Function at 0x140001e9c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3490]
mov eax, 0x3590
call fcn.14000bac0
sub rsp, rax
mov rax, qword [0x1400318e0]
xor rax, rsp
mov qword [rbp + 0x3480], rax
mov r13b, byte [rbp + 0x34f0]
mov sil, r9b
mov r9, rcx
mov byte [0x140031168], 0x52
mov r12b, r8b
mov byte [0x140031180], 0x50
mov r15b, dl
lea r8, str._sShellNew
mov rbx, rcx
mov edx, 0x800
lea rcx, [rbp + 0x1480]
call fcn.140003a3c
mov r9, rbx
lea r8, str.Setup_s
mov edx, 0x50
lea rcx, [rbp + 0xfe0]
call fcn.140003a3c
xor r14d, r14d
lea rdi, [0x1400225f0]
test r15b, r15b
je 0x1400021e4
mov rcx, rbx
call fcn.1400016a8
test al, al
jne 0x140002048
mov dword [rsp + 0x28], 0x200
lea r9, [rbp + 0x1080]
mov r8, rdi
mov qword [rsp + 0x20], rdi
mov rdx, rbx
mov rcx, 0xffffffff80000000
call fcn.14000971c
lea r9, [rbp + 0x2480]
mov dword [rsp + 0x28], 0x800
lea r8, str.FileName
mov qword [rsp + 0x20], rdi
lea rdx, [rbp + 0x1480]
mov rcx, 0xffffffff80000000
call fcn.14000971c
lea r9, [rbp + 0xfc0]
mov dword [rsp + 0x28], 0xa
lea r8, str.NullFile
mov qword [rsp + 0x20], rdi
lea rdx, [rbp + 0x1480]
mov rcx, 0xffffffff80000000
call fcn.14000971c
mov rdx, rbx
mov rcx, 0xffffffff80000000
mov dil, al
call fcn.1400087d8
movzx r8d, al
lea rdx, str.Exist
lea rcx, [rbp + 0xfe0]
call fcn.140009c40
lea r8, [rbp + 0x1080]
lea rdx, str.Type
lea rcx, [rbp + 0xfe0]
call fcn.140009c28
cmp word [rbp + 0x2480], r14w
jne 0x140002027
lea r8, [0x140023300]
test dil, dil
jne 0x14000202e
lea r8, [rbp + 0x2480]
lea rdx, str.ShellNew
lea rcx, [rbp + 0xfe0]
call fcn.140009c28
lea rdi, [0x1400225f0]
lea rax, str.WinRAR.ZIP
test r13b, r13b
lea r9, [0x140022b60]
mov r8, rdi
cmovne r9, rax
mov rdx, rbx
mov rcx, 0xffffffff80000000
call fcn.140009ac0
test sil, sil
je 0x1400020ca
call fcn.1400058ac
neg eax
sbb edi, edi
and edi, 0xffffffba
add edi, 0x64
mov r9d, r14d
lea r8, str..r_02u
mov edx, 0x20
lea rcx, [rbp + 0xf80]
call fcn.140003a3c
lea r9, [0x140022b60]
mov rcx, 0xffffffff80000000
lea r8, [0x1400225f0]
lea rdx, [rbp + 0xf80]
call fcn.140009ac0
inc r14d
cmp r14d, edi
jb 0x140002083
xor r14d, r14d
test r12b, r12b
je 0x1400021e4
test r13b, r13b
jne 0x1400020e1
test sil, sil
je 0x1400021e4
lea rdx, [rbp + 0x1480]
mov rcx, 0xffffffff80000000
call fcn.1400094fc
mov edi, 0x800
lea rdx, [rbp + 0x2480]
mov r8d, edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rax, str.rarnew.dat
test sil, sil
lea rdx, str.zipnew.dat
mov r8d, edi
cmovne rdx, rax
lea rcx, [rbp + 0x2480]
call fcn.140006034
xor r8d, r8d
mov qword [rbp + 0xf40], r14
lea rdx, [rsp + 0x30]
mov qword [rbp + 0xf48], r14
lea rcx, [rbp + 0x2480]
mov qword [rbp + 0xf50], r14
call fcn.140005584
test al, al
je 0x140002174
mov al, sil
neg al
sbb rcx, rcx
and ecx, 2
add rcx, 0x16
cmp qword [rbp + 0xf30], rcx
je 0x1400021c3
lea rdx, [0x1400233d8]
lea rcx, [rbp + 0x2480]
call fcn.140004e50
mov rdi, rax
test rax, rax
je 0x1400021c3
mov r9, rax
mov edx, 1
test sil, sil
je 0x1400021a9
lea r8d, [rdx + 0x17]
lea rcx, [0x140031168]
jmp 0x1400021b6
mov r8d, 0x16
lea rcx, [0x140031180]
call fcn.140012188
mov rcx, rdi
call fcn.140011edc
lea r9, [rbp + 0x2480]
mov rcx, 0xffffffff80000000
lea r8, str.FileName
lea rdx, [rbp + 0x1480]
call fcn.140009ac0
mov rcx, rbx
call fcn.1400016a8
test al, al
je 0x1400023ca
test r15b, r15b
je 0x140002202
test r12b, r12b
jne 0x1400023ca
mov r8d, 1
lea rdx, str.Exist
lea rcx, [rbp + 0xfe0]
call fcn.140009704
test eax, eax
lea r12, [0x1400225f0]
setne dil
test r15b, r15b
jne 0x140002325
mov r9, r12
mov dword [rsp + 0x20], 0x200
lea r8, [rbp + 0x1080]
lea rdx, str.Type
lea rcx, [rbp + 0xfe0]
call fcn.140009864
lea rdx, [0x140022b60]
lea rcx, [rbp + 0x1080]
call fcn.1400085bc
test eax, eax
je 0x140002284
lea rdx, str.WinRAR.ZIP
lea rcx, [rbp + 0x1080]
call fcn.1400085bc
test eax, eax
jne 0x14000228c
mov word [rbp + 0x1080], r14w
mov r15, 0xffffffff80000000
mov r8, r12
mov rcx, r15
mov rdx, rbx
test dil, dil
je 0x1400022af
lea r9, [rbp + 0x1080]
call fcn.140009ac0
jmp 0x1400022c2
mov r9, r12
call fcn.140009ac0
mov rdx, rbx
mov rcx, r15
call fcn.1400094fc
test sil, sil
je 0x140002325
mov ebx, r14d
mov r9d, ebx
lea r8, str..r_02u
mov edx, 0x20
lea rcx, [rbp + 0xf80]
call fcn.140003a3c
test dil, dil
je 0x14000230f
cmp word [rbp + 0x1080], r14w
je 0x14000230f
lea r9, [rbp + 0x1080]
mov r8, r12
lea rdx, [rbp + 0xf80]
mov rcx, r15
call fcn.140009ac0
jmp 0x14000231e
lea rdx, [rbp + 0xf80]
mov rcx, r15
call fcn.1400094fc
inc ebx
cmp ebx, 0x64
jb 0x1400022ca
test r13b, r13b
jne 0x140002333
test sil, sil
je 0x1400023ca
test dil, dil
je 0x1400023b7
mov r9, r12
mov dword [rsp + 0x20], 0x800
lea r8, [rbp + 0x2480]
lea rdx, str.ShellNew
lea rcx, [rbp + 0xfe0]
call fcn.140009864
mov rbx, 0xffffffff80000000
lea r8, str.FileName
mov rcx, rbx
lea rdx, [rbp + 0x1480]
call fcn.14000957c
movzx eax, word [rbp + 0x2480]
test ax, ax
je 0x1400023ca
lea rdx, [rbp + 0x1480]
mov rcx, rbx
cmp ax, 0x2a
jne 0x1400023a2
mov r9, r12
lea r8, str.NullFile
jmp 0x1400023b0
lea r9, [rbp + 0x2480]
lea r8, str.FileName
call fcn.140009ac0
jmp 0x1400023ca
lea rdx, [rbp + 0x1480]
mov rcx, 0xffffffff80000000
call fcn.1400094fc
mov rcx, qword [rbp + 0x3480]
xor rcx, rsp
call fcn.14000bb30
mov rbx, qword [rsp + 0x35d8]
add rsp, 0x3590
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret