Function at 0x406093
Capabilities:
Accept command line arguments
Check if file exists
Check os version
Get file attributes
Log keystrokes via polling
Set current directory

Disassembly:
push ebp
lea ebp, [esp - 0x68]
sub esp, 0x228
push ebx
push esi
push edi
push 0x405afe
call dword [sym.imp.msvcrt.dll_int____cdecl___unsigned_int____cdecl__set_new_handler_int____cdecl___unsigned_int__]
pop ecx
call fcn.004038a3
lea eax, [ebp - 0x1c0]
push eax
mov dword [ebp - 0x1c0], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x406f6d
cmp dword [ebp - 0x1b0], 2
jne 0x406f6d
cmp dword [ebp - 0x1bc], 5
jb 0x406f6d
lea ecx, [ebp + 0x24]
mov byte [str.___InstallEnd__], 0x3b
mov byte [str.___Install__UTF_8_], 0x3b
call fcn.0040eb1f
lea ecx, [ebp - 0x48]
call fcn.0040eb1f
lea ecx, [ebp - 8]
call fcn.0040eb1f
call fcn.00405489
mov esi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
call esi
lea edx, [ebp + 0x24]
mov ecx, eax
call fcn.00403091
push eax
lea ecx, [ebp - 8]
call fcn.0040eba4
lea ecx, [ebp - 8]
call fcn.004045ed
mov edi, dword [ebp - 8]
xor ebx, ebx
inc ebx
push ebx
mov edx, 0x417d70
mov ecx, str.SfxVarModulePlatform
call fcn.00404fd8
push ebx
call fcn.00403f64
mov edx, eax
mov ecx, str.SfxVarSystemPlatform
call fcn.00404fd8
push ebx
call esi
mov edx, eax
mov ecx, str.SfxVarCmdLine0
call fcn.00404fd8
movzx eax, word [0x41b690]
push eax
push 0x418dc4
push 0x20
lea ecx, [ebp + 0x24]
call fcn.0040427a
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [ebp + 0x24]
call fcn.0040425f
mov edx, dword [ebp + 0x24]
push ebx
mov ecx, str.SfxVarSystemLanguage
call fcn.00404fd8
mov edx, str.sfxlang
mov ecx, edi
call fcn.00405729
test eax, eax
je 0x4061e2
cmp word [eax], 0x3a
jne 0x4061e2
add eax, 2
push eax
call dword [sym.imp.msvcrt.dll__wtol]
pop ecx
lea ecx, [eax - 1]
cmp ecx, 0xfffe
ja 0x4061d9
mov word [0x41b690], ax
add edi, 2
cmp word [edi], 0x20
ja 0x4061d9
mov edx, str.sfxversion
mov ecx, edi
call fcn.00405729
test eax, eax
je 0x40621b
call fcn.00405d10
xor esi, esi
push dword [ebp - 8]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp - 0x48]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp + 0x24]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 0xc
mov eax, esi
jmp 0x406f84
mov edx, str.sfxwaitall
mov ecx, edi
call fcn.00405729
test eax, eax
je 0x406236
mov ecx, eax
call fcn.00401fa4
mov esi, eax
jmp 0x4061f9
mov edx, str.sfxelevation
mov ecx, edi
mov byte [ebp + 0x67], 0
call fcn.00405729
test eax, eax
je 0x406250
mov byte [ebp + 0x67], 1
mov edi, eax
mov eax, 0x208
push eax
mov ebx, 0x41b7a4
push eax
mov ecx, ebx
call fcn.0040427a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x406282
xor esi, esi
inc esi
push 6
push esi
call fcn.00409601
pop ecx
pop ecx
jmp 0x4061f9
mov ecx, ebx
call fcn.0040425f
mov edx, str.sfxtest
mov ecx, edi
call fcn.00405729
mov esi, eax
test esi, esi
je 0x40642a
cmp word [esi], 0x3a
je 0x4062ad
push 0x64
pop esi
jmp 0x4061f9
movzx ecx, word [esi + 2]
push 0x20
mov eax, ecx
pop edi
or eax, edi
sub eax, 0x61
je 0x4063bf
dec eax
dec eax
je 0x4063ab
dec eax
je 0x406328
sub eax, 0xb
je 0x4062e0
sub eax, 7
jne 0x4062a5
mov esi, 0x4f3d
jmp 0x4061f9
cmp word [esi + 4], 0x3a
jne 0x4061f7
movzx eax, word [esi + 6]
sub eax, 0x31
je 0x406320
dec eax
je 0x406316
dec eax
je 0x406312
dec eax
je 0x406308
dec eax
jne 0x4061f7
push 7
jmp 0x4062a7
mov esi, 0x3fff
jmp 0x4061f9
push 0x1f
jmp 0x4062a7
mov esi, 0x1c1
jmp 0x4061f9
xor esi, esi
inc esi
jmp 0x4061f9
cmp ecx, 0x44
jne 0x40636a
cmp word [esi + 4], 0x3a
jne 0x4062a5
add esi, 6
jmp 0x406354
cmp ax, 0x3a
je 0x40635c
movzx eax, ax
push eax
mov ecx, 0x41b83c
call fcn.0040157d
add esi, 2
movzx eax, word [esi]
cmp ax, di
ja 0x40633d
cmp dword [0x41b840], 0
jne 0x40636d
jmp 0x4062a5
add esi, 4
and dword [0x41b834], 0
cmp word [esi], 0x3a
jne 0x406395
lea eax, [esi + 2]
push eax
call dword [sym.imp.msvcrt.dll__wtol]
pop ecx
mov dword [0x41b834], eax
cmp eax, 0xe10
ja 0x406395
test eax, eax
jne 0x40639f
mov dword [0x41b834], 0xa
mov dword [0x41b838], 1
jmp 0x4063ce
xor eax, eax
cmp word [esi + 4], 0x63
sete al
add eax, 3
mov dword [0x41b838], eax
jmp 0x4063ce
mov dword [0x41b838], 2
jmp 0x4063ce
add esi, 2
cmp word [esi], di
ja 0x4063cb
mov edx, str.sfxconfig
mov ecx, esi
mov edi, esi
call fcn.00405729
test eax, eax
je 0x40642a
cmp word [eax], 0x3a
jne 0x4063f6
jmp 0x4063f3
cmp cx, 0x20
ja 0x4063fe
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x4063ed
mov edx, dword [ebp + 0x24]
and dword [ebp + 0x28], 0
xor ecx, ecx
mov word [edx], cx
lea edx, [ebp + 0x24]
mov ecx, eax
call fcn.00403091
cmp dword [0x41b838], 2
mov edi, eax
je 0x40642a
lea eax, [ebp + 0x24]
push eax
mov ecx, ebx
call fcn.0040ec07
mov esi, 0x41b7a4
push esi
mov ecx, 0x41b6f4
call fcn.0040ec07
mov ebx, 0x41b70c
push esi
mov ecx, ebx
call fcn.0040ec07
mov ecx, esi
call fcn.00403882
test eax, eax
js 0x4064e7
mov ecx, dword [0x41b6f4]
mov dword [0x41b6f8], eax
lea esi, [eax + eax]
xor eax, eax
mov word [ecx + esi], ax
mov eax, dword [0x41b7a4]
lea eax, [eax + esi + 2]
push eax
mov ecx, ebx
call fcn.0040eba4
mov eax, dword [0x41b7a4]
lea eax, [eax + esi + 2]
mov esi, 0x41b7f0
push eax
mov ecx, esi
call fcn.0040eba4
push 0x2e
mov ecx, esi
call fcn.0040edb9
test eax, eax
jle 0x4064af
mov edx, dword [0x41b7f0]
xor ecx, ecx
mov dword [0x41b7f4], eax
mov word [edx + eax*2], cx
push esi
mov esi, 0x41b7bc
mov ecx, esi
call fcn.0040ec07
push 4
pop ecx
call fcn.00403d4f
push eax
mov ecx, esi
call fcn.0040ec62
mov eax, dword [0x41b7f0]
mov ecx, dword [0x41b7bc]
mov dword [0x41b698], eax
mov dword [0x41b6c0], ecx
mov dword [0x41b6c4], eax
call fcn.00403f64
push eax
mov ecx, 0x41b7b0
call fcn.0040eba4
push dword [0x41b7a4]
mov esi, 0x41b718
mov ecx, esi
call fcn.0040129e
test al, al
jne 0x406526
push dword [0x41b7a4]
push 7
push 1
call fcn.00409601
add esp, 0xc
push 2
jmp 0x4062a7
lea ecx, [ebp + 0x58]
call fcn.0040e702
mov ecx, 0x41b700
call fcn.00405f5a
mov ecx, dword [0x41b71c]
lea eax, [ebp + 0x58]
push eax
xor dl, dl
call fcn.00405388
mov ebx, eax
test ebx, ebx
je 0x40655f
push dword [ebp + 0x58]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
mov esi, ebx
jmp 0x4061f9
cmp dword [0x41b838], 0
jne 0x4065d5
mov edx, str.sfxconfig
mov ecx, edi
call fcn.00405729
test eax, eax
je 0x4065d5
cmp word [eax], 0x3a
jne 0x406581
add eax, 2
movzx ecx, word [eax]
test cx, cx
je 0x4068a3
cmp cx, 0x20
ja 0x40659e
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x40658d
cmp word [eax], 0
je 0x4068a3
lea edx, [ebp + 0x58]
mov ecx, eax
call fcn.00405f7e
test al, al
jne 0x4068a3
push 0xa
push 0
call fcn.00409601
push dword [ebp + 0x58]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 0xc
push 4
jmp 0x4062a7
cmp dword [0x41b838], 4
je 0x4068a3
mov eax, dword [0x41b0c8]
mov ebx, 0x41b0c8
jmp 0x40661f
push eax
lea eax, [ebp - 0xac]
push str.SfxString_d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebx]
add esp, 0xc
push 0
call fcn.00403d4f
mov edx, eax
lea ecx, [ebp - 0xac]
call fcn.00404fd8
add ebx, 0x10
mov eax, dword [ebx]
test eax, eax
jne 0x4065ee
push edi
mov ecx, esi
call fcn.0040546a
call fcn.004016f6
xor edi, edi
mov dword [ebp + 0x10], eax
cmp eax, edi
jne 0x406649
push dword [ebp + 0x58]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
push 0x20
jmp 0x4062a7
call fcn.00405798
mov ecx, esi
call fcn.004012d2
mov ecx, 0x41b700
call fcn.00405f5a
mov ecx, dword [0x41b71c]
push edi
xor dl, dl
call fcn.00405388
call fcn.00405798
mov ecx, esi
call fcn.00401337
call fcn.004016f6
call fcn.00405798
cmp byte [ebp + 0x67], 0
jne 0x4067be
test byte [0x41b6d4], 4
je 0x4067be
call fcn.00403f79
test eax, eax
jne 0x4067be
lea ecx, [ebp + 0x18]
call fcn.0040eb1f
lea ecx, [ebp - 0x30]
call fcn.0040eb1f
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea edx, [ebp + 0x18]
mov ecx, eax
call fcn.00403091
push eax
lea ecx, [ebp + 0x30]
call fcn.0040eb43
push str.sfxelevation
push 0x417b4c
lea eax, [ebp + 0x18]
push eax
mov edx, 0x417a50
lea ecx, [ebp - 0x24]
call fcn.0040eaf1
mov edx, eax
lea ecx, [ebp - 0x3c]
call fcn.0040eac7
mov edx, eax
lea ecx, [ebp - 0x54]
call fcn.0040eac7
push 0x20
push eax
lea ecx, [ebp + 4]
call fcn.0040ea21
lea eax, [ebp + 0x30]
push eax
lea edx, [ebp + 4]
lea ecx, [ebp + 0x3c]
call fcn.0040eaab
push dword [eax]
lea ecx, [ebp - 0x30]
call fcn.0040eba4
push dword [ebp + 0x3c]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp + 4]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp - 0x54]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp - 0x3c]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp - 0x24]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 0x14
push 0xffffffffffffffff
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
mov ecx, dword [ebp - 0x30]
push edi
push 2
pop edx
call fcn.00401c51
push dword [ebp + 0x30]
test eax, eax
jne 0x406799
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp - 0x30]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp + 0x18]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp + 0x58]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 0x10
push 0xb
jmp 0x4062a7
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp - 0x30]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp + 0x18]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp + 0x58]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 0x10
jmp 0x4061f7
mov esi, str.SetEnvironment
lea edx, [ebp + 0x48]
mov ecx, esi
mov dword [ebp + 0x48], edi
call fcn.00404fc8
xor ebx, ebx
jmp 0x40681d
push edi
lea ecx, [ebp + 0x3c]
call fcn.0040eb43
mov ecx, dword [ebp + 0x3c]
push 0x3d
pop edx
call fcn.0040e54c
cmp eax, ebx
jle 0x406825
mov edx, dword [ebp + 0x3c]
mov dword [ebp + 0x40], eax
add eax, eax
xor ecx, ecx
mov word [edx + eax], cx
mov ecx, dword [ebp + 0x3c]
push ebx
lea edx, [eax + edi + 2]
call fcn.00404fd8
push dword [ebp + 0x3c]
inc dword [ebp + 0x48]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
lea edx, [ebp + 0x48]
mov ecx, esi
call fcn.00404fc8
mov edi, eax
cmp edi, ebx
jne 0x4067d4
jmp 0x40682e
push dword [ebp + 0x3c]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
call fcn.00405e01
cmp dword [0x41b3cc], 0xffffffff
jne 0x406842
mov dword [0x41b3cc], ebx
cmp byte [0x41b72b], bl
je 0x4068b1
xor edx, edx
mov ecx, str.HelpText
call fcn.00404fc8
mov esi, eax
cmp esi, ebx
jne 0x406866
push 0x18
pop ecx
call fcn.00403d4f
mov esi, eax
lea ecx, [ebp - 0xa8]
call fcn.0040754c
push 0
push esi
push dword [0x41b698]
lea ecx, [ebp - 0xa8]
push 0x11
mov dword [ebp - 0xa8], 0x418b34
mov dword [ebp - 0x70], 0x7d6
call fcn.004078be
lea ecx, [ebp - 0xa8]
call fcn.004075ad
push dword [ebp + 0x58]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
jmp 0x4061f7
cmp byte [0x41b729], bl
je 0x4068c3
and dword [0x41b3cc], 0xfffffeff
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
xor edx, edx
mov ecx, str.InstallPath
call fcn.00404fc8
mov esi, 0x41b7fc
cmp eax, ebx
je 0x4068ee
push eax
mov ecx, esi
call fcn.0040eba4
mov byte [0x41b6a0], 1
mov ecx, esi
call fcn.00405586
xor edx, edx
mov ecx, str.BeginPromptTimeout
call fcn.00404fc8
cmp eax, ebx
je 0x406912
push eax
call dword [sym.imp.msvcrt.dll__wtol]
pop ecx
mov dword [0x41b6e0], eax
cmp dword [0x41b840], ebx
je 0x40692e
call fcn.00409ede
push dword [ebp + 0x58]
mov esi, eax
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
jmp 0x40627c
cmp dword [0x41b838], 3
jne 0x40693e
call fcn.00409e00
jmp 0x40691f
mov esi, 0x417a9c
push 0
mov edx, esi
mov ecx, str.SfxVarApiPath
call fcn.00404fd8
call fcn.00405e01
mov edi, str.ExecuteOnLoad
xor edx, edx
mov ecx, edi
call fcn.00404fc8
mov ebx, 0x41b7c8
test eax, eax
je 0x4069c0
cmp byte [0x41b72a], 0
jne 0x4069c0
mov ecx, ebx
call fcn.004072ed
mov edx, dword [0x41b7cc]
push 0
mov ecx, str.SfxVarApiPath
call fcn.00404fd8
call fcn.00405e01
push esi
lea ecx, [ebp + 0x30]
call fcn.0040eb43
mov ecx, ebx
call fcn.004072ed
mov edx, dword [0x41b7cc]
push esi
lea eax, [ebp + 0x30]
push eax
push esi
mov ecx, edi
call fcn.004022ef
push dword [ebp + 0x30]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
mov ecx, 0x41b750
call fcn.00408289
xor edx, edx
mov ecx, str.BeginPrompt
call fcn.00404fc8
test eax, eax
je 0x406a26
cmp byte [0x41b729], 0
jne 0x406a26
mov ecx, dword [0x41b698]
mov edx, eax
call fcn.00408aa1
test eax, eax
je 0x406b32
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x406a13
mov word [0x41b728], 0x101
cmp dword [0x41b820], 0
je 0x406a26
and dword [0x41b3cc], 0xffffff7f
lea ecx, [ebp + 0x4c]
call fcn.0040eb1f
cmp byte [0x41b728], 0
je 0x406a99
mov edi, dword [0x41b724]
push str.AutoInstall
lea ecx, [ebp + 0x4c]
call fcn.0040eba4
movzx eax, word [edi]
push eax
lea ecx, [ebp + 0x4c]
call fcn.0040157d
mov ecx, dword [ebp + 0x4c]
xor edx, edx
call fcn.00404fc8
test eax, eax
je 0x406b42
add edi, 2
movzx eax, word [edi]
cmp eax, 0x30
jb 0x406a78
cmp eax, 0x39
jbe 0x406a3d
cmp eax, 0x61
jb 0x406a82
cmp eax, 0x7a
jbe 0x406a3d
cmp eax, 0x41
jb 0x406a8c
cmp eax, 0x5a
jbe 0x406a3d
push str.AutoInstall
lea ecx, [ebp + 0x4c]
call fcn.0040eba4
cmp dword [ebp + 0x50], 0
mov byte [ebp + 0x14], 0
jne 0x406ae3
mov edi, str.ExecuteFile
xor edx, edx
mov ecx, edi
call fcn.00404fc8
test eax, eax
je 0x406ac2
push edi
lea ecx, [ebp + 0x4c]
call fcn.0040eba4
mov byte [ebp + 0x14], 1
cmp dword [ebp + 0x50], 0
jne 0x406ae3
mov edi, str.RunProgram
xor edx, edx
mov ecx, edi
call fcn.00404fc8
test eax, eax
je 0x406ae3
push edi
lea ecx, [ebp + 0x4c]
call fcn.0040eba4
cmp byte [0x41b728], 0
jne 0x406b78
cmp byte [0x41b729], 0
jne 0x406b78
mov eax, dword [0x41b3cc]
and eax, 0xc0
cmp al, 0x80
jne 0x406b78
mov edx, dword [0x41b6a8]
mov ecx, dword [0x41b6b4]
call fcn.00408b3c
test eax, eax
jne 0x406b78
push dword [ebp + 0x4c]
cmp byte [0x41b6e4], al
je 0x406b68
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
jmp 0x4069ca
push dword [ebp + 0x58]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
push 5
jmp 0x4062a7
push dword [ebp + 0x4c]
push 0xe
push 0
call fcn.00409601
push dword [ebp + 0x4c]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp + 0x58]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 0x14
push 6
jmp 0x4062a7
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp + 0x58]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
jmp 0x406b3a
cmp dword [0x41b800], 0
jne 0x406baa
mov edx, str.7ZipSfx._03x
lea ecx, [ebp - 0x24]
call fcn.00404324
push eax
mov ecx, 0x41b7fc
call fcn.0040ec07
push dword [ebp - 0x24]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
mov byte [0x41b6a0], 0
jmp 0x406be0
mov edi, 0x41b7fc
push edi
lea ecx, [ebp + 0x18]
call fcn.0040eb79
lea ecx, [ebp + 0x18]
call fcn.00405586
cmp dword [ebp + 0x1c], 0
je 0x406bd1
lea eax, [ebp + 0x18]
push eax
mov ecx, edi
call fcn.0040ec07
push dword [ebp + 0x18]
mov byte [0x41b6a0], 1
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
mov eax, dword [0x41b7fc]
pop ecx
mov ecx, dword [0x41b800]
movzx edx, word [eax + ecx*2 - 2]
cmp edx, 0x5c
je 0x406bfb
cmp edx, 0x2f
jne 0x406c08
dec ecx
xor edx, edx
mov dword [0x41b800], ecx
mov word [eax + ecx*2], dx
cmp byte [0x41b729], 0
je 0x406c18
or dword [0x41b6d4], 3
mov edi, str.PreExtract
push edi
lea ecx, [ebp - 0x18]
call fcn.0040eb43
mov eax, dword [0x41b724]
movzx eax, word [eax]
push eax
lea ecx, [ebp - 0x18]
call fcn.0040157d
mov ecx, dword [ebp - 0x18]
xor edx, edx
call fcn.00404fc8
test eax, eax
je 0x406ca2
cmp byte [0x41b72a], 0
jne 0x406ca2
mov ecx, ebx
call fcn.004072ed
mov edx, dword [0x41b7cc]
push 0
mov ecx, str.SfxVarApiPath
call fcn.00404fd8
call fcn.00405e01
push esi
lea ecx, [ebp + 0x30]
call fcn.0040eb43
mov eax, dword [0x41b724]
mov ecx, ebx
mov dword [ebp - 0xc], eax
call fcn.004072ed
mov edx, dword [0x41b7cc]
push esi
lea eax, [ebp + 0x30]
push eax
push dword [ebp - 0xc]
mov ecx, edi
call fcn.004022ef
push dword [ebp + 0x30]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
cmp dword [0x41b834], 0
jne 0x406cb7
mov ecx, 0x41b7fc
call fcn.00402d20
jmp 0x406cc5
call fcn.00408b8f
test eax, eax
jne 0x406cf0
mov eax, 0x80004005
test eax, eax
je 0x406cf0
call fcn.00405ae9
push dword [ebp - 0x18]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp + 0x4c]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp + 0x58]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 0xc
push 8
jmp 0x4062a7
call fcn.00405e01
cmp byte [0x41b72a], 0
je 0x406d0b
cmp byte [0x41b6a0], 0
jne 0x406e75
lea ecx, [ebp + 0x3c]
call fcn.0040eb1f
lea ecx, [ebp + 4]
call fcn.0040eb1f
cmp byte [0x41b728], 0
jne 0x406d2c
lea ecx, [ebp + 0x3c]
call fcn.00401b7a
xor ebx, ebx
cmp dword [ebp + 0x50], ebx
jne 0x406dfa
cmp byte [0x41b6a0], bl
jne 0x406e15
mov esi, str.setup.exe
push esi
push 0x417c58
mov edx, 0x41b7fc
lea ecx, [ebp - 0x3c]
call fcn.0040eac7
mov edx, eax
lea ecx, [ebp - 0x24]
call fcn.0040eac7
push dword [eax]
lea ecx, [ebp + 4]
call fcn.0040eba4
push dword [ebp - 0x24]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp - 0x3c]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
pop ecx
push dword [ebp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x406dcc
call fcn.00405ae9
push 0xf
push ebx
call fcn.00409601
push dword [ebp + 4]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp + 0x3c]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp - 0x18]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp + 0x4c]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp + 0x58]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 0x1c
jmp 0x406304
mov edi, dword [0x41b7fc]
push esi
lea ecx, [ebp + 0x30]
call fcn.0040eb43
push dword [ebp + 0x10]
lea eax, [ebp + 0x3c]
push eax
push dword [ebp + 0x14]
mov edx, edi
lea ecx, [ebp + 0x30]
call fcn.00402000
push dword [ebp + 0x30]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
jmp 0x406e15
push dword [ebp + 0x10]
mov edx, dword [0x41b7fc]
mov ecx, dword [ebp + 0x4c]
lea eax, [ebp + 0x3c]
push eax
push dword [0x41b724]
call fcn.004022ef
cmp dword [0x41b838], ebx
jne 0x406e61
call fcn.00405e01
push 0xffffffffffffffff
push dword [0x41b724]
mov edx, str.Shortcut
mov ecx, 0x405e56
call fcn.00405a12
push dword [0x41b6f4]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 0xffffffffffffffff
push dword [0x41b724]
mov edx, str.Delete
mov ecx, 0x4059e8
call fcn.00405a12
call fcn.00405ae9
push dword [ebp + 4]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp + 0x3c]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
pop ecx
jmp 0x406e77
xor ebx, ebx
cmp dword [0x41b3d8], 0xffffffff
jne 0x406e93
cmp byte [0x41b729], 0
jne 0x406efb
mov dword [0x41b3d8], 1
cmp dword [0x41b3d8], ebx
jle 0x406efb
xor edx, edx
mov ecx, str.FinishMessage
call fcn.00404fc8
mov esi, eax
cmp esi, ebx
je 0x406efb
mov eax, 0x3e7
cmp dword [0x41b3d8], eax
jle 0x406ebf
mov dword [0x41b3d8], eax
lea ecx, [ebp - 0xa4]
call fcn.0040754c
push ebx
push esi
push dword [0x41b698]
lea ecx, [ebp - 0xa4]
push 0x11
mov dword [ebp - 0xa4], 0x418c14
mov dword [ebp - 0x6c], 0x7d5
call fcn.004078be
lea ecx, [ebp - 0xa4]
call fcn.004075ad
cmp byte [0x41b72a], 0
jne 0x406f36
cmp dword [0x41b838], ebx
jne 0x406f36
xor edx, edx
mov ecx, str.SelfDelete
call fcn.00404fc8
cmp eax, ebx
je 0x406f36
cmp word [eax], 0x31
jne 0x406f36
sub esp, 0xc
mov ecx, esp
push 0x41b7a4
call fcn.0040eb79
call fcn.00405b15
push dword [ebp - 0x18]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp + 0x4c]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp + 0x58]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp - 8]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp - 0x48]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push dword [ebp + 0x24]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 0x18
xor eax, eax
jmp 0x406f84
push 0x10
push str.7_Zip_SFX
push str.Sorry__this_program_requires_Microsoft_Windows_2000_or_later.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x14
pop eax
pop edi
pop esi
pop ebx
add ebp, 0x68
leave
ret 0x10