Function at 0x403723
Capabilities:
Accept command line arguments
Check os version
Delete file
Get common file path
Get file system object information
Set environment variable
Shutdown system
Terminate process

Disassembly:
sub esp, 0x3e8
push ebx
push ebp
push edi
push 4
push 0x40000000
xor ebp, ebp
xor ebx, ebx
push str.C:Mircmirc.ini
mov edi, str.Error_writing_temporary_file._Make_sure_your_temp_folder_is_valid.
mov dword [esp + 0x1c], ebp
call fcn.004067c6
cmp eax, 0xffffffff
je 0x40375b
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0x3e8
ret
push esi
push 0x8001
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
and dword [esp + 0x3c], ebx
lea eax, [esp + 0x28]
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
xorps xmm0, xmm0
push eax
movlpd qword [esp + 0x140], xmm0
mov dword [esp + 0x2c], 0x11c
call esi
test eax, eax
jne 0x4037c7
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 0x114
push eax
call esi
push 0x53
pop eax
mov dl, 4
mov byte [esp + 0x142], dl
cmp word [esp + 0x3c], ax
jne 0x4037c3
mov eax, dword [esp + 0x56]
add eax, 0xffffffd0
mov word [esp + 0x13c], ax
jmp 0x4037ce
xor eax, eax
jmp 0x4037b9
mov dl, byte [esp + 0x142]
cmp dword [esp + 0x2c], 0xa
jae 0x4037e0
movzx eax, word [esp + 0x34]
mov dword [esp + 0x34], eax
jmp 0x4037e4
mov eax, dword [esp + 0x34]
mov dword [0x429618], eax
movzx eax, byte [esp + 0x2c]
shl ax, 8
movzx ecx, ax
movzx eax, byte [esp + 0x30]
or ecx, eax
movzx eax, byte [esp + 0x13c]
shl ax, 8
shl ecx, 0x10
movzx eax, ax
or ecx, eax
movzx eax, dl
or ecx, eax
mov eax, 0x600
mov dword [0x42961c], ecx
sar ecx, 0x10
cmp cx, ax
je 0x40383a
push 0
call fcn.00406791
test eax, eax
je 0x40383a
push 0xc00
call eax
mov esi, str.UXTHEME
push esi
call fcn.00406049
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc esi
add esi, eax
cmp byte [esi], bl
jne 0x40383f
push 0xc
call fcn.00406791
push 0xa
call fcn.00406791
push 8
mov dword [0x428510], eax
call fcn.00406791
test eax, eax
je 0x403880
push 0x1e
call eax
test eax, eax
je 0x403880
or byte [0x42961c], 0x80
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
xor esi, esi
push esi
call dword [sym.imp.ole32.dll_OleInitialize]
push esi
push 0x2b4
mov dword [0x429580], eax
lea eax, [esp + 0x14c]
push eax
push esi
push 0x4085cc
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push str.NSIS_Error
push 0x428520
call fcn.004069c5
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
mov esi, 0x434000
push esi
call fcn.004069c5
movzx ecx, word [0x434000]
push 0x22
pop eax
push 0x20
pop edx
cmp cx, ax
mov dword [esp + 0x10], eax
mov dword [0x428514], 0x400000
cmovne eax, edx
movzx eax, ax
push eax
push 0x22
pop edx
cmp cx, dx
mov eax, 0x434002
cmove esi, eax
push esi
call fcn.004064a1
push eax
call dword [sym.imp.USER32.dll_CharNextW]
mov ecx, eax
movzx eax, word [ecx]
test ax, ax
je 0x4039fb
mov esi, eax
push 0x20
pop edx
movzx eax, si
cmp si, dx
jne 0x403935
add ecx, 2
movzx eax, word [ecx]
cmp ax, dx
je 0x40392a
mov ebp, edx
movzx esi, ax
movzx edx, ax
cmp ax, word [esp + 0x10]
jne 0x40394d
movzx edx, word [ecx + 2]
push 0x22
pop eax
mov ebp, eax
cmp si, word [esp + 0x10]
lea eax, [ecx + 2]
cmovne eax, ecx
cmp dx, 0x2f
jne 0x4039b9
push 0x53
add eax, 2
pop ecx
push 0x20
pop edx
cmp word [eax], cx
jne 0x403984
movzx ecx, word [eax + 2]
cmp cx, dx
je 0x40397a
test cx, cx
jne 0x403984
mov dword [0x429600], 1
cmp dword [eax], 0x43004e
jne 0x4039a8
cmp dword [eax + 4], 0x430052
jne 0x4039a8
movzx ecx, word [eax + 8]
cmp cx, dx
je 0x4039a3
test cx, cx
jne 0x4039a8
or dword [esp + 0x14], 4
cmp dword [eax - 4], 0x2f0020
jne 0x4039b9
cmp dword [eax], 0x3d0044
je 0x4039e3
push ebp
push eax
call fcn.004064a1
mov ecx, eax
push 0x22
pop ebp
movzx eax, word [ecx]
mov edx, eax
cmp ax, bp
jne 0x4039d5
add ecx, 2
movzx edx, word [ecx]
movzx esi, dx
test dx, dx
jne 0x40391f
jmp 0x4039f7
xor ecx, ecx
mov word [eax - 4], cx
add eax, 4
push eax
push 0x434800
call fcn.004069c5
mov ebp, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x436800
push 0x400
call esi
call fcn.00403b5f
test eax, eax
jne 0x403a7d
push 0x3fb
push 0x436800
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.Temp
push 0x436800
call sub.KERNEL32.dll_lstrcatW
call fcn.00403b5f
test eax, eax
jne 0x403a7d
push 0x436800
push 0x3fc
call esi
push 0x4085f4
mov esi, 0x436800
push esi
call sub.KERNEL32.dll_lstrcatW
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push str.TEMP
call esi
push 0x436800
push 0x408608
call esi
call fcn.00403b5f
test eax, eax
je 0x403aa2
push 0x436000
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebp
call fcn.00403414
mov edi, eax
test edi, edi
jne 0x403aa2
or dword [0x42960c], 0xffffffff
call fcn.004058f8
mov ebx, eax
call fcn.004036f9
call dword [sym.imp.ole32.dll_OleUninitialize]
test edi, edi
je 0x403ac4
push 0x200010
push edi
call fcn.00406953
push 2
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x4295f4], 0
je 0x403b4b
lea eax, [esp + 0x10]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
xor ebp, ebp
test eax, eax
je 0x403b1b
lea eax, [esp + 0x1c]
push eax
push str.SeShutdownPrivilege
push ebp
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push ebp
push ebp
push ebp
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 1
push eax
push ebp
push dword [esp + 0x24]
mov dword [esp + 0x3c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 4
call fcn.00406791
mov esi, 0x80040002
test eax, eax
je 0x403b37
push esi
push 0x25
push ebp
push ebp
push ebp
call eax
test eax, eax
je 0x403b44
push esi
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x403b4b
push 9
call fcn.00401533
cmp dword [0x42960c], 0xffffffff
cmovne ebx, dword [0x42960c]
push ebx
jmp 0x403abe