Function at 0x403a1c
Capabilities:
Accept command line arguments
Check os version
Copy file
Delete file
Get common file path
Get file system object information
Set current directory
Shutdown system
Terminate process

Disassembly:
sub esp, 0x2d4
push ebx
push ebp
push esi
push edi
push 0x20
pop esi
xor ebp, ebp
push 0x8001
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x14], str.Error_writing_temporary_file._Make_sure_your_temp_folder_is_valid.
mov dword [esp + 0x18], ebp
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp ax, 6
je 0x403a63
push ebp
call fcn.004065c8
cmp eax, ebp
je 0x403a63
push 0xc00
call eax
push str.UXTHEME
call fcn.0040656d
push str.USERENV
call fcn.0040656d
push str.SETUPAPI
call fcn.0040656d
push 0xd
call fcn.004065c8
push 0xb
call fcn.004065c8
mov dword [0x473df0], eax
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push ebp
call dword [sym.imp.ole32.dll_OleInitialize]
push ebp
push 0x2b4
mov dword [0x473ed8], eax
lea eax, [esp + 0x38]
push eax
push ebp
push 0x40a310
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push str.NSIS_Error
push 0x46bde0
call fcn.00406383
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
mov ebx, 0x4c40a0
push ebx
call fcn.00406383
push ebp
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp word [0x4c40a0], 0x22
mov dword [0x473df8], eax
mov eax, ebx
jne 0x403afe
push 0x22
pop esi
mov eax, 0x4c40a2
push esi
push eax
call fcn.0040600a
push eax
call dword [sym.imp.USER32.dll_CharNextW]
mov esi, eax
mov dword [esp + 0x1c], esi
jmp 0x403ba3
push 0x20
pop edi
cmp ax, di
jne 0x403b26
inc esi
inc esi
cmp word [esi], di
je 0x403b1f
cmp word [esi], 0x22
jne 0x403b31
inc esi
push 0x22
inc esi
pop edi
cmp word [esi], 0x2f
jne 0x403b92
inc esi
inc esi
cmp word [esi], 0x53
jne 0x403b53
movzx eax, word [esi + 2]
cmp ax, 0x20
je 0x403b4e
cmp ax, bp
jne 0x403b53
or dword [esp + 0x14], 2
push 4
push str.NCRC
push esi
call fcn.00403983
add esp, 0xc
test eax, eax
jne 0x403b7b
movzx eax, word [esi + 8]
cmp ax, 0x20
je 0x403b76
cmp ax, bp
jne 0x403b7b
or dword [esp + 0x14], 4
push 4
lea eax, [esi - 4]
push str.__D
push eax
call fcn.00403983
add esp, 0xc
test eax, eax
je 0x403bb1
push edi
push esi
call fcn.0040600a
mov esi, eax
cmp word [esi], 0x22
jne 0x403ba3
inc esi
inc esi
movzx eax, word [esi]
cmp ax, bp
jne 0x403b17
jmp 0x403bce
push 8
lea eax, [esi - 4]
push ebp
push eax
call fcn.00408220
add esp, 0xc
add esi, 4
push esi
push 0x4c80a8
call fcn.00406383
mov edi, 0x4d80c8
push edi
push 0x2004
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call fcn.00403952
test eax, eax
jne 0x403c0c
push 0x1fff
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.Temp
push edi
call sub.KERNEL32.dll_lstrcatW
call fcn.00403952
test eax, eax
je 0x403db3
push 0x4d40c0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [esp + 0x14]
call fcn.004036b7
mov dword [esp + 0x10], eax
cmp eax, ebp
jne 0x403db3
cmp dword [0x473e44], ebp
je 0x403c95
push ebp
push ebx
call fcn.0040600a
mov esi, eax
jmp 0x403c55
push 4
push str.___
push esi
call fcn.00403983
add esp, 0xc
test eax, eax
je 0x403c59
dec esi
dec esi
cmp esi, ebx
jae 0x403c3f
mov dword [esp + 0x10], str.Error_launching_installer
cmp esi, ebx
jb 0x403cb1
xor eax, eax
mov word [esi], ax
add esi, 8
push esi
call fcn.00406a66
test eax, eax
je 0x403db3
push esi
push 0x4c80a8
call fcn.00406383
push esi
push 0x4cc0b0
call fcn.00406383
mov dword [esp + 0x10], ebp
or dword [0x473ecc], 0xffffffff
call fcn.00405b91
push 1
mov dword [esp + 0x1c], eax
call fcn.00406e2a
jmp 0x403db3
call fcn.004069f2
push 0x40a2bc
push edi
mov esi, eax
call sub.KERNEL32.dll_lstrcatW
mov ebp, 0x40a2b8
test esi, esi
je 0x403cd3
push ebp
push edi
call sub.KERNEL32.dll_lstrcatW
push str..tmp
push edi
call sub.KERNEL32.dll_lstrcatW
mov ebx, 0x4d00b8
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x403db1
push edi
test esi, esi
je 0x403cff
call fcn.00405ea4
jmp 0x403d04
call fcn.00405f26
push edi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cmp word [0x4c80a8], 0
jne 0x403d20
push ebx
push 0x4c80a8
call fcn.00406383
push dword [esp + 0x1c]
push section..ndata
call fcn.00406383
push ebp
push 0x478008
call fcn.00406383
push 0x1a
pop ebp
mov esi, 0x434218
mov eax, dword [0x473dfc]
push dword [eax + 0x120]
push esi
call fcn.00406b99
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor ebx, ebx
cmp dword [esp + 0x10], ebx
je 0x403da0
push 1
push esi
push 0x4e00d8
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x403da0
push ebx
push esi
call fcn.00407100
mov eax, dword [0x473dfc]
push dword [eax + 0x124]
push esi
call fcn.00406b99
push esi
call fcn.00405f43
cmp eax, ebx
je 0x403da0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x10], ebx
inc word [0x478008]
dec ebp
jne 0x403d41
push ebx
push edi
call fcn.00407100
xor ebp, ebp
call fcn.004039da
call dword [sym.imp.ole32.dll_OleUninitialize]
cmp dword [esp + 0x10], ebp
je 0x403dda
push 0x200010
push dword [esp + 0x14]
call fcn.00405fa4
push 2
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x473eb4], ebp
je 0x403e7d
push 5
call fcn.004065c8
push 6
mov ebx, eax
call fcn.004065c8
push 7
mov esi, eax
call fcn.004065c8
mov edi, eax
cmp ebx, ebp
je 0x403e4d
cmp esi, ebp
je 0x403e4d
cmp edi, ebp
je 0x403e4d
lea eax, [esp + 0x1c]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
test eax, eax
je 0x403e4d
lea eax, [esp + 0x24]
push eax
push str.SeShutdownPrivilege
push ebp
call esi
push ebp
push ebp
push ebp
lea eax, [esp + 0x2c]
push eax
push ebp
push dword [esp + 0x30]
mov dword [esp + 0x38], 1
mov dword [esp + 0x44], 2
call edi
push 8
call fcn.004065c8
mov esi, 0x80040002
cmp eax, ebp
je 0x403e69
push esi
push 0x25
push ebp
push ebp
push ebp
call eax
test eax, eax
je 0x403e76
push esi
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x403e7d
push 9
call fcn.0040141d
mov eax, dword [0x473ecc]
cmp eax, 0xffffffff
je 0x403e8b
mov dword [esp + 0x18], eax
push dword [esp + 0x18]
jmp 0x403dd4