Function at 0x40309c
Capabilities:
Copy file
Create process on windows
Get common file path
Hide graphical window
Set current directory
Terminate process

Disassembly:
push ebp
mov ecx, 0x405b40
mov ebp, esp
mov edx, 0x924
sub esp, 0x5c
mov dword [ebp - 8], 1
push ebx
push esi
push edi
call fcn.00401269
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push section..Shared
mov dword [0x405b40], eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
test eax, eax
jne 0x4034b7
mov esi, 0xff
mov edi, 0x406470
push esi
mov eax, dword [0x405b40]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call fcn.004013bc
push edi
mov edi, 0x405330
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, edi
mov edi, 0x407080
call fcn.004014a6
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0x405730
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push esi
push 0x405530
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push edi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
call esi
cmp byte [eax + 0x40707f], 0x5c
jne 0x40314d
push edi
call esi
mov byte [eax + 0x40707f], 0
mov edi, 0x405730
push edi
call esi
cmp byte [eax + 0x40572f], 0x5c
jne 0x403168
push edi
call esi
mov byte [eax + 0x40572f], 0
mov edi, 0x407080
mov ecx, 0x405730
mov edx, edi
call fcn.00401000
test eax, eax
je 0x403189
push 0x405324
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x406a70
call esi
mov byte [ebp - 1], al
test al, al
jne 0x40322e
lea edx, [ebp - 8]
mov edi, 0x406470
mov ecx, edi
call fcn.00401336
cmp eax, 0xffffffff
mov esi, eax
jne 0x4031c4
push edi
push str.Dont_open__s
push 0x1001
call fcn.0040127c
add esp, 0xc
xor ebx, ebx
mov eax, dword [ebp - 8]
push ebx
sub eax, 0x100
push ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0x406470
mov edx, 0x405730
push 0x100
mov ecx, esi
call fcn.0040137e
cmp byte [0x40582e], bl
je 0x403211
mov eax, 0xfe
cmp byte [eax + 0x405730], 0
je 0x403209
dec eax
test eax, eax
jg 0x4031fb
add eax, 0x405731
push eax
jmp 0x403216
push str.uninstal.ini
mov edx, 0x405330
mov ecx, 0x406c70
call fcn.00401186
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40323e
push 0x406a70
push 0x406c70
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor ebx, ebx
mov esi, 0x13880
mov ecx, esi
mov dword [0x405b34], ebx
call fcn.004011fa
mov ecx, esi
mov dword [0x405b30], eax
mov dword [0x406460], 1
mov dword [0x406e74], ebx
call fcn.004011fa
mov ecx, 0x30d40
mov dword [0x406e70], eax
call fcn.004011fa
mov esi, 0x40632c
mov dword [0x406458], eax
mov dword [0x40645c], eax
call fcn.00401958
mov ecx, 0xa
call fcn.004014ef
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
mov ecx, 0x30
call fcn.004014ef
push eax
push str._s__s
push 0x4063ac
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov eax, dword [0x406324]
mov dword [0x40642c], eax
mov eax, dword [0x406320]
shl eax, 3
add eax, dword [0x406324]
sub eax, 8
cmp byte [ebp - 1], bl
mov dword [0x406430], eax
jne 0x4033fc
cmp dword [0x40500c], ebx
jne 0x403312
push esi
mov ecx, 0x2b
call fcn.004014ef
push eax
push 2
call fcn.0040127c
add esp, 0xc
cmp eax, 6
jne 0x403438
push str.guninst.exe
mov edx, 0x407080
mov esi, 0x405730
mov edi, 0x406470
mov ecx, esi
call fcn.00401186
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x403355
push esi
mov ecx, 0x24
push edi
call fcn.004014ef
push eax
push 0x1001
call fcn.0040127c
add esp, 0x10
push 0x406c70
mov eax, 0x4052ec
cmp dword [0x40500c], 0
jne 0x40336d
mov eax, 0x405170
push eax
mov esi, 0x406670
push 0x405730
push str.__s___s__s_
push esi
mov edi, 0x44
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
mov ecx, 1
call fcn.0040248d
lea ecx, [ebp - 0x5c]
mov edx, edi
call fcn.00401269
mov dword [ebp - 0x5c], edi
call fcn.00401829
lea eax, [ebp - 0x18]
lea edi, [ebp - 0x5c]
push eax
push edi
xor eax, eax
push eax
push eax
push 0x4000020
push 1
push eax
push eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4033dd
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x403438
push 0x406670
mov ecx, 0x31
call fcn.004014ef
push eax
push 0x1001
call fcn.0040127c
add esp, 0xc
jmp 0x403438
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x407080
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
cmp dword [0x40500c], 0
je 0x403421
xor ecx, ecx
call fcn.0040248d
jmp 0x403438
push 0
mov eax, dword [0x405b40]
push 0x403056
push 0
push 0x65
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
mov ecx, 0x406e70
call fcn.0040120b
mov ecx, 0x406458
call fcn.0040120b
mov ecx, 0x405b30
call fcn.0040120b
mov ecx, 0x406328
xor ebx, ebx
call fcn.0040120b
mov ecx, 0x406324
call fcn.0040120b
mov ecx, 0x405b48
call fcn.0040120b
cmp byte [ebp - 1], bl
je 0x4034ad
push ebx
mov esi, dword [sym.imp.SHELL32.dll_SHChangeNotify]
push 0x405730
mov edi, 0x405330
push 1
push 4
call esi
push ebx
push edi
push 1
push 0x10
call esi
push ebx
push edi
push 0x1001
push 0x1000
call esi
call fcn.00401704
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [section..rdata]
push eax
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
push 6
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xa
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret