Function at 0x14003a7a4
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3490]
mov eax, 0x3590
call fcn.1400f31b0
sub rsp, rax
mov rax, qword [0x1401542d0]
xor rax, rsp
mov qword [rbp + 0x3480], rax
mov r13b, byte [rbp + 0x34f0]
mov sil, r9b
mov r9, rcx
mov byte [0x14014af58], 0x52
mov r12b, r8b
mov byte [0x14014af70], 0x50
mov r15b, dl
lea r8, str._sShellNew
mov rbx, rcx
mov edx, 0x800
lea rcx, [rbp + 0x1480]
call fcn.140002694
mov r9, rbx
lea r8, str.Setup_s
mov edx, 0x50
lea rcx, [rbp + 0xfe0]
call fcn.140002694
xor r14d, r14d
lea rdi, [0x140111128]
test r15b, r15b
je 0x14003aaec
mov rcx, rbx
call fcn.140039e48
test al, al
jne 0x14003a950
mov dword [rsp + 0x28], 0x200
lea r9, [rbp + 0x1080]
mov r8, rdi
mov qword [rsp + 0x20], rdi
mov rdx, rbx
mov rcx, 0xffffffff80000000
call fcn.1400a05c8
lea r9, [rbp + 0x2480]
mov dword [rsp + 0x28], 0x800
lea r8, str.FileName
mov qword [rsp + 0x20], rdi
lea rdx, [rbp + 0x1480]
mov rcx, 0xffffffff80000000
call fcn.1400a05c8
lea r9, [rbp + 0xfc0]
mov dword [rsp + 0x28], 0xa
lea r8, str.NullFile
mov qword [rsp + 0x20], rdi
lea rdx, [rbp + 0x1480]
mov rcx, 0xffffffff80000000
call fcn.1400a05c8
mov rdx, rbx
mov rcx, 0xffffffff80000000
mov dil, al
call fcn.14009e838
movzx r8d, al
lea rdx, str.Exist
lea rcx, [rbp + 0xfe0]
call fcn.1400a11c0
lea r8, [rbp + 0x1080]
lea rdx, [0x140112140]
lea rcx, [rbp + 0xfe0]
call fcn.1400a11a8
cmp word [rbp + 0x2480], r14w
jne 0x14003a92f
lea r8, [0x140111558]
test dil, dil
jne 0x14003a936
lea r8, [rbp + 0x2480]
lea rdx, str.ShellNew
lea rcx, [rbp + 0xfe0]
call fcn.1400a11a8
lea rdi, [0x140111128]
lea rax, str.WinRAR.ZIP
test r13b, r13b
lea r9, [0x1401162e0]
mov r8, rdi
cmovne r9, rax
mov rdx, rbx
mov rcx, 0xffffffff80000000
call fcn.1400a0fcc
test sil, sil
je 0x14003a9d2
call fcn.14006c97c
neg eax
sbb edi, edi
and edi, 0xffffffba
add edi, 0x64
mov r9d, r14d
lea r8, str..r_02u
mov edx, 0x20
lea rcx, [rbp + 0xf80]
call fcn.140002694
lea r9, [0x1401162e0]
mov rcx, 0xffffffff80000000
lea r8, [0x140111128]
lea rdx, [rbp + 0xf80]
call fcn.1400a0fcc
inc r14d
cmp r14d, edi
jb 0x14003a98b
xor r14d, r14d
test r12b, r12b
je 0x14003aaec
test r13b, r13b
jne 0x14003a9e9
test sil, sil
je 0x14003aaec
lea rdx, [rbp + 0x1480]
mov rcx, 0xffffffff80000000
call fcn.14009fea0
mov edi, 0x800
lea rdx, [rbp + 0x2480]
mov r8d, edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rax, str.rarnew.dat
test sil, sil
lea rdx, str.zipnew.dat
mov r8d, edi
cmovne rdx, rax
lea rcx, [rbp + 0x2480]
call fcn.140079d58
xor r8d, r8d
mov qword [rbp + 0xf40], r14
lea rdx, [rsp + 0x30]
mov qword [rbp + 0xf48], r14
lea rcx, [rbp + 0x2480]
mov qword [rbp + 0xf50], r14
call fcn.14006a780
test al, al
je 0x14003aa7c
mov al, sil
neg al
sbb rcx, rcx
and ecx, 2
add rcx, 0x16
cmp qword [rbp + 0xf30], rcx
je 0x14003aacb
lea rdx, [0x140111b28]
lea rcx, [rbp + 0x2480]
call fcn.14006a1b0
mov rdi, rax
test rax, rax
je 0x14003aacb
mov r9, rax
mov edx, 1
test sil, sil
je 0x14003aab1
lea r8d, [rdx + 0x17]
lea rcx, [0x14014af58]
jmp 0x14003aabe
mov r8d, 0x16
lea rcx, [0x14014af70]
call fcn.1400fa838
mov rcx, rdi
call fcn.1400fa46c
lea r9, [rbp + 0x2480]
mov rcx, 0xffffffff80000000
lea r8, str.FileName
lea rdx, [rbp + 0x1480]
call fcn.1400a0fcc
mov rcx, rbx
call fcn.140039e48
test al, al
je 0x14003acd2
test r15b, r15b
je 0x14003ab0a
test r12b, r12b
jne 0x14003acd2
mov r8d, 1
lea rdx, str.Exist
lea rcx, [rbp + 0xfe0]
call fcn.1400a0584
test eax, eax
lea r12, [0x140111128]
setne dil
test r15b, r15b
jne 0x14003ac2d
mov r9, r12
mov dword [rsp + 0x20], 0x200
lea r8, [rbp + 0x1080]
lea rdx, [0x140112140]
lea rcx, [rbp + 0xfe0]
call fcn.1400a0710
lea rdx, [0x1401162e0]
lea rcx, [rbp + 0x1080]
call fcn.1400920d4
test eax, eax
je 0x14003ab8c
lea rdx, str.WinRAR.ZIP
lea rcx, [rbp + 0x1080]
call fcn.1400920d4
test eax, eax
jne 0x14003ab94
mov word [rbp + 0x1080], r14w
mov r15, 0xffffffff80000000
mov r8, r12
mov rcx, r15
mov rdx, rbx
test dil, dil
je 0x14003abb7
lea r9, [rbp + 0x1080]
call fcn.1400a0fcc
jmp 0x14003abca
mov r9, r12
call fcn.1400a0fcc
mov rdx, rbx
mov rcx, r15
call fcn.14009fea0
test sil, sil
je 0x14003ac2d
mov ebx, r14d
mov r9d, ebx
lea r8, str..r_02u
mov edx, 0x20
lea rcx, [rbp + 0xf80]
call fcn.140002694
test dil, dil
je 0x14003ac17
cmp word [rbp + 0x1080], r14w
je 0x14003ac17
lea r9, [rbp + 0x1080]
mov r8, r12
lea rdx, [rbp + 0xf80]
mov rcx, r15
call fcn.1400a0fcc
jmp 0x14003ac26
lea rdx, [rbp + 0xf80]
mov rcx, r15
call fcn.14009fea0
inc ebx
cmp ebx, 0x64
jb 0x14003abd2
test r13b, r13b
jne 0x14003ac3b
test sil, sil
je 0x14003acd2
test dil, dil
je 0x14003acbf
mov r9, r12
mov dword [rsp + 0x20], 0x800
lea r8, [rbp + 0x2480]
lea rdx, str.ShellNew
lea rcx, [rbp + 0xfe0]
call fcn.1400a0710
mov rbx, 0xffffffff80000000
lea r8, str.FileName
mov rcx, rbx
lea rdx, [rbp + 0x1480]
call fcn.14009ff30
movzx eax, word [rbp + 0x2480]
test ax, ax
je 0x14003acd2
lea rdx, [rbp + 0x1480]
mov rcx, rbx
cmp ax, 0x2a
jne 0x14003acaa
mov r9, r12
lea r8, str.NullFile
jmp 0x14003acb8
lea r9, [rbp + 0x2480]
lea r8, str.FileName
call fcn.1400a0fcc
jmp 0x14003acd2
lea rdx, [rbp + 0x1480]
mov rcx, 0xffffffff80000000
call fcn.14009fea0
mov rcx, qword [rbp + 0x3480]
xor rcx, rsp
call fcn.1400f3220
mov rbx, qword [rsp + 0x35d8]
add rsp, 0x3590
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret