Function at 0x47d920
Capabilities:
Delete file
Get common file path
Write file on windows

Disassembly:
sub esp, 0xcf4
mov eax, dword [0x4c0390]
xor eax, esp
mov dword [esp + 0xcf0], eax
push ebx
xor ebx, ebx
push esi
push edi
cmp byte [esp + 0xd0c], bl
je 0x47d95a
cmp byte [0x4e42b0], bl
je 0x47d9c3
cmp dword [0x4f66d0], ebx
je 0x47d9c3
mov byte [0x4e42b0], bl
jmp 0x47d9c3
push 1
call fcn.0047b410
mov al, byte [esp + 0xd08]
mov dword [0x4e576c], 3
cmp al, bl
je 0x47d97b
mov byte [0x4e57a3], al
mov dword [0x4dbcb0], ebx
mov dword [0x4dbcb4], ebx
cmp dword [0x4dbc5c], ebx
jne 0x47db11
mov eax, dword [0x4e818c]
push 1
push eax
mov ecx, 0x4dfee0
call fcn.0043ee00
cmp byte [0x4e0afe], bl
je 0x47d9c3
mov ecx, dword [0x4e818c]
cmp dword [ecx + 0x30], 1
jbe 0x47d9c3
mov dword [0x4e5768], 5
cmp dword [0x4dbc5c], ebx
jne 0x47db11
cmp byte [0x4e758c], bl
jne 0x47db11
mov esi, 0x4e798c
mov edi, 0x4e758c
mov byte [esp + 0xd04], bl
call fcn.00479420
push ebx
push edi
call fcn.0044e6c0
push 0x400
push 0x4b1914
lea edx, [esp + 0x104]
push edx
push str.DefFolder
push str.Compression
call fcn.00456900
cmp byte [esp + 0xfc], bl
jne 0x47da4e
cmp byte [0x4e0afe], bl
je 0x47daef
lea eax, [esp + 0xfc]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
cmp byte [esp + 0xfc], bl
je 0x47daef
lea ecx, [esp + 0xfc]
push ecx
call fcn.0044dfb0
push 0x1000000
lea edx, [esp + 0x500]
push edx
lea eax, [esp + 0x104]
push eax
call fcn.0046d7e0
mov eax, 0x4e758c
mov edx, eax
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x47da80
lea edi, [esp + 0xfc]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x47da91
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor eax, eax
jmp 0x47dab0
mov cl, byte [esp + eax + 0xfc]
mov byte [eax + 0x4e758c], cl
inc eax
cmp cl, bl
jne 0x47dab0
cmp word [0x4e798c], bx
je 0x47daef
push 0x4e798c
lea ecx, [esp + 0x500]
push ecx
call fcn.0046db40
lea edx, [esp + 0x4fc]
push edx
push 0x4e798c
call fcn.0046dae0
cmp byte [0x4e32b0], bl
mov eax, dword [0x4e613c]
setne cl
push eax
movzx edx, cl
push edx
push 0x4e798c
push 0x4e758c
call fcn.004795c0
cmp dword [0x4e5768], ebx
jne 0x47db23
mov dword [0x4e5768], 4
cmp dword [0x4dbc5c], ebx
je 0x47dc19
mov esi, dword [0x4e0e10]
cmp esi, ebx
je 0x47db64
cmp esi, 1
je 0x47db64
push 0x30
push 0x65
call fcn.0045bde0
push eax
push 0x1fd
call fcn.0045bde0
push eax
mov eax, dword [0x4dc1c8]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x47de46
push 0x4e798c
push 0x4e758c
mov ecx, 0x4e0c08
call fcn.00413690
push 0x4e4ab8
push 0x4e46b8
mov ecx, 0x4e0c08
call fcn.00413650
cmp byte [0x4e46b8], bl
je 0x47db9e
push 0x4e46b8
call fcn.0044dfb0
cmp word [0x4e4ab8], bx
je 0x47dbca
push 0x4e4ab8
call fcn.004652a0
test al, al
je 0x47dbc0
xor ecx, ecx
mov word [0x4e4ab8], cx
jmp 0x47dbca
push 0x4e4ab8
call fcn.0044d970
lea edx, [esp + 0xc]
push edx
mov ecx, 0x4e0c08
mov byte [0x4e57a7], bl
call fcn.004136e0
mov eax, dword [esp + 0x1c]
mov dword [0x4e613c], eax
cmp esi, ebx
jne 0x47dbf2
cmp dword [esp + 0x64], ebx
je 0x47dbff
mov ecx, dword [esp + 0x90]
mov dword [0x4e5758], ecx
cmp dword [esp + 0x7c], ebx
je 0x47dc13
mov edx, 0x2a
mov word [0x4e32b0], dx
jmp 0x47dc19
mov byte [0x4e32b0], bl
mov eax, dword [0x4dc1c8]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov ecx, dword [esp + 0xd04]
neg eax
sbb eax, eax
and eax, dword [0x4dc1c8]
push ebx
push ecx
push eax
call fcn.0047d610
test al, al
je 0x47de27
mov eax, dword [0x4f66d8]
cmp eax, 1
je 0x47dc55
cmp eax, 2
jne 0x47dca8
mov edx, dword [0x4f66e4]
mov eax, dword [0x4f66e0]
mov ecx, dword [0x4f66dc]
push edx
push eax
push ecx
lea edx, [esp + 0xb8]
push str._dd_dh_dm
push edx
call fcn.0049deb5
add esp, 0x14
cmp dword [0x4f66d8], 1
jne 0x47dc96
lea eax, [esp + 0xac]
push eax
mov ecx, 0x4e57fc
jmp 0x47dca3
lea ecx, [esp + 0xac]
push ecx
mov ecx, 0x4e5820
call fcn.004683a0
mov edi, dword [0x4f66d0]
cmp edi, ebx
je 0x47dcee
push 0x4e42b0
push str.Rar_CMXXXXXX
call fcn.0047efc0
mov esi, eax
cmp esi, ebx
je 0x47dd0b
mov eax, edi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x47dcd0
push esi
sub eax, edx
push eax
push 1
push edi
call fcn.0049f602
push esi
call fcn.0049f426
add esp, 0x14
jmp 0x47dd0b
cmp dword [0x4dbc5c], ebx
je 0x47dd0b
cmp dword [esp + 0x7c], ebx
je 0x47dd0b
cmp byte [0x4e32b0], 0x2a
jne 0x47dd0b
mov byte [0x4e32b0], bl
mov edx, dword [0x4e818c]
cmp dword [edx + 0x30], ebx
jne 0x47dd3c
push 0x30
push 0x65
call fcn.0045bde0
push eax
push 0x14b
call fcn.0045bde0
push eax
mov eax, dword [0x4dc1c8]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x47de27
cmp byte [0x4e52b8], bl
setne cl
mov byte [0x4dc1fc], cl
mov ecx, 0x4dc1d0
call fcn.00464f70
cmp byte [0x4f66ea], bl
je 0x47dd64
call fcn.0047cde0
jmp 0x47dd76
movzx edx, byte [0x4e6942]
push edx
mov ecx, 0x4e0c08
call fcn.004154f0
cmp dword [0x4f66d0], ebx
je 0x47dd89
push 0x4e42b0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [0x4dbc60], 1
je 0x47de27
cmp dword [0x4dbc5c], ebx
je 0x47ddaa
mov ecx, 0x4dfee0
call fcn.00442500
jmp 0x47de27
cmp byte [0x4e57a3], bl
je 0x47ddbc
mov ecx, 0x4dfeb8
call fcn.0046b3a0
lea eax, [esp + 0xfc]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [esp + 0xfc]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x47dde0
sub eax, edx
push eax
push 0x4e758c
lea ecx, [esp + 0x104]
push ecx
call fcn.00465050
push 0x4e798c
test eax, eax
jne 0x47de18
call fcn.0044dbb0
push eax
push 0x4e758c
call fcn.0044db30
push eax
jmp 0x47de1d
push 0x4e758c
mov ecx, 0x4dfee0
call fcn.00440fc0
mov edx, dword [0x4f66d0]
push edx
call fcn.0049e845
add esp, 4
mov ecx, 0x4dc1d0
mov byte [0x4dc1fc], bl
call fcn.00464f70
mov ecx, dword [esp + 0xcfc]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0049dea6
add esp, 0xcf4
ret 0xc