Function at 0x43df40
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x1cf8
call fcn.004a53e0
mov eax, dword [0x4cc3b0]
xor eax, esp
mov dword [esp + 0x1cf4], eax
push ebx
push esi
mov esi, ecx
push esi
lea eax, [esp + 0xd00]
push str._sShellNew
push eax
mov edx, 0x400
mov byte [0x4cafdc], 0x52
mov byte [0x4cafc4], 0x50
call fcn.0049c880
add esp, 0xc
cmp byte [esp + 0x1d04], 0
push esi
je 0x43e26a
call fcn.0043cb30
test al, al
jne 0x43e0d1
push 0x200
push 0x4bad38
lea ecx, [esp + 0x504]
push ecx
push 0x4bad38
push esi
push 0x80000000
call fcn.0045b440
push 0x200
push 0x4bad38
lea edx, [esp + 0x104]
push edx
push str.Content_Type
push esi
push 0x80000000
call fcn.0045b440
push 0x400
push 0x4bad38
lea eax, [esp + 0x1504]
push eax
push str.FileName
lea ecx, [esp + 0xd0c]
push ecx
push 0x80000000
call fcn.0045b440
push 0xa
push 0x4bad38
lea edx, [esp + 0xf0]
push edx
push str.NullFile
lea eax, [esp + 0xd0c]
push eax
push 0x80000000
call fcn.0045b440
push esi
lea ecx, [esp + 0x4c]
push 0x4bc8d0
push ecx
mov edx, 0x50
mov bl, al
call fcn.0049c880
add esp, 0xc
push esi
push 0x80000000
call fcn.0045b170
movzx edx, al
push edx
push str.Exist
lea eax, [esp + 0x50]
push eax
call fcn.0045b980
lea ecx, [esp + 0x4fc]
push ecx
push 0x4bb298
lea edx, [esp + 0x50]
push edx
call fcn.0045b960
lea eax, [esp + 0xfc]
push eax
push str.Content
lea ecx, [esp + 0x50]
push ecx
call fcn.0045b960
cmp word [esp + 0x14fc], 0
jne 0x43e0ba
test bl, bl
je 0x43e0ba
push 0x4baefc
push str.ShellNew
lea edx, [esp + 0x50]
push edx
jmp 0x43e0cc
lea eax, [esp + 0x14fc]
push eax
push str.ShellNew
lea ecx, [esp + 0x50]
push ecx
call fcn.0045b960
cmp byte [esp + 0x1d10], 0
mov eax, str.WinRAR.ZIP
jne 0x43e0e5
mov eax, 0x4bc770
push eax
push 0x4bad38
push esi
push 0x80000000
call fcn.0045b3d0
push str.Content_Type
push esi
push 0x80000000
call fcn.0045b050
mov bl, byte [esp + 0x1d0c]
test bl, bl
je 0x43e17b
push edi
call fcn.0043ee10
mov edi, eax
neg edi
sbb edi, edi
and edi, 0xffffffba
add edi, 0x64
xor esi, esi
test edi, edi
jle 0x43e17a
lea esp, [esp]
push esi
lea edx, [esp + 0x10]
push str..r_02d
push edx
mov edx, 0x20
call fcn.0049c880
add esp, 0xc
push 0x4bc770
push 0x4bad38
lea eax, [esp + 0x14]
push eax
push 0x80000000
call fcn.0045b3d0
push str.Content_Type
lea ecx, [esp + 0x10]
push ecx
push 0x80000000
call fcn.0045b050
inc esi
cmp esi, edi
jl 0x43e130
pop edi
cmp byte [esp + 0x1d08], 0
je 0x43e4c5
cmp byte [esp + 0x1d10], 0
jne 0x43e19b
test bl, bl
je 0x43e4c5
lea edx, [esp + 0xcfc]
push edx
push 0x80000000
call fcn.0045afa0
push 0x400
lea eax, [esp + 0x500]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, str.rarnew.dat
test bl, bl
jne 0x43e1d0
mov esi, str.zipnew.dat
lea ecx, [esp + 0x4fc]
push ecx
call fcn.00451bd0
lea ecx, [ecx]
movzx ecx, word [esi]
mov word [eax], cx
add esi, 2
add eax, 2
test cx, cx
jne 0x43e1e0
lea edx, [esp + 0x4fc]
push edx
call fcn.00431770
test al, al
jne 0x43e246
push 0
push 0x4bae08
lea eax, [esp + 0x504]
push eax
call fcn.00432010
mov esi, eax
test esi, esi
je 0x43e246
push esi
test bl, bl
je 0x43e22c
push 0x14
push 1
push 0x4cafdc
jmp 0x43e235
push 0x16
push 1
push 0x4cafc4
call fcn.004a6ea4
add esp, 0x10
push esi
call fcn.004a6c75
add esp, 4
lea ecx, [esp + 0x4fc]
push ecx
push str.FileName
lea edx, [esp + 0xd04]
push edx
push 0x80000000
call fcn.0045b3d0
jmp 0x43e4c5
lea eax, [esp + 0x4c]
push 0x4bc8d0
push eax
mov edx, 0x50
call fcn.0049c880
add esp, 0xc
push esi
call fcn.0043cb30
test al, al
je 0x43e4c5
push 1
push str.Exist
lea ecx, [esp + 0x50]
push ecx
call fcn.0045ba60
push 0x200
push 0x4bad38
lea edx, [esp + 0x104]
push edx
test eax, eax
push 0x4bb298
lea eax, [esp + 0x58]
push eax
setne bl
call fcn.0045ba30
push 0x4bc770
lea ecx, [esp + 0x100]
push ecx
call fcn.00473580
test eax, eax
je 0x43e2f2
push str.WinRAR.ZIP
lea edx, [esp + 0x100]
push edx
call fcn.00473580
test eax, eax
jne 0x43e2fc
xor eax, eax
mov word [esp + 0xfc], ax
push 0x200
push 0x4bad38
lea ecx, [esp + 0x504]
push ecx
push str.Content
lea edx, [esp + 0x58]
push edx
call fcn.0045ba30
test bl, bl
je 0x43e3fc
lea eax, [esp + 0xfc]
push eax
push 0x4bad38
push esi
push 0x80000000
call fcn.0045b3d0
cmp word [esp + 0x4fc], 0
je 0x43e362
lea ecx, [esp + 0x4fc]
push ecx
push str.Content_Type
push esi
push 0x80000000
call fcn.0045b3d0
jmp 0x43e372
push str.Content_Type
push esi
push 0x80000000
call fcn.0045b050
push 0x400
push 0x4bad38
lea edx, [esp + 0x1504]
push edx
push str.ShellNew
lea eax, [esp + 0x58]
push eax
call fcn.0045ba30
push str.FileName
lea ecx, [esp + 0xd00]
push ecx
push 0x80000000
call fcn.0045b050
mov ax, word [esp + 0x14fc]
test ax, ax
je 0x43e42e
cmp ax, 0x2a
jne 0x43e3db
push 0x4bad38
push str.NullFile
lea edx, [esp + 0xd04]
push edx
push 0x80000000
call fcn.0045b3d0
jmp 0x43e42e
lea eax, [esp + 0x14fc]
push eax
push str.FileName
lea ecx, [esp + 0xd04]
push ecx
push 0x80000000
call fcn.0045b3d0
jmp 0x43e42e
lea edx, [esp + 0xcfc]
push edx
push 0x80000000
call fcn.0045afa0
push 0x4bad38
push 0x4bad38
push esi
push 0x80000000
call fcn.0045b3d0
push esi
push 0x80000000
call fcn.0045afa0
cmp byte [esp + 0x1d0c], 0
je 0x43e4c5
xor esi, esi
mov edi, edi
push esi
lea eax, [esp + 0xc]
push str..r_02d
push eax
mov edx, 0x20
call fcn.0049c880
add esp, 0xc
test bl, bl
je 0x43e4ac
cmp word [esp + 0xfc], 0
je 0x43e4ac
lea ecx, [esp + 0xfc]
push ecx
push 0x4bad38
lea edx, [esp + 0x10]
push edx
push 0x80000000
call fcn.0045b3d0
cmp word [esp + 0x4fc], 0
je 0x43e4bb
lea eax, [esp + 0x4fc]
push eax
push str.Content_Type
lea ecx, [esp + 0x10]
push ecx
push 0x80000000
call fcn.0045b3d0
jmp 0x43e4bb
lea edx, [esp + 8]
push edx
push 0x80000000
call fcn.0045afa0
inc esi
cmp esi, 0x64
jl 0x43e440
mov ecx, dword [esp + 0x1cfc]
pop esi
pop ebx
xor ecx, esp
call fcn.004a4bb3
add esp, 0x1cf8
ret 0x10