Function at 0x40122f
Capabilities:
Accept command line arguments
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Delete file
Execute shell command and capture output
Extract resource via kernel32 functions
Get comspec environment variable
Query environment variable
Read file on windows
Self delete
Write and execute a file
Write file on windows
Write pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2bc
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [ebp - 4], eax
lea edx, [ebp - 0x1b8]
mov cl, byte [eax]
cmp cl, 0x22
je 0x401251
mov byte [edx], cl
inc edx
mov cl, byte [eax]
inc eax
test cl, cl
mov dword [ebp - 4], eax
jne 0x401247
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
lea eax, [ebp - 0x2bc]
push eax
lea eax, [ebp - 0x1b8]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
mov eax, dword [ebp - 4]
xor ebx, ebx
push str.UnInstall.log
mov byte [eax], bl
lea eax, [ebp - 0x2bc]
push eax
call fcn.00401570
lea eax, [ebp - 0x2bc]
push 0x8000
push eax
call fcn.00401d47
mov esi, eax
add esp, 0x10
cmp esi, ebx
jl 0x401555
push 2
push ebx
push esi
call fcn.00402c0d
push ebx
push ebx
push esi
mov dword [ebp - 8], eax
call fcn.00402c0d
push dword [ebp - 8]
call fcn.00401d39
push dword [ebp - 8]
mov edi, eax
mov dword [ebp - 0x10], edi
push edi
push esi
call fcn.00401b43
push esi
call fcn.00401a90
add esp, 0x2c
mov dword [ebp - 4], edi
push 0xa
push dword [ebp - 4]
call fcn.00401770
mov esi, eax
pop ecx
cmp esi, ebx
pop ecx
mov dword [ebp - 0x14], esi
je 0x40142a
mov byte [esi], bl
mov eax, dword [ebp - 4]
lea edi, [eax + 5]
mov eax, dword [eax]
cmp eax, 0x446c6544
je 0x40141a
cmp eax, 0x466c6544
je 0x401412
cmp eax, 0x4b6c6544
je 0x40140a
cmp eax, 0x656d614e
je 0x4013f0
cmp eax, 0x6b726f57
jne 0x401421
lea eax, [ebp - 0x1b8]
push edi
push eax
call fcn.00401560
pop ecx
pop ecx
push str.DELD
push str.101
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
mov dword [ebp - 0x1c], eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1b8]
push str.WaitDelD.exe
push eax
call fcn.00401570
push 0x180
lea eax, [ebp - 0x1b8]
push 0x8102
push eax
call fcn.00401d47
mov esi, eax
add esp, 0x14
cmp esi, ebx
jl 0x401555
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
push esi
call fcn.004018e3
push esi
call fcn.00401a90
add esp, 0x10
push dword [ebp - 0x20]
call dword [sym.imp.GDI32.dll_DeleteObject]
lea eax, [ebp - 0x1b8]
push edi
push eax
call fcn.00401560
mov esi, dword [ebp - 0x14]
pop ecx
pop ecx
jmp 0x401421
push 0x24
push str.UnInstall
push edi
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 7
je 0x401555
jmp 0x401421
push edi
call fcn.004011a3
jmp 0x401420
push edi
call section..text
jmp 0x401420
push edi
call fcn.004010ac
pop ecx
inc esi
mov dword [ebp - 4], esi
jmp 0x4012e8
push dword [ebp - 0x10]
call fcn.004018d8
pop ecx
lea eax, [ebp - 0x2bc]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x30]
push ebx
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x30], 0xc
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], 1
call dword [sym.imp.KERNEL32.dll_CreatePipe]
push ebx
push 0x80
lea eax, [ebp - 0x30]
push 3
push eax
push 3
push 0x40000000
push 0x4070b4
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0x44
mov esi, eax
pop edi
lea eax, [ebp - 0x74]
push edi
push ebx
push eax
call fcn.00401880
mov eax, dword [ebp - 0x24]
push ebx
push ebx
mov dword [ebp - 0x3c], eax
push ebx
push 0x4070a4
lea eax, [ebp - 0x1b8]
push ebx
push eax
lea eax, [ebp - 0x2bc]
push str.D_s_cK_s_c_c
push eax
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x48], 0x101
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], esi
mov word [ebp - 0x44], bx
call fcn.0040182c
add esp, 0x2c
lea eax, [ebp - 0x1b8]
push 0x104
push eax
push str.COMSPEC
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push 0xb
lea eax, [ebp - 0xb4]
pop ecx
mov esi, str.__D__K___r_ndel___D__K___r_nrmdir___D___r_nexit_r_n
lea edi, [ebp - 0xa4]
push eax
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x2bc]
push 0x407058
push eax
push ebx
push 1
push ebx
lea eax, [ebp - 0x1b8]
push ebx
push eax
lea eax, [ebp - 0x1b8]
push eax
movsw word es:[edi], word [esi]
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xa4]
push eax
call fcn.00401650
pop ecx
push eax
lea eax, [ebp - 0xa4]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10