Function at 0x48b8b0
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x28f8
call fcn.004e3510
mov eax, dword [0x514bc0]
xor eax, esp
mov dword [esp + 0x28f4], eax
push ebx
push esi
mov esi, ecx
push esi
lea eax, [esp + 0x900]
push str._sShellNew
push eax
mov edx, 0x800
mov byte [0x513ae4], 0x52
mov byte [0x513acc], 0x50
call fcn.00458640
add esp, 0xc
cmp byte [esp + 0x2904], 0
push esi
je 0x48bbca
call fcn.0048ad40
test al, al
jne 0x48ba41
push 0x200
push 0x4fdab8
lea ecx, [esp + 0x504]
push ecx
push 0x4fdab8
push esi
push SysReAllocString
call fcn.00499420
push 0x200
push 0x4fdab8
lea edx, [esp + 0x104]
push edx
push str.Content_Type
push esi
push SysReAllocString
call fcn.00499420
push 0x800
push 0x4fdab8
lea eax, [esp + 0x1904]
push eax
push str.FileName
lea ecx, [esp + 0x90c]
push ecx
push SysReAllocString
call fcn.00499420
push 0xa
push 0x4fdab8
lea edx, [esp + 0xf0]
push edx
push str.NullFile
lea eax, [esp + 0x90c]
push eax
push SysReAllocString
call fcn.00499420
push esi
lea ecx, [esp + 0x4c]
push str.Setup_s
push ecx
mov edx, 0x50
mov bl, al
call fcn.00458640
add esp, 0xc
push esi
push SysReAllocString
call fcn.00498ec0
movzx edx, al
push edx
push str.Exist
lea eax, [esp + 0x50]
push eax
call fcn.00499a10
lea ecx, [esp + 0x4fc]
push ecx
push str.Type
lea edx, [esp + 0x50]
push edx
call fcn.004999f0
lea eax, [esp + 0xfc]
push eax
push str.Content
lea ecx, [esp + 0x50]
push ecx
call fcn.004999f0
cmp word [esp + 0x18fc], 0
jne 0x48ba2a
test bl, bl
je 0x48ba2a
push 0x4fe964
push str.ShellNew
lea edx, [esp + 0x50]
push edx
jmp 0x48ba3c
lea eax, [esp + 0x18fc]
push eax
push str.ShellNew
lea ecx, [esp + 0x50]
push ecx
call fcn.004999f0
cmp byte [esp + 0x2910], 0
mov eax, str.WinRAR.ZIP
jne 0x48ba55
mov eax, 0x4ff068
push eax
push 0x4fdab8
push esi
push SysReAllocString
call fcn.004992b0
push str.Content_Type
push esi
push SysReAllocString
call fcn.00498de0
mov bl, byte [esp + 0x290c]
test bl, bl
je 0x48baeb
push edi
call fcn.00446760
mov edi, eax
neg edi
sbb edi, edi
and edi, 0xffffffba
add edi, 0x64
xor esi, esi
test edi, edi
jle 0x48baea
lea esp, [esp]
push esi
lea edx, [esp + 0x10]
push str..r_02d
push edx
mov edx, 0x20
call fcn.00458640
add esp, 0xc
push 0x4ff068
push 0x4fdab8
lea eax, [esp + 0x14]
push eax
push SysReAllocString
call fcn.004992b0
push str.Content_Type
lea ecx, [esp + 0x10]
push ecx
push SysReAllocString
call fcn.00498de0
inc esi
cmp esi, edi
jl 0x48baa0
pop edi
cmp byte [esp + 0x2908], 0
je 0x48be25
cmp byte [esp + 0x2910], 0
jne 0x48bb0b
test bl, bl
je 0x48be25
lea edx, [esp + 0x8fc]
push edx
push SysReAllocString
call fcn.00498d70
push 0x800
lea eax, [esp + 0x1900]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, str.rarnew.dat
test bl, bl
jne 0x48bb40
mov eax, str.zipnew.dat
push 0x800
push eax
lea ecx, [esp + 0x1904]
push ecx
call fcn.00451be0
lea edx, [esp + 0x18fc]
push edx
call fcn.00443cc0
test al, al
jne 0x48bba6
push 0x4ffb24
lea eax, [esp + 0x1900]
push eax
call fcn.00443af0
mov esi, eax
test esi, esi
je 0x48bba6
push esi
test bl, bl
je 0x48bb8c
push 0x14
push 1
push 0x513ae4
jmp 0x48bb95
push 0x16
push 1
push 0x513acc
call fcn.004e8056
add esp, 0x10
push esi
call fcn.004e4b91
add esp, 4
lea ecx, [esp + 0x18fc]
push ecx
push str.FileName
lea edx, [esp + 0x904]
push edx
push SysReAllocString
call fcn.004992b0
jmp 0x48be25
lea eax, [esp + 0x4c]
push str.Setup_s
push eax
mov edx, 0x50
call fcn.00458640
add esp, 0xc
push esi
call fcn.0048ad40
test al, al
je 0x48be25
push 1
push str.Exist
lea ecx, [esp + 0x50]
push ecx
call fcn.00499a90
push 0x200
push 0x4fdab8
lea edx, [esp + 0x104]
push edx
test eax, eax
push str.Type
lea eax, [esp + 0x58]
push eax
setne bl
call fcn.00499a60
push 0x4ff068
lea ecx, [esp + 0x100]
push ecx
call fcn.0046a940
test eax, eax
je 0x48bc52
push str.WinRAR.ZIP
lea edx, [esp + 0x100]
push edx
call fcn.0046a940
test eax, eax
jne 0x48bc5c
xor eax, eax
mov word [esp + 0xfc], ax
push 0x200
push 0x4fdab8
lea ecx, [esp + 0x504]
push ecx
push str.Content
lea edx, [esp + 0x58]
push edx
call fcn.00499a60
test bl, bl
je 0x48bd5c
lea eax, [esp + 0xfc]
push eax
push 0x4fdab8
push esi
push SysReAllocString
call fcn.004992b0
cmp word [esp + 0x4fc], 0
je 0x48bcc2
lea ecx, [esp + 0x4fc]
push ecx
push str.Content_Type
push esi
push SysReAllocString
call fcn.004992b0
jmp 0x48bcd2
push str.Content_Type
push esi
push SysReAllocString
call fcn.00498de0
push 0x800
push 0x4fdab8
lea edx, [esp + 0x1904]
push edx
push str.ShellNew
lea eax, [esp + 0x58]
push eax
call fcn.00499a60
push str.FileName
lea ecx, [esp + 0x900]
push ecx
push SysReAllocString
call fcn.00498de0
mov ax, word [esp + 0x18fc]
test ax, ax
je 0x48bd8e
cmp ax, 0x2a
jne 0x48bd3b
push 0x4fdab8
push str.NullFile
lea edx, [esp + 0x904]
push edx
push SysReAllocString
call fcn.004992b0
jmp 0x48bd8e
lea eax, [esp + 0x18fc]
push eax
push str.FileName
lea ecx, [esp + 0x904]
push ecx
push SysReAllocString
call fcn.004992b0
jmp 0x48bd8e
lea edx, [esp + 0x8fc]
push edx
push SysReAllocString
call fcn.00498d70
push 0x4fdab8
push 0x4fdab8
push esi
push SysReAllocString
call fcn.004992b0
push esi
push SysReAllocString
call fcn.00498d70
cmp byte [esp + 0x290c], 0
je 0x48be25
xor esi, esi
mov edi, edi
push esi
lea eax, [esp + 0xc]
push str..r_02d
push eax
mov edx, 0x20
call fcn.00458640
add esp, 0xc
test bl, bl
je 0x48be0c
cmp word [esp + 0xfc], 0
je 0x48be0c
lea ecx, [esp + 0xfc]
push ecx
push 0x4fdab8
lea edx, [esp + 0x10]
push edx
push SysReAllocString
call fcn.004992b0
cmp word [esp + 0x4fc], 0
je 0x48be1b
lea eax, [esp + 0x4fc]
push eax
push str.Content_Type
lea ecx, [esp + 0x10]
push ecx
push SysReAllocString
call fcn.004992b0
jmp 0x48be1b
lea edx, [esp + 8]
push edx
push SysReAllocString
call fcn.00498d70
inc esi
cmp esi, 0x64
jl 0x48bda0
mov ecx, dword [esp + 0x28fc]
pop esi
pop ebx
xor ecx, esp
call fcn.004e34f4
add esp, 0x28f8
ret 0x10