Function at 0x4039ed
Capabilities:
Accept command line arguments
Copy file
Delete file
Get common file path
Get file system object information
Set current directory
Set environment variable
Shutdown system
Terminate process

Disassembly:
sub esp, 0x2cc
and dword [esp], 0
push ebx
push ebp
push esi
push edi
push 0x20
pop ebx
push 0x8001
mov edi, str.Error_writing_temporary_file._Make_sure_your_temp_folder_is_valid.
xor ebp, ebp
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
call dword [sym.imp.KERNEL32.dll_GetVersion]
push 6
and eax, 0xbfffffff
pop ecx
mov dword [0x476210], eax
cmp ax, cx
je 0x403a39
push ebp
call fcn.00406e4e
test eax, eax
je 0x403a39
push 0xc00
call eax
mov esi, str.UXTHEME
push esi
call fcn.0040643f
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc esi
add esi, eax
cmp byte [esi], 0
jne 0x403a3e
push 0xa
call fcn.00406e4e
push 8
call fcn.00406e4e
push 6
mov dword [0x476214], eax
call fcn.00406e4e
test eax, eax
je 0x403a83
push 0x1e
call eax
test eax, eax
je 0x403a83
or dword [0x476210], 0x40000000
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
xor esi, esi
push esi
call dword [sym.imp.ole32.dll_OleInitialize]
push esi
push 0x2b4
mov dword [0x47e280], eax
lea eax, [esp + 0x30]
push eax
push esi
push 0x40a2c0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push str.NSIS_Error
push 0x476220
call fcn.0040708c
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
mov esi, 0x4cf000
push esi
call fcn.0040708c
push 0x22
mov eax, esi
mov dword [0x476218], 0x400000
pop esi
cmp word [0x4cf000], si
jne 0x403aee
mov ebx, esi
mov eax, 0x4cf002
push ebx
push eax
call fcn.00406a3c
push eax
call dword [sym.imp.USER32.dll_CharNextW]
mov dword [esp + 0x14], eax
movzx ecx, word [eax]
test cx, cx
je 0x403bb3
push 0x20
pop ebx
cmp cx, bx
jne 0x403b1c
add eax, 2
cmp word [eax], bx
je 0x403b14
mov edx, ebx
cmp word [eax], si
jne 0x403b28
add eax, 2
mov edx, esi
cmp word [eax], 0x2f
jne 0x403b82
add eax, 2
cmp word [eax], 0x53
jne 0x403b4f
movzx ecx, word [eax + 2]
cmp cx, bx
je 0x403b45
test cx, cx
jne 0x403b4f
mov dword [0x47e300], 1
cmp dword [eax], 0x43004e
jne 0x403b71
cmp dword [eax + 4], 0x430052
jne 0x403b71
movzx ecx, word [eax + 8]
cmp cx, bx
je 0x403b6e
test cx, cx
jne 0x403b71
or ebp, 4
cmp dword [eax - 4], 0x2f0020
jne 0x403b82
cmp dword [eax], 0x3d0044
je 0x403b9f
push edx
push eax
call fcn.00406a3c
cmp word [eax], si
jne 0x403b91
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x403b0f
jmp 0x403bb3
xor ecx, ecx
mov word [eax - 4], cx
add eax, 4
push eax
push 0x4d3000
call fcn.0040708c
mov esi, dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov ebx, 0x4e3000
push ebx
push 0x2000
call esi
call fcn.00403ea0
test eax, eax
jne 0x403c25
push 0x1ffb
push ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.Temp
push ebx
call sub.KERNEL32.dll_lstrcatW
call fcn.00403ea0
test eax, eax
jne 0x403c25
push ebx
push 0x1ffc
call esi
push 0x40a2e8
push ebx
call sub.KERNEL32.dll_lstrcatW
mov esi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push ebx
push str.TEMP
call esi
push ebx
push 0x40a2fc
call esi
call fcn.00403ea0
test eax, eax
je 0x403dd5
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x4df000
call ebx
push ebp
call fcn.004036d7
mov edi, eax
test edi, edi
jne 0x403dd5
cmp dword [0x47e224], eax
je 0x403ca9
push eax
mov ebp, 0x4cf000
push ebp
call fcn.00406a3c
mov esi, eax
jmp 0x403c6e
cmp dword [esi], 0x5f0020
jne 0x403c6b
cmp dword [esi + 4], 0x3d003f
je 0x403c72
sub esi, 2
cmp esi, ebp
jae 0x403c5a
mov edi, str.Error_launching_installer
cmp esi, ebp
jb 0x403cc3
xor eax, eax
mov word [esi], ax
add esi, 8
push esi
call fcn.00406a74
test eax, eax
je 0x403dd5
push esi
push 0x4d3000
call fcn.0040708c
push esi
push 0x4d7000
call fcn.0040708c
xor edi, edi
or dword [0x47e30c], 0xffffffff
call fcn.00405c70
push 1
mov ebx, eax
call fcn.00406b24
jmp 0x403dd9
call fcn.004067a3
push str.nsu
mov ebp, 0x4e3000
mov esi, eax
push ebp
call sub.KERNEL32.dll_lstrcatW
test esi, esi
je 0x403ce9
push 0x40a310
push ebp
call sub.KERNEL32.dll_lstrcatW
push 0x40a314
push ebp
call sub.KERNEL32.dll_lstrcatW
push 0x4db000
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x403dd5
push ebp
test esi, esi
je 0x403d14
call fcn.0040609b
jmp 0x403d19
call fcn.0040607b
push ebp
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cmp word [0x4d3000], 0
jne 0x403d39
push 0x4db000
push 0x4d3000
call fcn.0040708c
push dword [esp + 0x14]
push section..ndata
call fcn.0040708c
push 0x1a
mov dword [0x483000], 0x41
pop esi
mov eax, dword [0x47e230]
push dword [eax + 0x120]
push 0x43dd38
call fcn.00406119
push 0x43dd38
call ebx
test edi, edi
je 0x403dc2
push 1
push 0x43dd38
push 0x4eb000
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x403dc2
push 0
push 0x43dd38
call fcn.004064e0
mov eax, dword [0x47e230]
push dword [eax + 0x124]
push 0x43dd38
call fcn.00406119
push 0x43dd38
call fcn.00406be0
test eax, eax
je 0x403dc2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
inc word [0x483000]
sub esi, 1
jne 0x403d54
push esi
push ebp
call fcn.004064e0
mov ebx, dword [esp + 0x10]
call fcn.004039c3
call dword [sym.imp.ole32.dll_OleUninitialize]
test edi, edi
je 0x403dfb
push 0x200010
push edi
call fcn.0040701a
push 2
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x47e2f4], 0
je 0x403e8c
lea eax, [esp + 0x14]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x403e59
lea eax, [esp + 0x1c]
push eax
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 0
push 0
push 0
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 1
push eax
push 0
push dword [esp + 0x28]
mov dword [esp + 0x3c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 4
call fcn.00406e4e
mov esi, 0x80040002
test eax, eax
je 0x403e78
push esi
push 0x25
push 0
push 0
push 0
call eax
test eax, eax
je 0x403e85
push esi
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x403e8c
push 9
call fcn.004014e3
cmp dword [0x47e30c], 0xffffffff
cmovne ebx, dword [0x47e30c]
push ebx
jmp 0x403df5