Function at 0x449a70
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x28f8
call fcn.004bfc70
mov eax, dword [0x4ea93c]
xor eax, esp
mov dword [esp + 0x28f4], eax
push ebx
push esi
mov esi, ecx
push esi
lea eax, [esp + 0x900]
push str._sShellNew
push eax
mov edx, 0x800
mov byte [0x4e915c], 0x52
mov byte [0x4e9144], 0x50
call fcn.0043a6e0
add esp, 0xc
cmp byte [esp + 0x2904], 0
push esi
je 0x449d8a
call fcn.00448950
test al, al
jne 0x449c01
push 0x200
push 0x4d69fc
lea ecx, [esp + 0x504]
push ecx
push 0x4d69fc
push esi
push 0x80000000
call fcn.0046b6a0
push 0x200
push 0x4d69fc
lea edx, [esp + 0x104]
push edx
push str.Content_Type
push esi
push 0x80000000
call fcn.0046b6a0
push 0x800
push 0x4d69fc
lea eax, [esp + 0x1904]
push eax
push str.FileName
lea ecx, [esp + 0x90c]
push ecx
push 0x80000000
call fcn.0046b6a0
push 0xa
push 0x4d69fc
lea edx, [esp + 0xf0]
push edx
push str.NullFile
lea eax, [esp + 0x90c]
push eax
push 0x80000000
call fcn.0046b6a0
push esi
lea ecx, [esp + 0x4c]
push str.Setup_s
push ecx
mov edx, 0x50
mov bl, al
call fcn.0043a6e0
add esp, 0xc
push esi
push 0x80000000
call fcn.0046b3d0
movzx edx, al
push edx
push str.Exist
lea eax, [esp + 0x50]
push eax
call fcn.0046bc00
lea ecx, [esp + 0x4fc]
push ecx
push str.Type
lea edx, [esp + 0x50]
push edx
call fcn.0046bbe0
lea eax, [esp + 0xfc]
push eax
push str.Content
lea ecx, [esp + 0x50]
push ecx
call fcn.0046bbe0
cmp word [esp + 0x18fc], 0
jne 0x449bea
test bl, bl
je 0x449bea
push 0x4d67f0
push str.ShellNew
lea edx, [esp + 0x50]
push edx
jmp 0x449bfc
lea eax, [esp + 0x18fc]
push eax
push str.ShellNew
lea ecx, [esp + 0x50]
push ecx
call fcn.0046bbe0
cmp byte [esp + 0x2910], 0
mov eax, str.WinRAR.ZIP
jne 0x449c15
mov eax, 0x4d8bf4
push eax
push 0x4d69fc
push esi
push 0x80000000
call fcn.0046b630
push str.Content_Type
push esi
push 0x80000000
call fcn.0046b2b0
mov bl, byte [esp + 0x290c]
test bl, bl
je 0x449cab
push edi
call fcn.0044a940
mov edi, eax
neg edi
sbb edi, edi
and edi, 0xffffffba
add edi, 0x64
xor esi, esi
test edi, edi
jle 0x449caa
lea esp, [esp]
push esi
lea edx, [esp + 0x10]
push str..r_02d
push edx
mov edx, 0x20
call fcn.0043a6e0
add esp, 0xc
push 0x4d8bf4
push 0x4d69fc
lea eax, [esp + 0x14]
push eax
push 0x80000000
call fcn.0046b630
push str.Content_Type
lea ecx, [esp + 0x10]
push ecx
push 0x80000000
call fcn.0046b2b0
inc esi
cmp esi, edi
jl 0x449c60
pop edi
cmp byte [esp + 0x2908], 0
je 0x449fe5
cmp byte [esp + 0x2910], 0
jne 0x449ccb
test bl, bl
je 0x449fe5
lea edx, [esp + 0x8fc]
push edx
push 0x80000000
call fcn.0046b200
push 0x800
lea eax, [esp + 0x1900]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, str.rarnew.dat
test bl, bl
jne 0x449d00
mov eax, str.zipnew.dat
push 0x800
push eax
lea ecx, [esp + 0x1904]
push ecx
call fcn.0045fad0
lea edx, [esp + 0x18fc]
push edx
call fcn.0043c780
test al, al
jne 0x449d66
push 0x4d73cc
lea eax, [esp + 0x1900]
push eax
call fcn.0043c420
mov esi, eax
test esi, esi
je 0x449d66
push esi
test bl, bl
je 0x449d4c
push 0x14
push 1
push 0x4e915c
jmp 0x449d55
push 0x16
push 1
push 0x4e9144
call fcn.004c2576
add esp, 0x10
push esi
call fcn.004c2398
add esp, 4
lea ecx, [esp + 0x18fc]
push ecx
push str.FileName
lea edx, [esp + 0x904]
push edx
push 0x80000000
call fcn.0046b630
jmp 0x449fe5
lea eax, [esp + 0x4c]
push str.Setup_s
push eax
mov edx, 0x50
call fcn.0043a6e0
add esp, 0xc
push esi
call fcn.00448950
test al, al
je 0x449fe5
push 1
push str.Exist
lea ecx, [esp + 0x50]
push ecx
call fcn.0046bce0
push 0x200
push 0x4d69fc
lea edx, [esp + 0x104]
push edx
test eax, eax
push str.Type
lea eax, [esp + 0x58]
push eax
setne bl
call fcn.0046bcb0
push 0x4d8bf4
lea ecx, [esp + 0x100]
push ecx
call fcn.00485df0
test eax, eax
je 0x449e12
push str.WinRAR.ZIP
lea edx, [esp + 0x100]
push edx
call fcn.00485df0
test eax, eax
jne 0x449e1c
xor eax, eax
mov word [esp + 0xfc], ax
push 0x200
push 0x4d69fc
lea ecx, [esp + 0x504]
push ecx
push str.Content
lea edx, [esp + 0x58]
push edx
call fcn.0046bcb0
test bl, bl
je 0x449f1c
lea eax, [esp + 0xfc]
push eax
push 0x4d69fc
push esi
push 0x80000000
call fcn.0046b630
cmp word [esp + 0x4fc], 0
je 0x449e82
lea ecx, [esp + 0x4fc]
push ecx
push str.Content_Type
push esi
push 0x80000000
call fcn.0046b630
jmp 0x449e92
push str.Content_Type
push esi
push 0x80000000
call fcn.0046b2b0
push 0x800
push 0x4d69fc
lea edx, [esp + 0x1904]
push edx
push str.ShellNew
lea eax, [esp + 0x58]
push eax
call fcn.0046bcb0
push str.FileName
lea ecx, [esp + 0x900]
push ecx
push 0x80000000
call fcn.0046b2b0
mov ax, word [esp + 0x18fc]
test ax, ax
je 0x449f4e
cmp ax, 0x2a
jne 0x449efb
push 0x4d69fc
push str.NullFile
lea edx, [esp + 0x904]
push edx
push 0x80000000
call fcn.0046b630
jmp 0x449f4e
lea eax, [esp + 0x18fc]
push eax
push str.FileName
lea ecx, [esp + 0x904]
push ecx
push 0x80000000
call fcn.0046b630
jmp 0x449f4e
lea edx, [esp + 0x8fc]
push edx
push 0x80000000
call fcn.0046b200
push 0x4d69fc
push 0x4d69fc
push esi
push 0x80000000
call fcn.0046b630
push esi
push 0x80000000
call fcn.0046b200
cmp byte [esp + 0x290c], 0
je 0x449fe5
xor esi, esi
mov edi, edi
push esi
lea eax, [esp + 0xc]
push str..r_02d
push eax
mov edx, 0x20
call fcn.0043a6e0
add esp, 0xc
test bl, bl
je 0x449fcc
cmp word [esp + 0xfc], 0
je 0x449fcc
lea ecx, [esp + 0xfc]
push ecx
push 0x4d69fc
lea edx, [esp + 0x10]
push edx
push 0x80000000
call fcn.0046b630
cmp word [esp + 0x4fc], 0
je 0x449fdb
lea eax, [esp + 0x4fc]
push eax
push str.Content_Type
lea ecx, [esp + 0x10]
push ecx
push 0x80000000
call fcn.0046b630
jmp 0x449fdb
lea edx, [esp + 8]
push edx
push 0x80000000
call fcn.0046b200
inc esi
cmp esi, 0x64
jl 0x449f60
mov ecx, dword [esp + 0x28fc]
pop esi
pop ebx
xor ecx, esp
call fcn.004bfc52
add esp, 0x28f8
ret 0x10