Function at 0x489e70
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x28f8
call fcn.004df840
mov eax, dword [0x50fb70]
xor eax, esp
mov dword [esp + 0x28f4], eax
push ebx
push esi
mov esi, ecx
push esi
lea eax, [esp + 0x900]
push str._sShellNew
push eax
mov edx, 0x800
mov byte [0x50eac0], 0x52
mov byte [0x50eaa8], 0x50
call fcn.00460180
add esp, 0xc
cmp byte [esp + 0x2904], 0
push esi
je 0x48a18a
call fcn.00489360
test al, al
jne 0x48a001
push 0x200
push 0x4f9a98
lea ecx, [esp + 0x504]
push ecx
push 0x4f9a98
push esi
push SysReAllocString
call fcn.00496250
push 0x200
push 0x4f9a98
lea edx, [esp + 0x104]
push edx
push str.Content_Type
push esi
push SysReAllocString
call fcn.00496250
push 0x800
push 0x4f9a98
lea eax, [esp + 0x1904]
push eax
push str.FileName
lea ecx, [esp + 0x90c]
push ecx
push SysReAllocString
call fcn.00496250
push 0xa
push 0x4f9a98
lea edx, [esp + 0xf0]
push edx
push str.NullFile
lea eax, [esp + 0x90c]
push eax
push SysReAllocString
call fcn.00496250
push esi
lea ecx, [esp + 0x4c]
push str.Setup_s
push ecx
mov edx, 0x50
mov bl, al
call fcn.00460180
add esp, 0xc
push esi
push SysReAllocString
call fcn.00495f80
movzx edx, al
push edx
push str.Exist
lea eax, [esp + 0x50]
push eax
call fcn.004967b0
lea ecx, [esp + 0x4fc]
push ecx
push str.Type
lea edx, [esp + 0x50]
push edx
call fcn.00496790
lea eax, [esp + 0xfc]
push eax
push str.Content
lea ecx, [esp + 0x50]
push ecx
call fcn.00496790
cmp word [esp + 0x18fc], 0
jne 0x489fea
test bl, bl
je 0x489fea
push 0x4fa890
push str.ShellNew
lea edx, [esp + 0x50]
push edx
jmp 0x489ffc
lea eax, [esp + 0x18fc]
push eax
push str.ShellNew
lea ecx, [esp + 0x50]
push ecx
call fcn.00496790
cmp byte [esp + 0x2910], 0
mov eax, str.WinRAR.ZIP
jne 0x48a015
mov eax, 0x4fafa0
push eax
push 0x4f9a98
push esi
push SysReAllocString
call fcn.004961e0
push str.Content_Type
push esi
push SysReAllocString
call fcn.00495e60
mov bl, byte [esp + 0x290c]
test bl, bl
je 0x48a0ab
push edi
call fcn.00445f80
mov edi, eax
neg edi
sbb edi, edi
and edi, 0xffffffba
add edi, 0x64
xor esi, esi
test edi, edi
jle 0x48a0aa
lea esp, [esp]
push esi
lea edx, [esp + 0x10]
push str..r_02d
push edx
mov edx, 0x20
call fcn.00460180
add esp, 0xc
push 0x4fafa0
push 0x4f9a98
lea eax, [esp + 0x14]
push eax
push SysReAllocString
call fcn.004961e0
push str.Content_Type
lea ecx, [esp + 0x10]
push ecx
push SysReAllocString
call fcn.00495e60
inc esi
cmp esi, edi
jl 0x48a060
pop edi
cmp byte [esp + 0x2908], 0
je 0x48a3e5
cmp byte [esp + 0x2910], 0
jne 0x48a0cb
test bl, bl
je 0x48a3e5
lea edx, [esp + 0x8fc]
push edx
push SysReAllocString
call fcn.00495db0
push 0x800
lea eax, [esp + 0x1900]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, str.rarnew.dat
test bl, bl
jne 0x48a100
mov eax, str.zipnew.dat
push 0x800
push eax
lea ecx, [esp + 0x1904]
push ecx
call fcn.00451310
lea edx, [esp + 0x18fc]
push edx
call fcn.00443510
test al, al
jne 0x48a166
push 0x4fb9fc
lea eax, [esp + 0x1900]
push eax
call fcn.00443340
mov esi, eax
test esi, esi
je 0x48a166
push esi
test bl, bl
je 0x48a14c
push 0x14
push 1
push 0x50eac0
jmp 0x48a155
push 0x16
push 1
push 0x50eaa8
call fcn.004e450e
add esp, 0x10
push esi
call fcn.004e0da1
add esp, 4
lea ecx, [esp + 0x18fc]
push ecx
push str.FileName
lea edx, [esp + 0x904]
push edx
push SysReAllocString
call fcn.004961e0
jmp 0x48a3e5
lea eax, [esp + 0x4c]
push str.Setup_s
push eax
mov edx, 0x50
call fcn.00460180
add esp, 0xc
push esi
call fcn.00489360
test al, al
je 0x48a3e5
push 1
push str.Exist
lea ecx, [esp + 0x50]
push ecx
call fcn.00496890
push 0x200
push 0x4f9a98
lea edx, [esp + 0x104]
push edx
test eax, eax
push str.Type
lea eax, [esp + 0x58]
push eax
setne bl
call fcn.00496860
push 0x4fafa0
lea ecx, [esp + 0x100]
push ecx
call fcn.00469f00
test eax, eax
je 0x48a212
push str.WinRAR.ZIP
lea edx, [esp + 0x100]
push edx
call fcn.00469f00
test eax, eax
jne 0x48a21c
xor eax, eax
mov word [esp + 0xfc], ax
push 0x200
push 0x4f9a98
lea ecx, [esp + 0x504]
push ecx
push str.Content
lea edx, [esp + 0x58]
push edx
call fcn.00496860
test bl, bl
je 0x48a31c
lea eax, [esp + 0xfc]
push eax
push 0x4f9a98
push esi
push SysReAllocString
call fcn.004961e0
cmp word [esp + 0x4fc], 0
je 0x48a282
lea ecx, [esp + 0x4fc]
push ecx
push str.Content_Type
push esi
push SysReAllocString
call fcn.004961e0
jmp 0x48a292
push str.Content_Type
push esi
push SysReAllocString
call fcn.00495e60
push 0x800
push 0x4f9a98
lea edx, [esp + 0x1904]
push edx
push str.ShellNew
lea eax, [esp + 0x58]
push eax
call fcn.00496860
push str.FileName
lea ecx, [esp + 0x900]
push ecx
push SysReAllocString
call fcn.00495e60
mov ax, word [esp + 0x18fc]
test ax, ax
je 0x48a34e
cmp ax, 0x2a
jne 0x48a2fb
push 0x4f9a98
push str.NullFile
lea edx, [esp + 0x904]
push edx
push SysReAllocString
call fcn.004961e0
jmp 0x48a34e
lea eax, [esp + 0x18fc]
push eax
push str.FileName
lea ecx, [esp + 0x904]
push ecx
push SysReAllocString
call fcn.004961e0
jmp 0x48a34e
lea edx, [esp + 0x8fc]
push edx
push SysReAllocString
call fcn.00495db0
push 0x4f9a98
push 0x4f9a98
push esi
push SysReAllocString
call fcn.004961e0
push esi
push SysReAllocString
call fcn.00495db0
cmp byte [esp + 0x290c], 0
je 0x48a3e5
xor esi, esi
mov edi, edi
push esi
lea eax, [esp + 0xc]
push str..r_02d
push eax
mov edx, 0x20
call fcn.00460180
add esp, 0xc
test bl, bl
je 0x48a3cc
cmp word [esp + 0xfc], 0
je 0x48a3cc
lea ecx, [esp + 0xfc]
push ecx
push 0x4f9a98
lea edx, [esp + 0x10]
push edx
push SysReAllocString
call fcn.004961e0
cmp word [esp + 0x4fc], 0
je 0x48a3db
lea eax, [esp + 0x4fc]
push eax
push str.Content_Type
lea ecx, [esp + 0x10]
push ecx
push SysReAllocString
call fcn.004961e0
jmp 0x48a3db
lea edx, [esp + 8]
push edx
push SysReAllocString
call fcn.00495db0
inc esi
cmp esi, 0x64
jl 0x48a360
mov ecx, dword [esp + 0x28fc]
pop esi
pop ebx
xor ecx, esp
call fcn.004df824
add esp, 0x28f8
ret 0x10