Function at 0x4060b8
Capabilities:
Accept command line arguments
Check if file exists
Check os version
Get file attributes
Log keystrokes via polling
Set current directory

Disassembly:
push ebp
lea ebp, [esp - 0x68]
sub esp, 0x228
push ebx
push esi
push edi
push 0x405b23
call dword [sym.imp.msvcrt.dll_int____cdecl___unsigned_int____cdecl__set_new_handler_int____cdecl___unsigned_int__]
pop ecx
call fcn.004038c8
lea eax, [ebp - 0x1c0]
push eax
mov dword [ebp - 0x1c0], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x406f92
cmp dword [ebp - 0x1b0], 2
jne 0x406f92
cmp dword [ebp - 0x1bc], 5
jb 0x406f92
lea ecx, [ebp + 0x24]
mov byte [str.___InstallEnd__], 0x3b
mov byte [str.___Install__UTF_8_], 0x3b
call fcn.004147cf
lea ecx, [ebp - 0x48]
call fcn.004147cf
lea ecx, [ebp - 8]
call fcn.004147cf
call fcn.004054ae
mov esi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
call esi
lea edx, [ebp + 0x24]
mov ecx, eax
call fcn.004030b6
push eax
lea ecx, [ebp - 8]
call fcn.00414854
lea ecx, [ebp - 8]
call fcn.00404612
mov edi, dword [ebp - 8]
xor ebx, ebx
inc ebx
push ebx
mov edx, 0x41ddb8
mov ecx, str.SfxVarModulePlatform
call fcn.00404ffd
push ebx
call fcn.00403f89
mov edx, eax
mov ecx, str.SfxVarSystemPlatform
call fcn.00404ffd
push ebx
call esi
mov edx, eax
mov ecx, str.SfxVarCmdLine0
call fcn.00404ffd
movzx eax, word [0x422690]
push eax
push 0x41ee0c
push 0x20
lea ecx, [ebp + 0x24]
call fcn.0040429f
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [ebp + 0x24]
call fcn.00404284
mov edx, dword [ebp + 0x24]
push ebx
mov ecx, str.SfxVarSystemLanguage
call fcn.00404ffd
mov edx, str.sfxlang
mov ecx, edi
call fcn.0040574e
test eax, eax
je 0x406207
cmp word [eax], 0x3a
jne 0x406207
add eax, 2
push eax
call dword [sym.imp.msvcrt.dll__wtol]
pop ecx
lea ecx, [eax - 1]
cmp ecx, 0xfffe
ja 0x4061fe
mov word [0x422690], ax
add edi, 2
cmp word [edi], 0x20
ja 0x4061fe
mov edx, str.sfxversion
mov ecx, edi
call fcn.0040574e
test eax, eax
je 0x406240
call fcn.00405d35
xor esi, esi
push dword [ebp - 8]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp - 0x48]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp + 0x24]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 0xc
mov eax, esi
jmp 0x406fa9
mov edx, str.sfxwaitall
mov ecx, edi
call fcn.0040574e
test eax, eax
je 0x40625b
mov ecx, eax
call fcn.00402036
mov esi, eax
jmp 0x40621e
mov edx, str.sfxelevation
mov ecx, edi
mov byte [ebp + 0x67], 0
call fcn.0040574e
test eax, eax
je 0x406275
mov byte [ebp + 0x67], 1
mov edi, eax
mov eax, 0x208
push eax
mov ebx, 0x4227a4
push eax
mov ecx, ebx
call fcn.0040429f
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x4062a7
xor esi, esi
inc esi
push 6
push esi
call fcn.00409623
pop ecx
pop ecx
jmp 0x40621e
mov ecx, ebx
call fcn.00404284
mov edx, str.sfxtest
mov ecx, edi
call fcn.0040574e
mov esi, eax
test esi, esi
je 0x40644f
cmp word [esi], 0x3a
je 0x4062d2
push 0x64
pop esi
jmp 0x40621e
movzx ecx, word [esi + 2]
push 0x20
mov eax, ecx
pop edi
or eax, edi
sub eax, 0x61
je 0x4063e4
dec eax
dec eax
je 0x4063d0
dec eax
je 0x40634d
sub eax, 0xb
je 0x406305
sub eax, 7
jne 0x4062ca
mov esi, 0x4f3d
jmp 0x40621e
cmp word [esi + 4], 0x3a
jne 0x40621c
movzx eax, word [esi + 6]
sub eax, 0x31
je 0x406345
dec eax
je 0x40633b
dec eax
je 0x406337
dec eax
je 0x40632d
dec eax
jne 0x40621c
push 7
jmp 0x4062cc
mov esi, 0x3fff
jmp 0x40621e
push 0x1f
jmp 0x4062cc
mov esi, 0x5ff
jmp 0x40621e
xor esi, esi
inc esi
jmp 0x40621e
cmp ecx, 0x44
jne 0x40638f
cmp word [esi + 4], 0x3a
jne 0x4062ca
add esi, 6
jmp 0x406379
cmp ax, 0x3a
je 0x406381
movzx eax, ax
push eax
mov ecx, 0x42283c
call fcn.0040160f
add esi, 2
movzx eax, word [esi]
cmp ax, di
ja 0x406362
cmp dword [0x422840], 0
jne 0x406392
jmp 0x4062ca
add esi, 4
and dword [0x422834], 0
cmp word [esi], 0x3a
jne 0x4063ba
lea eax, [esi + 2]
push eax
call dword [sym.imp.msvcrt.dll__wtol]
pop ecx
mov dword [0x422834], eax
cmp eax, 0xe10
ja 0x4063ba
test eax, eax
jne 0x4063c4
mov dword [0x422834], 0xa
mov dword [0x422838], 1
jmp 0x4063f3
xor eax, eax
cmp word [esi + 4], 0x63
sete al
add eax, 3
mov dword [0x422838], eax
jmp 0x4063f3
mov dword [0x422838], 2
jmp 0x4063f3
add esi, 2
cmp word [esi], di
ja 0x4063f0
mov edx, str.sfxconfig
mov ecx, esi
mov edi, esi
call fcn.0040574e
test eax, eax
je 0x40644f
cmp word [eax], 0x3a
jne 0x40641b
jmp 0x406418
cmp cx, 0x20
ja 0x406423
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x406412
mov edx, dword [ebp + 0x24]
and dword [ebp + 0x28], 0
xor ecx, ecx
mov word [edx], cx
lea edx, [ebp + 0x24]
mov ecx, eax
call fcn.004030b6
cmp dword [0x422838], 2
mov edi, eax
je 0x40644f
lea eax, [ebp + 0x24]
push eax
mov ecx, ebx
call fcn.004148b7
mov esi, 0x4227a4
push esi
mov ecx, 0x4226f4
call fcn.004148b7
mov ebx, 0x42270c
push esi
mov ecx, ebx
call fcn.004148b7
mov ecx, esi
call fcn.004038a7
test eax, eax
js 0x40650c
mov ecx, dword [0x4226f4]
mov dword [0x4226f8], eax
lea esi, [eax + eax]
xor eax, eax
mov word [ecx + esi], ax
mov eax, dword [0x4227a4]
lea eax, [eax + esi + 2]
push eax
mov ecx, ebx
call fcn.00414854
mov eax, dword [0x4227a4]
lea eax, [eax + esi + 2]
mov esi, 0x4227f0
push eax
mov ecx, esi
call fcn.00414854
push 0x2e
mov ecx, esi
call fcn.00414a69
test eax, eax
jle 0x4064d4
mov edx, dword [0x4227f0]
xor ecx, ecx
mov dword [0x4227f4], eax
mov word [edx + eax*2], cx
push esi
mov esi, 0x4227bc
mov ecx, esi
call fcn.004148b7
push 4
pop ecx
call fcn.00403d74
push eax
mov ecx, esi
call fcn.00414912
mov eax, dword [0x4227f0]
mov ecx, dword [0x4227bc]
mov dword [0x422698], eax
mov dword [0x4226c0], ecx
mov dword [0x4226c4], eax
call fcn.00403f89
push eax
mov ecx, 0x4227b0
call fcn.00414854
push dword [0x4227a4]
mov esi, 0x422718
mov ecx, esi
call fcn.00401330
test al, al
jne 0x40654b
push dword [0x4227a4]
push 7
push 1
call fcn.00409623
add esp, 0xc
push 2
jmp 0x4062cc
lea ecx, [ebp + 0x58]
call fcn.004143b2
mov ecx, 0x422700
call fcn.00405f7f
mov ecx, dword [0x42271c]
lea eax, [ebp + 0x58]
push eax
xor dl, dl
call fcn.004053ad
mov ebx, eax
test ebx, ebx
je 0x406584
push dword [ebp + 0x58]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
mov esi, ebx
jmp 0x40621e
cmp dword [0x422838], 0
jne 0x4065fa
mov edx, str.sfxconfig
mov ecx, edi
call fcn.0040574e
test eax, eax
je 0x4065fa
cmp word [eax], 0x3a
jne 0x4065a6
add eax, 2
movzx ecx, word [eax]
test cx, cx
je 0x4068c8
cmp cx, 0x20
ja 0x4065c3
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x4065b2
cmp word [eax], 0
je 0x4068c8
lea edx, [ebp + 0x58]
mov ecx, eax
call fcn.00405fa3
test al, al
jne 0x4068c8
push 0xa
push 0
call fcn.00409623
push dword [ebp + 0x58]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 0xc
push 4
jmp 0x4062cc
cmp dword [0x422838], 4
je 0x4068c8
mov eax, dword [0x4220c8]
mov ebx, 0x4220c8
jmp 0x406644
push eax
lea eax, [ebp - 0xac]
push str.SfxString_d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebx]
add esp, 0xc
push 0
call fcn.00403d74
mov edx, eax
lea ecx, [ebp - 0xac]
call fcn.00404ffd
add ebx, 0x10
mov eax, dword [ebx]
test eax, eax
jne 0x406613
push edi
mov ecx, esi
call fcn.0040548f
call fcn.00401788
xor edi, edi
mov dword [ebp + 0x10], eax
cmp eax, edi
jne 0x40666e
push dword [ebp + 0x58]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
push 0x20
jmp 0x4062cc
call fcn.004057bd
mov ecx, esi
call fcn.00401364
mov ecx, 0x422700
call fcn.00405f7f
mov ecx, dword [0x42271c]
push edi
xor dl, dl
call fcn.004053ad
call fcn.004057bd
mov ecx, esi
call fcn.004013c9
call fcn.00401788
call fcn.004057bd
cmp byte [ebp + 0x67], 0
jne 0x4067e3
test byte [0x4226d4], 4
je 0x4067e3
call fcn.00403f9e
test eax, eax
jne 0x4067e3
lea ecx, [ebp + 0x18]
call fcn.004147cf
lea ecx, [ebp - 0x30]
call fcn.004147cf
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea edx, [ebp + 0x18]
mov ecx, eax
call fcn.004030b6
push eax
lea ecx, [ebp + 0x30]
call fcn.004147f3
push str.sfxelevation
push 0x41db94
lea eax, [ebp + 0x18]
push eax
mov edx, 0x41da98
lea ecx, [ebp - 0x24]
call fcn.004147a1
mov edx, eax
lea ecx, [ebp - 0x3c]
call fcn.00414777
mov edx, eax
lea ecx, [ebp - 0x54]
call fcn.00414777
push 0x20
push eax
lea ecx, [ebp + 4]
call fcn.004146d1
lea eax, [ebp + 0x30]
push eax
lea edx, [ebp + 4]
lea ecx, [ebp + 0x3c]
call fcn.0041475b
push dword [eax]
lea ecx, [ebp - 0x30]
call fcn.00414854
push dword [ebp + 0x3c]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp + 4]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp - 0x54]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp - 0x3c]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp - 0x24]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 0x14
push 0xffffffffffffffff
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
mov ecx, dword [ebp - 0x30]
push edi
push 2
pop edx
call fcn.00401ce3
push dword [ebp + 0x30]
test eax, eax
jne 0x4067be
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp - 0x30]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp + 0x18]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp + 0x58]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 0x10
push 0xb
jmp 0x4062cc
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp - 0x30]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp + 0x18]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp + 0x58]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 0x10
jmp 0x40621c
mov esi, str.SetEnvironment
lea edx, [ebp + 0x48]
mov ecx, esi
mov dword [ebp + 0x48], edi
call fcn.00404fed
xor ebx, ebx
jmp 0x406842
push edi
lea ecx, [ebp + 0x3c]
call fcn.004147f3
mov ecx, dword [ebp + 0x3c]
push 0x3d
pop edx
call fcn.004141fc
cmp eax, ebx
jle 0x40684a
mov edx, dword [ebp + 0x3c]
mov dword [ebp + 0x40], eax
add eax, eax
xor ecx, ecx
mov word [edx + eax], cx
mov ecx, dword [ebp + 0x3c]
push ebx
lea edx, [eax + edi + 2]
call fcn.00404ffd
push dword [ebp + 0x3c]
inc dword [ebp + 0x48]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
lea edx, [ebp + 0x48]
mov ecx, esi
call fcn.00404fed
mov edi, eax
cmp edi, ebx
jne 0x4067f9
jmp 0x406853
push dword [ebp + 0x3c]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
call fcn.00405e26
cmp dword [0x4223cc], 0xffffffff
jne 0x406867
mov dword [0x4223cc], ebx
cmp byte [0x42272b], bl
je 0x4068d6
xor edx, edx
mov ecx, str.HelpText
call fcn.00404fed
mov esi, eax
cmp esi, ebx
jne 0x40688b
push 0x18
pop ecx
call fcn.00403d74
mov esi, eax
lea ecx, [ebp - 0xa8]
call fcn.0040756e
push 0
push esi
push dword [0x422698]
lea ecx, [ebp - 0xa8]
push 0x11
mov dword [ebp - 0xa8], 0x41eb7c
mov dword [ebp - 0x70], 0x7d6
call fcn.004078e0
lea ecx, [ebp - 0xa8]
call fcn.004075cf
push dword [ebp + 0x58]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
jmp 0x40621c
cmp byte [0x422729], bl
je 0x4068e8
and dword [0x4223cc], 0xfffffeff
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
xor edx, edx
mov ecx, str.InstallPath
call fcn.00404fed
mov esi, 0x4227fc
cmp eax, ebx
je 0x406913
push eax
mov ecx, esi
call fcn.00414854
mov byte [0x4226a0], 1
mov ecx, esi
call fcn.004055ab
xor edx, edx
mov ecx, str.BeginPromptTimeout
call fcn.00404fed
cmp eax, ebx
je 0x406937
push eax
call dword [sym.imp.msvcrt.dll__wtol]
pop ecx
mov dword [0x4226e0], eax
cmp dword [0x422840], ebx
je 0x406953
call fcn.00409f00
push dword [ebp + 0x58]
mov esi, eax
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
jmp 0x4062a1
cmp dword [0x422838], 3
jne 0x406963
call fcn.00409e22
jmp 0x406944
mov esi, 0x41dae4
push 0
mov edx, esi
mov ecx, str.SfxVarApiPath
call fcn.00404ffd
call fcn.00405e26
mov edi, str.ExecuteOnLoad
xor edx, edx
mov ecx, edi
call fcn.00404fed
mov ebx, 0x4227c8
test eax, eax
je 0x4069e5
cmp byte [0x42272a], 0
jne 0x4069e5
mov ecx, ebx
call fcn.0040730f
mov edx, dword [0x4227cc]
push 0
mov ecx, str.SfxVarApiPath
call fcn.00404ffd
call fcn.00405e26
push esi
lea ecx, [ebp + 0x30]
call fcn.004147f3
mov ecx, ebx
call fcn.0040730f
mov edx, dword [0x4227cc]
push esi
lea eax, [ebp + 0x30]
push eax
push esi
mov ecx, edi
call fcn.00402381
push dword [ebp + 0x30]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
mov ecx, 0x422750
call fcn.004082ab
xor edx, edx
mov ecx, str.BeginPrompt
call fcn.00404fed
test eax, eax
je 0x406a4b
cmp byte [0x422729], 0
jne 0x406a4b
mov ecx, dword [0x422698]
mov edx, eax
call fcn.00408ac3
test eax, eax
je 0x406b57
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x406a38
mov word [0x422728], 0x101
cmp dword [0x422820], 0
je 0x406a4b
and dword [0x4223cc], 0xffffff7f
lea ecx, [ebp + 0x4c]
call fcn.004147cf
cmp byte [0x422728], 0
je 0x406abe
mov edi, dword [0x422724]
push str.AutoInstall
lea ecx, [ebp + 0x4c]
call fcn.00414854
movzx eax, word [edi]
push eax
lea ecx, [ebp + 0x4c]
call fcn.0040160f
mov ecx, dword [ebp + 0x4c]
xor edx, edx
call fcn.00404fed
test eax, eax
je 0x406b67
add edi, 2
movzx eax, word [edi]
cmp eax, 0x30
jb 0x406a9d
cmp eax, 0x39
jbe 0x406a62
cmp eax, 0x61
jb 0x406aa7
cmp eax, 0x7a
jbe 0x406a62
cmp eax, 0x41
jb 0x406ab1
cmp eax, 0x5a
jbe 0x406a62
push str.AutoInstall
lea ecx, [ebp + 0x4c]
call fcn.00414854
cmp dword [ebp + 0x50], 0
mov byte [ebp + 0x14], 0
jne 0x406b08
mov edi, str.ExecuteFile
xor edx, edx
mov ecx, edi
call fcn.00404fed
test eax, eax
je 0x406ae7
push edi
lea ecx, [ebp + 0x4c]
call fcn.00414854
mov byte [ebp + 0x14], 1
cmp dword [ebp + 0x50], 0
jne 0x406b08
mov edi, str.RunProgram
xor edx, edx
mov ecx, edi
call fcn.00404fed
test eax, eax
je 0x406b08
push edi
lea ecx, [ebp + 0x4c]
call fcn.00414854
cmp byte [0x422728], 0
jne 0x406b9d
cmp byte [0x422729], 0
jne 0x406b9d
mov eax, dword [0x4223cc]
and eax, 0xc0
cmp al, 0x80
jne 0x406b9d
mov edx, dword [0x4226a8]
mov ecx, dword [0x4226b4]
call fcn.00408b5e
test eax, eax
jne 0x406b9d
push dword [ebp + 0x4c]
cmp byte [0x4226e4], al
je 0x406b8d
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
jmp 0x4069ef
push dword [ebp + 0x58]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
push 5
jmp 0x4062cc
push dword [ebp + 0x4c]
push 0xe
push 0
call fcn.00409623
push dword [ebp + 0x4c]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp + 0x58]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 0x14
push 6
jmp 0x4062cc
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp + 0x58]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
jmp 0x406b5f
cmp dword [0x422800], 0
jne 0x406bcf
mov edx, str.7ZipSfx._03x
lea ecx, [ebp - 0x24]
call fcn.00404349
push eax
mov ecx, 0x4227fc
call fcn.004148b7
push dword [ebp - 0x24]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
mov byte [0x4226a0], 0
jmp 0x406c05
mov edi, 0x4227fc
push edi
lea ecx, [ebp + 0x18]
call fcn.00414829
lea ecx, [ebp + 0x18]
call fcn.004055ab
cmp dword [ebp + 0x1c], 0
je 0x406bf6
lea eax, [ebp + 0x18]
push eax
mov ecx, edi
call fcn.004148b7
push dword [ebp + 0x18]
mov byte [0x4226a0], 1
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
mov eax, dword [0x4227fc]
pop ecx
mov ecx, dword [0x422800]
movzx edx, word [eax + ecx*2 - 2]
cmp edx, 0x5c
je 0x406c20
cmp edx, 0x2f
jne 0x406c2d
dec ecx
xor edx, edx
mov dword [0x422800], ecx
mov word [eax + ecx*2], dx
cmp byte [0x422729], 0
je 0x406c3d
or dword [0x4226d4], 3
mov edi, str.PreExtract
push edi
lea ecx, [ebp - 0x18]
call fcn.004147f3
mov eax, dword [0x422724]
movzx eax, word [eax]
push eax
lea ecx, [ebp - 0x18]
call fcn.0040160f
mov ecx, dword [ebp - 0x18]
xor edx, edx
call fcn.00404fed
test eax, eax
je 0x406cc7
cmp byte [0x42272a], 0
jne 0x406cc7
mov ecx, ebx
call fcn.0040730f
mov edx, dword [0x4227cc]
push 0
mov ecx, str.SfxVarApiPath
call fcn.00404ffd
call fcn.00405e26
push esi
lea ecx, [ebp + 0x30]
call fcn.004147f3
mov eax, dword [0x422724]
mov ecx, ebx
mov dword [ebp - 0xc], eax
call fcn.0040730f
mov edx, dword [0x4227cc]
push esi
lea eax, [ebp + 0x30]
push eax
push dword [ebp - 0xc]
mov ecx, edi
call fcn.00402381
push dword [ebp + 0x30]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
cmp dword [0x422834], 0
jne 0x406cdc
mov ecx, 0x4227fc
call fcn.00402d45
jmp 0x406cea
call fcn.00408bb1
test eax, eax
jne 0x406d15
mov eax, 0x80004005
test eax, eax
je 0x406d15
call fcn.00405b0e
push dword [ebp - 0x18]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp + 0x4c]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp + 0x58]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 0xc
push 8
jmp 0x4062cc
call fcn.00405e26
cmp byte [0x42272a], 0
je 0x406d30
cmp byte [0x4226a0], 0
jne 0x406e9a
lea ecx, [ebp + 0x3c]
call fcn.004147cf
lea ecx, [ebp + 4]
call fcn.004147cf
cmp byte [0x422728], 0
jne 0x406d51
lea ecx, [ebp + 0x3c]
call fcn.00401c0c
xor ebx, ebx
cmp dword [ebp + 0x50], ebx
jne 0x406e1f
cmp byte [0x4226a0], bl
jne 0x406e3a
mov esi, str.setup.exe
push esi
push 0x41dca0
mov edx, 0x4227fc
lea ecx, [ebp - 0x3c]
call fcn.00414777
mov edx, eax
lea ecx, [ebp - 0x24]
call fcn.00414777
push dword [eax]
lea ecx, [ebp + 4]
call fcn.00414854
push dword [ebp - 0x24]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp - 0x3c]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
pop ecx
push dword [ebp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x406df1
call fcn.00405b0e
push 0xf
push ebx
call fcn.00409623
push dword [ebp + 4]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp + 0x3c]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp - 0x18]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp + 0x4c]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp + 0x58]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 0x1c
jmp 0x406329
mov edi, dword [0x4227fc]
push esi
lea ecx, [ebp + 0x30]
call fcn.004147f3
push dword [ebp + 0x10]
lea eax, [ebp + 0x3c]
push eax
push dword [ebp + 0x14]
mov edx, edi
lea ecx, [ebp + 0x30]
call fcn.00402092
push dword [ebp + 0x30]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
jmp 0x406e3a
push dword [ebp + 0x10]
mov edx, dword [0x4227fc]
mov ecx, dword [ebp + 0x4c]
lea eax, [ebp + 0x3c]
push eax
push dword [0x422724]
call fcn.00402381
cmp dword [0x422838], ebx
jne 0x406e86
call fcn.00405e26
push 0xffffffffffffffff
push dword [0x422724]
mov edx, str.Shortcut
mov ecx, 0x405e7b
call fcn.00405a37
push dword [0x4226f4]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 0xffffffffffffffff
push dword [0x422724]
mov edx, str.Delete
mov ecx, 0x405a0d
call fcn.00405a37
call fcn.00405b0e
push dword [ebp + 4]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp + 0x3c]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
pop ecx
jmp 0x406e9c
xor ebx, ebx
cmp dword [0x4223d8], 0xffffffff
jne 0x406eb8
cmp byte [0x422729], 0
jne 0x406f20
mov dword [0x4223d8], 1
cmp dword [0x4223d8], ebx
jle 0x406f20
xor edx, edx
mov ecx, str.FinishMessage
call fcn.00404fed
mov esi, eax
cmp esi, ebx
je 0x406f20
mov eax, 0x3e7
cmp dword [0x4223d8], eax
jle 0x406ee4
mov dword [0x4223d8], eax
lea ecx, [ebp - 0xa4]
call fcn.0040756e
push ebx
push esi
push dword [0x422698]
lea ecx, [ebp - 0xa4]
push 0x11
mov dword [ebp - 0xa4], 0x41ec5c
mov dword [ebp - 0x6c], 0x7d5
call fcn.004078e0
lea ecx, [ebp - 0xa4]
call fcn.004075cf
cmp byte [0x42272a], 0
jne 0x406f5b
cmp dword [0x422838], ebx
jne 0x406f5b
xor edx, edx
mov ecx, str.SelfDelete
call fcn.00404fed
cmp eax, ebx
je 0x406f5b
cmp word [eax], 0x31
jne 0x406f5b
sub esp, 0xc
mov ecx, esp
push 0x4227a4
call fcn.00414829
call fcn.00405b3a
push dword [ebp - 0x18]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp + 0x4c]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp + 0x58]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp - 8]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp - 0x48]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp + 0x24]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 0x18
xor eax, eax
jmp 0x406fa9
push 0x10
push str.7_Zip_SFX
push 0x41ecec
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x14
pop eax
pop edi
pop esi
pop ebx
add ebp, 0x68
leave
ret 0x10