Function at 0x4050c0
Capabilities:
Accept command line arguments
Check if file exists
Copy file
Create process on windows
Delete directory
Delete file
Delete registry key
Get common file path
Get file attributes
Persist via lnk shortcut
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xce4
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0xce0], eax
push ebx
push esi
push edi
push 0x208
lea eax, [esp + 0x8dc]
push 0
push eax
call fcn.00407340
add esp, 0xc
lea eax, [esp + 0xae0]
push 0x208
push 0
push eax
call fcn.00407340
add esp, 0xc
lea eax, [esp + 0x2b8]
push 0x208
push 0
push eax
call fcn.00407340
add esp, 0xc
mov dword [esp + 0x60], 0x44
lea eax, [esp + 0x64]
push 0x40
push 0
push eax
call fcn.00407340
add esp, 0xc
lea eax, [esp + 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [esp + 0x5c], 1
mov edi, eax
jle 0x40517b
mov esi, 1
nop dword [eax + eax]
push str.__payload
push dword [edi + esi*4]
call fcn.00406ca2
add esp, 8
test eax, eax
jne 0x4051c3
inc esi
cmp esi, dword [esp + 0x5c]
jl 0x405160
lea eax, [esp + 0x8d8]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x40553f
push 0x10
push str.Uninstaller
push str.Failed_to_get_the_temporary_folder_path
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xce0]
xor ecx, esp
call fcn.00405b56
mov esp, ebp
pop ebp
ret
call fcn.00404e60
mov ebx, eax
test ebx, ebx
jne 0x4051fa
push eax
push str.Supermium_Setup
push str.A_formally_installed_copy_of_Supermium_could_not_be_located._Now_exiting_the_uninstaller.
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xce0]
xor ecx, esp
call fcn.00405b56
mov esp, ebp
pop ebp
ret
mov edi, dword [sym.imp.USER32.dll_MessageBoxW]
push 4
push str.Supermium_Setup
push str.Would_you_like_to_uninstall_Supermium_
push 0
call edi
cmp eax, 6
jne 0x4051e0
push 4
push str.Supermium_Setup
push str.Would_you_like_to_keep_your_user_data_
push 0
call edi
mov esi, 0x614
cmp eax, 7
jne 0x405337
push 0x20c
lea eax, [esp + 0xac]
mov dword [esp + 0x10], 0
xorps xmm0, xmm0
mov dword [esp + 0x1c], 0
push 0
push eax
movlpd qword [esp + 0x2a], xmm0
mov dword [esp + 0x32], 0
call fcn.00407340
add esp, 0xc
lea eax, [esp + 0xa8]
push 0x106
push eax
push str.LOCALAPPDATA
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push str.SupermiumUser_Data
lea ecx, [esp + 0xac]
call fcn.004011f0
lea eax, [esp + 0xa8]
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], eax
lea eax, [esp + 0xc]
push eax
mov word [esp + 0x20], si
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
lea eax, [esp + 0xa8]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push str.SoftwareMicrosoftWindowsCurrentVersionApp_ManagementARPCacheSupermium
push 0x80000001
call esi
push str.SoftwareSupermiumPreferenceMACsDefaultextensions.settings
push 0x80000001
call esi
push str.SoftwareSupermiumPreferenceMACsDefault
push 0x80000001
call esi
push str.SoftwareSupermiumPreferenceMACsSystem_Profile
push 0x80000001
call esi
push str.SoftwareSupermiumPreferenceMACs
push 0x80000001
call esi
push str.SoftwareSupermiumBLBeacon
push 0x80000001
call esi
push str.SoftwareSupermiumStabilityMetrics
push 0x80000001
call esi
push str.SoftwareSupermiumThirdParty
push 0x80000001
call esi
push str.SoftwareSupermium
push 0x80000001
call esi
push 0x20c
lea eax, [esp + 0x6cc]
mov dword [esp + 0x30], 0
xorps xmm0, xmm0
mov dword [esp + 0x3c], 0
push 0
push eax
movlpd qword [esp + 0x4a], xmm0
mov dword [esp + 0x52], 0
call fcn.00407340
lea ecx, [esp + 0x6d4]
mov esi, ebx
mov eax, ecx
add esp, 0xc
mov edx, 0x82
sub esi, eax
lea eax, [edx + 0x7fffff7c]
test eax, eax
je 0x40539f
movzx eax, word [esi + ecx]
test ax, ax
je 0x40539f
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x405381
lea eax, [ecx - 2]
mov dword [esp + 0x30], 3
test edx, edx
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
lea eax, [esp + 0x6ca]
mov dword [esp + 0x34], eax
mov eax, 0x614
mov word [esp + 0x3c], ax
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
lea eax, [esp + 0x6ca]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40542f
lea eax, [esp + 0x6ca]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x40542f
push 0x10
push str.Supermium_Setup
push str.Unable_to_remove_the_Supermium_directory.
push eax
call edi
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xce0]
xor ecx, esp
call fcn.00405b56
mov esp, ebp
pop ebp
ret
call fcn.00401280
mov esi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [esp + 0x4c0]
push eax
push 0
push 0
push 0x10
push 0
call esi
lea eax, [esp + 0xa8]
push eax
push 0
push 0
push 2
push 0
call esi
push str.Supermium.lnk
lea ecx, [esp + 0x4c4]
call fcn.004011f0
push str.Supermium.lnk
lea ecx, [esp + 0xac]
call fcn.004011f0
lea eax, [esp + 0x4c0]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [esp + 0xa8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [0x41d3c0], 0
je 0x405505
lea eax, [esp + 0x4c0]
push eax
push 0
push 0
push 0x19
push 0
call esi
lea eax, [esp + 0xa8]
push eax
push 0
push 0
push 0x17
push 0
call esi
push str.Supermium.lnk
lea ecx, [esp + 0x4c4]
call fcn.004011f0
push str.Supermium.lnk
lea ecx, [esp + 0xac]
call fcn.004011f0
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [esp + 0x4c0]
push eax
call esi
lea eax, [esp + 0xa8]
push eax
call esi
push 0
push str.Supermium_Setup
push str.Supermium_has_been_uninstalled.
push 0
call edi
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xce0]
xor ecx, esp
call fcn.00405b56
mov esp, ebp
pop ebp
ret
push 0x104
lea eax, [esp + 0xae4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x405585
push 0x10
push str.Uninstaller
push str.Failed_to_get_the_current_executable_path
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xce0]
xor ecx, esp
call fcn.00405b56
mov esp, ebp
pop ebp
ret
lea ecx, [esp + 0x2b8]
mov edx, 0x104
lea esi, [esp + 0x8d8]
mov eax, ecx
sub esi, eax
nop dword [eax]
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x4055be
movzx eax, word [esi + ecx]
test ax, ax
je 0x4055be
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x4055a0
lea eax, [ecx - 2]
test edx, edx
push str.uninstall.exe
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
lea ecx, [esp + 0x2bc]
call fcn.00401160
push 0
lea eax, [esp + 0x2bc]
push eax
lea eax, [esp + 0xae8]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x405625
push 0x10
push str.Uninstaller
push str.Failed_to_copy_the_executable_to_the_temporary_folder
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xce0]
xor ecx, esp
call fcn.00405b56
mov esp, ebp
pop ebp
ret
push str.___payload
lea ecx, [esp + 0x2bc]
call fcn.00401160
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0x64]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x2d8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x405691
push 0x10
push str.Uninstaller
lea eax, [esp + 0x2c0]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xce0]
xor ecx, esp
call fcn.00405b56
mov esp, ebp
pop ebp
ret
push dword [esp + 0x4c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x50]
call esi
mov ecx, dword [esp + 0xcec]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00405b56
mov esp, ebp
pop ebp
ret