Function at 0x43b540
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x28f8
call fcn.004ebbf0
mov eax, dword [0x528af4]
xor eax, esp
mov dword [esp + 0x28f4], eax
push ebx
push esi
mov esi, dword [esp + 0x2904]
lea eax, [esp + 0x8fc]
push esi
push str._sShellNew
push 0x800
push eax
mov byte [0x525d8c], 0x52
mov byte [0x525da0], 0x50
call fcn.004028e0
add esp, 0x10
cmp byte [esp + 0x2908], 0
push esi
je 0x43b843
call fcn.0043abd0
test al, al
jne 0x43b6c9
push 0x200
push 0x50b8c4
lea eax, [esp + 0x504]
push eax
push 0x50b8c4
push esi
push SysReAllocString
call fcn.0049fd80
push 0x200
push 0x50b8c4
lea eax, [esp + 0x104]
push eax
push str.Content_Type
push esi
push SysReAllocString
call fcn.0049fd80
push 0x800
push 0x50b8c4
lea eax, [esp + 0x1904]
push eax
push 0x50e884
lea eax, [esp + 0x90c]
push eax
push SysReAllocString
call fcn.0049fd80
push 0xa
push 0x50b8c4
lea eax, [esp + 0xf0]
push eax
push str.NullFile
lea eax, [esp + 0x90c]
push eax
push SysReAllocString
call fcn.0049fd80
push esi
push str.Setup_s
mov bl, al
lea eax, [esp + 0x50]
push 0x50
push eax
call fcn.004028e0
add esp, 0x10
push esi
push SysReAllocString
call fcn.0049dc10
movzx eax, al
push eax
push str.Exist
lea eax, [esp + 0x50]
push eax
call fcn.004a08f0
lea eax, [esp + 0x4fc]
push eax
push str.Type
lea eax, [esp + 0x50]
push eax
call fcn.004a08d0
lea eax, [esp + 0xfc]
push eax
push str.Content
lea eax, [esp + 0x50]
push eax
call fcn.004a08d0
cmp word [esp + 0x18fc], 0
jne 0x43b6b2
test bl, bl
je 0x43b6b2
push 0x50ba14
jmp 0x43b6ba
lea eax, [esp + 0x18fc]
push eax
push str.ShellNew
lea eax, [esp + 0x50]
push eax
call fcn.004a08d0
mov bh, byte [esp + 0x2914]
mov eax, str.WinRAR.ZIP
test bh, bh
jne 0x43b6de
mov eax, 0x50e0ac
push eax
push 0x50b8c4
push esi
push SysReAllocString
call fcn.004a0710
push str.Content_Type
push esi
push SysReAllocString
call fcn.0049f870
mov bl, byte [esp + 0x2910]
test bl, bl
je 0x43b76a
push edi
call fcn.0046bee0
mov edi, eax
neg edi
sbb edi, edi
xor esi, esi
and edi, 0xffffffba
add edi, 0x64
test edi, edi
jle 0x43b769
push esi
push str..r_02d
lea eax, [esp + 0x14]
push 0x20
push eax
call fcn.004028e0
add esp, 0x10
lea eax, [esp + 0xc]
push 0x50e0ac
push 0x50b8c4
push eax
push SysReAllocString
call fcn.004a0710
push str.Content_Type
lea eax, [esp + 0x10]
push eax
push SysReAllocString
call fcn.0049f870
inc esi
cmp esi, edi
jl 0x43b722
pop edi
cmp byte [esp + 0x290c], 0
je 0x43ba92
test bh, bh
jne 0x43b784
test bl, bl
je 0x43ba92
lea eax, [esp + 0x8fc]
push eax
push SysReAllocString
call fcn.0049f760
push 0x800
lea eax, [esp + 0x1900]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, str.rarnew.dat
test bl, bl
jne 0x43b7b9
mov eax, str.zipnew.dat
push 0x800
push eax
lea eax, [esp + 0x1904]
push eax
call fcn.00478fb0
lea eax, [esp + 0x18fc]
push eax
call fcn.00469360
test al, al
jne 0x43b81f
push 0x50bd80
lea eax, [esp + 0x1900]
push eax
call fcn.0046a5a0
mov esi, eax
test esi, esi
je 0x43b81f
push esi
test bl, bl
je 0x43b805
push 0x14
push 1
push 0x525d8c
jmp 0x43b80e
push 0x16
push 1
push 0x525da0
call fcn.004f2dfc
add esp, 0x10
push esi
call fcn.004f2a17
add esp, 4
lea eax, [esp + 0x18fc]
push eax
push 0x50e884
lea eax, [esp + 0x904]
push eax
push SysReAllocString
call fcn.004a0710
jmp 0x43ba92
push str.Setup_s
lea eax, [esp + 0x50]
push 0x50
push eax
call fcn.004028e0
add esp, 0x10
push esi
call fcn.0043abd0
test al, al
je 0x43ba92
push 1
push str.Exist
lea eax, [esp + 0x50]
push eax
call fcn.0049fd30
push 0x200
test eax, eax
lea eax, [esp + 0x100]
push 0x50b8c4
push eax
push str.Type
lea eax, [esp + 0x58]
setne bl
push eax
call fcn.0049fec0
push 0x50e0ac
lea eax, [esp + 0x100]
push eax
call fcn.00491ab0
test eax, eax
je 0x43b8c8
push str.WinRAR.ZIP
lea eax, [esp + 0x100]
push eax
call fcn.00491ab0
test eax, eax
jne 0x43b8d2
xor eax, eax
mov word [esp + 0xfc], ax
push 0x200
push 0x50b8c4
lea eax, [esp + 0x504]
push eax
push str.Content
lea eax, [esp + 0x58]
push eax
call fcn.0049fec0
test bl, bl
je 0x43b9d2
lea eax, [esp + 0xfc]
push eax
push 0x50b8c4
push esi
push SysReAllocString
call fcn.004a0710
cmp word [esp + 0x4fc], 0
je 0x43b938
lea eax, [esp + 0x4fc]
push eax
push str.Content_Type
push esi
push SysReAllocString
call fcn.004a0710
jmp 0x43b948
push str.Content_Type
push esi
push SysReAllocString
call fcn.0049f870
push 0x800
push 0x50b8c4
lea eax, [esp + 0x1904]
push eax
push str.ShellNew
lea eax, [esp + 0x58]
push eax
call fcn.0049fec0
push 0x50e884
lea eax, [esp + 0x900]
push eax
push SysReAllocString
call fcn.0049f870
mov ax, word [esp + 0x18fc]
test ax, ax
je 0x43ba04
cmp ax, 0x2a
jne 0x43b9b1
push 0x50b8c4
push str.NullFile
lea eax, [esp + 0x904]
push eax
push SysReAllocString
call fcn.004a0710
jmp 0x43ba04
lea eax, [esp + 0x18fc]
push eax
push 0x50e884
lea eax, [esp + 0x904]
push eax
push SysReAllocString
call fcn.004a0710
jmp 0x43ba04
lea eax, [esp + 0x8fc]
push eax
push SysReAllocString
call fcn.0049f760
push 0x50b8c4
push 0x50b8c4
push esi
push SysReAllocString
call fcn.004a0710
push esi
push SysReAllocString
call fcn.0049f760
cmp byte [esp + 0x2910], 0
je 0x43ba92
xor esi, esi
push esi
push str..r_02d
lea eax, [esp + 0x10]
push 0x20
push eax
call fcn.004028e0
add esp, 0x10
test bl, bl
je 0x43ba7d
cmp word [esp + 0xfc], 0
je 0x43ba7d
lea eax, [esp + 0xfc]
push eax
push 0x50b8c4
lea eax, [esp + 0x10]
push eax
push SysReAllocString
call fcn.004a0710
cmp word [esp + 0x4fc], 0
je 0x43ba8c
lea eax, [esp + 0x4fc]
push eax
push str.Content_Type
lea eax, [esp + 0x10]
push eax
push SysReAllocString
call fcn.004a0710
jmp 0x43ba8c
lea eax, [esp + 8]
push eax
push SysReAllocString
call fcn.0049f760
inc esi
cmp esi, 0x64
jl 0x43ba14
mov ecx, dword [esp + 0x28fc]
pop esi
pop ebx
xor ecx, esp
call fcn.004ebbd8
add esp, 0x28f8
ret 0x14