Function at 0x441ef0
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x1cf8
call fcn.004af5f0
mov eax, dword [0x4d8620]
xor eax, esp
mov dword [esp + 0x1cf4], eax
push ebx
push esi
mov esi, ecx
push esi
lea eax, [esp + 0xd00]
push str._sShellNew
push eax
mov edx, 0x400
mov byte [0x4d707c], 0x52
mov byte [0x4d7064], 0x50
call fcn.004a5ca0
add esp, 0xc
cmp byte [esp + 0x1d04], 0
push esi
je 0x44221a
call fcn.00440b00
test al, al
jne 0x442081
push 0x200
push 0x4c5d70
lea ecx, [esp + 0x504]
push ecx
push 0x4c5d70
push esi
push 0x80000000
call fcn.0045f590
push 0x200
push 0x4c5d70
lea edx, [esp + 0x104]
push edx
push str.Content_Type
push esi
push 0x80000000
call fcn.0045f590
push 0x400
push 0x4c5d70
lea eax, [esp + 0x1504]
push eax
push str.FileName
lea ecx, [esp + 0xd0c]
push ecx
push 0x80000000
call fcn.0045f590
push 0xa
push 0x4c5d70
lea edx, [esp + 0xf0]
push edx
push str.NullFile
lea eax, [esp + 0xd0c]
push eax
push 0x80000000
call fcn.0045f590
push esi
lea ecx, [esp + 0x4c]
push str.Setup_s
push ecx
mov edx, 0x50
mov bl, al
call fcn.004a5ca0
add esp, 0xc
push esi
push 0x80000000
call fcn.0045f2c0
movzx edx, al
push edx
push str.Exist
lea eax, [esp + 0x50]
push eax
call fcn.0045faf0
lea ecx, [esp + 0x4fc]
push ecx
push str.Type
lea edx, [esp + 0x50]
push edx
call fcn.0045fad0
lea eax, [esp + 0xfc]
push eax
push str.Content
lea ecx, [esp + 0x50]
push ecx
call fcn.0045fad0
cmp word [esp + 0x14fc], 0
jne 0x44206a
test bl, bl
je 0x44206a
push 0x4c5f34
push str.ShellNew
lea edx, [esp + 0x50]
push edx
jmp 0x44207c
lea eax, [esp + 0x14fc]
push eax
push str.ShellNew
lea ecx, [esp + 0x50]
push ecx
call fcn.0045fad0
cmp byte [esp + 0x1d10], 0
mov eax, str.WinRAR.ZIP
jne 0x442095
mov eax, 0x4c7efc
push eax
push 0x4c5d70
push esi
push 0x80000000
call fcn.0045f520
push str.Content_Type
push esi
push 0x80000000
call fcn.0045f1a0
mov bl, byte [esp + 0x1d0c]
test bl, bl
je 0x44212b
push edi
call fcn.00442d90
mov edi, eax
neg edi
sbb edi, edi
and edi, 0xffffffba
add edi, 0x64
xor esi, esi
test edi, edi
jle 0x44212a
lea esp, [esp]
push esi
lea edx, [esp + 0x10]
push str..r_02d
push edx
mov edx, 0x20
call fcn.004a5ca0
add esp, 0xc
push 0x4c7efc
push 0x4c5d70
lea eax, [esp + 0x14]
push eax
push 0x80000000
call fcn.0045f520
push str.Content_Type
lea ecx, [esp + 0x10]
push ecx
push 0x80000000
call fcn.0045f1a0
inc esi
cmp esi, edi
jl 0x4420e0
pop edi
cmp byte [esp + 0x1d08], 0
je 0x442475
cmp byte [esp + 0x1d10], 0
jne 0x44214b
test bl, bl
je 0x442475
lea edx, [esp + 0xcfc]
push edx
push 0x80000000
call fcn.0045f0f0
push 0x400
lea eax, [esp + 0x500]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, str.rarnew.dat
test bl, bl
jne 0x442180
mov esi, str.zipnew.dat
lea ecx, [esp + 0x4fc]
push ecx
call fcn.00455b40
lea ecx, [ecx]
movzx ecx, word [esi]
mov word [eax], cx
add esi, 2
add eax, 2
test cx, cx
jne 0x442190
lea edx, [esp + 0x4fc]
push edx
call fcn.00432420
test al, al
jne 0x4421f6
push 0
push 0x4c86e0
lea eax, [esp + 0x504]
push eax
call fcn.00432bd0
mov esi, eax
test esi, esi
je 0x4421f6
push esi
test bl, bl
je 0x4421dc
push 0x14
push 1
push 0x4d707c
jmp 0x4421e5
push 0x16
push 1
push 0x4d7064
call fcn.004b1c88
add esp, 0x10
push esi
call fcn.004b203e
add esp, 4
lea ecx, [esp + 0x4fc]
push ecx
push str.FileName
lea edx, [esp + 0xd04]
push edx
push 0x80000000
call fcn.0045f520
jmp 0x442475
lea eax, [esp + 0x4c]
push str.Setup_s
push eax
mov edx, 0x50
call fcn.004a5ca0
add esp, 0xc
push esi
call fcn.00440b00
test al, al
je 0x442475
push 1
push str.Exist
lea ecx, [esp + 0x50]
push ecx
call fcn.0045fbd0
push 0x200
push 0x4c5d70
lea edx, [esp + 0x104]
push edx
test eax, eax
push str.Type
lea eax, [esp + 0x58]
push eax
setne bl
call fcn.0045fba0
push 0x4c7efc
lea ecx, [esp + 0x100]
push ecx
call fcn.00477c80
test eax, eax
je 0x4422a2
push str.WinRAR.ZIP
lea edx, [esp + 0x100]
push edx
call fcn.00477c80
test eax, eax
jne 0x4422ac
xor eax, eax
mov word [esp + 0xfc], ax
push 0x200
push 0x4c5d70
lea ecx, [esp + 0x504]
push ecx
push str.Content
lea edx, [esp + 0x58]
push edx
call fcn.0045fba0
test bl, bl
je 0x4423ac
lea eax, [esp + 0xfc]
push eax
push 0x4c5d70
push esi
push 0x80000000
call fcn.0045f520
cmp word [esp + 0x4fc], 0
je 0x442312
lea ecx, [esp + 0x4fc]
push ecx
push str.Content_Type
push esi
push 0x80000000
call fcn.0045f520
jmp 0x442322
push str.Content_Type
push esi
push 0x80000000
call fcn.0045f1a0
push 0x400
push 0x4c5d70
lea edx, [esp + 0x1504]
push edx
push str.ShellNew
lea eax, [esp + 0x58]
push eax
call fcn.0045fba0
push str.FileName
lea ecx, [esp + 0xd00]
push ecx
push 0x80000000
call fcn.0045f1a0
mov ax, word [esp + 0x14fc]
test ax, ax
je 0x4423de
cmp ax, 0x2a
jne 0x44238b
push 0x4c5d70
push str.NullFile
lea edx, [esp + 0xd04]
push edx
push 0x80000000
call fcn.0045f520
jmp 0x4423de
lea eax, [esp + 0x14fc]
push eax
push str.FileName
lea ecx, [esp + 0xd04]
push ecx
push 0x80000000
call fcn.0045f520
jmp 0x4423de
lea edx, [esp + 0xcfc]
push edx
push 0x80000000
call fcn.0045f0f0
push 0x4c5d70
push 0x4c5d70
push esi
push 0x80000000
call fcn.0045f520
push esi
push 0x80000000
call fcn.0045f0f0
cmp byte [esp + 0x1d0c], 0
je 0x442475
xor esi, esi
mov edi, edi
push esi
lea eax, [esp + 0xc]
push str..r_02d
push eax
mov edx, 0x20
call fcn.004a5ca0
add esp, 0xc
test bl, bl
je 0x44245c
cmp word [esp + 0xfc], 0
je 0x44245c
lea ecx, [esp + 0xfc]
push ecx
push 0x4c5d70
lea edx, [esp + 0x10]
push edx
push 0x80000000
call fcn.0045f520
cmp word [esp + 0x4fc], 0
je 0x44246b
lea eax, [esp + 0x4fc]
push eax
push str.Content_Type
lea ecx, [esp + 0x10]
push ecx
push 0x80000000
call fcn.0045f520
jmp 0x44246b
lea edx, [esp + 8]
push edx
push 0x80000000
call fcn.0045f0f0
inc esi
cmp esi, 0x64
jl 0x4423f0
mov ecx, dword [esp + 0x1cfc]
pop esi
pop ebx
xor ecx, esp
call fcn.004aedbb
add esp, 0x1cf8
ret 0x10