Function at 0x404126
Capabilities:
Accept command line arguments
Check os version
Copy file
Delete file
Get common file path
Get file system object information
Set current directory
Set environment variable
Shutdown system
Terminate process

Disassembly:
sub esp, 0x2cc
and dword [esp], 0
push ebx
push ebp
push esi
push edi
push 0x20
pop edi
push 0x8001
mov ebx, 0x40a1ec
xor ebp, ebp
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
call dword [sym.imp.KERNEL32.dll_GetVersion]
and eax, 0xbfffffff
mov dword [0x473560], eax
cmp ax, 6
je 0x404170
push ebp
call fcn.004076cd
test eax, eax
je 0x404170
push 0xc00
call eax
mov esi, str.UXTHEME
push esi
call fcn.00406c3c
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc esi
add esi, eax
cmp byte [esi], 0
jne 0x404175
push 0xb
call fcn.004076cd
push 9
call fcn.004076cd
push 7
mov dword [0x46b550], eax
call fcn.004076cd
test eax, eax
je 0x4041ba
push 0x1e
call eax
test eax, eax
je 0x4041ba
or dword [0x473560], 0x40000000
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
xor esi, esi
push esi
call dword [sym.imp.ole32.dll_OleInitialize]
push esi
push 0x2b4
mov dword [0x4735c0], eax
lea eax, [esp + 0x30]
push eax
push esi
push 0x40a27c
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push str.NSIS
push 0x46b560
call fcn.00407903
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
mov esi, 0x4c4000
push esi
call fcn.00407903
push 0x22
pop ecx
mov dword [0x46b554], 0x400000
mov eax, esi
cmp word [0x4c4000], cx
jne 0x404225
mov edi, ecx
mov eax, 0x4c4002
push edi
push eax
call fcn.0040723f
push eax
call dword [sym.imp.USER32.dll_CharNextW]
movzx ecx, word [eax]
mov dword [esp + 0x14], eax
test cx, cx
je 0x4042ed
push 0x20
pop esi
push 0x22
pop edi
cmp cx, si
jne 0x404256
add eax, 2
cmp word [eax], si
je 0x40424e
mov edx, esi
cmp word [eax], di
jne 0x404262
add eax, 2
mov edx, edi
cmp word [eax], 0x2f
jne 0x4042bc
add eax, 2
cmp word [eax], 0x53
jne 0x404289
movzx ecx, word [eax + 2]
cmp cx, si
je 0x40427f
test cx, cx
jne 0x404289
mov dword [0x473640], 1
cmp dword [eax], 0x43004e
jne 0x4042ab
cmp dword [eax + 4], 0x430052
jne 0x4042ab
movzx ecx, word [eax + 8]
cmp cx, si
je 0x4042a8
test cx, cx
jne 0x4042ab
or ebp, 4
cmp dword [eax - 4], 0x2f0020
jne 0x4042bc
cmp dword [eax], 0x3d0044
je 0x4042d9
push edx
push eax
call fcn.0040723f
cmp word [eax], di
jne 0x4042cb
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x404249
jmp 0x4042ed
xor ecx, ecx
mov word [eax - 4], cx
add eax, 4
push eax
push 0x4c8000
call fcn.00407903
mov esi, dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, 0x4d8000
push edi
push 0x2000
call esi
call fcn.004045d8
test eax, eax
jne 0x40435f
push 0x1ffb
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.Temp
push edi
call sub.KERNEL32.dll_lstrcatW
call fcn.004045d8
test eax, eax
jne 0x40435f
push edi
push 0x1ffc
call esi
push 0x40a2a8
push edi
call sub.KERNEL32.dll_lstrcatW
mov esi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push edi
push str.TEMP
call esi
push edi
push 0x40a2bc
call esi
call fcn.004045d8
test eax, eax
je 0x40450d
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x4d4000
call edi
push ebp
call fcn.00403da4
mov ebx, eax
test ebx, ebx
jne 0x40450d
cmp dword [0x473568], eax
je 0x4043e3
push eax
mov ebp, 0x4c4000
push ebp
call fcn.0040723f
mov esi, eax
jmp 0x4043a8
cmp dword [esi], 0x5f0020
jne 0x4043a5
cmp dword [esi + 4], 0x3d003f
je 0x4043ac
sub esi, 2
cmp esi, ebp
jae 0x404394
mov ebx, 0x40a2c4
cmp esi, ebp
jb 0x4043fd
xor eax, eax
mov word [esi], ax
add esi, 8
push esi
call fcn.004072a9
test eax, eax
je 0x40450d
push esi
push 0x4c8000
call fcn.00407903
push esi
push 0x4cc000
call fcn.00407903
xor ebx, ebx
or dword [0x47364c], 0xffffffff
call fcn.0040647b
push 1
mov ebp, eax
call fcn.0040739c
jmp 0x404511
call fcn.00406fa8
push str.nsu
mov ebp, 0x4d8000
push ebp
mov esi, eax
call sub.KERNEL32.dll_lstrcatW
test esi, esi
je 0x404423
push 0x40a2e4
push ebp
call sub.KERNEL32.dll_lstrcatW
push 0x40a2e8
push ebp
call sub.KERNEL32.dll_lstrcatW
push 0x4d0000
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x40450d
push ebp
test esi, esi
je 0x40444e
call fcn.004068a6
jmp 0x404453
call fcn.00406886
push ebp
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cmp word [0x4c8000], 0
jne 0x404473
push 0x4d0000
push 0x4c8000
call fcn.00407903
push dword [esp + 0x14]
push section..ndata
call fcn.00407903
push 0x1a
mov dword [0x478000], 0x41
pop esi
mov eax, dword [0x473574]
push dword [eax + 0x120]
push 0x4341f0
call fcn.00406922
push 0x4341f0
call edi
test ebx, ebx
je 0x4044fc
push 1
push 0x4341f0
push 0x4e0000
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x4044fc
push 0
push 0x4341f0
call fcn.00406cdb
mov eax, dword [0x473574]
push dword [eax + 0x124]
push 0x4341f0
call fcn.00406922
push 0x4341f0
call fcn.00407456
test eax, eax
je 0x4044fc
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
inc word [0x478000]
dec esi
jne 0x40448e
push esi
push ebp
call fcn.00406cdb
mov ebp, dword [esp + 0x10]
call fcn.004040e4
call dword [sym.imp.ole32.dll_OleUninitialize]
test ebx, ebx
je 0x404533
push 0x200010
push ebx
call fcn.00407891
push 2
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x473634], 0
je 0x4045c4
lea eax, [esp + 0x14]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x404591
lea eax, [esp + 0x1c]
push eax
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 0
push 0
push 0
lea eax, [esp + 0x24]
push eax
push 0
push dword [esp + 0x28]
mov dword [esp + 0x30], 1
mov dword [esp + 0x3c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 4
call fcn.004076cd
mov esi, 0x80040002
test eax, eax
je 0x4045b0
push esi
push 0x25
push 0
push 0
push 0
call eax
test eax, eax
je 0x4045bd
push esi
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x4045c4
push 9
call fcn.0040161a
cmp dword [0x47364c], 0xffffffff
cmovne ebp, dword [0x47364c]
push ebp
jmp 0x40452d