Function at 0x140001f04
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3490]
mov eax, 0x3590
call fcn.14000be70
sub rsp, rax
mov rax, qword [0x1400318e0]
xor rax, rsp
mov qword [rbp + 0x3480], rax
mov r13b, byte [rbp + 0x34f0]
mov sil, r9b
mov r9, rcx
mov byte [0x140031168], 0x52
mov r12b, r8b
mov byte [0x140031180], 0x50
mov r15b, dl
lea r8, str._sShellNew
mov rbx, rcx
mov edx, 0x800
lea rcx, [rbp + 0x1480]
call fcn.140003aa4
mov r9, rbx
lea r8, str.Setup_s
mov edx, 0x50
lea rcx, [rbp + 0xfe0]
call fcn.140003aa4
xor r14d, r14d
lea rdi, [0x140022780]
test r15b, r15b
je 0x14000224c
mov rcx, rbx
call fcn.140001710
test al, al
jne 0x1400020b0
mov dword [rsp + 0x28], 0x200
lea r9, [rbp + 0x1080]
mov r8, rdi
mov qword [rsp + 0x20], rdi
mov rdx, rbx
mov rcx, 0xffffffff80000000
call fcn.140009938
lea r9, [rbp + 0x2480]
mov dword [rsp + 0x28], 0x800
lea r8, str.FileName
mov qword [rsp + 0x20], rdi
lea rdx, [rbp + 0x1480]
mov rcx, 0xffffffff80000000
call fcn.140009938
lea r9, [rbp + 0xfc0]
mov dword [rsp + 0x28], 0xa
lea r8, str.NullFile
mov qword [rsp + 0x20], rdi
lea rdx, [rbp + 0x1480]
mov rcx, 0xffffffff80000000
call fcn.140009938
mov rdx, rbx
mov rcx, 0xffffffff80000000
mov dil, al
call fcn.1400089e0
movzx r8d, al
lea rdx, str.Exist
lea rcx, [rbp + 0xfe0]
call fcn.140009e5c
lea r8, [rbp + 0x1080]
lea rdx, str.Type
lea rcx, [rbp + 0xfe0]
call fcn.140009e44
cmp word [rbp + 0x2480], r14w
jne 0x14000208f
lea r8, [0x140023490]
test dil, dil
jne 0x140002096
lea r8, [rbp + 0x2480]
lea rdx, str.ShellNew
lea rcx, [rbp + 0xfe0]
call fcn.140009e44
lea rdi, [0x140022780]
lea rax, str.WinRAR.ZIP
test r13b, r13b
lea r9, [0x140022cf0]
mov r8, rdi
cmovne r9, rax
mov rdx, rbx
mov rcx, 0xffffffff80000000
call fcn.140009cdc
test sil, sil
je 0x140002132
call fcn.140005a08
neg eax
sbb edi, edi
and edi, 0xffffffba
add edi, 0x64
mov r9d, r14d
lea r8, str..r_02u
mov edx, 0x20
lea rcx, [rbp + 0xf80]
call fcn.140003aa4
lea r9, [0x140022cf0]
mov rcx, 0xffffffff80000000
lea r8, [0x140022780]
lea rdx, [rbp + 0xf80]
call fcn.140009cdc
inc r14d
cmp r14d, edi
jb 0x1400020eb
xor r14d, r14d
test r12b, r12b
je 0x14000224c
test r13b, r13b
jne 0x140002149
test sil, sil
je 0x14000224c
lea rdx, [rbp + 0x1480]
mov rcx, 0xffffffff80000000
call fcn.140009710
mov edi, 0x800
lea rdx, [rbp + 0x2480]
mov r8d, edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rax, str.rarnew.dat
test sil, sil
lea rdx, str.zipnew.dat
mov r8d, edi
cmovne rdx, rax
lea rcx, [rbp + 0x2480]
call fcn.1400061a0
xor r8d, r8d
mov qword [rbp + 0xf40], r14
lea rdx, [rsp + 0x30]
mov qword [rbp + 0xf48], r14
lea rcx, [rbp + 0x2480]
mov qword [rbp + 0xf50], r14
call fcn.1400056e0
test al, al
je 0x1400021dc
mov al, sil
neg al
sbb rcx, rcx
and ecx, 2
add rcx, 0x16
cmp qword [rbp + 0xf30], rcx
je 0x14000222b
lea rdx, [0x140023568]
lea rcx, [rbp + 0x2480]
call fcn.140004fac
mov rdi, rax
test rax, rax
je 0x14000222b
mov r9, rax
mov edx, 1
test sil, sil
je 0x140002211
lea r8d, [rdx + 0x17]
lea rcx, [0x140031168]
jmp 0x14000221e
mov r8d, 0x16
lea rcx, [0x140031180]
call fcn.140012598
mov rcx, rdi
call fcn.1400122ec
lea r9, [rbp + 0x2480]
mov rcx, 0xffffffff80000000
lea r8, str.FileName
lea rdx, [rbp + 0x1480]
call fcn.140009cdc
mov rcx, rbx
call fcn.140001710
test al, al
je 0x140002432
test r15b, r15b
je 0x14000226a
test r12b, r12b
jne 0x140002432
mov r8d, 1
lea rdx, str.Exist
lea rcx, [rbp + 0xfe0]
call fcn.140009920
test eax, eax
lea r12, [0x140022780]
setne dil
test r15b, r15b
jne 0x14000238d
mov r9, r12
mov dword [rsp + 0x20], 0x200
lea r8, [rbp + 0x1080]
lea rdx, str.Type
lea rcx, [rbp + 0xfe0]
call fcn.140009a80
lea rdx, [0x140022cf0]
lea rcx, [rbp + 0x1080]
call fcn.1400087c4
test eax, eax
je 0x1400022ec
lea rdx, str.WinRAR.ZIP
lea rcx, [rbp + 0x1080]
call fcn.1400087c4
test eax, eax
jne 0x1400022f4
mov word [rbp + 0x1080], r14w
mov r15, 0xffffffff80000000
mov r8, r12
mov rcx, r15
mov rdx, rbx
test dil, dil
je 0x140002317
lea r9, [rbp + 0x1080]
call fcn.140009cdc
jmp 0x14000232a
mov r9, r12
call fcn.140009cdc
mov rdx, rbx
mov rcx, r15
call fcn.140009710
test sil, sil
je 0x14000238d
mov ebx, r14d
mov r9d, ebx
lea r8, str..r_02u
mov edx, 0x20
lea rcx, [rbp + 0xf80]
call fcn.140003aa4
test dil, dil
je 0x140002377
cmp word [rbp + 0x1080], r14w
je 0x140002377
lea r9, [rbp + 0x1080]
mov r8, r12
lea rdx, [rbp + 0xf80]
mov rcx, r15
call fcn.140009cdc
jmp 0x140002386
lea rdx, [rbp + 0xf80]
mov rcx, r15
call fcn.140009710
inc ebx
cmp ebx, 0x64
jb 0x140002332
test r13b, r13b
jne 0x14000239b
test sil, sil
je 0x140002432
test dil, dil
je 0x14000241f
mov r9, r12
mov dword [rsp + 0x20], 0x800
lea r8, [rbp + 0x2480]
lea rdx, str.ShellNew
lea rcx, [rbp + 0xfe0]
call fcn.140009a80
mov rbx, 0xffffffff80000000
lea r8, str.FileName
mov rcx, rbx
lea rdx, [rbp + 0x1480]
call fcn.140009790
movzx eax, word [rbp + 0x2480]
test ax, ax
je 0x140002432
lea rdx, [rbp + 0x1480]
mov rcx, rbx
cmp ax, 0x2a
jne 0x14000240a
mov r9, r12
lea r8, str.NullFile
jmp 0x140002418
lea r9, [rbp + 0x2480]
lea r8, str.FileName
call fcn.140009cdc
jmp 0x140002432
lea rdx, [rbp + 0x1480]
mov rcx, 0xffffffff80000000
call fcn.140009710
mov rcx, qword [rbp + 0x3480]
xor rcx, rsp
call fcn.14000bee0
mov rbx, qword [rsp + 0x35d8]
add rsp, 0x3590
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret