Function at 0x403814
Capabilities:
Accept command line arguments
Check os version
Copy file
Delete file
Get common file path
Get file system object information
Set current directory
Set environment variable
Shutdown system
Terminate process

Disassembly:
sub esp, 0x2cc
and dword [esp], 0
push ebx
push ebp
push esi
push edi
push 0x20
pop edi
push 0x8001
mov ebx, str.Error_writing_temporary_file._Make_sure_your_temp_folder_is_valid.
xor ebp, ebp
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
call dword [sym.imp.KERNEL32.dll_GetVersion]
and eax, 0xbfffffff
mov dword [0x429d20], eax
cmp ax, 6
je 0x40385e
push ebp
call fcn.004068d4
test eax, eax
je 0x40385e
push 0xc00
call eax
mov esi, str.UXTHEME
push esi
call fcn.00406173
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc esi
add esi, eax
cmp byte [esi], 0
jne 0x403863
push 0xb
call fcn.004068d4
push 9
call fcn.004068d4
push 7
mov dword [0x428d10], eax
call fcn.004068d4
test eax, eax
je 0x4038a8
push 0x1e
call eax
test eax, eax
je 0x4038a8
or dword [0x429d20], 0x40000000
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
xor esi, esi
push esi
call dword [sym.imp.ole32.dll_OleInitialize]
push esi
push 0x2b4
mov dword [0x429d80], eax
lea eax, [esp + 0x30]
push eax
push esi
push 0x4085d4
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push str.NSIS_Error
push 0x428d20
call fcn.00406b12
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
mov esi, 0x434000
push esi
call fcn.00406b12
push 0x22
pop ecx
mov eax, esi
mov dword [0x428d14], 0x400000
cmp word [0x434000], cx
jne 0x403913
mov edi, ecx
mov eax, 0x434002
push edi
push eax
call fcn.004065e8
push eax
call dword [sym.imp.USER32.dll_CharNextW]
mov dword [esp + 0x14], eax
movzx ecx, word [eax]
test cx, cx
je 0x4039db
push 0x20
pop esi
push 0x22
pop edi
cmp cx, si
jne 0x403944
add eax, 2
cmp word [eax], si
je 0x40393c
mov edx, esi
cmp word [eax], di
jne 0x403950
add eax, 2
mov edx, edi
cmp word [eax], 0x2f
jne 0x4039aa
add eax, 2
cmp word [eax], 0x53
jne 0x403977
movzx ecx, word [eax + 2]
cmp cx, si
je 0x40396d
test cx, cx
jne 0x403977
mov dword [0x429e00], 1
cmp dword [eax], 0x43004e
jne 0x403999
cmp dword [eax + 4], 0x430052
jne 0x403999
movzx ecx, word [eax + 8]
cmp cx, si
je 0x403996
test cx, cx
jne 0x403999
or ebp, 4
cmp dword [eax - 4], 0x2f0020
jne 0x4039aa
cmp dword [eax], 0x3d0044
je 0x4039c7
push edx
push eax
call fcn.004065e8
cmp word [eax], di
jne 0x4039b9
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x403937
jmp 0x4039db
xor ecx, ecx
mov word [eax - 4], cx
add eax, 4
push eax
push 0x434800
call fcn.00406b12
mov esi, dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, 0x436800
push edi
push 0x400
call esi
call fcn.00403cc1
test eax, eax
jne 0x403a4d
push 0x3fb
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.Temp
push edi
call sub.KERNEL32.dll_lstrcatW
call fcn.00403cc1
test eax, eax
jne 0x403a4d
push edi
push 0x3fc
call esi
push 0x4085fc
push edi
call sub.KERNEL32.dll_lstrcatW
mov esi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push edi
push str.TEMP
call esi
push edi
push 0x408610
call esi
call fcn.00403cc1
test eax, eax
je 0x403bf6
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x436000
call edi
push ebp
call fcn.00403489
mov ebx, eax
test ebx, ebx
jne 0x403bf6
cmp dword [0x429d28], eax
je 0x403ad1
push eax
mov ebp, 0x434000
push ebp
call fcn.004065e8
mov esi, eax
jmp 0x403a96
cmp dword [esi], 0x5f0020
jne 0x403a93
cmp dword [esi + 4], 0x3d003f
je 0x403a9a
sub esi, 2
cmp esi, ebp
jae 0x403a82
mov ebx, str.Error_launching_installer
cmp esi, ebp
jb 0x403ae4
xor eax, eax
mov word [esi], ax
add esi, 8
push esi
call fcn.00406620
test eax, eax
je 0x403bf6
push esi
push 0x434800
call fcn.00406b12
push esi
push 0x435000
call fcn.00406b12
xor ebx, ebx
or dword [0x429e0c], 0xffffffff
call fcn.004059b8
mov ebp, eax
jmp 0x403bfa
call fcn.004064ec
push str.nsu
mov ebp, 0x436800
mov esi, eax
push ebp
call sub.KERNEL32.dll_lstrcatW
test esi, esi
je 0x403b0a
push 0x408624
push ebp
call sub.KERNEL32.dll_lstrcatW
push 0x408628
push ebp
call sub.KERNEL32.dll_lstrcatW
push 0x435800
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x403bf6
push ebp
test esi, esi
je 0x403b35
call fcn.00405dcf
jmp 0x403b3a
call fcn.00405daf
push ebp
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cmp word [0x434800], 0
jne 0x403b5a
push 0x435800
push 0x434800
call fcn.00406b12
push dword [esp + 0x14]
push section..ndata
call fcn.00406b12
push 0x1a
mov dword [0x42a800], 0x41
pop esi
mov eax, dword [0x429d34]
push dword [eax + 0x120]
push 0x4209d0
call fcn.00405e4d
push 0x4209d0
call edi
test ebx, ebx
je 0x403be3
push 1
push 0x4209d0
push 0x437800
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x403be3
push 0
push 0x4209d0
call fcn.00406214
mov eax, dword [0x429d34]
push dword [eax + 0x124]
push 0x4209d0
call fcn.00405e4d
push 0x4209d0
call fcn.004066c0
test eax, eax
je 0x403be3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
inc word [0x42a800]
sub esi, 1
jne 0x403b75
push esi
push ebp
call fcn.00406214
mov ebp, dword [esp + 0x10]
call fcn.004037d2
call dword [sym.imp.ole32.dll_OleUninitialize]
test ebx, ebx
je 0x403c1c
push 0x200010
push ebx
call fcn.00406aa0
push 2
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x429df4], 0
je 0x403cad
lea eax, [esp + 0x14]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x403c7a
lea eax, [esp + 0x1c]
push eax
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 0
push 0
push 0
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 1
push eax
push 0
push dword [esp + 0x28]
mov dword [esp + 0x3c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 4
call fcn.004068d4
mov esi, 0x80040002
test eax, eax
je 0x403c99
push esi
push 0x25
push 0
push 0
push 0
call eax
test eax, eax
je 0x403ca6
push esi
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x403cad
push 9
call fcn.00401549
cmp dword [0x429e0c], 0xffffffff
cmovne ebp, dword [0x429e0c]
push ebp
jmp 0x403c16