Function at 0x407d30
Capabilities:
Accept command line arguments
Check if file exists
Delete directory
Delete file
Delete registry key
Delete registry value
Get file attributes
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0x2000
xor esi, esi
mov dword [ebp - 4], ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x407f51
lea eax, [edi + 0x400]
mov byte [edi], 0
mov dword [ebp - 8], eax
add eax, 0x400
push esi
mov dword [ebp - 0x10], eax
add eax, 0x800
push str.SOFTWAREK7_ComputingK7TotalSecurity
push 0x80000002
mov dword [ebp - 0xc], eax
call fcn.00413e50
mov ebx, eax
test ebx, ebx
je 0x407da5
push 0x104
push edi
push str.DirProductBase
push ebx
call fcn.004141c0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [edi], 0
je 0x407f41
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x407db3
sub ecx, edx
cmp ecx, 0xc
jb 0x407f41
mov ecx, edi
call fcn.004079d0
push 0x5c
push edi
call fcn.00420f66
add esp, 8
test eax, eax
je 0x407de9
push 4
push 0
push edi
mov byte [eax], 0
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
cmp dword [ebp - 4], 3
je 0x407e2f
push edi
mov byte [edi], 0
call fcn.00414ef0
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
add esp, 4
push str.K7_Computing
push edi
call esi
push str.K7WS
push edi
call esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x407e2f
push ecx
mov ecx, edi
call fcn.00401cd0
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push str._SaveProfileData
push eax
call fcn.00416370
add esp, 8
test eax, eax
jne 0x407e52
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
call fcn.00407ad0
cmp dword [0x43c3e8], 0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
je 0x407efd
cmp dword [0x43c4f4], 3
je 0x407efd
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersionFonts
push 0x80000002
call ebx
test eax, eax
jne 0x407eb0
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push str.Gunplay__TrueType_
push dword [ebp - 4]
call esi
push str.Illuma_Black
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 8]
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
push str.FontsGunplay.ttf
push esi
push 0x436114
push edi
call fcn.004014f0
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExA]
add esp, 0x10
push 4
push 0
push edi
call esi
push str.Fontsilluma_black.ttf
push dword [ebp - 8]
push 0x436114
push edi
call fcn.004014f0
add esp, 0x10
push 4
push 0
push edi
call esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push 0x80000002
call ebx
test eax, eax
jne 0x407f2e
push dword [0x43c4fc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov eax, dword [ebp - 4]
test eax, eax
je 0x407f3c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 1
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret