Function at 0x140001120
Capabilities:
Create process on windows
Delete file
Terminate process

Disassembly:
push rbp
lea rbp, [rsp - 0x1d0]
sub rsp, 0x2d0
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
lea rcx, str.Once_finished_you_will_need_to_delete_the_folders_yourself._n_nAre_you_sure_you_want_to_uninstall___yes_no_:
call fcn.140001060
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov edx, 0xa
lea rcx, [rbp - 0x70]
mov r8, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgetws]
lea rcx, [rbp - 0x70]
mov rax, 0xffffffffffffffff
cmp word [rcx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x140001173
lea rax, [rax*2 - 2]
cmp rax, 0x14
jae 0x1400014cd
mov qword [rsp + 0x2e8], rsi
lea rdx, [rbp - 0x70]
xor esi, esi
lea r8, [0x1400033e8]
mov word [rbp + rax - 0x70], si
mov ecx, esi
nop dword [rax]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r8 + rcx*2 - 2]
jne 0x1400011c7
cmp rcx, 4
jne 0x1400011b0
jmp 0x1400011dc
cmp word [rbp - 0x70], 0x79
jne 0x1400014bc
cmp word [rbp - 0x6e], si
jne 0x1400014bc
mov qword [rsp + 0x2e0], rbx
mov qword [rsp + 0x2f0], rdi
call qword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x1400012fd
lea rcx, str.Restarting_as_administrator..._n
call fcn.140001060
mov r8d, 0x104
lea rdx, [rbp - 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
mov dword [rsp + 0x20], 0x70
mov qword [rbp - 0x7c], rax
lea rcx, [rsp + 0x20]
mov dword [rbp - 0x74], eax
xorps xmm0, xmm0
lea rax, str.runas
mov dword [rsp + 0x24], 0x2000040
mov qword [rsp + 0x30], rax
mov edi, 1
lea rax, [rbp - 0x50]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rax
lea rax, [0x1400033fc]
mov qword [rsp + 0x40], rax
movups xmmword [rsp + 0x54], xmm0
mov qword [rsp + 0x48], rsi
movups xmmword [rsp + 0x64], xmm0
mov dword [rsp + 0x50], edi
movups xmmword [rsp + 0x74], xmm0
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x1400012b2
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [rdi + 1]
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, ebx
lea rdx, str.Failed_to_elevate_privileges:__lu_n
mov rcx, rax
call fcn.140001010
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [rbp - 0x78]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x2e0]
mov rdi, qword [rsp + 0x2f0]
mov rsi, qword [rsp + 0x2e8]
xor eax, eax
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.1400014f0
add rsp, 0x2d0
pop rbp
ret
lea rcx, str.C:_Program_Files_ReagansViruses_TarkovTreeView.exe
mov qword [rsp + 0x2f8], r14
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wremove]
mov edi, 1
test eax, eax
jne 0x140001332
lea rdx, str.C:_Program_Files_ReagansViruses_TarkovTreeView.exe
lea rcx, str.Successfully_deleted:__s_n
call fcn.140001060
mov eax, edi
jmp 0x140001341
lea rcx, str.Error_deleting_file
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
mov eax, esi
test eax, eax
lea rbx, str._s_has_been_uninstalled._n
mov rcx, rbx
lea r14, str.Failed_to_uninstall__s._n
cmove rcx, r14
lea rdx, str.C:_Program_Files_ReagansViruses_TarkovTreeView.exe
call fcn.140001060
lea rcx, str.C:_Program_Files_ReagansViruses_cjson.dll
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wremove]
test eax, eax
jne 0x14000138c
lea rdx, str.C:_Program_Files_ReagansViruses_cjson.dll
lea rcx, str.Successfully_deleted:__s_n
call fcn.140001060
mov eax, edi
jmp 0x14000139b
lea rcx, str.Error_deleting_file
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
mov eax, esi
test eax, eax
lea rdx, str.C:_Program_Files_ReagansViruses_cjson.dll
mov rcx, rbx
cmove rcx, r14
call fcn.140001060
lea rcx, str.C:_Program_Files_ReagansViruses_libcurl.dll
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wremove]
test eax, eax
jne 0x1400013d8
lea rdx, str.C:_Program_Files_ReagansViruses_libcurl.dll
lea rcx, str.Successfully_deleted:__s_n
call fcn.140001060
mov eax, edi
jmp 0x1400013e7
lea rcx, str.Error_deleting_file
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
mov eax, esi
test eax, eax
lea rdx, str.C:_Program_Files_ReagansViruses_libcurl.dll
mov rcx, rbx
cmove rcx, r14
call fcn.140001060
lea rcx, str.C:_Program_Files_ReagansViruses_zlib1.dll
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wremove]
test eax, eax
jne 0x140001424
lea rdx, str.C:_Program_Files_ReagansViruses_zlib1.dll
lea rcx, str.Successfully_deleted:__s_n
call fcn.140001060
mov eax, edi
jmp 0x140001433
lea rcx, str.Error_deleting_file
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
mov eax, esi
test eax, eax
lea rdx, str.C:_Program_Files_ReagansViruses_zlib1.dll
cmove rbx, r14
mov rcx, rbx
call fcn.140001060
lea rcx, str.C:_Program_Files_ReagansViruses_Uninstaller_uninstaller.exe
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wremove]
mov r14, qword [rsp + 0x2f8]
test eax, eax
jne 0x140001476
lea rdx, str.C:_Program_Files_ReagansViruses_Uninstaller_uninstaller.exe
lea rcx, str.Successfully_deleted:__s_n
call fcn.140001060
jmp 0x140001485
lea rcx, str.Error_deleting_file
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
mov edi, esi
lea rax, str.Failed_to_delete__s._n
test edi, edi
lea rcx, str._s_has_been_deleted._n
cmove rcx, rax
lea rdx, str.C:_Program_Files_ReagansViruses_Uninstaller_uninstaller.exe
call fcn.140001060
lea rcx, str._n_nNOTE:_You_will_have_to_delete_the_folder_yourself__n_nEnter_any_key_to_exit..._n
call fcn.1400010c0
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
jmp 0x1400012cb
lea rcx, str.Uninstallation_canceled._n
call fcn.140001060
jmp 0x1400012db
call fcn.140001618
int3