Function at 0x403b00
Capabilities:
Accept command line arguments
Check os version
Copy file
Delete file
Get common file path
Get file attributes
Get file system object information
Set current directory
Set environment variable
Shutdown system
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x318
mov ecx, 0x8001
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [0x0043cfb8], eax
cmp ax, 6
je 0x403b43
xor ecx, ecx
call fcn.0040774e
test rax, rax
je 0x403b43
mov ecx, 0xc00
call rax
mov rsi, qword [sym.imp.KERNEL32.dll_lstrlenA]
lea rbx, str.UXTHEME
mov rcx, rbx
call fcn.004076c5
mov rcx, rbx
call rsi
inc eax
cdqe
add rbx, rax
cmp byte [rbx], 0
jne 0x403b51
mov ecx, 6
lea r13, [rsp + 0x58]
call fcn.0040774e
mov ecx, 4
call fcn.0040774e
mov qword [0x0043cfa8], rax
call qword [sym.imp.COMCTL32.dll_InitCommonControls]
xor ecx, ecx
call qword [sym.imp.ole32.dll_OleInitialize]
mov rdx, qword [0x0040bbb0]
mov r8, r13
mov r9d, 0x2b8
lea rcx, [0x0040b43a]
mov dword [rdx], eax
xor edx, edx
mov dword [rsp + 0x20], 0
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea rdx, str.NSIS_Error
lea rcx, [0x0043bfa0]
call fcn.00406f90
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdx, qword [0x0040bbf0]
mov rbx, qword [rdx]
mov rdx, rax
lea r12, [rbx + 0xa000]
mov rcx, r12
call fcn.00406f90
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
movzx edx, word [rbx + 0xa000]
lea rcx, [rbx + 0xa002]
mov qword [0x0043cfa0], rax
cmp dx, 0x22
je 0x403c21
mov rcx, r12
mov edx, 0x20
call fcn.00406940
xor r15d, r15d
movabs rdi, 0x4300520043004e
movabs rbp, 0x3d0044002f0020
mov rcx, rax
call qword [sym.imp.USER32.dll_CharNextW]
mov rsi, qword [0x0040bb60]
mov r14, rax
cmp word [rax], 0
je 0x403cec
movzx edx, word [rax]
cmp dx, 0x20
jne 0x403c69
add rax, 2
jmp 0x403c5a
cmp dx, 0x22
jne 0x403c75
add rax, 2
jmp 0x403c7a
mov edx, 0x20
cmp word [rax], 0x2f
jne 0x403cd1
cmp word [rax + 2], 0x53
lea rcx, [rax + 2]
jne 0x403c9a
test word [rax + 4], 0xffdf
jne 0x403c9a
mov dword [rsi + 0x20], 1
cmp qword [rax + 2], rdi
jne 0x403cb0
test word [rax + 0xa], 0xffdf
mov r8d, 4
cmove r15d, r8d
cmp qword [rax - 2], rbp
jne 0x403cce
mov word [rax - 2], 0
lea rdx, [rax + 6]
lea rcx, [rbx + 0xa800]
call fcn.00406f90
jmp 0x403cec
mov rax, rcx
mov rcx, rax
call fcn.00406940
cmp word [rax], 0x22
jne 0x403c50
add rax, 2
jmp 0x403c50
lea rsi, [rbx + 0xc800]
mov ecx, 0x400
mov rdi, qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov rdx, rsi
call rdi
call fcn.00403a60
test rax, rax
je 0x403d3b
mov rax, qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbx + 0xc000]
xor edi, edi
mov qword [rsp + 0x38], rax
call rax
mov ecx, r15d
call fcn.00403781
mov rbp, rax
test rax, rax
jne 0x403fd8
jmp 0x403db6
mov edx, 0x3fb
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea rdx, str.Temp
mov rcx, rsi
call sub.KERNEL32.dll_lstrcatW
call fcn.00403a60
test rax, rax
jne 0x403d0e
mov rdx, rsi
mov ecx, 0x3fc
lea rbp, str.Error_writing_temporary_file._Make_sure_your_temp_folder_is_valid.
call rdi
lea rdx, [0x0040b45e]
mov rcx, rsi
call sub.KERNEL32.dll_lstrcatW
mov rdi, qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rdx, rsi
lea rcx, str.TEMP
call rdi
mov rdx, rsi
lea rcx, [0x0040b470]
call rdi
xor edi, edi
call fcn.00403a60
test rax, rax
jne 0x403d0e
jmp 0x403fd8
mov rax, qword [0x0040bbd0]
cmp dword [rax], 0
je 0x403fc3
xor edx, edx
mov rcx, r12
call fcn.00406940
movabs rdx, 0x3d003f005f0020
cmp r12, rax
ja 0x403e2e
cmp qword [rax], rdx
je 0x403dea
sub rax, 2
jmp 0x403dda
mov word [rax], 0
lea rsi, [rax + 8]
mov rcx, rsi
call fcn.004073e1
test eax, eax
jne 0x403e0b
lea rbp, str.Error_launching_installer
jmp 0x403f7a
lea rcx, [rbx + 0xa800]
mov rdx, rsi
call fcn.00406f90
lea rcx, [rbx + 0xb000]
mov rdx, rsi
call fcn.00406f90
jmp 0x403fc3
call fcn.004077a8
mov rcx, rsi
lea rdi, [rbx + 0x2800]
mov dword [rsp + 0x4c], eax
call sub.KERNEL32.dll_lstrlenW
mov rdx, r14
mov rcx, rbx
movsxd r12, eax
lea rax, [rbx + 0x3000]
mov qword [rsp + 0x30], rax
call fcn.00406f90
cmp word [rbx + 0xa800], 0
jne 0x403e7d
lea rdx, [rbx + 0xb800]
lea rcx, [rbx + 0xa800]
call fcn.00406f90
lea rax, [rbx + r12*2 + 0xc800]
mov r12d, 1
mov qword [rsp + 0x40], rax
jmp 0x403f81
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
bt eax, 0xa
jb 0x403f7e
mov rcx, rdi
mov rax, qword [rsp + 0x38]
call rax
test eax, eax
je 0x403f7e
mov edx, 1
mov rcx, rsi
call fcn.00407496
test r14d, r14d
jne 0x403f7e
mov r14d, 1
movzx r8d, r12w
lea rdx, str.nsu_X.tmp
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rax, qword [r15]
mov rcx, rdi
mov edx, dword [rax + 0x140]
call fcn.004070be
cmp dword [rsp + 0x4c], 0
mov rcx, rsi
je 0x403f9a
call fcn.00406790
test eax, eax
jne 0x403e95
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
xor edx, edx
mov rcx, rsi
call fcn.00406d0c
lea rcx, [rbx + 0xd800]
mov r8d, 1
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x403dff
xor edx, edx
mov rcx, rdi
call fcn.00406d0c
mov rax, qword [r15]
mov rcx, qword [rsp + 0x30]
mov edx, dword [rax + 0x144]
call fcn.004070be
mov rcx, qword [rsp + 0x30]
call fcn.00406819
test rax, rax
je 0x403fa4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
jmp 0x403fd8
inc r12d
test r12w, r12w
je 0x403dff
xor r14d, r14d
mov r15, qword [0x0040bba0]
jmp 0x403ed6
call fcn.004067f7
jmp 0x403f10
test r14d, r14d
jne 0x403dff
mov rcx, rdi
call fcn.004073b0
test rax, rax
je 0x403ed0
jmp 0x403dff
mov rax, qword [0x0040bb60]
mov dword [rax + 0x2c], 0xffffffff
call fcn.0040551b
mov edi, eax
call fcn.00403ab9
call qword [sym.imp.ole32.dll_OleUninitialize]
test rbp, rbp
mov rbx, qword [sym.imp.KERNEL32.dll_ExitProcess]
je 0x404006
mov rcx, rbp
mov edx, 0x200010
call fcn.004068c6
mov ecx, 2
jmp 0x4040d1
mov rsi, qword [0x0040bb60]
cmp dword [rsi + 0x14], 0
je 0x4040c6
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x50]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40407c
lea r8, [r13 + 4]
lea rdx, str.SeShutdownPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
xor r9d, r9d
mov r8, r13
xor edx, edx
mov dword [rsp + 0x58], 1
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x64], 2
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov ecx, 1
call fcn.0040774e
test rax, rax
jne 0x4040a1
mov edx, 0x80040002
mov ecx, 2
call qword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
je 0x4040bc
jmp 0x4040c6
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0x80040002
mov r9d, 0x25
call rax
test eax, eax
jne 0x40408b
mov ecx, 9
call fcn.004033a5
mov eax, dword [rsi + 0x2c]
cmp eax, 0xffffffff
cmovne edi, eax
mov ecx, edi
call rbx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop