Function at 0x140002024
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3090]
mov eax, 0x3190
call fcn.14000c6a0
sub rsp, rax
mov rax, qword [0x140033a80]
xor rax, rsp
mov qword [rbp + 0x3080], rax
mov r12b, byte [rbp + 0x30f0]
mov r13b, dl
movzx edi, r9b
mov rsi, rcx
mov r9, rcx
movzx ebx, r8b
lea rcx, [rbp + 0x2080]
mov byte [0x140033170], 0x52
lea r8, str._sShellNew
mov byte [0x140033188], 0x50
mov edx, 0x800
call fcn.140003d94
mov r9, rsi
lea r8, str.Setup_s
mov edx, 0x50
lea rcx, [rbp + 0xfe0]
call fcn.140003d94
mov r8d, 1
lea rdx, str.NewRAR
lea rcx, str.SetupMenuItems
call fcn.14000a19c
xor r15d, r15d
test eax, eax
jne 0x1400020da
test dil, dil
cmovne ebx, r15d
mov r8d, 1
lea rdx, str.NewZIP
lea rcx, str.SetupMenuItems
call fcn.14000a19c
test eax, eax
jne 0x140002101
test r12b, r12b
movzx ebx, bl
cmovne ebx, r15d
lea r14, [0x1400247f0]
test r13b, r13b
je 0x1400023b3
mov rcx, rsi
call fcn.1400017c4
test al, al
jne 0x140002217
mov dword [rsp + 0x28], 0x200
lea r9, [rbp + 0x1080]
mov r8, r14
mov qword [rsp + 0x20], r14
mov rdx, rsi
mov rcx, 0xffffffff80000000
call fcn.14000a1b4
lea r9, [rsp + 0x30]
mov dword [rsp + 0x28], 0x800
lea r8, str.FileName
mov qword [rsp + 0x20], r14
lea rdx, [rbp + 0x2080]
mov rcx, 0xffffffff80000000
call fcn.14000a1b4
lea r9, [rbp + 0xfc0]
mov dword [rsp + 0x28], 0xa
lea r8, str.NullFile
mov qword [rsp + 0x20], r14
lea rdx, [rbp + 0x2080]
mov rcx, 0xffffffff80000000
call fcn.14000a1b4
mov rdx, rsi
mov rcx, 0xffffffff80000000
mov r14b, al
call fcn.14000920c
movzx r8d, al
lea rdx, str.Exist
lea rcx, [rbp + 0xfe0]
call fcn.14000a694
lea r8, [rbp + 0x1080]
lea rdx, str.Type
lea rcx, [rbp + 0xfe0]
call fcn.14000a67c
cmp word [rsp + 0x30], r15w
jne 0x1400021f8
lea r8, [0x140025520]
test r14b, r14b
jne 0x1400021fd
lea r8, [rsp + 0x30]
lea rdx, str.ShellNew
lea rcx, [rbp + 0xfe0]
call fcn.14000a67c
lea r14, [0x1400247f0]
lea rax, str.WinRAR.ZIP
test r12b, r12b
lea r9, [0x140024db0]
mov r8, r14
cmovne r9, rax
mov rdx, rsi
mov rcx, 0xffffffff80000000
call fcn.14000a514
test dil, dil
je 0x14000229c
call fcn.140006200
neg eax
sbb r14d, r14d
and r14d, 0xffffffba
add r14d, 0x64
mov r9d, r15d
lea r8, str..r_02u
mov edx, 0x20
lea rcx, [rbp + 0xf80]
call fcn.140003d94
lea r9, [0x140024db0]
mov rcx, 0xffffffff80000000
lea r8, [0x1400247f0]
lea rdx, [rbp + 0xf80]
call fcn.14000a514
inc r15d
cmp r15d, r14d
jb 0x140002255
xor r15d, r15d
test bl, bl
je 0x1400023b3
test r12b, r12b
jne 0x1400022b2
test dil, dil
je 0x1400023b3
lea rdx, [rbp + 0x2080]
mov rcx, 0xffffffff80000000
call fcn.140009f88
mov r14d, 0x800
lea rdx, [rbp + 0x1080]
mov r8d, r14d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rax, str.rarnew.dat
test dil, dil
lea rdx, str.zipnew.dat
mov r8d, r14d
cmovne rdx, rax
lea rcx, [rbp + 0x1080]
call fcn.1400069f8
xor r8d, r8d
mov qword [rbp + 0xf40], r15
lea rdx, [rsp + 0x30]
mov qword [rbp + 0xf48], r15
lea rcx, [rbp + 0x1080]
mov qword [rbp + 0xf50], r15
call fcn.140005afc
mov r14, rdi
test al, al
je 0x140002342
lea rax, [rdi*2 + 0x16]
cmp qword [rbp + 0xf30], rax
je 0x140002392
lea rdx, [0x140025638]
lea rcx, [rbp + 0x1080]
call fcn.140005394
mov r15, rax
test rax, rax
je 0x14000238f
lea rax, [0x140033188]
test dil, dil
lea rcx, [0x140033170]
mov r9, r15
cmove rcx, rax
lea r8, [r14*2 + 0x16]
mov edx, 1
call fcn.140013f40
mov rcx, r15
call fcn.140013c94
xor r15d, r15d
lea r9, [rbp + 0x1080]
mov rcx, 0xffffffff80000000
lea r8, str.FileName
lea rdx, [rbp + 0x2080]
call fcn.14000a514
mov rcx, rsi
call fcn.1400017c4
test al, al
je 0x1400025a1
test r13b, r13b
je 0x1400023d0
test bl, bl
jne 0x1400025a1
mov r8d, 1
lea rdx, str.Exist
lea rcx, [rbp + 0xfe0]
call fcn.14000a19c
test eax, eax
lea rbx, [0x1400247f0]
setne r14b
test r13b, r13b
jne 0x1400024fe
mov r9, rbx
mov dword [rsp + 0x20], 0x200
lea r8, [rbp + 0x1080]
lea rdx, str.Type
lea rcx, [rbp + 0xfe0]
call fcn.14000a300
lea rdx, [0x140024db0]
lea rcx, [rbp + 0x1080]
call fcn.140009138
test eax, eax
je 0x140002452
lea rdx, str.WinRAR.ZIP
lea rcx, [rbp + 0x1080]
call fcn.140009138
test eax, eax
jne 0x14000245a
mov word [rbp + 0x1080], r15w
mov r13, 0xffffffff80000000
mov r8, rbx
mov rcx, r13
mov rdx, rsi
test r14b, r14b
je 0x14000247d
lea r9, [rbp + 0x1080]
call fcn.14000a514
jmp 0x140002490
mov r9, rbx
call fcn.14000a514
mov rdx, rsi
mov rcx, r13
call fcn.140009f88
test dil, dil
je 0x1400024fe
mov ebx, r15d
mov r9d, ebx
lea r8, str..r_02u
mov edx, 0x20
lea rcx, [rbp + 0xf80]
call fcn.140003d94
test r14b, r14b
je 0x1400024e1
cmp word [rbp + 0x1080], r15w
je 0x1400024e1
lea r9, [rbp + 0x1080]
mov rcx, r13
lea r8, [0x1400247f0]
lea rdx, [rbp + 0xf80]
call fcn.14000a514
jmp 0x1400024f0
lea rdx, [rbp + 0xf80]
mov rcx, r13
call fcn.140009f88
inc ebx
cmp ebx, 0x64
jb 0x140002498
lea rbx, [0x1400247f0]
test r12b, r12b
jne 0x14000250c
test dil, dil
je 0x1400025a1
test r14b, r14b
je 0x14000258e
mov r9, rbx
mov dword [rsp + 0x20], 0x800
lea r8, [rsp + 0x30]
lea rdx, str.ShellNew
lea rcx, [rbp + 0xfe0]
call fcn.14000a300
mov rbx, 0xffffffff80000000
lea r8, str.FileName
mov rcx, rbx
lea rdx, [rbp + 0x2080]
call fcn.14000a008
movzx eax, word [rsp + 0x30]
test ax, ax
je 0x1400025a1
lea rdx, [rbp + 0x2080]
mov rcx, rbx
cmp ax, 0x2a
jne 0x14000257b
lea r9, [0x1400247f0]
lea r8, str.NullFile
jmp 0x140002587
lea r9, [rsp + 0x30]
lea r8, str.FileName
call fcn.14000a514
jmp 0x1400025a1
lea rdx, [rbp + 0x2080]
mov rcx, 0xffffffff80000000
call fcn.140009f88
mov rcx, qword [rbp + 0x3080]
xor rcx, rsp
call fcn.14000c700
mov rbx, qword [rsp + 0x31d8]
add rsp, 0x3190
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret