Function at 0x1400034e4
Capabilities:
Check if file exists
Check os version
Get file attributes
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0xf20
mov rax, qword [0x140018280]
xor rax, rsp
mov qword [rsp + 0xf10], rax
mov byte [rsp + 0x30], r8b
mov bl, dl
mov rsi, rcx
mov r8, rcx
lea rdx, str._sShellNew
lea rcx, [rsp + 0x710]
mov bpl, r9b
mov byte [0x140018228], 0x52
mov byte [0x140018210], 0x50
call fcn.140007180
test bl, bl
je 0x1400038a6
mov rcx, rsi
call fcn.140002780
lea rbx, [0x1400137ff]
mov rdi, 0xffffffff80000000
test al, al
jne 0x1400036a1
mov r14d, 0x200
lea r9, [rsp + 0x310]
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rbx
call fcn.14000454c
lea r9, [rsp + 0x110]
lea r8, str.Content_Type
mov rdx, rsi
mov rcx, rdi
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rbx
call fcn.14000454c
lea r9, [rsp + 0xb10]
lea r8, str.FileName
lea rdx, [rsp + 0x710]
mov rcx, rdi
mov dword [rsp + 0x28], 0x400
mov qword [rsp + 0x20], rbx
call fcn.14000454c
lea r9, [rsp + 0x100]
lea r8, str.NullFile
lea rdx, [rsp + 0x710]
mov rcx, rdi
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], rbx
call fcn.14000454c
lea rdx, str.Setup_s
lea rcx, [rsp + 0x40]
mov r8, rsi
mov r13b, al
call fcn.140007180
mov rdx, rsi
mov rcx, rdi
call fcn.140004240
lea rdx, str.Exist
lea rcx, [rsp + 0x40]
movzx r8d, al
call fcn.1400046b0
lea r8, [rsp + 0x310]
lea rdx, str.Type
lea rcx, [rsp + 0x40]
call fcn.140004698
lea r8, [rsp + 0x110]
lea rdx, str.Content
lea rcx, [rsp + 0x40]
call fcn.140004698
cmp byte [rsp + 0xb10], 0
jne 0x140003688
lea r8, [0x140013e54]
test r13b, r13b
jne 0x140003690
lea r8, [rsp + 0xb10]
lea rdx, str.ShellNew
lea rcx, [rsp + 0x40]
call fcn.140004698
mov r15b, byte [rsp + 0xf70]
lea rdx, str.WinRAR.ZIP
lea r9, [0x140013ac0]
test r15b, r15b
mov r8, rbx
mov rcx, rdi
cmovne r9, rdx
mov rdx, rsi
call fcn.140004404
lea r8, str.Content_Type
mov rdx, rsi
mov rcx, rdi
call fcn.140004080
mov r13d, 1
test bpl, bpl
je 0x14000374f
call fcn.140003dbc
neg eax
sbb esi, esi
xor r14d, r14d
and esi, 0xffffffba
add esi, 0x64
test esi, esi
jle 0x14000374f
lea rdx, str..r_02d
lea rcx, [rsp + 0xe0]
mov r8d, r14d
call fcn.140007180
lea r9, [0x140013ac0]
lea rdx, [rsp + 0xe0]
mov r8, rbx
mov rcx, rdi
call fcn.140004404
lea r8, str.Content_Type
lea rdx, [rsp + 0xe0]
mov rcx, rdi
call fcn.140004080
add r14d, r13d
cmp r14d, esi
jl 0x1400036ff
cmp byte [rsp + 0x30], 0
je 0x140003afd
test r15b, r15b
jne 0x140003768
test bpl, bpl
je 0x140003afd
lea rdx, [rsp + 0x710]
mov rcx, rdi
call fcn.140004024
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x44], 4
ja 0x1400037dc
cmp dword [rsp + 0x48], 0xa
ja 0x1400037dc
lea r8, str.Data
lea rdx, [rsp + 0x710]
mov rcx, rdi
test bpl, bpl
je 0x1400037ca
mov qword [rsp + 0x20], 0x14
lea r9, [0x140018228]
call fcn.1400044e0
jmp 0x140003afd
mov qword [rsp + 0x20], 0x16
lea r9, [0x140018210]
jmp 0x1400037c0
lea rdx, [rsp + 0x310]
mov r8d, 0x400
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rax, str.rarnew.dat
lea rbx, str.zipnew.dat
lea rcx, [rsp + 0x310]
test bpl, bpl
cmovne rbx, rax
call fcn.140003e30
mov rdx, rbx
mov rcx, rax
call fcn.140006ee8
lea rcx, [rsp + 0x310]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x140003882
lea rdx, [0x140013e10]
lea rcx, [rsp + 0x310]
call fcn.140007d7c
mov rbx, rax
test rax, rax
je 0x140003882
mov r9, rax
mov rdx, r13
test bpl, bpl
je 0x140003868
mov r8d, 0x14
lea rcx, [0x140018228]
jmp 0x140003875
mov r8d, 0x16
lea rcx, [0x140018210]
call fcn.140007ba0
mov rcx, rbx
call fcn.14000798c
lea r9, [rsp + 0x310]
lea r8, str.FileName
lea rdx, [rsp + 0x710]
mov rcx, rdi
call fcn.140004404
jmp 0x140003afd
lea rdx, str.Setup_s
lea rcx, [rsp + 0x40]
mov r8, rsi
call fcn.140007180
mov rcx, rsi
call fcn.140002780
test al, al
je 0x140003afd
mov r13d, 1
lea rdx, str.Exist
lea rcx, [rsp + 0x40]
mov r8d, r13d
call fcn.1400046f4
lea rbx, [0x1400137ff]
lea r8, [rsp + 0x110]
test eax, eax
lea rdx, str.Type
lea rcx, [rsp + 0x40]
mov r14d, 0x200
mov r9, rbx
setne r15b
mov dword [rsp + 0x20], r14d
call fcn.1400046c8
lea rdx, [0x140013ac0]
lea rcx, [rsp + 0x110]
call fcn.140012344
test eax, eax
je 0x140003948
lea rdx, str.WinRAR.ZIP
lea rcx, [rsp + 0x110]
call fcn.140012344
test eax, eax
jne 0x140003950
mov byte [rsp + 0x110], 0
lea r8, [rsp + 0x310]
lea rdx, str.Content
lea rcx, [rsp + 0x40]
mov r9, rbx
mov dword [rsp + 0x20], r14d
call fcn.1400046c8
xor r14d, r14d
mov rdi, 0xffffffff80000000
mov rcx, rdi
cmp r15b, r14b
je 0x140003a40
lea r9, [rsp + 0x110]
mov r8, rbx
mov rdx, rsi
call fcn.140004404
lea r8, str.Content_Type
mov rdx, rsi
mov rcx, rdi
cmp byte [rsp + 0x310], r14b
je 0x1400039c0
lea r9, [rsp + 0x310]
call fcn.140004404
jmp 0x1400039c5
call fcn.140004080
lea r8, [rsp + 0xb10]
lea rdx, str.ShellNew
lea rcx, [rsp + 0x40]
mov r9, rbx
mov dword [rsp + 0x20], 0x400
call fcn.1400046c8
lea r8, str.FileName
lea rdx, [rsp + 0x710]
mov rcx, rdi
call fcn.140004080
mov r11b, byte [rsp + 0xb10]
cmp r11b, r14b
je 0x140003a69
lea rdx, [rsp + 0x710]
mov rcx, rdi
cmp r11b, 0x2a
jne 0x140003a2a
mov r9, rbx
lea r8, str.NullFile
jmp 0x140003a39
lea r9, [rsp + 0xb10]
lea r8, str.FileName
call fcn.140004404
jmp 0x140003a69
lea rdx, [rsp + 0x710]
call fcn.140004024
mov r9, rbx
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
call fcn.140004404
mov rdx, rsi
mov rcx, rdi
call fcn.140004024
cmp bpl, r14b
je 0x140003afd
mov esi, r14d
lea rdx, str..r_02d
lea rcx, [rsp + 0xe0]
mov r8d, esi
call fcn.140007180
cmp r15b, r14b
je 0x140003ae1
cmp byte [rsp + 0x110], r14b
je 0x140003ae1
lea r9, [rsp + 0x110]
lea rdx, [rsp + 0xe0]
mov r8, rbx
mov rcx, rdi
call fcn.140004404
cmp byte [rsp + 0x310], r14b
je 0x140003af1
lea r9, [rsp + 0x310]
lea r8, str.Content_Type
lea rdx, [rsp + 0xe0]
mov rcx, rdi
call fcn.140004404
jmp 0x140003af1
lea rdx, [rsp + 0xe0]
mov rcx, rdi
call fcn.140004024
add esi, r13d
cmp esi, 0x64
jl 0x140003a75
mov rcx, qword [rsp + 0xf10]
xor rcx, rsp
call fcn.140007160
lea r11, [rsp + 0xf20]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret