Function at 0x403861
Capabilities:
Accept command line arguments
Check os version
Delete file
Get common file path
Get file system object information
Set environment variable
Shutdown system
Terminate process

Disassembly:
sub esp, 0x3e8
push ebx
push ebp
push esi
push edi
xor ebp, ebp
xor ebx, ebx
push 0x8001
mov edi, str.Error_writing_temporary_file._Make_sure_your_temp_folder_is_valid.
mov dword [esp + 0x18], ebp
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
and dword [esp + 0x3c], ebx
lea eax, [esp + 0x28]
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
xorps xmm0, xmm0
push eax
movlpd qword [esp + 0x140], xmm0
mov dword [esp + 0x2c], 0x11c
call esi
test eax, eax
jne 0x4038e3
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 0x114
push eax
call esi
push 0x53
pop eax
mov dl, 4
mov byte [esp + 0x142], dl
cmp word [esp + 0x3c], ax
jne 0x4038df
mov eax, dword [esp + 0x56]
add eax, 0xffffffd0
mov word [esp + 0x13c], ax
jmp 0x4038ea
xor eax, eax
jmp 0x4038d5
mov dl, byte [esp + 0x142]
cmp dword [esp + 0x2c], 0xa
jae 0x4038fc
movzx eax, word [esp + 0x34]
mov dword [esp + 0x34], eax
jmp 0x403900
mov eax, dword [esp + 0x34]
mov dword [0x434318], eax
movzx eax, byte [esp + 0x2c]
shl ax, 8
movzx ecx, ax
movzx eax, byte [esp + 0x30]
or ecx, eax
movzx eax, byte [esp + 0x13c]
shl ax, 8
shl ecx, 0x10
movzx eax, ax
or ecx, eax
movzx eax, dl
or ecx, eax
mov eax, 0x600
mov dword [0x43431c], ecx
sar ecx, 0x10
cmp cx, ax
je 0x403956
push 0
call fcn.004068ab
test eax, eax
je 0x403956
push 0xc00
call eax
mov esi, str.UXTHEME
push esi
call fcn.00406163
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc esi
add esi, eax
cmp byte [esi], bl
jne 0x40395b
push 0xc
call fcn.004068ab
push 0xa
call fcn.004068ab
push 8
mov dword [0x433210], eax
call fcn.004068ab
test eax, eax
je 0x40399c
push 0x1e
call eax
test eax, eax
je 0x40399c
or byte [0x43431c], 0x80
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
xor esi, esi
push esi
call dword [sym.imp.ole32.dll_OleInitialize]
push esi
push 0x2b4
mov dword [0x434280], eax
lea eax, [esp + 0x14c]
push eax
push esi
push 0x4085cc
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push str.NSIS_Error
push 0x433220
call fcn.00406adf
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
mov esi, 0x43f000
push esi
call fcn.00406adf
movzx ecx, word [0x43f000]
push 0x22
pop eax
push 0x20
pop edx
cmp cx, ax
mov dword [esp + 0x10], eax
mov dword [0x433214], 0x400000
cmovne eax, edx
movzx eax, ax
push eax
push 0x22
pop edx
cmp cx, dx
mov eax, 0x43f002
cmove esi, eax
push esi
call fcn.004065bb
push eax
call dword [sym.imp.USER32.dll_CharNextW]
mov ecx, eax
movzx eax, word [ecx]
test ax, ax
je 0x403b15
mov edx, eax
push 0x20
pop ebp
movzx eax, dx
cmp dx, bp
jne 0x403a51
add ecx, 2
movzx eax, word [ecx]
cmp ax, bp
je 0x403a46
movzx esi, ax
movzx edx, ax
cmp ax, word [esp + 0x10]
jne 0x403a67
movzx edx, word [ecx + 2]
push 0x22
pop eax
mov ebp, eax
cmp si, word [esp + 0x10]
lea eax, [ecx + 2]
cmovne eax, ecx
cmp dx, 0x2f
jne 0x403ad3
push 0x53
add eax, 2
pop ecx
push 0x20
pop edx
cmp word [eax], cx
jne 0x403a9e
movzx ecx, word [eax + 2]
cmp cx, dx
je 0x403a94
test cx, cx
jne 0x403a9e
mov dword [0x434300], 1
cmp dword [eax], 0x43004e
jne 0x403ac2
cmp dword [eax + 4], 0x430052
jne 0x403ac2
movzx ecx, word [eax + 8]
cmp cx, dx
je 0x403abd
test cx, cx
jne 0x403ac2
or dword [esp + 0x14], 4
cmp dword [eax - 4], 0x2f0020
jne 0x403ad3
cmp dword [eax], 0x3d0044
je 0x403afd
push ebp
push eax
call fcn.004065bb
mov ecx, eax
push 0x22
pop edx
movzx eax, word [ecx]
mov esi, eax
cmp ax, dx
jne 0x403aef
add ecx, 2
movzx esi, word [ecx]
movzx edx, si
test si, si
jne 0x403a3b
jmp 0x403b11
xor ecx, ecx
mov word [eax - 4], cx
add eax, 4
push eax
push 0x43f800
call fcn.00406adf
mov ebp, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x441800
push 0x400
call esi
call fcn.00403c79
test eax, eax
jne 0x403b97
push 0x3fb
push 0x441800
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.Temp
push 0x441800
call sub.KERNEL32.dll_lstrcatW
call fcn.00403c79
test eax, eax
jne 0x403b97
push 0x441800
push 0x3fc
call esi
push 0x4085f4
mov esi, 0x441800
push esi
call sub.KERNEL32.dll_lstrcatW
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push str.TEMP
call esi
push 0x441800
push 0x408608
call esi
call fcn.00403c79
test eax, eax
je 0x403bbc
push 0x441000
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebp
call fcn.004034c7
mov edi, eax
test edi, edi
jne 0x403bbc
or dword [0x43430c], 0xffffffff
call fcn.00405a12
mov ebx, eax
call fcn.0040381f
call dword [sym.imp.ole32.dll_OleUninitialize]
test edi, edi
je 0x403bde
push 0x200010
push edi
call fcn.00406a6d
push 2
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x4342f4], 0
je 0x403c65
lea eax, [esp + 0x10]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
xor ebp, ebp
test eax, eax
je 0x403c35
lea eax, [esp + 0x1c]
push eax
push str.SeShutdownPrivilege
push ebp
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push ebp
push ebp
push ebp
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 1
push eax
push ebp
push dword [esp + 0x24]
mov dword [esp + 0x3c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 4
call fcn.004068ab
mov esi, 0x80040002
test eax, eax
je 0x403c51
push esi
push 0x25
push ebp
push ebp
push ebp
call eax
test eax, eax
je 0x403c5e
push esi
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x403c65
push 9
call fcn.00401533
cmp dword [0x43430c], 0xffffffff
cmovne ebx, dword [0x43430c]
push ebx
jmp 0x403bd8