Function at 0x14003dddc
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1d50
call fcn.1400baa60
sub rsp, rax
mov rax, qword [0x1400e0920]
xor rax, rsp
mov qword [rsp + 0x1d40], rax
mov r13b, r9b
mov byte [rsp + 0x30], r8b
mov rdi, rcx
mov r9, rcx
mov bl, dl
mov r12d, 0x400
lea r8, str._sShellNew
lea rcx, [rsp + 0xd40]
mov r15d, 0x50
mov rdx, r12
mov byte [0x1400df188], 0x52
mov byte [0x1400df170], r15b
call fcn.1400287d0
xor r14d, r14d
cmp bl, r14b
je 0x14003e16f
mov rcx, rdi
call fcn.14003cefc
lea rsi, [0x1400c3f4c]
mov rbx, 0xffffffff80000000
cmp al, r14b
jne 0x14003dfc7
mov r14d, 0x200
lea r9, [rsp + 0x540]
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rsi
call fcn.14005bec0
lea r9, [rsp + 0x140]
lea r8, str.Content_Type
mov rdx, rdi
mov rcx, rbx
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rsi
call fcn.14005bec0
lea r9, [rsp + 0x1540]
lea r8, str.FileName
lea rdx, [rsp + 0xd40]
mov rcx, rbx
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rsi
call fcn.14005bec0
lea r9, [rsp + 0x120]
lea r8, str.NullFile
lea rdx, [rsp + 0xd40]
mov rcx, rbx
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], rsi
call fcn.14005bec0
lea r8, [0x1400c6ca0]
lea rcx, [rsp + 0x80]
mov r9, rdi
mov rdx, r15
mov r12b, al
call fcn.1400287d0
mov rdx, rdi
mov rcx, rbx
call fcn.14005bba8
lea rdx, str.Exist
lea rcx, [rsp + 0x80]
movzx r8d, al
call fcn.14005c428
lea r8, [rsp + 0x540]
lea rdx, [0x1400c4800]
lea rcx, [rsp + 0x80]
call fcn.14005c410
lea r8, [rsp + 0x140]
lea rdx, str.Content
lea rcx, [rsp + 0x80]
call fcn.14005c410
xor r14d, r14d
cmp word [rsp + 0x1540], r14w
jne 0x14003dfab
lea r8, [0x1400c42d4]
cmp r12b, r14b
jne 0x14003dfb3
lea r8, [rsp + 0x1540]
lea rdx, str.ShellNew
lea rcx, [rsp + 0x80]
call fcn.14005c410
mov r15b, byte [rsp + 0x1da0]
lea rdx, str.WinRAR.ZIP
lea r9, [0x1400c6ae8]
cmp r15b, r14b
mov r8, rsi
mov rcx, rbx
cmovne r9, rdx
mov rdx, rdi
call fcn.14005bd6c
lea r8, str.Content_Type
mov rdx, rdi
mov rcx, rbx
call fcn.14005bac0
mov r12d, 1
cmp r13b, r14b
je 0x14003e071
call fcn.14003ed2c
neg eax
sbb edi, edi
and edi, 0xffffffba
add edi, 0x64
test edi, edi
jle 0x14003e06e
lea r8, str..r_02d
lea rcx, [rsp + 0x40]
mov r9d, r14d
mov edx, 0x20
call fcn.1400287d0
lea r9, [0x1400c6ae8]
lea rdx, [rsp + 0x40]
mov r8, rsi
mov rcx, rbx
call fcn.14005bd6c
lea r8, str.Content_Type
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.14005bac0
add r14d, r12d
cmp r14d, edi
jl 0x14003e022
xor r14d, r14d
cmp byte [rsp + 0x30], r14b
je 0x14003e3d7
cmp r15b, r14b
jne 0x14003e08a
cmp r13b, r14b
je 0x14003e3d7
lea rdx, [rsp + 0xd40]
mov rcx, rbx
call fcn.14005ba64
lea rdx, [rsp + 0x540]
mov r8d, 0x400
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rax, str.rarnew.dat
cmp r13b, r14b
lea rdi, str.zipnew.dat
lea rcx, [rsp + 0x540]
cmovne rdi, rax
call fcn.140052af8
movzx ecx, word [rdi]
add rdi, 2
mov word [rax], cx
add rax, 2
cmp cx, r14w
jne 0x14003e0d2
lea rcx, [rsp + 0x540]
call fcn.140031164
cmp al, r14b
jne 0x14003e14b
lea rdx, [0x1400c40f8]
lea rcx, [rsp + 0x540]
xor r8d, r8d
call fcn.140031a0c
mov rdi, rax
cmp rax, r14
je 0x14003e14b
mov r9, rax
mov rdx, r12
cmp r13b, r14b
je 0x14003e131
mov r8d, 0x14
lea rcx, [0x1400df188]
jmp 0x14003e13e
mov r8d, 0x16
lea rcx, [0x1400df170]
call fcn.1400aa848
mov rcx, rdi
call fcn.1400aa5c0
lea r9, [rsp + 0x540]
lea r8, str.FileName
lea rdx, [rsp + 0xd40]
mov rcx, rbx
call fcn.14005bd6c
jmp 0x14003e3d7
lea r8, [0x1400c6ca0]
lea rcx, [rsp + 0x80]
mov r9, rdi
mov rdx, r15
call fcn.1400287d0
mov rcx, rdi
call fcn.14003cefc
cmp al, r14b
je 0x14003e3d7
mov r12d, 1
lea rdx, str.Exist
lea rcx, [rsp + 0x80]
mov r8d, r12d
call fcn.14005c490
lea rsi, [0x1400c3f4c]
lea r8, [rsp + 0x140]
cmp eax, r14d
lea rdx, [0x1400c4800]
lea rcx, [rsp + 0x80]
mov r14d, 0x200
mov r9, rsi
setne r15b
mov dword [rsp + 0x20], r14d
call fcn.14005c464
lea rdx, [0x1400c6ae8]
lea rcx, [rsp + 0x140]
call fcn.140073f2c
xor ebx, ebx
cmp eax, ebx
je 0x14003e221
lea rdx, str.WinRAR.ZIP
lea rcx, [rsp + 0x140]
call fcn.140073f2c
cmp eax, ebx
jne 0x14003e229
mov word [rsp + 0x140], bx
lea r8, [rsp + 0x540]
lea rdx, str.Content
lea rcx, [rsp + 0x80]
mov r9, rsi
mov dword [rsp + 0x20], r14d
call fcn.14005c464
xor r14d, r14d
mov rbx, 0xffffffff80000000
mov rcx, rbx
cmp r15b, r14b
je 0x14003e323
lea r9, [rsp + 0x140]
mov r8, rsi
mov rdx, rdi
call fcn.14005bd6c
lea r8, str.Content_Type
mov rdx, rdi
mov rcx, rbx
cmp word [rsp + 0x540], r14w
je 0x14003e29d
lea r9, [rsp + 0x540]
call fcn.14005bd6c
jmp 0x14003e2a2
call fcn.14005bac0
lea r8, [rsp + 0x1540]
lea rdx, str.ShellNew
lea rcx, [rsp + 0x80]
mov r9, rsi
mov dword [rsp + 0x20], 0x400
call fcn.14005c464
lea r8, str.FileName
lea rdx, [rsp + 0xd40]
mov rcx, rbx
call fcn.14005bac0
movzx r11d, word [rsp + 0x1540]
cmp r11w, r14w
je 0x14003e34c
lea rdx, [rsp + 0xd40]
mov rcx, rbx
cmp r11w, 0x2a
jne 0x14003e30d
mov r9, rsi
lea r8, str.NullFile
jmp 0x14003e31c
lea r9, [rsp + 0x1540]
lea r8, str.FileName
call fcn.14005bd6c
jmp 0x14003e34c
lea rdx, [rsp + 0xd40]
call fcn.14005ba64
mov r9, rsi
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
call fcn.14005bd6c
mov rdx, rdi
mov rcx, rbx
call fcn.14005ba64
cmp r13b, r14b
je 0x14003e3d7
mov edi, r14d
lea r8, str..r_02d
lea rcx, [rsp + 0x40]
mov r9d, edi
mov edx, 0x20
call fcn.1400287d0
cmp r15b, r14b
je 0x14003e3c2
cmp word [rsp + 0x140], r14w
je 0x14003e3c2
lea r9, [rsp + 0x140]
lea rdx, [rsp + 0x40]
mov r8, rsi
mov rcx, rbx
call fcn.14005bd6c
cmp word [rsp + 0x540], r14w
je 0x14003e3cf
lea r9, [rsp + 0x540]
lea r8, str.Content_Type
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.14005bd6c
jmp 0x14003e3cf
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.14005ba64
add edi, r12d
cmp edi, 0x64
jl 0x14003e358
mov rcx, qword [rsp + 0x1d40]
xor rcx, rsp
call fcn.1400a86e0
lea r11, [rsp + 0x1d50]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret