Function at 0x401000
Capabilities:
Accept command line arguments
Check os version
Copy file
Delete directory
Delete file
Delete registry key
Delete registry value
Extract resource via kernel32 functions
Get common file path
Get installed programs
Move file
Query environment variable
Set current directory

Disassembly:
jmp 0x401123
mov dword [section..data], 0x9c
push section..data
call sub.kernel32.dll_GetVersionExA
call sub.kernel32.dll_GetProcessHeap
mov dword [0x40310e], eax
push 0x300
push 8
push eax
call sub.kernel32.dll_HeapAlloc
mov dword [0x403112], eax
add eax, 0x100
mov dword [0x403116], eax
add eax, 0x100
mov dword [0x40311a], eax
push 0x100
push dword [0x403112]
push 0
call sub.kernel32.dll_GetModuleFileNameA
push 0x100
push dword [0x40311a]
push 0x40111a
call sub.kernel32.dll_GetEnvironmentVariableA
or eax, eax
jne 0x4011ab
push 0x100
push dword [0x40311a]
push 0x40111e
call sub.kernel32.dll_GetEnvironmentVariableA
or eax, eax
je 0x401228
add eax, dword [0x40311a]
cmp byte [eax], 0x5c
je 0x4011bb
mov word [eax], 0x5c
call sub.kernel32.dll_GetCommandLineA
inc eax
cmp byte [eax], 0
jne 0x4011c0
cmp byte [eax - 1], 0x55
je 0x401228
push dword [0x40311a]
push dword [0x403116]
call sub.kernel32.dll_lstrcpyA
push 0x4010f2
push eax
call sub.kernel32.dll_lstrcatA
push 0
push eax
push dword [0x403112]
call 0x40158a
or eax, eax
je 0x401228
push 0x4030fe
push 0x4030ba
push 0
push 0
push 0x20
push 0
push 0
push 0
push 0x401118
push dword [0x403116]
call sub.kernel32.dll_CreateProcessA
or eax, eax
jne 0x401570
cmp dword [0x403010], 2
jne 0x401242
push 4
push 0
push dword [0x403112]
call sub.kernel32.dll_MoveFileExA
jmp 0x401278
push 0x100
push dword [0x403116]
call sub.kernel32.dll_GetWindowsDirectoryA
push 0x401100
push dword [0x403116]
call sub.kernel32.dll_lstrcatA
push eax
push dword [0x403112]
push 0x401114
push 0x40110d
call sub.kernel32.dll_WritePrivateProfileStringA
push 0xa
push 1
push 0
call sub.kernel32.dll_FindResourceA
push eax
push 0
call sub.kernel32.dll_LoadResource
push eax
call sub.kernel32.dll_LockResource
mov dword [0x403126], eax
push dword [0x403126]
push 0x401005
push dword [0x403112]
call sub.user32.dll_wsprintfA
add esp, 0xc
push dword [0x403126]
push 0x401025
push dword [0x403116]
call sub.user32.dll_wsprintfA
add esp, 0xc
push 0x34
push dword [0x403112]
push dword [0x403116]
push 0
call sub.user32.dll_MessageBoxA
cmp eax, 6
jne 0x401570
push dword [0x403126]
call sub.kernel32.dll_lstrlenA
inc eax
add eax, dword [0x403126]
mov dword [0x40312a], eax
mov dword [0x40311e], eax
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
push dword [0x40311e]
call sub.kernel32.dll_lstrlenA
inc eax
add dword [0x40311e], eax
mov eax, dword [0x40311e]
cmp byte [eax], 0
je 0x40138f
push dword [0x40311e]
call sub.kernel32.dll_DeleteFileA
push dword [0x40311e]
call fcn.00401650
push dword [0x40311e]
call sub.kernel32.dll_lstrlenA
mov ecx, eax
add eax, dword [0x40311e]
cmp dword [eax - 4], 0x706c682e
jne 0x40135f
mov dword [eax - 4], 0x6469672e
jmp 0x401324
dec ecx
je 0x401308
mov eax, dword [0x40311e]
cmp byte [ecx + eax - 1], 0x5c
jne 0x40135f
push ecx
push ecx
push dword [0x40311e]
push dword [0x403112]
call sub.kernel32.dll_lstrcpynA
push dword [0x403112]
call sub.kernel32.dll_RemoveDirectoryA
pop ecx
jmp 0x40135f
push 0x4010f2
call sub.kernel32.dll_DeleteFileA
push dword [0x40311a]
call sub.kernel32.dll_SetCurrentDirectoryA
push dword [0x40312a]
call sub.kernel32.dll_RemoveDirectoryA
inc dword [0x40311e]
push dword [0x40311e]
pop dword [0x40312a]
push dword [0x40311e]
call sub.kernel32.dll_lstrlenA
inc eax
add dword [0x40311e], eax
mov eax, dword [0x40311e]
cmp byte [eax], 0
je 0x4013ea
push dword [0x40311e]
call sub.kernel32.dll_DeleteFileA
jmp 0x4013c1
mov eax, 2
cmp dword [0x403004], 6
jl 0x4013fd
mov eax, 0x17
push 0x403122
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
push dword [0x403112]
push dword [0x403122]
call sub.shell32.dll_SHGetPathFromIDListA
push dword [0x40312a]
call sub.kernel32.dll_lstrlenA
or eax, eax
je 0x401469
mov dword [0x403122], eax
push dword [0x403112]
call sub.kernel32.dll_SetCurrentDirectoryA
push dword [0x40312a]
call sub.kernel32.dll_RemoveDirectoryA
or eax, eax
je 0x401469
dec dword [0x403122]
mov eax, dword [0x403122]
add eax, dword [0x40312a]
cmp byte [eax], 0
je 0x401469
cmp byte [eax], 0x5c
jne 0x401449
mov byte [eax], 0
jmp 0x40143a
inc dword [0x40311e]
mov eax, dword [0x40311e]
cmp byte [eax], 0
je 0x401512
push eax
add dword [0x40311e], 5
push dword [0x40311e]
push 0x40312a
push 0xf003f
push 0
push dword [0x40311e]
push dword [eax + 1]
call sub.advapi32.dll_RegOpenKeyExA
push dword [0x40311e]
call sub.kernel32.dll_lstrlenA
inc eax
add dword [0x40311e], eax
mov eax, dword [0x40311e]
cmp byte [eax], 0xff
jne 0x4014d0
push 0
push dword [0x40312a]
call sub.advapi32.dll_RegDeleteValueA
jmp 0x4014f2
push dword [0x40311e]
push dword [0x40312a]
call sub.advapi32.dll_RegDeleteValueA
push dword [0x40311e]
call sub.kernel32.dll_lstrlenA
add dword [0x40311e], eax
pop edx
pop eax
cmp byte [eax], 0x43
jne 0x401502
push edx
push dword [eax + 1]
call sub.advapi32.dll_RegDeleteKeyA
push dword [0x40312a]
call sub.advapi32.dll_RegCloseKey
jmp 0x401469
push 0x4010bd
push dword [0x403112]
call sub.kernel32.dll_lstrcpyA
push dword [0x403126]
push 0x401088
push dword [0x403116]
call sub.user32.dll_wsprintfA
add esp, 0xc
push dword [0x403126]
push dword [0x403112]
call sub.kernel32.dll_lstrcatA
push dword [0x403112]
push 0x80000002
call sub.advapi32.dll_RegDeleteKeyA
push 0x40
push 0x401012
push dword [0x403116]
push 0
call sub.user32.dll_MessageBoxA
push dword [0x403112]
push 0
push dword [0x40310e]
call sub.kernel32.dll_HeapFree
push 0
call sub.kernel32.dll_ExitProcess
jmp dword [sym.imp.kernel32.dll_CopyFileA]