Function at 0x404815
Capabilities:
Accept command line arguments
Check if file exists
Check os version
Create process on windows
Get file attributes
Log keystrokes via polling
Parse credit card information
Resolve function by parsing pe exports
Self delete
Set current directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2a4
push ebx
push esi
push edi
push 0x4047c4
call fcn.004144cd
pop ecx
call fcn.00402cb3
lea eax, [esp + 0x198]
push eax
mov dword [esp + 0x19c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x405f66
cmp dword [esp + 0x1a8], 2
jne 0x405f66
cmp dword [esp + 0x19c], 5
jb 0x405f66
or dword [esp + 0xb0], 0xffffffff
or dword [esp + 0xac], 0xffffffff
xor ebx, ebx
lea eax, [esp + 0xc0]
mov byte [str.___InstallEnd__], 0x3b
mov byte [0x423ddc], 0x3b
mov dword [esp + 0x24], 0x41fd34
mov byte [esp + 0xd], bl
mov byte [esp + 0xc], bl
mov byte [esp + 0xf], bl
mov byte [esp + 0xe], bl
call fcn.004018b5
lea eax, [esp + 0xe4]
call fcn.004018b5
push 2
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x8c], ebx
mov dword [esp + 0x90], ebx
mov dword [esp + 0x94], ebx
pop ebx
lea esi, [esp + 0x88]
mov dword [esp + 0x38], 4
mov dword [esp + 0x28], 0x420018
call fcn.004017e5
mov eax, dword [esp + 0x88]
and word [eax + 2], 0
xor edi, edi
inc edi
mov word [eax], 0x20
mov dword [esp + 0x8c], edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ecx, eax
lea eax, [esp + 0xc0]
call fcn.00403f0e
call fcn.0040369d
mov eax, esi
push eax
call fcn.00401e39
mov esi, dword [esp + 0x8c]
add esi, ebx
mov eax, esi
mov dword [esp + 0x14], esi
mov dword [esp], str.sfxlang
call fcn.004040f2
test eax, eax
pop ecx
je 0x4049a1
cmp word [eax], 0x3a
jne 0x4049a1
add eax, ebx
push eax
call fcn.00413c63
pop ecx
lea ecx, [eax - 1]
cmp ecx, 0xfffe
ja 0x40497d
mov word [0x424ff4], ax
cmp word [esi], 0x20
jbe 0x404999
inc esi
inc esi
cmp word [esi], 0x20
ja 0x404983
jmp 0x404995
cmp ax, 0x20
ja 0x4049a1
inc esi
inc esi
mov dword [esp + 0x10], esi
movzx eax, word [esi]
test ax, ax
jne 0x40498d
call fcn.00403aa4
push str.sfxversion
mov eax, esi
call fcn.004040f2
test eax, eax
pop ecx
je 0x404a06
call fcn.00404708
xor esi, esi
push dword [esp + 0x88]
call fcn.0041383a
pop ecx
lea ecx, [esp + 0x28]
mov dword [esp + 0x28], 0x420018
call fcn.0040ea49
lea ecx, [esp + 0x28]
call fcn.0040ea1d
push dword [esp + 0xe4]
call fcn.0041383a
pop ecx
push dword [esp + 0xc0]
call fcn.0041383a
pop ecx
mov eax, esi
jmp 0x405f7d
mov ecx, 0x208
push ecx
mov eax, 0x42507c
call fcn.00403662
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x404a31
push 6
push edi
call fcn.0040810a
pop ecx
pop ecx
mov esi, edi
jmp 0x4049be
mov edx, 0x42507c
call fcn.0040367e
push str.sfxtest
mov eax, esi
call fcn.004040f2
mov edi, eax
test edi, edi
pop ecx
je 0x404bc2
cmp word [edi], 0x3a
je 0x404a60
push 0x64
pop esi
jmp 0x4049be
movzx ecx, word [edi + 2]
movzx eax, cx
or eax, 0x20
sub eax, 0x61
push 2
pop ebx
je 0x404b31
sub eax, ebx
je 0x404b1d
dec eax
je 0x404a9e
sub eax, ebx
je 0x404a94
sub eax, 0x10
jne 0x404a58
mov esi, 0x46a4
jmp 0x4049be
mov esi, 0x2032
jmp 0x4049be
cmp cx, 0x44
jne 0x404add
cmp word [edi + 4], 0x3a
jne 0x404a58
add edi, 6
jmp 0x404ac6
cmp ax, 0x3a
je 0x404acf
movzx eax, ax
push eax
mov esi, 0x42508c
call fcn.00401726
add edi, ebx
movzx eax, word [edi]
cmp ax, 0x20
ja 0x404ab0
cmp dword [0x425090], 0
jne 0x404ae0
jmp 0x404a58
add edi, 4
and dword [0x425024], 0
cmp word [edi], 0x3a
jne 0x404b07
lea eax, [edi + 2]
push eax
call fcn.00413c63
cmp eax, 0xe10
pop ecx
mov dword [0x425024], eax
ja 0x404b07
test eax, eax
jne 0x404b11
mov dword [0x425024], 0xa
mov dword [0x425028], 1
jmp 0x404b3b
xor eax, eax
cmp word [edi + 4], 0x63
sete al
add eax, 3
mov dword [0x425028], eax
jmp 0x404b3b
mov dword [0x425028], 2
push 0x20
pop esi
jmp 0x404b42
add edi, ebx
cmp word [edi], si
ja 0x404b40
jmp 0x404b50
cmp ax, si
ja 0x404b58
add edi, ebx
movzx eax, word [edi]
test ax, ax
jne 0x404b49
push str.sfxconfig
mov eax, edi
mov dword [esp + 0x14], edi
call fcn.004040f2
pop ecx
mov ecx, eax
test ecx, ecx
je 0x404bc2
cmp word [ecx], 0x3a
jne 0x404b7e
jmp 0x404b7c
cmp ax, si
ja 0x404b86
add ecx, ebx
movzx eax, word [ecx]
test ax, ax
jne 0x404b77
mov eax, dword [esp + 0xc0]
and word [eax], 0
and dword [esp + 0xc4], 0
lea eax, [esp + 0xc0]
call fcn.00403f0e
cmp dword [0x425028], ebx
mov dword [esp + 0x10], eax
je 0x404bc2
lea edi, [esp + 0xc0]
mov eax, 0x42507c
call fcn.004016e8
mov edi, 0x42507c
mov eax, 0x42504c
call fcn.004016e8
mov ebx, 0x425058
mov eax, ebx
call fcn.004016e8
push edi
call fcn.00402c8c
test eax, eax
pop ecx
jl 0x404c72
mov ecx, dword [0x42504c]
lea esi, [eax + eax]
and word [esi + ecx], 0
mov dword [0x425050], eax
mov eax, dword [0x42507c]
lea edi, [esi + eax + 2]
mov eax, ebx
call fcn.00401698
mov eax, dword [0x42507c]
lea edi, [esi + eax + 2]
mov esi, 0x425070
mov eax, esi
call fcn.00401698
mov dx, 0x2e
mov ecx, esi
call fcn.004036d8
test eax, eax
jle 0x404c43
mov ecx, dword [0x425070]
and word [ecx + eax*2], 0
mov dword [0x425074], eax
mov edi, esi
mov esi, 0x425064
mov eax, esi
call fcn.004016e8
push 4
call fcn.00403364
pop ecx
call fcn.0040369d
mov eax, dword [0x425070]
mov dword [0x424edc], eax
mov eax, dword [0x425064]
mov dword [0x424ee4], eax
push 0x10
call fcn.004137d0
test eax, eax
pop ecx
je 0x404ca2
mov dword [eax + 4], 0x41ffbc
and dword [eax + 8], 0
mov edi, eax
mov dword [eax], 0x41ffcc
mov dword [eax + 4], 0x41ffe4
or dword [eax + 0xc], 0xffffffff
mov dword [esp + 0x14], edi
jmp 0x404cab
and dword [esp + 0x14], 0
mov edi, dword [esp + 0x14]
test edi, edi
je 0x404cb5
mov eax, dword [edi]
push edi
call dword [eax + 4]
push dword [0x42507c]
mov eax, edi
call fcn.0040de6b
test al, al
jne 0x404ce9
push dword [0x42507c]
push 7
push 1
call fcn.0040810a
add esp, 0xc
test edi, edi
je 0x404ce2
mov eax, dword [edi]
push edi
call dword [eax + 8]
push 2
jmp 0x404a5a
lea eax, [esp + 0x3c]
call fcn.004037fa
lea eax, [esp + 0x60]
call fcn.004037fa
lea eax, [esp + 0x54]
call fcn.004037fa
movzx eax, word [0x424ff4]
push eax
lea ebx, [esp + 0x58]
lea eax, [esp + 0x64]
call fcn.0040415c
pop ecx
lea eax, [esp + 0x3c]
push eax
push dword [esp + 0x58]
push dword [esp + 0x68]
push edi
call fcn.00401ad7
add esp, 0x10
test al, al
jne 0x404d8a
lea eax, [esp + 0x3c]
push eax
push str.___InstallEnd__
push 0x423ddc
push edi
call fcn.00401ad7
add esp, 0x10
test al, al
jne 0x404d8a
push 9
push 0
call fcn.0040810a
push dword [esp + 0x5c]
call fcn.0041383a
add esp, 0xc
push dword [esp + 0x60]
call fcn.0041383a
pop ecx
push dword [esp + 0x3c]
call fcn.0041383a
test edi, edi
pop ecx
je 0x404d83
mov eax, dword [edi]
push edi
call dword [eax + 8]
push 3
jmp 0x404a5a
mov esi, dword [esp + 0x10]
xor ebx, ebx
cmp dword [0x425028], ebx
jne 0x404e51
push str.sfxconfig
mov eax, esi
call fcn.004040f2
cmp eax, ebx
pop ecx
je 0x404e51
cmp word [eax], 0x3a
jne 0x404db9
inc eax
inc eax
movzx ecx, word [eax]
cmp cx, bx
je 0x404e20
cmp cx, 0x20
ja 0x404dd1
inc eax
inc eax
movzx ecx, word [eax]
cmp cx, bx
jne 0x404dc1
cmp word [eax], bx
je 0x404e20
lea ecx, [esp + 0x3c]
push ecx
push eax
call fcn.00403f77
test al, al
pop ecx
pop ecx
jne 0x404e20
push 0xa
push ebx
call fcn.0040810a
push dword [esp + 0x5c]
call fcn.0041383a
add esp, 0xc
push dword [esp + 0x60]
call fcn.0041383a
pop ecx
push dword [esp + 0x3c]
call fcn.0041383a
cmp edi, ebx
pop ecx
je 0x404e19
mov eax, dword [edi]
push edi
call dword [eax + 8]
push 4
jmp 0x404a5a
push dword [esp + 0x54]
call fcn.0041383a
pop ecx
push dword [esp + 0x60]
call fcn.0041383a
pop ecx
push dword [esp + 0x3c]
call fcn.0041383a
cmp edi, ebx
pop ecx
je 0x4049bc
mov eax, dword [edi]
push edi
call dword [eax + 8]
jmp 0x4049bc
lea ecx, [esp + 0x28]
call fcn.0040ea49
cmp dword [esp + 0x40], ebx
je 0x404e86
push ebx
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x44]
push eax
call fcn.00401f7b
add esp, 0xc
test al, al
jne 0x404e86
push dword [esp + 0x54]
call fcn.0041383a
pop ecx
jmp 0x404dfb
cmp dword [0x425028], 4
je 0x404e20
mov eax, dword [0x423fa0]
mov ebx, 0x423fa0
jmp 0x404f26
push eax
lea eax, [esp + 0x13c]
push str.7zSfxString_d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [esp + 0xcc]
call fcn.004018b5
lea eax, [esp + 0xd8]
call fcn.004018b5
lea edi, [esp + 0x138]
lea eax, [esp + 0xcc]
call fcn.00401698
push dword [ebx]
call fcn.00403364
mov edi, eax
pop ecx
lea eax, [esp + 0xd8]
call fcn.00401698
push 0x424274
lea eax, [esp + 0xd0]
call fcn.004037c5
push dword [esp + 0xd8]
add ebx, 0x10
call fcn.0041383a
pop ecx
push dword [esp + 0xcc]
call fcn.0041383a
mov eax, dword [ebx]
pop ecx
test eax, eax
jne 0x404e9e
lea eax, [esp + 0x28]
push eax
call fcn.004042df
dec esi
dec esi
mov dword [esp + 0x14], esi
pop ecx
push 0x20
pop edi
cmp word [esi], di
jbe 0x404f5b
inc esi
inc esi
cmp word [esi], di
ja 0x404f47
jmp 0x404f57
cmp ax, di
ja 0x404f63
inc esi
inc esi
mov dword [esp + 0x10], esi
movzx eax, word [esi]
test ax, ax
jne 0x404f50
movzx eax, word [esi]
cmp ax, 0x2f
je 0x404f76
cmp ax, 0x2d
jne 0x405198
lea ebx, [esi + 2]
cmp word [ebx], 0x21
jne 0x404f89
cmp word [esi + 4], di
jbe 0x405180
push 0x41fdfc
call fcn.00403d01
test eax, eax
pop ecx
je 0x404fe8
lea ecx, [esi + 6]
movzx eax, word [ecx]
cmp ax, 0x30
jb 0x404faa
cmp ax, 0x39
jbe 0x404fc2
cmp ax, 0x61
jb 0x404fb6
cmp ax, 0x7a
jbe 0x404fc2
cmp ax, 0x41
jb 0x404fd5
cmp ax, 0x5a
ja 0x404fd5
mov dword [esp + 0x24], ecx
mov byte [esp + 0xd], 1
mov byte [esp + 0xc], 1
jmp 0x404f3f
cmp ax, di
ja 0x405198
mov dword [esp + 0x24], 0x41fd34
jmp 0x404fc6
push 0x41fe04
call fcn.00403d01
test eax, eax
pop ecx
je 0x405009
lea eax, [esp + 0x28]
push eax
lea eax, [esi + 6]
mov edi, str.OverwriteMode
jmp 0x4050b8
push 0x41fe0c
call fcn.00403d01
test eax, eax
pop ecx
je 0x405043
lea eax, [esi + 6]
movzx ecx, word [eax]
cmp cx, 0x30
jb 0x405198
cmp cx, 0x32
ja 0x405198
cmp word [esi + 8], di
ja 0x405198
mov edi, str.GUIMode
jmp 0x4050b3
push 0x41fe14
call fcn.00403d01
test eax, eax
pop ecx
je 0x405061
lea eax, [esp + 0x28]
push eax
lea eax, [esi + 6]
mov edi, str.GUIFlags
jmp 0x4050b8
push 0x41fe1c
call fcn.00403d01
test eax, eax
pop ecx
je 0x40507f
lea eax, [esp + 0x28]
push eax
lea eax, [esi + 6]
mov edi, str.MiscFlags
jmp 0x4050b8
push 0x41fe24
call fcn.00403d01
test eax, eax
pop ecx
je 0x4050c2
lea eax, [esi + 6]
movzx ecx, word [eax]
cmp cx, 0x30
je 0x4050a4
cmp cx, 0x31
jne 0x405198
cmp word [esi + 8], di
ja 0x405198
mov edi, str.SelfDelete
lea ecx, [esp + 0x28]
push ecx
call fcn.004044df
jmp 0x404f3e
push 0x41fe2c
call fcn.00403d01
test eax, eax
pop ecx
je 0x4050e5
cmp word [esi + 6], di
ja 0x405198
mov byte [esp + 0xf], 1
jmp 0x404f3f
push 0x41fe34
call fcn.00403d01
test eax, eax
pop ecx
je 0x40511e
lea eax, [esi + 6]
movzx ecx, word [eax]
cmp cx, 0x30
jb 0x405198
cmp cx, 0x39
ja 0x405198
push eax
call fcn.00413c63
mov dword [0x423f74], eax
jmp 0x404f3e
movzx eax, word [ebx]
cmp ax, 0x79
je 0x40512d
cmp ax, 0x59
jne 0x40513d
cmp word [esi + 4], di
ja 0x40513d
mov byte [esp + 0xd], 1
jmp 0x404f3f
cmp ax, 0x3f
je 0x40514f
cmp ax, 0x68
je 0x40514f
cmp ax, 0x48
jne 0x40515f
cmp word [esi + 4], di
ja 0x40515f
mov byte [esp + 0xe], 1
jmp 0x404f3f
lea eax, [esp + 0x28]
push eax
push ebx
call fcn.004041e8
test eax, eax
pop ecx
pop ecx
je 0x405198
cmp eax, 1
je 0x4051ac
mov dword [esp + 0x10], eax
mov esi, eax
jmp 0x404f3f
add esi, 4
jmp 0x40518c
cmp ax, di
ja 0x405198
inc esi
inc esi
movzx eax, word [esi]
test ax, ax
mov dword [esp + 0x10], esi
jne 0x405185
lea eax, [esp + 0x28]
push eax
call fcn.004042df
and dword [esp + 0x1c], 0
jmp 0x40529e
push dword [esp + 0x54]
call fcn.0041383a
pop ecx
push dword [esp + 0x60]
call fcn.0041383a
pop ecx
push dword [esp + 0x3c]
call fcn.0041383a
mov eax, dword [esp + 0x18]
test eax, eax
pop ecx
je 0x404a2d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x404a2d
mov edi, dword [esp + 0x20]
lea eax, [esp + 0x6c]
call fcn.0040360f
mov esi, dword [esp + 0x6c]
movzx ecx, word [esi]
cmp cx, 0x3d
mov eax, esi
je 0x405210
movzx ecx, cx
test cx, cx
je 0x405216
inc eax
inc eax
movzx ecx, word [eax]
cmp cx, 0x3d
jne 0x405200
sub eax, esi
sar eax, 1
jmp 0x405219
or eax, 0xffffffff
test eax, eax
jle 0x4052c1
lea ebx, [eax + eax]
and word [esi + ebx], 0
mov dword [esp + 0x70], eax
lea eax, [esp + 0xcc]
call fcn.004018b5
lea eax, [esp + 0xd8]
call fcn.004018b5
lea edi, [esp + 0x6c]
lea eax, [esp + 0xcc]
call fcn.004016e8
mov eax, dword [esp + 0x20]
lea edi, [ebx + eax + 2]
lea eax, [esp + 0xd8]
call fcn.00401698
push 0x424274
lea eax, [esp + 0xd0]
call fcn.004037c5
push dword [esp + 0xd8]
inc dword [esp + 0x1c]
call fcn.0041383a
pop ecx
push dword [esp + 0xcc]
call fcn.0041383a
pop ecx
push esi
call fcn.0041383a
lea ebx, [esp + 0x1c]
lea edi, [esp + 0x2c]
mov dword [esp], str.SetEnvironment
call fcn.004022a3
test eax, eax
mov dword [esp + 0x24], eax
pop ecx
jne 0x4051e1
jmp 0x4052c8
push esi
call fcn.0041383a
pop ecx
call fcn.00403cab
cmp dword [0x423f68], 0xffffffff
jne 0x4052dd
and dword [0x423f68], 0
cmp byte [esp + 0xe], 0
je 0x40537a
push str.HelpText
xor ebx, ebx
lea edi, [esp + 0x2c]
call fcn.004022a3
mov edi, eax
test edi, edi
pop ecx
jne 0x405309
push 0x18
call fcn.00403364
pop ecx
mov edi, eax
lea esi, [esp + 0x138]
call fcn.004065a8
push 0
push dword [0x424edc]
mov eax, edi
push 0x11
mov ecx, esi
mov dword [esp + 0x144], 0x42004c
mov dword [esp + 0x17c], 0x7d6
call fcn.00406be6
mov ecx, esi
call fcn.004065fd
push dword [esp + 0x54]
call fcn.0041383a
pop ecx
push dword [esp + 0x60]
call fcn.0041383a
pop ecx
push dword [esp + 0x3c]
call fcn.0041383a
mov eax, dword [esp + 0x18]
test eax, eax
pop ecx
je 0x4049bc
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x4049bc
cmp byte [esp + 0xd], 0
je 0x40538b
and dword [0x423f68], 0xfffffeff
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push str.InstallPath
xor ebx, ebx
lea edi, [esp + 0x2c]
call fcn.004022a3
test eax, eax
pop ecx
je 0x4053b4
mov edi, eax
mov eax, 0x425040
call fcn.00401698
mov eax, 0x425040
call fcn.00403c77
cmp dword [0x425090], 0
je 0x405407
lea eax, [esp + 0x28]
call fcn.00408259
push dword [esp + 0x54]
mov esi, eax
call fcn.0041383a
pop ecx
push dword [esp + 0x60]
call fcn.0041383a
pop ecx
push dword [esp + 0x3c]
call fcn.0041383a
mov eax, dword [esp + 0x18]
test eax, eax
pop ecx
je 0x4049be
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x4049be
cmp dword [0x425028], 3
jne 0x40541b
lea eax, [esp + 0x28]
call fcn.00408508
jmp 0x4053d0
push str.BeginPrompt
xor ebx, ebx
lea edi, [esp + 0x2c]
call fcn.004022a3
test eax, eax
pop ecx
je 0x405457
cmp byte [esp + 0xd], bl
jne 0x405457
push eax
call fcn.00407f5f
test eax, eax
pop ecx
je 0x4055a1
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x405457
mov byte [esp + 0xc], 1
lea eax, [esp + 0x48]
call fcn.004018b5
cmp byte [esp + 0xc], 0
je 0x4054f9
mov eax, dword [esp + 0x24]
mov dword [esp + 0x18], eax
mov edi, str.AutoInstall
lea eax, [esp + 0x48]
call fcn.00401698
mov eax, dword [esp + 0x18]
movzx eax, word [eax]
push eax
lea esi, [esp + 0x4c]
call fcn.00401726
push dword [esp + 0x48]
xor ebx, ebx
lea edi, [esp + 0x2c]
call fcn.004022a3
test eax, eax
pop ecx
je 0x4055d4
add dword [esp + 0x18], 2
mov eax, dword [esp + 0x18]
movzx eax, word [eax]
cmp ax, 0x30
jb 0x4054c2
cmp ax, 0x39
jbe 0x405473
cmp ax, 0x61
jb 0x4054ce
cmp ax, 0x7a
jbe 0x405473
cmp ax, 0x41
jb 0x4054da
cmp ax, 0x5a
jbe 0x405473
mov edi, str.AutoInstall
lea eax, [esp + 0x48]
call fcn.00401698
mov eax, dword [esp + 0x24]
movzx eax, word [eax]
push eax
lea esi, [esp + 0x4c]
call fcn.00401726
cmp dword [esp + 0x4c], 0
mov byte [esp + 0xe], 0
jne 0x405552
mov esi, str.ExecuteFile
push esi
xor ebx, ebx
lea edi, [esp + 0x2c]
call fcn.004022a3
test eax, eax
pop ecx
je 0x405531
mov edi, esi
lea eax, [esp + 0x48]
call fcn.00401698
cmp dword [esp + 0x4c], ebx
mov byte [esp + 0xe], 1
jne 0x405552
mov esi, str.RunProgram
push esi
xor ebx, ebx
lea edi, [esp + 0x2c]
call fcn.004022a3
test eax, eax
pop ecx
je 0x405552
mov edi, esi
lea eax, [esp + 0x48]
call fcn.00401698
xor ebx, ebx
cmp byte [esp + 0xc], bl
jne 0x40564f
cmp byte [esp + 0xd], bl
jne 0x40564f
mov eax, dword [0x423f68]
and ax, 0xc0
cmp al, 0x80
jne 0x40564f
call fcn.00407fe2
test eax, eax
jne 0x40564f
cmp byte [0x424ff6], bl
push dword [esp + 0x48]
je 0x405621
call fcn.0041383a
pop ecx
jmp 0x40541b
push dword [esp + 0x54]
call fcn.0041383a
pop ecx
push dword [esp + 0x60]
call fcn.0041383a
pop ecx
push dword [esp + 0x3c]
call fcn.0041383a
mov eax, dword [esp + 0x18]
test eax, eax
pop ecx
je 0x4055cd
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 5
jmp 0x404a5a
push dword [esp + 0x48]
push 0xe
push 0
call fcn.0040810a
add esp, 0xc
push dword [esp + 0x48]
call fcn.0041383a
pop ecx
push dword [esp + 0x54]
call fcn.0041383a
pop ecx
push dword [esp + 0x60]
call fcn.0041383a
pop ecx
push dword [esp + 0x3c]
call fcn.0041383a
mov eax, dword [esp + 0x18]
test eax, eax
pop ecx
je 0x40561a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 6
jmp 0x404a5a
call fcn.0041383a
pop ecx
push dword [esp + 0x54]
call fcn.0041383a
pop ecx
push dword [esp + 0x60]
call fcn.0041383a
pop ecx
push dword [esp + 0x3c]
call fcn.0041383a
mov eax, dword [esp + 0x18]
cmp eax, ebx
jmp 0x4055c4
cmp dword [0x425044], ebx
jne 0x405683
push str.7ZipSfx._03x
lea esi, [esp + 0x70]
call fcn.00403bed
mov edi, eax
pop ecx
mov eax, 0x425040
call fcn.004016e8
push dword [esp + 0x6c]
call fcn.0041383a
mov byte [0x424ec0], bl
jmp 0x4056bd
mov esi, 0x425040
mov edi, esi
lea eax, [esp + 0x6c]
call fcn.00401661
lea eax, [esp + 0x6c]
call fcn.00403c77
cmp dword [esp + 0x70], ebx
jne 0x4056ad
lea edi, [esp + 0x6c]
mov eax, esi
call fcn.004016e8
push dword [esp + 0x6c]
mov byte [0x424ec0], 1
call fcn.0041383a
mov eax, dword [0x425040]
pop ecx
mov ecx, dword [0x425044]
movzx edx, word [eax + ecx*2 - 2]
cmp dx, 0x5c
je 0x4056da
cmp dx, 0x2f
jne 0x4056e5
dec ecx
mov word [eax + ecx*2], bx
mov dword [0x425044], ecx
cmp byte [esp + 0xd], bl
je 0x4056f2
or dword [0x425004], 3
cmp dword [0x425024], ebx
jne 0x405705
mov eax, dword [esp + 0x14]
call fcn.00405fa0
jmp 0x405713
call fcn.004081ff
test eax, eax
jne 0x405759
mov eax, 0x80004005
cmp eax, ebx
je 0x405759
call fcn.004047ad
push dword [esp + 0x48]
call fcn.0041383a
pop ecx
push dword [esp + 0x54]
call fcn.0041383a
pop ecx
push dword [esp + 0x60]
call fcn.0041383a
pop ecx
push dword [esp + 0x3c]
call fcn.0041383a
mov eax, dword [esp + 0x18]
cmp eax, ebx
pop ecx
je 0x405752
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 8
jmp 0x404a5a
call fcn.00403cab
cmp byte [esp + 0xf], bl
je 0x405770
cmp byte [0x424ec0], bl
jne 0x405e0d
lea eax, [esp + 0xb4]
mov dword [esp + 0x20], ebx
call fcn.004018b5
cmp byte [esp + 0xc], bl
jne 0x405796
lea eax, [esp + 0xb4]
lea ecx, [esp + 0x28]
call fcn.00403ebb
mov eax, dword [esp + 0x24]
mov byte [esp + 0x1e], bl
mov dword [esp + 0x18], eax
xor ebx, ebx
lea eax, [esp + 0x78]
mov dword [esp + 0x84], ebx
mov byte [esp + 0x1f], bl
mov byte [esp + 0xc], bl
call fcn.004018b5
lea eax, [esp + 0x94]
call fcn.004018b5
cmp dword [esp + 0x4c], ebx
jne 0x40588e
cmp byte [0x424ec0], bl
jne 0x405c6a
mov eax, str.setup.exe
push eax
mov esi, eax
push 0x41ed14
mov edi, 0x425040
lea eax, [esp + 0xd4]
call fcn.004063cb
mov edi, eax
pop ecx
lea eax, [esp + 0x130]
call fcn.004063cb
mov edi, eax
pop ecx
lea eax, [esp + 0x78]
call fcn.004016e8
push dword [esp + 0x12c]
call fcn.0041383a
pop ecx
push dword [esp + 0xcc]
call fcn.0041383a
pop ecx
push dword [esp + 0x78]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x405c80
mov byte [esp + 0x1e], 1
mov edi, esi
lea eax, [esp + 0x94]
call fcn.00401698
lea eax, [esp + 0x94]
call fcn.00403c94
mov esi, dword [esp + 0x94]
push 2
pop edi
push 0
push str.hidcon
mov ebx, esi
call fcn.00403d34
test eax, eax
pop ecx
pop ecx
je 0x40591e
mov esi, eax
mov byte [esp + 0x1f], 1
jmp 0x40586d
push dword [esp + 0x48]
lea ebx, [esp + 0x24]
lea edi, [esp + 0x2c]
call fcn.004022a3
mov esi, eax
test esi, esi
pop ecx
jne 0x405849
add dword [esp + 0x18], 2
mov eax, dword [esp + 0x18]
movzx eax, word [eax]
cmp ax, 0x30
jb 0x4058be
cmp ax, 0x39
jbe 0x4058de
cmp ax, 0x61
jb 0x4058ca
cmp ax, 0x7a
jbe 0x4058de
cmp ax, 0x41
jb 0x405c6a
cmp ax, 0x5a
ja 0x405c6a
mov edi, str.AutoInstall
lea eax, [esp + 0x48]
call fcn.00401698
mov eax, dword [esp + 0x18]
movzx eax, word [eax]
push eax
lea esi, [esp + 0x4c]
call fcn.00401726
push dword [esp + 0x94]
and dword [esp + 0x24], 0
call fcn.0041383a
pop ecx
push dword [esp + 0x78]
call fcn.0041383a
pop ecx
jmp 0x4057a2
push 0
push str.nowait
mov ebx, esi
call fcn.00403d34
test eax, eax
pop ecx
pop ecx
je 0x405942
mov esi, eax
mov al, byte [0x424ec0]
mov byte [esp + 0xc], al
jmp 0x40586d
push 0
push str.forcenowait
mov ebx, esi
call fcn.00403d34
test eax, eax
pop ecx
pop ecx
je 0x405962
mov esi, eax
mov byte [esp + 0xc], 1
jmp 0x40586d
push edi
push 0x41fe34
mov ebx, esi
call fcn.00403d34
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
je 0x405996
cmp dword [0x423f74], 0xffffffff
jne 0x40598f
add esi, 4
push esi
call fcn.00413c63
pop ecx
mov dword [0x423f74], eax
mov esi, ebx
jmp 0x40586d
push 3
push 0x41fed4
mov ebx, esi
call fcn.00403d34
test eax, eax
pop ecx
pop ecx
je 0x4059ba
movzx ecx, word [esi + 6]
sub ecx, 0x30
mov dword [esp + 0xb0], ecx
jmp 0x4059dc
push 3
push 0x41fedc
mov ebx, esi
call fcn.00403d34
test eax, eax
pop ecx
pop ecx
je 0x4059e3
movzx ecx, word [esi + 6]
sub ecx, 0x30
mov dword [esp + 0xac], ecx
mov esi, eax
jmp 0x40586d
push 0
push 0x41fee4
mov ebx, esi
call fcn.00403d34
test eax, eax
pop ecx
pop ecx
jne 0x405a38
push eax
push str.i386
call fcn.00403d34
test eax, eax
pop ecx
pop ecx
jne 0x405a38
push eax
push str.amd64
call fcn.00403d34
test eax, eax
pop ecx
pop ecx
jne 0x405a2a
push eax
push 0x41ff04
call fcn.00403d34
test eax, eax
pop ecx
pop ecx
je 0x405a4a
mov esi, eax
mov dword [esp + 0x84], edi
jmp 0x40586d
mov esi, eax
mov dword [esp + 0x84], 1
jmp 0x40586d
cmp byte [esp + 0xe], 0
lea eax, [esp + 0x78]
je 0x405aa9
cmp word [esi], 0x22
je 0x405a79
mov edi, 0x41fd30
call fcn.00401698
mov eax, esi
lea esi, [esp + 0x78]
call fcn.0040369d
mov eax, edi
call fcn.0040369d
jmp 0x405a80
mov edi, esi
call fcn.00401698
push str.ExecuteParameters
xor ebx, ebx
lea edi, [esp + 0x2c]
call fcn.004022a3
mov edi, eax
test edi, edi
pop ecx
je 0x405ac0
mov eax, 0x41ff0c
lea esi, [esp + 0x78]
call fcn.0040369d
mov eax, edi
jmp 0x405ab7
lea edi, [esp + 0xb4]
call fcn.004016e8
mov eax, esi
lea esi, [esp + 0x78]
call fcn.0040369d
lea eax, [esp + 0x6c]
call fcn.004018b5
lea eax, [esp + 0xa0]
call fcn.004018b5
push 0x3c
pop esi
push esi
lea eax, [esp + 0xf4]
push 0
push eax
call fcn.00414520
mov eax, dword [0x425040]
add esp, 0xc
cmp byte [esp + 0x1f], 0
mov dword [esp + 0xf0], esi
mov dword [esp + 0x108], eax
mov dword [esp + 0xf4], 0x740
mov dword [esp + 0x10c], 1
je 0x405b2e
and dword [esp + 0x10c], 0
mov dword [esp + 0xf4], 0x8740
mov ebx, dword [esp + 0x78]
lea eax, [esp + 0x6c]
mov ecx, ebx
call fcn.00403f0e
mov edi, eax
lea eax, [esp + 0xa0]
call fcn.00401698
lea eax, [esp + 0x6c]
call fcn.00403c94
cmp dword [0x425028], 0
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x100], eax
jne 0x405c13
mov esi, dword [esp + 0x84]
call fcn.004035b2
test eax, eax
je 0x405c13
mov edi, dword [esp + 0x10]
cmp word [edi], 0
je 0x405bb1
push 0x20
lea esi, [esp + 0xa4]
call fcn.00401726
mov eax, edi
call fcn.0040369d
cmp word [edi], 0
je 0x405bb1
inc edi
inc edi
cmp word [edi], 0
jne 0x405ba5
mov dword [esp + 0x10], edi
lea eax, [esp + 0xa0]
call fcn.00403c94
cmp dword [esp + 0xa4], 0
mov esi, dword [esp + 0xa0]
je 0x405bd5
mov dword [esp + 0x104], esi
lea eax, [esp + 0xf0]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x405cf0
cmp byte [esp + 0xc], 0
jne 0x405c01
push 0xffffffffffffffff
push dword [esp + 0x12c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esp + 0x128]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.0040354a
cmp byte [esp + 0xe], 0
jne 0x405d71
cmp byte [esp + 0x1e], 0
jne 0x405d71
mov eax, dword [esp + 0xb4]
and word [eax], 0
push dword [esp + 0xa0]
and dword [esp + 0xbc], 0
inc dword [esp + 0x24]
call fcn.0041383a
pop ecx
push dword [esp + 0x6c]
call fcn.0041383a
pop ecx
push dword [esp + 0x94]
call fcn.0041383a
pop ecx
push ebx
jmp 0x405913
push dword [esp + 0x94]
call fcn.0041383a
pop ecx
push dword [esp + 0x78]
jmp 0x405d96
call fcn.004047ad
push 0xf
push ebx
call fcn.0040810a
push dword [esp + 0x9c]
call fcn.0041383a
add esp, 0xc
push dword [esp + 0x78]
call fcn.0041383a
pop ecx
push dword [esp + 0xb4]
call fcn.0041383a
pop ecx
push dword [esp + 0x48]
call fcn.0041383a
pop ecx
push dword [esp + 0x54]
call fcn.0041383a
pop ecx
push dword [esp + 0x60]
call fcn.0041383a
pop ecx
push dword [esp + 0x3c]
call fcn.0041383a
mov eax, dword [esp + 0x18]
cmp eax, ebx
pop ecx
je 0x405ce9
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 7
jmp 0x404a5a
push ebx
push 0x10
push 1
call fcn.0040810a
add esp, 0xc
call fcn.004047ad
push esi
call fcn.0041383a
pop ecx
push dword [esp + 0x6c]
call fcn.0041383a
pop ecx
push dword [esp + 0x94]
call fcn.0041383a
pop ecx
push ebx
call fcn.0041383a
pop ecx
push dword [esp + 0xb4]
call fcn.0041383a
pop ecx
push dword [esp + 0x48]
call fcn.0041383a
pop ecx
push dword [esp + 0x54]
call fcn.0041383a
pop ecx
push dword [esp + 0x60]
call fcn.0041383a
pop ecx
push dword [esp + 0x3c]
call fcn.0041383a
mov eax, dword [esp + 0x18]
test eax, eax
pop ecx
je 0x405d6a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 9
jmp 0x404a5a
push dword [esp + 0xa0]
call fcn.0041383a
pop ecx
push dword [esp + 0x6c]
call fcn.0041383a
pop ecx
push dword [esp + 0x94]
call fcn.0041383a
pop ecx
push ebx
call fcn.0041383a
xor ebx, ebx
cmp dword [0x425028], ebx
pop ecx
jne 0x405e00
call fcn.00403cab
push dword [esp + 0xb0]
lea eax, [esp + 0x2c]
push dword [esp + 0x28]
push 0x41ff10
push eax
push 0x40453b
call fcn.00404615
add esp, 0x14
push dword [0x42504c]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push dword [esp + 0xac]
lea eax, [esp + 0x2c]
push dword [esp + 0x28]
push str.Delete
push eax
push 0x4045e7
call fcn.00404615
add esp, 0x14
call fcn.004047ad
push dword [esp + 0xb4]
call fcn.0041383a
pop ecx
cmp dword [0x423f74], 0xffffffff
jne 0x405e2a
cmp byte [esp + 0xd], bl
jne 0x405ea9
mov dword [0x423f74], 1
cmp dword [0x423f74], ebx
jle 0x405ea9
push str.FinishMessage
xor ebx, ebx
lea edi, [esp + 0x2c]
call fcn.004022a3
mov edi, eax
test edi, edi
pop ecx
je 0x405ea9
mov eax, 0x3e7
cmp dword [0x423f74], eax
jle 0x405e5b
mov dword [0x423f74], eax
lea esi, [esp + 0x138]
call fcn.004065a8
lea eax, [esp + 0x174]
mov dword [esp + 0x138], 0x420020
call fcn.004018b5
push 0
push dword [0x424edc]
mov eax, edi
push 0x11
mov ecx, esi
mov dword [esp + 0x17c], 0x7d5
call fcn.00406be6
push dword [esp + 0x174]
call fcn.0041383a
pop ecx
cmp byte [esp + 0xf], 0
jne 0x405eeb
cmp dword [0x425028], 0
jne 0x405eeb
push str.SelfDelete
xor ebx, ebx
lea edi, [esp + 0x2c]
call fcn.004022a3
test eax, eax
pop ecx
je 0x405eeb
cmp word [eax], 0x31
jne 0x405eeb
sub esp, 0xc
mov edi, 0x42507c
mov eax, esp
call fcn.00401661
call fcn.0040607a
add esp, 0xc
push dword [esp + 0x48]
call fcn.0041383a
pop ecx
push dword [esp + 0x54]
call fcn.0041383a
pop ecx
push dword [esp + 0x60]
call fcn.0041383a
pop ecx
push dword [esp + 0x3c]
call fcn.0041383a
mov eax, dword [esp + 0x18]
test eax, eax
pop ecx
je 0x405f21
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [esp + 0x88]
call fcn.0041383a
pop ecx
lea ecx, [esp + 0x28]
mov dword [esp + 0x28], 0x420018
call fcn.0040ea49
lea ecx, [esp + 0x28]
call fcn.0040ea1d
push dword [esp + 0xe4]
call fcn.0041383a
pop ecx
push dword [esp + 0xc0]
call fcn.0041383a
pop ecx
xor eax, eax
jmp 0x405f7d
push 0x10
push str.7_Zip_SFX
push str.Sorry__this_program_requires_Microsoft_Windows_2000_or_later.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x14
pop eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret