Function at 0x43be30
Capabilities:
Check if file exists
Check os version
Get file attributes
Write file on windows

Disassembly:
sub esp, 0xec4
mov eax, dword [0x4c0390]
xor eax, esp
mov dword [esp + 0xec0], eax
push ebx
push esi
mov esi, ecx
push esi
lea eax, [esp + 0x6cc]
push str._sShellNew
push eax
mov byte [0x4befb8], 0x52
mov byte [0x4befa0], 0x50
call fcn.0049deb5
add esp, 0xc
cmp byte [esp + 0xed0], 0
push esi
je 0x43c1b6
call fcn.0043aaf0
test al, al
jne 0x43bfb2
push 0x200
push 0x4b1914
lea ecx, [esp + 0x2d0]
push ecx
push 0x4b1914
push esi
push 0x80000000
call fcn.00456470
push 0x200
push 0x4b1914
lea edx, [esp + 0xd0]
push edx
push str.Content_Type
push esi
push 0x80000000
call fcn.00456470
push 0x400
push 0x4b1914
lea eax, [esp + 0xad0]
push eax
push str.FileName
lea ecx, [esp + 0x6d8]
push ecx
push 0x80000000
call fcn.00456470
push 0xa
push 0x4b1914
lea edx, [esp + 0xc4]
push edx
push str.NullFile
lea eax, [esp + 0x6d8]
push eax
push 0x80000000
call fcn.00456470
push esi
lea ecx, [esp + 0xc]
push 0x4b2e90
push ecx
mov bl, al
call fcn.0049deb5
add esp, 0xc
push esi
push 0x80000000
call fcn.00456120
movzx edx, al
push edx
push str.Exist
lea eax, [esp + 0x10]
push eax
call fcn.00456800
lea ecx, [esp + 0x2c8]
push ecx
push str.Type
lea edx, [esp + 0x10]
push edx
call fcn.004567c0
lea eax, [esp + 0xc8]
push eax
push str.Content
lea ecx, [esp + 0x10]
push ecx
call fcn.004567c0
cmp byte [esp + 0xac8], 0
jne 0x43bf9b
test bl, bl
je 0x43bf9b
push 0x4b175c
push str.ShellNew
lea edx, [esp + 0x10]
push edx
jmp 0x43bfad
lea eax, [esp + 0xac8]
push eax
push str.ShellNew
lea ecx, [esp + 0x10]
push ecx
call fcn.004567c0
cmp byte [esp + 0xedc], 0
mov eax, str.WinRAR.ZIP
jne 0x43bfc6
mov eax, 0x4b2da4
push eax
push 0x4b1914
push esi
push 0x80000000
call fcn.004562d0
push str.Content_Type
push esi
push 0x80000000
call fcn.00455f80
mov bl, byte [esp + 0xed8]
test bl, bl
je 0x43c05f
push edi
call fcn.0043ca60
mov edi, eax
neg edi
sbb edi, edi
and edi, 0xffffffba
add edi, 0x64
xor esi, esi
test edi, edi
jle 0x43c05e
lea ebx, [ebx]
push esi
lea edx, [esp + 0xa4]
push str..r_02d
push edx
call fcn.0049deb5
add esp, 0xc
push 0x4b2da4
push 0x4b1914
lea eax, [esp + 0xa8]
push eax
push 0x80000000
call fcn.004562d0
push str.Content_Type
lea ecx, [esp + 0xa4]
push ecx
push 0x80000000
call fcn.00455f80
inc esi
cmp esi, edi
jl 0x43c010
pop edi
cmp byte [esp + 0xed4], 0
je 0x43c41a
cmp byte [esp + 0xedc], 0
jne 0x43c07f
test bl, bl
je 0x43c41a
lea edx, [esp + 0x6c8]
push edx
push 0x80000000
call fcn.00455f20
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0xc], 4
ja 0x43c0fc
cmp dword [esp + 0x10], 0xa
ja 0x43c0fc
test bl, bl
je 0x43c0d9
push 0x14
push 0x4befb8
push str.Data
lea ecx, [esp + 0x6d4]
push ecx
push 0x80000000
call fcn.00456420
jmp 0x43c41a
push 0x16
push 0x4befa0
push str.Data
lea edx, [esp + 0x6d4]
push edx
push 0x80000000
call fcn.00456420
jmp 0x43c41a
push 0x400
lea eax, [esp + 0x2cc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov esi, str.rarnew.dat
test bl, bl
jne 0x43c11f
mov esi, str.zipnew.dat
lea ecx, [esp + 0x2c8]
push ecx
call fcn.0044db30
lea esp, [esp]
mov cl, byte [esi]
mov byte [eax], cl
inc esi
inc eax
test cl, cl
jne 0x43c130
lea edx, [esp + 0x2c8]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x43c192
lea eax, [esp + 0x2c8]
push 0x4b1ba8
push eax
call fcn.0049f748
mov esi, eax
add esp, 8
test esi, esi
je 0x43c192
push esi
test bl, bl
je 0x43c178
push 0x14
push 1
push 0x4befb8
jmp 0x43c181
push 0x16
push 1
push 0x4befa0
call fcn.0049f602
add esp, 0x10
push esi
call fcn.0049f426
add esp, 4
lea ecx, [esp + 0x2c8]
push ecx
push str.FileName
lea edx, [esp + 0x6d0]
push edx
push 0x80000000
call fcn.004562d0
jmp 0x43c41a
lea eax, [esp + 0xc]
push 0x4b2e90
push eax
call fcn.0049deb5
add esp, 0xc
push esi
call fcn.0043aaf0
test al, al
je 0x43c41a
push 1
push str.Exist
lea ecx, [esp + 0x10]
push ecx
call fcn.00456960
push 0x200
push 0x4b1914
lea edx, [esp + 0xd0]
push edx
test eax, eax
push str.Type
lea eax, [esp + 0x18]
push eax
setne bl
call fcn.00456900
lea ecx, [esp + 0xc8]
push 0x4b2da4
push ecx
call fcn.004abe46
add esp, 8
test eax, eax
je 0x43c23f
lea edx, [esp + 0xc8]
push str.WinRAR.ZIP
push edx
call fcn.004abe46
add esp, 8
test eax, eax
jne 0x43c247
mov byte [esp + 0xc8], 0
push 0x200
push 0x4b1914
lea eax, [esp + 0x2d0]
push eax
push str.Content
lea ecx, [esp + 0x18]
push ecx
call fcn.00456900
test bl, bl
je 0x43c342
lea edx, [esp + 0xc8]
push edx
push 0x4b1914
push esi
push 0x80000000
call fcn.004562d0
cmp byte [esp + 0x2c8], 0
je 0x43c2ac
lea eax, [esp + 0x2c8]
push eax
push str.Content_Type
push esi
push 0x80000000
call fcn.004562d0
jmp 0x43c2bc
push str.Content_Type
push esi
push 0x80000000
call fcn.00455f80
push 0x400
push 0x4b1914
lea ecx, [esp + 0xad0]
push ecx
push str.ShellNew
lea edx, [esp + 0x18]
push edx
call fcn.00456900
push str.FileName
lea eax, [esp + 0x6cc]
push eax
push 0x80000000
call fcn.00455f80
mov al, byte [esp + 0xac8]
test al, al
je 0x43c374
cmp al, 0x2a
jne 0x43c321
push 0x4b1914
push str.NullFile
lea ecx, [esp + 0x6d0]
push ecx
push 0x80000000
call fcn.004562d0
jmp 0x43c374
lea edx, [esp + 0xac8]
push edx
push str.FileName
lea eax, [esp + 0x6d0]
push eax
push 0x80000000
call fcn.004562d0
jmp 0x43c374
lea ecx, [esp + 0x6c8]
push ecx
push 0x80000000
call fcn.00455f20
push 0x4b1914
push 0x4b1914
push esi
push 0x80000000
call fcn.004562d0
push esi
push 0x80000000
call fcn.00455f20
cmp byte [esp + 0xed8], 0
je 0x43c41a
xor esi, esi
jmp 0x43c390
push esi
lea edx, [esp + 0xa0]
push str..r_02d
push edx
call fcn.0049deb5
add esp, 0xc
test bl, bl
je 0x43c3fe
cmp byte [esp + 0xc8], 0
je 0x43c3fe
lea eax, [esp + 0xc8]
push eax
push 0x4b1914
lea ecx, [esp + 0xa4]
push ecx
push 0x80000000
call fcn.004562d0
cmp byte [esp + 0x2c8], 0
je 0x43c410
lea edx, [esp + 0x2c8]
push edx
push str.Content_Type
lea eax, [esp + 0xa4]
push eax
push 0x80000000
call fcn.004562d0
jmp 0x43c410
lea ecx, [esp + 0x9c]
push ecx
push 0x80000000
call fcn.00455f20
inc esi
cmp esi, 0x64
jl 0x43c390
mov ecx, dword [esp + 0xec8]
pop esi
pop ebx
xor ecx, esp
call fcn.0049dea6
add esp, 0xec4
ret 0x10