Function at 0x140003e14
Capabilities:
Accept command line arguments
Check os version
Copy file
Delete file
Get common file path
Get file system object information
Set current directory
Set environment variable
Shutdown system
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x300
xor r15d, r15d
lea rdi, str.Error_writing_temporary_file._Make_sure_your_temp_folder_is_valid.
mov ecx, 0x8001
mov r14d, r15d
mov ebp, r15d
lea r12d, [r15 + 0x20]
movzx esi, r12w
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [0x140036780], eax
cmp ax, 6
je 0x140003e7b
xor ecx, ecx
call fcn.140007810
test rax, rax
je 0x140003e7b
mov ecx, 0xc00
call rax
lea rbx, str.UXTHEME
mov r13d, 1
mov rcx, rbx
call fcn.14000706c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, r13d
cdqe
add rbx, rax
cmp byte [rbx], r15b
jne 0x140003e88
mov ecx, 7
call fcn.140007810
mov ecx, 5
call fcn.140007810
mov qword [0x140035750], rax
call qword [sym.imp.COMCTL32.dll_InitCommonControls]
xor ecx, ecx
call qword [sym.imp.ole32.dll_OleInitialize]
mov r9d, 0x2b8
mov dword [rsp + 0x20], r15d
lea r8, [rsp + 0x40]
mov dword [0x140036800], eax
xor edx, edx
lea rcx, [0x14000a868]
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea rdx, str.NSIS_Error
lea rcx, [0x140035780]
call fcn.140007b28
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rbx, [0x140042000]
mov rdx, rax
mov rcx, rbx
call fcn.140007b28
mov rcx, rbx
lea rax, [0x140000000]
mov ebx, 0x22
mov qword [0x140035758], rax
cmp word [0x140042000], bx
jne 0x140003f47
mov esi, ebx
lea rcx, [0x140042002]
movzx edx, si
call fcn.140007458
mov rcx, rax
call qword [sym.imp.USER32.dll_CharNextW]
mov rsi, rax
movzx edx, word [rax]
test dx, dx
je 0x14000401b
mov r10d, 0xffdf
jmp 0x140003f76
add rax, 2
movzx edx, word [rax]
cmp dx, r12w
je 0x140003f6f
movzx r9d, r12w
movzx r8d, dx
cmp dx, bx
jne 0x140003f91
movzx r8d, word [rax + 2]
mov r9d, ebx
lea rcx, [rax + 2]
cmovne rcx, rax
cmp r8w, 0x2f
jne 0x140003fe8
add rcx, 2
cmp word [rcx], 0x53
jne 0x140003fbf
test word [rcx + 2], r10w
mov eax, dword [0x140036880]
cmove eax, r13d
mov dword [0x140036880], eax
movabs rax, 0x4300520043004e
cmp qword [rcx], rax
jne 0x140003fd8
test word [rcx + 8], r10w
jne 0x140003fd8
or ebp, 4
movabs rax, 0x3d0044002f0020
cmp qword [rcx - 4], rax
je 0x140004006
movzx edx, r9w
call fcn.140007458
movzx edx, word [rax]
cmp dx, bx
jne 0x140003f5e
add rax, 2
jmp 0x140003f5b
mov word [rcx - 4], r15w
lea rdx, [rcx + 4]
lea rcx, [0x140042800]
call fcn.140007b28
lea r12, [0x140044800]
mov ecx, 0x400
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
call fcn.140004388
test rax, rax
jne 0x1400040ac
mov edx, 0x3fb
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea rdx, str.Temp
mov rcx, r12
call sub.KERNEL32.dll_lstrcatW
call fcn.140004388
test rax, rax
jne 0x1400040ac
mov rdx, r12
mov ecx, 0x3fc
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rdx, [0x14000a898]
mov rcx, r12
call sub.KERNEL32.dll_lstrcatW
mov rdx, r12
lea rcx, str.TEMP
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rdx, r12
lea rcx, [0x14000a8b0]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
call fcn.140004388
test rax, rax
je 0x140004156
lea rcx, [0x140044000]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, ebp
call fcn.140003a3c
mov rdi, rax
test rax, rax
jne 0x140004156
cmp dword [0x140036788], r15d
je 0x140004147
lea rbp, [0x140042000]
xor edx, edx
mov rcx, rbp
call fcn.140007458
mov rbx, rax
cmp rax, rbp
jb 0x140004106
movabs rax, 0x3d003f005f0020
cmp qword [rbx], rax
je 0x140004106
sub rbx, 2
cmp rbx, rbp
jae 0x1400040ee
lea rdi, str.Error_launching_installer
cmp rbx, rbp
jb 0x140004183
mov word [rbx], r15w
add rbx, 8
mov rcx, rbx
call fcn.14000749c
test eax, eax
je 0x140004156
mov rdx, rbx
lea rcx, [0x140042800]
call fcn.140007b28
mov rdx, rbx
lea rcx, [0x140043000]
call fcn.140007b28
mov rdi, r15
or dword [0x14003688c], 0xffffffff
call fcn.1400067f0
mov r14d, eax
call fcn.140003dd8
call qword [sym.imp.ole32.dll_OleUninitialize]
test rdi, rdi
je 0x1400042bb
mov edx, 0x200010
mov rcx, rdi
call fcn.140007aa4
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.140007310
lea rdx, str.nsu
mov rcx, r12
mov ebx, eax
call sub.KERNEL32.dll_lstrcatW
test ebx, ebx
je 0x1400041ac
lea rdx, [0x14000a8c4]
mov rcx, r12
call sub.KERNEL32.dll_lstrcatW
lea rdx, [0x14000a8c8]
mov rcx, r12
call sub.KERNEL32.dll_lstrcatW
lea rdx, [0x140043800]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140004156
mov rcx, r12
test ebx, ebx
je 0x1400041dd
call fcn.140006c7c
jmp 0x1400041e2
call fcn.140006c58
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cmp word [0x140042800], r15w
jne 0x140004208
lea rdx, [0x140043800]
lea rcx, [0x140042800]
call fcn.140007b28
mov rdx, rsi
lea rcx, [section..ndata]
call fcn.140007b28
mov dword [0x140038800], 0x41
lea rsi, [0x14002d5f0]
mov ebx, 0x1a
mov rax, qword [0x140036798]
mov rcx, rsi
mov edx, dword [rax + 0x140]
call fcn.140006d0c
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test rdi, rdi
je 0x14000429f
mov r8d, r13d
lea rcx, [0x140045800]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x14000429f
xor edx, edx
mov rcx, rsi
call fcn.140007124
mov rax, qword [0x140036798]
mov rcx, rsi
mov edx, dword [rax + 0x144]
call fcn.140006d0c
mov rcx, rsi
call fcn.140007564
test rax, rax
je 0x14000429f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, r15
add word [0x140038800], r13w
sub rbx, r13
jne 0x14000422d
xor edx, edx
mov rcx, r12
call fcn.140007124
jmp 0x140004156
cmp dword [0x140036874], r15d
je 0x14000436f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x330]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14000432b
lea r8, [rsp + 0x34]
xor ecx, ecx
lea rdx, str.SeShutdownPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rsp + 0x330]
lea r8, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], r15
xor edx, edx
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x3c], 2
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov ecx, r13d
call fcn.140007810
mov ebx, 0x80040002
test rax, rax
je 0x140004354
mov r9d, 0x25
mov dword [rsp + 0x20], ebx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rax
test eax, eax
je 0x140004365
mov edx, ebx
mov ecx, 2
call qword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x14000436f
mov ecx, 9
call fcn.140001610
cmp dword [0x14003688c], 0xffffffff
cmovne r14d, dword [0x14003688c]
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_ExitProcess]