Function at 0x401c14
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x3540
call fcn.0040a2d0
mov eax, dword [0x42a664]
xor eax, esp
mov dword [esp + 0x353c], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x3554]
lea eax, [esp + 0x154c]
push edi
push str._sShellNew
push 0x800
push eax
mov byte [0x42a0d8], 0x52
mov byte [0x42a0f0], 0x50
call fcn.0040346f
push edi
push str.Setup_s
lea eax, [esp + 0x10c4]
push 0x50
push eax
call fcn.0040346f
mov bh, byte [esp + 0x3578]
add esp, 0x20
xor ebp, ebp
mov esi, 0x80000000
test bh, bh
je 0x401ef1
push edi
call fcn.00401584
test al, al
jne 0x401d63
push 0x200
mov ecx, 0x420490
lea eax, [esp + 0x1150]
push ecx
push eax
push ecx
push edi
push esi
call fcn.0040849e
push 0x800
push 0x420490
lea eax, [esp + 0x2554]
push eax
push str.FileName
lea eax, [esp + 0x155c]
push eax
push esi
call fcn.0040849e
push 0xa
push 0x420490
lea eax, [esp + 0x10a0]
push eax
push str.NullFile
lea eax, [esp + 0x155c]
push eax
push esi
call fcn.0040849e
push edi
push esi
mov bl, al
call fcn.004077b7
movzx ecx, al
lea eax, [esp + 0x10ac]
push ecx
push str.Exist
push eax
call fcn.004088e1
lea eax, [esp + 0x114c]
push eax
push str.Type
lea eax, [esp + 0x10b4]
push eax
call fcn.004088c8
cmp word [esp + 0x254c], bp
jne 0x401d49
test bl, bl
je 0x401d49
push 0x4210cc
jmp 0x401d51
lea eax, [esp + 0x254c]
push eax
push str.ShellNew
lea eax, [esp + 0x10b4]
push eax
call fcn.004088c8
cmp byte [esp + 0x3564], 0
mov eax, str.WinRAR.ZIP
jne 0x401d77
mov eax, 0x4208e4
push eax
push 0x420490
push edi
push esi
call fcn.004087a2
mov bl, byte [esp + 0x3560]
test bl, bl
je 0x401dee
call fcn.00404f48
mov esi, eax
mov ebx, ebp
neg esi
sbb esi, esi
and esi, 0xffffffba
add esi, 0x64
push ebx
push str..r_02u
lea eax, [esp + 0x1060]
push 0x20
push eax
call fcn.0040346f
add esp, 0x10
lea eax, [esp + 0x1058]
push 0x4208e4
push 0x420490
push eax
push 0x80000000
call fcn.004087a2
inc ebx
cmp ebx, esi
jb 0x401da2
mov bl, byte [esp + 0x3560]
mov esi, 0x80000000
mov bh, byte [esp + 0x3558]
cmp byte [esp + 0x355c], 0
je 0x401ef1
cmp byte [esp + 0x3564], 0
jne 0x401e0e
test bl, bl
je 0x401ef1
lea eax, [esp + 0x154c]
push eax
push esi
call fcn.004082e6
push 0x800
lea eax, [esp + 0x2550]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, str.rarnew.dat
test bl, bl
jne 0x401e3e
mov eax, str.zipnew.dat
push 0x800
push eax
lea eax, [esp + 0x2554]
push eax
call fcn.00405583
lea ecx, [esp + 0x10]
call fcn.0040123f
push ebp
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x2554]
push eax
call fcn.00404c86
test al, al
je 0x401e91
xor eax, eax
test bl, bl
setne al
lea eax, [eax*2 + 0x16]
cmp dword [esp + 0x1010], eax
jne 0x401e91
cmp dword [esp + 0x1014], ebp
je 0x401ed6
push 0x421188
lea eax, [esp + 0x2550]
push eax
call fcn.004045d4
mov esi, eax
test esi, esi
je 0x401ed1
push esi
test bl, bl
je 0x401eb9
push 0x18
push 1
push 0x42a0d8
jmp 0x401ec2
push 0x16
push 1
push 0x42a0f0
call fcn.004101f0
add esp, 0x10
push esi
call fcn.0040ff38
pop ecx
mov esi, 0x80000000
lea eax, [esp + 0x254c]
push eax
push str.FileName
lea eax, [esp + 0x1554]
push eax
push esi
call fcn.004087a2
push edi
call fcn.00401584
test al, al
je 0x4020bb
test bh, bh
je 0x401f11
cmp byte [esp + 0x355c], 0
jne 0x4020bb
push 1
push str.Exist
lea eax, [esp + 0x10b4]
push eax
call fcn.00408485
test eax, eax
setne bl
test bh, bh
jne 0x402020
push 0x200
push 0x420490
lea eax, [esp + 0x1154]
push eax
push str.Type
lea eax, [esp + 0x10bc]
push eax
call fcn.004085cd
push 0x4208e4
lea eax, [esp + 0x1150]
push eax
call fcn.00407632
test eax, eax
je 0x401f82
push str.WinRAR.ZIP
lea eax, [esp + 0x1150]
push eax
call fcn.00407632
test eax, eax
jne 0x401f8c
xor eax, eax
mov word [esp + 0x114c], ax
test bl, bl
je 0x401fa6
lea eax, [esp + 0x114c]
push eax
push 0x420490
push edi
push esi
call fcn.004087a2
jmp 0x401fbb
mov eax, 0x420490
push eax
push eax
push edi
push esi
call fcn.004087a2
push edi
push esi
call fcn.004082e6
mov bh, byte [esp + 0x3560]
test bh, bh
je 0x402027
push ebp
push str..r_02u
lea eax, [esp + 0x1060]
push 0x20
push eax
call fcn.0040346f
add esp, 0x10
test bl, bl
je 0x40200a
cmp word [esp + 0x114c], 0
je 0x40200a
lea eax, [esp + 0x114c]
push eax
push 0x420490
lea eax, [esp + 0x1060]
push eax
push esi
call fcn.004087a2
jmp 0x402018
lea eax, [esp + 0x1058]
push eax
push esi
call fcn.004082e6
inc ebp
cmp ebp, 0x64
jb 0x401fc6
jmp 0x402027
mov bh, byte [esp + 0x3560]
cmp byte [esp + 0x3564], 0
jne 0x402039
test bh, bh
je 0x4020bb
test bl, bl
je 0x4020ad
push 0x800
mov ebx, 0x420490
lea eax, [esp + 0x2550]
push ebx
push eax
push str.ShellNew
lea eax, [esp + 0x10bc]
push eax
call fcn.004085cd
mov ebp, str.FileName
lea eax, [esp + 0x154c]
push ebp
push eax
push esi
call fcn.00408348
cmp word [esp + 0x254c], 0
je 0x4020bb
cmp word [esp + 0x254c], 0x2a
jne 0x402094
push ebx
push str.NullFile
jmp 0x40209d
lea eax, [esp + 0x254c]
push eax
push ebp
lea eax, [esp + 0x1554]
push eax
push esi
call fcn.004087a2
jmp 0x4020bb
lea eax, [esp + 0x154c]
push eax
push esi
call fcn.004082e6
mov ecx, dword [esp + 0x354c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040a2bd
add esp, 0x3540
ret 0x14