Function at 0x140001ec4
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3490]
mov eax, 0x3590
call fcn.14000be20
sub rsp, rax
mov rax, qword [0x1400318e0]
xor rax, rsp
mov qword [rbp + 0x3480], rax
mov r13b, byte [rbp + 0x34f0]
mov sil, r9b
mov r9, rcx
mov byte [0x140031168], 0x52
mov r12b, r8b
mov byte [0x140031180], 0x50
mov r15b, dl
lea r8, str._sShellNew
mov rbx, rcx
mov edx, 0x800
lea rcx, [rbp + 0x1480]
call fcn.140003a64
mov r9, rbx
lea r8, str.Setup_s
mov edx, 0x50
lea rcx, [rbp + 0xfe0]
call fcn.140003a64
xor r14d, r14d
lea rdi, [0x140022780]
test r15b, r15b
je 0x14000220c
mov rcx, rbx
call fcn.1400016d0
test al, al
jne 0x140002070
mov dword [rsp + 0x28], 0x200
lea r9, [rbp + 0x1080]
mov r8, rdi
mov qword [rsp + 0x20], rdi
mov rdx, rbx
mov rcx, 0xffffffff80000000
call fcn.1400098f8
lea r9, [rbp + 0x2480]
mov dword [rsp + 0x28], 0x800
lea r8, str.FileName
mov qword [rsp + 0x20], rdi
lea rdx, [rbp + 0x1480]
mov rcx, 0xffffffff80000000
call fcn.1400098f8
lea r9, [rbp + 0xfc0]
mov dword [rsp + 0x28], 0xa
lea r8, str.NullFile
mov qword [rsp + 0x20], rdi
lea rdx, [rbp + 0x1480]
mov rcx, 0xffffffff80000000
call fcn.1400098f8
mov rdx, rbx
mov rcx, 0xffffffff80000000
mov dil, al
call fcn.1400089a0
movzx r8d, al
lea rdx, str.Exist
lea rcx, [rbp + 0xfe0]
call fcn.140009e1c
lea r8, [rbp + 0x1080]
lea rdx, str.Type
lea rcx, [rbp + 0xfe0]
call fcn.140009e04
cmp word [rbp + 0x2480], r14w
jne 0x14000204f
lea r8, [0x140023490]
test dil, dil
jne 0x140002056
lea r8, [rbp + 0x2480]
lea rdx, str.ShellNew
lea rcx, [rbp + 0xfe0]
call fcn.140009e04
lea rdi, [0x140022780]
lea rax, str.WinRAR.ZIP
test r13b, r13b
lea r9, [0x140022cf0]
mov r8, rdi
cmovne r9, rax
mov rdx, rbx
mov rcx, 0xffffffff80000000
call fcn.140009c9c
test sil, sil
je 0x1400020f2
call fcn.1400059c8
neg eax
sbb edi, edi
and edi, 0xffffffba
add edi, 0x64
mov r9d, r14d
lea r8, str..r_02u
mov edx, 0x20
lea rcx, [rbp + 0xf80]
call fcn.140003a64
lea r9, [0x140022cf0]
mov rcx, 0xffffffff80000000
lea r8, [0x140022780]
lea rdx, [rbp + 0xf80]
call fcn.140009c9c
inc r14d
cmp r14d, edi
jb 0x1400020ab
xor r14d, r14d
test r12b, r12b
je 0x14000220c
test r13b, r13b
jne 0x140002109
test sil, sil
je 0x14000220c
lea rdx, [rbp + 0x1480]
mov rcx, 0xffffffff80000000
call fcn.1400096d0
mov edi, 0x800
lea rdx, [rbp + 0x2480]
mov r8d, edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rax, str.rarnew.dat
test sil, sil
lea rdx, str.zipnew.dat
mov r8d, edi
cmovne rdx, rax
lea rcx, [rbp + 0x2480]
call fcn.140006160
xor r8d, r8d
mov qword [rbp + 0xf40], r14
lea rdx, [rsp + 0x30]
mov qword [rbp + 0xf48], r14
lea rcx, [rbp + 0x2480]
mov qword [rbp + 0xf50], r14
call fcn.1400056a0
test al, al
je 0x14000219c
mov al, sil
neg al
sbb rcx, rcx
and ecx, 2
add rcx, 0x16
cmp qword [rbp + 0xf30], rcx
je 0x1400021eb
lea rdx, [0x140023568]
lea rcx, [rbp + 0x2480]
call fcn.140004f6c
mov rdi, rax
test rax, rax
je 0x1400021eb
mov r9, rax
mov edx, 1
test sil, sil
je 0x1400021d1
lea r8d, [rdx + 0x17]
lea rcx, [0x140031168]
jmp 0x1400021de
mov r8d, 0x16
lea rcx, [0x140031180]
call fcn.140012548
mov rcx, rdi
call fcn.14001229c
lea r9, [rbp + 0x2480]
mov rcx, 0xffffffff80000000
lea r8, str.FileName
lea rdx, [rbp + 0x1480]
call fcn.140009c9c
mov rcx, rbx
call fcn.1400016d0
test al, al
je 0x1400023f2
test r15b, r15b
je 0x14000222a
test r12b, r12b
jne 0x1400023f2
mov r8d, 1
lea rdx, str.Exist
lea rcx, [rbp + 0xfe0]
call fcn.1400098e0
test eax, eax
lea r12, [0x140022780]
setne dil
test r15b, r15b
jne 0x14000234d
mov r9, r12
mov dword [rsp + 0x20], 0x200
lea r8, [rbp + 0x1080]
lea rdx, str.Type
lea rcx, [rbp + 0xfe0]
call fcn.140009a40
lea rdx, [0x140022cf0]
lea rcx, [rbp + 0x1080]
call fcn.140008784
test eax, eax
je 0x1400022ac
lea rdx, str.WinRAR.ZIP
lea rcx, [rbp + 0x1080]
call fcn.140008784
test eax, eax
jne 0x1400022b4
mov word [rbp + 0x1080], r14w
mov r15, 0xffffffff80000000
mov r8, r12
mov rcx, r15
mov rdx, rbx
test dil, dil
je 0x1400022d7
lea r9, [rbp + 0x1080]
call fcn.140009c9c
jmp 0x1400022ea
mov r9, r12
call fcn.140009c9c
mov rdx, rbx
mov rcx, r15
call fcn.1400096d0
test sil, sil
je 0x14000234d
mov ebx, r14d
mov r9d, ebx
lea r8, str..r_02u
mov edx, 0x20
lea rcx, [rbp + 0xf80]
call fcn.140003a64
test dil, dil
je 0x140002337
cmp word [rbp + 0x1080], r14w
je 0x140002337
lea r9, [rbp + 0x1080]
mov r8, r12
lea rdx, [rbp + 0xf80]
mov rcx, r15
call fcn.140009c9c
jmp 0x140002346
lea rdx, [rbp + 0xf80]
mov rcx, r15
call fcn.1400096d0
inc ebx
cmp ebx, 0x64
jb 0x1400022f2
test r13b, r13b
jne 0x14000235b
test sil, sil
je 0x1400023f2
test dil, dil
je 0x1400023df
mov r9, r12
mov dword [rsp + 0x20], 0x800
lea r8, [rbp + 0x2480]
lea rdx, str.ShellNew
lea rcx, [rbp + 0xfe0]
call fcn.140009a40
mov rbx, 0xffffffff80000000
lea r8, str.FileName
mov rcx, rbx
lea rdx, [rbp + 0x1480]
call fcn.140009750
movzx eax, word [rbp + 0x2480]
test ax, ax
je 0x1400023f2
lea rdx, [rbp + 0x1480]
mov rcx, rbx
cmp ax, 0x2a
jne 0x1400023ca
mov r9, r12
lea r8, str.NullFile
jmp 0x1400023d8
lea r9, [rbp + 0x2480]
lea r8, str.FileName
call fcn.140009c9c
jmp 0x1400023f2
lea rdx, [rbp + 0x1480]
mov rcx, 0xffffffff80000000
call fcn.1400096d0
mov rcx, qword [rbp + 0x3480]
xor rcx, rsp
call fcn.14000be90
mov rbx, qword [rsp + 0x35d8]
add rsp, 0x3590
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret