Function at 0x4961a0
Capabilities:
Get file system object information
Parse pe header
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4b8b86
mov eax, dword fs:[0]
push eax
mov eax, 0x5d34
call fcn.004a53e0
mov eax, dword [0x4cc3b0]
xor eax, esp
mov dword [esp + 0x5d30], eax
push ebx
push esi
push edi
mov eax, dword [0x4cc3b0]
xor eax, esp
push eax
lea eax, [esp + 0x5d44]
mov dword fs:[0], eax
mov ecx, dword [0x4eacd4]
mov edx, dword [0x4d76b0]
lea eax, [esp + 0x18c]
push eax
push 0x492720
push ecx
push str.VIRSCAN
push edx
call dword [sym.imp.USER32.dll_DialogBoxParamW]
test eax, eax
je 0x496753
lea ecx, [esp + 0x18]
call fcn.0043f3e0
mov dword [esp + 0x5d4c], 0
cmp byte [0x4e9b89], 0
je 0x49625c
push 0x400
lea eax, [esp + 0x1544]
push eax
mov ecx, 0x4f0dd0
call fcn.004130a0
lea ecx, [esp + 0x1540]
push ecx
lea ecx, [esp + 0x1c]
call fcn.0043f130
lea ecx, [esp + 0x18]
call fcn.0043f260
jmp 0x4962d2
lea ecx, [esp + 0xe4]
call fcn.0046b190
mov byte [esp + 0x5d4c], 1
push 0
lea edx, [esp + 0xe8]
push edx
mov ecx, 0x4f04a8
call fcn.00440870
push 0
push 1
push 0
push 1
push 0
lea eax, [esp + 0x2c]
push eax
push 3
lea ecx, [esp + 0x100]
push ecx
call fcn.00463880
test al, al
jne 0x4962be
mov byte [esp + 0x5d4c], al
lea ecx, [esp + 0xe4]
call fcn.00401af0
jmp 0x49673f
mov byte [esp + 0x5d4c], 0
lea ecx, [esp + 0xe4]
call fcn.00401af0
lea edx, [esp + 0x1d40]
push edx
push str.Rar_VRXXXXXX
call fcn.004856a0
test al, al
je 0x49673f
push 0x400
lea eax, [esp + 0x3544]
push eax
call fcn.00485da0
xor edi, edi
cmp dword [esp + 0xcc], edi
jbe 0x49647f
lea ecx, [ecx]
cmp byte [0x4eac4c], 0
jne 0x49647f
lea ecx, [esp + 0x1d40]
push ecx
call fcn.00485d80
push edi
lea edx, [esp + 0x2544]
push edx
lea ecx, [esp + 0x20]
call fcn.0043f1b0
push eax
call fcn.00451bd0
lea edx, [esp + 0x1540]
lea esp, [esp]
movzx ecx, word [eax]
mov word [edx], cx
add eax, 2
add edx, 2
test cx, cx
jne 0x496350
push 0
push 0
lea eax, [esp + 0x1548]
push eax
push 0
call fcn.00432050
test eax, eax
je 0x4963c8
push 1
lea ecx, [esp + 0x1544]
push ecx
call fcn.004516c0
push 0
push 0
lea edx, [esp + 0x1548]
push edx
push 0
call fcn.00432050
test eax, eax
je 0x4963c8
lea eax, [esp + 0x1540]
push eax
push 0x1f7
call fcn.004612e0
push eax
call fcn.00493500
add esp, 8
mov ecx, 0x4d76b4
call fcn.00428fc0
jmp 0x496468
lea ecx, [esp + 0x1540]
push ecx
call fcn.00485d80
call fcn.00481960
push 0x4f907c
push edi
lea edx, [esp + 0x2548]
push edx
lea ecx, [esp + 0x24]
call fcn.0043f1b0
push eax
call fcn.00451890
cmp byte [0x4e9b89], 0
jne 0x496413
push 0
push 1
push 0x4f907c
mov ecx, 0x4f0dd0
call fcn.004162e0
mov eax, dword [0x4f0fdc]
mov ecx, dword [0x4f9888]
mov dword [0x4f701c], eax
call fcn.0046ae50
mov ecx, dword [0x4f987c]
call fcn.0046ae50
mov ecx, dword [0x4f987c]
push 0x4ba77c
call fcn.0046b230
mov esi, dword [0x512a68]
push 1
push 0
mov ecx, 0x4f0dd0
call fcn.00417a70
cmp esi, dword [0x512a68]
jne 0x496478
cmp byte [0x4e9b88], 0
jne 0x49647f
inc edi
cmp edi, dword [esp + 0xcc]
jb 0x496310
jmp 0x49647f
mov byte [0x4e9b88], 1
xor bl, bl
cmp byte [0x4e9b88], bl
jne 0x496714
push 0
push 0
push 0x4f907c
push 9
call fcn.00488860
lea ecx, [esp + 0x18c]
push ecx
mov byte [esp + 0x17], al
call fcn.004861b0
push 0x543
call fcn.004612e0
push eax
call fcn.004861b0
lea edx, [esp + 0x1d40]
push edx
call fcn.00485d80
lea eax, [esp + 0x98c]
push eax
lea ebx, [esp + 0x1d44]
call fcn.0048cab0
push 0x2000
push 0x2b4
lea ecx, [esp + 0x1294]
push ecx
push 0
lea edx, [esp + 0x19c]
push edx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov ecx, eax
shr ecx, 0x10
test ecx, ecx
jne 0x496672
mov edx, 0x5a4d
cmp ax, dx
je 0x496526
mov ecx, 0x4550
cmp ax, cx
jne 0x496672
xor eax, eax
jmp 0x496530
movzx ecx, word [esp + eax + 0x1d40]
mov word [esp + eax + 0x1540], cx
add eax, 2
test cx, cx
jne 0x496530
lea edx, [esp + 0x1540]
push edx
call fcn.00451670
lea eax, [esp + 0x1540]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x496560
sub eax, edx
sar eax, 1
mov esi, eax
call fcn.004a5ee5
push eax
lea eax, [esp + esi*2 + 0x1544]
push str.__rar_scan_d.bat
push eax
mov edx, 0x400
call fcn.0049c880
add esp, 0xc
push 0
push 0x4bae08
lea ecx, [esp + 0x1548]
push ecx
call fcn.00432010
mov esi, eax
test esi, esi
je 0x496672
cmp word [esp + 0x18c], 0x22
je 0x4965c7
lea edx, [esp + 0x18c]
push edx
call fcn.00447140
lea eax, [esp + 0x98c]
push eax
lea ecx, [esp + 0x190]
push ecx
lea edx, [esp + 0x3d48]
push str.__s__s_r_n_echo._r_n_pause
push edx
mov edx, 0x1000
call fcn.0049c880
add esp, 0x10
push 0x1000
lea eax, [esp + 0x2544]
push eax
lea ecx, [esp + 0x3d48]
push ecx
call fcn.00473250
lea eax, [esp + 0x2540]
mov byte [esp + 0x353f], 0
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x496620
sub eax, edx
push esi
push eax
lea edx, [esp + 0x2548]
push 1
push edx
call fcn.004a6ea4
push esi
call fcn.004a6c75
add esp, 0x14
xor eax, eax
jmp 0x496650
movzx ecx, word [esp + eax + 0x1540]
mov word [esp + eax + 0x18c], cx
add eax, 2
test cx, cx
jne 0x496650
xor eax, eax
mov word [esp + 0x98c], ax
push 0
lea ecx, [esp + 0x18]
push ecx
push 0
lea edx, [esp + 0x998]
push edx
lea eax, [esp + 0x1d50]
push eax
lea ecx, [esp + 0x1a0]
push ecx
push 0
call fcn.0049c8a0
test al, al
jne 0x4966b9
lea edx, [esp + 0x18c]
push edx
push 0x201
call fcn.004612e0
push eax
call fcn.00493500
add esp, 8
mov eax, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xc8
push eax
call esi
cmp eax, 0x102
jne 0x496705
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4966e0
cmp byte [0x4eac4c], 0
jne 0x496705
push 0x14
call edi
call fcn.00447090
mov ecx, dword [esp + 0x14]
push 0xc8
push ecx
call esi
cmp eax, 0x102
je 0x4966e0
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, byte [esp + 0x13]
lea eax, [esp + 0x3540]
push eax
call fcn.00485d80
lea ecx, [esp + 0x1d40]
push ecx
call fcn.00485ab0
test bl, bl
je 0x49673f
mov edx, dword [0x4e9b84]
push edx
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [esp + 0x5d4c], 0xffffffff
lea ecx, [esp + 0x18]
call fcn.004147b0
mov ecx, dword [esp + 0x5d44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x5d30]
xor ecx, esp
call fcn.004a4bb3
add esp, 0x5d40
ret