Function at 0x4029b0
Capabilities:
Create process on windows
Get common file path
Hide graphical window
Read .ini file
Read file on windows
Self delete
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov edx, 0x418598
mov ecx, 0x3c
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
mov dword [0x4185d4], 0
mov dword [0x4185d8], 0
mov dword [0x4185dc], 0
mov dword [0x4185e0], 0
mov dword [0x4185e4], 0
mov dword [0x4185e8], 0
mov edx, 0x4185ec
mov ecx, 0x410
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
mov edx, 0x4189fc
mov ecx, 0x410
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
mov edx, 0x418e0c
mov ecx, 0x800
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
mov edx, 0x41960c
mov ecx, 0x800
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
mov edx, 0x419e0c
mov ecx, 0x800
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
mov dword [0x41a60c], 0
mov dword [0x41a610], 0
mov dword [0x41a614], 0
mov edx, 0x41a618
mov ecx, 0x10
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
mov dword [0x41a628], 0
mov dword [0x41a62c], 0
mov dword [0x41a630], 0
mov dword [0x41a634], 0
mov dword [0x41a638], 0
mov dword [0x41a63c], 0
mov edx, 0x41a640
mov ecx, 0x104
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
mov edx, 0x41a744
mov ecx, 0x100
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
mov dword [0x412008], 0
push 0x41e008
call fcn.00401120
pop ecx
push 0x104
push 0x4189fc
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
test eax, eax
jne 0x402b33
push 1
call fcn.00404b70
pop ecx
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push 0x4189fc
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov dword [0x4185e0], eax
cmp eax, 0xffffffff
jne 0x402b61
push 2
call fcn.00404b70
pop ecx
push 0
push 0
mov eax, dword [0x412008]
push eax
mov eax, dword [0x4185e0]
push eax
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
cmp eax, 0xffffffff
jne 0x402c14
push 3
call fcn.00404b70
pop ecx
jmp 0x402c14
push 0
push 0x41a60c
push 4
push 0x41a618
mov eax, dword [0x4185e0]
push eax
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x402bb5
push 4
call fcn.00404b70
pop ecx
cmp byte [0x41a618], 0x5b
jne 0x402bd9
cmp byte [0x41a619], 0x46
jne 0x402bd9
cmp byte [0x41a61a], 0x50
jne 0x402bd9
cmp byte [0x41a61b], 0x5d
je 0x402c19
push 1
push 0
push 0xfffffffffffffffd
mov eax, dword [0x4185e0]
push eax
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
cmp eax, 0xffffffff
jne 0x402bfa
push 5
call fcn.00404b70
pop ecx
inc dword [0x412008]
cmp dword [0x412008], 0xea60
jle 0x402c14
push 6
call fcn.00404b70
pop ecx
jmp 0x402b8f
mov eax, dword [0x412008]
mov dword [0x41a62c], eax
jmp 0x402cad
push 0
push 0x41a60c
push 4
push 0x41a618
mov eax, dword [0x4185e0]
push eax
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x402c4e
push 7
call fcn.00404b70
pop ecx
cmp byte [0x41a618], 0x50
jne 0x402c72
cmp byte [0x41a619], 0x4b
jne 0x402c72
cmp byte [0x41a61a], 3
jne 0x402c72
cmp byte [0x41a61b], 4
je 0x402cb2
push 1
push 0
push 0xfffffffffffffffd
mov eax, dword [0x4185e0]
push eax
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
cmp eax, 0xffffffff
jne 0x402c93
push 8
call fcn.00404b70
pop ecx
inc dword [0x41a62c]
cmp dword [0x41a62c], 0xc3500
jle 0x402cad
push 9
call fcn.00404b70
pop ecx
jmp 0x402c28
mov eax, dword [0x41a62c]
mov edx, dword [0x412008]
mov ecx, eax
sub ecx, edx
add ecx, 4
mov dword [0x41a630], ecx
mov dword [0x41a628], eax
push 0
push 0
push edx
mov eax, dword [0x4185e0]
push eax
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
cmp eax, 0xffffffff
jne 0x402cef
push 0xa
call fcn.00404b70
pop ecx
push 4
push 0x1000
mov eax, dword [0x41a630]
add eax, 2
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov dword [0x4185e8], eax
test eax, eax
jne 0x402d18
push 0xb
call fcn.00404b70
pop ecx
push 0
push 0x41a60c
mov eax, dword [0x41a630]
push eax
mov eax, dword [0x4185e8]
push eax
mov eax, dword [0x4185e0]
push eax
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x402d43
push 0xc
call fcn.00404b70
pop ecx
call fcn.00401770
push 0x41db90
push 0
push 0x41074a
push eax
call dword [sym.imp.KERNEL32.DLL_GetTempFileNameA]
test eax, eax
jne 0x402d67
push 0xd
call fcn.00404b70
pop ecx
push 0
push 0
push 2
push 0
push 3
push 0x40000000
push 0x41db90
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov dword [0x4185e4], eax
cmp eax, 0xffffffff
jne 0x402d95
push 0xe
call fcn.00404b70
pop ecx
push 0
push 0x41a610
mov eax, dword [0x41a630]
push eax
mov eax, dword [0x4185e8]
push eax
mov eax, dword [0x4185e4]
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
jne 0x402dc0
push 0xf
call fcn.00404b70
pop ecx
push 0x8000
push 0
mov eax, dword [0x4185e8]
push eax
call dword [sym.imp.KERNEL32.DLL_VirtualFree]
mov eax, dword [0x4185e0]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [0x4185e4]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 0x41db90
push 0x104
push 0x4185ec
push 0x41073a
push str.ExtractionPath
push 0x41074a
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
push 0x41db90
push 0
push str.ZipSize
push 0x41074a
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntA]
mov dword [0x41a614], eax
push 0x41db90
push 0
push str.UnZipSize
push 0x41074a
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntA]
mov dword [0x41e004], eax
push 0x41db90
push 0
push str.ProgressBar
push 0x41074a
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntA]
mov dword [0x41dffc], eax
push 0x41db90
push 0
push str.DeleteFiles
push 0x41074a
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntA]
mov dword [0x41dff8], eax
push 0x41db90
push 0
push str.Password
push 0x41074a
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntA]
mov dword [0x41dff4], eax
push 0x41db90
push 0
push str.Overwrite
push 0x41074a
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntA]
mov dword [0x41e000], eax
push 0x4185ec
call fcn.00403910
pop ecx
push eax
push 0x41a640
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
push 1
push 0x41a640
call fcn.00401300
add esp, 8
mov dword [ebp - 4], eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x5c
call fcn.00401790
add esp, 0x28
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.00401260
add esp, 8
test eax, eax
je 0x402f35
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x5c
call fcn.00401790
add esp, 0x28
push eax
push 0x41a640
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
push 0
push 0x41a640
push 0x104
push 0x41a640
call dword [sym.imp.KERNEL32.DLL_GetFullPathNameA]
test eax, eax
jne 0x402f58
push 0x10
call fcn.00404b70
pop ecx
push 0x41a640
mov eax, dword [0x41a614]
push eax
mov eax, dword [0x41a628]
push eax
push 0x4189fc
call fcn.0040577f
add esp, 0x10
mov dword [0x4185dc], eax
push 0x4185d4
mov eax, dword [0x4185dc]
push eax
call fcn.004057d3
add esp, 8
test eax, eax
je 0x402f9a
push 0x11
call fcn.00404b70
pop ecx
cmp dword [0x41dffc], 0
je 0x402fe8
push 0
push 0
push 0x20080
mov eax, 0x90c00a04
push eax
push 0x26
push 0xc7
push 0
push 0
mov eax, dword [0x41dfec]
push eax
push 0x41073a
push 0x404590
call fcn.00401e10
add esp, 0x2c
mov dword [0x41dfec], eax
push 0
mov eax, dword [0x41dfec]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [0x41dff4], 0
je 0x403023
push 0
push 0
push 0x20000
mov eax, 0x90c80a04
push eax
push 0x30
push 0xac
push 0
push 0
mov eax, dword [0x41dfec]
push eax
push str.Password_needed.
push 0x4046a0
call fcn.00401ce0
add esp, 0x2c
mov dword [0x41a63c], 0
jmp 0x40307a
push 0x41a640
mov eax, dword [0x4185dc]
push eax
call fcn.004032f0
add esp, 8
test eax, eax
je 0x40304e
push 0x12
call fcn.00404b70
pop ecx
mov eax, dword [0x41a63c]
inc eax
cmp eax, dword [0x4185d4]
jae 0x403087
mov eax, dword [0x4185dc]
push eax
call fcn.00405c54
pop ecx
test eax, eax
je 0x403074
push 0x13
call fcn.00404b70
pop ecx
inc dword [0x41a63c]
mov eax, dword [0x41a63c]
cmp eax, dword [0x4185d4]
jbe 0x40302f
mov eax, dword [0x4185dc]
push eax
call fcn.00406744
pop ecx
mov eax, dword [0x4185dc]
push eax
call fcn.00405791
pop ecx
push 0
mov eax, dword [0x41dfec]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [0x41a63c], 0
fild dword [0x41a63c]
sub esp, 8
fstp qword [esp]
call fcn.00401740
add esp, 8
push eax
call fcn.004013c0
pop ecx
push eax
push str.ExecFile
push 2
call fcn.004017f0
add esp, 0xc
push 0x41db90
push 0x800
push 0x418e0c
push 0x41073a
push eax
push 0x41074a
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
test eax, eax
je 0x403291
fild dword [0x41a63c]
sub esp, 8
fstp qword [esp]
call fcn.00401740
add esp, 8
push eax
call fcn.004013c0
pop ecx
push eax
push str.CmdLine
push 2
call fcn.004017f0
add esp, 0xc
push 0x41db90
push 0x800
push 0x41960c
push 0x41073a
push eax
push 0x41074a
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
fild dword [0x41a63c]
sub esp, 8
fstp qword [esp]
call fcn.00401740
add esp, 8
push eax
call fcn.004013c0
pop ecx
push eax
push str.WinState
push 2
call fcn.004017f0
add esp, 0xc
push 0x41db90
push 0x800
push 0x419e0c
push 0x41073a
push eax
push 0x41074a
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
push 0x418e0c
push 0x41a640
push 2
call fcn.004017f0
add esp, 0xc
mov ecx, 0x418e0c
mov edx, eax
push ecx
sub ecx, edx
mov al, byte [edx]
mov byte [ecx + edx], al
inc edx
test al, al
jne 0x4031be
pop eax
push 0x418e0c
call fcn.00401a20
pop ecx
test eax, eax
je 0x403278
mov dword [0x418598], 0x3c
mov dword [0x41859c], 0x440
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov dword [0x4185a0], eax
mov dword [0x4185a4], 0x4106cd
mov dword [0x4185a8], 0x418e0c
push 0x41960c
call fcn.00403910
pop ecx
mov dword [0x4185ac], eax
push 0x418e0c
call fcn.00404500
pop ecx
mov dword [0x4185b0], eax
push 0x419e0c
call fcn.00404170
pop ecx
mov dword [0x4185b4], eax
push 0x418598
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x40325e
push 0x14
call fcn.00404b70
pop ecx
inc dword [0x41a638]
jmp 0x40327e
mov eax, dword [0x41a63c]
sub eax, dword [0x41a638]
mov edx, dword [0x4185d0]
mov dword [eax*4 + 0x41a744], edx
jmp 0x40327e
inc dword [0x41a638]
inc dword [0x41a63c]
cmp dword [0x41a63c], 0x3f
jle 0x4030b7
mov eax, dword [0x41a63c]
cmp dword [0x41a638], eax
je 0x4032e4
cmp dword [0x41dff8], 0
je 0x4032e4
or dword [0x41a634], 0xffffffff
jmp 0x4032db
push 0xffffffffffffffff
push 1
push 0x41a744
mov eax, dword [0x41a63c]
sub eax, dword [0x41a638]
push eax
call dword [sym.imp.KERNEL32.DLL_WaitForMultipleObjects]
mov dword [0x41a634], eax
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
cmp dword [0x41a634], 0
jne 0x4032b0
push 1
call fcn.00404350
pop ecx
mov esp, ebp
pop ebp
ret