Function at 0x140001f40
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2850]
mov eax, 0x2950
call fcn.14000a950
sub rsp, rax
mov rax, qword [0x14002e280]
xor rax, rsp
mov qword [rbp + 0x2840], rax
mov r15b, byte [rbp + 0x28b0]
mov r12b, r9b
mov r9, rcx
mov byte [rsp + 0x31], r8b
mov bl, dl
mov byte [rsp + 0x30], r15b
mov rdi, rcx
mov byte [0x14002e140], 0x52
lea rcx, [rbp + 0x840]
mov byte [0x14002e158], 0x50
lea r8, str._sShellNew
mov edx, 0x800
call fcn.140003a6c
xor r13d, r13d
test bl, bl
je 0x140002290
mov rcx, rdi
call fcn.140001768
lea rsi, [0x1400207a0]
mov rbx, 0xffffffff80000000
lea r14, str.Content_Type
test al, al
jne 0x140002110
mov r13d, 0x200
lea r9, [rbp + 0x440]
mov dword [rsp + 0x28], r13d
mov r8, rsi
mov rdx, rdi
mov qword [rsp + 0x20], rsi
mov rcx, rbx
call fcn.1400087ac
lea r9, [rbp + 0x40]
mov dword [rsp + 0x28], r13d
mov r8, r14
mov qword [rsp + 0x20], rsi
mov rdx, rdi
mov rcx, rbx
call fcn.1400087ac
lea r9, [rbp + 0x1840]
mov dword [rsp + 0x28], 0x800
lea r8, [0x1400212d0]
mov qword [rsp + 0x20], rsi
lea rdx, [rbp + 0x840]
mov rcx, rbx
call fcn.1400087ac
lea r9, [rbp + 0x20]
mov dword [rsp + 0x28], 0xa
lea r8, str.NullFile
mov qword [rsp + 0x20], rsi
lea rdx, [rbp + 0x840]
mov rcx, rbx
call fcn.1400087ac
mov r9, rdi
lea r8, str.Setup_s
mov edx, 0x50
lea rcx, [rbp - 0x80]
mov r13b, al
call fcn.140003a6c
mov rdx, rdi
mov rcx, rbx
call fcn.140007868
movzx r8d, al
lea rdx, str.Exist
lea rcx, [rbp - 0x80]
call fcn.140008cc4
lea r8, [rbp + 0x440]
lea rdx, str.Type
lea rcx, [rbp - 0x80]
call fcn.140008cac
lea r8, [rbp + 0x40]
lea rdx, str.Content
lea rcx, [rbp - 0x80]
call fcn.140008cac
xor eax, eax
cmp word [rbp + 0x1840], ax
jne 0x1400020f6
lea r8, [0x140021280]
test r13b, r13b
jne 0x1400020fd
lea r8, [rbp + 0x1840]
lea rdx, str.ShellNew
lea rcx, [rbp - 0x80]
call fcn.140008cac
xor r13d, r13d
lea rdx, str.WinRAR.ZIP
test r15b, r15b
lea r9, [0x140020b30]
mov r8, rsi
cmovne r9, rdx
mov rcx, rbx
mov rdx, rdi
call fcn.140008b48
mov r8, r14
mov rdx, rdi
mov rcx, rbx
call fcn.140008618
mov r15d, 1
test r12b, r12b
je 0x1400021aa
call fcn.1400056d0
neg eax
sbb edi, edi
and edi, 0xffffffba
add edi, 0x64
test edi, edi
jle 0x1400021a7
mov r9d, r13d
lea r8, str..r_02d
mov edx, 0x20
lea rcx, [rsp + 0x40]
call fcn.140003a6c
lea r9, [0x140020b30]
mov r8, rsi
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140008b48
mov r8, r14
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140008618
add r13d, r15d
cmp r13d, edi
jl 0x14000215f
xor r13d, r13d
cmp byte [rsp + 0x31], r13b
je 0x1400024be
cmp byte [rsp + 0x30], r13b
jne 0x1400021c5
test r12b, r12b
je 0x1400024be
lea rdx, [rbp + 0x840]
mov rcx, rbx
call fcn.140008598
mov edi, 0x800
lea rdx, [rbp + 0x1840]
mov r8d, edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rax, str.rarnew.dat
test r12b, r12b
lea rdx, str.zipnew.dat
mov r8d, edi
cmovne rdx, rax
lea rcx, [rbp + 0x1840]
call fcn.140005e40
lea rcx, [rbp + 0x1840]
call fcn.14000499c
test al, al
jne 0x14000226e
lea rdx, [0x140021388]
lea rcx, [rbp + 0x1840]
call fcn.140004d08
mov rdi, rax
test rax, rax
je 0x14000226e
mov r9, rax
mov rdx, r15
test r12b, r12b
je 0x140002254
mov r8d, 0x14
lea rcx, [0x14002e140]
jmp 0x140002261
mov r8d, 0x16
lea rcx, [0x14002e158]
call fcn.140010374
mov rcx, rdi
call fcn.1400100c8
lea r9, [rbp + 0x1840]
mov rcx, rbx
lea r8, [0x1400212d0]
lea rdx, [rbp + 0x840]
call fcn.140008b48
jmp 0x1400024be
mov r9, rdi
lea r8, str.Setup_s
mov edx, 0x50
lea rcx, [rbp - 0x80]
call fcn.140003a6c
mov rcx, rdi
call fcn.140001768
test al, al
je 0x1400024be
mov r15d, 1
lea rdx, str.Exist
mov r8d, r15d
lea rcx, [rbp - 0x80]
call fcn.140008794
test eax, eax
lea rsi, [0x1400207a0]
mov r13d, 0x200
lea r8, [rbp + 0x40]
setne bl
mov dword [rsp + 0x20], r13d
mov r9, rsi
mov byte [rsp + 0x30], bl
lea rdx, str.Type
lea rcx, [rbp - 0x80]
call fcn.1400088f4
lea rdx, [0x140020b30]
lea rcx, [rbp + 0x40]
call fcn.1400076bc
xor r14d, r14d
test eax, eax
je 0x14000232e
lea rdx, str.WinRAR.ZIP
lea rcx, [rbp + 0x40]
call fcn.1400076bc
test eax, eax
jne 0x140002333
mov word [rbp + 0x40], r14w
mov r9, rsi
mov dword [rsp + 0x20], r13d
lea r8, [rbp + 0x440]
lea rdx, str.Content
lea rcx, [rbp - 0x80]
call fcn.1400088f4
xor r13d, r13d
lea r14, str.Content_Type
test bl, bl
mov rbx, 0xffffffff80000000
mov rcx, rbx
je 0x140002418
lea r9, [rbp + 0x40]
mov r8, rsi
mov rdx, rdi
call fcn.140008b48
mov r8, r14
mov rdx, rdi
mov rcx, rbx
cmp word [rbp + 0x440], r13w
je 0x14000239e
lea r9, [rbp + 0x440]
call fcn.140008b48
jmp 0x1400023a3
call fcn.140008618
mov r9, rsi
mov dword [rsp + 0x20], 0x800
lea r8, [rbp + 0x1840]
lea rdx, str.ShellNew
lea rcx, [rbp - 0x80]
call fcn.1400088f4
lea r8, [0x1400212d0]
mov rcx, rbx
lea rdx, [rbp + 0x840]
call fcn.140008618
movzx eax, word [rbp + 0x1840]
test ax, ax
je 0x140002440
lea rdx, [rbp + 0x840]
mov rcx, rbx
cmp ax, 0x2a
jne 0x140002403
mov r9, rsi
lea r8, str.NullFile
jmp 0x140002411
lea r9, [rbp + 0x1840]
lea r8, [0x1400212d0]
call fcn.140008b48
jmp 0x140002440
lea rdx, [rbp + 0x840]
call fcn.140008598
mov r9, rsi
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
call fcn.140008b48
mov rdx, rdi
mov rcx, rbx
call fcn.140008598
test r12b, r12b
je 0x1400024be
mov r12b, byte [rsp + 0x30]
mov edi, r13d
mov r9d, edi
lea r8, str..r_02d
mov edx, 0x20
lea rcx, [rsp + 0x40]
call fcn.140003a6c
test r12b, r12b
je 0x1400024a9
cmp word [rbp + 0x40], r13w
je 0x1400024a9
lea r9, [rbp + 0x40]
mov r8, rsi
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140008b48
cmp word [rbp + 0x440], r13w
je 0x1400024b6
lea r9, [rbp + 0x440]
mov r8, r14
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140008b48
jmp 0x1400024b6
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140008598
add edi, r15d
cmp edi, 0x64
jl 0x14000244d
mov rcx, qword [rbp + 0x2840]
xor rcx, rsp
call fcn.14000a9c0
mov rbx, qword [rsp + 0x2998]
add rsp, 0x2950
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret