Function at 0x14003be1c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x34a0]
mov eax, 0x35a0
call fcn.1400f1270
sub rsp, rax
mov rax, qword [0x1401412b0]
xor rax, rsp
mov qword [rbp + 0x3490], rax
mov r13b, byte [rbp + 0x3500]
mov r14b, r9b
mov r9, rcx
mov byte [rsp + 0x30], r8b
mov bl, dl
mov byte [0x14013dfd0], 0x52
mov rsi, rcx
mov byte [0x14013dfe8], 0x50
mov r15d, 0x800
lea rcx, [rbp + 0x1490]
mov edx, r15d
lea r8, str._sShellNew
call fcn.1400026d0
xor r12d, r12d
test bl, bl
je 0x14003c14f
mov rcx, rsi
call fcn.14003b4a8
lea rdi, [0x14010f1a8]
mov rbx, 0xffffffff80000000
test al, al
jne 0x14003bfb9
mov dword [rsp + 0x28], 0x200
lea r9, [rbp + 0x1090]
mov r8, rdi
mov qword [rsp + 0x20], rdi
mov rdx, rsi
mov rcx, rbx
call fcn.14009f89c
lea r9, [rbp + 0x2490]
mov dword [rsp + 0x28], r15d
lea r8, str.FileName
mov qword [rsp + 0x20], rdi
lea rdx, [rbp + 0x1490]
mov rcx, rbx
call fcn.14009f89c
lea r9, [rbp + 0x1070]
mov dword [rsp + 0x28], 0xa
lea r8, str.NullFile
mov qword [rsp + 0x20], rdi
lea rdx, [rbp + 0x1490]
mov rcx, rbx
call fcn.14009f89c
mov r9, rsi
lea r8, str.Setup_s
lea edx, [r12 + 0x50]
mov r15b, al
lea rcx, [rbp + 0xfd0]
call fcn.1400026d0
mov rdx, rsi
mov rcx, rbx
call fcn.14009dbe4
movzx r8d, al
lea rdx, str.Exist
lea rcx, [rbp + 0xfd0]
call fcn.1400a03f8
lea r8, [rbp + 0x1090]
lea rdx, [0x1401100c0]
lea rcx, [rbp + 0xfd0]
call fcn.1400a03e0
cmp word [rbp + 0x2490], r12w
jne 0x14003bf9f
lea r8, [0x14010f558]
test r15b, r15b
jne 0x14003bfa6
lea r8, [rbp + 0x2490]
lea rdx, str.ShellNew
lea rcx, [rbp + 0xfd0]
call fcn.1400a03e0
lea rdx, str.WinRAR.ZIP
test r13b, r13b
lea r9, [0x140114380]
mov r8, rdi
cmovne r9, rdx
mov rcx, rbx
mov rdx, rsi
call fcn.1400a0208
mov r15d, 1
test r14b, r14b
je 0x14003c035
call fcn.14006c514
neg eax
sbb esi, esi
and esi, 0xffffffba
add esi, 0x64
mov r9d, r12d
lea r8, str..r_02u
mov edx, 0x20
lea rcx, [rbp + 0xf90]
call fcn.1400026d0
lea r9, [0x140114380]
mov r8, rdi
lea rdx, [rbp + 0xf90]
mov rcx, rbx
call fcn.1400a0208
add r12d, r15d
cmp r12d, esi
jb 0x14003bff6
xor r12d, r12d
cmp byte [rsp + 0x30], r12b
je 0x14003c32a
test r13b, r13b
jne 0x14003c04e
test r14b, r14b
je 0x14003c32a
lea rdx, [rbp + 0x1490]
mov rcx, rbx
call fcn.14009f248
mov r8d, 0x800
lea rdx, [rbp + 0x2490]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rax, str.rarnew.dat
test r14b, r14b
lea rdx, str.zipnew.dat
mov r8d, 0x800
cmovne rdx, rax
lea rcx, [rbp + 0x2490]
call fcn.1400797e0
xor r8d, r8d
mov qword [rbp + 0xf50], r12
lea rdx, [rsp + 0x40]
mov qword [rbp + 0xf58], r12
lea rcx, [rbp + 0x2490]
mov qword [rbp + 0xf60], r12
call fcn.14006a8bc
test al, al
je 0x14003c0de
mov al, r14b
neg al
sbb rcx, rcx
and ecx, 2
add rcx, 0x16
cmp qword [rbp + 0xf40], rcx
je 0x14003c12d
lea rdx, [0x14010fb00]
lea rcx, [rbp + 0x2490]
call fcn.14006a2ec
mov rdi, rax
test rax, rax
je 0x14003c12d
mov r9, rax
mov rdx, r15
test r14b, r14b
je 0x14003c113
mov r8d, 0x18
lea rcx, [0x14013dfd0]
jmp 0x14003c120
mov r8d, 0x16
lea rcx, [0x14013dfe8]
call fcn.1400f8a38
mov rcx, rdi
call fcn.1400f866c
lea r9, [rbp + 0x2490]
mov rcx, rbx
lea r8, str.FileName
lea rdx, [rbp + 0x1490]
call fcn.1400a0208
jmp 0x14003c32a
mov r9, rsi
lea r8, str.Setup_s
mov edx, 0x50
lea rcx, [rbp + 0xfd0]
call fcn.1400026d0
mov rcx, rsi
call fcn.14003b4a8
test al, al
je 0x14003c32a
mov r15d, 1
lea rdx, str.Exist
mov r8d, r15d
lea rcx, [rbp + 0xfd0]
call fcn.14009f858
test eax, eax
mov dword [rsp + 0x20], 0x200
lea rdi, [0x14010f1a8]
mov r9, rdi
lea r8, [rbp + 0x1090]
lea rdx, [0x1401100c0]
setne r12b
lea rcx, [rbp + 0xfd0]
call fcn.14009f9e4
lea rdx, [0x140114380]
lea rcx, [rbp + 0x1090]
call fcn.140091328
xor r13d, r13d
test eax, eax
je 0x14003c1f9
lea rdx, str.WinRAR.ZIP
lea rcx, [rbp + 0x1090]
call fcn.140091328
test eax, eax
jne 0x14003c201
mov word [rbp + 0x1090], r13w
mov rbx, 0xffffffff80000000
mov rcx, rbx
test r12b, r12b
je 0x14003c29e
lea r9, [rbp + 0x1090]
mov r8, rdi
mov rdx, rsi
call fcn.1400a0208
mov r9, rdi
mov dword [rsp + 0x20], 0x800
lea r8, [rbp + 0x2490]
lea rdx, str.ShellNew
lea rcx, [rbp + 0xfd0]
call fcn.14009f9e4
lea r8, str.FileName
mov rcx, rbx
lea rdx, [rbp + 0x1490]
call fcn.14009f2d8
movzx eax, word [rbp + 0x2490]
test ax, ax
je 0x14003c2c6
lea rdx, [rbp + 0x1490]
mov rcx, rbx
cmp ax, 0x2a
jne 0x14003c289
mov r9, rdi
lea r8, str.NullFile
jmp 0x14003c297
lea r9, [rbp + 0x2490]
lea r8, str.FileName
call fcn.1400a0208
jmp 0x14003c2c6
lea rdx, [rbp + 0x1490]
call fcn.14009f248
mov r9, rdi
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call fcn.1400a0208
mov rdx, rsi
mov rcx, rbx
call fcn.14009f248
test r14b, r14b
je 0x14003c32a
mov esi, r13d
mov r9d, esi
lea r8, str..r_02d
mov edx, 0x20
lea rcx, [rbp + 0xf90]
call fcn.1400026d0
test r12b, r12b
je 0x14003c313
cmp word [rbp + 0x1090], r13w
je 0x14003c313
lea r9, [rbp + 0x1090]
mov r8, rdi
lea rdx, [rbp + 0xf90]
mov rcx, rbx
call fcn.1400a0208
jmp 0x14003c322
lea rdx, [rbp + 0xf90]
mov rcx, rbx
call fcn.14009f248
add esi, r15d
cmp esi, 0x64
jl 0x14003c2ce
mov rcx, qword [rbp + 0x3490]
xor rcx, rsp
call fcn.1400f12e0
mov rbx, qword [rsp + 0x35e8]
add rsp, 0x35a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret