Function at 0x443fc0
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x1cf8
call fcn.004b1040
mov eax, dword [0x4da8f0]
xor eax, esp
mov dword [esp + 0x1cf4], eax
push ebx
push esi
mov esi, ecx
push esi
lea eax, [esp + 0xd00]
push str._sShellNew
push eax
mov edx, 0x400
mov byte [0x4d914c], 0x52
mov byte [0x4d9134], 0x50
call fcn.00483770
add esp, 0xc
cmp byte [esp + 0x1d04], 0
push esi
je 0x4442ea
call fcn.00442c30
test al, al
jne 0x444151
push 0x200
push 0x4c79a8
lea ecx, [esp + 0x504]
push ecx
push 0x4c79a8
push esi
push 0x80000000
call fcn.004608a0
push 0x200
push 0x4c79a8
lea edx, [esp + 0x104]
push edx
push str.Content_Type
push esi
push 0x80000000
call fcn.004608a0
push 0x400
push 0x4c79a8
lea eax, [esp + 0x1504]
push eax
push str.FileName
lea ecx, [esp + 0xd0c]
push ecx
push 0x80000000
call fcn.004608a0
push 0xa
push 0x4c79a8
lea edx, [esp + 0xf0]
push edx
push str.NullFile
lea eax, [esp + 0xd0c]
push eax
push 0x80000000
call fcn.004608a0
push esi
lea ecx, [esp + 0x4c]
push str.Setup_s
push ecx
mov edx, 0x50
mov bl, al
call fcn.00483770
add esp, 0xc
push esi
push 0x80000000
call fcn.004605d0
movzx edx, al
push edx
push str.Exist
lea eax, [esp + 0x50]
push eax
call fcn.00460e00
lea ecx, [esp + 0x4fc]
push ecx
push str.Type
lea edx, [esp + 0x50]
push edx
call fcn.00460de0
lea eax, [esp + 0xfc]
push eax
push str.Content
lea ecx, [esp + 0x50]
push ecx
call fcn.00460de0
cmp word [esp + 0x14fc], 0
jne 0x44413a
test bl, bl
je 0x44413a
push 0x4c7f44
push str.ShellNew
lea edx, [esp + 0x50]
push edx
jmp 0x44414c
lea eax, [esp + 0x14fc]
push eax
push str.ShellNew
lea ecx, [esp + 0x50]
push ecx
call fcn.00460de0
cmp byte [esp + 0x1d10], 0
mov eax, str.WinRAR.ZIP
jne 0x444165
mov eax, 0x4c9898
push eax
push 0x4c79a8
push esi
push 0x80000000
call fcn.00460830
push str.Content_Type
push esi
push 0x80000000
call fcn.004604b0
mov bl, byte [esp + 0x1d0c]
test bl, bl
je 0x4441fb
push edi
call fcn.00444e60
mov edi, eax
neg edi
sbb edi, edi
and edi, 0xffffffba
add edi, 0x64
xor esi, esi
test edi, edi
jle 0x4441fa
lea esp, [esp]
push esi
lea edx, [esp + 0x10]
push str..r_02d
push edx
mov edx, 0x20
call fcn.00483770
add esp, 0xc
push 0x4c9898
push 0x4c79a8
lea eax, [esp + 0x14]
push eax
push 0x80000000
call fcn.00460830
push str.Content_Type
lea ecx, [esp + 0x10]
push ecx
push 0x80000000
call fcn.004604b0
inc esi
cmp esi, edi
jl 0x4441b0
pop edi
cmp byte [esp + 0x1d08], 0
je 0x444545
cmp byte [esp + 0x1d10], 0
jne 0x44421b
test bl, bl
je 0x444545
lea edx, [esp + 0xcfc]
push edx
push 0x80000000
call fcn.00460400
push 0x400
lea eax, [esp + 0x500]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, str.rarnew.dat
test bl, bl
jne 0x444250
mov esi, str.zipnew.dat
lea ecx, [esp + 0x4fc]
push ecx
call fcn.00456820
lea ecx, [ecx]
movzx ecx, word [esi]
mov word [eax], cx
add esi, 2
add eax, 2
test cx, cx
jne 0x444260
lea edx, [esp + 0x4fc]
push edx
call fcn.00435ac0
test al, al
jne 0x4442c6
push 0
push 0x4ca078
lea eax, [esp + 0x504]
push eax
call fcn.00436260
mov esi, eax
test esi, esi
je 0x4442c6
push esi
test bl, bl
je 0x4442ac
push 0x14
push 1
push 0x4d914c
jmp 0x4442b5
push 0x16
push 1
push 0x4d9134
call fcn.004b39f8
add esp, 0x10
push esi
call fcn.004b3dae
add esp, 4
lea ecx, [esp + 0x4fc]
push ecx
push str.FileName
lea edx, [esp + 0xd04]
push edx
push 0x80000000
call fcn.00460830
jmp 0x444545
lea eax, [esp + 0x4c]
push str.Setup_s
push eax
mov edx, 0x50
call fcn.00483770
add esp, 0xc
push esi
call fcn.00442c30
test al, al
je 0x444545
push 1
push str.Exist
lea ecx, [esp + 0x50]
push ecx
call fcn.00460ee0
push 0x200
push 0x4c79a8
lea edx, [esp + 0x104]
push edx
test eax, eax
push str.Type
lea eax, [esp + 0x58]
push eax
setne bl
call fcn.00460eb0
push 0x4c9898
lea ecx, [esp + 0x100]
push ecx
call fcn.00478290
test eax, eax
je 0x444372
push str.WinRAR.ZIP
lea edx, [esp + 0x100]
push edx
call fcn.00478290
test eax, eax
jne 0x44437c
xor eax, eax
mov word [esp + 0xfc], ax
push 0x200
push 0x4c79a8
lea ecx, [esp + 0x504]
push ecx
push str.Content
lea edx, [esp + 0x58]
push edx
call fcn.00460eb0
test bl, bl
je 0x44447c
lea eax, [esp + 0xfc]
push eax
push 0x4c79a8
push esi
push 0x80000000
call fcn.00460830
cmp word [esp + 0x4fc], 0
je 0x4443e2
lea ecx, [esp + 0x4fc]
push ecx
push str.Content_Type
push esi
push 0x80000000
call fcn.00460830
jmp 0x4443f2
push str.Content_Type
push esi
push 0x80000000
call fcn.004604b0
push 0x400
push 0x4c79a8
lea edx, [esp + 0x1504]
push edx
push str.ShellNew
lea eax, [esp + 0x58]
push eax
call fcn.00460eb0
push str.FileName
lea ecx, [esp + 0xd00]
push ecx
push 0x80000000
call fcn.004604b0
mov ax, word [esp + 0x14fc]
test ax, ax
je 0x4444ae
cmp ax, 0x2a
jne 0x44445b
push 0x4c79a8
push str.NullFile
lea edx, [esp + 0xd04]
push edx
push 0x80000000
call fcn.00460830
jmp 0x4444ae
lea eax, [esp + 0x14fc]
push eax
push str.FileName
lea ecx, [esp + 0xd04]
push ecx
push 0x80000000
call fcn.00460830
jmp 0x4444ae
lea edx, [esp + 0xcfc]
push edx
push 0x80000000
call fcn.00460400
push 0x4c79a8
push 0x4c79a8
push esi
push 0x80000000
call fcn.00460830
push esi
push 0x80000000
call fcn.00460400
cmp byte [esp + 0x1d0c], 0
je 0x444545
xor esi, esi
mov edi, edi
push esi
lea eax, [esp + 0xc]
push str..r_02d
push eax
mov edx, 0x20
call fcn.00483770
add esp, 0xc
test bl, bl
je 0x44452c
cmp word [esp + 0xfc], 0
je 0x44452c
lea ecx, [esp + 0xfc]
push ecx
push 0x4c79a8
lea edx, [esp + 0x10]
push edx
push 0x80000000
call fcn.00460830
cmp word [esp + 0x4fc], 0
je 0x44453b
lea eax, [esp + 0x4fc]
push eax
push str.Content_Type
lea ecx, [esp + 0x10]
push ecx
push 0x80000000
call fcn.00460830
jmp 0x44453b
lea edx, [esp + 8]
push edx
push 0x80000000
call fcn.00460400
inc esi
cmp esi, 0x64
jl 0x4444c0
mov ecx, dword [esp + 0x1cfc]
pop esi
pop ebx
xor ecx, esp
call fcn.004b102c
add esp, 0x1cf8
ret 0x10