Function at 0x4aa0e0
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x304c]
mov eax, 0x304c
call fcn.004f8350
push 0xffffffffffffffff
push 0x515440
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x544354]
xor eax, ebp
mov dword [ebp + 0x3048], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x18], esi
mov ebx, dword [ebp + 0x3054]
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x20], ebx
call fcn.0046b040
mov dword [ebp - 4], 0
lea eax, [ebp + 0x2048]
push 0x800
push eax
lea eax, [ebp + 0x1048]
mov byte [esi + 0x3028], 0
push eax
mov ecx, 0x572f10
call fcn.004af7a0
cmp word [ebx + 0x8502], 0
lea eax, [ebx + 0x8502]
je 0x4aa180
push 0x800
push eax
lea eax, [ebp + 0x1048]
push eax
call fcn.004947d0
cmp word [ebx + 0x9502], 0
lea eax, [ebx + 0x9502]
je 0x4aa1a2
push 0x800
push eax
lea eax, [ebp + 0x2048]
push eax
call fcn.004947d0
push 6
push str.WinCon
add ebx, 0x1010
push ebx
call fcn.0047d830
push eax
call fcn.00497de0
test eax, eax
jne 0x4aa1c8
mov word [ebp + 0x2048], ax
jmp 0x4aa1cf
mov ax, word [ebp + 0x2048]
xor ecx, ecx
lea edi, [esi + 0x1024]
mov word [edi], cx
cmp word [ebx], cx
je 0x4aa4da
cmp word [ebp + 0x1048], cx
jne 0x4aa200
test ax, ax
jne 0x4aa200
mov eax, dword [ebp - 0x20]
cmp byte [eax + 0xa502], cl
je 0x4aa4da
push ebx
call fcn.0046cad0
test al, al
je 0x4aa4da
push 0x800
push ebx
lea eax, [esi + 0x2024]
push eax
call fcn.004947d0
push 0x800
push edi
push str.Rar_SF
mov dword [esi + 0x3024], ebx
call fcn.004cc240
mov dword [ebp - 0x18], eax
test eax, eax
je 0x4aa4ca
push ebx
mov ecx, esi
call fcn.004ab500
test al, al
je 0x4aa271
push 0x5f5
call fcn.0048e4c0
push eax
call fcn.004d1700
add esp, 4
mov ecx, 0x57f41c
push 1
call fcn.004668f0
jmp 0x4aa4ca
push dword [ebp - 0x18]
mov ecx, esi
push ebx
call fcn.004aac50
test al, al
je 0x4aa4da
push dword [ebp - 0x18]
call fcn.004fede7
add esp, 4
lea ecx, [ebp - 0x38]
push 0x10000
call fcn.00407f70
mov byte [ebp - 4], 1
mov ecx, esi
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push ebx
call fcn.004ab9c0
push 0
push edi
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4aa45a
push 3
push 0
xor al, al
mov byte [ebp - 0xe], 0
push edi
mov byte [ebp - 0xd], al
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x4aa3af
mov cx, word [ebp + 0x1048]
test cx, cx
je 0x4aa333
push dword [ebp - 0x14]
push 0x4aae70
push 3
push eax
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
push dword [ebp - 0x14]
push 0x4aae70
push 0xe
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
push 0x64
lea eax, [ebp + 0x1048]
mov ecx, esi
push eax
push dword [ebp - 0x14]
call fcn.004aa760
mov cx, word [ebp + 0x1048]
mov byte [ebp - 0xe], al
jmp 0x4aa336
mov al, byte [ebp - 0xe]
cmp word [ebp + 0x2048], 0
je 0x4aa3a6
test cx, cx
je 0x4aa349
test al, al
je 0x4aa3a6
push 0x526e38
lea eax, [ebp + 0x2048]
push eax
call fcn.0047bcd0
push dword [ebp - 0x14]
push 0x4aae70
test al, al
je 0x4aa384
push 2
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
lea eax, [ebp + 0x2048]
mov ecx, esi
push eax
push dword [ebp - 0x14]
call fcn.004aa5e0
jmp 0x4aa3a3
push 0x526e40
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
lea eax, [ebp + 0x2048]
mov ecx, esi
push eax
push dword [ebp - 0x14]
call fcn.004aa9e0
mov byte [ebp - 0xd], al
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceW]
test eax, eax
je 0x4aa45a
cmp word [ebp + 0x2048], 0
mov al, byte [ebp - 0xd]
je 0x4aa3d7
test al, al
je 0x4aa45a
cmp byte [ebp - 0xe], 0
jne 0x4aa3f3
test al, al
mov eax, dword [ebp - 0x20]
jne 0x4aa3f6
cmp byte [eax + 0xa502], 0
je 0x4aa474
jmp 0x4aa3f6
mov eax, dword [ebp - 0x20]
cmp byte [eax + 0xa502], 0
je 0x4aa407
push edi
mov ecx, esi
call fcn.004aad00
lea ecx, [ebp]
call fcn.00404070
push 0
lea eax, [ebp]
push eax
push edi
call fcn.0046e3d0
test al, al
je 0x4aa468
mov ecx, dword [ebp - 0x18]
xor eax, eax
add ecx, dword [ebp + 0x1000]
adc eax, dword [ebp + 0x1004]
mov dword [ebp - 0x20], eax
jne 0x4aa43d
cmp ecx, 0x200000
jbe 0x4aa468
push 0x200000
push 0x5a0
call fcn.0048e4c0
push eax
push 0x562a1a
call fcn.004d1f40
add esp, 0xc
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x38]
call fcn.004040b0
jmp 0x4aa4da
push 0x800
push edi
push ebx
call fcn.004947d0
cmp dword [ebp - 0x18], 0
je 0x4aa4be
push dword [ebp - 0x34]
mov ecx, esi
push dword [ebp - 0x38]
push edi
call fcn.004ab9c0
test eax, eax
jne 0x4aa4be
push 0x526e48
push edi
call fcn.004ccb60
mov ebx, eax
test ebx, ebx
je 0x4aa4be
push 2
push 0
push ebx
call fcn.00502aa9
push ebx
push dword [ebp - 0x18]
push 1
push dword [ebp - 0x38]
call fcn.004ff1cc
push ebx
call fcn.004fede7
add esp, 0x20
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x38]
call fcn.004040b0
cmp word [edi], 0
je 0x4aa4da
mov edx, dword [esi]
mov ecx, esi
push 4
push edi
call dword [edx + 4]
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x3048]
xor ecx, ebp
call fcn.004f833c
lea esp, [ebp + 0x304c]
pop ebp
ret 4