Function at 0x43bd80
Capabilities:
Check if file exists
Check os version
Get file attributes
Write file on windows

Disassembly:
sub esp, 0xec4
mov eax, dword [0x4c0390]
xor eax, esp
mov dword [esp + 0xec0], eax
push ebx
push esi
mov esi, ecx
push esi
lea eax, [esp + 0x6cc]
push str._sShellNew
push eax
mov byte [0x4befb8], 0x52
mov byte [0x4befa0], 0x50
call fcn.0049e0d5
add esp, 0xc
cmp byte [esp + 0xed0], 0
push esi
je 0x43c106
call fcn.0043aa30
test al, al
jne 0x43bf02
push 0x200
push 0x4b1914
lea ecx, [esp + 0x2d0]
push ecx
push 0x4b1914
push esi
push 0x80000000
call fcn.00455f10
push 0x200
push 0x4b1914
lea edx, [esp + 0xd0]
push edx
push str.Content_Type
push esi
push 0x80000000
call fcn.00455f10
push 0x400
push 0x4b1914
lea eax, [esp + 0xad0]
push eax
push str.FileName
lea ecx, [esp + 0x6d8]
push ecx
push 0x80000000
call fcn.00455f10
push 0xa
push 0x4b1914
lea edx, [esp + 0xc4]
push edx
push str.NullFile
lea eax, [esp + 0x6d8]
push eax
push 0x80000000
call fcn.00455f10
push esi
lea ecx, [esp + 0xc]
push 0x4b2e90
push ecx
mov bl, al
call fcn.0049e0d5
add esp, 0xc
push esi
push 0x80000000
call fcn.00455bc0
movzx edx, al
push edx
push str.Exist
lea eax, [esp + 0x10]
push eax
call fcn.004562a0
lea ecx, [esp + 0x2c8]
push ecx
push str.Type
lea edx, [esp + 0x10]
push edx
call fcn.00456260
lea eax, [esp + 0xc8]
push eax
push str.Content
lea ecx, [esp + 0x10]
push ecx
call fcn.00456260
cmp byte [esp + 0xac8], 0
jne 0x43beeb
test bl, bl
je 0x43beeb
push 0x4b175c
push str.ShellNew
lea edx, [esp + 0x10]
push edx
jmp 0x43befd
lea eax, [esp + 0xac8]
push eax
push str.ShellNew
lea ecx, [esp + 0x10]
push ecx
call fcn.00456260
cmp byte [esp + 0xedc], 0
mov eax, str.WinRAR.ZIP
jne 0x43bf16
mov eax, 0x4b2da4
push eax
push 0x4b1914
push esi
push 0x80000000
call fcn.00455d70
push str.Content_Type
push esi
push 0x80000000
call fcn.00455a20
mov bl, byte [esp + 0xed8]
test bl, bl
je 0x43bfaf
push edi
call fcn.0043c9b0
mov edi, eax
neg edi
sbb edi, edi
and edi, 0xffffffba
add edi, 0x64
xor esi, esi
test edi, edi
jle 0x43bfae
lea ebx, [ebx]
push esi
lea edx, [esp + 0xa4]
push str..r_02d
push edx
call fcn.0049e0d5
add esp, 0xc
push 0x4b2da4
push 0x4b1914
lea eax, [esp + 0xa8]
push eax
push 0x80000000
call fcn.00455d70
push str.Content_Type
lea ecx, [esp + 0xa4]
push ecx
push 0x80000000
call fcn.00455a20
inc esi
cmp esi, edi
jl 0x43bf60
pop edi
cmp byte [esp + 0xed4], 0
je 0x43c36a
cmp byte [esp + 0xedc], 0
jne 0x43bfcf
test bl, bl
je 0x43c36a
lea edx, [esp + 0x6c8]
push edx
push 0x80000000
call fcn.004559c0
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0xc], 4
ja 0x43c04c
cmp dword [esp + 0x10], 0xa
ja 0x43c04c
test bl, bl
je 0x43c029
push 0x14
push 0x4befb8
push str.Data
lea ecx, [esp + 0x6d4]
push ecx
push 0x80000000
call fcn.00455ec0
jmp 0x43c36a
push 0x16
push 0x4befa0
push str.Data
lea edx, [esp + 0x6d4]
push edx
push 0x80000000
call fcn.00455ec0
jmp 0x43c36a
push 0x400
lea eax, [esp + 0x2cc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov esi, str.rarnew.dat
test bl, bl
jne 0x43c06f
mov esi, str.zipnew.dat
lea ecx, [esp + 0x2c8]
push ecx
call fcn.0044d530
lea esp, [esp]
mov cl, byte [esi]
mov byte [eax], cl
inc esi
inc eax
test cl, cl
jne 0x43c080
lea edx, [esp + 0x2c8]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x43c0e2
lea eax, [esp + 0x2c8]
push 0x4b1ba8
push eax
call fcn.0049f968
mov esi, eax
add esp, 8
test esi, esi
je 0x43c0e2
push esi
test bl, bl
je 0x43c0c8
push 0x14
push 1
push 0x4befb8
jmp 0x43c0d1
push 0x16
push 1
push 0x4befa0
call fcn.0049f822
add esp, 0x10
push esi
call fcn.0049f646
add esp, 4
lea ecx, [esp + 0x2c8]
push ecx
push str.FileName
lea edx, [esp + 0x6d0]
push edx
push 0x80000000
call fcn.00455d70
jmp 0x43c36a
lea eax, [esp + 0xc]
push 0x4b2e90
push eax
call fcn.0049e0d5
add esp, 0xc
push esi
call fcn.0043aa30
test al, al
je 0x43c36a
push 1
push str.Exist
lea ecx, [esp + 0x10]
push ecx
call fcn.00456400
push 0x200
push 0x4b1914
lea edx, [esp + 0xd0]
push edx
test eax, eax
push str.Type
lea eax, [esp + 0x18]
push eax
setne bl
call fcn.004563a0
lea ecx, [esp + 0xc8]
push 0x4b2da4
push ecx
call fcn.004ac076
add esp, 8
test eax, eax
je 0x43c18f
lea edx, [esp + 0xc8]
push str.WinRAR.ZIP
push edx
call fcn.004ac076
add esp, 8
test eax, eax
jne 0x43c197
mov byte [esp + 0xc8], 0
push 0x200
push 0x4b1914
lea eax, [esp + 0x2d0]
push eax
push str.Content
lea ecx, [esp + 0x18]
push ecx
call fcn.004563a0
test bl, bl
je 0x43c292
lea edx, [esp + 0xc8]
push edx
push 0x4b1914
push esi
push 0x80000000
call fcn.00455d70
cmp byte [esp + 0x2c8], 0
je 0x43c1fc
lea eax, [esp + 0x2c8]
push eax
push str.Content_Type
push esi
push 0x80000000
call fcn.00455d70
jmp 0x43c20c
push str.Content_Type
push esi
push 0x80000000
call fcn.00455a20
push 0x400
push 0x4b1914
lea ecx, [esp + 0xad0]
push ecx
push str.ShellNew
lea edx, [esp + 0x18]
push edx
call fcn.004563a0
push str.FileName
lea eax, [esp + 0x6cc]
push eax
push 0x80000000
call fcn.00455a20
mov al, byte [esp + 0xac8]
test al, al
je 0x43c2c4
cmp al, 0x2a
jne 0x43c271
push 0x4b1914
push str.NullFile
lea ecx, [esp + 0x6d0]
push ecx
push 0x80000000
call fcn.00455d70
jmp 0x43c2c4
lea edx, [esp + 0xac8]
push edx
push str.FileName
lea eax, [esp + 0x6d0]
push eax
push 0x80000000
call fcn.00455d70
jmp 0x43c2c4
lea ecx, [esp + 0x6c8]
push ecx
push 0x80000000
call fcn.004559c0
push 0x4b1914
push 0x4b1914
push esi
push 0x80000000
call fcn.00455d70
push esi
push 0x80000000
call fcn.004559c0
cmp byte [esp + 0xed8], 0
je 0x43c36a
xor esi, esi
jmp 0x43c2e0
push esi
lea edx, [esp + 0xa0]
push str..r_02d
push edx
call fcn.0049e0d5
add esp, 0xc
test bl, bl
je 0x43c34e
cmp byte [esp + 0xc8], 0
je 0x43c34e
lea eax, [esp + 0xc8]
push eax
push 0x4b1914
lea ecx, [esp + 0xa4]
push ecx
push 0x80000000
call fcn.00455d70
cmp byte [esp + 0x2c8], 0
je 0x43c360
lea edx, [esp + 0x2c8]
push edx
push str.Content_Type
lea eax, [esp + 0xa4]
push eax
push 0x80000000
call fcn.00455d70
jmp 0x43c360
lea ecx, [esp + 0x9c]
push ecx
push 0x80000000
call fcn.004559c0
inc esi
cmp esi, 0x64
jl 0x43c2e0
mov ecx, dword [esp + 0xec8]
pop esi
pop ebx
xor ecx, esp
call fcn.0049e0c6
add esp, 0xec4
ret 0x10