Function at 0x4058fe
Capabilities:
Accept command line arguments
Check if file exists
Check os version
Encode data using xor
Get file attributes
Log keystrokes via polling
Set current directory

Disassembly:
push ebp
lea ebp, [esp - 0x68]
sub esp, 0x2e0
push ebx
push esi
push edi
push 0x404fa5
call dword [sym.imp.MSVCRT.dll_int____cdecl___unsigned_int____cdecl__set_new_handler_int____cdecl___unsigned_int__]
pop ecx
call fcn.00402b16
lea eax, [ebp - 0x278]
push eax
mov dword [ebp - 0x278], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x406ddc
cmp dword [ebp - 0x268], 2
jne 0x406ddc
cmp dword [ebp - 0x274], 5
jb 0x406ddc
lea ecx, [ebp + 0x3c]
mov byte [str.___InstallEnd__], 0x3b
mov byte [str.___Install__UTF_8_], 0x3b
mov dword [ebp + 0x54], 0x41b9c4
mov byte [ebp + 0x67], 0
mov byte [ebp + 0x66], 0
mov byte [ebp + 0x65], 0
mov byte [ebp + 0x5b], 0
call fcn.004110c6
lea ecx, [ebp - 0x54]
call fcn.004110c6
call fcn.00404a2b
push 0x41a59c
lea ecx, [ebp - 0x3c]
call fcn.004114b3
mov esi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea eax, [ebp + 0x3c]
push eax
call esi
push eax
call fcn.00402704
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x3c]
call fcn.0041153a
lea eax, [ebp - 0x3c]
push eax
call fcn.00403e13
mov ebx, dword [ebp - 0x3c]
pop ecx
push ebx
mov dword [ebp + 0x5c], ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
xor edi, edi
inc edi
push edi
lea eax, [ebx + eax*2]
push 0x41a5e4
push str.SfxVarModulePlatform
mov dword [ebp - 0x30], eax
call fcn.00404663
add esp, 0xc
push edi
call fcn.004031c0
push eax
push str.SfxVarSystemPlatform
call fcn.00404663
add esp, 0xc
push edi
call esi
push eax
push str.SfxVarCmdLine0
call fcn.00404663
movzx eax, word [0x41e704]
add esp, 0xc
push eax
push 0x41bca0
push 0x20
lea ecx, [ebp + 0x3c]
call fcn.00403a1b
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov esi, dword [ebp + 0x3c]
push esi
call fcn.00402637
mov dword [ebp + 0x40], eax
and word [esi + eax*2], 0
push edi
push dword [ebp + 0x3c]
push str.SfxVarSystemLanguage
call fcn.00404663
push str.sfxlang
push ebx
call fcn.00404c8f
add esp, 0x24
test eax, eax
je 0x405a9d
cmp word [eax], 0x3a
jne 0x405a9d
add eax, 2
push eax
call dword [sym.imp.MSVCRT.dll__wtol]
pop ecx
lea ecx, [eax - 1]
cmp ecx, 0xfffe
ja 0x405a83
mov word [0x41e704], ax
inc ebx
inc ebx
cmp word [ebx], 0x20
ja 0x405a83
jmp 0x405a95
cmp ax, 0x20
ja 0x405a9d
inc ebx
inc ebx
movzx eax, word [ebx]
test ax, ax
jne 0x405a8d
push str.sfxversion
push ebx
call fcn.00404c8f
test eax, eax
pop ecx
pop ecx
je 0x405ad7
call fcn.00405300
xor esi, esi
push dword [ebp - 0x3c]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push dword [ebp - 0x54]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push dword [ebp + 0x3c]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 0xc
mov eax, esi
jmp 0x406df3
push 0x41a584
push ebx
call fcn.00404c8f
test eax, eax
pop ecx
pop ecx
je 0x405af3
push eax
call fcn.0040158e
pop ecx
mov esi, eax
jmp 0x405ab5
push str.sfxelevation
push ebx
mov byte [ebp + 0x5a], 0
call fcn.00404c8f
test eax, eax
pop ecx
pop ecx
je 0x405b20
mov byte [ebp + 0x5a], 1
jmp 0x405b16
cmp cx, 0x20
ja 0x405b1e
inc eax
inc eax
movzx ecx, word [eax]
test cx, cx
jne 0x405b0e
mov ebx, eax
mov eax, 0x208
push eax
push eax
mov ecx, 0x41e7d8
call fcn.00403a1b
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x405b4f
push 6
push edi
call fcn.00408fd8
pop ecx
pop ecx
mov esi, edi
jmp 0x405ab5
mov esi, dword [0x41e7d8]
push esi
call fcn.00402637
mov dword [0x41e7dc], eax
and word [esi + eax*2], 0
mov dword [esp], str.sfxtest
push ebx
call fcn.00404c8f
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x405d16
cmp word [esi], 0x3a
je 0x405b8c
push 0x64
pop esi
jmp 0x405ab5
movzx ecx, word [esi + 2]
movzx eax, cx
or eax, 0x20
sub eax, 0x61
push 2
pop ebx
je 0x405c99
sub eax, ebx
je 0x405c85
dec eax
je 0x405c05
sub eax, 0xb
je 0x405bc1
sub eax, 7
jne 0x405b84
mov esi, 0x4f21
jmp 0x405ab5
cmp word [esi + 4], 0x3a
jne 0x405ab3
movzx eax, word [esi + 6]
sub eax, 0x31
je 0x405b48
dec eax
je 0x405bfb
dec eax
je 0x405bf7
dec eax
je 0x405bed
dec eax
jne 0x405ab3
push 7
jmp 0x405b86
mov esi, 0xfff
jmp 0x405ab5
push 0x1f
jmp 0x405b86
mov esi, 0x5b7
jmp 0x405ab5
cmp cx, 0x44
jne 0x405c48
cmp word [esi + 4], 0x3a
jne 0x405b84
add esi, 6
jmp 0x405c31
cmp ax, 0x3a
je 0x405c3a
movzx eax, ax
push eax
mov ecx, 0x41e830
call fcn.0040119e
add esi, ebx
movzx eax, word [esi]
cmp ax, 0x20
ja 0x405c1b
cmp dword [0x41e834], 0
jne 0x405c4b
jmp 0x405b84
add esi, 4
and dword [0x41e828], 0
cmp word [esi], 0x3a
jne 0x405c73
lea eax, [esi + 2]
push eax
call dword [sym.imp.MSVCRT.dll__wtol]
cmp eax, 0xe10
pop ecx
mov dword [0x41e828], eax
ja 0x405c73
test eax, eax
jne 0x405c7d
mov dword [0x41e828], 0xa
mov dword [0x41e82c], edi
jmp 0x405ca3
xor eax, eax
cmp word [esi + 4], 0x63
sete al
add eax, 3
mov dword [0x41e82c], eax
jmp 0x405ca3
mov dword [0x41e82c], ebx
jmp 0x405ca3
add esi, ebx
cmp word [esi], 0x20
ja 0x405ca1
jmp 0x405cb3
cmp ax, 0x20
ja 0x405cbb
add esi, ebx
movzx eax, word [esi]
test ax, ax
jne 0x405cab
push str.sfxconfig
push esi
mov ebx, esi
call fcn.00404c8f
test eax, eax
pop ecx
pop ecx
je 0x405d16
cmp word [eax], 0x3a
jne 0x405cde
jmp 0x405cdc
cmp cx, 0x20
ja 0x405ce6
inc eax
inc eax
movzx ecx, word [eax]
test cx, cx
jne 0x405cd6
mov ecx, dword [ebp + 0x3c]
and dword [ebp + 0x40], 0
and word [ecx], 0
lea ecx, [ebp + 0x3c]
push ecx
push eax
call fcn.00402704
cmp dword [0x41e82c], 2
pop ecx
pop ecx
mov ebx, eax
je 0x405d16
lea eax, [ebp + 0x3c]
push eax
mov ecx, 0x41e7d8
call fcn.00411111
mov esi, 0x41e7d8
push esi
mov ecx, 0x41e780
call fcn.00411111
mov edi, 0x41e78c
push esi
mov ecx, edi
call fcn.00411111
push esi
call fcn.00402af3
test eax, eax
pop ecx
jl 0x405dd0
mov dword [0x41e784], eax
lea esi, [eax + eax]
mov eax, dword [0x41e780]
and word [esi + eax], 0
mov eax, dword [0x41e7d8]
lea eax, [esi + eax + 2]
push eax
mov ecx, edi
call fcn.004114e2
mov eax, dword [0x41e7d8]
lea eax, [esi + eax + 2]
mov esi, 0x41e7a4
push eax
mov ecx, esi
call fcn.004114e2
push 0x2e
mov ecx, esi
call fcn.004111c8
test eax, eax
jle 0x405d98
mov ecx, dword [0x41e7a4]
mov dword [0x41e7a8], eax
and word [ecx + eax*2], 0
push esi
mov esi, 0x41e798
mov ecx, esi
call fcn.00411111
push 4
call fcn.00402fad
pop ecx
push eax
mov ecx, esi
call fcn.0041153a
mov eax, dword [0x41e7a4]
mov ecx, dword [0x41e798]
mov dword [0x41e738], eax
mov dword [0x41e740], ecx
mov dword [0x41e744], eax
xor esi, esi
call fcn.004031c0
push eax
mov ecx, 0x41e7b0
call fcn.004114e2
push 0x28
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, esi
pop ecx
je 0x405e05
mov dword [eax + 4], esi
mov dword [eax + 0x1c], esi
mov dword [eax + 0x20], esi
mov dword [eax + 0x24], esi
mov dword [eax], 0x41bab4
mov dword [ebp + 0x10], eax
jmp 0x405e08
mov dword [ebp + 0x10], esi
push dword [ebp + 0x10]
lea ecx, [ebp + 0x60]
call fcn.00412f07
push dword [0x41e7d8]
mov ecx, dword [ebp + 0x10]
call fcn.00409654
test al, al
jne 0x405e4b
push dword [0x41e7d8]
push 7
push 1
call fcn.00408fd8
mov eax, dword [ebp + 0x60]
add esp, 0xc
cmp eax, esi
je 0x405e44
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 2
jmp 0x405b86
lea ecx, [ebp + 0x48]
call fcn.00410edc
mov edi, dword [ebp + 0x60]
lea eax, [ebp + 0x48]
push eax
push edi
call fcn.004037f5
test al, al
pop ecx
pop ecx
jne 0x405e8a
push 9
push esi
call fcn.00408fd8
push dword [ebp + 0x48]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 0xc
cmp edi, esi
je 0x405e83
mov eax, dword [edi]
push edi
call dword [eax + 8]
push 3
jmp 0x405b86
cmp dword [0x41e82c], esi
jne 0x405f1c
push str.sfxconfig
push ebx
call fcn.00404c8f
cmp eax, esi
pop ecx
pop ecx
je 0x405f1c
cmp word [eax], 0x3a
jne 0x405eaf
inc eax
inc eax
movzx ecx, word [eax]
cmp cx, si
je 0x405f00
cmp cx, 0x20
ja 0x405ec7
inc eax
inc eax
movzx ecx, word [eax]
cmp cx, si
jne 0x405eb7
cmp word [eax], si
je 0x405f00
lea ecx, [ebp + 0x48]
push ecx
push eax
call fcn.004057d1
test al, al
pop ecx
pop ecx
jne 0x405f00
push 0xa
push esi
call fcn.00408fd8
push dword [ebp + 0x48]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 0xc
cmp edi, esi
je 0x405ef9
mov eax, dword [edi]
push edi
call dword [eax + 8]
push 4
jmp 0x405b86
push dword [ebp + 0x48]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
cmp edi, esi
pop ecx
je 0x405ab3
mov eax, dword [edi]
push edi
call dword [eax + 8]
jmp 0x405ab3
mov ecx, 0x41e7e4
call fcn.00405782
cmp dword [ebp + 0x4c], esi
je 0x405f46
lea eax, [ebp + 0x48]
push esi
push eax
call fcn.00404718
test al, al
pop ecx
pop ecx
jne 0x405f46
push dword [ebp + 0x48]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
jmp 0x405eef
cmp dword [0x41e82c], 4
je 0x405f00
mov eax, dword [0x41e0b8]
mov edi, 0x41e0b8
jmp 0x405f90
push eax
lea eax, [ebp - 0xb8]
push str.SfxString_d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0
push dword [edi]
call fcn.00402fad
pop ecx
push eax
lea eax, [ebp - 0xb8]
push eax
call fcn.00404663
add esp, 0xc
add edi, 0x10
mov eax, dword [edi]
test eax, eax
jne 0x405f5b
call fcn.00404d0a
push 1
push 0x41a64c
dec ebx
push str.SfxVarCmdLine2
dec ebx
call fcn.00404663
add esp, 0xc
push 0x30
pop esi
jmp 0x405fb6
inc ebx
inc ebx
cmp word [ebx], 0x20
ja 0x405fb4
jmp 0x405fc6
cmp ax, 0x20
ja 0x405fce
inc ebx
inc ebx
movzx eax, word [ebx]
test ax, ax
jne 0x405fbe
movzx eax, word [ebx]
cmp ax, 0x2f
je 0x405fe1
cmp ax, 0x2d
jne 0x406247
lea edi, [ebx + 2]
cmp word [edi], 0x21
je 0x40623e
push 0x41bbe4
push edi
call fcn.004026ca
test eax, eax
pop ecx
pop ecx
je 0x406048
lea ecx, [ebx + 6]
movzx eax, word [ecx]
cmp ax, si
jb 0x406010
cmp ax, 0x39
jbe 0x406028
cmp ax, 0x61
jb 0x40601c
cmp ax, 0x7a
jbe 0x406028
cmp ax, 0x41
jb 0x406035
cmp ax, 0x5a
ja 0x406035
mov dword [ebp + 0x54], ecx
mov byte [ebp + 0x67], 1
mov byte [ebp + 0x66], 1
jmp 0x405fb6
cmp ax, 0x20
ja 0x406247
mov dword [ebp + 0x54], 0x41b9c4
jmp 0x40602b
push 0x41bbdc
push edi
call fcn.004026ca
test eax, eax
pop ecx
pop ecx
je 0x406067
lea eax, [ebx + 6]
push eax
push str.OverwriteMode
jmp 0x406199
push 0x41bbd4
push edi
call fcn.004026ca
test eax, eax
pop ecx
pop ecx
je 0x4060a7
lea eax, [ebx + 6]
movzx ecx, word [eax]
cmp cx, si
jb 0x406247
cmp cx, 0x32
ja 0x406247
cmp word [ebx + 8], 0x20
ja 0x406247
push eax
push str.GUIMode
jmp 0x406199
push 0x41bbcc
push edi
call fcn.004026ca
test eax, eax
pop ecx
pop ecx
je 0x4060c6
lea eax, [ebx + 6]
push eax
push str.GUIFlags
jmp 0x406199
push 0x41bbc4
push edi
call fcn.004026ca
test eax, eax
pop ecx
pop ecx
je 0x4060e5
lea eax, [ebx + 6]
push eax
push str.MiscFlags
jmp 0x406199
push 0x41bbbc
push edi
call fcn.004026ca
test eax, eax
pop ecx
pop ecx
je 0x40611e
lea eax, [ebx + 6]
movzx ecx, word [eax]
cmp cx, si
je 0x40610b
cmp cx, 0x31
jne 0x406247
cmp word [ebx + 8], 0x20
ja 0x406247
push eax
push str.SelfDelete
jmp 0x406199
push 0x41bbb4
push edi
call fcn.004026ca
test eax, eax
pop ecx
pop ecx
je 0x406143
cmp word [ebx + 6], 0x20
ja 0x406247
mov byte [ebp + 0x65], 1
jmp 0x405fb6
push 0x41a5fc
push edi
call fcn.004026ca
test eax, eax
pop ecx
pop ecx
je 0x40617f
lea eax, [ebx + 6]
movzx ecx, word [eax]
cmp cx, si
jb 0x406247
cmp cx, 0x39
ja 0x406247
push eax
call dword [sym.imp.MSVCRT.dll__wtol]
pop ecx
mov dword [0x41e3b8], eax
jmp 0x405fb6
push 0x41bbac
push edi
call fcn.004026ca
test eax, eax
pop ecx
pop ecx
je 0x4061a5
lea eax, [ebx + 8]
push eax
push str.BeginPromptTimeout
call fcn.00405198
pop ecx
pop ecx
jmp 0x405fb6
movzx eax, word [edi]
cmp ax, 0x70
je 0x40620d
cmp ax, 0x50
je 0x40620d
cmp ax, 0x79
je 0x4061c0
cmp ax, 0x59
jne 0x4061d0
cmp word [ebx + 4], 0x20
ja 0x4061d0
mov byte [ebp + 0x67], 1
jmp 0x405fb6
cmp ax, 0x3f
je 0x4061e2
cmp ax, 0x68
je 0x4061e2
cmp ax, 0x48
jne 0x4061f2
cmp word [ebx + 4], 0x20
ja 0x4061f2
mov byte [ebp + 0x5b], 1
jmp 0x405fb6
push edi
call fcn.004050a0
test eax, eax
pop ecx
je 0x406247
cmp eax, 1
je 0x40629f
mov ebx, eax
jmp 0x405fb6
lea ecx, [ebp - 0x14]
call fcn.004110c6
lea eax, [ebp - 0x14]
push eax
add ebx, 4
push ebx
call fcn.00402704
push dword [ebp - 0x14]
dec eax
dec eax
mov ebx, eax
call fcn.004019fd
push dword [ebp - 0x14]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 0x10
jmp 0x405fb6
mov edi, ebx
add ebx, 4
test edi, edi
jne 0x406249
mov edi, ebx
cmp dword [ebp + 0x5c], edi
je 0x4062bc
push dword [ebp + 0x5c]
lea ecx, [ebp + 4]
call fcn.004114b3
sub edi, dword [ebp + 0x5c]
lea eax, [ebp + 4]
push eax
sar edi, 1
push edi
lea ecx, [ebp + 0x30]
call fcn.0041104f
push dword [ebp + 0x30]
lea ecx, [ebp + 0x3c]
call fcn.004114e2
push dword [ebp + 0x30]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push dword [ebp + 4]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
pop ecx
lea ecx, [ebp + 0x3c]
call fcn.004111f3
lea ecx, [ebp + 0x3c]
call fcn.004115bc
push 1
push dword [ebp + 0x3c]
jmp 0x4062c3
push dword [ebp + 0x48]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov eax, dword [ebp + 0x60]
test eax, eax
pop ecx
je 0x4062b5
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 0x20
jmp 0x405b86
push 1
push 0x41a64c
push str.SfxVarCmdLine1
call fcn.00404663
add esp, 0xc
push ebx
lea ecx, [ebp + 4]
call fcn.004114b3
lea eax, [ebp + 4]
push eax
mov eax, dword [ebp - 0x30]
sub eax, ebx
sar eax, 1
push eax
lea ecx, [ebp + 0x30]
call fcn.0041104f
push dword [ebp + 0x30]
lea ecx, [ebp + 0x3c]
call fcn.004114e2
push dword [ebp + 0x30]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push dword [ebp + 4]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
pop ecx
lea ecx, [ebp + 0x3c]
call fcn.004111f3
lea ecx, [ebp + 0x3c]
call fcn.004115bc
push 1
push dword [ebp + 0x3c]
push str.SfxVarCmdLine2
call fcn.00404663
add esp, 0xc
call fcn.00404d0a
cmp byte [ebp + 0x5a], 0
jne 0x40649e
test byte [0x41e754], 4
je 0x40649e
call fcn.00403262
test eax, eax
jne 0x40649e
lea ecx, [ebp - 8]
call fcn.004110c6
lea ecx, [ebp - 0x14]
call fcn.004110c6
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call fcn.00402704
pop ecx
pop ecx
push eax
lea ecx, [ebp + 0x30]
call fcn.004114b3
push str.sfxelevation
push 0x41a57c
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x20]
push 0x41a578
push eax
call fcn.0041148e
add esp, 0xc
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00411469
add esp, 0xc
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.00411469
add esp, 0xc
push 0x20
push eax
lea ecx, [ebp + 4]
call fcn.00411406
lea eax, [ebp + 0x30]
push eax
lea eax, [ebp + 4]
push eax
lea eax, [ebp + 0x18]
push eax
call fcn.00411449
add esp, 0xc
push dword [eax]
lea ecx, [ebp - 0x14]
call fcn.004114e2
push dword [ebp + 0x18]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push dword [ebp + 4]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push dword [ebp - 0x60]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push dword [ebp - 0x48]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push dword [ebp - 0x20]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 0x14
push 0xffffffffffffffff
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
push 0
push 2
push dword [ebp - 0x14]
call fcn.0040121c
add esp, 0xc
test eax, eax
push dword [ebp + 0x30]
jne 0x406468
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push dword [ebp - 0x14]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push dword [ebp - 8]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push dword [ebp + 0x48]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov eax, dword [ebp + 0x60]
add esp, 0x10
test eax, eax
je 0x406461
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 0xb
jmp 0x405b86
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push dword [ebp - 0x14]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push dword [ebp - 8]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push dword [ebp + 0x48]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov eax, dword [ebp + 0x60]
add esp, 0x10
test eax, eax
je 0x405ab3
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x405ab3
and dword [ebp + 0x14], 0
lea eax, [ebp + 0x14]
push eax
mov esi, str.SetEnvironment
push esi
call fcn.00403f23
pop ecx
pop ecx
jmp 0x406502
push edi
lea ecx, [ebp + 0x18]
call fcn.004114b3
push 0x3d
push dword [ebp + 0x18]
call fcn.00410d70
test eax, eax
pop ecx
pop ecx
jle 0x40650a
mov ecx, dword [ebp + 0x18]
mov dword [ebp + 0x1c], eax
add eax, eax
and word [eax + ecx], 0
push 0
lea eax, [eax + edi + 2]
push eax
push dword [ebp + 0x18]
call fcn.00404663
push dword [ebp + 0x18]
inc dword [ebp + 0x14]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
lea eax, [ebp + 0x14]
push eax
push esi
call fcn.00403f23
add esp, 0x18
mov edi, eax
test edi, edi
jne 0x4064b5
jmp 0x406513
push dword [ebp + 0x18]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
call fcn.004055d4
xor edi, edi
cmp dword [0x41e3ac], 0xffffffff
jne 0x406529
mov dword [0x41e3ac], edi
cmp byte [ebp + 0x5b], 0
je 0x40658a
push edi
push str.HelpText
call fcn.00403f23
mov esi, eax
cmp esi, edi
pop ecx
pop ecx
jne 0x40654c
push 0x18
call fcn.00402fad
pop ecx
mov esi, eax
lea ecx, [ebp - 0xb4]
call fcn.00404a12
push edi
push esi
push dword [0x41e738]
lea ecx, [ebp - 0xb4]
push 0x11
call fcn.00407dd0
lea ecx, [ebp - 0xb4]
call fcn.00407bde
push dword [ebp + 0x48]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov eax, dword [ebp + 0x60]
pop ecx
cmp eax, edi
jmp 0x40648d
cmp byte [ebp + 0x67], 0
je 0x40659a
and dword [0x41e3ac], 0xfffffeff
push edi
call dword [sym.imp.ole32.dll_CoInitialize]
push edi
push str.SfxAuthor
call fcn.00403f23
mov esi, eax
cmp esi, edi
pop ecx
pop ecx
je 0x406698
lea eax, [ebp - 0x164]
push eax
call fcn.0040a8c0
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
lea eax, [ebp - 0x164]
push esi
push eax
call fcn.0040ab20
lea eax, [ebp - 0xd8]
push eax
lea eax, [ebp - 0x164]
push eax
call fcn.0040abe0
add esp, 0x14
push 8
pop ecx
mov esi, str.123456789ABCDEFGHJKMNPQRSTUVWXYZ
lea edi, [ebp - 0xfc]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
xor ecx, ecx
mov edx, dword [ebp + ecx*4 - 0xc8]
lea eax, [ebp + ecx*4 - 0xd8]
xor dword [eax], edx
inc ecx
cmp ecx, 4
jl 0x406605
xor edi, edi
mov dword [ebp + 0x5c], edi
mov ecx, dword [ebp + 0x5c]
mov eax, ecx
cdq
and edx, 7
add eax, edx
sar eax, 3
and ecx, 0x80000007
movzx esi, byte [ebp + eax - 0xd8]
jns 0x406643
dec ecx
or ecx, 0xfffffff8
inc ecx
mov eax, dword [ebp + 0x5c]
shr esi, cl
and esi, 0x1f
test eax, eax
je 0x406664
push 0x19
cdq
pop ecx
idiv ecx
test edx, edx
jne 0x406664
mov word [ebp + edi*2 - 0xa0], 0x2d
inc edi
movsx ax, byte [ebp + esi - 0xfc]
add dword [ebp + 0x5c], 5
mov word [ebp + edi*2 - 0xa0], ax
inc edi
cmp dword [ebp + 0x5c], 0x7d
jl 0x406620
and word [ebp + edi*2 - 0xa0], 0
lea eax, [ebp - 0xa0]
push eax
call fcn.004019fd
pop ecx
xor edi, edi
push edi
push str.InstallPath
call fcn.00403f23
cmp eax, edi
pop ecx
pop ecx
mov esi, 0x41e774
je 0x4066bd
push eax
mov ecx, esi
call fcn.004114e2
mov byte [0x41e71c], 1
push esi
call fcn.00404b2a
push edi
push str.BeginPromptTimeout
call fcn.00403f23
add esp, 0xc
cmp eax, edi
je 0x4066e2
push eax
call dword [sym.imp.MSVCRT.dll__wtol]
pop ecx
mov dword [0x41e760], eax
cmp dword [0x41e834], edi
je 0x406710
call fcn.004097b9
push dword [ebp + 0x48]
mov esi, eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov eax, dword [ebp + 0x60]
cmp eax, edi
pop ecx
je 0x405ab5
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x405ab5
cmp dword [0x41e82c], 3
jne 0x406720
call fcn.004096d2
jmp 0x4066ef
test byte [0x41e754], 8
jne 0x40675b
mov esi, dword [ebp + 0x60]
push esi
call fcn.00401ff2
test eax, eax
pop ecx
jne 0x40675b
push 8
push edi
call fcn.00408fd8
push dword [ebp + 0x48]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 0xc
cmp esi, edi
je 0x406754
mov eax, dword [esi]
push esi
call dword [eax + 8]
push 5
jmp 0x405b86
push 0
mov esi, 0x41a64c
push esi
push str.SfxVarApiPath
call fcn.00404663
call fcn.004055d4
push 0
mov edi, str.ExecuteOnLoad
push edi
call fcn.00403f23
add esp, 0x14
test eax, eax
je 0x4067e9
cmp byte [ebp + 0x65], 0
jne 0x4067e9
cmp byte [0x41e71c], 0
je 0x4067e9
mov ecx, 0x41e7bc
call fcn.00406f48
push 0
push dword [0x41e7c0]
push str.SfxVarApiPath
call fcn.00404663
add esp, 0xc
call fcn.004055d4
push esi
lea ecx, [ebp + 0x30]
call fcn.004114b3
mov ecx, 0x41e7bc
call fcn.00406f48
push esi
lea eax, [ebp + 0x30]
push eax
push esi
push dword [0x41e7c0]
push edi
call fcn.0040192e
push dword [ebp + 0x30]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 0x18
xor edi, edi
push edi
push 0x41b91c
call fcn.00403f23
cmp eax, edi
pop ecx
pop ecx
je 0x40683f
cmp byte [ebp + 0x67], 0
jne 0x40683f
push eax
push dword [0x41e738]
call fcn.00408da4
test eax, eax
pop ecx
pop ecx
je 0x406955
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x40682d
mov byte [ebp + 0x67], 1
mov byte [ebp + 0x66], 1
cmp dword [0x41e814], edi
je 0x40683f
and dword [0x41e3ac], 0xffffff7f
lea ecx, [ebp + 0x24]
call fcn.004110c6
cmp byte [ebp + 0x66], 0
je 0x4068b5
mov edi, dword [ebp + 0x54]
push str.AutoInstall
lea ecx, [ebp + 0x24]
call fcn.004114e2
movzx eax, word [edi]
push eax
lea ecx, [ebp + 0x24]
call fcn.0040119e
push 0
push dword [ebp + 0x24]
call fcn.00403f23
test eax, eax
pop ecx
pop ecx
je 0x406974
inc edi
inc edi
movzx eax, word [edi]
cmp ax, 0x30
jb 0x40688e
cmp ax, 0x39
jbe 0x406850
cmp ax, 0x61
jb 0x40689a
cmp ax, 0x7a
jbe 0x406850
cmp ax, 0x41
jb 0x4068a6
cmp ax, 0x5a
jbe 0x406850
push str.AutoInstall
lea ecx, [ebp + 0x24]
call fcn.004114e2
xor edi, edi
cmp dword [ebp + 0x28], edi
mov byte [ebp + 0x5c], 0
jne 0x406903
push edi
push str.ExecuteFile
call fcn.00403f23
test eax, eax
pop ecx
pop ecx
je 0x4068e0
push str.ExecuteFile
lea ecx, [ebp + 0x24]
call fcn.004114e2
mov byte [ebp + 0x5c], 1
cmp dword [ebp + 0x28], edi
jne 0x406903
push edi
push str.RunProgram
call fcn.00403f23
test eax, eax
pop ecx
pop ecx
je 0x406903
push str.RunProgram
lea ecx, [ebp + 0x24]
call fcn.004114e2
cmp byte [ebp + 0x66], 0
jne 0x4069b7
cmp byte [ebp + 0x67], 0
jne 0x4069b7
mov eax, dword [0x41e3ac]
and ax, 0xc0
cmp al, 0x80
jne 0x4069b7
push dword [0x41e72c]
push dword [0x41e730]
call fcn.00408e22
test eax, eax
pop ecx
pop ecx
jne 0x4069b7
cmp byte [0x41e764], al
push dword [ebp + 0x24]
je 0x4069a7
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
jmp 0x4067e9
push dword [ebp + 0x48]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov eax, dword [ebp + 0x60]
cmp eax, edi
pop ecx
je 0x406754
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x406754
push dword [ebp + 0x24]
push 0xe
push 0
call fcn.00408fd8
push dword [ebp + 0x24]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push dword [ebp + 0x48]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov eax, dword [ebp + 0x60]
add esp, 0x14
test eax, eax
je 0x4069a0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 6
jmp 0x405b86
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push dword [ebp + 0x48]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
jmp 0x40695d
cmp dword [0x41e778], edi
jne 0x4069eb
lea eax, [ebp - 0x20]
push str.7ZipSfx._03x
push eax
call fcn.00403ac2
pop ecx
pop ecx
push eax
mov ecx, 0x41e774
call fcn.00411111
push dword [ebp - 0x20]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov byte [0x41e71c], 0
jmp 0x406a25
mov edi, 0x41e774
push edi
lea ecx, [ebp - 8]
call fcn.004110e9
lea eax, [ebp - 8]
push eax
call fcn.00404b2a
cmp dword [ebp - 4], 0
pop ecx
je 0x406a14
lea eax, [ebp - 8]
push eax
mov ecx, edi
call fcn.00411111
push dword [ebp - 8]
mov byte [0x41e71c], 1
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
xor edi, edi
mov eax, dword [0x41e774]
pop ecx
mov ecx, dword [0x41e778]
movzx edx, word [eax + ecx*2 - 2]
cmp dx, 0x5c
je 0x406a42
cmp dx, 0x2f
jne 0x406a4d
dec ecx
mov dword [0x41e778], ecx
mov word [eax + ecx*2], di
cmp byte [ebp + 0x67], 0
je 0x406a5a
or dword [0x41e754], 3
mov edi, str.PreExtract
push edi
lea ecx, [ebp - 0x2c]
call fcn.004114b3
mov eax, dword [ebp + 0x54]
movzx eax, word [eax]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040119e
push 0
push dword [ebp - 0x2c]
call fcn.00403f23
test eax, eax
pop ecx
pop ecx
je 0x406aec
cmp byte [ebp + 0x65], 0
jne 0x406aec
cmp byte [0x41e71c], 0
je 0x406aec
mov ecx, 0x41e7bc
call fcn.00406f48
push 0
push dword [0x41e7c0]
push str.SfxVarApiPath
call fcn.00404663
add esp, 0xc
call fcn.004055d4
push esi
lea ecx, [ebp + 0x30]
call fcn.004114b3
mov ecx, 0x41e7bc
call fcn.00406f48
push esi
lea eax, [ebp + 0x30]
push eax
push dword [ebp + 0x54]
push dword [0x41e7c0]
push edi
call fcn.0040192e
push dword [ebp + 0x30]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 0x18
cmp dword [0x41e828], 0
jne 0x406b06
push 0x41e774
push dword [ebp + 0x10]
call fcn.00402508
pop ecx
pop ecx
jmp 0x406b14
call fcn.00408e62
test eax, eax
jne 0x406b4c
mov eax, 0x80004005
test eax, eax
je 0x406b4c
call fcn.00404f8f
push dword [ebp - 0x2c]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push dword [ebp + 0x24]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push dword [ebp + 0x48]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov eax, dword [ebp + 0x60]
add esp, 0xc
test eax, eax
je 0x406b45
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 8
jmp 0x405b86
call fcn.004055d4
cmp byte [ebp + 0x65], 0
je 0x406b64
cmp byte [0x41e71c], 0
jne 0x406ce6
lea ecx, [ebp + 0x18]
call fcn.004110c6
lea ecx, [ebp + 4]
call fcn.004110c6
cmp byte [ebp + 0x66], 0
jne 0x406b84
lea eax, [ebp + 0x18]
push eax
call fcn.004011cb
pop ecx
xor edi, edi
cmp dword [ebp + 0x28], edi
jne 0x406c6d
cmp byte [0x41e71c], 0
jne 0x406c86
mov esi, str.setup.exe
push esi
push 0x41a888
lea eax, [ebp - 0x48]
push 0x41e774
push eax
call fcn.00411469
add esp, 0xc
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00411469
add esp, 0xc
push dword [eax]
lea ecx, [ebp + 4]
call fcn.004114e2
push dword [ebp - 0x20]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push dword [ebp - 0x48]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
pop ecx
push dword [ebp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x406c3d
call fcn.00404f8f
push 0xf
push edi
call fcn.00408fd8
push dword [ebp + 4]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push dword [ebp + 0x18]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push dword [ebp - 0x2c]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push dword [ebp + 0x24]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push dword [ebp + 0x48]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov eax, dword [ebp + 0x60]
add esp, 0x1c
cmp eax, edi
je 0x405be9
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x405be9
mov edi, dword [0x41e774]
push esi
lea ecx, [ebp + 0x30]
call fcn.004114b3
push ebx
lea eax, [ebp + 0x18]
push eax
push dword [ebp + 0x5c]
lea eax, [ebp + 0x30]
push edi
push eax
call fcn.004015eb
push dword [ebp + 0x30]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 0x18
xor edi, edi
jmp 0x406c86
push ebx
lea eax, [ebp + 0x18]
push eax
push dword [ebp + 0x54]
push dword [0x41e774]
push dword [ebp + 0x24]
call fcn.0040192e
add esp, 0x14
cmp dword [0x41e82c], edi
jne 0x406cd2
call fcn.004055d4
push 0xffffffffffffffff
push dword [ebp + 0x54]
push str.Shortcut
push 0x40562b
call fcn.00405221
add esp, 0x10
push dword [0x41e780]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 0xffffffffffffffff
push dword [ebp + 0x54]
push str.Delete
push 0x4051f2
call fcn.00405221
add esp, 0x10
call fcn.00404f8f
push dword [ebp + 4]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push dword [ebp + 0x18]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
pop ecx
jmp 0x406ce8
xor edi, edi
cmp dword [0x41e3b8], 0xffffffff
jne 0x406d01
cmp byte [ebp + 0x67], 0
jne 0x406d59
mov dword [0x41e3b8], 1
cmp dword [0x41e3b8], edi
jle 0x406d59
push edi
push str.FinishMessage
call fcn.00403f23
mov esi, eax
cmp esi, edi
pop ecx
pop ecx
je 0x406d59
mov eax, 0x3e7
cmp dword [0x41e3b8], eax
jle 0x406d2e
mov dword [0x41e3b8], eax
lea ecx, [ebp - 0xb0]
call fcn.00405017
push edi
push esi
push dword [0x41e738]
lea ecx, [ebp - 0xb0]
push 0x11
call fcn.00407dd0
lea ecx, [ebp - 0xb0]
call fcn.00407bde
cmp byte [ebp + 0x65], 0
jne 0x406d95
cmp dword [0x41e82c], edi
jne 0x406d95
push edi
push str.SelfDelete
call fcn.00403f23
cmp eax, edi
pop ecx
pop ecx
je 0x406d95
cmp word [eax], 0x31
jne 0x406d95
sub esp, 0xc
mov ecx, esp
push 0x41e7d8
call fcn.004110e9
call fcn.004053f1
add esp, 0xc
push dword [ebp - 0x2c]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push dword [ebp + 0x24]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push dword [ebp + 0x48]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov eax, dword [ebp + 0x60]
add esp, 0xc
cmp eax, edi
je 0x406dbd
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [ebp - 0x3c]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push dword [ebp - 0x54]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push dword [ebp + 0x3c]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 0xc
xor eax, eax
jmp 0x406df3
push 0x10
push 0x41b8dc
push str.Sorry__this_program_requires_Microsoft_Windows_2000_or_later.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x14
pop eax
pop edi
pop esi
pop ebx
add ebp, 0x68
leave
ret 0x10