Function at 0x401000
Capabilities:
Accept command line arguments
Check os version
Copy file
Delete directory
Delete file
Delete registry key
Delete registry value
Extract resource via kernel32 functions
Get common file path
Get installed programs
Move file
Query environment variable
Set current directory

Disassembly:
jmp 0x40115d
call 0x401642
mov dword [section..data], eax
push 0x300
push 8
push eax
call main
mov dword [0x403004], eax
add eax, 0x100
mov dword [0x403008], eax
add eax, 0x100
mov dword [0x40300c], eax
push 0x100
push eax
push 0x401158
call sub.kernel32.dll_GetEnvironmentVariableA
add eax, dword [0x40300c]
mov byte [eax], 0x5c
mov dword [0x403020], 0x9c
push 0x403020
call sub.kernel32.dll_GetVersionExA
push 0x100
push dword [0x403008]
push 0
call sub.kernel32.dll_GetModuleFileNameA
call sub.kernel32.dll_GetCommandLineA
push eax
push eax
call sub.kernel32.dll_lstrlenA
pop edx
cmp byte [edx + eax - 1], 0x55
je 0x4012a8
push dword [0x40300c]
push dword [0x403004]
call sub.kernel32.dll_lstrcpyA
push 0x40112b
push eax
call sub.kernel32.dll_lstrcatA
push 0
push eax
push dword [0x403008]
call 0x401612
or eax, eax
je 0x4012a8
mov dword [0x403020], 0x9c
push 0x403020
call sub.kernel32.dll_GetVersionExA
cmp dword [0x403030], 2
jne 0x401244
push 4
push 0
push dword [0x403004]
call sub.kernel32.dll_MoveFileExA
jmp 0x40127a
push 0x100
push dword [0x403008]
call sub.kernel32.dll_GetWindowsDirectoryA
push 0x401139
push dword [0x403008]
call sub.kernel32.dll_lstrcatA
push eax
push dword [0x403004]
push 0x40114d
push 0x401146
call sub.kernel32.dll_WritePrivateProfileStringA
push 0x40311e
push 0x4030da
push 0
push 0
push 0x20
push 0
push 0
push 0
push 0x401151
push dword [0x403004]
call sub.kernel32.dll_CreateProcessA
or eax, eax
jne 0x4015f3
push 0xa
push 1
push 0
call sub.kernel32.dll_FindResourceA
mov dword [0x403010], eax
push eax
push 0
call sub.kernel32.dll_LoadResource
push eax
call sub.kernel32.dll_LockResource
or eax, eax
je 0x4012e1
mov dword [0x403018], eax
push dword [0x403010]
push 0
call sub.kernel32.dll_SizeofResource
cmp eax, 0x10
jg 0x4012f9
push 0x10
push 0x401005
push 0x40102b
push 0
call sub.user32.dll_MessageBoxA
jmp 0x4015f3
push dword [0x403018]
push 0x40100b
push dword [0x403004]
call sub.user32.dll_wsprintfA
add esp, 0xc
push dword [0x403018]
push 0x40105e
push dword [0x403008]
call sub.user32.dll_wsprintfA
add esp, 0xc
push 0x34
push dword [0x403004]
push dword [0x403008]
push 0
call sub.user32.dll_MessageBoxA
cmp eax, 6
jne 0x4015f3
push dword [0x403018]
call sub.kernel32.dll_lstrlenA
inc eax
add eax, dword [0x403018]
mov dword [0x40301c], eax
mov dword [0x403010], eax
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
push dword [0x403010]
call sub.kernel32.dll_lstrlenA
inc eax
add dword [0x403010], eax
mov esi, dword [0x403010]
lodsb al, byte [esi]
cmp al, 0
je 0x40140c
push dword [0x403010]
call sub.kernel32.dll_DeleteFileA
push dword [0x403010]
call fcn.004016e0
push dword [0x403010]
call sub.kernel32.dll_lstrlenA
push eax
add eax, dword [0x403010]
sub eax, 4
push eax
push 0x401153
push eax
call sub.kernel32.dll_lstrcmpA
pop ecx
or eax, eax
jne 0x4013da
mov dword [ecx + 1], 0x646967
push dword [0x403010]
call sub.kernel32.dll_DeleteFileA
pop eax
dec eax
je 0x40136b
mov ecx, dword [0x403010]
cmp byte [ecx + eax - 1], 0x5c
jne 0x4013db
pushal
push eax
push dword [0x403010]
push dword [0x403004]
call sub.kernel32.dll_lstrcpynA
push dword [0x403004]
call sub.kernel32.dll_RemoveDirectoryA
popal
jmp 0x4013db
push 0x40112b
call sub.kernel32.dll_DeleteFileA
push dword [0x40300c]
call sub.kernel32.dll_SetCurrentDirectoryA
push dword [0x40301c]
call sub.kernel32.dll_RemoveDirectoryA
inc dword [0x403010]
push dword [0x403010]
pop dword [0x40301c]
push dword [0x403010]
call sub.kernel32.dll_lstrlenA
inc eax
add dword [0x403010], eax
mov eax, dword [0x403010]
cmp byte [eax], 0
je 0x401467
push dword [0x403010]
call sub.kernel32.dll_DeleteFileA
jmp 0x40143e
mov eax, 2
cmp dword [0x403024], 6
jl 0x40147a
mov eax, 0x17
push 0x403014
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
push dword [0x403004]
push dword [0x403014]
call sub.shell32.dll_SHGetPathFromIDListA
push dword [0x40301c]
call sub.kernel32.dll_lstrlenA
or eax, eax
je 0x4014e6
mov dword [0x403014], eax
push dword [0x403004]
call sub.kernel32.dll_SetCurrentDirectoryA
push dword [0x40301c]
call sub.kernel32.dll_RemoveDirectoryA
or eax, eax
je 0x4014e6
dec dword [0x403014]
mov eax, dword [0x403014]
add eax, dword [0x40301c]
cmp byte [eax], 0
je 0x4014e6
cmp byte [eax], 0x5c
jne 0x4014c6
mov byte [eax], 0
jmp 0x4014b7
inc dword [0x403010]
mov eax, dword [0x403010]
cmp byte [eax], 0
je 0x401595
push eax
add dword [0x403010], 5
push dword [0x403010]
push 0x40301c
push 0xf003f
push 0
push dword [0x403010]
push dword [eax + 1]
call sub.advapi32.dll_RegOpenKeyExA
push dword [0x403010]
call sub.kernel32.dll_lstrlenA
inc eax
add dword [0x403010], eax
mov eax, dword [0x403010]
cmp byte [eax], 1
jne 0x401553
push 0
push dword [0x40301c]
call sub.advapi32.dll_RegDeleteValueA
inc dword [0x403010]
jmp 0x401575
push dword [0x403010]
push dword [0x40301c]
call sub.advapi32.dll_RegDeleteValueA
push dword [0x403010]
call sub.kernel32.dll_lstrlenA
add dword [0x403010], eax
pop edx
pop eax
cmp byte [eax], 0x43
jne 0x401585
push edx
push dword [eax + 1]
call sub.advapi32.dll_RegDeleteKeyA
push dword [0x40301c]
call sub.advapi32.dll_RegCloseKey
jmp 0x4014e6
push 0x4010f6
push dword [0x403004]
call sub.kernel32.dll_lstrcpyA
push dword [0x403018]
push 0x4010c1
push dword [0x403008]
call sub.user32.dll_wsprintfA
add esp, 0xc
push dword [0x403018]
push dword [0x403004]
call sub.kernel32.dll_lstrcatA
push dword [0x403004]
push 0x80000002
call sub.advapi32.dll_RegDeleteKeyA
push 0x40
push 0x401018
push dword [0x403008]
push 0
call sub.user32.dll_MessageBoxA
push dword [0x403004]
push 0
push dword [section..data]
call sub.kernel32.dll_HeapFree
push 0
call sub.kernel32.dll_ExitProcess
call sub.comctl32.dll_InitCommonControls
jmp dword [sym.imp.kernel32.dll_CopyFileA]