Function at 0x404128
Capabilities:
Delete directory
Delete file
Delete registry key
Get common file path
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, 0x104
push esi
mov ebx, eax
push 8
push ebx
call edi
push esi
push 8
push ebx
mov dword [ebp - 8], eax
call edi
push esi
push 8
push ebx
mov dword [ebp - 0x10], eax
call edi
push esi
push 8
push ebx
call edi
push esi
push dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push dword [ebp - 8]
push 0
call fcn.0040321e
call fcn.0040182e
mov edi, dword [sym.imp.SHLWAPI.dll_wnsprintfA]
push str.Uninstaller.exe
push dword [ebp - 8]
push 0x4112c0
push esi
push dword [ebp - 0xc]
call edi
add esp, 0x14
lea eax, [ebp - 0x320]
push eax
push 0
call fcn.0040321e
push str.icon.ico
lea eax, [ebp - 0x320]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x320]
push eax
call ebx
lea eax, [ebp - 0x320]
push eax
call fcn.0040177d
cmp byte [ebp + 8], 0
pop ecx
jne 0x404219
push 0x103
lea eax, [ebp - 0x217]
push 0
push eax
mov byte [ebp - 0x218], 0
call fcn.0040a870
add esp, 0xc
push esi
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x218]
push eax
call fcn.0040177d
pop ecx
push dword [ebp - 0xc]
call ebx
push dword [ebp - 0xc]
call fcn.0040177d
pop ecx
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall
mov ebx, 0x80000002
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
push str.FreeWorkz
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.295296CF_D474_4b2d_A3BB_9D75CC81BA06
push str.Software_s
lea eax, [ebp - 0x428]
push esi
push eax
call edi
add esp, 0x10
lea eax, [ebp - 0x428]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push dword [ebp - 8]
call fcn.0040177d
cmp byte [ebp + 8], 0
pop ecx
jne 0x404397
mov eax, dword [str.regname]
mov dword [ebp - 0x218], eax
mov eax, dword [0x41174c]
push 0xf7
mov dword [ebp - 0x214], eax
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.0040a870
add esp, 0xc
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
push 0
push str.freeworkz_cleanup_1
push str._s__d
lea eax, [ebp - 0x218]
push 0xfe
push eax
call fcn.004058c6
add esp, 0x14
push dword [ebp - 8]
mov esi, 0xff
push str.cmd.exe__c_rd__s__q___s_
lea eax, [ebp - 0x110]
push esi
push eax
call edi
add esp, 0x10
lea ecx, [ebp - 0x110]
call fcn.004057cb
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push eax
mov eax, ecx
push eax
push 1
push 0
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 4]
call ebx
push str.FreeWorkzSettings
push str.cmd.exe__c_reg_delete_HKCUSoftware_s__f
lea eax, [ebp - 0x110]
push esi
push eax
call edi
add esp, 0x10
lea ecx, [ebp - 0x110]
call fcn.004057cb
push eax
mov eax, ecx
push eax
push 1
push 0
push str.freeworkz_cleanup_2
push dword [ebp - 4]
call ebx
push str.FreeWorkzSettings
push str.cmd.exe__c_reg_delete_HKCUSoftwareAppDataLow_s__f
lea eax, [ebp - 0x110]
push esi
push eax
call edi
add esp, 0x10
lea ecx, [ebp - 0x110]
call fcn.004057cb
push eax
mov eax, ecx
push eax
push 1
push 0
push str.freeworkz_cleanup_3
push dword [ebp - 4]
call ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp + 8], 0
jne 0x4043ab
call fcn.00404da7
pop edi
pop esi
pop ebx
leave
ret