Function at 0x402e18
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0xe50]
sub esp, 0xed0
mov eax, dword [0x4161a0]
xor eax, ebp
mov dword [ebp + 0xe4c], eax
push ebx
push esi
push edi
mov esi, ecx
push esi
lea eax, [ebp + 0x420]
push str._sShellNew
push eax
mov dword [ebp - 0x7c], esi
mov byte [0x416160], 0x52
mov byte [0x416148], 0x50
call fcn.00405fcd
add esp, 0xc
cmp byte [ebp + 0xe58], 0
push esi
je 0x403130
call fcn.00401ee4
mov edi, 0x41255f
mov esi, 0x80000000
test al, al
jne 0x402f6e
mov ebx, 0x200
push ebx
push edi
lea eax, [ebp + 0xa20]
push eax
push edi
push dword [ebp - 0x7c]
push esi
call fcn.00403b1f
push ebx
push edi
lea eax, [ebp + 0xc20]
push eax
mov ebx, str.Content_Type
push ebx
push dword [ebp - 0x7c]
push esi
call fcn.00403b1f
push 0x400
push edi
lea eax, [ebp + 0x20]
push eax
push str.FileName
lea eax, [ebp + 0x420]
push eax
push esi
call fcn.00403b1f
push 0xa
push edi
lea eax, [ebp + 0xe20]
push eax
push str.NullFile
lea eax, [ebp + 0x420]
push eax
push esi
call fcn.00403b1f
push dword [ebp - 0x7c]
mov byte [ebp - 0x75], al
lea eax, [ebp - 0x30]
push str.Setup_s
push eax
call fcn.00405fcd
add esp, 0xc
push dword [ebp - 0x7c]
push esi
call fcn.004038fb
movzx eax, al
push eax
push str.Exist
lea eax, [ebp - 0x30]
push eax
call fcn.00403c44
lea eax, [ebp + 0xa20]
push eax
push str.Type
lea eax, [ebp - 0x30]
push eax
call fcn.00403c2b
lea eax, [ebp + 0xc20]
push eax
push str.Content
lea eax, [ebp - 0x30]
push eax
call fcn.00403c2b
cmp byte [ebp + 0x20], 0
jne 0x402f68
cmp byte [ebp - 0x75], 0
je 0x402f68
push 0x4129cc
push str.ShellNew
lea eax, [ebp - 0x30]
push eax
call fcn.00403c2b
jmp 0x402f73
lea eax, [ebp + 0x20]
push eax
jmp 0x402f58
mov ebx, str.Content_Type
cmp byte [ebp + 0xe64], 0
mov eax, str.WinRAR.ZIP
jne 0x402f86
mov eax, 0x412558
push eax
push edi
push dword [ebp - 0x7c]
push esi
call fcn.00403a5a
push ebx
push dword [ebp - 0x7c]
push esi
call fcn.0040376a
cmp byte [ebp + 0xe60], 0
je 0x403001
call fcn.0040355c
neg eax
sbb eax, eax
and dword [ebp - 0x7c], 0
and eax, 0xffffffba
add eax, 0x64
mov dword [ebp - 0x80], eax
test eax, eax
jle 0x403001
push dword [ebp - 0x7c]
lea eax, [ebp + 0xe2c]
push str..r_02d
push eax
call fcn.00405fcd
add esp, 0xc
push 0x412558
push edi
lea eax, [ebp + 0xe2c]
push eax
push esi
call fcn.00403a5a
push ebx
lea eax, [ebp + 0xe2c]
push eax
push esi
call fcn.0040376a
inc dword [ebp - 0x7c]
mov eax, dword [ebp - 0x7c]
cmp eax, dword [ebp - 0x80]
jl 0x402fbe
cmp byte [ebp + 0xe5c], 0
je 0x403312
cmp byte [ebp + 0xe64], 0
jne 0x403024
cmp byte [ebp + 0xe60], 0
je 0x403312
lea eax, [ebp + 0x420]
push eax
push esi
call fcn.0040371d
lea eax, [ebp - 0x74]
push eax
mov dword [ebp - 0x74], 0x94
call dword [0x412048]
cmp dword [ebp - 0x70], 4
ja 0x40307e
cmp dword [ebp - 0x6c], 0xa
ja 0x40307e
cmp byte [ebp + 0xe60], 0
lea eax, [ebp + 0x420]
je 0x403075
push 0x14
push 0x416160
push str.Data
push eax
push esi
call fcn.00403ae0
jmp 0x403312
push 0x16
push 0x416148
jmp 0x403064
push 0x400
lea eax, [ebp + 0x820]
push eax
push 0
call dword [0x412040]
cmp byte [ebp + 0xe60], 0
mov eax, str.rarnew.dat
jne 0x4030a5
mov eax, str.zipnew.dat
push eax
lea eax, [ebp + 0x820]
push eax
call fcn.004035d9
push eax
call fcn.00405b30
pop ecx
pop ecx
lea eax, [ebp + 0x820]
push eax
call dword [0x412144]
cmp eax, 0xffffffff
jne 0x403112
lea eax, [ebp + 0x820]
push 0x412994
push eax
call fcn.00406bbe
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x403112
cmp byte [ebp + 0xe60], 0
push edi
je 0x4030fa
push 0x14
push 1
push 0x416160
jmp 0x403103
push 0x16
push 1
push 0x416148
call fcn.00406a78
add esp, 0x10
push edi
call fcn.0040689c
pop ecx
lea eax, [ebp + 0x820]
push eax
push str.FileName
lea eax, [ebp + 0x420]
push eax
push esi
call fcn.00403a5a
jmp 0x403312
lea eax, [ebp - 0x30]
push str.Setup_s
push eax
call fcn.00405fcd
add esp, 0xc
push esi
call fcn.00401ee4
test al, al
je 0x403312
push 1
push str.Exist
lea eax, [ebp - 0x30]
push eax
call fcn.00403c7d
test eax, eax
mov ebx, 0x200
push ebx
mov edi, 0x41255f
push edi
lea eax, [ebp + 0xc20]
push eax
push str.Type
lea eax, [ebp - 0x30]
push eax
setne byte [ebp - 0x75]
call fcn.00403c5d
lea eax, [ebp + 0xc20]
push 0x412558
push eax
call fcn.00410ed8
pop ecx
pop ecx
test eax, eax
je 0x4031b4
lea eax, [ebp + 0xc20]
push str.WinRAR.ZIP
push eax
call fcn.00410ed8
pop ecx
pop ecx
test eax, eax
jne 0x4031bb
mov byte [ebp + 0xc20], 0
push ebx
push edi
lea eax, [ebp + 0xa20]
push eax
push str.Content
lea eax, [ebp - 0x30]
push eax
call fcn.00403c5d
cmp byte [ebp - 0x75], 0
je 0x403271
lea eax, [ebp + 0xc20]
push eax
push edi
push esi
mov esi, 0x80000000
push esi
call fcn.00403a5a
cmp byte [ebp + 0xa20], 0
je 0x403210
lea eax, [ebp + 0xa20]
push eax
push str.Content_Type
push dword [ebp - 0x7c]
push esi
call fcn.00403a5a
jmp 0x40321e
push str.Content_Type
push dword [ebp - 0x7c]
push esi
call fcn.0040376a
push 0x400
push edi
lea eax, [ebp + 0x20]
push eax
push str.ShellNew
lea eax, [ebp - 0x30]
push eax
call fcn.00403c5d
mov ebx, str.FileName
push ebx
lea eax, [ebp + 0x420]
push eax
push esi
call fcn.0040376a
cmp byte [ebp + 0x20], 0
je 0x403297
cmp byte [ebp + 0x20], 0x2a
jne 0x40325d
push edi
push str.NullFile
jmp 0x403262
lea eax, [ebp + 0x20]
push eax
push ebx
lea eax, [ebp + 0x420]
push eax
push esi
call fcn.00403a5a
jmp 0x403297
lea eax, [ebp + 0x420]
push eax
mov esi, 0x80000000
push esi
call fcn.0040371d
push edi
push edi
push dword [ebp - 0x7c]
push esi
call fcn.00403a5a
push dword [ebp - 0x7c]
push esi
call fcn.0040371d
cmp byte [ebp + 0xe60], 0
je 0x403312
xor ebx, ebx
push ebx
lea eax, [ebp + 0xe2c]
push str..r_02d
push eax
call fcn.00405fcd
add esp, 0xc
cmp byte [ebp - 0x75], 0
je 0x4032ff
cmp byte [ebp + 0xc20], 0
je 0x4032ff
lea eax, [ebp + 0xc20]
push eax
push edi
lea eax, [ebp + 0xe2c]
push eax
push esi
call fcn.00403a5a
cmp byte [ebp + 0xa20], 0
je 0x40330c
lea eax, [ebp + 0xa20]
push eax
push str.Content_Type
lea eax, [ebp + 0xe2c]
push eax
push esi
call fcn.00403a5a
jmp 0x40330c
lea eax, [ebp + 0xe2c]
push eax
push esi
call fcn.0040371d
inc ebx
cmp ebx, 0x64
jl 0x4032a2
mov ecx, dword [ebp + 0xe4c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00405fbe
add ebp, 0xe50
leave
ret 0x10