Function at 0x403a5d
Capabilities:
Accept command line arguments
Check os version
Copy file
Delete file
Get common file path
Get file system object information
Set current directory
Set environment variable
Shutdown system

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2f8
push 0x8001
call sub.KERNEL32.dll_SetErrorMode
add esp, 0xc
call sub.KERNEL32.dll_GetVersion
cmp ax, 6
je 0x403a9f
sub esp, 0xc
push 0
call fcn.00406846
add esp, 0xc
test eax, eax
je 0x403a9f
sub esp, 0xc
push 0xc00
call eax
add esp, 0xc
mov ebx, str.UXTHEME
jmp 0x403abc
sub esp, 0xc
push ebx
call fcn.004067db
push ebx
call sub.KERNEL32.dll_lstrlenA
add esp, 0xc
lea ebx, [ebx + eax + 1]
cmp byte [ebx], 0
jne 0x403aa6
sub esp, 0xc
push 9
call fcn.00406846
push 7
call fcn.00406846
add esp, 0xc
mov dword [0x435af8], eax
call sub.COMCTL32.DLL_InitCommonControls
sub esp, 0xc
push 0
call sub.OLE32.dll_OleInitialize
mov dword [0x435a48], eax
lea eax, [ebp - 0x2c4]
push 0
push 0x2b4
push eax
push 0
push 0x40b360
call sub.SHELL32.DLL_SHGetFileInfoW
sub esp, 0xc
push str.NSIS_Error
push 0x435b28
call fcn.00406aea
add esp, 0x18
call sub.KERNEL32.dll_GetCommandLineW
mov edx, dword [0x40b688]
add edx, 0xa000
push ecx
mov dword [ebp - 0x2dc], edx
push ecx
push eax
push edx
call fcn.00406aea
push edi
push 0
call sub.KERNEL32.dll_GetModuleHandleW
mov dword [0x435b18], eax
mov eax, dword [0x40b688]
add esp, 0xc
cmp word [eax + 0xa000], 0x22
je 0x403b69
mov edx, dword [ebp - 0x2dc]
mov eax, 0x20
jmp 0x403b7a
mov edx, dword [0x40b688]
mov eax, 0x22
add edx, 0xa002
movzx eax, ax
push esi
push esi
push eax
push edx
call fcn.004068eb
push ebx
push eax
call fcn.00408e54
mov dword [ebp - 0x2e8], 0
add esp, 0xc
mov dword [ebp - 0x2d8], eax
mov dword [ebp - 0x2e0], eax
jmp 0x403d26
add dword [ebp - 0x2e0], 2
mov edx, dword [ebp - 0x2e0]
mov ax, word [edx]
cmp ax, 0x20
je 0x403bab
cmp ax, 0x22
mov word [ebp - 0x2d2], 0x20
jne 0x403be2
add edx, 2
mov word [ebp - 0x2d2], 0x22
mov dword [ebp - 0x2e0], edx
mov eax, dword [ebp - 0x2e0]
cmp word [eax], 0x2f
jne 0x403cfa
add eax, 2
mov dword [ebp - 0x2e0], eax
cmp word [eax], 0x53
jne 0x403c1a
mov ax, word [eax + 2]
cmp ax, 0x20
je 0x403c10
test ax, ax
jne 0x403c1a
mov dword [0x435a28], 1
movzx ecx, word [0x40b49e]
movzx eax, word [0x40b49c]
xor ebx, ebx
xor edx, edx
mov ebx, ecx
mov edx, eax
mov ecx, 0
mov eax, 0
or ecx, eax
movzx eax, word [0x40b49a]
movzx esi, word [str.NCRC]
shl ebx, 0x10
shl eax, 0x10
or ebx, edx
or eax, esi
mov esi, ecx
cdq
or esi, eax
mov edi, ebx
mov eax, dword [ebp - 0x2e0]
or edi, edx
cmp dword [eax + 4], edi
jne 0x403c82
cmp dword [eax], esi
jne 0x403c82
mov ax, word [eax + 8]
cmp ax, 0x20
je 0x403c7b
test ax, ax
jne 0x403c82
or dword [ebp - 0x2e8], 4
movzx ecx, word [0x40b4a8]
movzx eax, word [0x40b4a6]
xor ebx, ebx
xor edx, edx
mov ebx, ecx
mov edx, eax
mov ecx, 0
mov eax, 0
or ecx, eax
movzx eax, word [0x40b4a4]
movzx esi, word [str.__D]
shl ebx, 0x10
shl eax, 0x10
or ebx, edx
or eax, esi
mov esi, ecx
cdq
or esi, eax
mov edi, ebx
mov eax, dword [ebp - 0x2e0]
or edi, edx
cmp dword [eax], edi
jne 0x403cfa
cmp dword [eax - 4], esi
jne 0x403cfa
mov word [eax - 4], 0
push ecx
mov eax, dword [ebp - 0x2e0]
push ecx
add eax, 4
push eax
mov eax, dword [0x40b688]
add eax, 0xa800
push eax
call fcn.00406aea
pop eax
pop edx
jmp 0x403d36
movzx eax, word [ebp - 0x2d2]
push edi
push edi
push eax
push dword [ebp - 0x2e0]
call fcn.004068eb
mov dword [ebp - 0x2e0], eax
pop ebx
cmp word [eax], 0x22
pop esi
jne 0x403d26
add eax, 2
mov dword [ebp - 0x2e0], eax
mov edx, dword [ebp - 0x2e0]
cmp word [edx], 0
jne 0x403bb2
mov eax, dword [0x40b688]
push ecx
add eax, 0xc800
push ecx
mov dword [ebp - 0x2ec], eax
push eax
push 0x400
call sub.KERNEL32.dll_GetTempPathW
pop eax
pop edx
call fcn.00403a07
test eax, eax
jne 0x403ded
push edi
push edi
push 0x3fb
push dword [ebp - 0x2ec]
call sub.KERNEL32.dll_GetWindowsDirectoryW
push str.Temp
push dword [ebp - 0x2ec]
call fcn.00406a60
pop ebx
pop esi
call fcn.00403a07
test eax, eax
jne 0x403ded
push ecx
push ecx
push dword [ebp - 0x2ec]
push 0x3fc
call sub.KERNEL32.dll_GetTempPathW
push 0x40b384
push dword [ebp - 0x2ec]
call fcn.00406a60
push dword [ebp - 0x2ec]
push str.TEMP
call sub.KERNEL32.dll_SetEnvironmentVariableW
push dword [ebp - 0x2ec]
push 0x40b396
call sub.KERNEL32.dll_SetEnvironmentVariableW
pop eax
pop edx
call fcn.00403a07
test eax, eax
jne 0x403ded
xor esi, esi
mov dword [ebp - 0x2d0], str.Error_writing_temporary_file._Make_sure_your_temp_folder_is_valid.
jmp 0x4040d1
sub esp, 0xc
mov eax, dword [0x40b688]
add eax, 0xc000
xor esi, esi
push eax
call sub.KERNEL32.dll_DeleteFileW
push dword [ebp - 0x2e8]
call fcn.00403681
add esp, 0xc
mov dword [ebp - 0x2d0], eax
test eax, eax
jne 0x4040d1
cmp dword [0x435ad8], 0
je 0x4040c0
push edi
push edi
push 0
push dword [ebp - 0x2dc]
call fcn.004068eb
pop ebx
pop esi
mov dword [ebp - 0x2e4], eax
jmp 0x403e4b
sub dword [ebp - 0x2e4], 2
mov edx, dword [ebp - 0x2dc]
cmp dword [ebp - 0x2e4], edx
jb 0x403ef8
movzx ecx, word [0x40b4b2]
movzx eax, word [0x40b4b0]
xor ebx, ebx
xor edx, edx
mov ebx, ecx
mov edx, eax
mov ecx, 0
mov eax, 0
or ecx, eax
movzx eax, word [0x40b4ae]
movzx esi, word [0x40b4ac]
shl ebx, 0x10
shl eax, 0x10
or ebx, edx
or eax, esi
mov esi, ecx
cdq
or esi, eax
mov edi, ebx
mov eax, dword [ebp - 0x2e4]
or edi, edx
cmp dword [eax + 4], edi
jne 0x403e44
cmp dword [eax], esi
jne 0x403e44
sub esp, 0xc
mov ebx, eax
mov word [eax], 0
add ebx, 8
push ebx
call fcn.00406fde
add esp, 0xc
test eax, eax
je 0x403f5b
mov eax, dword [0x40b688]
push ecx
add eax, 0xa800
push ecx
push ebx
push eax
call fcn.00406aea
mov eax, dword [0x40b688]
add eax, 0xb000
push ebx
push eax
call fcn.00406aea
pop eax
pop edx
jmp 0x4040c0
call fcn.00406895
mov ebx, eax
push eax
push eax
push str.nsu
push dword [ebp - 0x2ec]
call fcn.00406a60
test ebx, ebx
pop esi
pop edi
je 0x403f2b
push ecx
push ecx
push 0x40b462
push dword [ebp - 0x2ec]
call fcn.00406a60
pop eax
pop edx
push eax
push eax
push str..tmp
push dword [ebp - 0x2ec]
call fcn.00406a60
mov esi, dword [0x40b688]
add esi, 0xb800
push esi
push dword [ebp - 0x2ec]
call sub.KERNEL32.dll_lstrcmpiW
pop ecx
test eax, eax
pop edi
jne 0x403f6c
xor esi, esi
mov dword [ebp - 0x2d0], str.Error_launching_installer
jmp 0x4040d1
test ebx, ebx
je 0x403f80
sub esp, 0xc
push dword [ebp - 0x2ec]
call fcn.0040775f
jmp 0x403f8e
sub esp, 0xc
push dword [ebp - 0x2ec]
call fcn.0040773a
push dword [ebp - 0x2ec]
call sub.KERNEL32.dll_SetCurrentDirectoryW
mov edx, dword [0x40b688]
mov eax, dword [0x40b688]
add esp, 0xc
add eax, 0xa800
cmp word [edx + 0xa800], 0
jne 0x403fc1
push edx
push edx
push esi
push eax
call fcn.00406aea
pop esi
pop edi
push ebx
push ebx
push dword [ebp - 0x2d8]
push dword [0x40b688]
call fcn.00406aea
mov edi, dword [0x40b688]
movzx eax, word [0x40b4b8]
movzx edx, word [0x40b4b6]
shl eax, 0x10
add edi, 0x800
or eax, edx
mov edx, dword [0x40b688]
mov esi, str.Error_launching_installer
xor ebx, ebx
mov dword [edx + 0x800], eax
add edx, 0xd800
pop eax
mov dword [ebp - 0x2f0], edx
pop ecx
push eax
push eax
mov eax, dword [0x435a68]
push dword [eax + 0x120]
push 0x42d470
call fcn.00406b8a
push eax
push 0x42d470
call sub.KERNEL32.dll_DeleteFileW
add esp, 0xc
test esi, esi
je 0x404098
push ecx
push 1
push 0x42d470
push dword [ebp - 0x2f0]
call sub.KERNEL32.dll_CopyFileW
pop edx
test eax, eax
je 0x404098
push eax
push eax
push 0
push 0x42d470
call fcn.0040733a
mov eax, dword [0x435a68]
push dword [eax + 0x124]
push 0x42d470
call fcn.00406b8a
push eax
push 0x42d470
call fcn.004076e9
add esp, 0xc
test eax, eax
je 0x404098
sub esp, 0xc
xor esi, esi
push eax
call sub.KERNEL32.dll_CloseHandle
add esp, 0xc
inc word [edi]
inc ebx
cmp ebx, 0x1a
jne 0x404014
push eax
push eax
push 0
push dword [ebp - 0x2ec]
call fcn.0040733a
mov dword [ebp - 0x2d0], esi
pop edi
xor esi, esi
pop eax
jmp 0x4040d1
mov dword [0x435a34], 0xffffffff
call fcn.00406285
mov esi, eax
call fcn.004039c4
call sub.OLE32.dll_OleUninitialize
cmp dword [ebp - 0x2d0], 0
je 0x4040fe
push ebx
push ebx
push 0x200010
push dword [ebp - 0x2d0]
call fcn.00407652
push ecx
push 2
jmp 0x4041bf
cmp dword [0x435a1c], 0
je 0x4041af
call sub.KERNEL32.dll_GetCurrentProcess
push edx
lea edx, [ebp - 0x10]
push edx
push 0x28
push eax
call sub.ADVAPI32.DLL_OpenProcessToken
pop edi
test eax, eax
je 0x404164
lea eax, [ebp - 0x2c0]
push ebx
push eax
push str.SeShutdownPrivilege
push 0
call sub.ADVAPI32.DLL_LookupPrivilegeValueW
lea ebx, [ebp - 0x2c4]
mov dword [ebp - 0x2c4], 1
push ecx
push 0
push 0
push 0
push ebx
push 0
push dword [ebp - 0x10]
mov dword [ebp - 0x2b8], 2
call sub.ADVAPI32.DLL_AdjustTokenPrivileges
pop eax
pop edx
sub esp, 0xc
push 4
call fcn.00406846
add esp, 0xc
test eax, eax
je 0x40418e
sub esp, 0xc
push 0x80040002
push 0x25
push 0
push 0
push 0
call eax
add esp, 0xc
test eax, eax
je 0x4041a2
push eax
push eax
push 0x80040002
push 2
call sub.USER32.dll_ExitWindowsEx
pop ebx
test eax, eax
pop edi
jne 0x4041af
sub esp, 0xc
push 9
call fcn.0040331b
add esp, 0xc
mov eax, dword [0x435a34]
cmp eax, 0xffffffff
je 0x4041bb
mov esi, eax
sub esp, 0xc
push esi
call sub.KERNEL32.dll_ExitProcess