Function at 0x43b680
Capabilities:
Create process on windows
Delete file
Read .ini file
Self delete

Disassembly:
push 0xffffffffffffffff
push 0x453f12
mov eax, dword fs:[0]
push eax
sub esp, 0x12c
mov eax, dword [0x4652b0]
xor eax, esp
mov dword [esp + 0x128], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4652b0]
xor eax, esp
push eax
lea eax, [esp + 0x140]
mov dword fs:[0], eax
mov esi, ecx
push str.rsinstall:CUninstall::UninstallLinks_start
push 0x40
mov dword [esp + 0x20], esi
call fcn.004025a0
mov eax, dword [0x467e80]
mov edx, dword [eax + 0xc]
add esp, 8
mov ecx, 0x467e80
call edx
add eax, 0x10
mov dword [esp + 0x2c], eax
mov dword [esp + 0x148], 0
mov eax, dword [0x467e80]
mov edx, dword [eax + 0xc]
mov ecx, 0x467e80
call edx
lea ebp, [eax + 0x10]
mov dword [esp + 0x14], ebp
mov byte [esp + 0x148], 1
mov eax, dword [0x467e80]
mov edx, dword [eax + 0xc]
mov ecx, 0x467e80
call edx
add eax, 0x10
mov dword [esp + 0x20], eax
mov byte [esp + 0x148], 2
mov eax, dword [0x467e80]
mov edx, dword [eax + 0xc]
mov ecx, 0x467e80
call edx
lea ebx, [eax + 0x10]
mov dword [esp + 0x28], ebx
mov byte [esp + 0x148], 3
mov esi, dword [esi + 0x18]
test esi, esi
je 0x43b76a
mov eax, dword [esi]
mov edx, dword [eax + 0x18]
mov ecx, esi
call edx
test eax, eax
jne 0x43b826
mov esi, dword [esi + 0x40]
test esi, esi
jne 0x43b752
xor eax, eax
mov esi, str.LINKS
call fcn.0041d140
mov edi, eax
test edi, edi
je 0x43b7a3
lea esp, [esp]
mov eax, dword [edi]
mov edx, dword [eax + 0x18]
mov ecx, edi
call edx
test eax, eax
jne 0x43b834
mov esi, str.LINKS
mov eax, edi
call fcn.0041d190
mov edi, eax
test edi, edi
jne 0x43b780
xor eax, eax
mov esi, str.ITEM
call fcn.0041d140
mov edi, eax
test edi, edi
je 0x43b7d8
mov eax, dword [edi]
mov edx, dword [eax + 0x18]
mov ecx, edi
call edx
test eax, eax
jne 0x43b842
mov esi, str.ITEM
mov eax, edi
call fcn.0041d190
mov edi, eax
test edi, edi
jne 0x43b7b5
mov dword [esp + 0x1c], 0
push 0x103
lea eax, [esp + 0x39]
push 0
push eax
mov dword [esp + 0x3c], 0
mov byte [esp + 0x40], 0
call fcn.00443400
add esp, 0xc
cmp dword [esp + 0x1c], 0
je 0x43bcad
lea esp, [esp]
mov edx, dword [esp + 0x1c]
mov ecx, str.NAMEID
call fcn.0041d580
test eax, eax
jne 0x43b851
xor ecx, ecx
jmp 0x43b85f
mov eax, dword [esi]
mov edx, dword [eax + 0x18]
mov ecx, esi
call edx
jmp 0x43b76c
mov eax, dword [edi]
mov edx, dword [eax + 0x18]
mov ecx, edi
call edx
jmp 0x43b7a5
mov eax, dword [edi]
mov edx, dword [eax + 0x18]
mov ecx, edi
call edx
mov dword [esp + 0x1c], eax
jmp 0x43b7e0
mov ecx, eax
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x43b856
sub ecx, esi
push eax
mov edi, ecx
lea eax, [esp + 0x2c]
call fcn.00404710
mov ecx, dword [esp + 0x18]
mov esi, dword [ecx + 0x8c]
mov ebx, dword [esp + 0x28]
mov eax, dword [ebx - 8]
mov ecx, 1
sub ecx, dword [ebx - 4]
sub eax, 0x104
or eax, ecx
jge 0x43b89f
mov ecx, 0x104
lea eax, [esp + 0x28]
call fcn.00404d80
mov ebx, dword [esp + 0x28]
push esi
push 0x104
push ebx
push 0
push ebx
push str.LANGUAGE
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, dword [ebx - 8]
push eax
push ebx
call fcn.0043ecbd
add esp, 8
test eax, eax
jl 0x43be15
cmp eax, dword [ebx - 8]
jg 0x43be15
mov ebp, dword [esp + 0x1c]
mov dword [ebx - 0xc], eax
mov ecx, str.FILENAME
mov edx, ebp
mov byte [eax + ebx], 0
call fcn.0041d580
test eax, eax
jne 0x43b8f1
xor ecx, ecx
jmp 0x43b8ff
mov ecx, eax
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x43b8f6
sub ecx, esi
push eax
mov edi, ecx
lea eax, [esp + 0x30]
call fcn.00404710
mov ecx, str.TARGETDIR
mov edx, ebp
call fcn.0041d580
test eax, eax
jne 0x43b91f
xor ecx, ecx
jmp 0x43b92d
mov ecx, eax
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x43b924
sub ecx, esi
push eax
mov edi, ecx
lea eax, [esp + 0x18]
call fcn.00404710
mov esi, dword [esp + 0x14]
cmp dword [esi - 0xc], 0
jl 0x43b9fc
push str._DESKTOP_
push esi
call fcn.0043e3d5
add esp, 8
test eax, eax
je 0x43b986
sub eax, esi
cmp eax, 0xffffffff
je 0x43b986
mov edx, dword [esp + 0x18]
mov eax, dword [edx + 0x80]
push eax
push str._DESKTOP_
lea eax, [esp + 0x1c]
push eax
call fcn.00425ab0
mov esi, dword [esp + 0x14]
mov dword [esp + 0x30], 1
cmp dword [esi - 0xc], 0
jl 0x43b9fc
push str._LINKS_
push esi
call fcn.0043e3d5
add esp, 8
test eax, eax
je 0x43b9c3
sub eax, esi
cmp eax, 0xffffffff
je 0x43b9c3
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx + 0x84]
push eax
push str._LINKS_
lea edx, [esp + 0x1c]
push edx
call fcn.00425ab0
mov esi, dword [esp + 0x14]
cmp dword [esi - 0xc], 0
jl 0x43b9fc
push str._QUICKLAUNCH_
push esi
call fcn.0043e3d5
add esp, 8
test eax, eax
je 0x43b9fc
sub eax, esi
cmp eax, 0xffffffff
je 0x43b9fc
mov eax, dword [esp + 0x18]
mov eax, dword [eax + 0x88]
push eax
push str._QUICKLAUNCH_
lea ecx, [esp + 0x1c]
push ecx
call fcn.00425ab0
mov ecx, str.TARGETSUBDIRID
mov edx, ebp
call fcn.0041d580
test eax, eax
je 0x43bac5
mov ecx, str.TARGETSUBDIRID
mov edx, ebp
call fcn.0041d580
test eax, eax
jne 0x43ba24
xor ecx, ecx
jmp 0x43ba39
mov ecx, eax
lea esi, [ecx + 1]
lea esp, [esp]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x43ba30
sub ecx, esi
push eax
mov edi, ecx
lea eax, [esp + 0x24]
call fcn.00404710
mov edi, dword [esp + 0x20]
mov eax, dword [edi - 8]
mov edx, dword [esp + 0x18]
mov esi, dword [edx + 0x8c]
mov ecx, 1
sub ecx, dword [edi - 4]
sub eax, 0x104
or eax, ecx
jge 0x43ba79
mov ecx, 0x104
lea eax, [esp + 0x20]
call fcn.00404d80
mov edi, dword [esp + 0x20]
push esi
push 0x104
push edi
push 0
push edi
push str.LANGUAGE
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, dword [edi - 8]
push eax
push edi
call fcn.0043ecbd
add esp, 8
test eax, eax
jl 0x43be15
cmp eax, dword [edi - 8]
jg 0x43be15
mov dword [edi - 0xc], eax
push edi
mov byte [eax + edi], 0
push 0x45c154
lea edi, [esp + 0x1c]
call fcn.0043d8d0
add esp, 8
push ebx
push str._s.lnk
lea edi, [esp + 0x1c]
call fcn.0043d8d0
mov ebp, dword [esp + 0x1c]
add esp, 8
cmp dword [esp + 0x30], 0
je 0x43bc45
push str.rsinstall:CUninstall::ShellExecute_start
push 0x40
call fcn.004025a0
mov eax, dword [esp + 0x20]
mov esi, dword [eax + 0x88]
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
sub esi, 0x10
add esp, 8
call eax
cmp dword [esi + 0xc], 0
lea ecx, [esi + 0xc]
jl 0x43bb26
cmp eax, dword [esi]
jne 0x43bb26
mov edi, esi
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x43bb5a
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 1
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
je 0x43be1f
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 4]
inc eax
push eax
add esi, 0x10
push esi
push eax
lea ecx, [edi + 0x10]
push ecx
call fcn.0043ed20
add esp, 0x10
add edi, 0x10
mov dword [esp + 0x24], edi
push str.User_PinnedTaskBar_
lea edx, [esp + 0x28]
push edx
mov edx, 0x27
mov byte [esp + 0x150], 4
call fcn.00404c50
mov esi, dword [esp + 0x24]
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0
push 0
push 0
push esi
push str.TaskbarunPin
push 0
call edi
push eax
push str.TaskbarunPin__0x_x
push 0x80
call fcn.004025a0
add esp, 0xc
push 0
push 0
push 0
push ebp
push str.startunpin
push 0
call edi
push eax
push str.TaskbarunPin__0x_x
push 0x80
call fcn.004025a0
add esp, 0xc
push str.rsinstall:CUninstall::ShellExecute_end
push 0x40
call fcn.004025a0
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x43bc21
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0x104
mov edi, eax
lea eax, [esp + 0x3c]
push eax
push 0
push edi
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
lea ecx, [esp + 0x34]
push ecx
push edi
push ebp
push str.DeleteFile__s_fail_with_error_code__d:__s
push 0x40
call fcn.004025a0
add esp, 0x14
lea eax, [esi - 0x10]
mov byte [esp + 0x148], 3
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x43bc45
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x43bc8a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0x104
lea ecx, [esp + 0x3c]
push ecx
push 0
mov esi, eax
push esi
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
lea edx, [esp + 0x34]
push edx
push esi
push ebp
push str.DeleteFile__s_fail_with_error_code__d:__s
push 0x40
call fcn.004025a0
add esp, 0x14
mov eax, dword [esp + 0x1c]
mov esi, dword [eax + 0x40]
test esi, esi
je 0x43bcad
mov edx, dword [esi]
mov eax, dword [edx + 0x18]
mov ecx, esi
call eax
test eax, eax
jne 0x43bdfb
mov esi, dword [esi + 0x40]
test esi, esi
jne 0x43bc95
mov edx, dword [0x467e80]
mov eax, dword [edx + 0xc]
mov ecx, 0x467e80
call eax
add eax, 0x10
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x18]
mov byte [esp + 0x148], 5
mov ecx, dword [eax + 0x98]
mov edx, dword [eax + 0x84]
push ecx
push edx
push str._s_s
lea edi, [esp + 0x30]
call fcn.00404e80
mov esi, dword [esp + 0x30]
add esp, 0xc
push 0
push 1
push esi
call section..text
add esp, 0xc
push str.rsinstall:CUninstall::UninstallLinks_end
push 0x40
call fcn.004025a0
lea eax, [esi - 0x10]
add esp, 8
mov byte [esp + 0x148], 3
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43bd33
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebx - 0x10]
mov byte [esp + 0x148], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43bd57
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x148], 1
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43bd7f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebp - 0x10]
mov byte [esp + 0x148], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43bda3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x148], 0xffffffff
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43bdce
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x140]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.0043defc
add esp, 0x138
ret
mov edx, dword [esi]
mov eax, dword [edx + 0x18]
mov ecx, esi
call eax
mov dword [esp + 0x1c], eax
test eax, eax
jne 0x43b810
jmp 0x43bcad
push 0x80070057
call fcn.004059f0
call fcn.00404d70
int3