Function at 0x43df90
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x1cf8
call fcn.004a5100
mov eax, dword [0x4cc3b0]
xor eax, esp
mov dword [esp + 0x1cf4], eax
push ebx
push esi
mov esi, ecx
push esi
lea eax, [esp + 0xd00]
push str._sShellNew
push eax
mov edx, 0x400
mov byte [0x4cafdc], 0x52
mov byte [0x4cafc4], 0x50
call fcn.004a29f0
add esp, 0xc
cmp byte [esp + 0x1d04], 0
push esi
je 0x43e2ba
call fcn.0043cb80
test al, al
jne 0x43e121
push 0x200
push 0x4bad38
lea ecx, [esp + 0x504]
push ecx
push 0x4bad38
push esi
push 0x80000000
call fcn.0045b320
push 0x200
push 0x4bad38
lea edx, [esp + 0x104]
push edx
push str.Content_Type
push esi
push 0x80000000
call fcn.0045b320
push 0x400
push 0x4bad38
lea eax, [esp + 0x1504]
push eax
push str.FileName
lea ecx, [esp + 0xd0c]
push ecx
push 0x80000000
call fcn.0045b320
push 0xa
push 0x4bad38
lea edx, [esp + 0xf0]
push edx
push str.NullFile
lea eax, [esp + 0xd0c]
push eax
push 0x80000000
call fcn.0045b320
push esi
lea ecx, [esp + 0x4c]
push 0x4bc8d0
push ecx
mov edx, 0x50
mov bl, al
call fcn.004a29f0
add esp, 0xc
push esi
push 0x80000000
call fcn.0045b050
movzx edx, al
push edx
push str.Exist
lea eax, [esp + 0x50]
push eax
call fcn.0045b860
lea ecx, [esp + 0x4fc]
push ecx
push str.Type
lea edx, [esp + 0x50]
push edx
call fcn.0045b840
lea eax, [esp + 0xfc]
push eax
push str.Content
lea ecx, [esp + 0x50]
push ecx
call fcn.0045b840
cmp word [esp + 0x14fc], 0
jne 0x43e10a
test bl, bl
je 0x43e10a
push 0x4baefc
push str.ShellNew
lea edx, [esp + 0x50]
push edx
jmp 0x43e11c
lea eax, [esp + 0x14fc]
push eax
push str.ShellNew
lea ecx, [esp + 0x50]
push ecx
call fcn.0045b840
cmp byte [esp + 0x1d10], 0
mov eax, str.WinRAR.ZIP
jne 0x43e135
mov eax, 0x4bc770
push eax
push 0x4bad38
push esi
push 0x80000000
call fcn.0045b2b0
push str.Content_Type
push esi
push 0x80000000
call fcn.0045af30
mov bl, byte [esp + 0x1d0c]
test bl, bl
je 0x43e1cb
push edi
call fcn.0043ee30
mov edi, eax
neg edi
sbb edi, edi
and edi, 0xffffffba
add edi, 0x64
xor esi, esi
test edi, edi
jle 0x43e1ca
lea esp, [esp]
push esi
lea edx, [esp + 0x10]
push str..r_02d
push edx
mov edx, 0x20
call fcn.004a29f0
add esp, 0xc
push 0x4bc770
push 0x4bad38
lea eax, [esp + 0x14]
push eax
push 0x80000000
call fcn.0045b2b0
push str.Content_Type
lea ecx, [esp + 0x10]
push ecx
push 0x80000000
call fcn.0045af30
inc esi
cmp esi, edi
jl 0x43e180
pop edi
cmp byte [esp + 0x1d08], 0
je 0x43e515
cmp byte [esp + 0x1d10], 0
jne 0x43e1eb
test bl, bl
je 0x43e515
lea edx, [esp + 0xcfc]
push edx
push 0x80000000
call fcn.0045ae80
push 0x400
lea eax, [esp + 0x500]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, str.rarnew.dat
test bl, bl
jne 0x43e220
mov esi, str.zipnew.dat
lea ecx, [esp + 0x4fc]
push ecx
call fcn.00451c30
lea ecx, [ecx]
movzx ecx, word [esi]
mov word [eax], cx
add esi, 2
add eax, 2
test cx, cx
jne 0x43e230
lea edx, [esp + 0x4fc]
push edx
call fcn.004317c0
test al, al
jne 0x43e296
push 0
push 0x4bae08
lea eax, [esp + 0x504]
push eax
call fcn.00432060
mov esi, eax
test esi, esi
je 0x43e296
push esi
test bl, bl
je 0x43e27c
push 0x14
push 1
push 0x4cafdc
jmp 0x43e285
push 0x16
push 1
push 0x4cafc4
call fcn.004a6bc4
add esp, 0x10
push esi
call fcn.004a6995
add esp, 4
lea ecx, [esp + 0x4fc]
push ecx
push str.FileName
lea edx, [esp + 0xd04]
push edx
push 0x80000000
call fcn.0045b2b0
jmp 0x43e515
lea eax, [esp + 0x4c]
push 0x4bc8d0
push eax
mov edx, 0x50
call fcn.004a29f0
add esp, 0xc
push esi
call fcn.0043cb80
test al, al
je 0x43e515
push 1
push str.Exist
lea ecx, [esp + 0x50]
push ecx
call fcn.0045b940
push 0x200
push 0x4bad38
lea edx, [esp + 0x104]
push edx
test eax, eax
push str.Type
lea eax, [esp + 0x58]
push eax
setne bl
call fcn.0045b910
push 0x4bc770
lea ecx, [esp + 0x100]
push ecx
call fcn.00473340
test eax, eax
je 0x43e342
push str.WinRAR.ZIP
lea edx, [esp + 0x100]
push edx
call fcn.00473340
test eax, eax
jne 0x43e34c
xor eax, eax
mov word [esp + 0xfc], ax
push 0x200
push 0x4bad38
lea ecx, [esp + 0x504]
push ecx
push str.Content
lea edx, [esp + 0x58]
push edx
call fcn.0045b910
test bl, bl
je 0x43e44c
lea eax, [esp + 0xfc]
push eax
push 0x4bad38
push esi
push 0x80000000
call fcn.0045b2b0
cmp word [esp + 0x4fc], 0
je 0x43e3b2
lea ecx, [esp + 0x4fc]
push ecx
push str.Content_Type
push esi
push 0x80000000
call fcn.0045b2b0
jmp 0x43e3c2
push str.Content_Type
push esi
push 0x80000000
call fcn.0045af30
push 0x400
push 0x4bad38
lea edx, [esp + 0x1504]
push edx
push str.ShellNew
lea eax, [esp + 0x58]
push eax
call fcn.0045b910
push str.FileName
lea ecx, [esp + 0xd00]
push ecx
push 0x80000000
call fcn.0045af30
mov ax, word [esp + 0x14fc]
test ax, ax
je 0x43e47e
cmp ax, 0x2a
jne 0x43e42b
push 0x4bad38
push str.NullFile
lea edx, [esp + 0xd04]
push edx
push 0x80000000
call fcn.0045b2b0
jmp 0x43e47e
lea eax, [esp + 0x14fc]
push eax
push str.FileName
lea ecx, [esp + 0xd04]
push ecx
push 0x80000000
call fcn.0045b2b0
jmp 0x43e47e
lea edx, [esp + 0xcfc]
push edx
push 0x80000000
call fcn.0045ae80
push 0x4bad38
push 0x4bad38
push esi
push 0x80000000
call fcn.0045b2b0
push esi
push 0x80000000
call fcn.0045ae80
cmp byte [esp + 0x1d0c], 0
je 0x43e515
xor esi, esi
mov edi, edi
push esi
lea eax, [esp + 0xc]
push str..r_02d
push eax
mov edx, 0x20
call fcn.004a29f0
add esp, 0xc
test bl, bl
je 0x43e4fc
cmp word [esp + 0xfc], 0
je 0x43e4fc
lea ecx, [esp + 0xfc]
push ecx
push 0x4bad38
lea edx, [esp + 0x10]
push edx
push 0x80000000
call fcn.0045b2b0
cmp word [esp + 0x4fc], 0
je 0x43e50b
lea eax, [esp + 0x4fc]
push eax
push str.Content_Type
lea ecx, [esp + 0x10]
push ecx
push 0x80000000
call fcn.0045b2b0
jmp 0x43e50b
lea edx, [esp + 8]
push edx
push 0x80000000
call fcn.0045ae80
inc esi
cmp esi, 0x64
jl 0x43e490
mov ecx, dword [esp + 0x1cfc]
pop esi
pop ebx
xor ecx, esp
call fcn.004a48d3
add esp, 0x1cf8
ret 0x10