Function at 0x404a90
Capabilities:
Accept command line arguments
Check if file exists
Copy file
Create process on windows
Delete directory
Delete file
Delete registry key
Get common file path
Get file attributes
Persist via lnk shortcut
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xce4
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0xce0], eax
push ebx
push esi
push edi
push 0x208
lea eax, [esp + 0x8dc]
push 0
push eax
call fcn.00406b50
add esp, 0xc
lea eax, [esp + 0xae0]
push 0x208
push 0
push eax
call fcn.00406b50
add esp, 0xc
lea eax, [esp + 0xa8]
push 0x208
push 0
push eax
call fcn.00406b50
add esp, 0xc
mov dword [esp + 0x60], 0x44
lea eax, [esp + 0x64]
push 0x40
push 0
push eax
call fcn.00406b50
add esp, 0xc
lea eax, [esp + 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [esp + 0x5c], 1
mov edi, eax
jle 0x404b4b
mov esi, 1
nop dword [eax + eax]
push str.__payload
push dword [edi + esi*4]
call fcn.004064b6
add esp, 8
test eax, eax
jne 0x404b93
inc esi
cmp esi, dword [esp + 0x5c]
jl 0x404b30
lea eax, [esp + 0x8d8]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x404ea4
push 0x10
push str.Uninstaller
push str.Failed_to_get_the_temporary_folder_path
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xce0]
xor ecx, esp
call fcn.004054d3
mov esp, ebp
pop ebp
ret
call fcn.00404830
mov ebx, eax
test ebx, ebx
jne 0x404bca
push eax
push str.Supermium_Setup
push str.A_formally_installed_copy_of_Supermium_could_not_be_located._Now_exiting_the_uninstaller.
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xce0]
xor ecx, esp
call fcn.004054d3
mov esp, ebp
pop ebp
ret
mov edi, dword [sym.imp.USER32.dll_MessageBoxW]
push 4
push str.Supermium_Setup
push str.Would_you_like_to_uninstall_Supermium_
push 0
call edi
cmp eax, 6
jne 0x404bb0
push 4
push str.Supermium_Setup
push str.Would_you_like_to_keep_your_user_data_
push 0
call edi
mov esi, 0x614
cmp eax, 7
jne 0x404d07
push 0x20c
lea eax, [esp + 0x2b4]
mov dword [esp + 0x10], 0
xorps xmm0, xmm0
mov dword [esp + 0x1c], 0
push 0
push eax
movlpd qword [esp + 0x2a], xmm0
mov dword [esp + 0x32], 0
call fcn.00406b50
add esp, 0xc
lea eax, [esp + 0x2b0]
push 0x106
push eax
push str.LOCALAPPDATA
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push str.SupermiumUser_Data
lea ecx, [esp + 0x2b4]
call fcn.004011f0
lea eax, [esp + 0x2b0]
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], eax
lea eax, [esp + 0xc]
push eax
mov word [esp + 0x20], si
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
lea eax, [esp + 0x2b0]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push str.SoftwareMicrosoftWindowsCurrentVersionApp_ManagementARPCacheSupermium
push 0x80000001
call esi
push str.SoftwareSupermiumPreferenceMACsDefaultextensions.settings
push 0x80000001
call esi
push str.SoftwareSupermiumPreferenceMACsDefault
push 0x80000001
call esi
push str.SoftwareSupermiumPreferenceMACsSystem_Profile
push 0x80000001
call esi
push str.SoftwareSupermiumPreferenceMACs
push 0x80000001
call esi
push str.SoftwareSupermiumBLBeacon
push 0x80000001
call esi
push str.SoftwareSupermiumStabilityMetrics
push 0x80000001
call esi
push str.SoftwareSupermiumThirdParty
push 0x80000001
call esi
push str.SoftwareSupermium
push 0x80000001
call esi
push 0x20c
lea eax, [esp + 0x4c4]
mov dword [esp + 0x30], 0
xorps xmm0, xmm0
mov dword [esp + 0x3c], 0
push 0
push eax
movlpd qword [esp + 0x4a], xmm0
mov dword [esp + 0x52], 0
call fcn.00406b50
lea ecx, [esp + 0x4cc]
mov esi, ebx
mov eax, ecx
add esp, 0xc
mov edx, 0x82
sub esi, eax
lea eax, [edx + 0x7fffff7c]
test eax, eax
je 0x404d6f
movzx eax, word [esi + ecx]
test ax, ax
je 0x404d6f
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x404d51
lea eax, [ecx - 2]
mov dword [esp + 0x30], 3
test edx, edx
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
lea eax, [esp + 0x4c2]
mov dword [esp + 0x34], eax
mov eax, 0x614
mov word [esp + 0x3c], ax
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
lea eax, [esp + 0x4c2]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x404dff
lea eax, [esp + 0x4c2]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x404dff
push 0x10
push str.Supermium_Setup
push str.Unable_to_remove_the_Supermium_directory.
push eax
call edi
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xce0]
xor ecx, esp
call fcn.004054d3
mov esp, ebp
pop ebp
ret
call fcn.004012a0
mov esi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [esp + 0x6d0]
push eax
push 0
push 0
push 0x10
push 0
call esi
lea eax, [esp + 0x2b0]
push eax
push 0
push 0
push 2
push 0
call esi
push str.Supermium.lnk
lea ecx, [esp + 0x6d4]
call fcn.004011f0
push str.Supermium.lnk
lea ecx, [esp + 0x2b4]
call fcn.004011f0
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [esp + 0x6d0]
push eax
call esi
lea eax, [esp + 0x2b0]
push eax
call esi
push 0
push str.Supermium_Setup
push str.Supermium_has_been_uninstalled.
push 0
call edi
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xce0]
xor ecx, esp
call fcn.004054d3
mov esp, ebp
pop ebp
ret
push 0x104
lea eax, [esp + 0xae4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x404eea
push 0x10
push str.Uninstaller
push str.Failed_to_get_the_current_executable_path
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xce0]
xor ecx, esp
call fcn.004054d3
mov esp, ebp
pop ebp
ret
lea ecx, [esp + 0xa8]
mov edx, 0x104
lea esi, [esp + 0x8d8]
mov eax, ecx
sub esi, eax
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x404f1f
movzx eax, word [esi + ecx]
test ax, ax
je 0x404f1f
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x404f01
lea eax, [ecx - 2]
test edx, edx
push str.uninstall.exe
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
lea ecx, [esp + 0xac]
call fcn.00401160
push 0
lea eax, [esp + 0xac]
push eax
lea eax, [esp + 0xae8]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x404f86
push 0x10
push str.Uninstaller
push str.Failed_to_copy_the_executable_to_the_temporary_folder
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xce0]
xor ecx, esp
call fcn.004054d3
mov esp, ebp
pop ebp
ret
push str.___payload
lea ecx, [esp + 0xac]
call fcn.00401160
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0x64]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0xc8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x404ff2
push 0x10
push str.Uninstaller
lea eax, [esp + 0xb0]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xce0]
xor ecx, esp
call fcn.004054d3
mov esp, ebp
pop ebp
ret
push dword [esp + 0x4c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x50]
call esi
mov ecx, dword [esp + 0xcec]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004054d3
mov esp, ebp
pop ebp
ret