Function at 0x4d4a20
Capabilities:
Get file system object information
Move file
Parse pe header
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x84fc]
mov eax, 0x84fc
call fcn.004ebbf0
push 0xffffffffffffffff
push 0x509819
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x528af4]
xor eax, ebp
mov dword [ebp + 0x84f8], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp]
push eax
push 0x4d5030
push dword [0x538900]
push str.VIRSCAN
push dword [0x56df20]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
test eax, eax
je 0x4d5003
lea ecx, [ebp - 0x38]
call fcn.0043cf40
mov dword [ebp - 4], 0
cmp byte [0x53898c], 0
je 0x4d4acc
push 0x800
lea eax, [ebp + 0x21e8]
mov ecx, 0x55a850
push eax
call fcn.00404e00
lea eax, [ebp + 0x21e8]
push eax
lea ecx, [ebp - 0x38]
call fcn.0043d5b0
lea ecx, [ebp - 0x38]
call fcn.0043d690
jmp 0x4d4b40
lea ecx, [ebp + 0x349c]
call fcn.0048e750
mov byte [ebp - 4], 1
lea eax, [ebp + 0x349c]
push 1
push eax
mov ecx, 0x55d4d8
call fcn.0043f800
push 0
push 0
push 0xa
lea eax, [ebp - 0x38]
push eax
push 3
lea eax, [ebp + 0x349c]
push eax
call fcn.004a3d60
test al, al
jne 0x4d4b29
mov byte [ebp - 4], al
mov eax, dword [ebp + 0x349c]
test eax, eax
je 0x4d4ff4
push eax
call fcn.004f252e
add esp, 4
jmp 0x4d4ff4
mov byte [ebp - 4], 0
mov eax, dword [ebp + 0x349c]
test eax, eax
je 0x4d4b40
push eax
call fcn.004f252e
add esp, 4
push 0
push 0x800
lea eax, [ebp + 0x64f8]
push eax
push str.Rar_VR
call fcn.004c3dd0
test al, al
je 0x4d4ff4
push 0x800
lea eax, [ebp + 0x54f8]
push eax
call fcn.004c48f0
xor edi, edi
xor bh, bh
cmp dword [ebp - 0x34], edi
jbe 0x4d4cf7
mov edi, edi
cmp byte [0x53898e], 0
jne 0x4d4cf7
lea eax, [ebp + 0x64f8]
push eax
call fcn.004c4cd0
push edi
lea eax, [ebp + 0x2100]
push eax
lea ecx, [ebp - 0x38]
call fcn.0043d1b0
push eax
call fcn.00478eb0
lea edx, [ebp + 0x74f8]
sub edx, eax
jmp 0x4d4bc0
movzx ecx, word [eax]
lea eax, [eax + 2]
mov word [edx + eax - 2], cx
test cx, cx
jne 0x4d4bc0
push 0
push 0
lea eax, [ebp + 0x74f8]
push eax
call fcn.004698f0
test eax, eax
je 0x4d4c2f
push 1
lea eax, [ebp + 0x74f8]
push eax
call fcn.00478c30
push 0
push 0
lea eax, [ebp + 0x74f8]
push eax
call fcn.004698f0
test eax, eax
je 0x4d4c2f
lea eax, [ebp + 0x74f8]
push eax
push 0x1f7
call fcn.00488530
push eax
call fcn.004cf640
add esp, 8
mov ecx, 0x56df60
call fcn.00463320
jmp 0x4d4ce4
lea eax, [ebp + 0x74f8]
push eax
call fcn.004c4cd0
push 1
call fcn.004bf7c0
push 0x800
push 0x54f29a
push edi
lea eax, [ebp + 0x2100]
push eax
lea ecx, [ebp - 0x38]
call fcn.0043d1b0
push eax
call fcn.00477320
cmp byte [0x53898c], 0
jne 0x4d4c7e
push 0
push 0
push 0x54f29a
mov ecx, 0x55a850
call fcn.004059c0
cmp byte [0x55ab7c], 0
jne 0x4d4c90
cmp byte [0x55aacb], 0
je 0x4d4c92
mov bh, 1
mov eax, dword [0x55a854]
mov ecx, 0x5503b0
mov dword [0x54c248], eax
call fcn.0048e9d0
mov ecx, 0x55029c
call fcn.0048e9d0
push 0x50ba14
mov ecx, 0x55029c
call fcn.0048e7f0
mov esi, dword [0x598728]
mov ecx, 0x55a850
push 1
push 0
call fcn.004049a0
cmp esi, dword [0x598728]
jne 0x4d4cf0
cmp byte [0x53898f], 0
jne 0x4d4cf7
inc edi
cmp edi, dword [ebp - 0x34]
jb 0x4d4b80
jmp 0x4d4cf7
mov byte [0x53898f], 1
xor bl, bl
cmp byte [0x53898f], bl
jne 0x4d4f49
push 0
push 0
push 0x54f29a
push 0xb
call fcn.004c5f90
mov bl, al
lea eax, [ebp]
push eax
push 0x510204
call fcn.004c4d60
add esp, 8
push 0x543
call fcn.00488530
push eax
call fcn.004c4d60
add esp, 4
lea eax, [ebp + 0x64f8]
push eax
call fcn.004c4cd0
lea eax, [ebp + 0x64f8]
push eax
lea eax, [ebp + 0x1000]
push eax
call fcn.004cfa90
push 0x2000
push 0x2b4
lea eax, [ebp + 0x31e8]
push eax
push 0
lea eax, [ebp]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov ecx, eax
shr ecx, 0x10
test ecx, ecx
jne 0x4d4ec2
mov ecx, 0x5a4d
cmp ax, cx
je 0x4d4d9c
mov ecx, 0x4550
cmp ax, cx
jne 0x4d4ec2
xor ecx, ecx
mov edi, edi
movzx eax, word [ebp + ecx + 0x64f8]
lea ecx, [ecx + 2]
mov word [ebp + ecx + 0x74f6], ax
test ax, ax
jne 0x4d4da0
push 0x800
lea eax, [ebp + 0x74f8]
push eax
call fcn.00477290
lea esi, [ebp + 0x74f8]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x4d4dd2
sub esi, ecx
sar esi, 1
call fcn.004f24cc
push eax
mov eax, 0x800
sub eax, esi
push str.Rar_Scan_d.bat
push eax
lea eax, [ebp + 0x74f8]
lea eax, [eax + esi*2]
push eax
call fcn.004028e0
add esp, 0x10
lea eax, [ebp + 0x74f8]
push 0x50bd80
push eax
call fcn.0046a5a0
mov esi, eax
test esi, esi
je 0x4d4ec2
cmp word [ebp], 0x22
je 0x4d4e36
push 0x800
lea eax, [ebp]
push eax
call fcn.004a7bd0
lea eax, [ebp + 0x1000]
push eax
lea eax, [ebp]
push eax
push str.__s__s_r_n_echo._r_n_pause
lea eax, [ebp + 0x34f8]
push 0x1000
push eax
call fcn.004028e0
add esp, 0x14
lea eax, [ebp + 0x21e8]
push 0x1000
push eax
lea eax, [ebp + 0x34f8]
push eax
call fcn.00491720
lea ecx, [ebp + 0x21e8]
mov byte [ebp + 0x31e7], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4d4e82
push esi
sub ecx, edx
lea eax, [ebp + 0x21e8]
push ecx
push 1
push eax
call fcn.004f2dfc
push esi
call fcn.004f2a17
add esp, 0x14
lea eax, [ebp + 0x74f8]
push 0x800
push eax
lea eax, [ebp]
push eax
call fcn.0048e710
xor eax, eax
mov word [ebp + 0x1000], ax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp + 0x1000]
push eax
lea eax, [ebp + 0x64f8]
push eax
lea eax, [ebp]
push eax
push 0
call fcn.004db670
test al, al
je 0x4d4f32
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xc8
push dword [ebp - 0x10]
call esi
cmp eax, 0x102
jne 0x4d4f27
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x53898e], 0
jne 0x4d4f27
push 0x14
call edi
call fcn.00445680
push 0xc8
push dword [ebp - 0x10]
call esi
cmp eax, 0x102
je 0x4d4f04
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4d4f49
lea eax, [ebp]
push eax
push 0x201
call fcn.00488530
push eax
call fcn.004cf640
add esp, 8
lea eax, [ebp + 0x54f8]
push eax
call fcn.004c4cd0
test bh, bh
je 0x4d4fd8
xor ecx, ecx
jmp 0x4d4f60
movzx eax, word [ebp + ecx + 0x64f8]
lea ecx, [ecx + 2]
mov word [ebp + ecx + 0x74f6], ax
test ax, ax
jne 0x4d4f60
lea eax, [ebp + 0x74f8]
push eax
call fcn.00478eb0
mov ecx, 0x62
mov word [eax + 0xc], cx
lea eax, [ebp + 0x74f8]
push eax
call fcn.00469360
test al, al
jne 0x4d4fd8
lea eax, [ebp + 0x74f8]
push eax
lea eax, [ebp + 0x64f8]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x4d4fd8
xor ecx, ecx
jmp 0x4d4fc0
movzx eax, word [ebp + ecx + 0x74f8]
lea ecx, [ecx + 2]
mov word [ebp + ecx + 0x64f6], ax
test ax, ax
jne 0x4d4fc0
lea eax, [ebp + 0x64f8]
push eax
call fcn.004c3220
test bl, bl
je 0x4d4ff4
push dword [0x53890c]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.0043d0f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x84f8]
xor ecx, ebp
call fcn.004ebbd8
lea esp, [ebp + 0x84fc]
pop ebp
ret