Function at 0x441ae0
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x35e4
call fcn.00502fa0
mov eax, dword [0x5513d4]
xor eax, esp
mov dword [esp + 0x35e0], eax
push ebx
mov ebx, dword [esp + 0x35ec]
lea eax, [esp + 0x15e4]
push esi
push ebx
push str._sShellNew
push 0x800
push eax
mov byte [0x549d68], 0x52
mov byte [0x549d80], 0x50
call fcn.004027c0
push ebx
push str.Setup_s
lea eax, [esp + 0x10c0]
push 0x50
push eax
call fcn.004027c0
add esp, 0x20
cmp byte [esp + 0x35f4], 0
je 0x441e18
push ebx
call fcn.00441150
test al, al
jne 0x441c3e
push 0x200
push 0x52452c
lea eax, [esp + 0x11f0]
push eax
push 0x52452c
push ebx
push SysReAllocString
call fcn.004ae590
push 0x800
push 0x52452c
lea eax, [esp + 0x25f0]
push eax
push str.FileName
lea eax, [esp + 0x15f8]
push eax
push SysReAllocString
call fcn.004ae590
push 0xa
push 0x52452c
lea eax, [esp + 0x109c]
push eax
push str.NullFile
lea eax, [esp + 0x15f8]
push eax
push SysReAllocString
call fcn.004ae590
push ebx
push SysReAllocString
mov byte [esp + 0x13], al
call fcn.004ac290
movzx ecx, al
lea eax, [esp + 0x10a8]
push ecx
push str.Exist
push eax
call fcn.004af150
lea eax, [esp + 0x11e8]
push eax
push 0x524ffc
lea eax, [esp + 0x10b0]
push eax
call fcn.004af130
cmp word [esp + 0x25e8], 0
jne 0x441c24
cmp byte [esp + 0xb], 0
je 0x441c24
push 0x524704
jmp 0x441c2c
lea eax, [esp + 0x25e8]
push eax
push str.ShellNew
lea eax, [esp + 0x10b0]
push eax
call fcn.004af130
cmp byte [esp + 0x3600], 0
mov eax, str.WinRAR.ZIP
jne 0x441c52
mov eax, 0x526fa4
push eax
push 0x52452c
push ebx
push SysReAllocString
call fcn.004aef70
mov al, byte [esp + 0x35fc]
test al, al
je 0x441cc3
push edi
call fcn.00477ef0
mov edi, eax
neg edi
sbb edi, edi
and edi, 0xffffffba
add edi, 0x64
xor esi, esi
push esi
push str..r_02u
lea eax, [esp + 0x1060]
push 0x20
push eax
call fcn.004027c0
add esp, 0x10
lea eax, [esp + 0x1058]
push 0x526fa4
push 0x52452c
push eax
push SysReAllocString
call fcn.004aef70
inc esi
cmp esi, edi
jb 0x441c82
mov al, byte [esp + 0x3600]
pop edi
cmp byte [esp + 0x35f8], 0
je 0x441e18
cmp byte [esp + 0x3600], 0
jne 0x441ce3
test al, al
je 0x441e18
lea eax, [esp + 0x15e8]
push eax
push SysReAllocString
call fcn.004adeb0
push 0x800
lea eax, [esp + 0x25ec]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp byte [esp + 0x35fc], 0
mov eax, str.rarnew.dat
jne 0x441d1e
mov eax, str.zipnew.dat
push 0x800
push eax
lea eax, [esp + 0x25f0]
push eax
call fcn.00485380
push 0
lea eax, [esp + 0x10]
mov dword [esp + 0x1020], 0
push eax
lea eax, [esp + 0x25f0]
mov dword [esp + 0x1028], 0
push eax
mov dword [esp + 0x1030], 0
mov dword [esp + 0x1034], 0
mov dword [esp + 0x1038], 0
mov dword [esp + 0x103c], 0
call fcn.00475a80
test al, al
je 0x441db1
xor eax, eax
cmp byte [esp + 0x35fc], al
setne al
lea eax, [eax*2 + 0x16]
cmp dword [esp + 0x100c], eax
jne 0x441db1
cmp dword [esp + 0x1010], 0
je 0x441df9
push 0x524ae0
lea eax, [esp + 0x25ec]
push eax
call fcn.00475430
mov esi, eax
test esi, esi
je 0x441df9
cmp byte [esp + 0x35fc], 0
push esi
je 0x441ddf
push 0x18
push 1
push 0x549d68
jmp 0x441de8
push 0x16
push 1
push 0x549d80
call fcn.0050a0c5
add esp, 0x10
push esi
call fcn.00509ce0
add esp, 4
lea eax, [esp + 0x25e8]
push eax
push str.FileName
lea eax, [esp + 0x15f0]
push eax
push SysReAllocString
call fcn.004aef70
push 0x50
push 0x52452c
lea eax, [esp + 0x1150]
push eax
push 0x52452c
push ebx
push SysReAllocString
call fcn.004ae590
push 0x526fa4
lea eax, [esp + 0x114c]
push eax
call fcn.004a05e0
test eax, eax
je 0x441e67
push str.WinRAR.ZIP
lea eax, [esp + 0x114c]
push eax
call fcn.004a05e0
test eax, eax
jne 0x442090
cmp byte [esp + 0x35f4], 0
je 0x441e7f
cmp byte [esp + 0x35f8], 0
jne 0x442090
push 1
push str.Exist
lea eax, [esp + 0x10b0]
push eax
call fcn.004ae540
test eax, eax
setne al
cmp byte [esp + 0x35f4], 0
mov byte [esp + 0xb], al
jne 0x441fc7
push 0x200
push 0x52452c
lea eax, [esp + 0x11f0]
push eax
push 0x524ffc
lea eax, [esp + 0x10b8]
push eax
call fcn.004ae6d0
push 0x526fa4
lea eax, [esp + 0x11ec]
push eax
call fcn.004a05e0
test eax, eax
je 0x441efa
push str.WinRAR.ZIP
lea eax, [esp + 0x11ec]
push eax
call fcn.004a05e0
test eax, eax
jne 0x441f04
xor eax, eax
mov word [esp + 0x11e8], ax
cmp byte [esp + 0xb], 0
je 0x441f25
lea eax, [esp + 0x11e8]
push eax
push 0x52452c
push ebx
push SysReAllocString
call fcn.004aef70
jmp 0x441f45
push 0x52452c
push 0x52452c
push ebx
push SysReAllocString
call fcn.004aef70
push ebx
push SysReAllocString
call fcn.004adeb0
mov cl, byte [esp + 0x35fc]
test cl, cl
je 0x442054
xor esi, esi
jmp 0x441f60
push esi
push str..r_02u
lea eax, [esp + 0x105c]
push 0x20
push eax
call fcn.004027c0
add esp, 0x10
cmp byte [esp + 0xb], 0
je 0x441fab
cmp word [esp + 0x11e8], 0
je 0x441fab
lea eax, [esp + 0x11e8]
push eax
push 0x52452c
lea eax, [esp + 0x105c]
push eax
push SysReAllocString
call fcn.004aef70
jmp 0x441fbd
lea eax, [esp + 0x1054]
push eax
push SysReAllocString
call fcn.004adeb0
inc esi
cmp esi, 0x64
jb 0x441f60
mov al, byte [esp + 0xb]
mov cl, byte [esp + 0x35fc]
cmp byte [esp + 0x3600], 0
jne 0x441fe0
test cl, cl
je 0x442090
test al, al
je 0x44207e
push 0x800
push 0x52452c
lea eax, [esp + 0x25f0]
push eax
push str.ShellNew
lea eax, [esp + 0x10b8]
push eax
call fcn.004ae6d0
push str.FileName
lea eax, [esp + 0x15ec]
push eax
push SysReAllocString
call fcn.004adfc0
mov ax, word [esp + 0x25e8]
test ax, ax
je 0x442090
cmp ax, 0x2a
jne 0x44205d
push 0x52452c
push str.NullFile
lea eax, [esp + 0x15f0]
push eax
push SysReAllocString
call fcn.004aef70
jmp 0x442090
mov al, byte [esp + 0xb]
jmp 0x441fce
lea eax, [esp + 0x25e8]
push eax
push str.FileName
lea eax, [esp + 0x15f0]
push eax
push SysReAllocString
call fcn.004aef70
jmp 0x442090
lea eax, [esp + 0x15e8]
push eax
push SysReAllocString
call fcn.004adeb0
mov ecx, dword [esp + 0x35e8]
pop esi
pop ebx
xor ecx, esp
call fcn.00502f8e
add esp, 0x35e4
ret 0x14