Function at 0x448588
Capabilities:
Get file system object information
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 5
add esp, 0xfffff004
push eax
dec eax
jne 0x448591
mov eax, dword [ebp - 4]
add esp, 0xfffffb54
push ebx
push esi
push edi
mov edi, 0x4ae85c
mov eax, 0x49de48
call fcn.0048dd88
lea edx, [ebp - 0xab0]
push edx
push 0x43d952
push dword [0x4b9890]
push str.VIRSCAN
push dword [0x4a7028]
call fcn.0049789c
test eax, eax
jne 0x4485f0
mov ecx, dword [ebp - 0x22c]
mov dword fs:[0], ecx
mov eax, ecx
jmp 0x448b91
mov word [ebp - 0x21c], 8
lea eax, [ebp - 0x110]
call fcn.00464f18
add dword [ebp - 0x210], 6
mov word [ebp - 0x21c], 0x14
cmp dword [0x4bc218], 0
je 0x44865a
lea ecx, [ebp - 0x1ec0]
lea edx, [ebp - 0x16c0]
mov eax, 0x4ba5d4
call fcn.0045d270
lea ecx, [ebp - 0x1ec0]
lea edx, [ebp - 0x16c0]
lea eax, [ebp - 0x110]
call fcn.004651e8
lea eax, [ebp - 0x110]
call fcn.0046530c
jmp 0x44872b
mov word [ebp - 0x21c], 0x20
lea eax, [ebp - 0x208]
call fcn.0040ee0c
add dword [ebp - 0x210], 4
mov word [ebp - 0x21c], 0x2c
lea edx, [ebp - 0x208]
mov eax, 0x4b98a4
xor ecx, ecx
call fcn.004639cc
push 0
push 1
push 0
push 1
lea ecx, [ebp - 0x110]
lea eax, [ebp - 0x208]
mov edx, 2
call fcn.004689e4
test al, al
jne 0x44870b
sub dword [ebp - 0x210], 4
lea eax, [ebp - 0x208]
mov edx, 2
call fcn.0040ef28
dec dword [ebp - 0x210]
dec dword [ebp - 0x210]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.004392b0
sub dword [ebp - 0x210], 4
lea eax, [ebp - 0x110]
mov edx, 2
call fcn.0040ef28
mov ecx, dword [ebp - 0x22c]
mov dword fs:[0], ecx
jmp 0x448b91
sub dword [ebp - 0x210], 4
lea eax, [ebp - 0x208]
mov edx, 2
call fcn.0040ef28
mov word [ebp - 0x21c], 0x14
lea edx, [ebp - 0x22c0]
mov eax, str.Rar_VRXXXXXX
call fcn.00467e64
test al, al
jne 0x448781
dec dword [ebp - 0x210]
dec dword [ebp - 0x210]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.004392b0
sub dword [ebp - 0x210], 4
lea eax, [ebp - 0x110]
mov edx, 2
call fcn.0040ef28
mov ecx, dword [ebp - 0x22c]
mov dword fs:[0], ecx
jmp 0x448b91
lea eax, [ebp - 0x26c0]
push eax
push 0x400
call fcn.004973fe
mov word [ebp - 0x21c], 0x14
xor ebx, ebx
jmp 0x448928
lea eax, [ebp - 0x22c0]
push eax
call fcn.0048f2ec
pop ecx
lea ecx, [ebp - 0x36f0]
lea eax, [ebp - 0x110]
mov edx, ebx
call fcn.00465240
lea eax, [ebp - 0x36f0]
call fcn.0040b578
push eax
lea edx, [ebp - 0x2ac0]
push edx
call fcn.0048d8e8
add esp, 8
lea eax, [ebp - 0x2ac0]
xor ecx, ecx
xor edx, edx
call fcn.00409c34
test eax, eax
je 0x448839
lea eax, [ebp - 0x2ac0]
mov dl, 1
call fcn.0040bda0
lea eax, [ebp - 0x2ac0]
xor ecx, ecx
xor edx, edx
call fcn.00409c34
test eax, eax
je 0x448839
lea eax, [ebp - 0x2ac0]
push eax
mov eax, 0x1f7
call fcn.004116e8
push eax
call fcn.0044a224
add esp, 8
mov eax, 0x4a69f4
call fcn.00429838
jmp 0x448927
lea edx, [ebp - 0x2ac0]
push edx
call fcn.0048f2ec
pop ecx
call fcn.004525f4
lea ecx, [ebp - 0x4320]
lea eax, [ebp - 0x110]
mov edx, ebx
call fcn.00465240
lea eax, [ebp - 0x4320]
lea edx, [edi + 0x3ed8]
call fcn.0040a568
lea ecx, [ebp - 0x4f50]
lea eax, [ebp - 0x110]
mov edx, ebx
call fcn.00465240
lea eax, [ebp - 0x4f50]
lea edx, [edi + 0x42d8]
add eax, 0x400
call fcn.0040a5b0
cmp dword [0x4bc218], 0
jne 0x4488bb
push 1
push 0
lea ecx, [edi + 0x42d8]
lea edx, [edi + 0x3ed8]
mov eax, 0x4ba5d4
call fcn.0045bd3c
mov ecx, dword [0x4ba7dc]
mov dword [edi + 0x2a90], ecx
mov eax, dword [edi + 0x4ae4]
call fcn.0040efa4
mov eax, dword [edi + 0x4ad8]
call fcn.0040efa4
mov edx, 0x49cbc1
mov eax, dword [edi + 0x4ad8]
call fcn.0040efd4
call fcn.0044a498
mov esi, eax
mov word [ebp - 0x21c], 0x14
mov eax, 0x4ba5d4
mov cl, 1
xor edx, edx
call fcn.004587a4
call fcn.0044a498
cmp esi, eax
je 0x44891e
mov dword [0x4bc228], 1
cmp dword [0x4bc228], 0
jne 0x44893a
inc ebx
cmp ebx, dword [ebp - 0xc]
jae 0x44893a
cmp dword [0x4bc224], 0
je 0x4487a2
xor ebx, ebx
cmp dword [0x4bc228], 0
jne 0x448b1e
push 0
lea edx, [edi + 0x3ed8]
xor ecx, ecx
mov eax, 9
call fcn.00475efc
mov ebx, eax
lea eax, [ebp - 0xab0]
call fcn.00477b04
mov eax, 0x543
call fcn.004116e8
call fcn.00477b04
lea edx, [ebp - 0x22c0]
push edx
call fcn.0048f2ec
pop ecx
lea edx, [ebp - 0x22c0]
lea eax, [ebp - 0x6b0]
call fcn.0043e2a7
push 0x2000
lea ecx, [ebp - 0x50b0]
push 0x160
push ecx
lea eax, [ebp - 0xab0]
push 0
push eax
call fcn.004977d4
mov ecx, eax
shr ecx, 0x10
test cx, cx
jne 0x4489d5
mov edx, eax
and dx, 0xffff
cmp dx, 0x5a4d
je 0x4489d9
cmp dx, 0x4550
je 0x4489d9
xor eax, eax
jmp 0x4489de
mov eax, 1
test al, al
je 0x448aa2
lea edx, [ebp - 0x22c0]
push edx
lea ecx, [ebp - 0x54b0]
push ecx
call fcn.0048d8e8
add esp, 8
lea eax, [ebp - 0x54b0]
call fcn.0040ba60
call fcn.00495d7c
push eax
push str.__rar_scan_d.bat
lea edx, [ebp - 0x54b0]
push edx
call fcn.0048d918
pop ecx
lea ecx, [ebp - 0x54b0]
add eax, ecx
push eax
call fcn.004908b8
add esp, 0xc
push 0x49cbf9
lea eax, [ebp - 0x54b0]
push eax
call fcn.0048f890
add esp, 8
mov esi, eax
test esi, esi
je 0x448aa2
xor eax, eax
mov al, byte [ebp - 0xab0]
cmp eax, 0x22
je 0x448a62
lea eax, [ebp - 0xab0]
call fcn.004444e4
lea edx, [ebp - 0x6b0]
push edx
lea ecx, [ebp - 0xab0]
push ecx
push str.__s__s_r_n_echo._r_n_pause
push esi
call fcn.0048f8c4
add esp, 0x10
push esi
call fcn.0048f394
pop ecx
lea eax, [ebp - 0x54b0]
push eax
lea edx, [ebp - 0xab0]
push edx
call fcn.0048d8e8
add esp, 8
mov byte [ebp - 0x6b0], 0
lea ecx, [ebp - 0x6b0]
lea eax, [ebp - 0x230]
push ecx
push 0
push eax
lea eax, [ebp - 0xab0]
push 0
lea ecx, [ebp - 0x22c0]
xor edx, edx
call fcn.0046dde0
test al, al
jne 0x448af3
lea ecx, [ebp - 0xab0]
mov eax, 0x201
push ecx
call fcn.004116e8
push eax
call fcn.0044a224
add esp, 8
jmp 0x448af3
push 0x14
call fcn.0049760e
call fcn.004442e0
push 0xc8
push dword [ebp - 0x230]
call fcn.0049765c
cmp eax, 0x102
jne 0x448b13
cmp dword [0x4bc224], 0
je 0x448ae7
push dword [ebp - 0x230]
call fcn.004972f6
lea edx, [ebp - 0x26c0]
push edx
call fcn.0048f2ec
pop ecx
lea eax, [ebp - 0x22c0]
call fcn.00468084
test al, al
je 0x448b45
lea eax, [ebp - 0x22c0]
call fcn.004678e4
test bl, bl
je 0x448b54
push dword [0x4b989c]
call fcn.00497896
dec dword [ebp - 0x210]
dec dword [ebp - 0x210]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.004392b0
sub dword [ebp - 0x210], 4
lea eax, [ebp - 0x110]
mov edx, 2
call fcn.0040ef28
mov ecx, dword [ebp - 0x22c]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret