp + 0x5d30], eax
push ebx
push esi
push edi
mov eax, dword [0x4ca3b0]
xor eax, esp
push eax
lea eax, [esp + 0x5d44]
mov dword fs:[0], eax
mov ecx, dword [0x4e8cd4]
mov edx, dword [0x4d56b0]
lea eax, [esp + 0x18c]
push eax
push 0x491640
push ecx
push str.VIRSCAN
push edx
call dword [sym.imp.USER32.dll_DialogBoxParamW]
test eax, eax
je 0x4955f3
lea ecx, [esp + 0x18]
call fcn.0043ed70
mov dword [esp + 0x5d4c], 0
cmp byte [0x4e7b89], 0
je 0x4950fc
push 0x400
lea eax, [esp + 0x1544]
push eax
mov ecx, 0x4eeda0
call fcn.00413010
lea ecx, [esp + 0x1540]
push ecx
lea ecx, [esp + 0x1c]
call fcn.0043eac0
lea ecx, [esp + 0x18]
call fcn.0043ebf0
jmp 0x495172
lea ecx, [esp + 0xe4]
call fcn.0046a510
mov byte [esp + 0x5d4c], 1
push 0
lea edx, [esp + 0xe8]
push edx
mov ecx, 0x4ee478
call fcn.00440200
push 0
push 1
push 0
push 1
push 0
lea eax, [esp + 0x2c]
push eax
push 3
lea ecx, [esp + 0x100]
push ecx
call fcn.00462cf0
test al, al
jne 0x49515e
mov byte [esp + 0x5d4c], al
lea ecx, [esp + 0xe4]
call fcn.00401a50
jmp 0x4955df
mov byte [esp + 0x5d4c], 0
lea ecx, [esp + 0xe4]
call fcn.00401a50
lea edx, [esp + 0x1d40]
push edx
push str.Rar_VRXXXXXX
call fcn.004847c0
test al, al
je 0x4955df
push 0x400
lea eax, [esp + 0x3544]
push eax
call fcn.00484e80
xor edi, edi
cmp dword [esp + 0xcc], edi
jbe 0x49531f
lea ecx, [ecx]
cmp byte [0x4e8c4c], 0
jne 0x49531f
lea ecx, [esp + 0x1d40]
push ecx
call fcn.00484e60
push edi
lea edx, [esp + 0x2544]
push edx
lea ecx, [esp + 0x20]
call fcn.0043eb40
push eax
call fcn.004513d0
lea edx, [esp + 0x1540]
lea esp, [esp]
movzx ecx, word [eax]
mov word [edx], cx
add eax, 2
add edx, 2
test cx, cx
jne 0x4951f0
push 0
push 0
lea eax, [esp + 0x1548]
push eax
push 0
call fcn.00431ac0
test eax, eax
je 0x495268
push 1
lea ecx, [esp + 0x1544]
push ecx
call fcn.00450ec0
push 0
push 0
lea edx, [esp + 0x1548]
push edx
push 0
call fcn.00431ac0
test eax, eax
je 0x495268
lea eax, [esp + 0x1540]
push eax
push 0x1f7
call fcn.00460760
push eax
call fcn.00492420
add esp, 8
mov ecx, 0x4d56b4
call fcn.00428c40
jmp 0x495308
lea ecx, [esp + 0x1540]
push ecx
call fcn.00484e60
call fcn.00480b00
push 0x4f7014
push edi
lea edx, [esp + 0x2548]
push edx
lea ecx, [esp + 0x24]
call fcn.0043eb40
push eax
call fcn.00451090
cmp byte [0x4e7b89], 0
jne 0x4952b3
push 0
push 1
push 0x4f7014
mov ecx, 0x4eeda0
call fcn.00414630
mov eax, dword [0x4eefa8]
mov ecx, dword [0x4f7820]
mov dword [0x4f4fb4], eax
call fcn.0046a1d0
mov ecx, dword [0x4f7814]
call fcn.0046a1d0
mov ecx, dword [0x4f7814]
push 0x4b876c
call fcn.0046a5b0
mov esi, dword [0x5115d0]
push 1
push 0
mov ecx, 0x4eeda0
call fcn.00416120
cmp esi, dword [0x5115d0]
jne 0x495318
cmp byte [0x4e7b88], 0
jne 0x49531f
inc edi
cmp edi, dword [esp + 0xcc]
jb 0x4951b0
jmp 0x49531f
mov byte [0x4e7b88], 1
xor bl, bl
cmp byte [0x4e7b88], bl
jne 0x4955b4
push 0
push 0
push 0x4f7014
push 9
call fcn.004878a0
lea ecx, [esp + 0x18c]
push ecx
mov byte [esp + 0x17], al
call fcn.00485240
push 0x543
call fcn.00460760
push eax
call fcn.00485240
lea edx, [esp + 0x1d40]
push edx
call fcn.00484e60
lea eax, [esp + 0x98c]
push eax
lea ebx, [esp + 0x1d44]
call fcn.0048ba70
push 0x2000
push 0x2b4
lea ecx, [esp + 0x1294]
push ecx
push 0
lea edx, [esp + 0x19c]
push edx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov ecx, eax
shr ecx, 0x10
test ecx, ecx
jne 0x495512
mov edx, 0x5a4d
cmp ax, dx
je 0x4953c6
mov ecx, 0x4550
cmp ax, cx
jne 0x495512
xor eax, eax
jmp 0x4953d0
movzx ecx, word [esp + eax + 0x1d40]
mov word [esp + eax + 0x1540], cx
add eax, 2
test cx, cx
jne 0x4953d0
lea edx, [esp + 0x1540]
push edx
call fcn.00450e70
lea eax, [esp + 0x1540]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x495400
sub eax, edx
sar eax, 1
mov esi, eax
call fcn.004a4d25
push eax
lea eax, [esp + esi*2 + 0x1544]
push str.__rar_scan_d.bat
push eax
mov edx, 0x400
call fcn.00495900
add esp, 0xc
push 0
push 0x4b8d50
lea ecx, [esp + 0x1548]
push ecx
call fcn.00431a80
mov esi, eax
test esi, esi
je 0x495512
cmp word [esp + 0x18c], 0x22
je 0x495467
lea edx, [esp + 0x18c]
push edx
call fcn.004469a0
lea eax, [esp + 0x98c]
push eax
lea ecx, [esp + 0x190]
push ecx
lea edx, [esp + 0x3d48]
push str.__s__s_r_n_echo._r_n_pause
push edx
mov edx, 0x1000
call fcn.00495900
add esp, 0x10
push 0x1000
lea eax, [esp + 0x2544]
push eax
lea ecx, [esp + 0x3d48]
push ecx
call fcn.00472540
lea eax, [esp + 0x2540]
mov byte [esp + 0x353f], 0
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4954c0
sub eax, edx
push esi
push eax
lea edx, [esp + 0x2548]
push 1
push edx
call fcn.004a5c91
push esi
call fcn.004a5ab5
add esp, 0x14
xor eax, eax
jmp 0x4954f0
movzx ecx, word [esp + eax + 0x1540]
mov word [esp + eax + 0x18c], cx
add eax, 2
test cx, cx
jne 0x4954f0
xor eax, eax
mov word [esp + 0x98c], ax
push 0
lea ecx, [esp + 0x18]
push ecx
push 0
lea edx, [esp + 0x998]
push edx
lea eax, [esp + 0x1d50]
push eax
lea ecx, [esp + 0x1a0]
push ecx
push 0
call fcn.0049b7a0
test al, al
jne 0x495559
lea edx, [esp + 0x18c]
push edx
push 0x201
call fcn.00460760
push eax
call fcn.00492420
add esp, 8
mov eax, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xc8
push eax
call esi
cmp eax, 0x102
jne 0x4955a5
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x495580
cmp byte [0x4e8c4c], 0
jne 0x4955a5
push 0x14
call edi
call fcn.004468f0
mov ecx, dword [esp + 0x14]
push 0xc8
push ecx
call esi
cmp eax, 0x102
je 0x495580
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, byte [esp + 0x13]
lea eax, [esp + 0x3540]
push eax
call fcn.00484e60
lea ecx, [esp + 0x1d40]
push ecx
call fcn.00484ba0
test bl, bl
je 0x4955df
mov edx, dword [0x4e7b84]
push edx
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [esp + 0x5d4c], 0xffffffff
lea ecx, [esp + 0x18]
call fcn.004152a0
mov ecx, dword [esp + 0x5d44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x5d30]
xor ecx, esp
call fcn.004a39f3
add esp, 0x5d40
ret