Function at 0x404076
Capabilities:
Accept command line arguments
Check for time delay via gettickcount
Copy file
Delete file
Get common file path
Get file size
Terminate process

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [0x409290]
add eax, 0x3e8
mov dword [esp + 0x14], eax
mov bl, 0x20
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
mov edi, 0x400
push 0x42bf80
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
push dword [0x409290]
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
cmp byte [esi], 0x22
jne 0x4040c8
add bl, 2
inc esi
mov al, byte [esi]
mov ebp, dword [sym.imp.USER32.dll_CharNextA]
test al, al
je 0x4040ed
cmp al, bl
je 0x4040e3
push esi
call ebp
mov esi, eax
mov al, byte [esi]
test al, al
jne 0x4040d4
cmp byte [esi], 0
je 0x4040ed
push esi
call ebp
mov esi, eax
mov dword [esp + 0x18], esi
jmp 0x4040f8
push esi
call ebp
mov esi, eax
cmp byte [esi], 0x20
je 0x4040f3
cmp byte [esi], 0x2f
jne 0x40414d
inc esi
cmp byte [esi], 0x53
jne 0x404117
mov al, byte [esi + 1]
or al, 0x20
cmp al, 0x20
jne 0x404117
inc byte [0x422e90]
cmp dword [esi], 0x4352434e
jne 0x40412e
mov al, byte [esi + 4]
or al, 0x20
cmp al, 0x20
jne 0x40412e
inc byte [0x422e91]
cmp word [esi], 0x3d44
jne 0x4041a7
and byte [esi - 2], 0
add esi, 2
push esi
push dword [0x409294]
call sub.KERNEL32.dll_lstrcpyA
mov esi, 0x40c460
push str.NSIS_ERROR
push 0x42c3e0
call sub.KERNEL32.dll_lstrcpyA
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push edi
mov dword [0x425358], eax
push dword [0x40929c]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 3
push 0x80000000
push dword [0x40929c]
call fcn.004067a8
cmp eax, 0xffffffff
mov dword [0x42cbf4], eax
jne 0x4041b4
mov dword [0x422030], str.Error_launching_installer
jmp 0x404434
push esi
call ebp
mov esi, eax
mov al, byte [esi]
or al, 0x20
cmp al, 0x20
jne 0x4041a2
jmp 0x4040f8
push dword [0x40929c]
call fcn.00406677
push 0
push dword [0x42cbf4]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
mov dword [0x42cbec], eax
test edi, edi
jle 0x40431d
mov ebx, 0x422e98
mov eax, 0x200
mov ebp, edi
cmp edi, eax
jbe 0x4041ee
mov ebp, eax
push ebp
push 0x422038
call fcn.00403faf
test eax, eax
je 0x4042fa
cmp dword [0x42cbe4], 0
jne 0x40426d
push 0x422038
call fcn.00403d00
test eax, eax
je 0x4042af
mov ecx, dword [0x42cbe0]
cmp eax, edi
mov dword [0x42cbe4], ecx
jg 0x404337
mov cl, byte [0x422038]
test cl, 4
je 0x404241
inc byte [0x422e90]
cmp byte [0x422e91], 0
je 0x404253
test cl, 8
je 0x40431d
test cl, 1
je 0x40431d
inc byte [0x422238]
lea edi, [eax - 4]
cmp ebp, edi
jbe 0x4042af
mov ebp, edi
jmp 0x4042af
cmp byte [0x422e90], 0
jne 0x4042af
cmp dword [0x422688], 0
jne 0x4042e6
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [esp + 0x14]
jbe 0x4042af
push str.verifying_installer:__d__
push 0x403ffa
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0x6f
push dword [0x425358]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov dword [0x422688], eax
cmp edi, dword [0x42cbec]
jge 0x4042cd
push ebp
push 0x422038
push dword [0x422640]
call fcn.004021f4
mov dword [0x422640], eax
add dword [0x42cbe0], ebp
sub edi, ebp
test edi, edi
jg 0x4041e1
jmp 0x40431d
push ebx
call dword [sym.imp.USER32.dll_DispatchMessageA]
xor eax, eax
push 1
push eax
push eax
push eax
push ebx
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x4042df
jmp 0x4042af
mov eax, dword [0x422688]
mov dword [0x422030], 0x4090d0
test eax, eax
je 0x40441a
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
jmp 0x40441a
mov eax, dword [0x422688]
xor edi, edi
cmp eax, edi
je 0x40432f
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
cmp dword [0x42cbe4], edi
jne 0x404346
mov dword [0x422030], str.Installer_corrupted_or_incomplete._r_n_r_nThis_could_be_the_result_of_a_failed_download_or_corruption_from_a_virus._r_n_r_nIf_desperate__try_the__NCRC_command_line_switch__NOT_recommended_
jmp 0x40441a
cmp byte [0x422238], 0
je 0x404376
push edi
push dword [0x42cbe0]
call fcn.00403fe1
lea eax, [esp + 0x14]
push 4
push eax
call fcn.00403faf
test eax, eax
je 0x404337
mov eax, dword [0x422640]
cmp eax, dword [esp + 0x14]
jne 0x404337
push edi
push dword [0x42cbe4]
call fcn.00403fe1
call fcn.00403d3a
cmp eax, edi
mov dword [0x422030], eax
jne 0x40441a
xor eax, eax
cmp dword [0x42c3a8], eax
je 0x4043fc
cmp byte [esi], al
mov edi, esi
je 0x4043b2
inc edi
cmp byte [edi], 0
jne 0x4043a4
cmp edi, esi
jb 0x404476
cmp byte [edi], 0x5f
jne 0x4043c3
cmp byte [edi + 1], 0x3f
jne 0x4043c3
cmp byte [edi + 2], 0x3d
je 0x4043c8
dec edi
cmp edi, esi
jae 0x4043b2
cmp edi, esi
jb 0x404476
and byte [edi], 0
add edi, 3
push edi
call fcn.004066f6
test eax, eax
je 0x404589
push edi
push dword [0x409294]
call sub.KERNEL32.dll_lstrcpyA
push edi
push dword [0x409298]
call sub.KERNEL32.dll_lstrcpyA
mov eax, dword [0x42c39c]
cmp byte [eax + 0x42], 0
jne 0x404410
mov cl, byte [0x422e90]
mov byte [eax + 0x42], cl
call fcn.00404598
mov dword [0x422e94], eax
mov eax, dword [0x42cbf4]
cmp eax, 0xffffffff
je 0x40442b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x422030], 0
je 0x404441
push 0x10
push dword [0x422030]
call fcn.004065b4
cmp byte [0x40c060], 0
pop edi
pop esi
pop ebp
pop ebx
je 0x40445a
push 1
push 0x40c060
call fcn.004065df
mov eax, dword [0x42c3b4]
test eax, eax
je 0x40446a
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push dword [0x422e94]
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov ebx, 0x422691
mov esi, 0x422690
mov ebp, 0x422240
push 0x42bf80
push ebx
mov byte [0x422690], 0x22
call sub.KERNEL32.dll_lstrcpyA
push str.ANSISu_.exe
push esi
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [esp + 0x14], 0
jne 0x404569
push 0x400
push ebp
push dword [0x425358]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [eax + 0x422235]
push 0x40918d
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x404589
push 0
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x404569
push 0
push ebx
call fcn.004067c4
mov eax, dword [0x409294]
cmp byte [eax], 0
je 0x404514
push eax
push ebp
call sub.KERNEL32.dll_lstrcpyA
jmp 0x40451a
push ebp
call fcn.00406677
push ebp
call fcn.004066f6
test eax, eax
je 0x404589
push 0x4091c0
push esi
mov dword [esp + 0x1c], 1
call edi
push dword [esp + 0x18]
push esi
call edi
push str.___
push esi
call edi
push ebp
push esi
call edi
push 0x42bf80
push esi
call fcn.004064de
test eax, eax
je 0x40455f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x404569
mov eax, dword [str.Error_launching_installer]
mov dword [0x422030], eax
inc byte [str.ANSISu_.exe]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x1a
jl 0x404493
cmp dword [esp + 0x14], 0
jne 0x40441a
mov eax, dword [str.Error_launching_installer]
mov dword [0x422030], eax
jmp 0x40441a