Function at 0x1400034d4
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1d50
call fcn.140012000
sub rsp, rax
mov rax, qword [0x140019280]
xor rax, rsp
mov qword [rsp + 0x1d40], rax
mov r13b, r9b
mov byte [rsp + 0x30], r8b
mov rsi, rcx
mov r9, rcx
mov bl, dl
mov r12d, 0x400
lea r8, str._sShellNew
lea rcx, [rsp + 0xd40]
mov r15d, 0x50
mov rdx, r12
mov byte [0x140019228], 0x52
mov byte [0x140019210], r15b
call fcn.140007768
xor r14d, r14d
cmp bl, r14b
je 0x14000385e
mov rcx, rsi
call fcn.140002860
lea rbx, [0x1400139b0]
mov rdi, 0xffffffff80000000
cmp al, r14b
jne 0x1400036bf
mov r14d, 0x200
lea r9, [rsp + 0x540]
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rbx
call fcn.1400049b4
lea r9, [rsp + 0x140]
lea r8, str.Content_Type
mov rdx, rsi
mov rcx, rdi
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rbx
call fcn.1400049b4
lea r9, [rsp + 0x1540]
lea r8, str.FileName
lea rdx, [rsp + 0xd40]
mov rcx, rdi
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rbx
call fcn.1400049b4
lea r9, [rsp + 0x120]
lea r8, str.NullFile
lea rdx, [rsp + 0xd40]
mov rcx, rdi
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], rbx
call fcn.1400049b4
lea r8, str.Setup_s
lea rcx, [rsp + 0x80]
mov r9, rsi
mov rdx, r15
mov r12b, al
call fcn.140007768
mov rdx, rsi
mov rcx, rdi
call fcn.140004714
lea rdx, str.Exist
lea rcx, [rsp + 0x80]
movzx r8d, al
call fcn.140004b6c
lea r8, [rsp + 0x540]
lea rdx, str.Type
lea rcx, [rsp + 0x80]
call fcn.140004b54
lea r8, [rsp + 0x140]
lea rdx, [0x1400143e8]
lea rcx, [rsp + 0x80]
call fcn.140004b54
xor r14d, r14d
cmp word [rsp + 0x1540], r14w
jne 0x1400036a3
lea r8, [0x1400143e4]
cmp r12b, r14b
jne 0x1400036ab
lea r8, [rsp + 0x1540]
lea rdx, str.ShellNew
lea rcx, [rsp + 0x80]
call fcn.140004b54
mov r15b, byte [rsp + 0x1da0]
lea rdx, str.WinRAR.ZIP
lea r9, [0x140013f18]
cmp r15b, r14b
mov r8, rbx
mov rcx, rdi
cmovne r9, rdx
mov rdx, rsi
call fcn.1400048d8
lea r8, str.Content_Type
mov rdx, rsi
mov rcx, rdi
call fcn.14000462c
mov r12d, 1
cmp r13b, r14b
je 0x140003769
call fcn.1400040f4
neg eax
sbb esi, esi
and esi, 0xffffffba
add esi, 0x64
test esi, esi
jle 0x140003766
lea r8, str..r_02d
lea rcx, [rsp + 0x40]
mov r9d, r14d
mov edx, 0x20
call fcn.140007768
lea r9, [0x140013f18]
lea rdx, [rsp + 0x40]
mov r8, rbx
mov rcx, rdi
call fcn.1400048d8
lea r8, str.Content_Type
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.14000462c
add r14d, r12d
cmp r14d, esi
jl 0x14000371a
xor r14d, r14d
cmp byte [rsp + 0x30], r14b
je 0x140003ac6
cmp r15b, r14b
jne 0x140003782
cmp r13b, r14b
je 0x140003ac6
lea rdx, [rsp + 0xd40]
mov rcx, rdi
call fcn.1400045d0
lea rdx, [rsp + 0x540]
mov r8d, 0x400
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rax, str.rarnew.dat
lea rbx, str.zipnew.dat
lea rcx, [rsp + 0x540]
cmp r13b, r14b
cmovne rbx, rax
call fcn.14000424c
mov rdx, rbx
mov rcx, rax
call fcn.140007b34
lea rcx, [rsp + 0x540]
call fcn.140001a7c
cmp al, r14b
jne 0x14000383a
lea rdx, [0x140014388]
lea rcx, [rsp + 0x540]
xor r8d, r8d
call fcn.140001ca8
mov rbx, rax
cmp rax, r14
je 0x14000383a
mov r9, rax
mov rdx, r12
cmp r13b, r14b
je 0x140003820
mov r8d, 0x14
lea rcx, [0x140019228]
jmp 0x14000382d
mov r8d, 0x16
lea rcx, [0x140019210]
call fcn.140008d64
mov rcx, rbx
call fcn.140008b50
lea r9, [rsp + 0x540]
lea r8, str.FileName
lea rdx, [rsp + 0xd40]
mov rcx, rdi
call fcn.1400048d8
jmp 0x140003ac6
lea r8, str.Setup_s
lea rcx, [rsp + 0x80]
mov r9, rsi
mov rdx, r15
call fcn.140007768
mov rcx, rsi
call fcn.140002860
cmp al, r14b
je 0x140003ac6
mov r12d, 1
lea rdx, str.Exist
lea rcx, [rsp + 0x80]
mov r8d, r12d
call fcn.140004bb0
lea rbx, [0x1400139b0]
lea r8, [rsp + 0x140]
cmp eax, r14d
lea rdx, str.Type
lea rcx, [rsp + 0x80]
mov r14d, 0x200
mov r9, rbx
setne r15b
mov dword [rsp + 0x20], r14d
call fcn.140004b84
lea rdx, [0x140013f18]
lea rcx, [rsp + 0x140]
call fcn.140005e30
xor edi, edi
cmp eax, edi
je 0x140003910
lea rdx, str.WinRAR.ZIP
lea rcx, [rsp + 0x140]
call fcn.140005e30
cmp eax, edi
jne 0x140003918
mov word [rsp + 0x140], di
lea r8, [rsp + 0x540]
lea rdx, [0x1400143e8]
lea rcx, [rsp + 0x80]
mov r9, rbx
mov dword [rsp + 0x20], r14d
call fcn.140004b84
xor r14d, r14d
mov rdi, 0xffffffff80000000
mov rcx, rdi
cmp r15b, r14b
je 0x140003a12
lea r9, [rsp + 0x140]
mov r8, rbx
mov rdx, rsi
call fcn.1400048d8
lea r8, str.Content_Type
mov rdx, rsi
mov rcx, rdi
cmp word [rsp + 0x540], r14w
je 0x14000398c
lea r9, [rsp + 0x540]
call fcn.1400048d8
jmp 0x140003991
call fcn.14000462c
lea r8, [rsp + 0x1540]
lea rdx, str.ShellNew
lea rcx, [rsp + 0x80]
mov r9, rbx
mov dword [rsp + 0x20], 0x400
call fcn.140004b84
lea r8, str.FileName
lea rdx, [rsp + 0xd40]
mov rcx, rdi
call fcn.14000462c
movzx r11d, word [rsp + 0x1540]
cmp r11w, r14w
je 0x140003a3b
lea rdx, [rsp + 0xd40]
mov rcx, rdi
cmp r11w, 0x2a
jne 0x1400039fc
mov r9, rbx
lea r8, str.NullFile
jmp 0x140003a0b
lea r9, [rsp + 0x1540]
lea r8, str.FileName
call fcn.1400048d8
jmp 0x140003a3b
lea rdx, [rsp + 0xd40]
call fcn.1400045d0
mov r9, rbx
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
call fcn.1400048d8
mov rdx, rsi
mov rcx, rdi
call fcn.1400045d0
cmp r13b, r14b
je 0x140003ac6
mov esi, r14d
lea r8, str..r_02d
lea rcx, [rsp + 0x40]
mov r9d, esi
mov edx, 0x20
call fcn.140007768
cmp r15b, r14b
je 0x140003ab1
cmp word [rsp + 0x140], r14w
je 0x140003ab1
lea r9, [rsp + 0x140]
lea rdx, [rsp + 0x40]
mov r8, rbx
mov rcx, rdi
call fcn.1400048d8
cmp word [rsp + 0x540], r14w
je 0x140003abe
lea r9, [rsp + 0x540]
lea r8, str.Content_Type
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.1400048d8
jmp 0x140003abe
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.1400045d0
add esi, r12d
cmp esi, 0x64
jl 0x140003a47
mov rcx, qword [rsp + 0x1d40]
xor rcx, rsp
call fcn.140008090
lea r11, [rsp + 0x1d50]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret