Function at 0x48df30
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x28f8
call fcn.004e6b50
mov eax, dword [0x519bc0]
xor eax, esp
mov dword [esp + 0x28f4], eax
push ebx
push esi
mov esi, ecx
push esi
lea eax, [esp + 0x900]
push str._sShellNew
push eax
mov edx, 0x800
mov byte [0x517af0], 0x52
mov byte [0x517ad8], 0x50
call fcn.004a63e0
add esp, 0xc
cmp byte [esp + 0x2904], 0
push esi
je 0x48e24a
call fcn.0048d440
test al, al
jne 0x48e0c1
push 0x200
push 0x501a20
lea ecx, [esp + 0x504]
push ecx
push 0x501a20
push esi
push SysReAllocString
call fcn.0049bef0
push 0x200
push 0x501a20
lea edx, [esp + 0x104]
push edx
push str.Content_Type
push esi
push SysReAllocString
call fcn.0049bef0
push 0x800
push 0x501a20
lea eax, [esp + 0x1904]
push eax
push str.FileName
lea ecx, [esp + 0x90c]
push ecx
push SysReAllocString
call fcn.0049bef0
push 0xa
push 0x501a20
lea edx, [esp + 0xf0]
push edx
push str.NullFile
lea eax, [esp + 0x90c]
push eax
push SysReAllocString
call fcn.0049bef0
push esi
lea ecx, [esp + 0x4c]
push str.Setup_s
push ecx
mov edx, 0x50
mov bl, al
call fcn.004a63e0
add esp, 0xc
push esi
push SysReAllocString
call fcn.0049b980
movzx edx, al
push edx
push str.Exist
lea eax, [esp + 0x50]
push eax
call fcn.0049c4e0
lea ecx, [esp + 0x4fc]
push ecx
push 0x503f00
lea edx, [esp + 0x50]
push edx
call fcn.0049c4c0
lea eax, [esp + 0xfc]
push eax
push str.Content
lea ecx, [esp + 0x50]
push ecx
call fcn.0049c4c0
cmp word [esp + 0x18fc], 0
jne 0x48e0aa
test bl, bl
je 0x48e0aa
push 0x502a28
push str.ShellNew
lea edx, [esp + 0x50]
push edx
jmp 0x48e0bc
lea eax, [esp + 0x18fc]
push eax
push str.ShellNew
lea ecx, [esp + 0x50]
push ecx
call fcn.0049c4c0
cmp byte [esp + 0x2910], 0
mov eax, str.WinRAR.ZIP
jne 0x48e0d5
mov eax, 0x503130
push eax
push 0x501a20
push esi
push SysReAllocString
call fcn.0049bd80
push str.Content_Type
push esi
push SysReAllocString
call fcn.0049b8a0
mov bl, byte [esp + 0x290c]
test bl, bl
je 0x48e16b
push edi
call fcn.00447ef0
mov edi, eax
neg edi
sbb edi, edi
and edi, 0xffffffba
add edi, 0x64
xor esi, esi
test edi, edi
jle 0x48e16a
lea esp, [esp]
push esi
lea edx, [esp + 0x10]
push str..r_02d
push edx
mov edx, 0x20
call fcn.004a63e0
add esp, 0xc
push 0x503130
push 0x501a20
lea eax, [esp + 0x14]
push eax
push SysReAllocString
call fcn.0049bd80
push str.Content_Type
lea ecx, [esp + 0x10]
push ecx
push SysReAllocString
call fcn.0049b8a0
inc esi
cmp esi, edi
jl 0x48e120
pop edi
cmp byte [esp + 0x2908], 0
je 0x48e4a5
cmp byte [esp + 0x2910], 0
jne 0x48e18b
test bl, bl
je 0x48e4a5
lea edx, [esp + 0x8fc]
push edx
push SysReAllocString
call fcn.0049b830
push 0x800
lea eax, [esp + 0x1900]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, str.rarnew.dat
test bl, bl
jne 0x48e1c0
mov eax, str.zipnew.dat
push 0x800
push eax
lea ecx, [esp + 0x1904]
push ecx
call fcn.00453690
lea edx, [esp + 0x18fc]
push edx
call fcn.00445470
test al, al
jne 0x48e226
push 0x503b68
lea eax, [esp + 0x1900]
push eax
call fcn.004452a0
mov esi, eax
test esi, esi
je 0x48e226
push esi
test bl, bl
je 0x48e20c
push 0x14
push 1
push 0x517af0
jmp 0x48e215
push 0x16
push 1
push 0x517ad8
call fcn.004eb049
add esp, 0x10
push esi
call fcn.004eae6b
add esp, 4
lea ecx, [esp + 0x18fc]
push ecx
push str.FileName
lea edx, [esp + 0x904]
push edx
push SysReAllocString
call fcn.0049bd80
jmp 0x48e4a5
lea eax, [esp + 0x4c]
push str.Setup_s
push eax
mov edx, 0x50
call fcn.004a63e0
add esp, 0xc
push esi
call fcn.0048d440
test al, al
je 0x48e4a5
push 1
push str.Exist
lea ecx, [esp + 0x50]
push ecx
call fcn.0049c560
push 0x200
push 0x501a20
lea edx, [esp + 0x104]
push edx
test eax, eax
push 0x503f00
lea eax, [esp + 0x58]
push eax
setne bl
call fcn.0049c530
push 0x503130
lea ecx, [esp + 0x100]
push ecx
call fcn.0046cb00
test eax, eax
je 0x48e2d2
push str.WinRAR.ZIP
lea edx, [esp + 0x100]
push edx
call fcn.0046cb00
test eax, eax
jne 0x48e2dc
xor eax, eax
mov word [esp + 0xfc], ax
push 0x200
push 0x501a20
lea ecx, [esp + 0x504]
push ecx
push str.Content
lea edx, [esp + 0x58]
push edx
call fcn.0049c530
test bl, bl
je 0x48e3dc
lea eax, [esp + 0xfc]
push eax
push 0x501a20
push esi
push SysReAllocString
call fcn.0049bd80
cmp word [esp + 0x4fc], 0
je 0x48e342
lea ecx, [esp + 0x4fc]
push ecx
push str.Content_Type
push esi
push SysReAllocString
call fcn.0049bd80
jmp 0x48e352
push str.Content_Type
push esi
push SysReAllocString
call fcn.0049b8a0
push 0x800
push 0x501a20
lea edx, [esp + 0x1904]
push edx
push str.ShellNew
lea eax, [esp + 0x58]
push eax
call fcn.0049c530
push str.FileName
lea ecx, [esp + 0x900]
push ecx
push SysReAllocString
call fcn.0049b8a0
mov ax, word [esp + 0x18fc]
test ax, ax
je 0x48e40e
cmp ax, 0x2a
jne 0x48e3bb
push 0x501a20
push str.NullFile
lea edx, [esp + 0x904]
push edx
push SysReAllocString
call fcn.0049bd80
jmp 0x48e40e
lea eax, [esp + 0x18fc]
push eax
push str.FileName
lea ecx, [esp + 0x904]
push ecx
push SysReAllocString
call fcn.0049bd80
jmp 0x48e40e
lea edx, [esp + 0x8fc]
push edx
push SysReAllocString
call fcn.0049b830
push 0x501a20
push 0x501a20
push esi
push SysReAllocString
call fcn.0049bd80
push esi
push SysReAllocString
call fcn.0049b830
cmp byte [esp + 0x290c], 0
je 0x48e4a5
xor esi, esi
mov edi, edi
push esi
lea eax, [esp + 0xc]
push str..r_02d
push eax
mov edx, 0x20
call fcn.004a63e0
add esp, 0xc
test bl, bl
je 0x48e48c
cmp word [esp + 0xfc], 0
je 0x48e48c
lea ecx, [esp + 0xfc]
push ecx
push 0x501a20
lea edx, [esp + 0x10]
push edx
push SysReAllocString
call fcn.0049bd80
cmp word [esp + 0x4fc], 0
je 0x48e49b
lea eax, [esp + 0x4fc]
push eax
push str.Content_Type
lea ecx, [esp + 0x10]
push ecx
push SysReAllocString
call fcn.0049bd80
jmp 0x48e49b
lea edx, [esp + 8]
push edx
push SysReAllocString
call fcn.0049b830
inc esi
cmp esi, 0x64
jl 0x48e420
mov ecx, dword [esp + 0x28fc]
pop esi
pop ebx
xor ecx, esp
call fcn.004e6b3a
add esp, 0x28f8
ret 0x10