Function at 0x140003d03
Capabilities:
Accept command line arguments
Copy file
Delete file
Get common file path
Get file system object information
Set current directory
Set environment variable
Shutdown system
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x428
mov ecx, 0x8001
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
lea rcx, [rsp + 0x4c]
mov dword [rsp + 0x4c], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov rsi, qword [0x14000c0d0]
mov eax, dword [rsp + 0x58]
mov edx, dword [rsp + 0x50]
mov dword [rsi + 0x38], eax
movzx eax, byte [rsp + 0x54]
shl edx, 8
or eax, edx
movzx edx, byte [rsp + 0x160]
shl eax, 0x10
shl edx, 8
mov ecx, edx
movzx edx, byte [rsp + 0x166]
or edx, ecx
movzx edx, dx
or eax, edx
mov dword [rsi + 0x3c], eax
shr eax, 0x10
cmp ax, 0x600
je 0x140003d8e
xor ecx, ecx
call fcn.140007a7b
test rax, rax
je 0x140003d8e
mov ecx, 0xc00
call rax
mov rdi, qword [sym.imp.KERNEL32.dll_lstrlenA]
lea rbx, str.UXTHEME
mov rcx, rbx
call fcn.1400079f0
mov rcx, rbx
call rdi
inc eax
cdqe
add rbx, rax
cmp byte [rbx], 0
jne 0x140003d9c
mov ecx, 7
lea rbp, [rsp + 0x168]
call fcn.140007a7b
mov ecx, 5
call fcn.140007a7b
mov qword [0x1400385e8], rax
call qword [sym.imp.COMCTL32.dll_InitCommonControls]
xor ecx, ecx
call qword [sym.imp.ole32.dll_OleInitialize]
mov rdx, qword [0x14000c120]
mov r8, rbp
mov r9d, 0x2b8
lea rcx, [0x14000b43a]
mov dword [rdx], eax
xor edx, edx
mov dword [rsp + 0x20], 0
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea rdx, str.NSIS_Error
lea rcx, [0x140038600]
call fcn.140007271
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdx, rax
mov rax, qword [0x14000c160]
mov rbx, qword [rax]
lea rdi, [rbx + 0xa000]
mov rcx, rdi
call fcn.140007271
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
movzx edx, word [rbx + 0xa000]
lea rcx, [rbx + 0xa002]
mov qword [0x1400385f0], rax
cmp dx, 0x22
je 0x140003e6f
mov rcx, rdi
mov edx, 0x20
call fcn.140006c07
xor r15d, r15d
movabs r12, 0x4300520043004e
movabs r13, 0x3d0044002f0020
mov rcx, rax
call qword [sym.imp.USER32.dll_CharNextW]
mov qword [rsp + 0x30], rax
mov rcx, rax
cmp word [rcx], 0
je 0x140003f38
movzx edx, word [rcx]
cmp dx, 0x20
jne 0x140003eb5
add rcx, 2
jmp 0x140003ea6
cmp dx, 0x22
jne 0x140003ec1
add rcx, 2
jmp 0x140003ec6
mov edx, 0x20
cmp word [rcx], 0x2f
jne 0x140003f1d
cmp word [rcx + 2], 0x53
lea rax, [rcx + 2]
jne 0x140003ee6
test word [rcx + 4], 0xffdf
jne 0x140003ee6
mov dword [rsi + 0x20], 1
cmp qword [rcx + 2], r12
jne 0x140003efc
test word [rcx + 0xa], 0xffdf
mov r8d, 4
cmove r15d, r8d
cmp qword [rcx - 2], r13
jne 0x140003f1a
mov word [rcx - 2], 0
lea rdx, [rcx + 6]
lea rcx, [rbx + 0xa800]
call fcn.140007271
jmp 0x140003f38
mov rcx, rax
call fcn.140006c07
cmp word [rax], 0x22
mov rcx, rax
jne 0x140003e9c
add rcx, 2
jmp 0x140003e9c
lea r12, [rbx + 0xc800]
mov ecx, 0x400
mov r13, qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov rdx, r12
call r13
call fcn.140003c60
test rax, rax
je 0x140003f89
mov rax, qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbx + 0xc000]
xor r14d, r14d
mov qword [rsp + 0x38], rax
call rax
mov ecx, r15d
call fcn.14000398a
mov r13, rax
test rax, rax
jne 0x1400041e5
jmp 0x140004008
mov edx, 0x3fb
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea rdx, str.Temp
mov rcx, r12
call sub.KERNEL32.dll_lstrcatW
call fcn.140003c60
test rax, rax
jne 0x140003f5b
mov rdx, r12
mov ecx, 0x3fc
xor r14d, r14d
call r13
lea rdx, [0x14000b45e]
mov rcx, r12
call sub.KERNEL32.dll_lstrcatW
mov r13, qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rdx, r12
lea rcx, str.TEMP
call r13
mov rdx, r12
lea rcx, [0x14000b470]
call r13
lea r13, str.Error_writing_temporary_file._Make_sure_your_temp_folder_is_valid.
call fcn.140003c60
test rax, rax
jne 0x140003f5b
jmp 0x1400041e5
mov rax, qword [0x14000c140]
cmp dword [rax], 0
je 0x1400041d6
xor edx, edx
mov rcx, rdi
call fcn.140006c07
movabs rdx, 0x3d003f005f0020
cmp rdi, rax
ja 0x140004080
cmp qword [rax], rdx
je 0x14000403c
sub rax, 2
jmp 0x14000402c
mov word [rax], 0
lea r12, [rax + 8]
mov rcx, r12
call fcn.140007712
test eax, eax
jne 0x14000405d
lea r13, str.Error_launching_installer
jmp 0x1400041d1
lea rcx, [rbx + 0xa800]
mov rdx, r12
call fcn.140007271
lea rcx, [rbx + 0xb000]
mov rdx, r12
call fcn.140007271
jmp 0x1400041d6
call fcn.140007adb
lea rdx, str.nsu
mov rcx, r12
mov edi, eax
call sub.KERNEL32.dll_lstrcatW
test edi, edi
je 0x1400040a9
lea rdx, [0x14000b482]
mov rcx, r12
call sub.KERNEL32.dll_lstrcatW
lea rdx, str..tmp
mov rcx, r12
lea r13, [rbx + 0xb800]
call sub.KERNEL32.dll_lstrcatW
mov rdx, r13
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140004051
mov rcx, r12
test edi, edi
je 0x1400040dd
call fcn.140006a30
jmp 0x1400040e2
call fcn.140006ac3
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cmp word [rbx + 0xa800], 0
jne 0x140004104
lea rcx, [rbx + 0xa800]
mov rdx, r13
call fcn.140007271
mov rdx, qword [rsp + 0x30]
mov rcx, rbx
mov edi, 0x1a
lea r13, str.Error_launching_installer
call fcn.140007271
mov r14, qword [0x14000c110]
mov dword [rbx + 0x800], 0x41
mov r15, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [r14]
lea rcx, [0x140039600]
mov edx, dword [rax + 0x140]
call fcn.1400073df
mov rax, qword [rsp + 0x38]
lea rcx, [0x140039600]
call rax
test r13, r13
je 0x1400041b8
lea rcx, [rbx + 0xd800]
mov r8d, 1
lea rdx, [0x140039600]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x1400041b8
xor edx, edx
lea rcx, [0x140039600]
call fcn.140006fef
mov rax, qword [r14]
lea rcx, [0x140039600]
mov edx, dword [rax + 0x144]
call fcn.1400073df
lea rcx, [0x140039600]
call fcn.140006ae5
mov rcx, rax
test rax, rax
je 0x1400041b8
call r15
xor r13d, r13d
inc word [rbx + 0x800]
dec edi
jne 0x140004135
xor edx, edx
mov rcx, r12
call fcn.140006fef
xor r14d, r14d
jmp 0x1400041e5
mov dword [rsi + 0x2c], 0xffffffff
call fcn.1400057a7
mov r14d, eax
call fcn.140003cbc
call qword [sym.imp.ole32.dll_OleUninitialize]
test r13, r13
mov rbx, qword [sym.imp.KERNEL32.dll_ExitProcess]
je 0x140004213
mov rcx, r13
mov edx, 0x200010
call fcn.140006b93
mov ecx, 2
jmp 0x1400042e3
cmp dword [rsi + 0x14], 0
je 0x1400042d6
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x40]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14000428c
lea r8, [rsp + 0x16c]
lea rdx, str.SeShutdownPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
mov r8, rbp
mov dword [rsp + 0x168], 1
xor edx, edx
mov dword [rsp + 0x174], 2
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov ecx, 1
call fcn.140007a7b
test rax, rax
jne 0x1400042b1
mov edx, 0x80040002
mov ecx, 2
call qword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
je 0x1400042cc
jmp 0x1400042d6
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0x80040002
mov r9d, 0x25
call rax
test eax, eax
jne 0x14000429b
mov ecx, 9
call fcn.14000359b
mov eax, dword [rsi + 0x2c]
cmp eax, 0xffffffff
cmovne r14d, eax
mov ecx, r14d
call rbx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop