Function at 0x44c484
Capabilities:
Get common file path
Get file system object information
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 5
add esp, 0xfffff004
push eax
dec eax
jne 0x44c48d
mov eax, dword [ebp - 4]
add esp, 0xfffffb54
push ebx
push esi
push edi
mov edi, 0x4b5fc4
mov eax, 0x4a51dc
call fcn.00494df8
lea edx, [ebp - 0xab0]
push edx
push 0x4412b4
push dword [0x4c1440]
push str.VIRSCAN
push dword [0x4ae754]
call sub.USER32.DLL_DialogBoxParamA
test eax, eax
jne 0x44c4ec
mov ecx, dword [ebp - 0x22c]
mov dword fs:[0], ecx
mov eax, ecx
jmp 0x44ca8d
mov word [ebp - 0x21c], 8
lea eax, [ebp - 0x110]
call fcn.0046b394
add dword [ebp - 0x210], 6
mov word [ebp - 0x21c], 0x14
cmp dword [0x4c3de0], 0
je 0x44c556
lea ecx, [ebp - 0x1ec0]
lea edx, [ebp - 0x16c0]
mov eax, 0x4c219c
call fcn.004623f0
lea ecx, [ebp - 0x1ec0]
lea edx, [ebp - 0x16c0]
lea eax, [ebp - 0x110]
call fcn.0046b664
lea eax, [ebp - 0x110]
call fcn.0046b788
jmp 0x44c627
mov word [ebp - 0x21c], 0x20
lea eax, [ebp - 0x208]
call fcn.0040f5c0
add dword [ebp - 0x210], 4
mov word [ebp - 0x21c], 0x2c
lea edx, [ebp - 0x208]
mov eax, 0x4c1454
xor ecx, ecx
call fcn.00468d04
push 0
push 1
push 0
push 1
lea ecx, [ebp - 0x110]
lea eax, [ebp - 0x208]
mov edx, 2
call fcn.0046f0dc
test al, al
jne 0x44c607
sub dword [ebp - 0x210], 4
lea eax, [ebp - 0x208]
mov edx, 2
call fcn.0040f698
dec dword [ebp - 0x210]
dec dword [ebp - 0x210]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.0043ca88
sub dword [ebp - 0x210], 4
lea eax, [ebp - 0x110]
mov edx, 2
call fcn.0040f698
mov ecx, dword [ebp - 0x22c]
mov dword fs:[0], ecx
jmp 0x44ca8d
sub dword [ebp - 0x210], 4
lea eax, [ebp - 0x208]
mov edx, 2
call fcn.0040f698
mov word [ebp - 0x21c], 0x14
lea edx, [ebp - 0x22c0]
mov eax, str.Rar_VRXXXXXX
call fcn.0046e4b4
test al, al
jne 0x44c67d
dec dword [ebp - 0x210]
dec dword [ebp - 0x210]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.0043ca88
sub dword [ebp - 0x210], 4
lea eax, [ebp - 0x110]
mov edx, 2
call fcn.0040f698
mov ecx, dword [ebp - 0x22c]
mov dword fs:[0], ecx
jmp 0x44ca8d
lea eax, [ebp - 0x26c0]
push eax
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
mov word [ebp - 0x21c], 0x14
xor ebx, ebx
jmp 0x44c824
lea eax, [ebp - 0x22c0]
push eax
call fcn.0049635c
pop ecx
lea ecx, [ebp - 0x36f0]
lea eax, [ebp - 0x110]
mov edx, ebx
call fcn.0046b6bc
lea eax, [ebp - 0x36f0]
call fcn.0040ba30
push eax
lea edx, [ebp - 0x2ac0]
push edx
call fcn.004949c8
add esp, 8
lea eax, [ebp - 0x2ac0]
xor ecx, ecx
xor edx, edx
call fcn.0040a030
test eax, eax
je 0x44c735
lea eax, [ebp - 0x2ac0]
mov dl, 1
call fcn.0040c2e0
lea eax, [ebp - 0x2ac0]
xor ecx, ecx
xor edx, edx
call fcn.0040a030
test eax, eax
je 0x44c735
lea eax, [ebp - 0x2ac0]
push eax
mov eax, 0x1f7
call fcn.00411fe8
push eax
call fcn.0044e1d4
add esp, 8
mov eax, 0x4ae120
call fcn.0042cf6c
jmp 0x44c823
lea edx, [ebp - 0x2ac0]
push edx
call fcn.0049635c
pop ecx
call fcn.00456acc
lea ecx, [ebp - 0x4320]
lea eax, [ebp - 0x110]
mov edx, ebx
call fcn.0046b6bc
lea eax, [ebp - 0x4320]
lea edx, [edi + 0x3ef0]
call fcn.0040a978
lea ecx, [ebp - 0x4f50]
lea eax, [ebp - 0x110]
mov edx, ebx
call fcn.0046b6bc
lea eax, [ebp - 0x4f50]
lea edx, [edi + 0x42f0]
add eax, 0x400
call fcn.0040a9c0
cmp dword [0x4c3de0], 0
jne 0x44c7b7
push 1
push 0
lea ecx, [edi + 0x42f0]
lea edx, [edi + 0x3ef0]
mov eax, 0x4c219c
call fcn.00460e08
mov ecx, dword [0x4c23a4]
mov dword [edi + 0x2aa8], ecx
mov eax, dword [edi + 0x4afc]
call fcn.0040f714
mov eax, dword [edi + 0x4af0]
call fcn.0040f714
mov edx, 0x4a3eb5
mov eax, dword [edi + 0x4af0]
call fcn.0040f744
call fcn.0044e3dc
mov esi, eax
mov word [ebp - 0x21c], 0x14
mov eax, 0x4c219c
mov cl, 1
xor edx, edx
call fcn.0045d418
call fcn.0044e3dc
cmp esi, eax
je 0x44c81a
mov dword [0x4c3df4], 1
cmp dword [0x4c3df4], 0
jne 0x44c836
inc ebx
cmp ebx, dword [ebp - 0xc]
jae 0x44c836
cmp dword [0x4c3df0], 0
je 0x44c69e
xor ebx, ebx
cmp dword [0x4c3df4], 0
jne 0x44ca1a
push 0
lea edx, [edi + 0x3ef0]
xor ecx, ecx
mov eax, 9
call fcn.0047c8e4
mov ebx, eax
lea eax, [ebp - 0xab0]
call fcn.0047e5d0
mov eax, 0x543
call fcn.00411fe8
call fcn.0047e5d0
lea edx, [ebp - 0x22c0]
push edx
call fcn.0049635c
pop ecx
lea edx, [ebp - 0x22c0]
lea eax, [ebp - 0x6b0]
call fcn.00441c67
push 0x2000
lea ecx, [ebp - 0x50b0]
push 0x160
push ecx
lea eax, [ebp - 0xab0]
push 0
push eax
call sub.SHELL32.DLL_SHGetFileInfoA
mov ecx, eax
shr ecx, 0x10
test cx, cx
jne 0x44c8d1
mov edx, eax
and dx, 0xffff
cmp dx, 0x5a4d
je 0x44c8d5
cmp dx, 0x4550
je 0x44c8d5
xor eax, eax
jmp 0x44c8da
mov eax, 1
test al, al
je 0x44c99e
lea edx, [ebp - 0x22c0]
push edx
lea ecx, [ebp - 0x54b0]
push ecx
call fcn.004949c8
add esp, 8
lea eax, [ebp - 0x54b0]
call fcn.0040bf34
call fcn.0049cdec
push eax
push str.__rar_scan_d.bat
lea edx, [ebp - 0x54b0]
push edx
call fcn.004949f8
pop ecx
lea ecx, [ebp - 0x54b0]
add eax, ecx
push eax
call fcn.00497928
add esp, 0xc
push 0x4a3eed
lea eax, [ebp - 0x54b0]
push eax
call fcn.00496900
add esp, 8
mov esi, eax
test esi, esi
je 0x44c99e
xor eax, eax
mov al, byte [ebp - 0xab0]
cmp eax, 0x22
je 0x44c95e
lea eax, [ebp - 0xab0]
call fcn.004483cc
lea edx, [ebp - 0x6b0]
push edx
lea ecx, [ebp - 0xab0]
push ecx
push str.__s__s_r_n_echo._r_n_pause
push esi
call fcn.00496934
add esp, 0x10
push esi
call fcn.00496404
pop ecx
lea eax, [ebp - 0x54b0]
push eax
lea edx, [ebp - 0xab0]
push edx
call fcn.004949c8
add esp, 8
mov byte [ebp - 0x6b0], 0
lea ecx, [ebp - 0x6b0]
lea eax, [ebp - 0x230]
push ecx
push 0
push eax
lea eax, [ebp - 0xab0]
push 0
lea ecx, [ebp - 0x22c0]
xor edx, edx
call fcn.00474648
test al, al
jne 0x44c9ef
lea ecx, [ebp - 0xab0]
mov eax, 0x201
push ecx
call fcn.00411fe8
push eax
call fcn.0044e1d4
add esp, 8
jmp 0x44c9ef
push 0x14
call sub.KERNEL32.DLL_Sleep
call fcn.004481c8
push 0xc8
push dword [ebp - 0x230]
call sub.KERNEL32.DLL_WaitForSingleObject
cmp eax, 0x102
jne 0x44ca0f
cmp dword [0x4c3df0], 0
je 0x44c9e3
push dword [ebp - 0x230]
call sub.KERNEL32.DLL_CloseHandle
lea edx, [ebp - 0x26c0]
push edx
call fcn.0049635c
pop ecx
lea eax, [ebp - 0x22c0]
call fcn.0046e6d4
test al, al
je 0x44ca41
lea eax, [ebp - 0x22c0]
call fcn.0046deb4
test bl, bl
je 0x44ca50
push dword [0x4c144c]
call sub.USER32.DLL_DestroyWindow
dec dword [ebp - 0x210]
dec dword [ebp - 0x210]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.0043ca88
sub dword [ebp - 0x210], 4
lea eax, [ebp - 0x110]
mov edx, 2
call fcn.0040f698
mov ecx, dword [ebp - 0x22c]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret