Function at 0x14003f24c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3490]
mov eax, 0x3590
call fcn.1400fc480
sub rsp, rax
mov rax, qword [0x140160370]
xor rax, rsp
mov qword [rbp + 0x3480], rax
mov r13b, byte [rbp + 0x34f0]
mov sil, r9b
mov r9, rcx
mov byte [0x140156f58], 0x52
mov r12b, r8b
mov byte [0x140156f70], 0x50
mov r15b, dl
lea r8, str._sShellNew
mov rbx, rcx
mov edx, 0x800
lea rcx, [rbp + 0x1480]
call fcn.140002810
mov r9, rbx
lea r8, str.Setup_s
mov edx, 0x50
lea rcx, [rbp + 0xfe0]
call fcn.140002810
xor r14d, r14d
lea rdi, [0x14011bd58]
test r15b, r15b
je 0x14003f594
mov rcx, rbx
call fcn.14003e8f0
test al, al
jne 0x14003f3f8
mov dword [rsp + 0x28], 0x200
lea r9, [rbp + 0x1080]
mov r8, rdi
mov qword [rsp + 0x20], rdi
mov rdx, rbx
mov rcx, 0xffffffff80000000
call fcn.1400a78f0
lea r9, [rbp + 0x2480]
mov dword [rsp + 0x28], 0x800
lea r8, str.FileName
mov qword [rsp + 0x20], rdi
lea rdx, [rbp + 0x1480]
mov rcx, 0xffffffff80000000
call fcn.1400a78f0
lea r9, [rbp + 0xfc0]
mov dword [rsp + 0x28], 0xa
lea r8, str.NullFile
mov qword [rsp + 0x20], rdi
lea rdx, [rbp + 0x1480]
mov rcx, 0xffffffff80000000
call fcn.1400a78f0
mov rdx, rbx
mov rcx, 0xffffffff80000000
mov dil, al
call fcn.1400a5b78
movzx r8d, al
lea rdx, str.Exist
lea rcx, [rbp + 0xfe0]
call fcn.1400a84e8
lea r8, [rbp + 0x1080]
lea rdx, [0x14011d148]
lea rcx, [rbp + 0xfe0]
call fcn.1400a84d0
cmp word [rbp + 0x2480], r14w
jne 0x14003f3d7
lea r8, [0x14011c528]
test dil, dil
jne 0x14003f3de
lea r8, [rbp + 0x2480]
lea rdx, str.ShellNew
lea rcx, [rbp + 0xfe0]
call fcn.1400a84d0
lea rdi, [0x14011bd58]
lea rax, str.WinRAR.ZIP
test r13b, r13b
lea r9, [0x1401213e0]
mov r8, rdi
cmovne r9, rax
mov rdx, rbx
mov rcx, 0xffffffff80000000
call fcn.1400a82f4
test sil, sil
je 0x14003f47a
call fcn.140072f20
neg eax
sbb edi, edi
and edi, 0xffffffba
add edi, 0x64
mov r9d, r14d
lea r8, str..r_02u
mov edx, 0x20
lea rcx, [rbp + 0xf80]
call fcn.140002810
lea r9, [0x1401213e0]
mov rcx, 0xffffffff80000000
lea r8, [0x14011bd58]
lea rdx, [rbp + 0xf80]
call fcn.1400a82f4
inc r14d
cmp r14d, edi
jb 0x14003f433
xor r14d, r14d
test r12b, r12b
je 0x14003f594
test r13b, r13b
jne 0x14003f491
test sil, sil
je 0x14003f594
lea rdx, [rbp + 0x1480]
mov rcx, 0xffffffff80000000
call fcn.1400a71f4
mov edi, 0x800
lea rdx, [rbp + 0x2480]
mov r8d, edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rax, str.rarnew.dat
test sil, sil
lea rdx, str.zipnew.dat
mov r8d, edi
cmovne rdx, rax
lea rcx, [rbp + 0x2480]
call fcn.1400804ec
xor r8d, r8d
mov qword [rbp + 0xf40], r14
lea rdx, [rsp + 0x30]
mov qword [rbp + 0xf48], r14
lea rcx, [rbp + 0x2480]
mov qword [rbp + 0xf50], r14
call fcn.140070c98
test al, al
je 0x14003f524
mov al, sil
neg al
sbb rcx, rcx
and ecx, 2
add rcx, 0x16
cmp qword [rbp + 0xf30], rcx
je 0x14003f573
lea rdx, [0x14011cb30]
lea rcx, [rbp + 0x2480]
call fcn.1400706c8
mov rdi, rax
test rax, rax
je 0x14003f573
mov r9, rax
mov edx, 1
test sil, sil
je 0x14003f559
lea r8d, [rdx + 0x17]
lea rcx, [0x140156f58]
jmp 0x14003f566
mov r8d, 0x16
lea rcx, [0x140156f70]
call fcn.140103d94
mov rcx, rdi
call fcn.1401039c8
lea r9, [rbp + 0x2480]
mov rcx, 0xffffffff80000000
lea r8, str.FileName
lea rdx, [rbp + 0x1480]
call fcn.1400a82f4
mov rcx, rbx
call fcn.14003e8f0
test al, al
je 0x14003f77a
test r15b, r15b
je 0x14003f5b2
test r12b, r12b
jne 0x14003f77a
mov r8d, 1
lea rdx, str.Exist
lea rcx, [rbp + 0xfe0]
call fcn.1400a78ac
test eax, eax
lea r12, [0x14011bd58]
setne dil
test r15b, r15b
jne 0x14003f6d5
mov r9, r12
mov dword [rsp + 0x20], 0x200
lea r8, [rbp + 0x1080]
lea rdx, [0x14011d148]
lea rcx, [rbp + 0xfe0]
call fcn.1400a7a38
lea rdx, [0x1401213e0]
lea rcx, [rbp + 0x1080]
call fcn.140099438
test eax, eax
je 0x14003f634
lea rdx, str.WinRAR.ZIP
lea rcx, [rbp + 0x1080]
call fcn.140099438
test eax, eax
jne 0x14003f63c
mov word [rbp + 0x1080], r14w
mov r15, 0xffffffff80000000
mov r8, r12
mov rcx, r15
mov rdx, rbx
test dil, dil
je 0x14003f65f
lea r9, [rbp + 0x1080]
call fcn.1400a82f4
jmp 0x14003f672
mov r9, r12
call fcn.1400a82f4
mov rdx, rbx
mov rcx, r15
call fcn.1400a71f4
test sil, sil
je 0x14003f6d5
mov ebx, r14d
mov r9d, ebx
lea r8, str..r_02u
mov edx, 0x20
lea rcx, [rbp + 0xf80]
call fcn.140002810
test dil, dil
je 0x14003f6bf
cmp word [rbp + 0x1080], r14w
je 0x14003f6bf
lea r9, [rbp + 0x1080]
mov r8, r12
lea rdx, [rbp + 0xf80]
mov rcx, r15
call fcn.1400a82f4
jmp 0x14003f6ce
lea rdx, [rbp + 0xf80]
mov rcx, r15
call fcn.1400a71f4
inc ebx
cmp ebx, 0x64
jb 0x14003f67a
test r13b, r13b
jne 0x14003f6e3
test sil, sil
je 0x14003f77a
test dil, dil
je 0x14003f767
mov r9, r12
mov dword [rsp + 0x20], 0x800
lea r8, [rbp + 0x2480]
lea rdx, str.ShellNew
lea rcx, [rbp + 0xfe0]
call fcn.1400a7a38
mov rbx, 0xffffffff80000000
lea r8, str.FileName
mov rcx, rbx
lea rdx, [rbp + 0x1480]
call fcn.1400a7284
movzx eax, word [rbp + 0x2480]
test ax, ax
je 0x14003f77a
lea rdx, [rbp + 0x1480]
mov rcx, rbx
cmp ax, 0x2a
jne 0x14003f752
mov r9, r12
lea r8, str.NullFile
jmp 0x14003f760
lea r9, [rbp + 0x2480]
lea r8, str.FileName
call fcn.1400a82f4
jmp 0x14003f77a
lea rdx, [rbp + 0x1480]
mov rcx, 0xffffffff80000000
call fcn.1400a71f4
mov rcx, qword [rbp + 0x3480]
xor rcx, rsp
call fcn.1400fc4f0
mov rbx, qword [rsp + 0x35d8]
add rsp, 0x3590
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret