Function at 0x401200
Capabilities:
Copy file
Delete registry value
Get file attributes
Get installed programs
Print debug messages
Set file attributes

Disassembly:
mov eax, 0x1808
call fcn.004021e0
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov ecx, 0x1ff
xor eax, eax
lea edi, [esp + 0x819]
mov byte [esp + 0x818], bl
mov byte [esp + 0x18], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x1ff
xor eax, eax
lea edi, [esp + 0x19]
mov esi, dword [esp + 0x181c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push esi
mov dword [esp + 0x14], ebx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x401449
mov ax, word [0x409084]
mov cx, word [0x409088]
lea edx, [esp + 0x16]
mov word [esp + 0x16], ax
push edx
push esi
mov word [esp + 0x1c], cx
call fcn.00401fee
add esp, 8
mov esi, eax
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.SHLWAPI.dll_StrTrimA]
cmp esi, ebx
je 0x401449
mov ebp, dword [sym.imp.USER32.dll_wsprintfA]
or edi, 0xffffffff
cmp edi, 3
ja case.default.0x4012a1
jmp dword [edi*4 + 0x401464]
push esi
call fcn.00402115
add esp, 4
mov dword [esp + 0x10], eax
jmp case.default.0x4012a1
push esi
call fcn.00402115
add esp, 4
mov ebx, eax
jmp case.default.0x4012a1
push esi
lea ecx, [esp + 0x81c]
push 0x409128
push ecx
jmp 0x4012df
push esi
lea edx, [esp + 0x1c]
push 0x409128
push edx
call ebp
add esp, 0xc
lea eax, [esp + 0x16]
inc edi
push eax
push 0
call fcn.00401fee
add esp, 8
lea ecx, [esp + 0x14]
mov esi, eax
push ecx
push esi
call dword [sym.imp.SHLWAPI.dll_StrTrimA]
test esi, esi
jne 0x40129c
mov eax, dword [esp + 0x10]
cmp eax, 2
jne 0x401361
push ebx
push esi
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0x18]
push 0
lea eax, [esp + 0x81c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
and al, 0xfe
lea edx, [esp + 0x18]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x401449
cmp eax, 4
jne 0x401407
push ebx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x1ff
xor eax, eax
lea edi, [esp + 0x1019]
mov byte [esp + 0x1018], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x818]
lea ecx, [esp + 0x1018]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallInstallShield__s
push ecx
call ebp
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x1018]
mov dword [esp + 0x10], 0
push edx
push 0xf003f
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401449
mov esi, dword [esp + 0x10]
push str.DisplayName
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test esi, esi
je 0x401449
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x401449
cmp eax, 5
jne 0x401449
push ebx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x818]
push ecx
push 0x4090d0
push str.EnableLangDlg
push str.Startup
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push str._PostBuild__InstallHandler_Done
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1808
ret