Function at 0x404afc
Capabilities:
Accept command line arguments
Check for time delay via gettickcount
Check if file exists
Encode data using xor
Get file attributes
Log keystrokes via polling
Set current directory

Disassembly:
push ebp
lea ebp, [esp - 0x68]
sub esp, 0xd0
push ebx
push esi
push edi
push 0x4044ae
call dword [sym.imp.msvcrt.dll_int____cdecl___unsigned_int____cdecl__set_new_handler_int____cdecl___unsigned_int__]
pop ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
call esi
cmp eax, 0x1a2890
je 0x404b3f
call esi
cmp eax, 0x7a33
je 0x404b3f
call esi
cmp eax, 0xf4240
jne 0x404b60
mov eax, edi
neg eax
mov ecx, eax
xor ecx, edi
test cl, 1
jne 0x404b60
mov ecx, eax
mov eax, 0x221e
sub ecx, eax
add edi, eax
mov edx, ecx
xor edx, edi
test dl, 1
je 0x404b53
lea ecx, [ebp + 8]
call fcn.0040dc8c
lea ecx, [ebp - 4]
call fcn.0040dc8c
lea ecx, [ebp + 0x20]
call fcn.0040dc8c
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.FreeConsole
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
call fcn.00403f8a
lea eax, [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call fcn.00402b06
pop ecx
pop ecx
push eax
lea ecx, [ebp + 0x20]
call fcn.0040dfeb
lea eax, [ebp + 0x20]
push eax
call fcn.00403478
mov eax, dword [ebp + 0x20]
mov dword [esp], str.sfxversion
push eax
mov dword [ebp + 0x64], eax
call fcn.00404242
pop ecx
pop ecx
test eax, eax
je 0x404bff
call fcn.004045f6
xor esi, esi
push dword [ebp + 0x20]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp - 4]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp + 8]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 0xc
pop edi
mov eax, esi
pop esi
pop ebx
add ebp, 0x68
leave
ret
mov eax, 0x208
push eax
push eax
mov ecx, 0x41b4fc
call fcn.004030cb
push eax
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x404c2d
xor esi, esi
inc esi
push 6
push esi
call fcn.004070b5
pop ecx
pop ecx
jmp 0x404bda
mov esi, dword [0x41b4fc]
push esi
call fcn.00402278
xor ecx, ecx
mov dword [esp], str.sfxtest
push dword [ebp + 0x64]
mov dword [0x41b500], eax
mov word [esi + eax*2], cx
call fcn.00404242
pop ecx
pop ecx
test eax, eax
je 0x404c61
push 0x64
pop esi
jmp 0x404bda
mov esi, 0x41b4fc
push esi
mov ecx, 0x41b4a0
call fcn.0040dcdb
mov edi, 0x41b4ac
push esi
mov ecx, edi
call fcn.0040dcdb
push esi
call fcn.00402675
pop ecx
cmp eax, ebx
jl 0x404d17
mov ecx, dword [0x41b4a0]
mov dword [0x41b4a4], eax
lea esi, [eax + eax]
xor eax, eax
mov word [esi + ecx], ax
mov eax, dword [0x41b4fc]
lea eax, [esi + eax + 2]
push eax
mov ecx, edi
call fcn.0040dfeb
mov eax, dword [0x41b4fc]
lea eax, [esi + eax + 2]
mov esi, 0x41b4c4
push eax
mov ecx, esi
call fcn.0040dfeb
push 0x2e
mov ecx, esi
call fcn.0040dd98
cmp eax, ebx
jle 0x404ce6
mov edx, dword [0x41b4c4]
xor ecx, ecx
mov dword [0x41b4c8], eax
mov word [edx + eax*2], cx
push esi
mov esi, 0x41b4b8
mov ecx, esi
call fcn.0040dcdb
push 4
call fcn.0040272f
pop ecx
push eax
mov ecx, esi
call fcn.0040e046
mov eax, dword [0x41b4c4]
mov dword [0x41b478], eax
mov eax, dword [0x41b4b8]
mov dword [0x41b47c], eax
call fcn.00402944
push eax
mov ecx, 0x41b4d0
call fcn.0040dfeb
push dword [0x41b4fc]
mov edi, 0x41b4dc
mov ecx, edi
call fcn.0040117c
test al, al
jne 0x404d56
push dword [0x41b4fc]
push 7
push 1
call fcn.004070b5
add esp, 0xc
push 2
jmp 0x404c5b
lea ecx, [ebp + 0x3c]
call fcn.0040dad2
mov ecx, 0x41b508
call fcn.004049c1
lea eax, [ebp + 0x3c]
push eax
push ebx
push dword [0x41b4e0]
call fcn.00403ed1
mov esi, eax
add esp, 0xc
cmp esi, ebx
je 0x404d8e
push dword [ebp + 0x3c]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
jmp 0x404c2a
push str.sfxconfig
push dword [ebp + 0x64]
call fcn.00404242
pop ecx
pop ecx
cmp eax, ebx
je 0x404e00
cmp word [eax], 0x3a
jne 0x404daa
add eax, 2
movzx ecx, word [eax]
cmp cx, bx
je 0x404df2
cmp cx, 0x20
ja 0x404dc3
add eax, 2
movzx ecx, word [eax]
cmp cx, bx
jne 0x404db2
cmp word [eax], bx
je 0x404df2
lea ecx, [ebp + 0x3c]
push ecx
push eax
call fcn.004049e5
pop ecx
pop ecx
test al, al
jne 0x404df2
push 0xa
push ebx
call fcn.004070b5
push dword [ebp + 0x3c]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 0xc
push 4
jmp 0x404c5b
push dword [ebp + 0x3c]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
jmp 0x404bd8
mov eax, dword [0x41b090]
mov esi, 0x41b090
jmp 0x404e3a
push eax
lea eax, [ebp - 0x68]
push str.SfxString_d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push ebx
push dword [esi]
call fcn.0040272f
pop ecx
push eax
lea eax, [ebp - 0x68]
push eax
call fcn.00403b6c
add esp, 0xc
add esi, 0x10
mov eax, dword [esi]
cmp eax, ebx
jne 0x404e0c
push dword [ebp + 0x64]
mov ecx, edi
call fcn.00403f6a
call fcn.004013b9
mov dword [ebp + 0x64], eax
cmp eax, ebx
jne 0x404e64
push dword [ebp + 0x3c]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
push 0x20
jmp 0x404c5b
call fcn.004042b8
mov ecx, edi
call fcn.004011ae
lea eax, [ebp + 0x48]
push eax
mov edi, str.SetEnvironment
push edi
mov dword [ebp + 0x48], ebx
call fcn.00402c56
pop ecx
pop ecx
jmp 0x404ed3
push esi
lea ecx, [ebp + 0x4c]
call fcn.0040dfb9
push 0x3d
push dword [ebp + 0x4c]
call fcn.0040d9a4
pop ecx
pop ecx
cmp eax, ebx
jle 0x404edb
mov edx, dword [ebp + 0x4c]
mov dword [ebp + 0x50], eax
add eax, eax
xor ecx, ecx
mov word [eax + edx], cx
push ebx
lea eax, [eax + esi + 2]
push eax
push dword [ebp + 0x4c]
call fcn.00403b6c
push dword [ebp + 0x4c]
inc dword [ebp + 0x48]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
lea eax, [ebp + 0x48]
push eax
push edi
call fcn.00402c56
add esp, 0x18
mov esi, eax
cmp esi, ebx
jne 0x404e86
jmp 0x404ee4
push dword [ebp + 0x4c]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
call fcn.00404864
cmp dword [0x41b300], 0xffffffff
jne 0x404ef8
mov dword [0x41b300], ebx
cmp byte [0x41b4ef], bl
je 0x404f52
push ebx
push str.HelpText
call fcn.00402c56
mov esi, eax
pop ecx
pop ecx
cmp esi, ebx
jne 0x404f1d
push 0x18
call fcn.0040272f
pop ecx
mov esi, eax
lea ecx, [ebp - 0x64]
call fcn.00405f8a
push ebx
push esi
push dword [0x41b478]
lea ecx, [ebp - 0x64]
push 0x11
mov dword [ebp - 0x64], 0x418330
mov dword [ebp - 0x2c], 0x7d6
call fcn.004061e5
lea ecx, [ebp - 0x64]
call fcn.00405feb
jmp 0x404df2
cmp byte [0x41b4ed], bl
je 0x404f64
and dword [0x41b300], 0xfffffeff
push 6
push ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
push ebx
push str.InstallPath
call fcn.00402c56
pop ecx
pop ecx
mov edi, 0x41b494
cmp eax, ebx
je 0x404f92
push eax
mov ecx, edi
call fcn.0040dfeb
mov byte [0x41b45c], 1
push edi
call fcn.00404078
pop ecx
push ebx
push str.BeginPrompt
call fcn.00402c56
pop ecx
pop ecx
cmp eax, ebx
je 0x404fe3
cmp byte [0x41b4ed], bl
jne 0x404fe3
push eax
push dword [0x41b478]
call fcn.00406ee3
pop ecx
pop ecx
test eax, eax
je 0x4050eb
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x404fe3
mov word [0x41b4ec], 0x101
lea ecx, [ebp + 0x58]
call fcn.0040dc8c
cmp byte [0x41b4ec], bl
je 0x405056
mov esi, dword [0x41b4e8]
push str.AutoInstall
lea ecx, [ebp + 0x58]
call fcn.0040dfeb
movzx eax, word [esi]
push eax
lea ecx, [ebp + 0x58]
call fcn.0040123a
push ebx
push dword [ebp + 0x58]
call fcn.00402c56
pop ecx
pop ecx
test eax, eax
je 0x4050fb
add esi, 2
movzx eax, word [esi]
cmp eax, 0x30
jb 0x405035
cmp eax, 0x39
jbe 0x404ff9
cmp eax, 0x61
jb 0x40503f
cmp eax, 0x7a
jbe 0x404ff9
cmp eax, 0x41
jb 0x405049
cmp eax, 0x5a
jbe 0x404ff9
push str.AutoInstall
lea ecx, [ebp + 0x58]
call fcn.0040dfeb
mov byte [ebp + 0x38], bl
cmp dword [ebp + 0x5c], ebx
jne 0x40509d
push ebx
mov esi, str.ExecuteFile
push esi
call fcn.00402c56
pop ecx
pop ecx
test eax, eax
je 0x40507d
push esi
lea ecx, [ebp + 0x58]
call fcn.0040dfeb
mov byte [ebp + 0x38], 1
cmp dword [ebp + 0x5c], ebx
jne 0x40509d
push ebx
mov esi, str.RunProgram
push esi
call fcn.00402c56
pop ecx
pop ecx
test eax, eax
je 0x40509d
push esi
lea ecx, [ebp + 0x58]
call fcn.0040dfeb
cmp byte [0x41b4ec], bl
jne 0x405130
cmp byte [0x41b4ed], bl
jne 0x405130
mov eax, dword [0x41b300]
and eax, 0xc0
cmp al, 0x80
jne 0x405130
push dword [0x41b46c]
push dword [0x41b470]
call fcn.00406f7e
pop ecx
pop ecx
test eax, eax
jne 0x405130
push dword [ebp + 0x58]
cmp byte [0x41b490], bl
je 0x405120
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
jmp 0x404f98
push dword [ebp + 0x3c]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
push 5
jmp 0x404c5b
push dword [ebp + 0x58]
push 0xe
push ebx
call fcn.004070b5
push dword [ebp + 0x58]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp + 0x3c]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 0x14
push 6
jmp 0x404c5b
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp + 0x3c]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
jmp 0x4050f3
cmp dword [0x41b498], ebx
jne 0x405160
lea eax, [ebp + 0x2c]
push str.7ZipSfx._03x
push eax
call fcn.00403180
pop ecx
pop ecx
push eax
mov ecx, edi
call fcn.0040dcdb
push dword [ebp + 0x2c]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
mov byte [0x41b45c], bl
jmp 0x405192
push edi
lea ecx, [ebp + 0x4c]
call fcn.0040dcb0
lea eax, [ebp + 0x4c]
push eax
call fcn.00404078
pop ecx
cmp dword [ebp + 0x50], ebx
je 0x405183
lea eax, [ebp + 0x4c]
push eax
mov ecx, edi
call fcn.0040dcdb
push dword [ebp + 0x4c]
mov byte [0x41b45c], 1
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
mov eax, dword [0x41b494]
pop ecx
mov ecx, dword [0x41b498]
movzx edx, word [eax + ecx*2 - 2]
cmp edx, 0x5c
je 0x4051ad
cmp edx, 0x2f
jne 0x4051ba
dec ecx
xor edx, edx
mov dword [0x41b498], ecx
mov word [eax + ecx*2], dx
cmp byte [0x41b4ed], bl
je 0x4051c9
or dword [0x41b484], 3
push edi
call fcn.00401ec0
pop ecx
test eax, eax
je 0x4051f2
call fcn.00404498
push dword [ebp + 0x58]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp + 0x3c]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
pop ecx
push 8
jmp 0x404c5b
call fcn.00404864
cmp byte [0x41b4ee], bl
je 0x40520b
cmp byte [0x41b45c], bl
jne 0x405370
lea ecx, [ebp + 0x4c]
call fcn.0040dc8c
lea ecx, [ebp + 0x14]
call fcn.0040dc8c
cmp byte [0x41b4ec], bl
jne 0x40522d
lea eax, [ebp + 0x4c]
push eax
call fcn.00401678
pop ecx
cmp dword [ebp + 0x5c], ebx
jne 0x4052f8
cmp byte [0x41b45c], bl
jne 0x405316
mov esi, str.setup.exe
push esi
push 0x417830
lea eax, [ebp - 0x10]
push edi
push eax
call fcn.0040df6f
add esp, 0xc
push eax
lea eax, [ebp + 0x2c]
push eax
call fcn.0040df6f
add esp, 0xc
push dword [eax]
lea ecx, [ebp + 0x14]
call fcn.0040dfeb
push dword [ebp + 0x2c]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp - 0x10]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
pop ecx
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4052c8
call fcn.00404498
push 0xf
push ebx
call fcn.004070b5
push dword [ebp + 0x14]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp + 0x4c]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp + 0x58]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp + 0x3c]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 0x18
push 7
jmp 0x404c5b
mov edi, dword [0x41b494]
push esi
lea ecx, [ebp + 0x2c]
call fcn.0040dfb9
push dword [ebp + 0x64]
lea eax, [ebp + 0x4c]
push eax
push dword [ebp + 0x38]
lea eax, [ebp + 0x2c]
push edi
push eax
call fcn.004017bb
push dword [ebp + 0x2c]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 0x18
jmp 0x405316
push dword [ebp + 0x64]
lea eax, [ebp + 0x4c]
push eax
push dword [0x41b4e8]
push dword [0x41b494]
push dword [ebp + 0x58]
call fcn.00401a3a
add esp, 0x14
call fcn.00404864
push 0xffffffffffffffff
push dword [0x41b4e8]
push str.Shortcut
push 0x4048bb
call fcn.0040451c
add esp, 0x10
push dword [0x41b4a0]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 0xffffffffffffffff
push dword [0x41b4e8]
push str.Delete
push 0x4044ed
call fcn.0040451c
call fcn.00404498
push dword [ebp + 0x14]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp + 0x4c]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 0x18
cmp dword [0x41b30c], 0xffffffff
jne 0x40538b
cmp byte [0x41b4ed], bl
jne 0x4053e8
mov dword [0x41b30c], 1
cmp dword [0x41b30c], ebx
jle 0x4053e8
push ebx
push str.FinishMessage
call fcn.00402c56
mov esi, eax
pop ecx
pop ecx
cmp esi, ebx
je 0x4053e8
mov eax, 0x3e7
cmp dword [0x41b30c], eax
jle 0x4053b8
mov dword [0x41b30c], eax
lea ecx, [ebp - 0x60]
call fcn.00405f8a
push ebx
push esi
push dword [0x41b478]
lea ecx, [ebp - 0x60]
push 0x11
mov dword [ebp - 0x60], 0x418388
mov dword [ebp - 0x28], 0x7d5
call fcn.004061e5
lea ecx, [ebp - 0x60]
call fcn.00405feb
cmp byte [0x41b4ee], bl
jne 0x40541e
push ebx
push str.SelfDelete
call fcn.00402c56
pop ecx
pop ecx
cmp eax, ebx
je 0x40541e
cmp word [eax], 0x31
jne 0x40541e
sub esp, 0xc
mov ecx, esp
push 0x41b4fc
call fcn.0040dcb0
call fcn.004046a5
add esp, 0xc
push dword [ebp + 0x58]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp + 0x3c]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
jmp 0x404dfa