Function at 0x43c180
Capabilities:
Check if file exists
Check os version
Get file attributes
Write file on windows

Disassembly:
sub esp, 0xec4
mov eax, dword [0x4c03a0]
xor eax, esp
mov dword [esp + 0xec0], eax
push ebx
push esi
mov esi, ecx
push esi
lea eax, [esp + 0x6cc]
push str._sShellNew
push eax
mov byte [0x4befd0], 0x52
mov byte [0x4befb8], 0x50
call fcn.0049e635
add esp, 0xc
cmp byte [esp + 0xed0], 0
push esi
je 0x43c506
call fcn.0043ae40
test al, al
jne 0x43c302
push 0x200
push 0x4b1914
lea ecx, [esp + 0x2d0]
push ecx
push 0x4b1914
push esi
push 0x80000000
call fcn.00456450
push 0x200
push 0x4b1914
lea edx, [esp + 0xd0]
push edx
push str.Content_Type
push esi
push 0x80000000
call fcn.00456450
push 0x400
push 0x4b1914
lea eax, [esp + 0xad0]
push eax
push str.FileName
lea ecx, [esp + 0x6d8]
push ecx
push 0x80000000
call fcn.00456450
push 0xa
push 0x4b1914
lea edx, [esp + 0xc4]
push edx
push str.NullFile
lea eax, [esp + 0x6d8]
push eax
push 0x80000000
call fcn.00456450
push esi
lea ecx, [esp + 0xc]
push 0x4b2f28
push ecx
mov bl, al
call fcn.0049e635
add esp, 0xc
push esi
push 0x80000000
call fcn.00456100
movzx edx, al
push edx
push str.Exist
lea eax, [esp + 0x10]
push eax
call fcn.004567e0
lea ecx, [esp + 0x2c8]
push ecx
push str.Type
lea edx, [esp + 0x10]
push edx
call fcn.004567a0
lea eax, [esp + 0xc8]
push eax
push str.Content
lea ecx, [esp + 0x10]
push ecx
call fcn.004567a0
cmp byte [esp + 0xac8], 0
jne 0x43c2eb
test bl, bl
je 0x43c2eb
push 0x4b175c
push str.ShellNew
lea edx, [esp + 0x10]
push edx
jmp 0x43c2fd
lea eax, [esp + 0xac8]
push eax
push str.ShellNew
lea ecx, [esp + 0x10]
push ecx
call fcn.004567a0
cmp byte [esp + 0xedc], 0
mov eax, str.WinRAR.ZIP
jne 0x43c316
mov eax, 0x4b2e3c
push eax
push 0x4b1914
push esi
push 0x80000000
call fcn.004562b0
push str.Content_Type
push esi
push 0x80000000
call fcn.00455f60
mov bl, byte [esp + 0xed8]
test bl, bl
je 0x43c3af
push edi
call fcn.0043cdb0
mov edi, eax
neg edi
sbb edi, edi
and edi, 0xffffffba
add edi, 0x64
xor esi, esi
test edi, edi
jle 0x43c3ae
lea ebx, [ebx]
push esi
lea edx, [esp + 0xa4]
push str..r_02d
push edx
call fcn.0049e635
add esp, 0xc
push 0x4b2e3c
push 0x4b1914
lea eax, [esp + 0xa8]
push eax
push 0x80000000
call fcn.004562b0
push str.Content_Type
lea ecx, [esp + 0xa4]
push ecx
push 0x80000000
call fcn.00455f60
inc esi
cmp esi, edi
jl 0x43c360
pop edi
cmp byte [esp + 0xed4], 0
je 0x43c76a
cmp byte [esp + 0xedc], 0
jne 0x43c3cf
test bl, bl
je 0x43c76a
lea edx, [esp + 0x6c8]
push edx
push 0x80000000
call fcn.00455f00
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0xc], 4
ja 0x43c44c
cmp dword [esp + 0x10], 0xa
ja 0x43c44c
test bl, bl
je 0x43c429
push 0x14
push 0x4befd0
push str.Data
lea ecx, [esp + 0x6d4]
push ecx
push 0x80000000
call fcn.00456400
jmp 0x43c76a
push 0x16
push 0x4befb8
push str.Data
lea edx, [esp + 0x6d4]
push edx
push 0x80000000
call fcn.00456400
jmp 0x43c76a
push 0x400
lea eax, [esp + 0x2cc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov esi, str.rarnew.dat
test bl, bl
jne 0x43c46f
mov esi, str.zipnew.dat
lea ecx, [esp + 0x2c8]
push ecx
call fcn.0044daf0
lea esp, [esp]
mov cl, byte [esi]
mov byte [eax], cl
inc esi
inc eax
test cl, cl
jne 0x43c480
lea edx, [esp + 0x2c8]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x43c4e2
lea eax, [esp + 0x2c8]
push 0x4b1ba8
push eax
call fcn.0049fec8
mov esi, eax
add esp, 8
test esi, esi
je 0x43c4e2
push esi
test bl, bl
je 0x43c4c8
push 0x14
push 1
push 0x4befd0
jmp 0x43c4d1
push 0x16
push 1
push 0x4befb8
call fcn.0049fd82
add esp, 0x10
push esi
call fcn.0049fba6
add esp, 4
lea ecx, [esp + 0x2c8]
push ecx
push str.FileName
lea edx, [esp + 0x6d0]
push edx
push 0x80000000
call fcn.004562b0
jmp 0x43c76a
lea eax, [esp + 0xc]
push 0x4b2f28
push eax
call fcn.0049e635
add esp, 0xc
push esi
call fcn.0043ae40
test al, al
je 0x43c76a
push 1
push str.Exist
lea ecx, [esp + 0x10]
push ecx
call fcn.00456940
push 0x200
push 0x4b1914
lea edx, [esp + 0xd0]
push edx
test eax, eax
push str.Type
lea eax, [esp + 0x18]
push eax
setne bl
call fcn.004568e0
lea ecx, [esp + 0xc8]
push 0x4b2e3c
push ecx
call fcn.004ac5d6
add esp, 8
test eax, eax
je 0x43c58f
lea edx, [esp + 0xc8]
push str.WinRAR.ZIP
push edx
call fcn.004ac5d6
add esp, 8
test eax, eax
jne 0x43c597
mov byte [esp + 0xc8], 0
push 0x200
push 0x4b1914
lea eax, [esp + 0x2d0]
push eax
push str.Content
lea ecx, [esp + 0x18]
push ecx
call fcn.004568e0
test bl, bl
je 0x43c692
lea edx, [esp + 0xc8]
push edx
push 0x4b1914
push esi
push 0x80000000
call fcn.004562b0
cmp byte [esp + 0x2c8], 0
je 0x43c5fc
lea eax, [esp + 0x2c8]
push eax
push str.Content_Type
push esi
push 0x80000000
call fcn.004562b0
jmp 0x43c60c
push str.Content_Type
push esi
push 0x80000000
call fcn.00455f60
push 0x400
push 0x4b1914
lea ecx, [esp + 0xad0]
push ecx
push str.ShellNew
lea edx, [esp + 0x18]
push edx
call fcn.004568e0
push str.FileName
lea eax, [esp + 0x6cc]
push eax
push 0x80000000
call fcn.00455f60
mov al, byte [esp + 0xac8]
test al, al
je 0x43c6c4
cmp al, 0x2a
jne 0x43c671
push 0x4b1914
push str.NullFile
lea ecx, [esp + 0x6d0]
push ecx
push 0x80000000
call fcn.004562b0
jmp 0x43c6c4
lea edx, [esp + 0xac8]
push edx
push str.FileName
lea eax, [esp + 0x6d0]
push eax
push 0x80000000
call fcn.004562b0
jmp 0x43c6c4
lea ecx, [esp + 0x6c8]
push ecx
push 0x80000000
call fcn.00455f00
push 0x4b1914
push 0x4b1914
push esi
push 0x80000000
call fcn.004562b0
push esi
push 0x80000000
call fcn.00455f00
cmp byte [esp + 0xed8], 0
je 0x43c76a
xor esi, esi
jmp 0x43c6e0
push esi
lea edx, [esp + 0xa0]
push str..r_02d
push edx
call fcn.0049e635
add esp, 0xc
test bl, bl
je 0x43c74e
cmp byte [esp + 0xc8], 0
je 0x43c74e
lea eax, [esp + 0xc8]
push eax
push 0x4b1914
lea ecx, [esp + 0xa4]
push ecx
push 0x80000000
call fcn.004562b0
cmp byte [esp + 0x2c8], 0
je 0x43c760
lea edx, [esp + 0x2c8]
push edx
push str.Content_Type
lea eax, [esp + 0xa4]
push eax
push 0x80000000
call fcn.004562b0
jmp 0x43c760
lea ecx, [esp + 0x9c]
push ecx
push 0x80000000
call fcn.00455f00
inc esi
cmp esi, 0x64
jl 0x43c6e0
mov ecx, dword [esp + 0xec8]
pop esi
pop ebx
xor ecx, esp
call fcn.0049e626
add esp, 0xec4
ret 0x10