Function at 0x467f70
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4b7e66
mov eax, dword fs:[0]
push eax
mov eax, 0x24c8
call fcn.004a5370
mov eax, dword [0x4cc3b0]
xor eax, esp
mov dword [esp + 0x24c4], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4cc3b0]
xor eax, esp
push eax
lea eax, [esp + 0x24dc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24ec]
mov ebx, ecx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x20], esi
call fcn.00430310
mov dword [esp + 0x24e4], 0
lea eax, [esp + 0x1cd8]
push eax
lea ecx, [esp + 0x14dc]
push ecx
mov ecx, 0x4f23e0
call fcn.0046c630
cmp word [esi + 0x4352], 0
lea eax, [esi + 0x4352]
je 0x468012
lea edx, [esp + 0x14d8]
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x468003
cmp word [esi + 0x4b52], 0
lea eax, [esi + 0x4b52]
je 0x46803f
lea edx, [esp + 0x1cd8]
sub edx, eax
jmp 0x468030
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x468030
xor edx, edx
lea ebp, [esi + 0x810]
mov word [ebx + 0xc20], dx
mov dword [esp + 0x24], ebp
cmp word [ebp], dx
je 0x4682d2
cmp word [esp + 0x14d8], dx
jne 0x46807c
cmp word [esp + 0x1cd8], dx
jne 0x46807c
cmp byte [esi + 0x5352], dl
je 0x4682d2
push ebp
call fcn.004317d0
test al, al
je 0x4682d2
lea edx, [ebx + 0x1420]
mov eax, ebp
sub edx, ebp
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x468094
lea esi, [ebx + 0xc20]
push esi
push str.Rar_SFXXXXXX
mov dword [ebx + 0x1c20], ebp
call fcn.00485550
mov edi, eax
test edi, edi
je 0x46837f
call fcn.0043ee90
test eax, eax
je 0x4683a6
push ebp
call fcn.00465000
test al, al
jne 0x4683a6
push ebp
call fcn.004650b0
test al, al
je 0x4682d2
push edi
call fcn.004a6c05
mov edi, 0x10000
push edi
call fcn.004a4c1c
mov ebx, eax
add esp, 8
mov dword [esp + 0x2c], ebx
test ebx, ebx
jne 0x468115
mov ecx, 0x4d76b4
call fcn.00429090
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edi
mov byte [esp + 0x24e4], 1
push edi
push ebp
mov ecx, ebx
call fcn.00465160
push 0
push esi
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
mov esi, eax
test esi, esi
je 0x4682b9
mov eax, dword [esp + 0x18]
push 3
push 0
add eax, 0xc20
push eax
mov byte [esp + 0x23], 0
mov byte [esp + 0x22], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x4681ed
cmp word [esp + 0x14d8], 0
mov ebp, dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
je 0x4681a7
push esi
push 0x464fd0
push 3
push edi
call ebp
push esi
push 0x464fd0
push 0xe
push edi
call ebp
push 0x64
push esi
lea eax, [esp + 0x14e0]
call fcn.00464ca0
mov byte [esp + 0x17], al
cmp word [esp + 0x1cd8], 0
je 0x4681e2
cmp word [esp + 0x14d8], 0
je 0x4681c4
cmp byte [esp + 0x17], 0
je 0x4681e2
push esi
push 0x464fd0
push 2
push edi
call ebp
push 0x65
push esi
lea eax, [esp + 0x1ce0]
call fcn.00464e90
mov byte [esp + 0x16], al
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ebp, dword [esp + 0x24]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceW]
test eax, eax
je 0x4682b9
cmp word [esp + 0x1cd8], 0
je 0x468214
cmp byte [esp + 0x16], 0
je 0x4682b9
cmp byte [esp + 0x17], 0
jne 0x468233
cmp byte [esp + 0x16], 0
jne 0x468233
mov eax, dword [esp + 0x20]
cmp byte [eax + 0x5352], 0
je 0x468315
mov ecx, dword [esp + 0x20]
cmp byte [ecx + 0x5352], 0
je 0x46824f
mov eax, dword [esp + 0x18]
add eax, 0xc20
push eax
call fcn.00465320
lea ecx, [esp + 0x38]
call fcn.00401190
mov esi, dword [esp + 0x18]
push 0
lea edx, [esp + 0x3c]
push edx
add esi, 0xc20
push esi
push 0
call fcn.004354a0
test al, al
je 0x468309
mov eax, dword [esp + 0x1c]
xor ecx, ecx
add eax, dword [esp + 0xc38]
adc ecx, dword [esp + 0xc3c]
mov dword [esp + 0x28], ecx
js 0x468309
jg 0x46829c
cmp eax, 0x100000
jbe 0x468309
push 0x100000
push 0x5a0
call fcn.00461310
push eax
push 0x4f907c
call fcn.00493aa0
add esp, 0xc
mov byte [esp + 0x24e4], 0
test ebx, ebx
je 0x4682ce
push ebx
call fcn.004a4cdf
add esp, 4
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x24e4], 0xffffffff
mov eax, ebx
mov ecx, dword [esp + 0x24dc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24c4]
xor ecx, esp
call fcn.004a4b43
add esp, 0x24d4
ret 4
push 0x400
push esi
push ebp
call fcn.0046ac10
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x468366
mov esi, dword [esp + 0x18]
push 0x10000
add esi, 0xc20
push esi
mov ecx, ebx
call fcn.00465160
test eax, eax
jne 0x468366
push 0x4be47c
push esi
call fcn.00485520
mov esi, eax
test esi, esi
je 0x468366
push 2
push 0
push esi
call fcn.004a6b0e
push esi
push edi
push 1
push ebx
call fcn.004a6e34
push esi
call fcn.004a6c05
add esp, 0x20
mov byte [esp + 0x24e4], 0
test ebx, ebx
je 0x46837b
push ebx
call fcn.004a4cdf
add esp, 4
mov ebx, dword [esp + 0x18]
cmp word [ebx + 0xc20], 0
lea eax, [ebx + 0xc20]
je 0x4682d2
push 0
push 1
push eax
push 0
mov ecx, ebx
call fcn.00430750
jmp 0x4682d2
cmp word [esp + 0x14d8], 0
je 0x46837f
lea edx, [esp + 0x14d8]
push edx
push edi
push ebp
mov ecx, ebx
call fcn.004671c0
test al, al
je 0x46837f
push 0x400
push esi
push ebp
call fcn.0046ac10
push edi
call fcn.004a6c05
add esp, 4
jmp 0x46837f