Function at 0x1400a2f30
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x30c0
call fcn.1400fe810
sub rsp, rax
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x3110], rbx
mov rax, qword [0x140132350]
xor rax, rsp
mov qword [rsp + 0x30b0], rax
mov r12, rdx
mov rbx, rcx
mov qword [rsp + 0x50], rcx
call fcn.140041020
nop
xor r13d, r13d
mov byte [rbx + 0x3038], r13b
mov edi, 0x800
mov r9, rdi
lea r8, [rsp + 0x10b0]
lea rdx, [rsp + 0x20b0]
lea rcx, [0x1401679a0]
call fcn.1400a4b10
lea r11, [r12 + 0x83ea]
cmp word [r11], r13w
je 0x1400a2fd7
lea rcx, [rsp + 0x20b0]
sub rcx, r11
movzx eax, word [r11]
mov word [rcx + r11], ax
add r11, 2
cmp ax, r13w
jne 0x1400a2fc4
lea rcx, [r12 + 0x93ea]
cmp word [rcx], r13w
je 0x1400a3001
lea rdx, [rsp + 0x10b0]
sub rdx, rcx
movzx eax, word [rcx]
mov word [rdx + rcx], ax
add rcx, 2
cmp ax, r13w
jne 0x1400a2ff0
lea rbp, [r12 + 0x1018]
mov rcx, rbp
call fcn.140050ce0
mov rcx, rax
mov r8d, 6
lea rdx, str.WinCon
call fcn.140068cd4
cmp eax, r13d
jne 0x1400a3039
movzx eax, r13w
mov word [rsp + 0x10b0], ax
jmp 0x1400a3041
mov ax, word [rsp + 0x10b0]
mov word [rbx + 0x1030], r13w
cmp word [rbp], r13w
je 0x1400a3417
cmp word [rsp + 0x20b0], r13w
jne 0x1400a3073
cmp ax, r13w
jne 0x1400a3073
cmp byte [r12 + 0xa3ea], r13b
je 0x1400a3417
mov rcx, rbp
call fcn.140042584
cmp al, r13b
je 0x1400a3417
mov rcx, rbp
lea rdx, [rbx + 0x2030]
sub rdx, rbp
movzx eax, word [rcx]
mov word [rdx + rcx], ax
add rcx, 2
cmp ax, r13w
jne 0x1400a3091
mov qword [rbx + 0x3030], rbp
mov r8, rdi
lea rdx, [rbx + 0x1030]
lea rcx, str.Rar_SF
call fcn.1400b5c78
mov rdi, rax
cmp rax, r13
je 0x1400a33f5
mov rdx, rbp
mov rcx, rbx
call fcn.1400a00b0
cmp al, r13b
je 0x1400a3103
mov ecx, 0x5f5
call fcn.14005fad0
mov rcx, rax
call fcn.1400c5808
mov edx, 1
lea rcx, [0x140149f00]
call fcn.14003c438
jmp 0x1400a33f5
mov r8, rdi
mov rdx, rbp
mov rcx, rbx
call fcn.1400a017c
cmp al, r13b
je 0x1400a3417
mov rcx, rdi
call fcn.1400eee40
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], r13
mov edx, 0x10000
lea rcx, [rsp + 0x30]
call fcn.14000127c
nop
mov r9, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x30]
mov r8, rdi
mov rdx, rbp
mov rcx, rbx
call fcn.1400a022c
mov qword [rsp + 0x28], rax
xor edx, edx
lea rcx, [rbx + 0x1030]
call qword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
mov r15, rax
cmp rax, r13
jne 0x1400a3190
cmp rdi, r13
je 0x1400a3417
mov rcx, rdi
call fcn.1400e9aa4
jmp 0x1400a3417
mov byte [rsp + 0x20], r13b
mov r14b, r13b
xor edx, edx
lea r8d, [rdx + 3]
lea rcx, [rbx + 0x1030]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov r13, rax
xor edx, edx
cmp rax, rdx
je 0x1400a3273
movzx eax, word [rsp + 0x20b0]
cmp ax, dx
je 0x1400a3221
mov r9, r15
lea r8, [0x1400a0090]
mov edx, 3
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
mov r9, r15
lea r8, [0x1400a0090]
mov edx, 0xe
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
mov r9d, reloc.SHELL32.dll_SHRestricted
lea r8, [rsp + 0x20b0]
mov rdx, r15
mov rcx, rbx
call fcn.14009fcf4
mov cl, al
mov byte [rsp + 0x20], al
mov ax, word [rsp + 0x20b0]
xor edx, edx
jmp 0x1400a3223
mov cl, dl
cmp word [rsp + 0x10b0], dx
je 0x1400a326a
cmp ax, dx
je 0x1400a3236
cmp cl, dl
je 0x1400a326a
mov r9, r15
lea r8, [0x1400a0090]
mov edx, 2
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
mov r9d, 0x65
lea r8, [rsp + 0x10b0]
mov rdx, r15
mov rcx, rbx
call fcn.14009ff2c
mov r14b, al
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor edx, edx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_EndUpdateResourceW]
xor r13d, r13d
cmp eax, r13d
je 0x1400a33e6
cmp word [rsp + 0x10b0], r13w
je 0x1400a329e
cmp r14b, r13b
je 0x1400a33e6
cmp byte [rsp + 0x20], r13b
jne 0x1400a32b8
cmp r14b, r13b
jne 0x1400a32b8
cmp byte [r12 + 0xa3ea], r13b
je 0x1400a336c
cmp byte [r12 + 0xa3ea], r13b
je 0x1400a32d1
lea rdx, [rbx + 0x1030]
mov rcx, rbx
call fcn.1400a03d8
mov qword [rsp + 0x1070], r13
mov qword [rsp + 0x1078], r13
mov qword [rsp + 0x1080], r13
xor r8d, r8d
lea rdx, [rsp + 0x60]
lea rcx, [rbx + 0x1030]
call fcn.140043efc
cmp al, r13b
je 0x1400a3350
mov rcx, qword [rsp + 0x1060]
mov r12, qword [rsp + 0x28]
add rcx, r12
mov r14d, 0x100000
cmp rcx, r14
jbe 0x1400a3355
mov ecx, 0x5a0
call fcn.14005fad0
mov rdx, rax
mov r8d, r14d
lea rcx, [0x140173f2a]
call fcn.1400c5d9c
nop
cmp rdi, r13
je 0x1400a3417
mov rcx, rdi
call fcn.1400e9aa4
jmp 0x1400a3417
mov r12, qword [rsp + 0x28]
mov r8d, 0x800
lea rdx, [rbx + 0x1030]
mov rcx, rbp
call fcn.140065d2c
jmp 0x1400a3371
mov r12, qword [rsp + 0x28]
cmp r12, r13
je 0x1400a33d7
mov r9, qword [rsp + 0x38]
mov r8, rdi
lea rdx, [rbx + 0x1030]
mov rcx, rbx
call fcn.1400a022c
cmp rax, r13
jne 0x1400a33d7
lea rdx, [0x140112a08]
lea rcx, [rbx + 0x1030]
call fcn.1400b5c3c
mov rbp, rax
cmp rax, r13
je 0x1400a33d7
xor edx, edx
lea r8d, [rdx + 2]
mov rcx, rax
call fcn.1400ef620
mov r9, rbp
mov r8, r12
mov edx, 1
mov rcx, rdi
call fcn.1400ef054
mov rcx, rbp
call fcn.1400eee40
nop
cmp rdi, r13
je 0x1400a33f5
mov rcx, rdi
call fcn.1400e9aa4
jmp 0x1400a33f5
cmp rdi, r13
je 0x1400a3417
mov rcx, rdi
call fcn.1400e9aa4
jmp 0x1400a3417
cmp word [rbx + 0x1030], r13w
je 0x1400a3417
mov r9, qword [rbx]
mov r8d, 4
lea rdx, [rbx + 0x1030]
mov rcx, rbx
call qword [r9 + reloc.COMCTL32.dll_CreateMappedBitmap]
nop
mov rax, rbx
mov rcx, qword [rsp + 0x30b0]
xor rcx, rsp
call fcn.1400e9d00
mov rbx, qword [rsp + 0x3110]
add rsp, 0x30c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret