Function at 0x43da50
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x1cf8
call fcn.004a4490
mov eax, dword [0x4ca3b0]
xor eax, esp
mov dword [esp + 0x1cf4], eax
push ebx
push esi
mov esi, ecx
push esi
lea eax, [esp + 0xd00]
push str._sShellNew
push eax
mov edx, 0x400
mov byte [0x4c8fdc], 0x52
mov byte [0x4c8fc4], 0x50
call fcn.0046b810
add esp, 0xc
cmp byte [esp + 0x1d04], 0
push esi
je 0x43dd7a
call fcn.0043c640
test al, al
jne 0x43dbe1
push 0x200
push 0x4b8d34
lea ecx, [esp + 0x504]
push ecx
push 0x4b8d34
push esi
push 0x80000000
call fcn.0045ac30
push 0x200
push 0x4b8d34
lea edx, [esp + 0x104]
push edx
push str.Content_Type
push esi
push 0x80000000
call fcn.0045ac30
push 0x400
push 0x4b8d34
lea eax, [esp + 0x1504]
push eax
push str.FileName
lea ecx, [esp + 0xd0c]
push ecx
push 0x80000000
call fcn.0045ac30
push 0xa
push 0x4b8d34
lea edx, [esp + 0xf0]
push edx
push str.NullFile
lea eax, [esp + 0xd0c]
push eax
push 0x80000000
call fcn.0045ac30
push esi
lea ecx, [esp + 0x4c]
push 0x4ba8b8
push ecx
mov edx, 0x50
mov bl, al
call fcn.0046b810
add esp, 0xc
push esi
push 0x80000000
call fcn.0045a960
movzx edx, al
push edx
push str.Exist
lea eax, [esp + 0x50]
push eax
call fcn.0045b150
lea ecx, [esp + 0x4fc]
push ecx
push str.Type
lea edx, [esp + 0x50]
push edx
call fcn.0045b130
lea eax, [esp + 0xfc]
push eax
push str.Content
lea ecx, [esp + 0x50]
push ecx
call fcn.0045b130
cmp word [esp + 0x14fc], 0
jne 0x43dbca
test bl, bl
je 0x43dbca
push 0x4b8efc
push str.ShellNew
lea edx, [esp + 0x50]
push edx
jmp 0x43dbdc
lea eax, [esp + 0x14fc]
push eax
push str.ShellNew
lea ecx, [esp + 0x50]
push ecx
call fcn.0045b130
cmp byte [esp + 0x1d10], 0
mov eax, str.WinRAR.ZIP
jne 0x43dbf5
mov eax, 0x4ba758
push eax
push 0x4b8d34
push esi
push 0x80000000
call fcn.0045abc0
push str.Content_Type
push esi
push 0x80000000
call fcn.0045a840
mov bl, byte [esp + 0x1d0c]
test bl, bl
je 0x43dc8b
push edi
call fcn.0043e920
mov edi, eax
neg edi
sbb edi, edi
and edi, 0xffffffba
add edi, 0x64
xor esi, esi
test edi, edi
jle 0x43dc8a
lea esp, [esp]
push esi
lea edx, [esp + 0x10]
push str..r_02d
push edx
mov edx, 0x20
call fcn.0046b810
add esp, 0xc
push 0x4ba758
push 0x4b8d34
lea eax, [esp + 0x14]
push eax
push 0x80000000
call fcn.0045abc0
push str.Content_Type
lea ecx, [esp + 0x10]
push ecx
push 0x80000000
call fcn.0045a840
inc esi
cmp esi, edi
jl 0x43dc40
pop edi
cmp byte [esp + 0x1d08], 0
je 0x43dfd5
cmp byte [esp + 0x1d10], 0
jne 0x43dcab
test bl, bl
je 0x43dfd5
lea edx, [esp + 0xcfc]
push edx
push 0x80000000
call fcn.0045a790
push 0x400
lea eax, [esp + 0x500]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, str.rarnew.dat
test bl, bl
jne 0x43dce0
mov esi, str.zipnew.dat
lea ecx, [esp + 0x4fc]
push ecx
call fcn.004515b0
lea ecx, [ecx]
movzx ecx, word [esi]
mov word [eax], cx
add esi, 2
add eax, 2
test cx, cx
jne 0x43dcf0
lea edx, [esp + 0x4fc]
push edx
call fcn.00431560
test al, al
jne 0x43dd56
push 0
push 0x4b8e04
lea eax, [esp + 0x504]
push eax
call fcn.00431b90
mov esi, eax
test esi, esi
je 0x43dd56
push esi
test bl, bl
je 0x43dd3c
push 0x14
push 1
push 0x4c8fdc
jmp 0x43dd45
push 0x16
push 1
push 0x4c8fc4
call fcn.004a5f54
add esp, 0x10
push esi
call fcn.004a5d25
add esp, 4
lea ecx, [esp + 0x4fc]
push ecx
push str.FileName
lea edx, [esp + 0xd04]
push edx
push 0x80000000
call fcn.0045abc0
jmp 0x43dfd5
lea eax, [esp + 0x4c]
push 0x4ba8b8
push eax
mov edx, 0x50
call fcn.0046b810
add esp, 0xc
push esi
call fcn.0043c640
test al, al
je 0x43dfd5
push 1
push str.Exist
lea ecx, [esp + 0x50]
push ecx
call fcn.0045b230
push 0x200
push 0x4b8d34
lea edx, [esp + 0x104]
push edx
test eax, eax
push str.Type
lea eax, [esp + 0x58]
push eax
setne bl
call fcn.0045b200
push 0x4ba758
lea ecx, [esp + 0x100]
push ecx
call fcn.00472b40
test eax, eax
je 0x43de02
push str.WinRAR.ZIP
lea edx, [esp + 0x100]
push edx
call fcn.00472b40
test eax, eax
jne 0x43de0c
xor eax, eax
mov word [esp + 0xfc], ax
push 0x200
push 0x4b8d34
lea ecx, [esp + 0x504]
push ecx
push str.Content
lea edx, [esp + 0x58]
push edx
call fcn.0045b200
test bl, bl
je 0x43df0c
lea eax, [esp + 0xfc]
push eax
push 0x4b8d34
push esi
push 0x80000000
call fcn.0045abc0
cmp word [esp + 0x4fc], 0
je 0x43de72
lea ecx, [esp + 0x4fc]
push ecx
push str.Content_Type
push esi
push 0x80000000
call fcn.0045abc0
jmp 0x43de82
push str.Content_Type
push esi
push 0x80000000
call fcn.0045a840
push 0x400
push 0x4b8d34
lea edx, [esp + 0x1504]
push edx
push str.ShellNew
lea eax, [esp + 0x58]
push eax
call fcn.0045b200
push str.FileName
lea ecx, [esp + 0xd00]
push ecx
push 0x80000000
call fcn.0045a840
mov ax, word [esp + 0x14fc]
test ax, ax
je 0x43df3e
cmp ax, 0x2a
jne 0x43deeb
push 0x4b8d34
push str.NullFile
lea edx, [esp + 0xd04]
push edx
push 0x80000000
call fcn.0045abc0
jmp 0x43df3e
lea eax, [esp + 0x14fc]
push eax
push str.FileName
lea ecx, [esp + 0xd04]
push ecx
push 0x80000000
call fcn.0045abc0
jmp 0x43df3e
lea edx, [esp + 0xcfc]
push edx
push 0x80000000
call fcn.0045a790
push 0x4b8d34
push 0x4b8d34
push esi
push 0x80000000
call fcn.0045abc0
push esi
push 0x80000000
call fcn.0045a790
cmp byte [esp + 0x1d0c], 0
je 0x43dfd5
xor esi, esi
mov edi, edi
push esi
lea eax, [esp + 0xc]
push str..r_02d
push eax
mov edx, 0x20
call fcn.0046b810
add esp, 0xc
test bl, bl
je 0x43dfbc
cmp word [esp + 0xfc], 0
je 0x43dfbc
lea ecx, [esp + 0xfc]
push ecx
push 0x4b8d34
lea edx, [esp + 0x10]
push edx
push 0x80000000
call fcn.0045abc0
cmp word [esp + 0x4fc], 0
je 0x43dfcb
lea eax, [esp + 0x4fc]
push eax
push str.Content_Type
lea ecx, [esp + 0x10]
push ecx
push 0x80000000
call fcn.0045abc0
jmp 0x43dfcb
lea edx, [esp + 8]
push edx
push 0x80000000
call fcn.0045a790
inc esi
cmp esi, 0x64
jl 0x43df50
mov ecx, dword [esp + 0x1cfc]
pop esi
pop ebx
xor ecx, esp
call fcn.004a3c63
add esp, 0x1cf8
ret 0x10