Function at 0x404e5f
Capabilities:
Accept command line arguments
Check for time delay via gettickcount
Check if file exists
Encode data using xor
Get file attributes
Log keystrokes via polling
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
push edi
push 0x404e48
call sub.api_ms_win_crt_runtime_l1_1_0.dll__set_new_handler
pop ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
call edi
xor ebx, ebx
inc ebx
cmp eax, 0x1a2890
je 0x404ea2
call edi
cmp eax, 0x7a33
je 0x404ea2
call edi
cmp eax, 0xf4240
jne 0x404ebf
mov ecx, esi
neg ecx
mov eax, ecx
xor eax, esi
test bl, al
jne 0x404ebf
mov edx, 0x221e
sub ecx, edx
add esi, edx
mov eax, ecx
xor eax, esi
test bl, al
je 0x404eb3
lea ecx, [ebp - 0x5c]
call fcn.0040e457
lea ecx, [ebp - 0x74]
call fcn.0040e457
lea ecx, [ebp - 0x44]
call fcn.0040e457
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.FreeConsole
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
call fcn.00404b55
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call fcn.00403800
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x44]
call fcn.0040e589
lea eax, [ebp - 0x44]
push eax
call fcn.00403b58
mov edi, dword [ebp - 0x44]
mov dword [esp], str.sfxversion
push edi
call fcn.00404458
pop ecx
pop ecx
test eax, eax
je 0x404f3b
call fcn.00404c43
xor ebx, ebx
jmp 0x405776
mov eax, 0x208
mov ecx, 0x4215b8
push eax
push eax
call fcn.00402f39
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x404f67
push 6
push ebx
call fcn.00407280
pop ecx
jmp 0x405775
mov esi, dword [0x4215b8]
push esi
call fcn.004039dd
xor ecx, ecx
mov dword [0x4215bc], eax
mov dword [esp], str.sfxtest
push edi
mov word [esi + eax*2], cx
call fcn.00404458
pop ecx
pop ecx
test eax, eax
je 0x404f98
push 0x64
jmp 0x40508a
mov esi, 0x4215b8
mov ecx, 0x42155c
push esi
call fcn.0040e522
push esi
mov ecx, 0x421568
call fcn.0040e522
push esi
call fcn.00403008
mov esi, eax
pop ecx
test esi, esi
js 0x405053
mov edx, dword [0x42155c]
xor eax, eax
mov dword [0x421560], esi
mov ecx, 0x421568
mov word [edx + esi*2], ax
mov eax, dword [0x4215b8]
lea eax, [eax + esi*2]
add eax, 2
push eax
call fcn.0040e589
mov eax, dword [0x4215b8]
lea eax, [eax + esi*2]
mov esi, 0x421580
add eax, 2
mov ecx, esi
push eax
call fcn.0040e589
push 0x2e
mov ecx, esi
call fcn.0040eb0a
test eax, eax
jle 0x405022
mov ecx, dword [0x421580]
xor edx, edx
mov dword [0x421584], eax
mov word [ecx + eax*2], dx
push esi
mov esi, 0x421574
mov ecx, esi
call fcn.0040e522
push 4
call fcn.004030a0
pop ecx
push eax
mov ecx, esi
call fcn.0040e6f7
mov eax, dword [0x421580]
mov dword [0x421518], eax
mov eax, dword [0x421574]
mov dword [0x42151c], eax
call fcn.004032f6
push eax
mov ecx, 0x42158c
call fcn.0040e589
push dword [0x4215b8]
mov ecx, 0x421598
call fcn.0040126c
test al, al
jne 0x405090
push dword [0x4215b8]
push 7
push ebx
call fcn.00407280
add esp, 0xc
push 2
pop ebx
jmp 0x405776
lea ecx, [ebp - 0x50]
call fcn.0040e383
mov ecx, 0x4215c4
call fcn.0040428a
lea eax, [ebp - 0x50]
push eax
push 0
push dword [0x42159c]
call fcn.0040377f
add esp, 0xc
test eax, eax
je 0x4050c1
mov ebx, eax
jmp 0x40576d
push str.sfxconfig
push edi
call fcn.00404458
mov edx, eax
pop ecx
pop ecx
test edx, edx
je 0x405139
movzx ecx, word [edx]
mov eax, ecx
cmp ecx, 0x3a
jne 0x4050e4
add edx, 2
movzx eax, word [edx]
test ax, ax
je 0x40529d
push 0x20
movzx ecx, ax
pop edi
movzx esi, cx
cmp cx, di
ja 0x40510a
add edx, 2
movzx eax, word [edx]
mov ecx, eax
mov esi, eax
test ax, ax
jne 0x4050f3
test si, si
je 0x40529d
lea eax, [ebp - 0x50]
push eax
push edx
call fcn.004047b0
pop ecx
pop ecx
test al, al
jne 0x40529d
push 0xa
push 0
call fcn.00407280
pop ecx
pop ecx
push 4
jmp 0x40544c
mov eax, dword [0x421090]
mov esi, 0x421090
jmp 0x40517a
push eax
lea eax, [ebp - 0xcc]
push str.SfxString_d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0
push dword [esi]
call fcn.004030a0
pop ecx
push eax
lea eax, [ebp - 0xcc]
push eax
call fcn.00404033
lea esi, [esi + 0x10]
add esp, 0xc
mov eax, dword [esi]
test eax, eax
jne 0x405145
mov esi, 0x421598
push edi
mov ecx, esi
call fcn.004048c0
call fcn.0040147d
mov edi, eax
test edi, edi
jne 0x40519d
push 0x20
jmp 0x40544c
call fcn.004048e2
mov ecx, esi
call fcn.004012a1
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
push str.SetEnvironment
call fcn.004035c2
pop ecx
pop ecx
jmp 0x405210
push esi
lea ecx, [ebp - 0xc]
call fcn.0040e420
push 0x3d
push dword [ebp - 0xc]
call fcn.0040e7e1
pop ecx
pop ecx
test eax, eax
jle 0x405218
mov ecx, dword [ebp - 0xc]
xor edx, edx
add esi, 2
mov dword [ebp - 8], eax
push edx
mov word [ecx + eax*2], dx
lea eax, [esi + eax*2]
push eax
push dword [ebp - 0xc]
call fcn.00404033
push dword [ebp - 0xc]
inc dword [ebp - 0x10]
call fcn.0041a3c0
lea eax, [ebp - 0x10]
push eax
push str.SetEnvironment
call fcn.004035c2
add esp, 0x18
mov esi, eax
test esi, esi
jne 0x4051bf
jmp 0x405221
push dword [ebp - 0xc]
call fcn.0041a3c0
pop ecx
call fcn.00404ae8
mov eax, dword [0x421300]
xor ecx, ecx
cmp eax, 0xffffffff
cmove eax, ecx
mov dword [0x421300], eax
cmp byte [0x4215ab], cl
je 0x4052a4
push ecx
push str.HelpText
call fcn.004035c2
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x40525d
push 0x18
call fcn.004030a0
pop ecx
mov esi, eax
lea ecx, [ebp - 0xc8]
call fcn.00405798
push 0
push esi
push dword [0x421518]
lea ecx, [ebp - 0xc8]
mov dword [ebp - 0xc8], 0x41d3cc
push 0x11
mov dword [ebp - 0x90], 0x7d6
call fcn.004073d3
lea ecx, [ebp - 0xc8]
call fcn.004057f9
xor ebx, ebx
jmp 0x40576d
cmp byte [0x4215a9], cl
je 0x4052b6
and eax, 0xfffffeff
mov dword [0x421300], eax
push 6
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
push 0
push str.InstallPath
call fcn.004035c2
mov esi, 0x421550
pop ecx
pop ecx
test eax, eax
je 0x4052e5
push eax
mov ecx, esi
call fcn.0040e589
mov byte [0x421541], bl
push esi
call fcn.00404757
pop ecx
push 0
push str.BeginPrompt
call fcn.004035c2
pop ecx
pop ecx
test eax, eax
je 0x40533b
cmp byte [0x4215a9], 0
jne 0x40533b
push eax
push dword [0x421518]
call fcn.00407180
pop ecx
pop ecx
test eax, eax
je 0x40544a
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x40533b
mov byte [0x4215a8], bl
mov byte [0x4215a9], bl
lea ecx, [ebp - 0x1c]
call fcn.0040e457
cmp byte [0x4215a8], 0
je 0x4053b0
mov esi, dword [0x4215a4]
push str.AutoInstall
lea ecx, [ebp - 0x1c]
call fcn.0040e589
movzx eax, word [esi]
lea ecx, [ebp - 0x1c]
push eax
call fcn.004013e1
push 0
push dword [ebp - 0x1c]
call fcn.004035c2
pop ecx
pop ecx
test eax, eax
je 0x405452
add esi, 2
movzx eax, word [esi]
cmp eax, 0x30
jb 0x40538f
cmp eax, 0x39
jbe 0x405352
cmp eax, 0x61
jb 0x405399
cmp eax, 0x7a
jbe 0x405352
cmp eax, 0x41
jb 0x4053a3
cmp eax, 0x5a
jbe 0x405352
push str.AutoInstall
lea ecx, [ebp - 0x1c]
call fcn.0040e589
cmp dword [ebp - 0x18], 0
mov byte [ebp - 0x20], 0
jne 0x405401
push 0
push str.ExecuteFile
call fcn.004035c2
pop ecx
pop ecx
test eax, eax
je 0x4053dc
push str.ExecuteFile
lea ecx, [ebp - 0x1c]
call fcn.0040e589
mov byte [ebp - 0x20], bl
cmp dword [ebp - 0x18], 0
jne 0x405401
push 0
push str.RunProgram
call fcn.004035c2
pop ecx
pop ecx
test eax, eax
je 0x405401
push str.RunProgram
lea ecx, [ebp - 0x1c]
call fcn.0040e589
cmp byte [0x4215a8], 0
jne 0x40546f
cmp byte [0x4215a9], 0
jne 0x40546f
mov eax, dword [0x421300]
and al, 0xc0
cmp al, 0x80
jne 0x40546f
push dword [0x42152c]
push dword [0x421528]
call fcn.00407379
pop ecx
pop ecx
test eax, eax
jne 0x40546f
cmp byte [0x421540], al
je 0x405468
push dword [ebp - 0x1c]
call fcn.0041a3c0
jmp 0x4052eb
push 5
pop ebx
jmp 0x40576d
push dword [ebp - 0x1c]
push 0xe
push 0
call fcn.00407280
add esp, 0xc
push 6
jmp 0x4055f4
push 5
jmp 0x4055f4
cmp dword [0x421554], 0
jne 0x4054a6
lea eax, [ebp - 0x2c]
push str.7ZipSfx._03x
push eax
call fcn.00402ac3
pop ecx
pop ecx
mov esi, 0x421550
push eax
mov ecx, esi
call fcn.0040e522
push dword [ebp - 0x2c]
call fcn.0041a3c0
mov byte [0x421541], 0
jmp 0x4054dd
mov esi, 0x421550
lea ecx, [ebp - 0xc]
push esi
call fcn.0040e3ef
lea eax, [ebp - 0xc]
push eax
call fcn.00404757
cmp dword [ebp - 8], 0
pop ecx
je 0x4054cf
lea eax, [ebp - 0xc]
mov ecx, esi
push eax
call fcn.0040e522
push dword [ebp - 0xc]
mov byte [0x421541], bl
call fcn.0041a3c0
mov edx, dword [0x421554]
pop ecx
mov ecx, dword [0x421550]
movzx eax, word [ecx + edx*2 - 2]
cmp eax, 0x5c
je 0x4054f9
cmp eax, 0x2f
jne 0x405507
lea eax, [edx - 1]
xor edx, edx
mov dword [0x421554], eax
mov word [ecx + eax*2], dx
cmp byte [0x4215a9], 0
je 0x405517
or dword [0x42153c], 3
push esi
call fcn.00401e72
pop ecx
test eax, eax
je 0x40552e
call fcn.00404b3f
push 8
jmp 0x4055f4
call fcn.00404ae8
cmp byte [0x4215aa], 0
je 0x405549
cmp byte [0x421541], 0
jne 0x4056a2
lea ecx, [ebp - 0xc]
call fcn.0040e457
lea ecx, [ebp - 0x38]
call fcn.0040e457
cmp byte [0x4215a8], 0
jne 0x40556c
lea eax, [ebp - 0xc]
push eax
call fcn.00401b16
pop ecx
cmp dword [ebp - 0x18], 0
jne 0x40562c
cmp byte [0x421541], 0
jne 0x405648
push str.setup.exe
push 0x41c898
lea eax, [ebp - 0x68]
push esi
push eax
call fcn.0040e635
add esp, 0xc
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.0040e635
add esp, 0xc
lea ecx, [ebp - 0x38]
push dword [eax]
call fcn.0040e589
push dword [ebp - 0x2c]
call fcn.0041a3c0
push dword [ebp - 0x68]
call fcn.0041a3c0
pop ecx
pop ecx
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4055fa
call fcn.00404b3f
push 0xf
push 0
call fcn.00407280
push dword [ebp - 0x38]
call fcn.0041a3c0
push dword [ebp - 0xc]
call fcn.0041a3c0
add esp, 0x10
push 7
pop ebx
jmp 0x405764
mov esi, dword [0x421550]
lea ecx, [ebp - 0x2c]
push str.setup.exe
call fcn.0040e420
push edi
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x20]
lea eax, [ebp - 0x2c]
push esi
push eax
call fcn.00401896
push dword [ebp - 0x2c]
call fcn.0041a3c0
add esp, 0x18
jmp 0x405648
push edi
lea eax, [ebp - 0xc]
push eax
push dword [0x4215a4]
push dword [0x421550]
push dword [ebp - 0x1c]
call fcn.004017ca
add esp, 0x14
call fcn.00404ae8
push 0xffffffffffffffff
push dword [0x4215a4]
push str.Shortcut
push 0x40452a
call fcn.00404607
add esp, 0x10
push dword [0x42155c]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 0xffffffffffffffff
push dword [0x4215a4]
push str.Delete
push 0x4044fb
call fcn.00404607
call fcn.00404b3f
push dword [ebp - 0x38]
call fcn.0041a3c0
push dword [ebp - 0xc]
call fcn.0041a3c0
add esp, 0x18
mov eax, dword [0x42130c]
cmp eax, 0xffffffff
jne 0x4056bc
cmp byte [0x4215a9], 0
jne 0x40572a
mov eax, ebx
mov dword [0x42130c], eax
test eax, eax
jle 0x40572a
push 0
push str.FinishMessage
call fcn.004035c2
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x40572a
mov ecx, dword [0x42130c]
mov eax, 0x3e7
cmp ecx, eax
cmovg ecx, eax
mov dword [0x42130c], ecx
lea ecx, [ebp - 0xc4]
call fcn.00405798
push 0
push esi
push dword [0x421518]
lea ecx, [ebp - 0xc4]
mov dword [ebp - 0xc4], 0x41d39c
push 0x11
mov dword [ebp - 0x8c], 0x7d5
call fcn.004073d3
lea ecx, [ebp - 0xc4]
call fcn.004057f9
cmp byte [0x4215aa], 0
jne 0x405762
push 0
push str.SelfDelete
call fcn.004035c2
pop ecx
pop ecx
test eax, eax
je 0x405762
cmp word [eax], 0x31
jne 0x405762
sub esp, 0xc
mov ecx, esp
push 0x4215b8
call fcn.0040e3ef
call fcn.004042ae
add esp, 0xc
xor ebx, ebx
push dword [ebp - 0x1c]
call fcn.0041a3c0
pop ecx
push dword [ebp - 0x50]
call fcn.0041a3c0
pop ecx
push dword [ebp - 0x44]
call fcn.0041a3c0
push dword [ebp - 0x74]
call fcn.0041a3c0
push dword [ebp - 0x5c]
call fcn.0041a3c0
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret