Function at 0x43dff0
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x1cf8
call fcn.004a5370
mov eax, dword [0x4cc3b0]
xor eax, esp
mov dword [esp + 0x1cf4], eax
push ebx
push esi
mov esi, ecx
push esi
lea eax, [esp + 0xd00]
push str._sShellNew
push eax
mov edx, 0x400
mov byte [0x4cafdc], 0x52
mov byte [0x4cafc4], 0x50
call fcn.0049c820
add esp, 0xc
cmp byte [esp + 0x1d04], 0
push esi
je 0x43e31a
call fcn.0043cbd0
test al, al
jne 0x43e181
push 0x200
push 0x4bad38
lea ecx, [esp + 0x504]
push ecx
push 0x4bad38
push esi
push 0x80000000
call fcn.0045b470
push 0x200
push 0x4bad38
lea edx, [esp + 0x104]
push edx
push str.Content_Type
push esi
push 0x80000000
call fcn.0045b470
push 0x400
push 0x4bad38
lea eax, [esp + 0x1504]
push eax
push str.FileName
lea ecx, [esp + 0xd0c]
push ecx
push 0x80000000
call fcn.0045b470
push 0xa
push 0x4bad38
lea edx, [esp + 0xf0]
push edx
push str.NullFile
lea eax, [esp + 0xd0c]
push eax
push 0x80000000
call fcn.0045b470
push esi
lea ecx, [esp + 0x4c]
push 0x4bc8d0
push ecx
mov edx, 0x50
mov bl, al
call fcn.0049c820
add esp, 0xc
push esi
push 0x80000000
call fcn.0045b1a0
movzx edx, al
push edx
push str.Exist
lea eax, [esp + 0x50]
push eax
call fcn.0045b9b0
lea ecx, [esp + 0x4fc]
push ecx
push str.Type
lea edx, [esp + 0x50]
push edx
call fcn.0045b990
lea eax, [esp + 0xfc]
push eax
push str.Content
lea ecx, [esp + 0x50]
push ecx
call fcn.0045b990
cmp word [esp + 0x14fc], 0
jne 0x43e16a
test bl, bl
je 0x43e16a
push 0x4baefc
push str.ShellNew
lea edx, [esp + 0x50]
push edx
jmp 0x43e17c
lea eax, [esp + 0x14fc]
push eax
push str.ShellNew
lea ecx, [esp + 0x50]
push ecx
call fcn.0045b990
cmp byte [esp + 0x1d10], 0
mov eax, str.WinRAR.ZIP
jne 0x43e195
mov eax, 0x4bc770
push eax
push 0x4bad38
push esi
push 0x80000000
call fcn.0045b400
push str.Content_Type
push esi
push 0x80000000
call fcn.0045b080
mov bl, byte [esp + 0x1d0c]
test bl, bl
je 0x43e22b
push edi
call fcn.0043ee90
mov edi, eax
neg edi
sbb edi, edi
and edi, 0xffffffba
add edi, 0x64
xor esi, esi
test edi, edi
jle 0x43e22a
lea esp, [esp]
push esi
lea edx, [esp + 0x10]
push str..r_02d
push edx
mov edx, 0x20
call fcn.0049c820
add esp, 0xc
push 0x4bc770
push 0x4bad38
lea eax, [esp + 0x14]
push eax
push 0x80000000
call fcn.0045b400
push str.Content_Type
lea ecx, [esp + 0x10]
push ecx
push 0x80000000
call fcn.0045b080
inc esi
cmp esi, edi
jl 0x43e1e0
pop edi
cmp byte [esp + 0x1d08], 0
je 0x43e575
cmp byte [esp + 0x1d10], 0
jne 0x43e24b
test bl, bl
je 0x43e575
lea edx, [esp + 0xcfc]
push edx
push 0x80000000
call fcn.0045afd0
push 0x400
lea eax, [esp + 0x500]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, str.rarnew.dat
test bl, bl
jne 0x43e280
mov esi, str.zipnew.dat
lea ecx, [esp + 0x4fc]
push ecx
call fcn.00451c20
lea ecx, [ecx]
movzx ecx, word [esi]
mov word [eax], cx
add esi, 2
add eax, 2
test cx, cx
jne 0x43e290
lea edx, [esp + 0x4fc]
push edx
call fcn.004317d0
test al, al
jne 0x43e2f6
push 0
push 0x4bae08
lea eax, [esp + 0x504]
push eax
call fcn.00432070
mov esi, eax
test esi, esi
je 0x43e2f6
push esi
test bl, bl
je 0x43e2dc
push 0x14
push 1
push 0x4cafdc
jmp 0x43e2e5
push 0x16
push 1
push 0x4cafc4
call fcn.004a6e34
add esp, 0x10
push esi
call fcn.004a6c05
add esp, 4
lea ecx, [esp + 0x4fc]
push ecx
push str.FileName
lea edx, [esp + 0xd04]
push edx
push 0x80000000
call fcn.0045b400
jmp 0x43e575
lea eax, [esp + 0x4c]
push 0x4bc8d0
push eax
mov edx, 0x50
call fcn.0049c820
add esp, 0xc
push esi
call fcn.0043cbd0
test al, al
je 0x43e575
push 1
push str.Exist
lea ecx, [esp + 0x50]
push ecx
call fcn.0045ba90
push 0x200
push 0x4bad38
lea edx, [esp + 0x104]
push edx
test eax, eax
push str.Type
lea eax, [esp + 0x58]
push eax
setne bl
call fcn.0045ba60
push 0x4bc770
lea ecx, [esp + 0x100]
push ecx
call fcn.00473520
test eax, eax
je 0x43e3a2
push str.WinRAR.ZIP
lea edx, [esp + 0x100]
push edx
call fcn.00473520
test eax, eax
jne 0x43e3ac
xor eax, eax
mov word [esp + 0xfc], ax
push 0x200
push 0x4bad38
lea ecx, [esp + 0x504]
push ecx
push str.Content
lea edx, [esp + 0x58]
push edx
call fcn.0045ba60
test bl, bl
je 0x43e4ac
lea eax, [esp + 0xfc]
push eax
push 0x4bad38
push esi
push 0x80000000
call fcn.0045b400
cmp word [esp + 0x4fc], 0
je 0x43e412
lea ecx, [esp + 0x4fc]
push ecx
push str.Content_Type
push esi
push 0x80000000
call fcn.0045b400
jmp 0x43e422
push str.Content_Type
push esi
push 0x80000000
call fcn.0045b080
push 0x400
push 0x4bad38
lea edx, [esp + 0x1504]
push edx
push str.ShellNew
lea eax, [esp + 0x58]
push eax
call fcn.0045ba60
push str.FileName
lea ecx, [esp + 0xd00]
push ecx
push 0x80000000
call fcn.0045b080
mov ax, word [esp + 0x14fc]
test ax, ax
je 0x43e4de
cmp ax, 0x2a
jne 0x43e48b
push 0x4bad38
push str.NullFile
lea edx, [esp + 0xd04]
push edx
push 0x80000000
call fcn.0045b400
jmp 0x43e4de
lea eax, [esp + 0x14fc]
push eax
push str.FileName
lea ecx, [esp + 0xd04]
push ecx
push 0x80000000
call fcn.0045b400
jmp 0x43e4de
lea edx, [esp + 0xcfc]
push edx
push 0x80000000
call fcn.0045afd0
push 0x4bad38
push 0x4bad38
push esi
push 0x80000000
call fcn.0045b400
push esi
push 0x80000000
call fcn.0045afd0
cmp byte [esp + 0x1d0c], 0
je 0x43e575
xor esi, esi
mov edi, edi
push esi
lea eax, [esp + 0xc]
push str..r_02d
push eax
mov edx, 0x20
call fcn.0049c820
add esp, 0xc
test bl, bl
je 0x43e55c
cmp word [esp + 0xfc], 0
je 0x43e55c
lea ecx, [esp + 0xfc]
push ecx
push 0x4bad38
lea edx, [esp + 0x10]
push edx
push 0x80000000
call fcn.0045b400
cmp word [esp + 0x4fc], 0
je 0x43e56b
lea eax, [esp + 0x4fc]
push eax
push str.Content_Type
lea ecx, [esp + 0x10]
push ecx
push 0x80000000
call fcn.0045b400
jmp 0x43e56b
lea edx, [esp + 8]
push edx
push 0x80000000
call fcn.0045afd0
inc esi
cmp esi, 0x64
jl 0x43e4f0
mov ecx, dword [esp + 0x1cfc]
pop esi
pop ebx
xor ecx, esp
call fcn.004a4b43
add esp, 0x1cf8
ret 0x10