Function at 0x140003de8
Capabilities:
Accept command line arguments
Check os version
Copy file
Delete file
Get common file path
Get file system object information
Set current directory
Set environment variable
Shutdown system
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x300
xor r15d, r15d
lea rdi, str.Error_writing_temporary_file._Make_sure_your_temp_folder_is_valid.
mov ecx, 0x8001
mov r14d, r15d
mov ebp, r15d
lea r12d, [r15 + 0x20]
movzx esi, r12w
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [0x14002aa60], eax
cmp ax, 6
je 0x140003e4f
xor ecx, ecx
call fcn.1400077e4
test rax, rax
je 0x140003e4f
mov ecx, 0xc00
call rax
lea rbx, str.UXTHEME
mov r13d, 1
mov rcx, rbx
call fcn.140007040
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, r13d
cdqe
add rbx, rax
cmp byte [rbx], r15b
jne 0x140003e5c
mov ecx, 7
call fcn.1400077e4
mov ecx, 5
call fcn.1400077e4
mov qword [0x140029a30], rax
call qword [sym.imp.COMCTL32.dll_InitCommonControls]
xor ecx, ecx
call qword [sym.imp.ole32.dll_OleInitialize]
mov r9d, 0x2b8
mov dword [rsp + 0x20], r15d
lea r8, [rsp + 0x40]
mov dword [0x14002aae0], eax
xor edx, edx
lea rcx, [0x140009868]
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea rdx, str.NSIS_Error
lea rcx, [0x140029a60]
call fcn.140007afc
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rbx, [0x140036000]
mov rdx, rax
mov rcx, rbx
call fcn.140007afc
mov rcx, rbx
lea rax, [0x140000000]
mov ebx, 0x22
mov qword [0x140029a38], rax
cmp word [0x140036000], bx
jne 0x140003f1b
mov esi, ebx
lea rcx, [0x140036002]
movzx edx, si
call fcn.14000742c
mov rcx, rax
call qword [sym.imp.USER32.dll_CharNextW]
mov rsi, rax
movzx edx, word [rax]
test dx, dx
je 0x140003fef
mov r10d, 0xffdf
jmp 0x140003f4a
add rax, 2
movzx edx, word [rax]
cmp dx, r12w
je 0x140003f43
movzx r9d, r12w
movzx r8d, dx
cmp dx, bx
jne 0x140003f65
movzx r8d, word [rax + 2]
mov r9d, ebx
lea rcx, [rax + 2]
cmovne rcx, rax
cmp r8w, 0x2f
jne 0x140003fbc
add rcx, 2
cmp word [rcx], 0x53
jne 0x140003f93
test word [rcx + 2], r10w
mov eax, dword [0x14002ab60]
cmove eax, r13d
mov dword [0x14002ab60], eax
movabs rax, 0x4300520043004e
cmp qword [rcx], rax
jne 0x140003fac
test word [rcx + 8], r10w
jne 0x140003fac
or ebp, 4
movabs rax, 0x3d0044002f0020
cmp qword [rcx - 4], rax
je 0x140003fda
movzx edx, r9w
call fcn.14000742c
movzx edx, word [rax]
cmp dx, bx
jne 0x140003f32
add rax, 2
jmp 0x140003f2f
mov word [rcx - 4], r15w
lea rdx, [rcx + 4]
lea rcx, [0x140036800]
call fcn.140007afc
lea r12, [0x140038800]
mov ecx, 0x400
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
call fcn.14000435c
test rax, rax
jne 0x140004080
mov edx, 0x3fb
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea rdx, str.Temp
mov rcx, r12
call sub.KERNEL32.dll_lstrcatW
call fcn.14000435c
test rax, rax
jne 0x140004080
mov rdx, r12
mov ecx, 0x3fc
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rdx, [0x140009898]
mov rcx, r12
call sub.KERNEL32.dll_lstrcatW
mov rdx, r12
lea rcx, str.TEMP
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rdx, r12
lea rcx, [0x1400098b0]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
call fcn.14000435c
test rax, rax
je 0x14000412a
lea rcx, [0x140038000]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, ebp
call fcn.140003a10
mov rdi, rax
test rax, rax
jne 0x14000412a
cmp dword [0x14002aa68], r15d
je 0x14000411b
lea rbp, [0x140036000]
xor edx, edx
mov rcx, rbp
call fcn.14000742c
mov rbx, rax
cmp rax, rbp
jb 0x1400040da
movabs rax, 0x3d003f005f0020
cmp qword [rbx], rax
je 0x1400040da
sub rbx, 2
cmp rbx, rbp
jae 0x1400040c2
lea rdi, str.Error_launching_installer
cmp rbx, rbp
jb 0x140004157
mov word [rbx], r15w
add rbx, 8
mov rcx, rbx
call fcn.140007470
test eax, eax
je 0x14000412a
mov rdx, rbx
lea rcx, [0x140036800]
call fcn.140007afc
mov rdx, rbx
lea rcx, [0x140037000]
call fcn.140007afc
mov rdi, r15
or dword [0x14002ab6c], 0xffffffff
call fcn.1400067c4
mov r14d, eax
call fcn.140003dac
call qword [sym.imp.ole32.dll_OleUninitialize]
test rdi, rdi
je 0x14000428f
mov edx, 0x200010
mov rcx, rdi
call fcn.140007a78
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.1400072e4
lea rdx, str.nsu
mov rcx, r12
mov ebx, eax
call sub.KERNEL32.dll_lstrcatW
test ebx, ebx
je 0x140004180
lea rdx, [0x1400098c4]
mov rcx, r12
call sub.KERNEL32.dll_lstrcatW
lea rdx, [0x1400098c8]
mov rcx, r12
call sub.KERNEL32.dll_lstrcatW
lea rdx, [0x140037800]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14000412a
mov rcx, r12
test ebx, ebx
je 0x1400041b1
call fcn.140006c50
jmp 0x1400041b6
call fcn.140006c2c
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cmp word [0x140036800], r15w
jne 0x1400041dc
lea rdx, [0x140037800]
lea rcx, [0x140036800]
call fcn.140007afc
mov rdx, rsi
lea rcx, [section..ndata]
call fcn.140007afc
mov dword [0x14002c800], 0x41
lea rsi, [0x140022a70]
mov ebx, 0x1a
mov rax, qword [0x14002aa78]
mov rcx, rsi
mov edx, dword [rax + 0x140]
call fcn.140006ce0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test rdi, rdi
je 0x140004273
mov r8d, r13d
lea rcx, [0x140039800]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x140004273
xor edx, edx
mov rcx, rsi
call fcn.1400070f8
mov rax, qword [0x14002aa78]
mov rcx, rsi
mov edx, dword [rax + 0x144]
call fcn.140006ce0
mov rcx, rsi
call fcn.140007538
test rax, rax
je 0x140004273
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, r15
add word [0x14002c800], r13w
sub rbx, r13
jne 0x140004201
xor edx, edx
mov rcx, r12
call fcn.1400070f8
jmp 0x14000412a
cmp dword [0x14002ab54], r15d
je 0x140004343
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x330]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400042ff
lea r8, [rsp + 0x34]
xor ecx, ecx
lea rdx, str.SeShutdownPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rsp + 0x330]
lea r8, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], r15
xor edx, edx
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x3c], 2
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov ecx, r13d
call fcn.1400077e4
mov ebx, 0x80040002
test rax, rax
je 0x140004328
mov r9d, 0x25
mov dword [rsp + 0x20], ebx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rax
test eax, eax
je 0x140004339
mov edx, ebx
mov ecx, 2
call qword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x140004343
mov ecx, 9
call fcn.140001610
cmp dword [0x14002ab6c], 0xffffffff
cmovne r14d, dword [0x14002ab6c]
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_ExitProcess]