Function at 0x4067d6
Capabilities:
Check if file exists
Create process on windows
Create thread
Delete directory
Delete file
Get file attributes
Read file on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x640
mov eax, dword [ebp + 8]
or dword [ebp - 0x1c], 0xffffffff
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
xor esi, esi
mov dword [0x41fe64], esi
push edi
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x20], esi
mov edi, 0x41e030
cmp word [eax], si
jne 0x406a1b
push 0x104
push eax
push dword [0x41e420]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x416d80
push dword [ebp + 8]
push 0x41fe64
call fcn.0040b3ea
add esp, 0xc
test eax, eax
jne 0x406a66
push 2
push esi
push esi
push dword [0x41fe64]
call fcn.0040b10d
push dword [0x41fe64]
call fcn.0040aac4
push dword [0x41e420]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
call fcn.00402442
add esp, 0x18
mov dword [ebp - 4], eax
cmp dword [ebp - 0xc], esi
jl 0x406ae2
jg 0x406886
cmp dword [ebp - 0x10], eax
jbe 0x406ae2
push 0x3e4
call fcn.0040b18c
mov esi, eax
push 0
xor eax, eax
push eax
push dword [ebp - 4]
push dword [0x41fe64]
call fcn.0040b10d
push dword [0x41fe64]
push 0x3e4
push 1
push esi
call fcn.0040a221
add esp, 0x24
cmp eax, 0x3e4
jne 0x4069f4
cmp byte [esi], 0x44
jne 0x4069f4
cmp byte [esi + 1], 0x45
jne 0x4069f4
cmp byte [esi + 2], 0x43
jne 0x4069f4
cmp byte [esi + 3], 0x5a
jne 0x4069f4
cmp byte [esi + 4], 0x49
jne 0x4069f4
cmp byte [esi + 5], 0x50
jne 0x4069f4
cmp byte [esi + 7], 0x55
jne 0x4069f4
cmp word [esi + 0x210], 0
jne 0x406920
and dword [esi + 0x318], 0
mov byte [esi + 6], 0x33
cmp byte [esi + 6], 0x36
jne 0x406983
push 0xffffffffffffffff
call fcn.00406414
pop ecx
test eax, eax
jne 0x40697c
push esi
call fcn.00409dd8
push dword [0x41fe64]
call fcn.0040b2b8
pop ecx
pop ecx
push 0x80
lea eax, [ebp - 0x140]
push eax
push 0x16
push dword [0x41e420]
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x10
push str.ZIP_SFX
lea eax, [ebp - 0x140]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
jmp 0x406f46
mov byte [0x41e02e], 0x36
push dword [ebp + 8]
push esi
push edi
call fcn.004026df
add esp, 0xc
mov dword [ebp - 0x20], eax
lea eax, [esi + 0x210]
push eax
push 0x41e238
call ebx
mov eax, dword [esi + 0x310]
mov dword [0x41e338], eax
mov eax, dword [esi + 0x314]
mov dword [0x41e33c], eax
mov eax, dword [esi + 0x318]
mov dword [0x41e340], eax
mov eax, dword [esi + 0x31c]
mov dword [0x41e344], eax
mov eax, dword [esi + 0x320]
mov dword [0x41e348], eax
lea eax, [esi + 0x324]
push eax
push 0x41e34c
call ebx
lea eax, [esi + 0x364]
push eax
push 0x41e38c
call ebx
push esi
call fcn.00409dd8
xor eax, eax
push eax
push eax
push eax
push dword [0x41fe64]
call fcn.0040b10d
xor esi, esi
add esp, 0x14
cmp dword [0x41fe64], esi
jne 0x406aaa
push 0x416d80
push dword [ebp + 8]
push 0x41fe64
call fcn.0040b3ea
add esp, 0xc
test eax, eax
jne 0x406a6e
push 2
push esi
push dword [0x41fe64]
call fcn.0040a2c8
push dword [0x41fe64]
call fcn.0040b72a
push esi
cdq
push esi
push dword [0x41fe64]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
call fcn.0040a2c8
add esp, 0x1c
jmp 0x406a74
mov dword [0x41fe64], esi
jmp 0x406a7c
mov dword [0x41fe64], esi
cmp dword [0x41fe64], esi
jne 0x406aaa
push 0x80
lea eax, [ebp - 0x140]
push eax
push 0xc
push dword [0x41e420]
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x10
push str.ZIP_SFX
lea eax, [ebp - 0x140]
push eax
push esi
jmp 0x40696f
call fcn.00405491
or eax, edx
jne 0x406af3
push 0x80
lea eax, [ebp - 0x140]
push eax
push 0xd
push dword [0x41e420]
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x10
push str.ZIP_SFX
lea eax, [ebp - 0x140]
push eax
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [0x41fe64]
call fcn.0040b2b8
pop ecx
jmp 0x406975
cmp word [0x41e38c], si
je 0x406b14
push 0x24
push 0x41e34c
push 0x41e38c
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x406ae2
mov eax, dword [0x41e348]
add dword [ebp - 4], 0x3e4
cmp eax, esi
je 0x406b61
push dword [ebp + 8]
push dword [ebp - 4]
push dword [ebp - 0x10]
push eax
push dword [0x41e420]
push dword [0x41fe64]
call fcn.00402963
add esp, 0x18
test eax, eax
jne 0x406b4f
cmp word [0x41e238], si
jne 0x406ae2
push esi
push dword [ebp - 4]
push dword [0x41fe64]
call fcn.0040a2c8
add esp, 0xc
lea eax, [ebp - 0x440]
push eax
lea eax, [ebp - 0x240]
push eax
push dword [ebp + 8]
call fcn.00402397
add esp, 0xc
cmp word [0x41e030], si
jne 0x406b8d
lea eax, [ebp - 0x240]
push eax
push edi
call ebx
lea eax, [ebp - 0x440]
push 0x2e
push eax
call fcn.00409daa
pop ecx
pop ecx
cmp eax, esi
je 0x406ba6
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x440]
push eax
call fcn.00402355
pop ecx
cmp dword [0x41e344], esi
jne 0x406bd1
lea eax, [ebp - 0x440]
push eax
call fcn.00401ec5
pop ecx
cmp eax, 1
jne 0x406ae2
push edi
call fcn.00402378
push edi
call fcn.00402335
pop ecx
pop ecx
cmp word [0x41e030], si
jne 0x406bf7
lea eax, [ebp - 0x240]
push eax
push edi
call ebx
jmp 0x406d0f
push 0x5c
push edi
call fcn.00409daa
pop ecx
pop ecx
test eax, eax
jne 0x406c27
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp word [eax*2 + 0x41e02e], 0x3a
je 0x406c27
push edi
lea eax, [ebp - 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
jmp 0x406be8
mov ax, word [0x41e030]
cmp ax, 0x5c
jne 0x406c43
cmp word [0x41e032], ax
je 0x406c5a
push 0x41e032
jmp 0x406c18
cmp ax, 0x2e
jne 0x406c5a
cmp word [0x41e032], 0x5c
jne 0x406c5a
push 0x41e034
jmp 0x406c18
push 0x416d78
push edi
call fcn.00409d4a
pop ecx
pop ecx
cmp eax, edi
jne 0x406d0f
push 0x416d78
mov dword [ebp - 8], esi
push edi
jmp 0x406c8f
add dword [ebp - 4], 4
push dword [ebp - 4]
inc dword [ebp - 8]
push edi
call ebx
push 0x416d78
push dword [ebp - 4]
call fcn.00409d4a
pop ecx
mov dword [ebp - 4], eax
pop ecx
cmp eax, esi
jne 0x406c7a
lea eax, [ebp - 0x240]
push eax
call fcn.00402335
lea eax, [ebp - 0x240]
push eax
call fcn.00409e12
pop ecx
pop ecx
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], esi
cmp dword [ebp - 8], esi
jle 0x406ce2
push 0x5c
push dword [ebp - 4]
call fcn.00409daa
pop ecx
pop ecx
cmp eax, esi
je 0x406d3a
xor ecx, ecx
inc dword [ebp - 0x14]
mov word [eax], cx
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 8]
jl 0x406cc2
push dword [ebp - 4]
lea eax, [ebp - 0x240]
push eax
call ebx
push edi
lea eax, [ebp - 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x240]
push eax
push edi
call ebx
push dword [ebp - 4]
call fcn.00409dd8
pop ecx
push 0x416d68
push edi
call fcn.0040a41e
push edi
mov esi, eax
call fcn.00409e67
add esp, 0xc
cmp esi, eax
je 0x406d51
lea eax, [ebp - 0x240]
push eax
push edi
call ebx
xor esi, esi
jmp 0x406bb3
lea eax, [ebp - 0x240]
push eax
push edi
call ebx
push dword [ebp - 4]
call fcn.00409dd8
jmp 0x406bb2
push edi
call fcn.00402355
push edi
call fcn.00402308
pop ecx
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor esi, esi
cmp eax, 0xffffffff
jne 0x406e12
mov ebx, dword [sym.imp.USER32.dll_LoadStringW]
cmp dword [0x41e338], esi
jne 0x406dcb
push 0x80
lea eax, [ebp - 0x140]
push eax
push 0xe
push dword [0x41e420]
call ebx
push edi
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x640]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x21
push str.ZIP_SFX
lea eax, [ebp - 0x640]
push eax
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 1
jne 0x406f2a
push edi
call fcn.004021b7
pop ecx
test eax, eax
jne 0x406e12
push 0x80
lea eax, [ebp - 0x640]
push eax
push 0x11
push dword [0x41e420]
call ebx
push 0x10
push str.ZIP_SFX
lea eax, [ebp - 0x640]
push eax
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [0x41fe64]
call fcn.0040b2b8
pop ecx
jmp 0x406f2a
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call fcn.00401f39
lea eax, [ebp - 0x24]
push eax
push esi
push dword [ebp + 8]
push 0x405d68
push esi
push esi
call fcn.0040b4f6
mov ebx, dword [sym.imp.USER32.dll_GetMessageW]
add esp, 0x20
mov dword [ebp + 8], eax
jmp 0x406e67
lea eax, [ebp - 0x40]
push eax
push dword [0x41e438]
call dword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x406e67
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push esi
push esi
push esi
lea eax, [ebp - 0x40]
push eax
call ebx
test eax, eax
jne 0x406e3f
push 0xffffffffffffffff
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x41e43c], esi
je 0x406ea5
mov dword [ebp - 0x18], esi
jmp 0x406f2a
cmp word [0x41e238], si
je 0x406f04
push dword [0x41e340]
push edi
push 0x41e238
call fcn.004064b8
add esp, 0xc
cmp dword [0x41e960], esi
je 0x406f2a
call fcn.004020ba
jmp 0x406ee9
push 0x80
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.004020cc
mov ebx, eax
cmp ebx, esi
jne 0x406ed1
cmp dword [ebp - 0x20], esi
je 0x406f2a
push edi
call fcn.004039ce
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x406f2a
cmp dword [0x41e33c], esi
je 0x406f2a
cmp dword [ebp - 0x1c], esi
jne 0x406f2a
push 0x40
call dword [sym.imp.USER32.dll_MessageBeep]
push 0xa
push esi
push esi
push edi
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push dword [0x41fe64]
call fcn.0040b2b8
pop ecx
cmp dword [0x41e960], esi
je 0x406f43
call fcn.0040201f
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
leave
ret