Function at 0x43c220
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x3540
call fcn.004f8350
mov eax, dword [0x544354]
xor eax, esp
mov dword [esp + 0x353c], eax
push ebx
push esi
mov esi, dword [esp + 0x354c]
lea eax, [esp + 0x1544]
push esi
push str._sShellNew
push 0x800
push eax
mov byte [0x53cd70], 0x52
mov byte [0x53cd88], 0x50
call fcn.00402720
add esp, 0x10
cmp byte [esp + 0x3550], 0
push esi
je 0x43c53e
call fcn.0043b8b0
test al, al
jne 0x43c37c
push 0x200
push 0x51787c
lea eax, [esp + 0x114c]
push eax
push 0x51787c
push esi
push SysReAllocString
call fcn.004a5da0
push 0x800
push 0x51787c
lea eax, [esp + 0x254c]
push eax
push str.FileName
lea eax, [esp + 0x1554]
push eax
push SysReAllocString
call fcn.004a5da0
push 0xa
push 0x51787c
lea eax, [esp + 0x1138]
push eax
push str.NullFile
lea eax, [esp + 0x1554]
push eax
push SysReAllocString
call fcn.004a5da0
push esi
push str.Setup_s
mov bl, al
lea eax, [esp + 0x1098]
push 0x50
push eax
call fcn.00402720
add esp, 0x10
push esi
push SysReAllocString
call fcn.004a3ab0
movzx eax, al
push eax
push str.Exist
lea eax, [esp + 0x1098]
push eax
call fcn.004a6960
lea eax, [esp + 0x1144]
push eax
push 0x518314
lea eax, [esp + 0x1098]
push eax
call fcn.004a6940
cmp word [esp + 0x2544], 0
jne 0x43c362
test bl, bl
je 0x43c362
push 0x517a54
jmp 0x43c36a
lea eax, [esp + 0x2544]
push eax
push str.ShellNew
lea eax, [esp + 0x1098]
push eax
call fcn.004a6940
mov bh, byte [esp + 0x355c]
mov eax, str.WinRAR.ZIP
test bh, bh
jne 0x43c391
mov eax, 0x51a224
push eax
push 0x51787c
push esi
push SysReAllocString
call fcn.004a6780
mov bl, byte [esp + 0x3558]
test bl, bl
je 0x43c3fb
push edi
call fcn.00470750
mov edi, eax
neg edi
sbb edi, edi
and edi, 0xffffffba
add edi, 0x64
xor esi, esi
push esi
push str..r_02u
lea eax, [esp + 0x105c]
push 0x20
push eax
call fcn.00402720
add esp, 0x10
lea eax, [esp + 0x1054]
push 0x51a224
push 0x51787c
push eax
push SysReAllocString
call fcn.004a6780
inc esi
cmp esi, edi
jb 0x43c3c1
pop edi
cmp byte [esp + 0x3554], 0
je 0x43c721
test bh, bh
jne 0x43c415
test bl, bl
je 0x43c721
lea eax, [esp + 0x1544]
push eax
push SysReAllocString
call fcn.004a56d0
push 0x800
lea eax, [esp + 0x2548]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, str.rarnew.dat
test bl, bl
jne 0x43c44a
mov eax, str.zipnew.dat
push 0x800
push eax
lea eax, [esp + 0x254c]
push eax
call fcn.0047d930
push 0
lea eax, [esp + 0xc]
mov dword [esp + 0x101c], 0
push eax
lea eax, [esp + 0x254c]
mov dword [esp + 0x1024], 0
push eax
mov dword [esp + 0x102c], 0
mov dword [esp + 0x1030], 0
mov dword [esp + 0x1034], 0
mov dword [esp + 0x1038], 0
call fcn.0046e3d0
test al, al
je 0x43c4d8
xor eax, eax
test bl, bl
setne al
lea eax, [eax*2 + 0x16]
cmp dword [esp + 0x1008], eax
jne 0x43c4d8
cmp dword [esp + 0x100c], 0
je 0x43c51a
push 0x517df8
lea eax, [esp + 0x2548]
push eax
call fcn.0046dd80
mov esi, eax
test esi, esi
je 0x43c51a
push esi
test bl, bl
je 0x43c500
push 0x18
push 1
push 0x53cd70
jmp 0x43c509
push 0x16
push 1
push 0x53cd88
call fcn.004ff1cc
add esp, 0x10
push esi
call fcn.004fede7
add esp, 4
lea eax, [esp + 0x2544]
push eax
push str.FileName
lea eax, [esp + 0x154c]
push eax
push SysReAllocString
call fcn.004a6780
jmp 0x43c721
push str.Setup_s
lea eax, [esp + 0x1098]
push 0x50
push eax
call fcn.00402720
add esp, 0x10
push esi
call fcn.0043b8b0
test al, al
je 0x43c721
push 1
push str.Exist
lea eax, [esp + 0x1098]
push eax
call fcn.004a5d50
push 0x200
test eax, eax
lea eax, [esp + 0x1148]
push 0x51787c
push eax
push 0x518314
lea eax, [esp + 0x10a0]
setne bl
push eax
call fcn.004a5ee0
push 0x51a224
lea eax, [esp + 0x1148]
push eax
call fcn.00497d90
test eax, eax
je 0x43c5cc
push str.WinRAR.ZIP
lea eax, [esp + 0x1148]
push eax
call fcn.00497d90
test eax, eax
jne 0x43c5d6
xor eax, eax
mov word [esp + 0x1144], ax
test bl, bl
je 0x43c683
lea eax, [esp + 0x1144]
push eax
push 0x51787c
push esi
push SysReAllocString
call fcn.004a6780
push 0x800
push 0x51787c
lea eax, [esp + 0x254c]
push eax
push str.ShellNew
lea eax, [esp + 0x10a0]
push eax
call fcn.004a5ee0
push str.FileName
lea eax, [esp + 0x1548]
push eax
push SysReAllocString
call fcn.004a57e0
mov ax, word [esp + 0x2544]
test ax, ax
je 0x43c6b5
cmp ax, 0x2a
jne 0x43c662
push 0x51787c
push str.NullFile
lea eax, [esp + 0x154c]
push eax
push SysReAllocString
call fcn.004a6780
jmp 0x43c6b5
lea eax, [esp + 0x2544]
push eax
push str.FileName
lea eax, [esp + 0x154c]
push eax
push SysReAllocString
call fcn.004a6780
jmp 0x43c6b5
lea eax, [esp + 0x1544]
push eax
push SysReAllocString
call fcn.004a56d0
push 0x51787c
push 0x51787c
push esi
push SysReAllocString
call fcn.004a6780
push esi
push SysReAllocString
call fcn.004a56d0
cmp byte [esp + 0x3558], 0
je 0x43c721
xor esi, esi
push esi
push str..r_02u
lea eax, [esp + 0x1058]
push 0x20
push eax
call fcn.00402720
add esp, 0x10
test bl, bl
je 0x43c709
cmp word [esp + 0x1144], 0
je 0x43c709
lea eax, [esp + 0x1144]
push eax
push 0x51787c
lea eax, [esp + 0x1058]
push eax
push SysReAllocString
call fcn.004a6780
jmp 0x43c71b
lea eax, [esp + 0x1050]
push eax
push SysReAllocString
call fcn.004a56d0
inc esi
cmp esi, 0x64
jb 0x43c6c1
mov ecx, dword [esp + 0x3544]
pop esi
pop ebx
xor ecx, esp
call fcn.004f833c
add esp, 0x3540
ret 0x14