Function at 0x40415f
Capabilities:
Accept command line arguments
Copy file
Delete file
Get common file path
Get file system object information
Set current directory
Set environment variable
Shutdown system
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x3e8
push 0x8001
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
xor esi, esi
lea edi, [esp + 0x18]
mov dword [edi + 0x14], esi
mov dword [edi + 0x118], esi
mov dword [edi + 0x114], esi
mov dword [edi], 0x11c
push edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x4041ca
mov dword [esp + 0x18], 0x114
push edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov byte [esp + 0x132], 4
movzx eax, word [esp + 0x46]
add eax, 0xffffffd0
cmp word [esp + 0x2c], 0x53
cmove esi, eax
mov word [esp + 0x12c], si
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
cmp eax, 9
ja 0x4041de
movzx ecx, cx
mov dword [esp + 0x24], ecx
mov edi, dword [0x40b114]
mov dword [edi + 0x38], ecx
movzx edx, byte [esp + 0x132]
mov ecx, dword [esp + 0x12c]
shl ecx, 8
mov esi, 0xffff
and ecx, esi
or ecx, edx
movzx edx, byte [esp + 0x20]
shl eax, 8
and eax, esi
or eax, edx
mov edx, eax
shl edx, 0x10
or edx, ecx
mov dword [edi + 0x3c], edx
cmp eax, 0x600
je 0x404231
push 0
call fcn.00406f3d
test eax, eax
je 0x404231
push 0xc00
call eax
mov esi, str.UXTHEME
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
call fcn.004082da
push esi
call edi
add esi, eax
inc esi
cmp byte [esi], 0
jne 0x40423c
push 0xb
call fcn.00406f3d
push 9
call fcn.00406f3d
mov dword [0x44028c], eax
push 7
call fcn.00406f3d
test eax, eax
je 0x40427c
push 0x1e
call eax
test eax, eax
je 0x40427c
mov eax, dword [0x40b114]
or byte [eax + 0x3c], 0x80
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
xor ebx, ebx
push ebx
call dword [sym.imp.ole32.dll_OleInitialize]
mov ecx, dword [0x40b2c4]
mov dword [ecx], eax
lea eax, [esp + 0x134]
push ebx
push 0x2b4
push eax
push ebx
push 0x40b208
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push str.NSIS_Error
push 0x440290
call fcn.00407432
mov eax, dword [0x40ae14]
mov esi, dword [eax]
lea edi, [esi + 0x50000]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
push edi
call fcn.00407432
mov dword [esp], 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [0x448290], eax
xor eax, eax
cmp word [esi + 0x50000], 0x22
mov dword [esp + 4], esi
lea ecx, [esi + 0x50002]
sete al
mov dword [esp + 0x10], edi
cmovne ecx, edi
lea eax, [eax*2 + 0x20]
push eax
push ecx
call fcn.0040754a
push eax
call dword [sym.imp.USER32.dll_CharNextW]
mov dword [esp + 0xc], eax
movzx edx, word [eax]
test dx, dx
je 0x404405
mov dword [esp], 0
mov ebx, 0x2f0020
mov eax, dword [esp + 0xc]
add eax, 2
cmp dx, 0x20
jne 0x40434a
movzx edx, word [eax]
jmp 0x40433c
movzx ecx, dx
cmp ecx, 0x22
jne 0x40435b
movzx edx, word [eax]
mov cx, 0x22
jmp 0x404362
add eax, 0xfffffffe
mov cx, 0x20
cmp dx, 0x2f
jne 0x4043c7
cmp word [eax + 2], 0x53
jne 0x404388
movzx edx, word [eax + 4]
test edx, 0xffdf
jne 0x404388
mov edx, dword [0x40b114]
mov dword [edx + 0x20], 1
lea edx, [eax + 2]
mov ebp, dword [edx + 4]
mov edi, 0x430052
xor ebp, edi
mov edi, dword [edx]
mov esi, 0x43004e
xor edi, esi
or edi, ebp
jne 0x4043b2
movzx edi, word [eax + 0xa]
test edi, 0xffdf
jne 0x4043b2
or dword [esp], 4
mov edi, dword [eax + 2]
mov esi, 0x3d0044
xor edi, esi
mov ebp, dword [eax - 2]
xor ebp, ebx
or ebp, edi
je 0x4043eb
mov eax, edx
movzx ecx, cx
push ecx
push eax
call fcn.0040754a
xor ecx, ecx
cmp word [eax], 0x22
sete cl
lea eax, [eax + ecx*2]
movzx edx, word [eax]
test dx, dx
jne 0x40433c
jmp 0x404405
mov word [eax - 2], 0
mov ecx, dword [esp + 4]
add ecx, 0x54000
add eax, 6
push eax
push ecx
call fcn.00407432
mov esi, dword [esp + 4]
lea edi, [esi + 0x64000]
push edi
push 0x2000
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call fcn.00404120
test eax, eax
jne 0x40448c
push 0x1ffb
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.Temp
push edi
call sub.KERNEL32.dll_lstrcatW
call fcn.00404120
test eax, eax
jne 0x40448c
push edi
push 0x1ffc
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x40b22c
push edi
call sub.KERNEL32.dll_lstrcatW
mov esi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push edi
push str.TEMP
call esi
push edi
push 0x40b23e
call esi
mov esi, dword [esp + 4]
call fcn.00404120
test eax, eax
jne 0x40448c
mov dword [esp], 0
mov ebx, 0x40b130
jmp 0x4044db
lea eax, [esi + 0x60000]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [esp]
call fcn.00403ae1
test eax, eax
jne 0x4044d2
mov eax, dword [0x40b2c8]
cmp dword [eax], 0
jne 0x4045b9
mov eax, dword [0x40b114]
mov dword [eax + 0x2c], 0xffffffff
call fcn.004048ae
mov dword [esp], eax
push 1
call fcn.0040804d
xor ebx, ebx
jmp 0x4044db
mov ebx, eax
mov dword [esp], 0
call fcn.00404760
call dword [sym.imp.ole32.dll_OleUninitialize]
test ebx, ebx
jne 0x4045a6
mov eax, dword [0x40b114]
cmp dword [eax + 0x14], 0
je 0x40458e
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [esp + 0x14]
push ecx
push 0x28
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40454f
lea edi, [esp + 0x138]
xor esi, esi
push edi
push str.SeShutdownPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov dword [edi - 4], 1
mov dword [edi + 8], 2
push esi
push esi
push esi
lea eax, [esp + 0x140]
push eax
push esi
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 4
call fcn.00406f3d
test eax, eax
je 0x404576
sub esp, 0x14
movaps xmm0, xmmword [0x40b120]
movups xmmword [esp], xmm0
mov dword [esp + 0x10], 0x80040002
call eax
test eax, eax
je 0x404587
push 0x80040002
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x40458e
push 9
call fcn.00403728
mov eax, dword [0x40b114]
mov eax, dword [eax + 0x2c]
cmp eax, 0xffffffff
mov ecx, dword [esp]
cmovne ecx, eax
push ecx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x200010
push ebx
call fcn.00407019
push 2
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [esp], 0
mov dword [esp + 8], edi
push 0
mov edi, dword [esp + 0x14]
push edi
call fcn.0040754a
cmp eax, edi
jb 0x4045f5
mov ebp, eax
mov eax, 0x3d003f
mov ecx, 0x5f0020
mov edx, dword [ebp + 4]
xor edx, eax
mov esi, dword [ebp]
xor esi, ecx
or esi, edx
je 0x404650
add ebp, 0xfffffffe
cmp ebp, edi
jae 0x4045e0
call fcn.00406f23
mov ebp, eax
push str.nsu
mov edi, dword [esp + 0xc]
push edi
call sub.KERNEL32.dll_lstrcatW
test ebp, ebp
je 0x40461a
push 0x40b284
push edi
call sub.KERNEL32.dll_lstrcatW
push 0x40b288
push edi
call sub.KERNEL32.dll_lstrcatW
mov eax, dword [esp + 4]
lea esi, [eax + 0x5c000]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov ebx, str.Error_launching_installer
test eax, eax
je 0x4044db
test ebp, ebp
jne 0x40468f
push edi
call fcn.00406f05
jmp 0x404695
mov word [ebp], 0
add ebp, 8
push ebp
call fcn.00407397
mov ebx, str.Error_launching_installer
test eax, eax
je 0x4044db
mov esi, dword [esp + 4]
lea eax, [esi + 0x54000]
push ebp
push eax
call fcn.00407432
add esi, 0x58000
push ebp
push esi
call fcn.00407432
jmp 0x4044b3
push edi
call fcn.00406e88
push edi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov edi, dword [esp + 4]
cmp word [edi + 0x54000], 0
jne 0x4046b7
lea eax, [edi + 0x54000]
push esi
push eax
call fcn.00407432
push dword [esp + 0xc]
push edi
call fcn.00407432
mov dword [edi + 0x4000], 0x41
lea eax, [edi + 0x6c000]
mov dword [esp], eax
mov ebx, str.Error_launching_installer
mov edi, 0x1a
mov ebp, dword [0x40a004]
mov esi, 0x448294
mov eax, dword [ebp]
push dword [eax + 0x120]
push esi
call fcn.00407b44
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test ebx, ebx
je 0x404740
push 1
push 0x448294
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x404742
push 0
push esi
call fcn.004074c4
mov eax, dword [ebp]
push dword [eax + 0x124]
push esi
call fcn.00407b44
push esi
call fcn.00406f76
test eax, eax
je 0x404742
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
mov eax, dword [esp + 4]
inc word [eax + 0x4000]
dec edi
jne 0x4046e9
push 0
push dword [esp + 0xc]
call fcn.004074c4
jmp 0x4044d4