Function at 0x4035ce
Capabilities:
Check if file exists
Create process on windows
Create process suspended
Get common file path
Get file attributes
Move file

Disassembly:
push ebp
sub esp, 0x820
lea ebp, [esp - 4]
mov eax, dword [0x41e068]
xor eax, ebp
mov dword [ebp + 0x820], eax
push 0x70
mov eax, 0x413ea0
call fcn.00407979
mov ebx, 0x618
push ebx
lea eax, [ebp + 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
mov edi, str._rundll32.exe
push edi
lea eax, [ebp + 0x208]
push eax
call esi
lea eax, [ebp + 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x403644
push ebx
lea eax, [ebp + 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push edi
lea eax, [ebp + 0x208]
push eax
call esi
mov eax, dword [0x41f234]
mov ecx, 0x41f234
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
xor ebx, ebx
push 0x41acac
lea eax, [ebp - 0x10]
mov dword [ebp - 4], ebx
call fcn.00403bdf
mov edi, dword [ebp - 0x10]
cmp dword [edi - 0xc], ebx
jne 0x4036bd
push str.TEMP
lea eax, [ebp - 0x10]
call fcn.00403bdf
mov edi, dword [ebp - 0x10]
cmp dword [edi - 0xc], ebx
jne 0x4036bd
push ebx
push ecx
mov eax, esp
mov dword [ebp - 0x20], esp
push str.Could_not_copy_files_required_for_uninstallation._Aborting_uninstallation.
push eax
call fcn.0040388d
push ecx
mov byte [ebp - 4], 1
mov eax, esp
mov dword [ebp - 0x1c], esp
push str.Error
push eax
call fcn.0040388d
mov byte [ebp - 4], bl
call fcn.00401d45
add esp, 0xc
jmp 0x403810
lea eax, [ebp - 0x18]
xor ecx, ecx
push eax
inc ecx
lea eax, [ebp - 0x10]
call fcn.00403b53
push 0x41aaa8
push eax
mov byte [ebp - 4], 2
call fcn.00403f9e
neg eax
sbb al, al
inc al
mov byte [ebp - 0x11], al
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.004013a9
cmp byte [ebp - 0x11], bl
je 0x403722
mov edi, dword [edi - 0xc]
lea ecx, [edi - 1]
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x10]
call fcn.00403ba3
lea edi, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.00403917
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.004013a9
mov eax, str._selfdel.dll
lea ecx, [ebp - 0x10]
call fcn.00403ce0
mov edi, dword [ebp - 0x10]
push edi
push str.selfdel.dll
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push str.___MagicDel_16
lea eax, [ebp - 0x20]
push eax
call fcn.004038d2
mov dword [ebp - 0x18], eax
push 0x41ada8
lea eax, [ebp - 0x1c]
push eax
mov byte [ebp - 4], 4
call fcn.004038d2
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x28]
push ecx
mov ecx, eax
mov byte [ebp - 4], 5
call fcn.00403c34
mov byte [ebp - 4], 6
push dword [ebp - 0x18]
lea ecx, [ebp - 0x24]
push ecx
mov ecx, eax
call fcn.00403c34
add esp, 0x10
push dword [eax]
lea eax, [ebp + 0x208]
push eax
call esi
mov eax, dword [ebp - 0x24]
add eax, 0xfffffff0
call fcn.004013a9
mov eax, dword [ebp - 0x28]
add eax, 0xfffffff0
call fcn.004013a9
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.004013a9
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
call fcn.004013a9
push 0x208
lea eax, [ebp]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp]
push eax
lea eax, [ebp + 0x208]
push eax
call esi
push 0x44
lea eax, [ebp - 0x7c]
push ebx
push eax
call fcn.00406be0
add esp, 0xc
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x7c]
push eax
push ebx
push ebx
push 0x20
push ebx
push ebx
push ebx
lea eax, [ebp + 0x208]
push eax
push ebx
mov dword [ebp - 0x50], 0x80
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
lea eax, [edi - 0x10]
call fcn.004013a9
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x820]
xor ecx, ebp
call fcn.00405a1a
add ebp, 0x824
leave
ret