Function at 0x4011a0
Capabilities:
Copy file
Create process on windows
Delete directory
Delete file
Delete registry key
Get common file path
Persist via lnk shortcut
Query or enumerate registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0xee8
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0xee4], eax
push esi
push edi
push ecx
lea ecx, [esp + 0x44]
mov dword [esp + 0x40], 0x104
call section..text
mov esi, dword [esp + 0x48]
add esp, 4
mov edi, dword [esp + 0x40]
mov esi, dword [esi]
cmp esi, 0x206
jbe 0x4011ff
push 0x10
push str.Error
push str.InitRsrcData:_nInvalid_path.
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
shr esi, 1
push esi
push dword [edi]
push 0x41b320
call fcn.004067e5
add esi, esi
add esp, 0xc
cmp esi, 0x208
jae 0x401548
xor eax, eax
mov word [esi + 0x41b320], ax
xor esi, esi
cmp dword [esp + 0x48], eax
jbe 0x40125d
push dword [edi + esi*4]
call fcn.004044ab
mov eax, dword [esp + 0x4c]
inc esi
add esp, 4
cmp esi, eax
jb 0x401230
test eax, eax
je 0x40125d
push edi
call fcn.004044ab
add esp, 4
push dword [esp + 0x44]
call fcn.004044ab
add esp, 4
push 0x41b320
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_
push str._ls_ls
lea eax, [esp + 0x4c4]
push 0x104
push eax
call fcn.00401160
mov esi, dword [sym.imp.USER32.dll_MessageBoxW]
add esp, 0x14
test eax, eax
js 0x40153a
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x2b4]
push eax
push 0
push 2
push str.InstallLocation
lea eax, [esp + 0x4cc]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x4012e4
push 0x10
push str.Error
push str.Couldnt_retrieve_software_information.
push 0
call esi
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0xee4]
xor ecx, esp
call fcn.0040154e
mov esp, ebp
pop ebp
ret 0x10
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0xa8]
push 0x104
push eax
push 0
call edi
push 0x104
lea eax, [esp + 0xac]
push eax
call dword [sym.imp.api_ms_win_core_path_l1_1_0.dll_PathCchRemoveFileSpec]
lea eax, [esp + 0x2b0]
push eax
lea eax, [esp + 0xac]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4013e9
push 0x104
lea eax, [esp + 0x8cc]
push eax
push 0
call edi
lea eax, [esp + 0x6c0]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [esp + 0xa8]
push eax
push 0
push 0x418878
lea eax, [esp + 0x6cc]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 0
lea eax, [esp + 0xac]
push eax
lea eax, [esp + 0x8d0]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0x44
lea eax, [esp + 0x64]
push 0
push eax
call fcn.00402560
add esp, 0xc
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x64]
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
push 0
lea eax, [esp + 0xcc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push dword [esp + 0x30]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x2c]
call esi
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0xee4]
xor ecx, esp
call fcn.0040154e
mov esp, ebp
pop ebp
ret 0x10
push 0x24
push str.Confirmation
push str.Are_you_sure_you_want_to_uninstall_
push 0
call esi
cmp eax, 7
je 0x401522
push 0
push 0
lea eax, [esp + 0x2b8]
push eax
push str._ls_c_c
lea eax, [esp + 0xce8]
push 0x105
push eax
call fcn.00401160
add esp, 0x18
test eax, eax
js 0x40153a
movups xmm0, xmmword [0x4131b0]
lea eax, [esp + 0xcd8]
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], eax
mov eax, 0x614
mov word [esp + 0x1c], ax
lea eax, [esp + 8]
push eax
push 0
push 0
lea eax, [esp + 0x4c]
mov dword [esp + 0x1c], 3
push eax
mov dword [esp + 0x28], 0
movups xmmword [esp + 0x50], xmm0
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
jne 0x40149f
push dword [esp + 8]
lea eax, [esp + 0xac]
push 0x418870
push 0x104
push eax
call fcn.00401160
add esp, 0x10
push dword [esp + 8]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push 0x41b320
lea eax, [esp + 0xac]
push eax
push str._ls_ls.lnk
lea eax, [esp + 0xadc]
push 0x104
push eax
call fcn.00401160
add esp, 0x14
test eax, eax
js 0x40153a
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
lea eax, [esp + 0x2b0]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push 0
push 0
lea eax, [esp + 0x4c0]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
lea eax, [esp + 0xad0]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push str.Success
push str.Uninstall_complete.
push 0
call esi
mov ecx, dword [esp + 0xeec]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.0040154e
mov esp, ebp
pop ebp
ret 0x10
push 0x10
push str.Error
push str.swprintf:_nInvalid_path.
jmp 0x40151e
call fcn.0040167e
int3