Function at 0x406a70
Capabilities:
Accept command line arguments
Check for time delay via gettickcount
Check if file exists
Get file attributes
Log keystrokes via polling
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
cmp eax, 0x1a2890
je 0x407510
call esi
cmp eax, 0x7a33
je 0x407510
call esi
cmp eax, 0xf4240
je 0x407510
push 0x406a50
call sub.api_ms_win_crt_runtime_l1_1_0.dll__set_new_handler
add esp, 4
lea ecx, [ebp - 0x5c]
call fcn.00401290
lea ecx, [ebp - 0x74]
call fcn.00401290
lea ecx, [ebp - 0x38]
call fcn.00401290
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.FreeConsole
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
call fcn.00406700
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call fcn.004046e0
add esp, 8
lea ecx, [ebp - 0x38]
push eax
call fcn.00401b90
lea eax, [ebp - 0x38]
push eax
call fcn.00404ba0
add esp, 4
lea ecx, [ebp - 0x38]
call fcn.004012e0
mov edi, eax
push str.sfxversion
push edi
call fcn.00405ea0
add esp, 8
test eax, eax
je 0x406b5e
call fcn.00406810
xor esi, esi
lea ecx, [ebp - 0x38]
call fcn.00401650
lea ecx, [ebp - 0x74]
call fcn.00401650
lea ecx, [ebp - 0x5c]
call fcn.00401650
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x208
push 0x208
mov ecx, 0x4265b8
call fcn.00403c00
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x406b92
push 6
push 1
call fcn.004093a0
add esp, 8
mov esi, 1
jmp 0x406b3d
mov ecx, 0x4265b8
call fcn.00404b80
push str.sfxtest
push edi
call fcn.00405ea0
add esp, 8
test eax, eax
je 0x406bb5
mov esi, 0x64
jmp 0x406b3d
push str.sfxcreate
push edi
call fcn.00405ea0
add esp, 8
test eax, eax
je 0x406bf9
push eax
mov ecx, 0x4265b8
call fcn.004012e0
push eax
call fcn.00405590
add esp, 8
test al, al
jne 0x406b3b
push 0xa
push 0
call fcn.004093a0
add esp, 8
mov esi, 4
jmp 0x406b3d
push 0x4265b8
mov ecx, 0x42655c
call fcn.00401b70
push 0x4265b8
mov ecx, 0x426568
call fcn.00401b70
push 0x4265b8
call fcn.00403d10
mov esi, eax
add esp, 4
test esi, esi
js 0x406ccc
push esi
mov ecx, 0x42655c
call fcn.00401b10
mov ecx, 0x4265b8
call fcn.004012e0
mov ecx, 0x426568
lea eax, [eax + esi*2]
add eax, 2
push eax
call fcn.00401b90
mov ecx, 0x4265b8
call fcn.004012e0
mov ecx, 0x426580
lea eax, [eax + esi*2]
add eax, 2
push eax
call fcn.00401b90
push 0x2e
mov ecx, 0x426580
call fcn.00413560
test eax, eax
jle 0x406c8a
push eax
mov ecx, 0x426580
call fcn.00401b10
push 0x426580
mov ecx, 0x426574
call fcn.00401b70
push 4
call fcn.00403e20
add esp, 4
mov ecx, 0x426574
push eax
call fcn.00412fb0
mov ecx, 0x426580
call fcn.004012e0
mov ecx, 0x426574
mov dword [0x426518], eax
call fcn.004012e0
mov dword [0x42651c], eax
call fcn.004040b0
push eax
mov ecx, 0x42658c
call fcn.00401b90
mov ecx, 0x4265b8
call fcn.004012e0
push eax
mov ecx, 0x426598
call fcn.004013d0
test al, al
jne 0x406d16
mov ecx, 0x4265b8
call fcn.004012e0
push eax
push 7
push 1
call fcn.004093a0
add esp, 0xc
mov esi, 2
jmp 0x406b3d
lea ecx, [ebp - 0x44]
call fcn.00402df0
mov ecx, 0x4265c4
call fcn.00405540
lea eax, [ebp - 0x44]
mov ecx, 0x426598
push eax
push 0
call fcn.00405e90
push eax
call fcn.00404630
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x4074fe
push 0x422518
push edi
call fcn.00405ea0
mov edx, eax
add esp, 8
test edx, edx
je 0x406dd6
movzx ecx, word [edx]
mov eax, ecx
cmp ecx, 0x3a
jne 0x406d70
movzx eax, word [edx + 2]
add edx, 2
test ax, ax
je 0x406f59
movzx ecx, ax
nop dword [eax]
cmp cx, 0x20
ja 0x406da3
movzx eax, word [edx + 2]
add edx, 2
mov ecx, eax
test ax, ax
jne 0x406d80
lea ecx, [ebp - 0x44]
xor esi, esi
call fcn.00401650
jmp 0x406b3d
lea eax, [ebp - 0x44]
push eax
push edx
call fcn.004062c0
add esp, 8
test al, al
jne 0x406f59
push 0xa
push 0
call fcn.004093a0
add esp, 8
lea ecx, [ebp - 0x44]
mov esi, 4
call fcn.00401650
jmp 0x406b3d
mov eax, dword [0x426090]
mov esi, 0x426090
test eax, eax
je 0x406e28
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
nop word [eax + eax]
push eax
lea eax, [ebp - 0xcc]
push str.SfxString_d
push eax
call ebx
add esp, 0xc
push 0
push dword [esi]
call fcn.00403e20
add esp, 4
push eax
lea eax, [ebp - 0xcc]
push eax
call fcn.004050e0
mov eax, dword [esi + 0x10]
lea esi, [esi + 0x10]
add esp, 0xc
test eax, eax
jne 0x406df0
push edi
mov ecx, 0x426598
call fcn.004063e0
call fcn.00401730
mov ebx, eax
test ebx, ebx
jne 0x406e4e
lea ecx, [ebp - 0x44]
lea esi, [eax + 0x20]
call fcn.00401650
jmp 0x406b3d
call fcn.00406410
mov ecx, 0x426598
call fcn.00401430
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push str.SetEnvironment
call fcn.00404420
mov esi, eax
add esp, 8
test esi, esi
je 0x406ee5
nop dword [eax + eax]
push esi
lea ecx, [ebp - 0xc]
call fcn.00401620
push 0x3d
lea ecx, [ebp - 0xc]
call fcn.00403b00
mov edi, eax
lea ecx, [ebp - 0xc]
test edi, edi
jle 0x406ee0
push edi
call fcn.00401b10
lea eax, [esi + 2]
push 0
lea eax, [eax + edi*2]
push eax
lea ecx, [ebp - 0xc]
call fcn.004012e0
push eax
call fcn.004050e0
inc dword [ebp - 0x10]
lea ecx, [ebp - 0xc]
add esp, 0xc
call fcn.00401650
lea eax, [ebp - 0x10]
push eax
push str.SetEnvironment
call fcn.00404420
mov esi, eax
add esp, 8
test esi, esi
jne 0x406e80
jmp 0x406ee5
call fcn.00401650
call fcn.00406660
mov esi, dword [0x426300]
xor eax, eax
cmp esi, 0xffffffff
mov ecx, 0x426598
cmove esi, eax
mov dword [0x426300], esi
call fcn.00405e80
test al, al
je 0x406f68
push 0
push str.HelpText
call fcn.00404420
mov esi, eax
add esp, 8
test esi, esi
jne 0x406f2d
push 0x18
call fcn.00403e20
add esp, 4
mov esi, eax
lea ecx, [ebp - 0xc8]
call fcn.004053b0
push 0
push esi
push dword [0x426518]
lea ecx, [ebp - 0xc8]
push 0x11
call fcn.00409500
lea ecx, [ebp - 0xc8]
call fcn.00405470
lea ecx, [ebp - 0x44]
xor esi, esi
call fcn.00401650
jmp 0x406b3d
mov ecx, 0x426598
call fcn.00405e40
test al, al
je 0x406f82
and esi, 0xfffffeff
mov dword [0x426300], esi
push 6
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
push 0
push str.InstallPath
call fcn.00404420
add esp, 8
test eax, eax
je 0x406fb1
push eax
mov ecx, 0x426550
call fcn.00401b90
mov byte [0x426541], 1
push 0x426550
call fcn.00406250
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
add esp, 4
push 0
push str.BeginPrompt
call fcn.00404420
mov esi, eax
add esp, 8
test esi, esi
je 0x407021
mov ecx, 0x426598
call fcn.00405e40
test al, al
jne 0x407021
push esi
push dword [0x426518]
call fcn.004092a0
add esp, 8
test eax, eax
je 0x407161
push 0x10
call edi
bt ax, 0xf
jae 0x407021
push 1
mov ecx, 0x426598
call fcn.00401b30
push 1
mov ecx, 0x426598
call fcn.00401b20
lea ecx, [ebp - 0x1c]
call fcn.00401290
mov ecx, 0x426598
call fcn.00405e50
test al, al
je 0x4070a9
mov ecx, 0x426598
call fcn.00405e60
mov esi, eax
push str.AutoInstall
lea ecx, [ebp - 0x1c]
call fcn.00401b90
movzx ecx, word [esi]
push ecx
lea ecx, [ebp - 0x1c]
call fcn.00401660
push 0
lea ecx, [ebp - 0x1c]
call fcn.004012e0
push eax
call fcn.00404420
add esp, 8
test eax, eax
je 0x407173
movzx eax, word [esi + 2]
add esi, 2
cmp eax, 0x30
jb 0x407088
cmp eax, 0x39
jbe 0x407043
cmp eax, 0x61
jb 0x407092
cmp eax, 0x7a
jbe 0x407043
cmp eax, 0x41
jb 0x40709c
cmp eax, 0x5a
jbe 0x407043
push str.AutoInstall
lea ecx, [ebp - 0x1c]
call fcn.00401b90
lea ecx, [ebp - 0x1c]
mov byte [ebp - 0x20], 0
call fcn.00404540
test al, al
je 0x4070dd
push 0
push str.ExecuteFile
call fcn.00404420
add esp, 8
test eax, eax
je 0x4070dd
push str.ExecuteFile
lea ecx, [ebp - 0x1c]
call fcn.00401b90
mov byte [ebp - 0x20], 1
lea ecx, [ebp - 0x1c]
call fcn.00404540
test al, al
je 0x407109
push 0
push str.RunProgram
call fcn.00404420
add esp, 8
test eax, eax
je 0x407109
push str.RunProgram
lea ecx, [ebp - 0x1c]
call fcn.00401b90
mov ecx, 0x426598
call fcn.00405e50
test al, al
jne 0x40719c
mov ecx, 0x426598
call fcn.00405e40
test al, al
jne 0x40719c
mov eax, dword [0x426300]
and al, 0xc0
cmp al, 0x80
jne 0x40719c
push dword [0x42652c]
push dword [0x426528]
call fcn.004094b0
add esp, 8
test eax, eax
jne 0x40719c
cmp byte [0x426540], al
je 0x407192
lea ecx, [ebp - 0x1c]
call fcn.00401650
jmp 0x406fc4
lea ecx, [ebp - 0x44]
mov esi, 5
call fcn.00401650
jmp 0x406b3d
lea ecx, [ebp - 0x1c]
call fcn.004012e0
push eax
push 0xe
push 0
call fcn.004093a0
add esp, 0xc
mov esi, 6
jmp 0x4074f6
mov esi, 5
jmp 0x4074f6
mov ecx, 0x426550
call fcn.00404540
test al, al
je 0x4071d7
lea eax, [ebp - 0x2c]
push str.7ZipSfx._03x
push eax
call fcn.00403640
add esp, 8
mov ecx, 0x426550
push eax
call fcn.00401b70
lea ecx, [ebp - 0x2c]
call fcn.00401650
mov byte [0x426541], 0
jmp 0x407219
push 0x426550
lea ecx, [ebp - 0xc]
call fcn.00402280
lea eax, [ebp - 0xc]
push eax
call fcn.00406250
add esp, 4
lea ecx, [ebp - 0xc]
call fcn.00404540
test al, al
jne 0x40720a
lea eax, [ebp - 0xc]
mov ecx, 0x426550
push eax
call fcn.00401b70
lea ecx, [ebp - 0xc]
mov byte [0x426541], 1
call fcn.00401650
mov ecx, 0x426550
call fcn.00401fd0
mov ecx, 0x426550
mov esi, eax
call fcn.004012e0
movzx ecx, word [eax + esi*2 - 2]
cmp ecx, 0x5c
je 0x40723e
cmp ecx, 0x2f
jne 0x40724c
lea eax, [esi - 1]
mov ecx, 0x426550
push eax
call fcn.00401b10
mov ecx, 0x426598
call fcn.00405e40
test al, al
je 0x407261
or dword [0x42653c], 3
push 0x426550
call fcn.00402630
add esp, 4
test eax, eax
je 0x407281
call fcn.004066e0
mov esi, 8
jmp 0x4074f6
call fcn.00406660
mov ecx, 0x426598
call fcn.00405e70
test al, al
je 0x4072a1
cmp byte [0x426541], 0
jne 0x407437
lea ecx, [ebp - 0xc]
call fcn.00401290
lea ecx, [ebp - 0x2c]
call fcn.00401290
mov ecx, 0x426598
call fcn.00405e50
test al, al
jne 0x4072cb
lea eax, [ebp - 0xc]
push eax
call fcn.00401f60
add esp, 4
lea ecx, [ebp - 0x1c]
call fcn.00404540
test al, al
je 0x4073a2
cmp byte [0x426541], 0
jne 0x4073ce
push str.setup.exe
push 0x421904
lea eax, [ebp - 0x50]
push 0x426550
push eax
call fcn.00412eb0
add esp, 0xc
push eax
lea eax, [ebp - 0x68]
push eax
call fcn.00412eb0
add esp, 0xc
mov ecx, eax
call fcn.004012e0
push eax
lea ecx, [ebp - 0x2c]
call fcn.00401b90
lea ecx, [ebp - 0x68]
call fcn.00401640
lea ecx, [ebp - 0x50]
call fcn.00401640
lea ecx, [ebp - 0x2c]
call fcn.004012e0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40736f
call fcn.004066e0
push 0xf
push 0
call fcn.004093a0
add esp, 8
lea ecx, [ebp - 0x2c]
call fcn.00401650
lea ecx, [ebp - 0xc]
call fcn.00401650
mov esi, 7
jmp 0x4074f6
push ebx
lea eax, [ebp - 0xc]
mov ecx, 0x426550
push eax
push dword [ebp - 0x20]
call fcn.004012e0
push eax
push str.setup.exe
lea ecx, [ebp - 0x50]
call fcn.00401620
push eax
call fcn.00401ca0
add esp, 0x14
lea ecx, [ebp - 0x50]
call fcn.00401650
jmp 0x4073ce
push ebx
lea eax, [ebp - 0xc]
mov ecx, 0x426598
push eax
call fcn.00405e60
push eax
mov ecx, 0x426550
call fcn.004012e0
push eax
lea ecx, [ebp - 0x1c]
call fcn.004012e0
push eax
call fcn.00401bc0
add esp, 0x14
call fcn.00406660
push 0xffffffffffffffff
mov ecx, 0x426598
call fcn.00405e60
push eax
push str.Shortcut
push 0x405f90
call fcn.004060a0
add esp, 0x10
mov ecx, 0x42655c
call fcn.004012e0
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 0xffffffffffffffff
mov ecx, 0x426598
call fcn.00405e60
push eax
push str.Delete
push 0x405f50
call fcn.004060a0
add esp, 0x10
call fcn.004066e0
lea ecx, [ebp - 0x2c]
call fcn.00401650
lea ecx, [ebp - 0xc]
call fcn.00401650
mov eax, dword [0x42630c]
cmp eax, 0xffffffff
jne 0x40745b
mov ecx, 0x426598
call fcn.00405e40
test al, al
jne 0x4074b6
mov dword [0x42630c], 1
jmp 0x40745f
test eax, eax
jle 0x4074b6
push 0
push str.FinishMessage
call fcn.00404420
mov esi, eax
add esp, 8
test esi, esi
je 0x4074b6
mov ecx, dword [0x42630c]
mov eax, 0x3e7
cmp ecx, eax
cmovg ecx, eax
mov dword [0x42630c], ecx
lea ecx, [ebp - 0xc4]
call fcn.00405390
push 0
push esi
push dword [0x426518]
lea ecx, [ebp - 0xc4]
push 0x11
call fcn.00409500
lea ecx, [ebp - 0xc4]
call fcn.00405470
mov ecx, 0x426598
call fcn.00405e70
test al, al
jne 0x4074f4
push 0
push str.SelfDelete
call fcn.00404420
add esp, 8
test eax, eax
je 0x4074f4
cmp word [eax], 0x31
jne 0x4074f4
sub esp, 0xc
mov ecx, esp
push 0x4265b8
call fcn.00402280
call fcn.00405c50
add esp, 0xc
xor esi, esi
lea ecx, [ebp - 0x1c]
call fcn.00401650
lea ecx, [ebp - 0x44]
call fcn.00401650
jmp 0x406b3d
jmp 0x407510