Function at 0x1400a2fc4
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x30c0
call fcn.1400fe810
sub rsp, rax
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x3110], rbx
mov rax, qword [0x140132350]
xor rax, rsp
mov qword [rsp + 0x30b0], rax
mov r12, rdx
mov rbx, rcx
mov qword [rsp + 0x50], rcx
call fcn.140041028
nop
xor r13d, r13d
mov byte [rbx + 0x3038], r13b
mov edi, 0x800
mov r9, rdi
lea r8, [rsp + 0x10b0]
lea rdx, [rsp + 0x20b0]
lea rcx, [0x1401679c0]
call fcn.1400a4b8c
lea r11, [r12 + 0x83ea]
cmp word [r11], r13w
je 0x1400a306b
lea rcx, [rsp + 0x20b0]
sub rcx, r11
movzx eax, word [r11]
mov word [rcx + r11], ax
add r11, 2
cmp ax, r13w
jne 0x1400a3058
lea rcx, [r12 + 0x93ea]
cmp word [rcx], r13w
je 0x1400a3095
lea rdx, [rsp + 0x10b0]
sub rdx, rcx
movzx eax, word [rcx]
mov word [rdx + rcx], ax
add rcx, 2
cmp ax, r13w
jne 0x1400a3084
lea rbp, [r12 + 0x1018]
mov rcx, rbp
call fcn.140050ce8
mov rcx, rax
mov r8d, 6
lea rdx, str.WinCon
call fcn.140068d60
cmp eax, r13d
jne 0x1400a30cd
movzx eax, r13w
mov word [rsp + 0x10b0], ax
jmp 0x1400a30d5
mov ax, word [rsp + 0x10b0]
mov word [rbx + 0x1030], r13w
cmp word [rbp], r13w
je 0x1400a34ab
cmp word [rsp + 0x20b0], r13w
jne 0x1400a3107
cmp ax, r13w
jne 0x1400a3107
cmp byte [r12 + 0xa3ea], r13b
je 0x1400a34ab
mov rcx, rbp
call fcn.14004258c
cmp al, r13b
je 0x1400a34ab
mov rcx, rbp
lea rdx, [rbx + 0x2030]
sub rdx, rbp
movzx eax, word [rcx]
mov word [rdx + rcx], ax
add rcx, 2
cmp ax, r13w
jne 0x1400a3125
mov qword [rbx + 0x3030], rbp
mov r8, rdi
lea rdx, [rbx + 0x1030]
lea rcx, str.Rar_SF
call fcn.1400b5c90
mov rdi, rax
cmp rax, r13
je 0x1400a3489
mov rdx, rbp
mov rcx, rbx
call fcn.1400a0144
cmp al, r13b
je 0x1400a3197
mov ecx, 0x5f5
call fcn.14005fad8
mov rcx, rax
call fcn.1400c5814
mov edx, 1
lea rcx, [0x140149f20]
call fcn.14003c408
jmp 0x1400a3489
mov r8, rdi
mov rdx, rbp
mov rcx, rbx
call fcn.1400a0210
cmp al, r13b
je 0x1400a34ab
mov rcx, rdi
call fcn.1400eee40
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], r13
mov edx, 0x10000
lea rcx, [rsp + 0x30]
call fcn.14000db34
nop
mov r9, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x30]
mov r8, rdi
mov rdx, rbp
mov rcx, rbx
call fcn.1400a02c0
mov qword [rsp + 0x28], rax
xor edx, edx
lea rcx, [rbx + 0x1030]
call qword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
mov r15, rax
cmp rax, r13
jne 0x1400a3224
cmp rdi, r13
je 0x1400a34ab
mov rcx, rdi
call fcn.1400ea2a8
jmp 0x1400a34ab
mov byte [rsp + 0x20], r13b
mov r14b, r13b
xor edx, edx
lea r8d, [rdx + 3]
lea rcx, [rbx + 0x1030]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov r13, rax
xor edx, edx
cmp rax, rdx
je 0x1400a3307
movzx eax, word [rsp + 0x20b0]
cmp ax, dx
je 0x1400a32b5
mov r9, r15
lea r8, [0x1400a0124]
mov edx, 3
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
mov r9, r15
lea r8, [0x1400a0124]
mov edx, 0xe
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
mov r9d, reloc.SHELL32.dll_SHRestricted
lea r8, [rsp + 0x20b0]
mov rdx, r15
mov rcx, rbx
call fcn.14009fd88
mov cl, al
mov byte [rsp + 0x20], al
mov ax, word [rsp + 0x20b0]
xor edx, edx
jmp 0x1400a32b7
mov cl, dl
cmp word [rsp + 0x10b0], dx
je 0x1400a32fe
cmp ax, dx
je 0x1400a32ca
cmp cl, dl
je 0x1400a32fe
mov r9, r15
lea r8, [0x1400a0124]
mov edx, 2
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
mov r9d, 0x65
lea r8, [rsp + 0x10b0]
mov rdx, r15
mov rcx, rbx
call fcn.14009ffc0
mov r14b, al
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor edx, edx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_EndUpdateResourceW]
xor r13d, r13d
cmp eax, r13d
je 0x1400a347a
cmp word [rsp + 0x10b0], r13w
je 0x1400a3332
cmp r14b, r13b
je 0x1400a347a
cmp byte [rsp + 0x20], r13b
jne 0x1400a334c
cmp r14b, r13b
jne 0x1400a334c
cmp byte [r12 + 0xa3ea], r13b
je 0x1400a3400
cmp byte [r12 + 0xa3ea], r13b
je 0x1400a3365
lea rdx, [rbx + 0x1030]
mov rcx, rbx
call fcn.1400a046c
mov qword [rsp + 0x1070], r13
mov qword [rsp + 0x1078], r13
mov qword [rsp + 0x1080], r13
xor r8d, r8d
lea rdx, [rsp + 0x60]
lea rcx, [rbx + 0x1030]
call fcn.140043f04
cmp al, r13b
je 0x1400a33e4
mov rcx, qword [rsp + 0x1060]
mov r12, qword [rsp + 0x28]
add rcx, r12
mov r14d, 0x100000
cmp rcx, r14
jbe 0x1400a33e9
mov ecx, 0x5a0
call fcn.14005fad8
mov rdx, rax
mov r8d, r14d
lea rcx, [0x140173f4a]
call fcn.1400c5da8
nop
cmp rdi, r13
je 0x1400a34ab
mov rcx, rdi
call fcn.1400ea2a8
jmp 0x1400a34ab
mov r12, qword [rsp + 0x28]
mov r8d, 0x800
lea rdx, [rbx + 0x1030]
mov rcx, rbp
call fcn.140065d00
jmp 0x1400a3405
mov r12, qword [rsp + 0x28]
cmp r12, r13
je 0x1400a346b
mov r9, qword [rsp + 0x38]
mov r8, rdi
lea rdx, [rbx + 0x1030]
mov rcx, rbx
call fcn.1400a02c0
cmp rax, r13
jne 0x1400a346b
lea rdx, [0x140112a18]
lea rcx, [rbx + 0x1030]
call fcn.1400b5c54
mov rbp, rax
cmp rax, r13
je 0x1400a346b
xor edx, edx
lea r8d, [rdx + 2]
mov rcx, rax
call fcn.1400ef620
mov r9, rbp
mov r8, r12
mov edx, 1
mov rcx, rdi
call fcn.1400ef054
mov rcx, rbp
call fcn.1400eee40
nop
cmp rdi, r13
je 0x1400a3489
mov rcx, rdi
call fcn.1400ea2a8
jmp 0x1400a3489
cmp rdi, r13
je 0x1400a34ab
mov rcx, rdi
call fcn.1400ea2a8
jmp 0x1400a34ab
cmp word [rbx + 0x1030], r13w
je 0x1400a34ab
mov r9, qword [rbx]
mov r8d, 4
lea rdx, [rbx + 0x1030]
mov rcx, rbx
call qword [r9 + reloc.COMCTL32.dll_CreateMappedBitmap]
nop
mov rax, rbx
mov rcx, qword [rsp + 0x30b0]
xor rcx, rsp
call fcn.1400e9d80
mov rbx, qword [rsp + 0x3110]
add rsp, 0x30c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret