Function at 0x140003d80
Capabilities:
Accept command line arguments
Check os version
Copy file
Delete file
Get common file path
Get file system object information
Set current directory
Set environment variable
Shutdown system
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x308
mov ecx, 0x8001
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [0x14002aaa0], eax
cmp ax, 6
je 0x140003dc3
xor ecx, ecx
call fcn.140007a45
test rax, rax
je 0x140003dc3
mov ecx, 0xc00
call rax
mov rsi, qword [sym.imp.KERNEL32.dll_lstrlenA]
lea rbx, str.UXTHEME
mov rcx, rbx
call fcn.1400079ba
mov rcx, rbx
call rsi
inc eax
cdqe
add rbx, rax
cmp byte [rbx], 0
jne 0x140003dd1
mov ecx, 6
lea rdi, [rsp + 0x48]
call fcn.140007a45
mov ecx, 4
call fcn.140007a45
mov qword [0x14002aaa8], rax
call qword [sym.imp.COMCTL32.dll_InitCommonControls]
xor ecx, ecx
call qword [sym.imp.ole32.dll_OleInitialize]
mov rdx, qword [0x14000b090]
mov r8, rdi
mov r9d, 0x2b8
lea rcx, [0x14000a4da]
mov dword [rdx], eax
xor edx, edx
mov dword [rsp + 0x20], 0
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea rdx, str.NSIS_Error
lea rcx, [0x14002aac0]
call fcn.140007271
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdx, rax
mov rax, qword [0x14000b0d0]
mov rbx, qword [rax]
lea rsi, [rbx + 0xa000]
mov rcx, rsi
call fcn.140007271
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
movzx edx, word [rbx + 0xa000]
lea rcx, [rbx + 0xa002]
mov qword [0x14002aab0], rax
cmp dx, 0x22
je 0x140003ea1
mov rcx, rsi
mov edx, 0x20
call fcn.140006c07
xor r15d, r15d
movabs r12, 0x4300520043004e
movabs r13, 0x3d0044002f0020
mov rcx, rax
call qword [sym.imp.USER32.dll_CharNextW]
mov rbp, qword [0x14000b040]
mov qword [rsp + 0x38], rax
mov rcx, rax
cmp word [rcx], 0
je 0x140003f71
movzx edx, word [rcx]
cmp dx, 0x20
jne 0x140003eee
add rcx, 2
jmp 0x140003edf
cmp dx, 0x22
jne 0x140003efa
add rcx, 2
jmp 0x140003eff
mov edx, 0x20
cmp word [rcx], 0x2f
jne 0x140003f56
cmp word [rcx + 2], 0x53
lea rax, [rcx + 2]
jne 0x140003f1f
test word [rcx + 4], 0xffdf
jne 0x140003f1f
mov dword [rbp + 0x20], 1
cmp qword [rcx + 2], r12
jne 0x140003f35
test word [rcx + 0xa], 0xffdf
mov r8d, 4
cmove r15d, r8d
cmp qword [rcx - 2], r13
jne 0x140003f53
mov word [rcx - 2], 0
lea rdx, [rcx + 6]
lea rcx, [rbx + 0xa800]
call fcn.140007271
jmp 0x140003f71
mov rcx, rax
call fcn.140006c07
cmp word [rax], 0x22
mov rcx, rax
jne 0x140003ed5
add rcx, 2
jmp 0x140003ed5
lea r12, [rbx + 0xc800]
mov ecx, 0x400
mov rbp, qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov rdx, r12
call rbp
call fcn.140003cc0
test rax, rax
je 0x140003fbc
lea rcx, [rbx + 0xc000]
mov rbp, qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r14d, r14d
call rbp
mov ecx, r15d
call fcn.140003966
mov r13, rax
test rax, rax
jne 0x140004217
jmp 0x140004038
mov edx, 0x3fb
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea rdx, str.Temp
mov rcx, r12
call sub.KERNEL32.dll_lstrcatW
call fcn.140003cc0
test rax, rax
jne 0x140003f93
mov rdx, r12
mov ecx, 0x3fc
lea r13, str.Error_writing_temporary_file._Make_sure_your_temp_folder_is_valid.
xor r14d, r14d
call rbp
lea rdx, [0x14000a4fe]
mov rcx, r12
call sub.KERNEL32.dll_lstrcatW
mov rbp, qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rdx, r12
lea rcx, str.TEMP
call rbp
mov rdx, r12
lea rcx, [0x14000a510]
call rbp
call fcn.140003cc0
test rax, rax
jne 0x140003f93
jmp 0x140004217
mov rax, qword [0x14000b0b0]
cmp dword [rax], 0
je 0x140004201
xor edx, edx
mov rcx, rsi
call fcn.140006c07
movabs rdx, 0x3d003f005f0020
cmp rsi, rax
ja 0x1400040b0
cmp qword [rax], rdx
je 0x14000406c
sub rax, 2
jmp 0x14000405c
mov word [rax], 0
lea r12, [rax + 8]
mov rcx, r12
call fcn.1400076dc
test eax, eax
jne 0x14000408d
lea r13, str.Error_launching_installer
jmp 0x1400041fc
lea rcx, [rbx + 0xa800]
mov rdx, r12
call fcn.140007271
lea rcx, [rbx + 0xb000]
mov rdx, r12
call fcn.140007271
jmp 0x140004201
call fcn.140007aa5
lea rdx, str.nsu
mov rcx, r12
mov esi, eax
call sub.KERNEL32.dll_lstrcatW
test esi, esi
je 0x1400040d9
lea rdx, [0x14000a522]
mov rcx, r12
call sub.KERNEL32.dll_lstrcatW
lea rdx, str..tmp
mov rcx, r12
lea r13, [rbx + 0xb800]
call sub.KERNEL32.dll_lstrcatW
mov rdx, r13
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140004081
mov rcx, r12
test esi, esi
je 0x14000410d
call fcn.140006a30
jmp 0x140004112
call fcn.140006ac3
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cmp word [rbx + 0xa800], 0
jne 0x140004134
lea rcx, [rbx + 0xa800]
mov rdx, r13
call fcn.140007271
mov rdx, qword [rsp + 0x38]
mov rcx, rbx
mov esi, 0x1a
lea r13, str.Error_launching_installer
call fcn.140007271
mov r14, qword [0x14000b080]
mov dword [rbx + 0x800], 0x41
mov r15, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [r14]
lea rcx, [0x14002bac0]
mov edx, dword [rax + 0x140]
call fcn.1400073a9
lea rcx, [0x14002bac0]
call rbp
test r13, r13
je 0x1400041e3
lea rcx, [rbx + 0xd800]
mov r8d, 1
lea rdx, [0x14002bac0]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x1400041e3
xor edx, edx
lea rcx, [0x14002bac0]
call fcn.140006fef
mov rax, qword [r14]
lea rcx, [0x14002bac0]
mov edx, dword [rax + 0x144]
call fcn.1400073a9
lea rcx, [0x14002bac0]
call fcn.140006ae5
mov rcx, rax
test rax, rax
je 0x1400041e3
call r15
xor r13d, r13d
inc word [rbx + 0x800]
dec esi
jne 0x140004165
xor edx, edx
mov rcx, r12
call fcn.140006fef
xor r14d, r14d
jmp 0x140004217
mov rax, qword [0x14000b040]
mov dword [rax + 0x2c], 0xffffffff
call fcn.1400057a2
mov r14d, eax
call fcn.140003d1c
call qword [sym.imp.ole32.dll_OleUninitialize]
test r13, r13
mov rbx, qword [sym.imp.KERNEL32.dll_ExitProcess]
je 0x140004245
mov rcx, r13
mov edx, 0x200010
call fcn.140006b93
mov ecx, 2
jmp 0x140004313
mov rsi, qword [0x14000b040]
cmp dword [rsi + 0x14], 0
je 0x140004306
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x40]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400042bc
lea r8, [rsp + 0x4c]
lea rdx, str.SeShutdownPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
mov r8, rdi
mov dword [rsp + 0x48], 1
xor edx, edx
mov dword [rsp + 0x54], 2
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov ecx, 1
call fcn.140007a45
test rax, rax
jne 0x1400042e1
mov edx, 0x80040002
mov ecx, 2
call qword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
je 0x1400042fc
jmp 0x140004306
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0x80040002
mov r9d, 0x25
call rax
test eax, eax
jne 0x1400042cb
mov ecx, 9
call fcn.140003466
mov eax, dword [rsi + 0x2c]
cmp eax, 0xffffffff
cmovne r14d, eax
mov ecx, r14d
call rbx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop