Back in early 2006 someone posted a feature request for an MSI package (see link below). It was "added to the list".
Would I be correct in thinking you've not got around to it yet?
I used WinInstall to create an MSI package, using the snapshot before/after method. This works OK, except that whenever a non-admin opens the application, it keeps going through the process of saying "Please wait while Windows configures WinSCP" as if it's the first time it was being used. I know this probably isn't your fault, but do you have any idea of what Windows might be configuring?