Function at 0x4c26e0
Capabilities:
Get file system object information
Move file
Parse pe header
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4fbec6
mov eax, dword fs:[0]
push eax
mov eax, 0x858c
call fcn.004e3510
mov eax, dword [0x514bc0]
xor eax, esp
mov dword [esp + 0x8588], eax
push ebx
push esi
push edi
mov eax, dword [0x514bc0]
xor eax, esp
push eax
lea eax, [esp + 0x859c]
mov dword fs:[0], eax
mov ecx, dword [0x53a464]
mov edx, dword [0x52c134]
lea eax, [esp + 0x3b0]
push eax
push 0x4be400
push ecx
push str.VIRSCAN
push edx
call dword [sym.imp.USER32.dll_DialogBoxParamW]
test eax, eax
je 0x4c2d4c
lea ecx, [esp + 0x18]
call fcn.0048d400
mov dword [esp + 0x85a4], 0
cmp byte [0x538309], 0
je 0x4c27a1
push 0x800
lea eax, [esp + 0x44b4]
push eax
mov ecx, 0x546dc0
call fcn.004790c0
lea ecx, [esp + 0x44b0]
push ecx
lea ecx, [esp + 0x1c]
call fcn.0048d620
lea ecx, [esp + 0x18]
call fcn.0048d320
mov ebx, 1
jmp 0x4c281a
lea ecx, [esp + 0xa0]
call fcn.00467ad0
mov ebx, 1
mov byte [esp + 0x85a4], bl
push ebx
lea edx, [esp + 0xa4]
push edx
mov ecx, 0x544c98
call fcn.00491520
push 0
push 0
push ebx
push 0
push ebx
push 0
lea eax, [esp + 0x30]
push eax
push 3
lea ecx, [esp + 0xc0]
push ecx
call fcn.0049d1d0
test al, al
jne 0x4c2806
mov byte [esp + 0x85a4], al
lea ecx, [esp + 0xa0]
call fcn.00429e50
jmp 0x4c2d38
mov byte [esp + 0x85a4], 0
lea ecx, [esp + 0xa0]
call fcn.00429e50
push 0
push 0x800
lea edx, [esp + 0x34b8]
push edx
push str.Rar_VR
call fcn.004b1590
test al, al
je 0x4c2d38
push 0x800
lea eax, [esp + 0x759c]
push eax
call fcn.004b1ef0
xor edi, edi
mov byte [esp + 0x12], 0
cmp dword [esp + 0x84], edi
jbe 0x4c29e2
cmp byte [0x5393c9], 0
jne 0x4c29e2
lea ecx, [esp + 0x34b0]
push ecx
call fcn.004b1e90
push edi
lea edx, [esp + 0x44b4]
push edx
lea ecx, [esp + 0x20]
call fcn.0048d4f0
push eax
call fcn.00451a10
lea edx, [esp + 0x24b0]
lea ebx, [ebx]
movzx ecx, word [eax]
mov word [edx], cx
add eax, 2
add edx, 2
test cx, cx
jne 0x4c28a0
push 0
push 0
lea eax, [esp + 0x24b8]
push eax
call fcn.00443ff0
test eax, eax
je 0x4c2913
push ebx
lea ecx, [esp + 0x24b4]
push ecx
call fcn.00451750
push 0
push 0
lea edx, [esp + 0x24b8]
push edx
call fcn.00443ff0
test eax, eax
je 0x4c2913
lea eax, [esp + 0x24b0]
push eax
push 0x1f7
call fcn.00461b20
push eax
call fcn.004bf990
add esp, 8
mov ecx, 0x52c138
call fcn.0043dd70
jmp 0x4c29cb
lea ecx, [esp + 0x24b0]
push ecx
call fcn.004b1e90
push ebx
call fcn.004ad4e0
push 0x800
push 0x555ba2
push edi
lea edx, [esp + 0x44bc]
push edx
lea ecx, [esp + 0x28]
call fcn.0048d4f0
push eax
call fcn.004526f0
cmp byte [0x538309], 0
jne 0x4c2964
push 0
push 0
push 0x555ba2
mov ecx, 0x546dc0
call fcn.0047a6c0
cmp byte [0x54714c], 0
jne 0x4c2976
cmp byte [0x54709b], 0
je 0x4c297a
mov byte [esp + 0x12], bl
mov eax, dword [0x546dc4]
mov ecx, 0x556cb8
mov dword [0x552b50], eax
call fcn.00467910
mov ecx, 0x556ba4
call fcn.00467910
push 0x4fe964
mov ecx, 0x556ba4
call fcn.00467940
mov esi, dword [0x570cb0]
push ebx
push 0
mov ecx, 0x546dc0
call fcn.0047b380
cmp esi, dword [0x570cb0]
jne 0x4c29dc
cmp byte [0x538308], 0
jne 0x4c29e2
add edi, ebx
cmp edi, dword [esp + 0x84]
jb 0x4c2861
jmp 0x4c29e2
mov byte [0x538308], bl
cmp byte [0x538308], 0
mov byte [esp + 0x13], 0
jne 0x4c2c7d
push 0
push 0
push 0x555ba2
push 9
call fcn.004b4e90
lea ecx, [esp + 0x3b0]
push ecx
push 0x4ff698
mov byte [esp + 0x1b], al
call fcn.004b2770
add esp, 8
push 0x543
call fcn.00461b20
push eax
call fcn.004b2770
add esp, 4
lea edx, [esp + 0x34b0]
push edx
call fcn.004b1e90
lea eax, [esp + 0x13b0]
push eax
lea ebx, [esp + 0x34b4]
call fcn.004b8ca0
push 0x2000
push 0x2b4
lea ecx, [esp + 0x104]
push ecx
push 0
lea edx, [esp + 0x3c0]
push edx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov ecx, eax
shr ecx, 0x10
test ecx, ecx
jne 0x4c2bdd
mov edx, 0x5a4d
cmp ax, dx
je 0x4c2a98
mov ecx, 0x4550
cmp ax, cx
jne 0x4c2bdd
xor eax, eax
lea ebx, [ebx]
movzx ecx, word [esp + eax + 0x34b0]
mov word [esp + eax + 0x24b0], cx
add eax, 2
test cx, cx
jne 0x4c2aa0
push 0x800
lea edx, [esp + 0x24b4]
push edx
call fcn.00451500
lea eax, [esp + 0x24b0]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4c2ad4
sub eax, edx
sar eax, 1
mov esi, eax
call fcn.004e6fda
push eax
lea eax, [esp + esi*2 + 0x24b4]
push str.Rar_Scan_d.bat
mov edx, 0x800
sub edx, esi
push eax
call fcn.00458640
add esp, 0xc
push 0x4ffb24
lea ecx, [esp + 0x24b4]
push ecx
call fcn.00443af0
mov esi, eax
test esi, esi
je 0x4c2bdd
cmp word [esp + 0x3b0], 0x22
je 0x4c2b40
push 0x800
lea edx, [esp + 0x3b4]
push edx
call fcn.004a1040
lea eax, [esp + 0x13b0]
push eax
lea ecx, [esp + 0x3b4]
push ecx
lea edx, [esp + 0x55a0]
push str.__s__s_r_n_echo._r_n_pause
push edx
mov edx, 0x1000
call fcn.00458640
add esp, 0x10
push 0x1000
lea eax, [esp + 0x44b4]
push eax
lea ecx, [esp + 0x55a0]
push ecx
call fcn.0046a500
lea eax, [esp + 0x44b0]
mov byte [esp + 0x54af], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4c2b96
sub eax, edx
push esi
push eax
lea edx, [esp + 0x44b8]
push 1
push edx
call fcn.004e8056
push esi
call fcn.004e4b91
add esp, 0x14
push 0x800
lea eax, [esp + 0x24b4]
push eax
lea ecx, [esp + 0x3b8]
push ecx
call fcn.00467570
xor edx, edx
mov word [esp + 0x13b0], dx
push 0
lea eax, [esp + 0x18]
push eax
push 0
lea ecx, [esp + 0x13bc]
push ecx
lea edx, [esp + 0x34c0]
push edx
lea eax, [esp + 0x3c4]
push eax
push 0
call fcn.004c6be0
test al, al
je 0x4c2c62
mov ecx, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xc8
push ecx
call esi
cmp eax, 0x102
jne 0x4c2c55
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4c2c30
cmp byte [0x5393c9], 0
jne 0x4c2c55
push 0x14
call edi
call fcn.00494e60
mov edx, dword [esp + 0x14]
push 0xc8
push edx
call esi
cmp eax, 0x102
je 0x4c2c30
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4c2c7d
lea ecx, [esp + 0x3b0]
push ecx
push 0x201
call fcn.00461b20
push eax
call fcn.004bf990
add esp, 8
lea edx, [esp + 0x7598]
push edx
call fcn.004b1e90
cmp byte [esp + 0x12], 0
je 0x4c2d18
xor eax, eax
jmp 0x4c2ca0
movzx ecx, word [esp + eax + 0x34b0]
mov word [esp + eax + 0x24b0], cx
add eax, 2
test cx, cx
jne 0x4c2ca0
lea eax, [esp + 0x24b0]
push eax
call fcn.00451a10
lea edx, [esp + 0x24b0]
mov ecx, 0x62
push edx
mov word [eax + 0xc], cx
call fcn.00443cc0
test al, al
jne 0x4c2d18
lea eax, [esp + 0x24b0]
push eax
lea ecx, [esp + 0x34b4]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x4c2d18
xor eax, eax
jmp 0x4c2d00
movzx ecx, word [esp + eax + 0x24b0]
mov word [esp + eax + 0x34b0], cx
add eax, 2
test cx, cx
jne 0x4c2d00
lea edx, [esp + 0x34b0]
push edx
call fcn.004b1b20
cmp byte [esp + 0x13], 0
je 0x4c2d38
mov eax, dword [0x538304]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [esp + 0x85a4], 0xffffffff
lea ecx, [esp + 0x18]
call fcn.00479920
mov ecx, dword [esp + 0x859c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x8588]
xor ecx, esp
call fcn.004e34f4
add esp, 0x8598
ret