Function at 0x4b06f0
Capabilities:
Get file system object information
Move file
Parse pe header
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4d6d66
mov eax, dword fs:[0]
push eax
mov eax, 0x84f4
call fcn.004c1c40
mov eax, dword [0x4ec0b4]
xor eax, esp
mov dword [esp + 0x84f0], eax
push ebx
push esi
push edi
mov eax, dword [0x4ec0b4]
xor eax, esp
push eax
lea eax, [esp + 0x8504]
mov dword fs:[0], eax
mov ecx, dword [0x535cac]
mov edx, dword [0x51ff0c]
lea eax, [esp + 0x3b0]
push eax
push 0x4aca20
push ecx
push str.VIRSCAN
push edx
call dword [sym.imp.USER32.dll_DialogBoxParamW]
test eax, eax
je 0x4b0d5c
lea ecx, [esp + 0x18]
call fcn.0044bfe0
mov dword [esp + 0x850c], 0
cmp byte [0x533b59], 0
je 0x4b07b1
push 0x800
lea eax, [esp + 0x44b4]
push eax
mov ecx, 0x542618
call fcn.004153c0
lea ecx, [esp + 0x44b0]
push ecx
lea ecx, [esp + 0x1c]
call fcn.0044bd60
lea ecx, [esp + 0x18]
call fcn.0044bf00
mov ebx, 1
jmp 0x4b0828
lea ecx, [esp + 0xa0]
call fcn.00480330
mov ebx, 1
mov byte [esp + 0x850c], bl
push ebx
lea edx, [esp + 0xa4]
push edx
mov ecx, 0x5404f0
call fcn.0044da00
push 0
push ebx
push 0
push ebx
push 0
lea eax, [esp + 0x2c]
push eax
push 3
lea ecx, [esp + 0xbc]
push ecx
call fcn.00478450
test al, al
jne 0x4b0814
mov byte [esp + 0x850c], al
lea ecx, [esp + 0xa0]
call fcn.00401b50
jmp 0x4b0d48
mov byte [esp + 0x850c], 0
lea ecx, [esp + 0xa0]
call fcn.00401b50
push 0
push 0x800
lea edx, [esp + 0x34b8]
push edx
push str.Rar_VR
call fcn.0049fbc0
test al, al
je 0x4b0d48
push 0x800
lea eax, [esp + 0x7504]
push eax
call fcn.004a0610
xor edi, edi
mov byte [esp + 0x12], 0
cmp dword [esp + 0x84], edi
jbe 0x4b09f2
nop
cmp byte [0x535c28], 0
jne 0x4b09f2
lea ecx, [esp + 0x34b0]
push ecx
call fcn.004a05b0
push edi
lea edx, [esp + 0x44b4]
push edx
lea ecx, [esp + 0x20]
call fcn.0044bde0
push eax
call fcn.00460c50
lea edx, [esp + 0x24b0]
lea esp, [esp]
movzx ecx, word [eax]
mov word [edx], cx
add eax, 2
add edx, 2
test cx, cx
jne 0x4b08b0
push 0
push 0
lea eax, [esp + 0x24b8]
push eax
call fcn.0043d970
test eax, eax
je 0x4b0923
push ebx
lea ecx, [esp + 0x24b4]
push ecx
call fcn.00460970
push 0
push 0
lea edx, [esp + 0x24b8]
push edx
call fcn.0043d970
test eax, eax
je 0x4b0923
lea eax, [esp + 0x24b0]
push eax
push 0x1f7
call fcn.00475cc0
push eax
call fcn.004ad8e0
add esp, 8
mov ecx, 0x51ff10
call fcn.00433f70
jmp 0x4b09db
lea ecx, [esp + 0x24b0]
push ecx
call fcn.004a05b0
push ebx
call fcn.0049ba40
push 0x800
push 0x55147a
push edi
lea edx, [esp + 0x44bc]
push edx
lea ecx, [esp + 0x28]
call fcn.0044bde0
push eax
call fcn.00462230
cmp byte [0x533b59], 0
jne 0x4b0974
push 0
push 0
push 0x55147a
mov ecx, 0x542618
call fcn.00418a80
cmp dword [0x542a08], 0
jne 0x4b0986
cmp byte [0x542a12], 0
je 0x4b098a
mov byte [esp + 0x12], bl
mov eax, dword [0x542824]
mov ecx, 0x552590
mov dword [0x54e418], eax
call fcn.00480170
mov ecx, 0x55247c
call fcn.00480170
push 0x4d8800
mov ecx, 0x55247c
call fcn.004801a0
mov esi, dword [0x5765b0]
push ebx
push 0
mov ecx, 0x542618
call fcn.00419e80
cmp esi, dword [0x5765b0]
jne 0x4b09ec
cmp byte [0x533b58], 0
jne 0x4b09f2
add edi, ebx
cmp edi, dword [esp + 0x84]
jb 0x4b0870
jmp 0x4b09f2
mov byte [0x533b58], bl
cmp byte [0x533b58], 0
mov byte [esp + 0x13], 0
jne 0x4b0c8d
push 0
push 0
push 0x55147a
push 9
call fcn.004a30d0
lea ecx, [esp + 0x3b0]
push ecx
push 0x4d8c40
mov byte [esp + 0x1b], al
call fcn.004a09e0
add esp, 8
push 0x543
call fcn.00475cc0
push eax
call fcn.004a09e0
add esp, 4
lea edx, [esp + 0x34b0]
push edx
call fcn.004a05b0
lea eax, [esp + 0x13b0]
push eax
lea ebx, [esp + 0x34b4]
call fcn.004a6ed0
push 0x2000
push 0x2b4
lea ecx, [esp + 0x104]
push ecx
push 0
lea edx, [esp + 0x3c0]
push edx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov ecx, eax
shr ecx, 0x10
test ecx, ecx
jne 0x4b0bed
mov edx, 0x5a4d
cmp ax, dx
je 0x4b0aa8
mov ecx, 0x4550
cmp ax, cx
jne 0x4b0bed
xor eax, eax
lea ebx, [ebx]
movzx ecx, word [esp + eax + 0x34b0]
mov word [esp + eax + 0x24b0], cx
add eax, 2
test cx, cx
jne 0x4b0ab0
push 0x800
lea edx, [esp + 0x24b4]
push edx
call fcn.004607d0
lea eax, [esp + 0x24b0]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4b0ae4
sub eax, edx
sar eax, 1
mov esi, eax
call fcn.004c3655
push eax
lea eax, [esp + esi*2 + 0x24b4]
push str.Rar_Scan_d.bat
mov edx, 0x800
sub edx, esi
push eax
call fcn.00407810
add esp, 0xc
push 0x4d93b4
lea ecx, [esp + 0x24b4]
push ecx
call fcn.0043d170
mov esi, eax
test esi, esi
je 0x4b0bed
cmp word [esp + 0x3b0], 0x22
je 0x4b0b50
push 0x800
lea edx, [esp + 0x3b4]
push edx
call fcn.00480060
lea eax, [esp + 0x13b0]
push eax
lea ecx, [esp + 0x3b4]
push ecx
lea edx, [esp + 0x5508]
push str.__s__s_r_n_echo._r_n_pause
push edx
mov edx, 0x1000
call fcn.00407810
add esp, 0x10
push 0x1000
lea eax, [esp + 0x44b4]
push eax
lea ecx, [esp + 0x5508]
push ecx
call fcn.00487240
lea eax, [esp + 0x44b0]
mov byte [esp + 0x54af], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4b0ba6
sub eax, edx
push esi
push eax
lea edx, [esp + 0x44b8]
push 1
push edx
call fcn.004c4800
push esi
call fcn.004c4622
add esp, 0x14
push 0x800
lea eax, [esp + 0x24b4]
push eax
lea ecx, [esp + 0x3b8]
push ecx
call fcn.0047fbe0
xor edx, edx
mov word [esp + 0x13b0], dx
push 0
lea eax, [esp + 0x18]
push eax
push 0
lea ecx, [esp + 0x13bc]
push ecx
lea edx, [esp + 0x34c0]
push edx
lea eax, [esp + 0x3c4]
push eax
push 0
call fcn.004b4b80
test al, al
je 0x4b0c72
mov ecx, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xc8
push ecx
call esi
cmp eax, 0x102
jne 0x4b0c65
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4b0c40
cmp byte [0x535c28], 0
jne 0x4b0c65
push 0x14
call edi
call fcn.00453df0
mov edx, dword [esp + 0x14]
push 0xc8
push edx
call esi
cmp eax, 0x102
je 0x4b0c40
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4b0c8d
lea ecx, [esp + 0x3b0]
push ecx
push 0x201
call fcn.00475cc0
push eax
call fcn.004ad8e0
add esp, 8
lea edx, [esp + 0x7500]
push edx
call fcn.004a05b0
cmp byte [esp + 0x12], 0
je 0x4b0d28
xor eax, eax
jmp 0x4b0cb0
movzx ecx, word [esp + eax + 0x34b0]
mov word [esp + eax + 0x24b0], cx
add eax, 2
test cx, cx
jne 0x4b0cb0
lea eax, [esp + 0x24b0]
push eax
call fcn.00460c50
lea edx, [esp + 0x24b0]
mov ecx, 0x62
push edx
mov word [eax + 0xc], cx
call fcn.0043d340
test al, al
jne 0x4b0d28
lea eax, [esp + 0x24b0]
push eax
lea ecx, [esp + 0x34b4]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x4b0d28
xor eax, eax
jmp 0x4b0d10
movzx ecx, word [esp + eax + 0x24b0]
mov word [esp + eax + 0x34b0], cx
add eax, 2
test cx, cx
jne 0x4b0d10
lea edx, [esp + 0x34b0]
push edx
call fcn.004a0240
cmp byte [esp + 0x13], 0
je 0x4b0d48
mov eax, dword [0x533b54]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [esp + 0x850c], 0xffffffff
lea ecx, [esp + 0x18]
call fcn.00417bc0
mov ecx, dword [esp + 0x8504]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x84f0]
xor ecx, esp
call fcn.004c1c22
add esp, 0x8500
ret