Function at 0x4038e6
Capabilities:
Accept command line arguments
Check os version
Copy file
Delete file
Get common file path
Get file system object information
Set current directory
Shutdown system
Terminate process

Disassembly:
sub esp, 0x2d4
push ebx
push ebp
push esi
push edi
push 0x20
pop esi
xor ebp, ebp
push 0x8001
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x14], str.Error_writing_temporary_file._Make_sure_your_temp_folder_is_valid.
mov dword [esp + 0x18], ebp
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp ax, 6
je 0x40392d
push ebp
call fcn.00406492
cmp eax, ebp
je 0x40392d
push 0xc00
call eax
push str.UXTHEME
call fcn.00406437
push str.USERENV
call fcn.00406437
push str.SETUPAPI
call fcn.00406437
push 0xd
call fcn.00406492
push 0xb
call fcn.00406492
mov dword [0x47eaf0], eax
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push ebp
call dword [sym.imp.ole32.dll_OleInitialize]
push ebp
push 0x2b4
mov dword [0x47ebd8], eax
lea eax, [esp + 0x38]
push eax
push ebp
push 0x40a258
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push str.NSIS_Error
push 0x476ae0
call fcn.0040624d
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
mov ebx, 0x4cf0a0
push ebx
call fcn.0040624d
push ebp
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp word [0x4cf0a0], 0x22
mov dword [0x47eaf8], eax
mov eax, ebx
jne 0x4039c8
push 0x22
pop esi
mov eax, 0x4cf0a2
push esi
push eax
call fcn.00405ed4
push eax
call dword [sym.imp.USER32.dll_CharNextW]
mov esi, eax
mov dword [esp + 0x1c], esi
jmp 0x403a6d
push 0x20
pop edi
cmp ax, di
jne 0x4039f0
inc esi
inc esi
cmp word [esi], di
je 0x4039e9
cmp word [esi], 0x22
jne 0x4039fb
inc esi
push 0x22
inc esi
pop edi
cmp word [esi], 0x2f
jne 0x403a5c
inc esi
inc esi
cmp word [esi], 0x53
jne 0x403a1d
movzx eax, word [esi + 2]
cmp ax, 0x20
je 0x403a18
cmp ax, bp
jne 0x403a1d
or dword [esp + 0x14], 2
push 4
push str.NCRC
push esi
call fcn.00403865
add esp, 0xc
test eax, eax
jne 0x403a45
movzx eax, word [esi + 8]
cmp ax, 0x20
je 0x403a40
cmp ax, bp
jne 0x403a45
or dword [esp + 0x14], 4
push 4
lea eax, [esi - 4]
push str.__D
push eax
call fcn.00403865
add esp, 0xc
test eax, eax
je 0x403a7b
push edi
push esi
call fcn.00405ed4
mov esi, eax
cmp word [esi], 0x22
jne 0x403a6d
inc esi
inc esi
movzx eax, word [esi]
cmp ax, bp
jne 0x4039e1
jmp 0x403a98
push 8
lea eax, [esi - 4]
push ebp
push eax
call fcn.0040859a
add esp, 0xc
add esi, 4
push esi
push 0x4d30a8
call fcn.0040624d
mov edi, 0x4e30c8
push edi
push 0x2004
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call fcn.00403834
test eax, eax
jne 0x403ad6
push 0x1fff
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.Temp
push edi
call sub.KERNEL32.dll_lstrcatW
call fcn.00403834
test eax, eax
je 0x403c7d
push 0x4df0c0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [esp + 0x14]
call fcn.004035ef
mov dword [esp + 0x10], eax
cmp eax, ebp
jne 0x403c7d
cmp dword [0x47eb44], ebp
je 0x403b5f
push ebp
push ebx
call fcn.00405ed4
mov esi, eax
jmp 0x403b1f
push 4
push str.___
push esi
call fcn.00403865
add esp, 0xc
test eax, eax
je 0x403b23
dec esi
dec esi
cmp esi, ebx
jae 0x403b09
mov dword [esp + 0x10], str.Error_launching_installer
cmp esi, ebx
jb 0x403b7b
xor eax, eax
mov word [esi], ax
add esi, 8
push esi
call fcn.00406930
test eax, eax
je 0x403c7d
push esi
push 0x4d30a8
call fcn.0040624d
push esi
push 0x4d70b0
call fcn.0040624d
mov dword [esp + 0x10], ebp
or dword [0x47ebcc], 0xffffffff
call fcn.00405a5b
push 1
mov dword [esp + 0x1c], eax
call fcn.00406cf4
jmp 0x403c7d
call fcn.004068bc
push 0x40a204
push edi
mov esi, eax
call sub.KERNEL32.dll_lstrcatW
mov ebp, 0x40a200
test esi, esi
je 0x403b9d
push ebp
push edi
call sub.KERNEL32.dll_lstrcatW
push str..tmp
push edi
call sub.KERNEL32.dll_lstrcatW
mov ebx, 0x4db0b8
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x403c7b
push edi
test esi, esi
je 0x403bc9
call fcn.00405d6e
jmp 0x403bce
call fcn.00405df0
push edi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cmp word [0x4d30a8], 0
jne 0x403bea
push ebx
push 0x4d30a8
call fcn.0040624d
push dword [esp + 0x1c]
push section..ndata
call fcn.0040624d
push ebp
push 0x483008
call fcn.0040624d
push 0x1a
pop ebp
mov esi, 0x43dd80
mov eax, dword [0x47eafc]
push dword [eax + 0x120]
push esi
call fcn.00406a63
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor ebx, ebx
cmp dword [esp + 0x10], ebx
je 0x403c6a
push 1
push esi
push 0x4eb0d8
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x403c6a
push ebx
push esi
call fcn.00406fca
mov eax, dword [0x47eafc]
push dword [eax + 0x124]
push esi
call fcn.00406a63
push esi
call fcn.00405e0d
cmp eax, ebx
je 0x403c6a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x10], ebx
inc word [0x483008]
dec ebp
jne 0x403c0b
push ebx
push edi
call fcn.00406fca
xor ebp, ebp
call fcn.004038bc
call dword [sym.imp.ole32.dll_OleUninitialize]
cmp dword [esp + 0x10], ebp
je 0x403ca4
push 0x200010
push dword [esp + 0x14]
call fcn.00405e6e
push 2
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x47ebb4], ebp
je 0x403d47
push 5
call fcn.00406492
push 6
mov ebx, eax
call fcn.00406492
push 7
mov esi, eax
call fcn.00406492
mov edi, eax
cmp ebx, ebp
je 0x403d17
cmp esi, ebp
je 0x403d17
cmp edi, ebp
je 0x403d17
lea eax, [esp + 0x1c]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
test eax, eax
je 0x403d17
lea eax, [esp + 0x24]
push eax
push str.SeShutdownPrivilege
push ebp
call esi
push ebp
push ebp
push ebp
lea eax, [esp + 0x2c]
push eax
push ebp
push dword [esp + 0x30]
mov dword [esp + 0x38], 1
mov dword [esp + 0x44], 2
call edi
push 8
call fcn.00406492
mov esi, 0x80040002
cmp eax, ebp
je 0x403d33
push esi
push 0x25
push ebp
push ebp
push ebp
call eax
test eax, eax
je 0x403d40
push esi
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x403d47
push 9
call fcn.0040141d
mov eax, dword [0x47ebcc]
cmp eax, 0xffffffff
je 0x403d55
mov dword [esp + 0x18], eax
push dword [esp + 0x18]
jmp 0x403c9e