Function at 0x403819
Capabilities:
Accept command line arguments
Copy file
Delete file
Get common file path
Get file system object information
Set current directory
Set environment variable
Shutdown system
Terminate process

Disassembly:
sub esp, 0x17c
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov byte [esp + 0x10], 0x20
push 0x8001
mov dword [esp + 0x18], ebx
mov edi, str.Error_writing_temporary_file._Make_sure_your_temp_folder_is_valid.
xor ebp, ebp
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
call dword [sym.imp.KERNEL32.dll_GetVersion]
push 6
and eax, 0xbfffffff
pop ecx
mov dword [0x453d00], eax
cmp ax, cx
je 0x403869
push ebp
call fcn.00406a89
test eax, eax
je 0x403869
push 0xc00
call eax
mov esi, str.UXTHEME
push esi
call fcn.0040612d
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc esi
add esi, eax
cmp byte [esi], bl
jne 0x40386e
push 0xa
call fcn.00406a89
push 8
call fcn.00406a89
push 6
mov dword [0x453d04], eax
call fcn.00406a89
test eax, eax
je 0x4038b2
push 0x1e
call eax
test eax, eax
je 0x4038b2
or dword [0x453d00], 0x40000000
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push 0
call dword [sym.imp.ole32.dll_OleInitialize]
push 0
push 0x160
mov dword [0x453df8], eax
lea eax, [esp + 0x34]
push eax
push 0
push 0x409b13
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
push str.NSIS_Error
push 0x44fd00
call fcn.00406cb4
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
mov esi, 0x47c000
push esi
call fcn.00406cb4
cmp byte [0x47c000], 0x22
mov eax, esi
mov dword [0x44fcf0], 0x400000
jne 0x40391e
mov byte [esp + 0x10], 0x22
mov eax, 0x47c001
push dword [esp + 0x10]
push eax
call fcn.00406666
push eax
call dword [sym.imp.USER32.dll_CharNextA]
mov dword [esp + 0x18], eax
jmp 0x40399f
push 0x20
pop edx
cmp cl, dl
jne 0x403941
inc eax
cmp byte [eax], dl
je 0x40393c
cmp byte [eax], 0x22
mov byte [esp + 0x10], dl
jne 0x403950
inc eax
mov byte [esp + 0x10], 0x22
cmp byte [eax], 0x2f
jne 0x40398f
inc eax
cmp byte [eax], 0x53
jne 0x403970
mov cl, byte [eax + 1]
cmp cl, dl
je 0x403966
test cl, cl
jne 0x403970
mov dword [0x453de0], 1
cmp dword [eax], 0x4352434e
jne 0x403986
mov cl, byte [eax + 4]
cmp cl, dl
je 0x403983
test cl, cl
jne 0x403986
or ebp, 4
cmp dword [eax - 2], 0x3d442f20
je 0x4039a7
push dword [esp + 0x10]
push eax
call fcn.00406666
cmp byte [eax], 0x22
jne 0x40399f
inc eax
mov cl, byte [eax]
test cl, cl
jne 0x403935
jmp 0x4039b8
mov byte [eax - 2], bl
add eax, 2
push eax
push 0x47e000
call fcn.00406cb4
mov esi, dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0x486000
push 0x2000
call esi
call fcn.00403ca0
test eax, eax
jne 0x403a3e
push 0x1ffb
push 0x486000
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.Temp
push 0x486000
call sub.KERNEL32.dll_lstrcatA
call fcn.00403ca0
test eax, eax
jne 0x403a3e
push 0x486000
push 0x1ffc
call esi
push 0x409b28
mov esi, 0x486000
push esi
call sub.KERNEL32.dll_lstrcatA
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.TEMP
call esi
push 0x486000
push 0x409b34
call esi
call fcn.00403ca0
test eax, eax
je 0x403be2
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x484000
call ebx
push ebp
call fcn.00403506
mov edi, eax
test edi, edi
jne 0x403bde
cmp dword [0x453d08], eax
je 0x403ab5
push eax
mov ebp, 0x47c000
push ebp
call fcn.00406666
mov esi, eax
jmp 0x403a7c
cmp dword [esi], 0x3d3f5f20
je 0x403a80
dec esi
cmp esi, ebp
jae 0x403a73
mov edi, str.Error_launching_installer
cmp esi, ebp
jb 0x403acf
mov byte [esi], 0
add esi, 4
push esi
call fcn.004066a3
test eax, eax
je 0x403bde
push esi
push 0x47e000
call fcn.00406cb4
push esi
push 0x480000
call fcn.00406cb4
xor edi, edi
or dword [0x453dec], 0xffffffff
call fcn.004059b9
push 1
mov ebx, eax
call fcn.0040674c
jmp 0x403be2
call fcn.004063cf
push str.nsu
mov ebp, 0x486000
mov esi, eax
push ebp
call sub.KERNEL32.dll_lstrcatA
test esi, esi
je 0x403af5
push 0x409b40
push ebp
call sub.KERNEL32.dll_lstrcatA
push str..tmp
push ebp
call sub.KERNEL32.dll_lstrcatA
push 0x482000
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x403bde
push ebp
test esi, esi
je 0x403b20
call fcn.00405dca
jmp 0x403b25
call fcn.00405daa
push ebp
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
cmp byte [0x47e000], 0
jne 0x403b44
push 0x482000
push 0x47e000
call fcn.00406cb4
push dword [esp + 0x18]
push section..ndata
call fcn.00406cb4
push 0x41
pop eax
push 0x1a
mov word [0x456000], ax
pop esi
mov eax, dword [0x453d14]
push dword [eax + 0x120]
push 0x432d18
call fcn.00405e48
push 0x432d18
call ebx
test edi, edi
je 0x403bcc
push 1
push 0x432d18
push 0x48a000
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x403bcc
push 0
push 0x432d18
call fcn.004061cc
mov eax, dword [0x453d14]
push dword [eax + 0x124]
push 0x432d18
call fcn.00405e48
push 0x432d18
call fcn.00406805
test eax, eax
je 0x403bcc
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
inc byte [0x456000]
sub esi, 1
jne 0x403b5e
push esi
push ebp
call fcn.004061cc
mov ebx, dword [esp + 0x14]
call fcn.004037ef
call dword [sym.imp.ole32.dll_OleUninitialize]
test edi, edi
je 0x403c04
push 0x200010
push edi
call fcn.00406c42
push 2
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x453dd4], 0
je 0x403c8c
lea eax, [esp + 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
push 2
pop edi
test eax, eax
je 0x403c5b
lea eax, [esp + 0x20]
push eax
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
xor ecx, ecx
mov dword [esp + 0x1c], 1
push ecx
push ecx
push ecx
lea eax, [esp + 0x28]
mov dword [esp + 0x34], edi
push eax
push ecx
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 4
call fcn.00406a89
mov esi, 0x80040002
test eax, eax
je 0x403c79
push esi
push 0x25
xor ecx, ecx
push ecx
push ecx
push ecx
call eax
test eax, eax
je 0x403c85
push esi
push edi
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x403c8c
push 9
call fcn.004014e3
cmp dword [0x453dec], 0xffffffff
cmovne ebx, dword [0x453dec]
push ebx
jmp 0x403bfe