Function at 0x43d8c0
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x1cf8
call fcn.004a4220
mov eax, dword [0x4ca3b0]
xor eax, esp
mov dword [esp + 0x1cf4], eax
push ebx
push esi
mov esi, ecx
push esi
lea eax, [esp + 0xd00]
push str._sShellNew
push eax
mov edx, 0x400
mov byte [0x4c8fdc], 0x52
mov byte [0x4c8fc4], 0x50
call fcn.00495900
add esp, 0xc
cmp byte [esp + 0x1d04], 0
push esi
je 0x43dbea
call fcn.0043c4a0
test al, al
jne 0x43da51
push 0x200
push 0x4b8d0c
lea ecx, [esp + 0x504]
push ecx
push 0x4b8d0c
push esi
push 0x80000000
call fcn.0045a9c0
push 0x200
push 0x4b8d0c
lea edx, [esp + 0x104]
push edx
push str.Content_Type
push esi
push 0x80000000
call fcn.0045a9c0
push 0x400
push 0x4b8d0c
lea eax, [esp + 0x1504]
push eax
push str.FileName
lea ecx, [esp + 0xd0c]
push ecx
push 0x80000000
call fcn.0045a9c0
push 0xa
push 0x4b8d0c
lea edx, [esp + 0xf0]
push edx
push str.NullFile
lea eax, [esp + 0xd0c]
push eax
push 0x80000000
call fcn.0045a9c0
push esi
lea ecx, [esp + 0x4c]
push 0x4ba8a8
push ecx
mov edx, 0x50
mov bl, al
call fcn.00495900
add esp, 0xc
push esi
push 0x80000000
call fcn.0045a6f0
movzx edx, al
push edx
push str.Exist
lea eax, [esp + 0x50]
push eax
call fcn.0045aed0
lea ecx, [esp + 0x4fc]
push ecx
push 0x4b9278
lea edx, [esp + 0x50]
push edx
call fcn.0045aeb0
lea eax, [esp + 0xfc]
push eax
push str.Content
lea ecx, [esp + 0x50]
push ecx
call fcn.0045aeb0
cmp word [esp + 0x14fc], 0
jne 0x43da3a
test bl, bl
je 0x43da3a
push 0x4b8eec
push str.ShellNew
lea edx, [esp + 0x50]
push edx
jmp 0x43da4c
lea eax, [esp + 0x14fc]
push eax
push str.ShellNew
lea ecx, [esp + 0x50]
push ecx
call fcn.0045aeb0
cmp byte [esp + 0x1d10], 0
mov eax, str.WinRAR.ZIP
jne 0x43da65
mov eax, 0x4ba748
push eax
push 0x4b8d0c
push esi
push 0x80000000
call fcn.0045a950
push str.Content_Type
push esi
push 0x80000000
call fcn.0045a5d0
mov bl, byte [esp + 0x1d0c]
test bl, bl
je 0x43dafb
push edi
call fcn.0043e7a0
mov edi, eax
neg edi
sbb edi, edi
and edi, 0xffffffba
add edi, 0x64
xor esi, esi
test edi, edi
jle 0x43dafa
lea esp, [esp]
push esi
lea edx, [esp + 0x10]
push str..r_02d
push edx
mov edx, 0x20
call fcn.00495900
add esp, 0xc
push 0x4ba748
push 0x4b8d0c
lea eax, [esp + 0x14]
push eax
push 0x80000000
call fcn.0045a950
push str.Content_Type
lea ecx, [esp + 0x10]
push ecx
push 0x80000000
call fcn.0045a5d0
inc esi
cmp esi, edi
jl 0x43dab0
pop edi
cmp byte [esp + 0x1d08], 0
je 0x43de45
cmp byte [esp + 0x1d10], 0
jne 0x43db1b
test bl, bl
je 0x43de45
lea edx, [esp + 0xcfc]
push edx
push 0x80000000
call fcn.0045a520
push 0x400
lea eax, [esp + 0x500]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, str.rarnew.dat
test bl, bl
jne 0x43db50
mov esi, str.zipnew.dat
lea ecx, [esp + 0x4fc]
push ecx
call fcn.004513d0
lea ecx, [ecx]
movzx ecx, word [esi]
mov word [eax], cx
add esi, 2
add eax, 2
test cx, cx
jne 0x43db60
lea edx, [esp + 0x4fc]
push edx
call fcn.00431440
test al, al
jne 0x43dbc6
push 0
push 0x4b8d50
lea eax, [esp + 0x504]
push eax
call fcn.00431a80
mov esi, eax
test esi, esi
je 0x43dbc6
push esi
test bl, bl
je 0x43dbac
push 0x14
push 1
push 0x4c8fdc
jmp 0x43dbb5
push 0x16
push 1
push 0x4c8fc4
call fcn.004a5c91
add esp, 0x10
push esi
call fcn.004a5ab5
add esp, 4
lea ecx, [esp + 0x4fc]
push ecx
push str.FileName
lea edx, [esp + 0xd04]
push edx
push 0x80000000
call fcn.0045a950
jmp 0x43de45
lea eax, [esp + 0x4c]
push 0x4ba8a8
push eax
mov edx, 0x50
call fcn.00495900
add esp, 0xc
push esi
call fcn.0043c4a0
test al, al
je 0x43de45
push 1
push str.Exist
lea ecx, [esp + 0x50]
push ecx
call fcn.0045afb0
push 0x200
push 0x4b8d0c
lea edx, [esp + 0x104]
push edx
test eax, eax
push 0x4b9278
lea eax, [esp + 0x58]
push eax
setne bl
call fcn.0045af80
push 0x4ba748
lea ecx, [esp + 0x100]
push ecx
call fcn.00472870
test eax, eax
je 0x43dc72
push str.WinRAR.ZIP
lea edx, [esp + 0x100]
push edx
call fcn.00472870
test eax, eax
jne 0x43dc7c
xor eax, eax
mov word [esp + 0xfc], ax
push 0x200
push 0x4b8d0c
lea ecx, [esp + 0x504]
push ecx
push str.Content
lea edx, [esp + 0x58]
push edx
call fcn.0045af80
test bl, bl
je 0x43dd7c
lea eax, [esp + 0xfc]
push eax
push 0x4b8d0c
push esi
push 0x80000000
call fcn.0045a950
cmp word [esp + 0x4fc], 0
je 0x43dce2
lea ecx, [esp + 0x4fc]
push ecx
push str.Content_Type
push esi
push 0x80000000
call fcn.0045a950
jmp 0x43dcf2
push str.Content_Type
push esi
push 0x80000000
call fcn.0045a5d0
push 0x400
push 0x4b8d0c
lea edx, [esp + 0x1504]
push edx
push str.ShellNew
lea eax, [esp + 0x58]
push eax
call fcn.0045af80
push str.FileName
lea ecx, [esp + 0xd00]
push ecx
push 0x80000000
call fcn.0045a5d0
mov ax, word [esp + 0x14fc]
test ax, ax
je 0x43ddae
cmp ax, 0x2a
jne 0x43dd5b
push 0x4b8d0c
push str.NullFile
lea edx, [esp + 0xd04]
push edx
push 0x80000000
call fcn.0045a950
jmp 0x43ddae
lea eax, [esp + 0x14fc]
push eax
push str.FileName
lea ecx, [esp + 0xd04]
push ecx
push 0x80000000
call fcn.0045a950
jmp 0x43ddae
lea edx, [esp + 0xcfc]
push edx
push 0x80000000
call fcn.0045a520
push 0x4b8d0c
push 0x4b8d0c
push esi
push 0x80000000
call fcn.0045a950
push esi
push 0x80000000
call fcn.0045a520
cmp byte [esp + 0x1d0c], 0
je 0x43de45
xor esi, esi
mov edi, edi
push esi
lea eax, [esp + 0xc]
push str..r_02d
push eax
mov edx, 0x20
call fcn.00495900
add esp, 0xc
test bl, bl
je 0x43de2c
cmp word [esp + 0xfc], 0
je 0x43de2c
lea ecx, [esp + 0xfc]
push ecx
push 0x4b8d0c
lea edx, [esp + 0x10]
push edx
push 0x80000000
call fcn.0045a950
cmp word [esp + 0x4fc], 0
je 0x43de3b
lea eax, [esp + 0x4fc]
push eax
push str.Content_Type
lea ecx, [esp + 0x10]
push ecx
push 0x80000000
call fcn.0045a950
jmp 0x43de3b
lea edx, [esp + 8]
push edx
push 0x80000000
call fcn.0045a520
inc esi
cmp esi, 0x64
jl 0x43ddc0
mov ecx, dword [esp + 0x1cfc]
pop esi
pop ebx
xor ecx, esp
call fcn.004a39f3
add esp, 0x1cf8
ret 0x10