Function at 0x404003
Capabilities:
Accept command line arguments
Copy file
Delete file
Get common file path
Get file system object information
Set current directory
Set environment variable
Shutdown system
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x3e8
push 0x8001
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
xor esi, esi
lea edi, [esp + 0x18]
mov dword [edi + 0x14], esi
mov dword [edi + 0x118], esi
mov dword [edi + 0x114], esi
mov dword [edi], 0x11c
push edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x40406e
mov dword [esp + 0x18], 0x114
push edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov byte [esp + 0x132], 4
movzx eax, word [esp + 0x46]
add eax, 0xffffffd0
cmp word [esp + 0x2c], 0x53
cmove esi, eax
mov word [esp + 0x12c], si
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
cmp eax, 9
ja 0x404082
movzx ecx, cx
mov dword [esp + 0x24], ecx
mov edi, dword [0x40b054]
mov dword [edi + 0x38], ecx
movzx edx, byte [esp + 0x132]
mov ecx, dword [esp + 0x12c]
shl ecx, 8
mov esi, 0xffff
and ecx, esi
or ecx, edx
movzx edx, byte [esp + 0x20]
shl eax, 8
and eax, esi
or eax, edx
mov edx, eax
shl edx, 0x10
or edx, ecx
mov dword [edi + 0x3c], edx
cmp eax, 0x600
je 0x4040d5
push 0
call fcn.00406dc9
test eax, eax
je 0x4040d5
push 0xc00
call eax
mov esi, str.UXTHEME
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
call fcn.00408166
push esi
call edi
add esi, eax
inc esi
cmp byte [esi], 0
jne 0x4040e0
push 0xb
call fcn.00406dc9
push 9
call fcn.00406dc9
mov dword [0x440278], eax
push 7
call fcn.00406dc9
test eax, eax
je 0x404120
push 0x1e
call eax
test eax, eax
je 0x404120
mov eax, dword [0x40b054]
or byte [eax + 0x3c], 0x80
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
xor ebx, ebx
push ebx
call dword [sym.imp.ole32.dll_OleInitialize]
mov ecx, dword [0x40b200]
mov dword [ecx], eax
lea eax, [esp + 0x134]
push ebx
push 0x2b4
push eax
push ebx
push 0x40b148
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push str.NSIS_Error
push 0x44027c
call fcn.004072be
mov eax, dword [0x40ae14]
mov esi, dword [eax]
lea edi, [esi + 0x50000]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
push edi
call fcn.004072be
mov dword [esp], 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [0x44827c], eax
xor eax, eax
cmp word [esi + 0x50000], 0x22
mov dword [esp + 4], esi
lea ecx, [esi + 0x50002]
sete al
mov dword [esp + 0x10], edi
cmovne ecx, edi
lea eax, [eax*2 + 0x20]
push eax
push ecx
call fcn.004073d6
push eax
call dword [sym.imp.USER32.dll_CharNextW]
mov dword [esp + 0xc], eax
movzx edx, word [eax]
test dx, dx
je 0x4042a9
mov dword [esp], 0
mov ebx, 0x2f0020
mov eax, dword [esp + 0xc]
add eax, 2
cmp dx, 0x20
jne 0x4041ee
movzx edx, word [eax]
jmp 0x4041e0
movzx ecx, dx
cmp ecx, 0x22
jne 0x4041ff
movzx edx, word [eax]
mov cx, 0x22
jmp 0x404206
add eax, 0xfffffffe
mov cx, 0x20
cmp dx, 0x2f
jne 0x40426b
cmp word [eax + 2], 0x53
jne 0x40422c
movzx edx, word [eax + 4]
test edx, 0xffdf
jne 0x40422c
mov edx, dword [0x40b054]
mov dword [edx + 0x20], 1
lea edx, [eax + 2]
mov ebp, dword [edx + 4]
mov edi, 0x430052
xor ebp, edi
mov edi, dword [edx]
mov esi, 0x43004e
xor edi, esi
or edi, ebp
jne 0x404256
movzx edi, word [eax + 0xa]
test edi, 0xffdf
jne 0x404256
or dword [esp], 4
mov edi, dword [eax + 2]
mov esi, 0x3d0044
xor edi, esi
mov ebp, dword [eax - 2]
xor ebp, ebx
or ebp, edi
je 0x40428f
mov eax, edx
movzx ecx, cx
push ecx
push eax
call fcn.004073d6
xor ecx, ecx
cmp word [eax], 0x22
sete cl
lea eax, [eax + ecx*2]
movzx edx, word [eax]
test dx, dx
jne 0x4041e0
jmp 0x4042a9
mov word [eax - 2], 0
mov ecx, dword [esp + 4]
add ecx, 0x54000
add eax, 6
push eax
push ecx
call fcn.004072be
mov esi, dword [esp + 4]
lea edi, [esi + 0x64000]
push edi
push 0x2000
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call fcn.00403fc4
test eax, eax
jne 0x404330
push 0x1ffb
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.Temp
push edi
call sub.KERNEL32.dll_lstrcatW
call fcn.00403fc4
test eax, eax
jne 0x404330
push edi
push 0x1ffc
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x40b16c
push edi
call sub.KERNEL32.dll_lstrcatW
mov esi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push edi
push str.TEMP
call esi
push edi
push 0x40b17e
call esi
mov esi, dword [esp + 4]
call fcn.00403fc4
test eax, eax
jne 0x404330
mov dword [esp], 0
mov ebx, 0x40b070
jmp 0x40437f
lea eax, [esi + 0x60000]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [esp]
call fcn.00403a70
test eax, eax
jne 0x404376
mov eax, dword [0x40b204]
cmp dword [eax], 0
jne 0x40445d
mov eax, dword [0x40b054]
mov dword [eax + 0x2c], 0xffffffff
call fcn.0040473a
mov dword [esp], eax
push 1
call fcn.00407ed9
xor ebx, ebx
jmp 0x40437f
mov ebx, eax
mov dword [esp], 0
call fcn.00404604
call dword [sym.imp.ole32.dll_OleUninitialize]
test ebx, ebx
jne 0x40444a
mov eax, dword [0x40b054]
cmp dword [eax + 0x14], 0
je 0x404432
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [esp + 0x14]
push ecx
push 0x28
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4043f3
lea edi, [esp + 0x138]
xor esi, esi
push edi
push str.SeShutdownPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov dword [edi - 4], 1
mov dword [edi + 8], 2
push esi
push esi
push esi
lea eax, [esp + 0x140]
push eax
push esi
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 4
call fcn.00406dc9
test eax, eax
je 0x40441a
sub esp, 0x14
movaps xmm0, xmmword [0x40b060]
movups xmmword [esp], xmm0
mov dword [esp + 0x10], 0x80040002
call eax
test eax, eax
je 0x40442b
push 0x80040002
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x404432
push 9
call fcn.00403728
mov eax, dword [0x40b054]
mov eax, dword [eax + 0x2c]
cmp eax, 0xffffffff
mov ecx, dword [esp]
cmovne ecx, eax
push ecx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x200010
push ebx
call fcn.00406ea5
push 2
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [esp], 0
mov dword [esp + 8], edi
push 0
mov edi, dword [esp + 0x14]
push edi
call fcn.004073d6
cmp eax, edi
jb 0x404499
mov ebp, eax
mov eax, 0x3d003f
mov ecx, 0x5f0020
mov edx, dword [ebp + 4]
xor edx, eax
mov esi, dword [ebp]
xor esi, ecx
or esi, edx
je 0x4044f4
add ebp, 0xfffffffe
cmp ebp, edi
jae 0x404484
call fcn.00406daf
mov ebp, eax
push str.nsu
mov edi, dword [esp + 0xc]
push edi
call sub.KERNEL32.dll_lstrcatW
test ebp, ebp
je 0x4044be
push 0x40b1c4
push edi
call sub.KERNEL32.dll_lstrcatW
push 0x40b1c8
push edi
call sub.KERNEL32.dll_lstrcatW
mov eax, dword [esp + 4]
lea esi, [eax + 0x5c000]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov ebx, str.Error_launching_installer
test eax, eax
je 0x40437f
test ebp, ebp
jne 0x404533
push edi
call fcn.00406d91
jmp 0x404539
mov word [ebp], 0
add ebp, 8
push ebp
call fcn.00407223
mov ebx, str.Error_launching_installer
test eax, eax
je 0x40437f
mov esi, dword [esp + 4]
lea eax, [esi + 0x54000]
push ebp
push eax
call fcn.004072be
add esi, 0x58000
push ebp
push esi
call fcn.004072be
jmp 0x404357
push edi
call fcn.00406d14
push edi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov edi, dword [esp + 4]
cmp word [edi + 0x54000], 0
jne 0x40455b
lea eax, [edi + 0x54000]
push esi
push eax
call fcn.004072be
push dword [esp + 0xc]
push edi
call fcn.004072be
mov dword [edi + 0x4000], 0x41
lea eax, [edi + 0x6c000]
mov dword [esp], eax
mov ebx, str.Error_launching_installer
mov edi, 0x1a
mov ebp, dword [0x40a004]
mov esi, 0x448280
mov eax, dword [ebp]
push dword [eax + 0x120]
push esi
call fcn.004079d0
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test ebx, ebx
je 0x4045e4
push 1
push 0x448280
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x4045e6
push 0
push esi
call fcn.00407350
mov eax, dword [ebp]
push dword [eax + 0x124]
push esi
call fcn.004079d0
push esi
call fcn.00406e02
test eax, eax
je 0x4045e6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
mov eax, dword [esp + 4]
inc word [eax + 0x4000]
dec edi
jne 0x40458d
push 0
push dword [esp + 0xc]
call fcn.00407350
jmp 0x404378