Function at 0x4056b6
Capabilities:
Check if file exists
Create process on windows
Delete directory
Delete file
Get common file path
Get comspec environment variable
Get file attributes
Move file
Query environment variable
Self delete
Set current directory
Set file attributes

Disassembly:
push ebp
lea ebp, [esp - 0x5978]
mov eax, 0x59f8
call fcn.00406900
mov eax, dword [0x4161a0]
xor eax, ebp
mov dword [ebp + 0x5974], eax
push ebx
push esi
mov esi, 0x400
push esi
lea eax, [ebp + 0x4be4]
push eax
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp + 0x4be4]
push eax
lea eax, [ebp + 0x3fe4]
push eax
call fcn.00406562
lea eax, [ebp + 0x3fe4]
push 0x5c
push eax
call fcn.0040764a
add esp, 0x10
cmp eax, ebx
je 0x405bc7
lea ecx, [ebp + 0x3fe4]
cmp eax, ecx
jbe 0x405732
cmp word [eax - 2], 0x3a
jne 0x405732
xor ecx, ecx
mov word [eax + 2], cx
jmp 0x405737
xor ecx, ecx
mov word [eax], cx
push edi
lea eax, [ebp + 0x3fe4]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea eax, [ebp + 0x3fe4]
push eax
call fcn.00403866
mov edi, 0x13f0
cmp byte [0x41a918], bl
jne 0x405785
push 0x10024
push edi
call fcn.00404b94
push eax
push 0x13f3
call fcn.00404b94
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x405bc6
push ebx
push 0x4128b4
push str.Uninstall.lst
call fcn.00401a0c
mov dword [ebp - 0x2c], eax
cmp eax, ebx
jne 0x4057df
push str.Uninstall.lst
push 0x13f4
call fcn.00404b94
push eax
lea eax, [ebp + 0x57e4]
push 0xc8
push eax
call fcn.00402123
add esp, 0x10
push 0x10010
push edi
call fcn.00404b94
push eax
lea eax, [ebp + 0x57e4]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x405bc6
push pe_nt_image_headers32
push 0x13fa
call fcn.00404b94
push eax
lea eax, [ebp + 0x49e4]
push eax
call fcn.00404dd0
push pe_nt_image_headers32
push edi
call fcn.00404b94
push eax
lea eax, [ebp + 0x47e4]
push eax
call fcn.00404dd0
call fcn.004053b2
mov ecx, 0x417fe8
call fcn.00404a60
cmp byte [0x41a919], bl
jne 0x405bc6
mov dword [ebp - 0x24], ebx
mov edi, dword [ebp - 0x24]
push ebx
lea edi, [edi + 0x41617c]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
add dword [ebp - 0x24], 4
cmp dword [ebp - 0x24], 8
jb 0x405831
mov byte [ebp - 0x1d], bl
push dword [ebp - 0x2c]
lea eax, [ebp + 0x53e4]
push esi
push eax
mov dword [ebp - 0x24], ebx
call fcn.0040845c
add esp, 0xc
test eax, eax
je 0x405a0f
lea eax, [ebp + 0x53e4]
push eax
call fcn.00404d6f
cmp byte [ebp + 0x53e4], bl
je 0x4059dd
lea eax, [ebp + 0x3fe4]
push eax
lea eax, [ebp + 0x17e4]
push eax
call fcn.00406562
pop ecx
pop ecx
lea eax, [ebp + 0x17e4]
push 0x1000000
push eax
call fcn.0040709b
pop ecx
lea eax, [ebp + eax*2 + 0x17e4]
push eax
lea eax, [ebp + 0x53e4]
push eax
call fcn.00404e56
lea eax, [ebp + 0x17e4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x28], eax
push ebx
lea eax, [ebp + 0x17e4]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp dword [ebp - 0x28], 0xffffffff
je 0x405908
test byte [ebp - 0x28], 0x10
je 0x405908
lea eax, [ebp + 0x17e4]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
add dword [ebp - 0x24], eax
jmp 0x4059dd
lea eax, [ebp + 0x17e4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
add dword [ebp - 0x24], eax
cmp eax, ebx
jne 0x4059dd
cmp dword [ebp - 0x28], 0xffffffff
je 0x4059dd
lea eax, [ebp + 0x17e4]
push eax
call fcn.0040390f
mov edi, eax
lea eax, [ebp + 0x4be4]
push eax
call fcn.0040390f
push eax
push edi
call fcn.00404e81
test eax, eax
je 0x4059dd
push str.Uninstall.lst
push edi
call fcn.00404e81
test eax, eax
je 0x4059dd
mov byte [ebp - 0x1d], 1
xor edi, edi
push edi
lea eax, [ebp + 0x17e4]
push eax
push str._s._d.tmp
lea eax, [ebp + 0x2fe4]
push esi
push eax
call fcn.00402123
add esp, 0x14
lea eax, [ebp + 0x2fe4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4059a0
inc edi
cmp edi, 0x3e8
jl 0x405968
lea eax, [ebp + 0x2fe4]
push eax
lea eax, [ebp + 0x17e4]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x4059cd
lea eax, [ebp + 0x17e4]
push eax
lea eax, [ebp + 0x2fe4]
push eax
call fcn.00406562
pop ecx
pop ecx
push 4
push ebx
lea eax, [ebp + 0x2fe4]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push dword [ebp - 0x2c]
lea eax, [ebp + 0x53e4]
push esi
push eax
call fcn.0040845c
add esp, 0xc
test eax, eax
jne 0x405876
cmp dword [ebp - 0x24], ebx
je 0x405a0f
push ebx
push ebx
push dword [ebp - 0x2c]
call fcn.004083d7
add esp, 0xc
jmp 0x405858
push dword [ebp - 0x2c]
call fcn.004073ec
mov dword [esp], str.Uninstall.lst
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp byte [ebp - 0x1d], bl
je 0x405a4b
cmp byte [0x41a918], bl
jne 0x405a4b
push 0x10040
lea eax, [ebp + 0x47e4]
push eax
lea eax, [ebp + 0x49e4]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
lea eax, [ebp + 0x27e4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp + 0x27e4]
push str.Uninstall_Rar.Bat
push eax
call fcn.00406538
pop ecx
pop ecx
push ebx
push 0x411df0
lea eax, [ebp + 0x27e4]
push eax
call fcn.00401a0c
mov edi, eax
cmp edi, ebx
je 0x405bc6
lea eax, [ebp + 0x4be4]
push eax
push str.__s___wait_r_n
lea eax, [ebp + 0x37e4]
push esi
push eax
call fcn.00402123
add esp, 0x10
lea eax, [ebp + 0x37e4]
push eax
push edi
call fcn.00405365
lea eax, [ebp - 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp + 0x4be4]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp + 0x4be4]
push eax
push str.del___s__r_nrd___s__r_nif_not_exist___s__goto_done_r_n
lea eax, [ebp + 0x37e4]
push esi
push eax
call fcn.00402123
add esp, 0x18
mov dword [ebp - 0x28], 5
lea eax, [ebp + 0x37e4]
push eax
push edi
call fcn.00405365
dec dword [ebp - 0x28]
jne 0x405aea
lea eax, [ebp + 0x27e4]
push eax
lea eax, [ebp + 0x4be4]
push eax
push eax
push str.:done_r_nif_exist___s____s___warning_r_ndel___s_
lea eax, [ebp + 0x37e4]
push esi
push eax
call fcn.00402123
add esp, 0x18
lea eax, [ebp + 0x37e4]
push eax
push edi
call fcn.00405365
push edi
call fcn.004073ec
pop ecx
xor eax, eax
mov word [ebp + 0xfe4], ax
push esi
lea eax, [ebp + 0xfe4]
push eax
push str.COMSPEC
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea eax, [ebp + 0x27e4]
push eax
lea eax, [ebp + 0xfe4]
push eax
push str._s__c___s_
lea eax, [ebp + 0x7e4]
push esi
push eax
call fcn.00402123
push 0x44
pop esi
push esi
lea eax, [ebp - 0x70]
push ebx
push eax
call fcn.00407300
mov dword [ebp - 0x70], esi
add esp, 0x20
xor esi, esi
xor eax, eax
inc esi
push 0x412750
mov dword [ebp - 0x44], esi
mov word [ebp - 0x40], ax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x70]
push eax
push ebx
push ebx
call fcn.004037cc
neg eax
sbb eax, eax
and eax, 0xfffffff8
add eax, 8
push eax
push esi
push ebx
push ebx
lea eax, [ebp + 0x7e4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
pop edi
mov ecx, dword [ebp + 0x5974]
pop esi
xor ecx, ebp
pop ebx
call fcn.004068ab
add ebp, 0x5978
leave
ret