Function at 0x44a510
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x28f8
call fcn.004c1320
mov eax, dword [0x4eb0b4]
xor eax, esp
mov dword [esp + 0x28f4], eax
push ebx
push esi
mov esi, ecx
push esi
lea eax, [esp + 0x900]
push str._sShellNew
push eax
mov edx, 0x800
mov byte [0x4e9830], 0x52
mov byte [0x4e9818], 0x50
call fcn.0041cb70
add esp, 0xc
cmp byte [esp + 0x2904], 0
push esi
je 0x44a82a
call fcn.00449130
test al, al
jne 0x44a6a1
push 0x200
push 0x4d79fc
lea ecx, [esp + 0x504]
push ecx
push 0x4d79fc
push esi
push 0x80000000
call fcn.0046c2b0
push 0x200
push 0x4d79fc
lea edx, [esp + 0x104]
push edx
push str.Content_Type
push esi
push 0x80000000
call fcn.0046c2b0
push 0x800
push 0x4d79fc
lea eax, [esp + 0x1904]
push eax
push str.FileName
lea ecx, [esp + 0x90c]
push ecx
push 0x80000000
call fcn.0046c2b0
push 0xa
push 0x4d79fc
lea edx, [esp + 0xf0]
push edx
push str.NullFile
lea eax, [esp + 0x90c]
push eax
push 0x80000000
call fcn.0046c2b0
push esi
lea ecx, [esp + 0x4c]
push str.Setup_s
push ecx
mov edx, 0x50
mov bl, al
call fcn.0041cb70
add esp, 0xc
push esi
push 0x80000000
call fcn.0046bfe0
movzx edx, al
push edx
push str.Exist
lea eax, [esp + 0x50]
push eax
call fcn.0046c810
lea ecx, [esp + 0x4fc]
push ecx
push 0x4d868c
lea edx, [esp + 0x50]
push edx
call fcn.0046c7f0
lea eax, [esp + 0xfc]
push eax
push str.Content
lea ecx, [esp + 0x50]
push ecx
call fcn.0046c7f0
cmp word [esp + 0x18fc], 0
jne 0x44a68a
test bl, bl
je 0x44a68a
push 0x4d7800
push str.ShellNew
lea edx, [esp + 0x50]
push edx
jmp 0x44a69c
lea eax, [esp + 0x18fc]
push eax
push str.ShellNew
lea ecx, [esp + 0x50]
push ecx
call fcn.0046c7f0
cmp byte [esp + 0x2910], 0
mov eax, str.WinRAR.ZIP
jne 0x44a6b5
mov eax, 0x4d9bec
push eax
push 0x4d79fc
push esi
push 0x80000000
call fcn.0046c240
push str.Content_Type
push esi
push 0x80000000
call fcn.0046bec0
mov bl, byte [esp + 0x290c]
test bl, bl
je 0x44a74b
push edi
call fcn.0044b3b0
mov edi, eax
neg edi
sbb edi, edi
and edi, 0xffffffba
add edi, 0x64
xor esi, esi
test edi, edi
jle 0x44a74a
lea esp, [esp]
push esi
lea edx, [esp + 0x10]
push str..r_02d
push edx
mov edx, 0x20
call fcn.0041cb70
add esp, 0xc
push 0x4d9bec
push 0x4d79fc
lea eax, [esp + 0x14]
push eax
push 0x80000000
call fcn.0046c240
push str.Content_Type
lea ecx, [esp + 0x10]
push ecx
push 0x80000000
call fcn.0046bec0
inc esi
cmp esi, edi
jl 0x44a700
pop edi
cmp byte [esp + 0x2908], 0
je 0x44aa85
cmp byte [esp + 0x2910], 0
jne 0x44a76b
test bl, bl
je 0x44aa85
lea edx, [esp + 0x8fc]
push edx
push 0x80000000
call fcn.0046be10
push 0x800
lea eax, [esp + 0x1900]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, str.rarnew.dat
test bl, bl
jne 0x44a7a0
mov eax, str.zipnew.dat
push 0x800
push eax
lea ecx, [esp + 0x1904]
push ecx
call fcn.004607f0
lea edx, [esp + 0x18fc]
push edx
call fcn.0043ccc0
test al, al
jne 0x44a806
push 0x4d83b4
lea eax, [esp + 0x1900]
push eax
call fcn.0043caf0
mov esi, eax
test esi, esi
je 0x44a806
push esi
test bl, bl
je 0x44a7ec
push 0x14
push 1
push 0x4e9830
jmp 0x44a7f5
push 0x16
push 1
push 0x4e9818
call fcn.004c3ee0
add esp, 0x10
push esi
call fcn.004c3d02
add esp, 4
lea ecx, [esp + 0x18fc]
push ecx
push str.FileName
lea edx, [esp + 0x904]
push edx
push 0x80000000
call fcn.0046c240
jmp 0x44aa85
lea eax, [esp + 0x4c]
push str.Setup_s
push eax
mov edx, 0x50
call fcn.0041cb70
add esp, 0xc
push esi
call fcn.00449130
test al, al
je 0x44aa85
push 1
push str.Exist
lea ecx, [esp + 0x50]
push ecx
call fcn.0046c8f0
push 0x200
push 0x4d79fc
lea edx, [esp + 0x104]
push edx
test eax, eax
push 0x4d868c
lea eax, [esp + 0x58]
push eax
setne bl
call fcn.0046c8c0
push 0x4d9bec
lea ecx, [esp + 0x100]
push ecx
call fcn.00486fc0
test eax, eax
je 0x44a8b2
push str.WinRAR.ZIP
lea edx, [esp + 0x100]
push edx
call fcn.00486fc0
test eax, eax
jne 0x44a8bc
xor eax, eax
mov word [esp + 0xfc], ax
push 0x200
push 0x4d79fc
lea ecx, [esp + 0x504]
push ecx
push str.Content
lea edx, [esp + 0x58]
push edx
call fcn.0046c8c0
test bl, bl
je 0x44a9bc
lea eax, [esp + 0xfc]
push eax
push 0x4d79fc
push esi
push 0x80000000
call fcn.0046c240
cmp word [esp + 0x4fc], 0
je 0x44a922
lea ecx, [esp + 0x4fc]
push ecx
push str.Content_Type
push esi
push 0x80000000
call fcn.0046c240
jmp 0x44a932
push str.Content_Type
push esi
push 0x80000000
call fcn.0046bec0
push 0x800
push 0x4d79fc
lea edx, [esp + 0x1904]
push edx
push str.ShellNew
lea eax, [esp + 0x58]
push eax
call fcn.0046c8c0
push str.FileName
lea ecx, [esp + 0x900]
push ecx
push 0x80000000
call fcn.0046bec0
mov ax, word [esp + 0x18fc]
test ax, ax
je 0x44a9ee
cmp ax, 0x2a
jne 0x44a99b
push 0x4d79fc
push str.NullFile
lea edx, [esp + 0x904]
push edx
push 0x80000000
call fcn.0046c240
jmp 0x44a9ee
lea eax, [esp + 0x18fc]
push eax
push str.FileName
lea ecx, [esp + 0x904]
push ecx
push 0x80000000
call fcn.0046c240
jmp 0x44a9ee
lea edx, [esp + 0x8fc]
push edx
push 0x80000000
call fcn.0046be10
push 0x4d79fc
push 0x4d79fc
push esi
push 0x80000000
call fcn.0046c240
push esi
push 0x80000000
call fcn.0046be10
cmp byte [esp + 0x290c], 0
je 0x44aa85
xor esi, esi
mov edi, edi
push esi
lea eax, [esp + 0xc]
push str..r_02d
push eax
mov edx, 0x20
call fcn.0041cb70
add esp, 0xc
test bl, bl
je 0x44aa6c
cmp word [esp + 0xfc], 0
je 0x44aa6c
lea ecx, [esp + 0xfc]
push ecx
push 0x4d79fc
lea edx, [esp + 0x10]
push edx
push 0x80000000
call fcn.0046c240
cmp word [esp + 0x4fc], 0
je 0x44aa7b
lea eax, [esp + 0x4fc]
push eax
push str.Content_Type
lea ecx, [esp + 0x10]
push ecx
push 0x80000000
call fcn.0046c240
jmp 0x44aa7b
lea edx, [esp + 8]
push edx
push 0x80000000
call fcn.0046be10
inc esi
cmp esi, 0x64
jl 0x44aa00
mov ecx, dword [esp + 0x28fc]
pop esi
pop ebx
xor ecx, esp
call fcn.004c1302
add esp, 0x28f8
ret 0x10