Function at 0x401d49
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x3148
call fcn.0040a9a0
mov eax, dword [0x42b7a4]
xor eax, esp
mov dword [esp + 0x3144], eax
push ebx
mov bh, byte [esp + 0x315c]
lea eax, [esp + 0x2148]
push ebp
push esi
push edi
mov edi, dword [esp + 0x315c]
push edi
push str._sShellNew
push 0x800
push eax
mov byte [0x42b0dc], 0x52
mov byte [0x42b0f4], 0x50
call fcn.004035d8
push edi
push str.Setup_s
lea eax, [esp + 0x10cc]
push 0x50
push eax
call fcn.004035d8
add esp, 0x20
mov esi, str.SetupMenuItems
push 1
push str.NewRAR
push esi
call fcn.00408b79
test eax, eax
jne 0x401dd7
test bh, bh
setne bl
dec bl
and bl, byte [esp + 0x3164]
jmp 0x401dde
mov bl, byte [esp + 0x3164]
push 1
push str.NewZIP
push esi
call fcn.00408b79
test eax, eax
jne 0x401dfd
cmp byte [esp + 0x316c], al
setne al
dec al
and bl, al
xor ebp, ebp
mov esi, SysReAllocString
cmp byte [esp + 0x3160], 0
je 0x40205b
push edi
call fcn.00401685
test al, al
jne 0x401ee6
push 0x200
mov ecx, 0x4204c0
lea eax, [esp + 0x1158]
push ecx
push eax
push ecx
push edi
push esi
call fcn.00408b92
push 0x800
push 0x4204c0
lea eax, [esp + 0x20]
push eax
push str.FileName
lea eax, [esp + 0x2164]
push eax
push esi
call fcn.00408b92
push 0xa
push 0x4204c0
lea eax, [esp + 0x10a8]
push eax
push str.NullFile
lea eax, [esp + 0x2164]
push eax
push esi
call fcn.00408b92
push edi
push esi
mov byte [esp + 0x1b], al
call fcn.00407eb7
movzx ecx, al
lea eax, [esp + 0x10b4]
push ecx
push str.Exist
push eax
call fcn.00408fc4
lea eax, [esp + 0x1154]
push eax
push str.Type
lea eax, [esp + 0x10bc]
push eax
call fcn.00408fab
cmp word [esp + 0x18], bp
jne 0x401ecf
cmp byte [esp + 0x13], 0
je 0x401ecf
push 0x4210c8
jmp 0x401ed4
lea eax, [esp + 0x18]
push eax
push str.ShellNew
lea eax, [esp + 0x10bc]
push eax
call fcn.00408fab
cmp byte [esp + 0x316c], 0
mov eax, str.WinRAR.ZIP
jne 0x401efa
mov eax, 0x420984
push eax
push 0x4204c0
push edi
push esi
call fcn.00408e8b
test bh, bh
je 0x401f5a
call fcn.004055ca
neg eax
sbb esi, esi
and esi, 0xffffffba
add esi, 0x64
push ebp
push str..r_02u
lea eax, [esp + 0x1068]
push 0x20
push eax
call fcn.004035d8
add esp, 0x10
lea eax, [esp + 0x1060]
push 0x420984
push 0x4204c0
push eax
push SysReAllocString
call fcn.00408e8b
inc ebp
cmp ebp, esi
jb 0x401f1a
xor ebp, ebp
mov esi, SysReAllocString
test bl, bl
je 0x40205b
cmp byte [esp + 0x316c], 0
jne 0x401f74
test bh, bh
je 0x40205b
lea eax, [esp + 0x2154]
push eax
push esi
call fcn.004089eb
push 0x800
lea eax, [esp + 0x1158]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, str.rarnew.dat
test bh, bh
jne 0x401fa4
mov eax, str.zipnew.dat
push 0x800
push eax
lea eax, [esp + 0x115c]
push eax
call fcn.00405c32
lea ecx, [esp + 0x18]
call fcn.0040124f
push ebp
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x115c]
push eax
call fcn.00404f4f
test al, al
movzx eax, bh
mov dword [esp + 0x14], eax
je 0x401ff7
lea eax, [eax*2 + 0x16]
cmp dword [esp + 0x1018], eax
jne 0x401ff7
cmp dword [esp + 0x101c], ebp
je 0x402040
push 0x4211c4
lea eax, [esp + 0x1158]
push eax
call fcn.0040485b
mov esi, eax
test esi, esi
je 0x40203b
mov ecx, 0x42b0dc
test bh, bh
jne 0x40201d
mov ecx, 0x42b0f4
mov eax, dword [esp + 0x14]
push esi
lea eax, [eax*2 + 0x16]
push eax
push 1
push ecx
call fcn.004107f0
push esi
call fcn.00410538
add esp, 0x14
mov esi, SysReAllocString
lea eax, [esp + 0x1154]
push eax
push str.FileName
lea eax, [esp + 0x215c]
push eax
push esi
call fcn.00408e8b
push edi
call fcn.00401685
test al, al
je 0x40221b
cmp byte [esp + 0x3160], 0
je 0x40207b
test bl, bl
jne 0x40221b
push 1
push str.Exist
lea eax, [esp + 0x10bc]
push eax
call fcn.00408b79
test eax, eax
setne bl
cmp byte [esp + 0x3160], 0
jne 0x402187
push 0x200
push 0x4204c0
lea eax, [esp + 0x115c]
push eax
push str.Type
lea eax, [esp + 0x10c4]
push eax
call fcn.00408cd5
push 0x420984
lea eax, [esp + 0x1158]
push eax
call fcn.00407df8
test eax, eax
je 0x4020f2
push str.WinRAR.ZIP
lea eax, [esp + 0x1158]
push eax
call fcn.00407df8
test eax, eax
jne 0x4020fc
xor eax, eax
mov word [esp + 0x1154], ax
test bl, bl
je 0x402116
lea eax, [esp + 0x1154]
push eax
push 0x4204c0
push edi
push esi
call fcn.00408e8b
jmp 0x40212b
mov eax, 0x4204c0
push eax
push eax
push edi
push esi
call fcn.00408e8b
push edi
push esi
call fcn.004089eb
test bh, bh
je 0x402187
push ebp
push str..r_02u
lea eax, [esp + 0x1068]
push 0x20
push eax
call fcn.004035d8
add esp, 0x10
test bl, bl
je 0x402173
cmp word [esp + 0x1154], 0
je 0x402173
lea eax, [esp + 0x1154]
push eax
push 0x4204c0
lea eax, [esp + 0x1068]
push eax
push esi
call fcn.00408e8b
jmp 0x402181
lea eax, [esp + 0x1060]
push eax
push esi
call fcn.004089eb
inc ebp
cmp ebp, 0x64
jb 0x40212f
cmp byte [esp + 0x316c], 0
jne 0x402199
test bh, bh
je 0x40221b
test bl, bl
je 0x40220d
push 0x800
mov ebx, 0x4204c0
lea eax, [esp + 0x1158]
push ebx
push eax
push str.ShellNew
lea eax, [esp + 0x10c4]
push eax
call fcn.00408cd5
mov ebp, str.FileName
lea eax, [esp + 0x2154]
push ebp
push eax
push esi
call fcn.00408a4b
cmp word [esp + 0x1154], 0
je 0x40221b
cmp word [esp + 0x1154], 0x2a
jne 0x4021f4
push ebx
push str.NullFile
jmp 0x4021fd
lea eax, [esp + 0x1154]
push eax
push ebp
lea eax, [esp + 0x215c]
push eax
push esi
call fcn.00408e8b
jmp 0x40221b
lea eax, [esp + 0x2154]
push eax
push esi
call fcn.004089eb
mov ecx, dword [esp + 0x3154]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040a986
add esp, 0x3148
ret 0x14