Function at 0x401200
Capabilities:
Copy file
Delete file
Delete registry value
Get file attributes
Get installed programs
Print debug messages
Set file attributes

Disassembly:
mov eax, 0x3014
call fcn.004024d0
push ebx
push ebp
push esi
push edi
mov ecx, 0x1ff
xor eax, eax
lea edi, [esp + 0x25]
mov byte [esp + 0x24], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x1ff
xor eax, eax
lea edi, [esp + 0x825]
mov byte [esp + 0x824], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x1ff
xor eax, eax
lea edi, [esp + 0x2825]
mov byte [esp + 0x2824], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x1ff
xor eax, eax
lea edi, [esp + 0x2025]
mov byte [esp + 0x2024], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x1ff
xor eax, eax
lea edi, [esp + 0x1825]
mov byte [esp + 0x1824], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov esi, dword [esp + 0x3028]
xor ebp, ebp
stosb byte es:[edi], al
xor eax, eax
push esi
mov dword [esp + 0x21], eax
mov dword [esp + 0x18], ebp
mov word [esp + 0x25], ax
mov byte [esp + 0x20], 0
mov byte [esp + 0x27], al
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x401585
mov cx, word [0x407074]
mov dx, word [0x407078]
lea eax, [esp + 0x1a]
mov word [esp + 0x1a], cx
push eax
push esi
mov word [esp + 0x1a], dx
call fcn.00402250
add esp, 8
lea ecx, [esp + 0x12]
mov esi, eax
push ecx
push esi
call dword [sym.imp.SHLWAPI.dll_StrTrimA]
cmp esi, ebp
je 0x401585
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
or edi, 0xffffffff
cmp edi, 3
ja case.default.0x401309
jmp dword [edi*4 + 0x4015a0]
push esi
call fcn.004024be
add esp, 4
mov dword [esp + 0x14], eax
jmp case.default.0x401309
push esi
call fcn.004024be
add esp, 4
mov ebp, eax
jmp case.default.0x401309
push esi
lea edx, [esp + 0x28]
push 0x407118
push edx
jmp 0x401347
push esi
lea eax, [esp + 0x828]
push 0x407118
push eax
call ebx
add esp, 0xc
lea ecx, [esp + 0x1a]
inc edi
push ecx
push 0
call fcn.00402250
add esp, 8
lea edx, [esp + 0x12]
mov esi, eax
push edx
push esi
call dword [sym.imp.SHLWAPI.dll_StrTrimA]
test esi, esi
jne 0x401304
mov eax, dword [esp + 0x14]
cmp eax, 2
jne 0x401412
push ebp
push esi
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x824]
push 0
lea ecx, [esp + 0x28]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea edx, [esp + 0x824]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
and al, 0xfe
push eax
lea eax, [esp + 0x828]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x1824]
push ecx
lea eax, [esp + 0x2028]
push edx
lea ecx, [esp + 0x282c]
push eax
lea edx, [esp + 0x830]
push ecx
push edx
call fcn.004022ec
lea eax, [esp + 0x2038]
push 0x80
push eax
call fcn.00402050
add esp, 0x1c
jmp 0x401585
cmp eax, 4
jne 0x4014c0
push ebp
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x1ff
xor eax, eax
lea edi, [esp + 0x1025]
mov byte [esp + 0x1024], 0
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x24]
lea edx, [esp + 0x1024]
stosw word es:[edi], ax
push ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallInstallShield__s
push edx
stosb byte es:[edi], al
call ebx
add esp, 0xc
lea eax, [esp + 0x14]
lea ecx, [esp + 0x1024]
mov dword [esp + 0x14], 0
push eax
push 0xf003f
push 0
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401585
mov esi, dword [esp + 0x14]
push str.DisplayName
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test esi, esi
je 0x401585
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x401585
cmp eax, 5
jne 0x401504
push ebp
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0x24]
push edx
push 0x4070c0
push str.EnableLangDlg
push str.Startup
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
jmp 0x401585
cmp eax, 6
jne 0x401545
push ebp
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x824]
push 0
lea ecx, [esp + 0x28]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea edx, [esp + 0x24]
push edx
jmp 0x40157f
cmp eax, 7
jne 0x401585
push ebp
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x24]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str._PostBuild__InstallHandler_Done
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x3014
ret