Function at 0x403848
Capabilities:
Accept command line arguments
Check os version
Delete file
Get common file path
Get file system object information
Set environment variable
Shutdown system
Terminate process

Disassembly:
sub esp, 0x3e8
push ebx
push ebp
push esi
push edi
xor ebp, ebp
xor ebx, ebx
push 0x8001
mov edi, str.Error_writing_temporary_file._Make_sure_your_temp_folder_is_valid.
mov dword [esp + 0x18], ebp
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
and dword [esp + 0x3c], ebx
lea eax, [esp + 0x28]
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
xorps xmm0, xmm0
push eax
movlpd qword [esp + 0x140], xmm0
mov dword [esp + 0x2c], 0x11c
call esi
test eax, eax
jne 0x4038ca
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 0x114
push eax
call esi
push 0x53
pop eax
mov dl, 4
mov byte [esp + 0x142], dl
cmp word [esp + 0x3c], ax
jne 0x4038c6
mov eax, dword [esp + 0x56]
add eax, 0xffffffd0
mov word [esp + 0x13c], ax
jmp 0x4038d1
xor eax, eax
jmp 0x4038bc
mov dl, byte [esp + 0x142]
cmp dword [esp + 0x2c], 0xa
jae 0x4038e3
movzx eax, word [esp + 0x34]
mov dword [esp + 0x34], eax
jmp 0x4038e7
mov eax, dword [esp + 0x34]
mov dword [0x7a7e78], eax
movzx eax, byte [esp + 0x2c]
shl ax, 8
movzx ecx, ax
movzx eax, byte [esp + 0x30]
or ecx, eax
movzx eax, byte [esp + 0x13c]
shl ax, 8
shl ecx, 0x10
movzx eax, ax
or ecx, eax
movzx eax, dl
or ecx, eax
mov eax, 0x600
mov dword [0x7a7e7c], ecx
sar ecx, 0x10
cmp cx, ax
je 0x40393d
push 0
call fcn.00406892
test eax, eax
je 0x40393d
push 0xc00
call eax
mov esi, str.UXTHEME
push esi
call fcn.0040614a
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc esi
add esi, eax
cmp byte [esi], bl
jne 0x403942
push 0xc
call fcn.00406892
push 0xa
call fcn.00406892
push 8
mov dword [0x7a6d70], eax
call fcn.00406892
test eax, eax
je 0x403983
push 0x1e
call eax
test eax, eax
je 0x403983
or byte [0x7a7e7c], 0x80
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
xor esi, esi
push esi
call dword [sym.imp.ole32.dll_OleInitialize]
push esi
push 0x2b4
mov dword [0x7a7de0], eax
lea eax, [esp + 0x14c]
push eax
push esi
push 0x4085cc
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push str.NSIS_Error
push 0x7a6d80
call fcn.00406ac6
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
mov esi, 0x7b2000
push esi
call fcn.00406ac6
movzx ecx, word [0x7b2000]
push 0x22
pop eax
push 0x20
pop edx
cmp cx, ax
mov dword [esp + 0x10], eax
mov dword [0x7a6d74], 0x400000
cmovne eax, edx
movzx eax, ax
push eax
push 0x22
pop edx
cmp cx, dx
mov eax, 0x7b2002
cmove esi, eax
push esi
call fcn.004065a2
push eax
call dword [sym.imp.USER32.dll_CharNextW]
mov ecx, eax
movzx eax, word [ecx]
test ax, ax
je 0x403afc
mov edx, eax
push 0x20
pop ebp
movzx eax, dx
cmp dx, bp
jne 0x403a38
add ecx, 2
movzx eax, word [ecx]
cmp ax, bp
je 0x403a2d
movzx esi, ax
movzx edx, ax
cmp ax, word [esp + 0x10]
jne 0x403a4e
movzx edx, word [ecx + 2]
push 0x22
pop eax
mov ebp, eax
cmp si, word [esp + 0x10]
lea eax, [ecx + 2]
cmovne eax, ecx
cmp dx, 0x2f
jne 0x403aba
push 0x53
add eax, 2
pop ecx
push 0x20
pop edx
cmp word [eax], cx
jne 0x403a85
movzx ecx, word [eax + 2]
cmp cx, dx
je 0x403a7b
test cx, cx
jne 0x403a85
mov dword [0x7a7e60], 1
cmp dword [eax], 0x43004e
jne 0x403aa9
cmp dword [eax + 4], 0x430052
jne 0x403aa9
movzx ecx, word [eax + 8]
cmp cx, dx
je 0x403aa4
test cx, cx
jne 0x403aa9
or dword [esp + 0x14], 4
cmp dword [eax - 4], 0x2f0020
jne 0x403aba
cmp dword [eax], 0x3d0044
je 0x403ae4
push ebp
push eax
call fcn.004065a2
mov ecx, eax
push 0x22
pop edx
movzx eax, word [ecx]
mov esi, eax
cmp ax, dx
jne 0x403ad6
add ecx, 2
movzx esi, word [ecx]
movzx edx, si
test si, si
jne 0x403a22
jmp 0x403af8
xor ecx, ecx
mov word [eax - 4], cx
add eax, 4
push eax
push 0x7b2800
call fcn.00406ac6
mov ebp, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x7b4800
push 0x400
call esi
call fcn.00403c60
test eax, eax
jne 0x403b7e
push 0x3fb
push 0x7b4800
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.Temp
push 0x7b4800
call sub.KERNEL32.dll_lstrcatW
call fcn.00403c60
test eax, eax
jne 0x403b7e
push 0x7b4800
push 0x3fc
call esi
push 0x4085f4
mov esi, 0x7b4800
push esi
call sub.KERNEL32.dll_lstrcatW
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push str.TEMP
call esi
push 0x7b4800
push 0x408608
call esi
call fcn.00403c60
test eax, eax
je 0x403ba3
push 0x7b4000
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebp
call fcn.004034cf
mov edi, eax
test edi, edi
jne 0x403ba3
or dword [0x7a7e6c], 0xffffffff
call fcn.004059f9
mov ebx, eax
call fcn.00403806
call dword [sym.imp.ole32.dll_OleUninitialize]
test edi, edi
je 0x403bc5
push 0x200010
push edi
call fcn.00406a54
push 2
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x7a7e54], 0
je 0x403c4c
lea eax, [esp + 0x10]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
xor ebp, ebp
test eax, eax
je 0x403c1c
lea eax, [esp + 0x1c]
push eax
push str.SeShutdownPrivilege
push ebp
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push ebp
push ebp
push ebp
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 1
push eax
push ebp
push dword [esp + 0x24]
mov dword [esp + 0x3c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 4
call fcn.00406892
mov esi, 0x80040002
test eax, eax
je 0x403c38
push esi
push 0x25
push ebp
push ebp
push ebp
call eax
test eax, eax
je 0x403c45
push esi
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x403c4c
push 9
call fcn.00401533
cmp dword [0x7a7e6c], 0xffffffff
cmovne ebx, dword [0x7a7e6c]
push ebx
jmp 0x403bbf