Function at 0x1400a3e60
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2fd0]
mov eax, 0x30d0
call fcn.1400eea70
sub rsp, rax
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x3120], rbx
mov rax, qword [0x14013f2b0]
xor rax, rsp
mov qword [rbp + 0x2fc0], rax
mov r14, rdx
mov rbx, rcx
mov qword [rsp + 0x60], rcx
call fcn.1400678f4
nop
xor r12d, r12d
mov byte [rbx + 0x3038], r12b
mov r15d, 0x800
mov r9d, r15d
lea r8, [rbp + 0xfc0]
lea rdx, [rbp + 0x1fc0]
lea rcx, [0x14016e3d0]
call fcn.1400a9954
lea rcx, [r14 + 0x83f2]
cmp word [rcx], r12w
je 0x1400a3f08
lea rdx, [rbp + 0x1fc0]
sub rdx, rcx
movzx eax, word [rcx]
mov word [rdx + rcx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x1400a3ef8
lea rcx, [r14 + 0x93f2]
cmp word [rcx], r12w
je 0x1400a3f2f
lea rdx, [rbp + 0xfc0]
sub rdx, rcx
movzx eax, word [rcx]
mov word [rdx + rcx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x1400a3f1f
lea rsi, [r14 + 0x1018]
mov rcx, rsi
call fcn.1400792dc
mov rcx, rax
mov r8d, 6
lea rdx, str.WinCon
call fcn.1400910d0
test eax, eax
jne 0x1400a3f64
movzx eax, r12w
mov word [rbp + 0xfc0], ax
jmp 0x1400a3f6b
movzx eax, word [rbp + 0xfc0]
lea rdi, [rbx + 0x1030]
mov word [rdi], r12w
cmp word [rsi], r12w
je 0x1400a42f3
cmp word [rbp + 0x1fc0], r12w
jne 0x1400a3f9c
test ax, ax
jne 0x1400a3f9c
cmp byte [r14 + 0xa3f2], r12b
je 0x1400a42f3
mov rcx, rsi
call fcn.140068f88
test al, al
je 0x1400a42f3
mov rcx, rsi
lea rdx, [rbx + 0x2030]
sub rdx, rsi
movzx eax, word [rcx]
mov word [rdx + rcx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x1400a3fb9
mov qword [rbx + 0x3030], rsi
mov r8, r15
mov rdx, rdi
lea rcx, str.Rar_SF
call fcn.1400c52e4
mov r15, rax
test rax, rax
je 0x1400a42d9
mov rdx, rsi
mov rcx, rbx
call fcn.1400a539c
test al, al
je 0x1400a4025
mov ecx, 0x5f5
call fcn.140087e6c
mov rcx, rax
call fcn.1400d1b9c
mov edx, 1
lea rcx, [0x14017d200]
call fcn.14006320c
jmp 0x1400a42d9
mov r8, r15
mov rdx, rsi
mov rcx, rbx
call fcn.1400a4ad0
test al, al
je 0x1400a42f3
mov rcx, r15
call fcn.1400f5e3c
mov edx, 0x10000
lea rcx, [rsp + 0x30]
call fcn.140004018
nop
mov r9, qword [rsp + 0x38]
mov r8, qword [rsp + 0x30]
mov rdx, rsi
mov rcx, rbx
call fcn.1400a5924
mov qword [rsp + 0x28], rax
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
mov r15, rax
test rax, rax
jne 0x1400a408f
lea rcx, [rsp + 0x30]
call fcn.140008018
jmp 0x1400a42f3
mov byte [rsp + 0x20], r12b
mov r13b, r12b
xor edx, edx
lea r8d, [rdx + 3]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov r12, rax
xor edx, edx
test rax, rax
je 0x1400a419b
movzx eax, word [rbp + 0x1fc0]
test ax, ax
je 0x1400a4119
mov r9, r15
lea r8, [0x1400a4cf4]
mov edx, 3
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
mov r9, r15
lea r8, [0x1400a4cf4]
mov edx, 0xe
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
mov r9d, reloc.SHELL32.dll_SHRestricted
lea r8, [rbp + 0x1fc0]
mov rdx, r15
mov rcx, rbx
call fcn.1400a4560
mov cl, al
mov byte [rsp + 0x20], al
movzx eax, word [rbp + 0x1fc0]
xor edx, edx
jmp 0x1400a411b
mov cl, dl
cmp word [rbp + 0xfc0], dx
je 0x1400a4192
test ax, ax
je 0x1400a412d
test cl, cl
je 0x1400a4192
lea rdx, [0x140117a68]
lea rcx, [rbp + 0xfc0]
call fcn.140077948
mov r9, r15
lea r8, [0x1400a4cf4]
mov rcx, r12
test al, al
je 0x1400a4170
mov edx, 2
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
lea r8, [rbp + 0xfc0]
mov rdx, r15
mov rcx, rbx
call fcn.1400a43d4
jmp 0x1400a418f
lea rdx, [0x140117a70]
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
lea r8, [rbp + 0xfc0]
mov rdx, r15
mov rcx, rbx
call fcn.1400a47c0
mov r13b, al
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor edx, edx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_EndUpdateResourceW]
xor r12d, r12d
test eax, eax
je 0x1400a4080
cmp word [rbp + 0xfc0], r12w
je 0x1400a41c4
test r13b, r13b
je 0x1400a4080
cmp byte [rsp + 0x20], r12b
jne 0x1400a41dd
test r13b, r13b
jne 0x1400a41dd
cmp byte [r14 + 0xa3f2], r12b
je 0x1400a4268
cmp byte [r14 + 0xa3f2], r12b
je 0x1400a41f1
mov rdx, rdi
mov rcx, rbx
call fcn.1400a4b7c
mov qword [rbp + 0xf80], r12
mov qword [rbp + 0xf88], r12
mov qword [rbp + 0xf90], r12
xor r8d, r8d
lea rdx, [rsp + 0x70]
mov rcx, rdi
call fcn.14006a4b4
mov r14, qword [rsp + 0x28]
test al, al
je 0x1400a4255
mov rcx, qword [rbp + 0xf70]
add rcx, r14
mov r15d, 0x200000
cmp rcx, r15
jbe 0x1400a4255
mov ecx, 0x5a0
call fcn.140087e6c
mov rdx, rax
mov r8d, r15d
lea rcx, [0x14015db52]
call fcn.1400d53bc
jmp 0x1400a4080
mov r8d, 0x800
mov rdx, rdi
mov rcx, rsi
call fcn.14008df58
jmp 0x1400a426d
mov r14, qword [rsp + 0x28]
test r14, r14
je 0x1400a42cf
mov r9, qword [rsp + 0x38]
mov r8, qword [rsp + 0x30]
mov rdx, rdi
mov rcx, rbx
call fcn.1400a5924
test rax, rax
jne 0x1400a42cf
lea rdx, [0x140117a78]
mov rcx, rdi
call fcn.1400c5c98
mov rsi, rax
test rax, rax
je 0x1400a42cf
xor edx, edx
lea r8d, [rdx + 2]
mov rcx, rax
call fcn.1400fa150
mov r9, rsi
mov r8, r14
mov edx, 1
mov rcx, qword [rsp + 0x30]
call fcn.1400f6208
mov rcx, rsi
call fcn.1400f5e3c
nop
lea rcx, [rsp + 0x30]
call fcn.140008018
cmp word [rdi], r12w
je 0x1400a42f3
mov r9, qword [rbx]
mov r8d, 4
mov rdx, rdi
mov rcx, rbx
call qword [r9 + VariantCopy]
nop
mov rax, rbx
mov rcx, qword [rbp + 0x2fc0]
xor rcx, rsp
call fcn.1400eeae0
mov rbx, qword [rsp + 0x3120]
add rsp, 0x30d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret