Function at 0x4081d0
Capabilities:
Create process on windows
Delete file
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x40f0e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x6fc
push ebx
push ebp
push esi
mov ebp, ecx
push edi
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x2f5]
mov byte [esp + 0x2f4], 0
mov byte [esp + 0x60], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x61]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 0x2b4]
test eax, eax
jne 0x408240
mov eax, dword [0x4143cc]
push eax
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 4
mov dword [ebp + 0x2b4], eax
lea ecx, [ebp + 0x1b0]
push 0x414c10
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x40828a
push eax
push 0x4140f4
push 0x414d2c
mov ecx, ebp
call sub.MFC42.DLL_CWnd::MessageBoxA
xor eax, eax
mov ecx, dword [esp + 0x70c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x708
ret 4
mov edi, 0x4156d0
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x60]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x60]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.LiteUnzip.dll
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x71c]
mov ecx, edx
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push 0
push ebx
lea ecx, [esp + 0x6c]
push 1
push ecx
mov ecx, ebp
call fcn.00408920
mov dword [esp + 0x10], eax
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x60]
rep stosd dword es:[edi], eax
mov edi, str.C:WINDOWS_tmp_read_dirdg_install.zip
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x60]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x60]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [esp + 0x71c]
mov esi, dword [esp + 0x10]
push edx
push esi
push ebx
lea eax, [esp + 0x6c]
push 2
push eax
mov ecx, ebp
call fcn.00408920
lea ecx, [esp + 0x14]
add esi, eax
push ecx
mov ecx, ebp
mov dword [esp + 0x14], esi
call fcn.0040aba0
test eax, eax
push 0
jne 0x40837f
push str.C:WINDOWS_tmp_read_dir
mov ecx, ebp
call fcn.00409a70
push 0
call dword [sym.imp.MSVCRT.dll_exit]
push 0x415804
lea ecx, [esp + 0x168]
call fcn.00406a60
lea ecx, [esp + 0x160]
mov dword [esp + 0x714], 0
call sub.MFC42.DLL_CDialog::DoModal
mov eax, dword [0x415804]
test eax, eax
jne 0x4083c4
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x415804]
test eax, eax
je 0x4083b0
mov ecx, ebp
call fcn.0040a6a0
mov eax, dword [ebp + 0x19d4]
test eax, eax
jne 0x408408
push 0
push str.C:WINDOWS_tmp_read_dir
mov ecx, ebp
call fcn.00409a70
push ebx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov ecx, ebp
push 0x30
push 0x41406c
push 0x414cd8
call sub.MFC42.DLL_CWnd::MessageBoxA
push 0
call dword [sym.imp.MSVCRT.dll_exit]
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x3f5]
mov byte [esp + 0x3f4], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, 0x4156d0
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x3f4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 5
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x3f8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov edi, str._fastlock.exe
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x400]
and ecx, 3
push eax
push str.open
push 0
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0
lea ecx, [esp + 0x1c]
push 0x415684
push ecx
push 0x415684
push 0x414458
lea ecx, [esp + 0x21c]
call fcn.0040db10
lea ecx, [esp + 0x208]
mov byte [esp + 0x714], 2
call sub.MFC42.DLL_CDialog::DoModal
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x40854d
push ebx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
lea ecx, [esp + 0x2bc]
mov byte [esp + 0x714], 4
call fcn.0040da70
lea ecx, [esp + 0x268]
mov byte [esp + 0x714], 3
call sub.MFC42.DLL_CEdit::CEdit
lea ecx, [esp + 0x208]
mov byte [esp + 0x714], 0
call fcn.0040e0f8
lea ecx, [esp + 0x1c0]
mov dword [esp + 0x714], 5
call sub.MFC42.DLL_CProgressCtrl::CProgressCtrl
lea ecx, [esp + 0x160]
mov dword [esp + 0x714], 0xffffffff
call fcn.0040e0f8
jmp 0x40826d
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
and eax, 0xffff
and ecx, 0xffff
lea edx, [eax + eax*8]
lea eax, [eax + edx*8]
lea edx, [eax + eax*4]
mov eax, dword [esp + 0x1e]
and eax, 0xffff
mov esi, eax
shl esi, 4
sub esi, eax
lea eax, [edx + esi*2]
mov edx, dword [esp + 0x22]
and edx, 0xffff
add eax, edx
lea eax, [eax + eax*2]
lea eax, [ecx + eax*8]
mov edx, eax
shl edx, 4
sub edx, eax
mov eax, dword [esp + 0x26]
and eax, 0xffff
lea eax, [eax + edx*4]
mov edx, dword [str.q_r_]
cmp eax, edx
jae 0x4085d7
push ebx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov dword [ebp + 0x9b8], 1
call fcn.00409440
push 0
call dword [sym.imp.MSVCRT.dll_exit]
mov edx, dword [0x4143dc]
mov esi, dword [0x4143d8]
add edx, esi
cmp eax, edx
jbe 0x40860a
push ebx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov dword [ebp + 0x9b8], 1
call fcn.00409440
push 0
call dword [sym.imp.MSVCRT.dll_exit]
cmp ecx, dword [0x4143e0]
jl 0x408899
cmp ecx, dword [0x4143e4]
jge 0x408899
mov eax, dword [0x4143e8]
test eax, eax
jg 0x40864c
push ebx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov dword [ebp + 0x9b8], 1
call fcn.00409440
push 0
call dword [sym.imp.MSVCRT.dll_exit]
mov ecx, 0x86
xor eax, eax
lea edi, [esp + 0x4f4]
push 0x104
rep stosd dword es:[edi], eax
lea eax, [esp + 0x508]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, dword [str.q_r_]
mov eax, dword [0x4143ec]
mov dword [esp + 0x4fc], ecx
mov dword [esp + 0x4f4], eax
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x41]
mov byte [esp + 0x40], 0
rep stosd dword es:[edi], eax
mov edx, dword [0x4143f0]
lea ecx, [esp + 0x2c]
stosw word es:[edi], ax
push ecx
mov dword [esp + 0x4fc], edx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov edx, dword [esp + 0x3a]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x36]
and edx, 0xffff
and eax, 0xffff
push edx
and ecx, 0xffff
push eax
push ecx
lea edx, [esp + 0x4c]
push str._d__d__d
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
mov edi, str.C:WINDOWS_tmp_read_dir__tmp_
or ecx, 0xffffffff
xor eax, eax
add esp, 0x14
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x2f4]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x2f4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x40]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x2f4]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x414ca4
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x2f4]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x414498
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x71c]
mov ecx, edx
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x2f8]
push ecx
push ebx
push 3
push edx
mov ecx, ebp
call fcn.00408920
lea edi, [esp + 0x2f4]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x608]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x218
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x4f8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push edx
and ecx, 3
push str.FILE_INFO_TIME
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x50c], ecx
call fcn.00406d10
add esp, 0xc
push 0x258
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
lea ecx, [esp + 0x2bc]
mov byte [esp + 0x714], 0x13
call fcn.0040da70
lea ecx, [esp + 0x268]
mov byte [esp + 0x714], 0x12
call sub.MFC42.DLL_CEdit::CEdit
lea ecx, [esp + 0x208]
mov byte [esp + 0x714], 0
call fcn.0040e0f8
lea ecx, [esp + 0x1c0]
mov dword [esp + 0x714], 0x14
call sub.MFC42.DLL_CProgressCtrl::CProgressCtrl
lea ecx, [esp + 0x160]
mov dword [esp + 0x714], 0xffffffff
call fcn.0040e0f8
mov eax, 1
jmp 0x40826f
push ebx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov ecx, ebp
push 0x30
push 0x41406c
push 0x414c74
call sub.MFC42.DLL_CWnd::MessageBoxA
push 0
call dword [sym.imp.MSVCRT.dll_exit]
nop
nop