Function at 0x402ed0
Capabilities:
Create process on windows
Get common file path
Hide graphical window
Read .ini file
Read file on windows
Self delete
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov edx, 0x41a8b0
mov ecx, 0x3c
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
mov dword [0x41a8ec], 0
mov dword [0x41a8f0], 0
mov dword [0x41a8f4], 0
mov dword [0x41a8f8], 0
mov dword [0x41a8fc], 0
mov dword [0x41a900], 0
mov edx, 0x41a904
mov ecx, 0x410
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
mov edx, 0x41ad14
mov ecx, 0x410
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
mov edx, 0x41b124
mov ecx, 0x800
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
mov edx, 0x41b924
mov ecx, 0x800
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
mov dword [0x41c124], 0
mov dword [0x41c128], 0
mov dword [0x41c12c], 0
mov dword [0x41c130], 0
mov edx, 0x41c134
mov ecx, 0x10
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
mov dword [0x41c144], 0
mov dword [0x41c148], 0
mov dword [0x41c14c], 0
mov dword [0x41c150], 0
mov dword [0x41c154], 0
mov dword [0x41c158], 0
mov edx, 0x41c15c
mov ecx, 0x104
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
mov edx, 0x41c260
mov ecx, 0x100
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
mov dword [0x413008], 0
push 0x421b24
call fcn.00401120
pop ecx
push 0x104
push 0x41ad14
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
test eax, eax
jne 0x403049
push 1
call fcn.00405090
pop ecx
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push 0x41ad14
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov dword [0x41a8f8], eax
cmp eax, 0xffffffff
jne 0x403077
push 2
call fcn.00405090
pop ecx
push 0
push 0
mov eax, dword [0x413008]
push eax
mov eax, dword [0x41a8f8]
push eax
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
cmp eax, 0xffffffff
jne 0x40312a
push 3
call fcn.00405090
pop ecx
jmp 0x40312a
push 0
push 0x41c124
push 4
push 0x41c134
mov eax, dword [0x41a8f8]
push eax
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x4030cb
push 4
call fcn.00405090
pop ecx
cmp byte [0x41c134], 0x5b
jne 0x4030ef
cmp byte [0x41c135], 0x46
jne 0x4030ef
cmp byte [0x41c136], 0x50
jne 0x4030ef
cmp byte [0x41c137], 0x5d
je 0x40312f
push 1
push 0
push 0xfffffffffffffffd
mov eax, dword [0x41a8f8]
push eax
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
cmp eax, 0xffffffff
jne 0x403110
push 5
call fcn.00405090
pop ecx
inc dword [0x413008]
cmp dword [0x413008], 0xea60
jle 0x40312a
push 6
call fcn.00405090
pop ecx
jmp 0x4030a5
mov eax, dword [0x413008]
mov dword [0x41c148], eax
jmp 0x4031c3
push 0
push 0x41c124
push 4
push 0x41c134
mov eax, dword [0x41a8f8]
push eax
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x403164
push 7
call fcn.00405090
pop ecx
cmp byte [0x41c134], 0x50
jne 0x403188
cmp byte [0x41c135], 0x4b
jne 0x403188
cmp byte [0x41c136], 3
jne 0x403188
cmp byte [0x41c137], 4
je 0x4031c8
push 1
push 0
push 0xfffffffffffffffd
mov eax, dword [0x41a8f8]
push eax
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
cmp eax, 0xffffffff
jne 0x4031a9
push 8
call fcn.00405090
pop ecx
inc dword [0x41c148]
cmp dword [0x41c148], 0xc3500
jle 0x4031c3
push 9
call fcn.00405090
pop ecx
jmp 0x40313e
mov eax, dword [0x41c148]
mov edx, dword [0x413008]
mov ecx, eax
sub ecx, edx
add ecx, 4
mov dword [0x41c14c], ecx
mov dword [0x41c144], eax
push 0
push 0
push edx
mov eax, dword [0x41a8f8]
push eax
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
cmp eax, 0xffffffff
jne 0x403205
push 0xa
call fcn.00405090
pop ecx
push 4
push 0x1000
mov eax, dword [0x41c14c]
add eax, 2
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov dword [0x41a900], eax
test eax, eax
jne 0x40322e
push 0xb
call fcn.00405090
pop ecx
push 0
push 0x41c124
mov eax, dword [0x41c14c]
push eax
mov eax, dword [0x41a900]
push eax
mov eax, dword [0x41a8f8]
push eax
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x403259
push 0xc
call fcn.00405090
pop ecx
call fcn.00401750
push 0x41fea8
push 0
push 0x411712
push eax
call dword [sym.imp.KERNEL32.DLL_GetTempFileNameA]
test eax, eax
jne 0x40327d
push 0xd
call fcn.00405090
pop ecx
push 0
push 0
push 2
push 0
push 3
push 0x40000000
push 0x41fea8
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov dword [0x41a8fc], eax
cmp eax, 0xffffffff
jne 0x4032ab
push 0xe
call fcn.00405090
pop ecx
push 0
push 0x41c128
mov eax, dword [0x41c14c]
push eax
mov eax, dword [0x41a900]
push eax
mov eax, dword [0x41a8fc]
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
jne 0x4032d6
push 0xf
call fcn.00405090
pop ecx
push 0x8000
push 0
mov eax, dword [0x41a900]
push eax
call dword [sym.imp.KERNEL32.DLL_VirtualFree]
mov eax, dword [0x41a8f8]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [0x41a8fc]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 0x41fea8
push 0x104
push 0x41a904
push 0x411898
push str.ExtractionPath
push 0x411712
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
push 0x41fea8
push 0
push str.ZipSize
push 0x411712
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntA]
mov dword [0x41c130], eax
push 0x41fea8
push 0
push str.UnZipSize
push 0x411712
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntA]
mov dword [0x421b20], eax
push 0x41fea8
push 0
push str.ProgressBar
push 0x411712
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntA]
mov dword [0x421b18], eax
push 0x41fea8
push 0
push str.DeleteFiles
push 0x411712
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntA]
mov dword [0x421b14], eax
push 0x41fea8
push 0
push str.Password
push 0x411712
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntA]
mov dword [0x421b10], eax
push 0x41fea8
push 0
push str.Overwrite
push 0x411712
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntA]
mov dword [0x421b1c], eax
push 0x41fea8
push 0
push str.ExecFileNumber
push 0x411712
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntA]
mov dword [0x41c12c], eax
push 0x41a904
call fcn.00403dd0
pop ecx
push eax
push 0x41c15c
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
push 1
push 0x41c15c
call fcn.00401300
add esp, 8
mov dword [ebp - 4], eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x5c
call fcn.00401770
add esp, 0x28
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.00401260
add esp, 8
test eax, eax
je 0x403467
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x5c
call fcn.00401770
add esp, 0x28
push eax
push 0x41c15c
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
push 0
push 0x41c15c
push 0x104
push 0x41c15c
call dword [sym.imp.KERNEL32.DLL_GetFullPathNameA]
test eax, eax
jne 0x40348a
push 0x10
call fcn.00405090
pop ecx
push 0x41c15c
mov eax, dword [0x41c130]
push eax
mov eax, dword [0x41c144]
push eax
push 0x41ad14
call fcn.00405c9f
add esp, 0x10
mov dword [0x41a8f4], eax
push 0x41a8ec
mov eax, dword [0x41a8f4]
push eax
call fcn.00405cf3
add esp, 8
test eax, eax
je 0x4034cc
push 0x11
call fcn.00405090
pop ecx
cmp dword [0x421b18], 0
je 0x40351a
push 0
push 0
push 0x20080
mov eax, 0x90c00a04
push eax
push 0x26
push 0xc7
push 0
push 0
mov eax, dword [0x420304]
push eax
push 0x411898
push 0x404ad0
call fcn.00401e50
add esp, 0x2c
mov dword [0x420304], eax
push 0
mov eax, dword [0x420304]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [0x421b10], 0
je 0x403555
push 0
push 0
push 0x20000
mov eax, 0x90c80a04
push eax
push 0x30
push 0xac
push 0
push 0
mov eax, dword [0x420304]
push eax
push str.Password_needed.
push 0x404be0
call fcn.00401d20
add esp, 0x2c
mov dword [0x41c158], 0
jmp 0x4035ac
push 0x41c15c
mov eax, dword [0x41a8f4]
push eax
call fcn.004037e0
add esp, 8
test eax, eax
je 0x403580
push 0x12
call fcn.00405090
pop ecx
mov eax, dword [0x41c158]
inc eax
cmp eax, dword [0x41a8ec]
jae 0x4035b9
mov eax, dword [0x41a8f4]
push eax
call fcn.00406174
pop ecx
test eax, eax
je 0x4035a6
push 0x13
call fcn.00405090
pop ecx
inc dword [0x41c158]
mov eax, dword [0x41c158]
cmp eax, dword [0x41a8ec]
jbe 0x403561
mov eax, dword [0x41a8f4]
push eax
call fcn.00406c64
pop ecx
mov eax, dword [0x41a8f4]
push eax
call fcn.00405cb1
pop ecx
push 0
mov eax, dword [0x420304]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [0x41c12c], 0
je 0x4037cc
mov dword [0x41a8b0], 0x3c
mov dword [0x41a8b4], 0x440
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov dword [0x41a8b8], eax
mov dword [0x41a8bc], 0x4116a1
mov dword [0x41a8cc], 1
mov dword [0x41c158], 1
jmp 0x403766
fild dword [0x41c158]
sub esp, 8
fstp qword [esp]
call fcn.00401720
add esp, 8
push eax
call fcn.004013c0
pop ecx
push eax
push str.ExecFile
push 2
call fcn.004017d0
add esp, 0xc
push 0x41fea8
push 0x800
push 0x41b124
push 0x411898
push eax
push 0x411712
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
fild dword [0x41c158]
sub esp, 8
fstp qword [esp]
call fcn.00401720
add esp, 8
push eax
call fcn.004013c0
pop ecx
push eax
push str.CmdLine
push 2
call fcn.004017d0
add esp, 0xc
push 0x41fea8
push 0x800
push 0x41b924
push 0x411898
push eax
push 0x411712
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
push 0x41b124
push 0x41c15c
push 2
call fcn.004017d0
add esp, 0xc
mov ecx, 0x41b124
mov edx, eax
push ecx
sub ecx, edx
mov al, byte [edx]
mov byte [ecx + edx], al
inc edx
test al, al
jne 0x4036e2
pop eax
mov dword [0x41a8c0], 0x41b124
mov dword [0x41a8c4], 0x41b924
push 0x41b124
call fcn.00404a40
pop ecx
mov dword [0x41a8c8], eax
push 0x41b124
call fcn.00401a80
pop ecx
test eax, eax
je 0x40375a
push 0x41a8b0
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x40373f
push 0x14
call fcn.00405090
pop ecx
inc dword [0x41c154]
jmp 0x403760
mov eax, dword [0x41c158]
dec eax
sub eax, dword [0x41c154]
mov edx, dword [0x41a8e8]
mov dword [eax*4 + 0x41c260], edx
jmp 0x403760
inc dword [0x41c154]
inc dword [0x41c158]
mov eax, dword [0x41c158]
cmp eax, dword [0x41c12c]
jbe 0x40362e
mov eax, dword [0x41c154]
cmp eax, dword [0x41c12c]
je 0x4037cc
cmp dword [0x421b14], 0
je 0x4037cc
or dword [0x41c150], 0xffffffff
jmp 0x4037c3
push 0xffffffffffffffff
push 1
push 0x41c260
mov eax, dword [0x41c12c]
mov edx, dword [0x41c154]
sub eax, edx
push eax
call dword [sym.imp.KERNEL32.DLL_WaitForMultipleObjects]
mov dword [0x41c150], eax
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
cmp dword [0x41c150], 0
jne 0x403796
push 1
call fcn.00404860
pop ecx
mov esp, ebp
pop ebp
ret