Function at 0x4420f0
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x35e4
call fcn.00507730
mov eax, dword [0x5755c4]
xor eax, esp
mov dword [esp + 0x35e0], eax
push ebx
push ebp
mov ebp, dword [esp + 0x35f0]
lea eax, [esp + 0x15e8]
push esi
push ebp
push str._sShellNew
push 0x800
push eax
mov byte [0x56dd68], 0x52
mov byte [0x56dd80], 0x50
call fcn.00402930
push ebp
push str.Setup_s
lea eax, [esp + 0x10c4]
push 0x50
push eax
call fcn.00402930
add esp, 0x20
push 1
push str.NewRAR
push str.SetupMenuItems
call fcn.004af130
mov bh, byte [esp + 0x3600]
test eax, eax
jne 0x44217c
test bh, bh
setne bl
dec bl
and bl, byte [esp + 0x35fc]
jmp 0x442183
mov bl, byte [esp + 0x35fc]
push 1
push str.NewZIP
push str.SetupMenuItems
call fcn.004af130
test eax, eax
jne 0x4421a6
cmp byte [esp + 0x3604], al
setne al
dec al
and bl, al
cmp byte [esp + 0x35f8], 0
je 0x44245a
push ebp
call fcn.00441760
test al, al
jne 0x4422a5
push 0x200
push 0x541b9c
lea eax, [esp + 0x11f4]
push eax
push 0x541b9c
push ebp
push SysReAllocString
call fcn.004af180
push 0x800
push 0x541b9c
lea eax, [esp + 0x25f4]
push eax
push str.FileName
lea eax, [esp + 0x15fc]
push eax
push SysReAllocString
call fcn.004af180
push 0xa
push 0x541b9c
lea eax, [esp + 0x10a0]
push eax
push str.NullFile
lea eax, [esp + 0x15fc]
push eax
push SysReAllocString
call fcn.004af180
push ebp
push SysReAllocString
mov byte [esp + 0x17], al
call fcn.004aced0
movzx ecx, al
lea eax, [esp + 0x10ac]
push ecx
push str.Exist
push eax
call fcn.004afd40
lea eax, [esp + 0x11ec]
push eax
push 0x5426d4
lea eax, [esp + 0x10b4]
push eax
call fcn.004afd20
cmp word [esp + 0x25ec], 0
jne 0x44228b
cmp byte [esp + 0xf], 0
je 0x44228b
push 0x541db4
jmp 0x442293
lea eax, [esp + 0x25ec]
push eax
push str.ShellNew
lea eax, [esp + 0x10b4]
push eax
call fcn.004afd20
cmp byte [esp + 0x3604], 0
mov eax, str.WinRAR.ZIP
jne 0x4422b9
mov eax, 0x5445d4
push eax
push 0x541b9c
push ebp
push SysReAllocString
call fcn.004afb60
test bh, bh
je 0x44231c
push edi
call fcn.00478e40
mov edi, eax
neg edi
sbb edi, edi
and edi, 0xffffffba
add edi, 0x64
xor esi, esi
push esi
push str..r_02u
lea eax, [esp + 0x1064]
push 0x20
push eax
call fcn.00402930
add esp, 0x10
lea eax, [esp + 0x105c]
push 0x5445d4
push 0x541b9c
push eax
push SysReAllocString
call fcn.004afb60
inc esi
cmp esi, edi
jb 0x4422e2
pop edi
test bl, bl
je 0x44245a
cmp byte [esp + 0x3604], 0
jne 0x442336
test bh, bh
je 0x44245a
lea eax, [esp + 0x15ec]
push eax
push SysReAllocString
call fcn.004aeae0
push 0x800
lea eax, [esp + 0x25f0]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, str.rarnew.dat
test bh, bh
jne 0x44236b
mov eax, str.zipnew.dat
push 0x800
push eax
lea eax, [esp + 0x25f4]
push eax
call fcn.00486320
push 0
lea eax, [esp + 0x14]
mov dword [esp + 0x1024], 0
push eax
lea eax, [esp + 0x25f4]
mov dword [esp + 0x102c], 0
push eax
mov dword [esp + 0x1034], 0
mov dword [esp + 0x1038], 0
mov dword [esp + 0x103c], 0
mov dword [esp + 0x1040], 0
call fcn.004769d0
test al, al
je 0x4423f9
xor eax, eax
test bh, bh
setne al
lea eax, [eax*2 + 0x16]
cmp dword [esp + 0x1010], eax
jne 0x4423f9
cmp dword [esp + 0x1014], 0
je 0x44243b
push 0x5421b8
lea eax, [esp + 0x25f0]
push eax
call fcn.00476380
mov esi, eax
test esi, esi
je 0x44243b
push esi
test bh, bh
je 0x442421
push 0x18
push 1
push 0x56dd68
jmp 0x44242a
push 0x16
push 1
push 0x56dd80
call fcn.00525e32
add esp, 0x10
push esi
call fcn.00525a4d
add esp, 4
lea eax, [esp + 0x25ec]
push eax
push str.FileName
lea eax, [esp + 0x15f4]
push eax
push SysReAllocString
call fcn.004afb60
push 0x50
push 0x541b9c
lea eax, [esp + 0x1154]
push eax
push 0x541b9c
push ebp
push SysReAllocString
call fcn.004af180
push 0x5445d4
lea eax, [esp + 0x1150]
push eax
call fcn.004a1330
test eax, eax
je 0x4424a9
push str.WinRAR.ZIP
lea eax, [esp + 0x1150]
push eax
call fcn.004a1330
test eax, eax
jne 0x442699
cmp byte [esp + 0x35f8], 0
je 0x4424bb
test bl, bl
jne 0x442699
push 1
push str.Exist
lea eax, [esp + 0x10b4]
push eax
call fcn.004af130
test eax, eax
setne bl
cmp byte [esp + 0x35f8], 0
jne 0x4425e0
push 0x200
push 0x541b9c
lea eax, [esp + 0x11f4]
push eax
push 0x5426d4
lea eax, [esp + 0x10bc]
push eax
call fcn.004af2c0
push 0x5445d4
lea eax, [esp + 0x11f0]
push eax
call fcn.004a1330
test eax, eax
je 0x442532
push str.WinRAR.ZIP
lea eax, [esp + 0x11f0]
push eax
call fcn.004a1330
test eax, eax
jne 0x44253c
xor eax, eax
mov word [esp + 0x11ec], ax
test bl, bl
je 0x44255a
lea eax, [esp + 0x11ec]
push eax
push 0x541b9c
push ebp
push SysReAllocString
call fcn.004afb60
jmp 0x44257a
push 0x541b9c
push 0x541b9c
push ebp
push SysReAllocString
call fcn.004afb60
push ebp
push SysReAllocString
call fcn.004aeae0
test bh, bh
je 0x4425e0
xor esi, esi
push esi
push str..r_02u
lea eax, [esp + 0x1060]
push 0x20
push eax
call fcn.00402930
add esp, 0x10
test bl, bl
je 0x4425c8
cmp word [esp + 0x11ec], 0
je 0x4425c8
lea eax, [esp + 0x11ec]
push eax
push 0x541b9c
lea eax, [esp + 0x1060]
push eax
push SysReAllocString
call fcn.004afb60
jmp 0x4425da
lea eax, [esp + 0x1058]
push eax
push SysReAllocString
call fcn.004aeae0
inc esi
cmp esi, 0x64
jb 0x442580
cmp byte [esp + 0x3604], 0
jne 0x4425f2
test bh, bh
je 0x442699
test bl, bl
je 0x442687
push 0x800
push 0x541b9c
lea eax, [esp + 0x25f4]
push eax
push str.ShellNew
lea eax, [esp + 0x10bc]
push eax
call fcn.004af2c0
push str.FileName
lea eax, [esp + 0x15f0]
push eax
push SysReAllocString
call fcn.004aebf0
mov ax, word [esp + 0x25ec]
test ax, ax
je 0x442699
cmp ax, 0x2a
jne 0x442666
push 0x541b9c
push str.NullFile
lea eax, [esp + 0x15f4]
push eax
push SysReAllocString
call fcn.004afb60
jmp 0x442699
lea eax, [esp + 0x25ec]
push eax
push str.FileName
lea eax, [esp + 0x15f4]
push eax
push SysReAllocString
call fcn.004afb60
jmp 0x442699
lea eax, [esp + 0x15ec]
push eax
push SysReAllocString
call fcn.004aeae0
mov ecx, dword [esp + 0x35ec]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00507712
add esp, 0x35e4
ret 0x14