Function at 0x1400043c8
Capabilities:
Accept command line arguments
Copy file
Delete file
Get common file path
Get file attributes
Get file system object information
Set current directory
Set environment variable
Shutdown system
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x438
mov ecx, 0x8001
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
lea rsi, [rsp + 0x318]
mov dword [rsi], 0x11c
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [rsi + 0xc]
mov r12, qword [0x14000b368]
mov dword [r12 + 0x38], eax
movzx eax, byte [rsi + 0x11a]
mov ecx, dword [rsi + 0x114]
shl ecx, 8
movzx ecx, cx
or ecx, eax
mov eax, dword [rsi + 4]
mov edx, dword [rsi + 8]
shl eax, 0x18
movzx edx, dl
shl edx, 0x10
or edx, eax
or ecx, edx
mov dword [r12 + 0x3c], ecx
cmp edx, 0x6000000
je 0x140004454
xor ecx, ecx
call fcn.14000767a
test rax, rax
je 0x140004454
mov ecx, 0xc00
call rax
lea rsi, str.UXTHEME
mov rdi, qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, rsi
call fcn.140008736
mov rcx, rsi
call rdi
cdqe
add rsi, rax
inc rsi
cmp byte [rsi], 0
jne 0x140004462
mov ecx, 8
call fcn.14000767a
mov ecx, 6
call fcn.14000767a
mov qword [0x14002eb90], rax
call qword [sym.imp.COMCTL32.dll_InitCommonControls]
xor r14d, r14d
xor ecx, ecx
call qword [sym.imp.ole32.dll_OleInitialize]
mov rcx, qword [0x14000b518]
mov dword [rcx], eax
mov dword [rsp + 0x20], 0
lea rcx, [0x14000b452]
lea r8, [rsp + 0x60]
xor edx, edx
mov r9d, 0x2b8
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea rcx, [0x14002eba0]
lea rdx, str.NSIS_Error
call fcn.140007bae
mov rax, qword [0x14000b058]
mov r13, qword [rax]
lea rbx, [r13 + 0xa000]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rbx
mov rdx, rax
call fcn.140007bae
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [0x14002fba0], rax
lea rcx, [r13 + 0xa002]
xor eax, eax
cmp word [r13 + 0xa000], 0x22
sete al
cmovne rcx, rbx
lea edx, [rax + rax]
add edx, 0x20
call fcn.140007c94
mov rcx, rax
call qword [sym.imp.USER32.dll_CharNextW]
mov r15, rax
movzx ecx, word [rax]
test cx, cx
je 0x140004619
xor r14d, r14d
movabs rsi, 0x4300520043004e
movabs rdi, 0x3d0044002f0020
mov rax, r15
add rax, 2
cmp cx, 0x20
jne 0x14000457c
movzx ecx, word [rax]
jmp 0x14000456d
movzx edx, cx
cmp edx, 0x22
jne 0x14000458d
movzx ecx, word [rax]
mov dx, 0x22
jmp 0x140004595
add rax, 0xfffffffffffffffe
mov dx, 0x20
cmp cx, 0x2f
jne 0x1400045dd
lea rcx, [rax + 2]
cmp word [rax + 2], 0x53
jne 0x1400045bd
movzx r8d, word [rax + 4]
test r8d, 0xffdf
jne 0x1400045bd
mov dword [r12 + 0x20], 1
cmp qword [rcx], rsi
jne 0x1400045d4
movzx r8d, word [rax + 0xa]
test r8d, 0xffdf
jne 0x1400045d4
or r14d, 4
cmp qword [rax - 2], rdi
je 0x140004600
mov rax, rcx
mov rcx, rax
call fcn.140007c94
xor ecx, ecx
cmp word [rax], 0x22
sete cl
lea rax, [rax + rcx*2]
movzx ecx, word [rax]
test cx, cx
jne 0x14000456d
jmp 0x140004619
mov word [rax - 2], 0
lea rcx, [r13 + 0xa800]
add rax, 6
mov rdx, rax
call fcn.140007bae
lea rdi, [r13 + 0xc800]
mov ecx, 0x400
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
call fcn.14000436c
test rax, rax
jne 0x1400046b0
mov rcx, rdi
mov edx, 0x3fb
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea rdx, str.Temp
mov rcx, rdi
call sub.KERNEL32.dll_lstrcatW
call fcn.14000436c
test rax, rax
jne 0x1400046b0
mov ecx, 0x3fc
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rdx, [0x14000b476]
mov rcx, rdi
call sub.KERNEL32.dll_lstrcatW
lea rcx, str.TEMP
mov rsi, qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rdx, rdi
call rsi
lea rcx, [0x14000b488]
mov rdx, rdi
call rsi
call fcn.14000436c
test rax, rax
jne 0x1400046b0
xor ebp, ebp
lea rsi, str.Error_writing_temporary_file._Make_sure_your_temp_folder_is_valid.
jmp 0x1400046f3
lea rcx, [r13 + 0xc000]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, r14d
call fcn.140003c69
test rax, rax
jne 0x1400046ee
mov rax, qword [0x14000b520]
cmp dword [rax], 0
jne 0x1400047e5
mov dword [r12 + 0x2c], 0xffffffff
xor esi, esi
call fcn.140004bb8
mov ebp, eax
jmp 0x1400046f3
mov rsi, rax
xor ebp, ebp
call fcn.140004a47
call qword [sym.imp.ole32.dll_OleUninitialize]
test rsi, rsi
jne 0x1400047cd
cmp dword [r12 + 0x14], 0
je 0x1400047ba
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x58]
mov rcx, rax
mov edx, 0x28
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140004772
lea rsi, [rsp + 0x64]
lea rdx, str.SeShutdownPrivilege
xor ecx, ecx
mov r8, rsi
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov dword [rsi - 4], 1
mov dword [rsi + 8], 2
mov rcx, qword [rsp + 0x58]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
lea r8, [rsp + 0x60]
xor edx, edx
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov ecx, 1
call fcn.14000767a
test rax, rax
je 0x14000479c
mov dword [rsp + 0x20], 0x80040002
xor ecx, ecx
xor edx, edx
xor r8d, r8d
mov r9d, 0x25
call rax
test eax, eax
je 0x1400047b0
mov ecx, 2
mov edx, 0x80040002
call qword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x1400047ba
mov ecx, 9
call fcn.140003804
mov eax, dword [r12 + 0x2c]
cmp eax, 0xffffffff
cmovne ebp, eax
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, rsi
mov edx, 0x200010
call fcn.140007772
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, rbx
xor edx, edx
call fcn.140007c94
cmp rax, rbx
jb 0x140004813
mov rsi, rax
movabs rax, 0x3d003f005f0020
cmp qword [rsi], rax
je 0x1400049d2
add rsi, 0xfffffffffffffffe
cmp rsi, rbx
jae 0x140004801
call fcn.140007653
mov r12d, eax
mov rcx, rdi
call sub.KERNEL32.dll_lstrlenW
movsxd rsi, eax
mov rcx, r13
mov rdx, r15
call fcn.140007bae
cmp word [r13 + 0xa800], 0
jne 0x14000484f
lea rcx, [r13 + 0xa800]
lea rdx, [r13 + 0xb800]
call fcn.140007bae
lea r14, [r13 + 0x2800]
lea rax, [r13 + 0x3000]
mov qword [rsp + 0x48], rax
mov rax, r13
lea r13, [rdi + rsi*2]
add rax, 0xd800
mov qword [rsp + 0x50], rax
mov r15d, 1
lea rbx, str.nsu_X.tmp
mov rbp, qword [sym.imp.USER32.dll_wsprintfW]
mov qword [rsp + 0x40], r13
mov sil, 1
mov dword [rsp + 0x3c], r15d
mov rcx, r13
mov rdx, rbx
mov r8d, r15d
call rbp
mov rax, qword [0x14000b008]
mov rax, qword [rax]
mov edx, dword [rax + 0x140]
mov rcx, r14
call fcn.1400083fa
mov rcx, rdi
test r12d, r12d
je 0x1400048c7
call fcn.1400075d0
jmp 0x1400048cc
call fcn.140007631
test eax, eax
je 0x140004911
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
bt eax, 0xa
jb 0x1400049b7
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x1400049b7
mov rcx, rdi
mov edx, 1
call fcn.140007876
test sil, 1
mov esi, 0
jne 0x140004895
jmp 0x1400049b7
mov r13, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
xor ebp, ebp
mov r15, rdi
mov rcx, rdi
xor edx, edx
call fcn.140007c08
mov rcx, qword [rsp + 0x50]
mov rdx, r14
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x1400049c9
mov ebp, r12d
mov rdi, r14
mov rcx, r14
xor edx, edx
call fcn.140007c08
mov rax, qword [0x14000b008]
mov rax, qword [rax]
mov edx, dword [rax + 0x144]
mov r12, qword [rsp + 0x48]
mov rcx, r12
call fcn.1400083fa
mov rcx, r12
call fcn.1400076cd
test rax, rax
jne 0x1400049f5
test sil, 1
je 0x140004a0e
mov r14, rdi
mov rcx, rdi
call fcn.140007c27
xor esi, esi
test rax, rax
mov r12d, ebp
mov rbp, r13
mov r13, qword [rsp + 0x40]
mov rdi, r15
mov r15d, dword [rsp + 0x3c]
je 0x140004895
jmp 0x1400049c7
inc r15d
cmp r15d, 0x10000
jne 0x14000488d
xor ebp, ebp
mov r12, qword [0x14000b368]
jmp 0x1400049e9
mov word [rsi], 0
add rsi, 8
mov rcx, rsi
call fcn.140007ade
test eax, eax
jne 0x140004a21
xor ebp, ebp
lea rsi, str.Error_launching_installer
jmp 0x1400046f3
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
xor ebp, ebp
mov r12, qword [0x14000b368]
jmp 0x1400046f3
mov r12, qword [0x14000b368]
lea rsi, str.Error_launching_installer
jmp 0x1400046f1
lea rcx, [r13 + 0xa800]
mov rdx, rsi
call fcn.140007bae
add r13, 0xb000
mov rcx, r13
mov rdx, rsi
call fcn.140007bae
jmp 0x1400046da