Function at 0x404cfd
Capabilities:
Accept command line arguments
Check if file exists
Copy file
Create directory
Delete file
Get common file path
Get file attributes
Get file system object information
Set current directory
Set environment variable
Shutdown system
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x184
push ebx
push esi
mov eax, str.Error_writing_temporary_file._Make_sure_your_temp_folder_is_valid.
mov byte [esp + 0xf], 0x20
xor ebx, ebx
mov dword [esp + 0x14], eax
push edi
mov dword [esp + 0x14], ebx
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push 0x8001
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push ebx
call dword [sym.imp.ole32.dll_OleInitialize]
push 8
pop ecx
mov dword [0x792c84], eax
call fcn.00407f66
push ebx
push 0x160
mov dword [0x791fec], eax
lea eax, [esp + 0x38]
push eax
push ebx
push 0x409b03
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov edi, 0x400
push edi
push str.NSIS_Error
push 0x792000
call esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push edi
push eax
push 0x799000
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp byte [0x799000], 0x22
mov ecx, 0x799000
mov dword [0x791ff0], eax
jne 0x404dab
mov al, 0x22
mov ecx, 0x799001
jmp 0x404daf
mov al, byte [esp + 0x13]
mov dl, al
call fcn.00407571
push eax
call dword [sym.imp.USER32.dll_CharNextA]
mov dword [esp + 0x1c], eax
jmp 0x404e28
cmp cl, 0x20
jne 0x404dce
inc eax
cmp byte [eax], 0x20
je 0x404dc8
cmp byte [eax], 0x22
mov dl, 0x20
jne 0x404dd9
inc eax
add dl, 2
cmp byte [eax], 0x2f
jne 0x404e1b
inc eax
cmp byte [eax], 0x53
jne 0x404df7
mov cl, byte [eax + 1]
cmp cl, 0x20
je 0x404df0
test cl, cl
jne 0x404df7
or ebx, 2
mov dword [esp + 0x14], ebx
cmp dword [eax], 0x4352434e
jne 0x404e12
mov cl, byte [eax + 4]
cmp cl, 0x20
je 0x404e0b
test cl, cl
jne 0x404e12
or ebx, 4
mov dword [esp + 0x14], ebx
cmp dword [eax - 2], 0x3d442f20
je 0x404e30
mov ecx, eax
call fcn.00407571
cmp byte [eax], 0x22
jne 0x404e28
inc eax
mov cl, byte [eax]
test cl, cl
jne 0x404dc3
jmp 0x404e40
mov byte [eax - 2], 0
add eax, 2
push edi
push eax
push 0x799400
call esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0x79a400
push edi
call esi
call fcn.00404cc9
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
test eax, eax
jne 0x404ec2
push 0x3fb
push 0x79a400
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.Temp
push 0x79a400
call edi
call fcn.00404cc9
test eax, eax
jne 0x404ec2
push 0x79a400
push 0x3fc
call esi
push 0x409b18
mov esi, 0x79a400
push esi
call edi
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.TEMP
call esi
push 0x79a400
push 0x409b24
call esi
call fcn.00404cc9
test eax, eax
je 0x40536d
push 0x79a000
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, ebx
call fcn.00404057
mov esi, eax
mov dword [esp + 0x18], esi
test esi, esi
jne 0x40536d
cmp dword [0x792c20], eax
je 0x405053
xor dl, dl
mov ecx, 0x799000
call fcn.00407571
mov esi, eax
mov ecx, 0x799000
jmp 0x404f0c
cmp dword [esi], 0x3d3f5f20
je 0x404f10
dec esi
cmp esi, ecx
jae 0x404f03
mov eax, str.Error_launching_installer
mov dword [esp + 0x18], eax
cmp esi, ecx
jb 0x404f5c
mov byte [esi], 0
add esi, 4
mov ecx, esi
call fcn.00407627
test eax, eax
je 0x40536d
mov ebx, 0x400
push ebx
push esi
push 0x799400
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push ebx
push esi
push 0x799800
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
xor ebx, ebx
mov dword [esp + 0x18], ebx
jmp 0x405055
push str.nsu.tmp
mov esi, 0x79a400
push esi
call edi
mov edi, 0x799c00
push edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x40536d
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
cmp byte [0x799400], 0
jne 0x404fa8
push 0x400
push edi
push 0x799400
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push 0x400
push dword [esp + 0x20]
push section..ndata
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov ebx, dword [esp + 0x18]
mov edi, 0x78d1b0
push 0x41
pop eax
push 0x1a
mov word [0x794400], ax
pop esi
mov edx, dword [0x792c80]
mov ecx, edi
mov edx, dword [edx + 0x120]
call fcn.00407a7b
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test ebx, ebx
je 0x405031
push 1
push edi
push 0x79ac00
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x405031
xor edx, edx
mov ecx, edi
call fcn.00407952
mov edx, dword [0x792c80]
mov ecx, edi
mov edx, dword [edx + 0x124]
call fcn.00407a7b
mov ecx, edi
call fcn.004071f7
test eax, eax
je 0x405031
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
inc byte [0x794400]
dec esi
jne 0x404fd1
xor edx, edx
mov dword [esp + 0x18], ebx
mov ecx, 0x79a400
call fcn.00407952
mov ebx, dword [esp + 0x14]
jmp 0x40536d
xor ebx, ebx
or dword [0x792ccc], 0xffffffff
mov edi, dword [0x792c80]
push 6
pop ecx
call fcn.00407f66
test eax, eax
je 0x40507f
call eax
movzx edx, ax
mov ecx, 0x79a000
call fcn.004079f6
jmp 0x4050d0
push ebx
mov esi, 0x78d5c8
mov word [0x79a000], 0x7830
push esi
push ebx
mov edx, str.Control_PanelDesktopResourceLocale
mov byte [0x79a002], bl
mov ecx, 0x80000001
call fcn.00407980
cmp byte [0x78d5c8], 0
jne 0x4050c4
push ebx
push esi
push 0x409c0a
mov edx, str..DEFAULTControl_PanelInternational
mov ecx, 0x80000003
call fcn.00407980
push esi
push 0x79a000
call dword [sym.imp.KERNEL32.dll_lstrcatA]
call fcn.0040563a
mov eax, dword [0x792800]
mov ecx, 0x799400
and eax, 0x20
mov dword [0x792cbc], 0x10000
mov dword [0x792ca0], eax
call fcn.00407627
test eax, eax
jne 0x405194
mov edx, dword [edi + 0x48]
test edx, edx
je 0x405194
mov eax, dword [edi + 0x4c]
mov esi, 0x7917c0
add eax, dword [0x792c58]
add edx, dword [0x792c58]
mov ecx, dword [edi + 0x44]
push ebx
push esi
push eax
call fcn.00407980
mov al, byte [0x7917c0]
test al, al
je 0x405194
cmp al, 0x22
jne 0x405145
mov esi, 0x7917c1
mov dl, al
mov ecx, esi
call fcn.00407571
mov byte [eax], bl
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 0xfffffffc
add eax, esi
cmp eax, esi
jbe 0x40517c
push str..exe
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x40517c
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x405175
test al, 0x10
jne 0x40517c
mov ecx, esi
call fcn.0040758d
mov ecx, esi
call fcn.00407548
push 0x400
push eax
push 0x799400
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov ecx, 0x799400
call fcn.00407627
test eax, eax
jne 0x4051b2
mov edx, dword [edi + 0x118]
mov ecx, 0x799400
call fcn.00407a7b
test byte [0x792800], 0x10
je 0x4051d3
cmp dword [0x792c20], 0
jne 0x4051d3
call fcn.00405611
mov dword [0x791fc0], 1
push 0x8040
push ebx
push ebx
push 1
push 0x67
push dword [0x791ff0]
call dword [sym.imp.USER32.dll_LoadImageA]
cmp dword [edi + 0x50], 0xffffffff
mov edi, dword [sym.imp.USER32.dll_RegisterClassA]
mov dword [0x791fd0], eax
je 0x40527a
mov ecx, dword [0x791ff0]
mov esi, 0x409b5c
push 0x790b80
mov dword [0x790b84], 0x401cff
mov dword [0x790b90], ecx
mov dword [0x790b94], eax
mov dword [0x790ba4], esi
call edi
test ax, ax
je 0x405365
push ebx
lea eax, [esp + 0x24]
push eax
push ebx
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
mov eax, dword [esp + 0x2c]
sub eax, dword [esp + 0x24]
push ebx
push dword [0x791ff0]
push ebx
push ebx
push eax
mov eax, dword [esp + 0x3c]
sub eax, dword [esp + 0x34]
push eax
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push 0x80000000
push ebx
push esi
push 0x80
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x78d5c4], eax
xor ecx, ecx
call fcn.0040213a
test eax, eax
je 0x40528d
push 2
pop ebx
jmp 0x405365
call fcn.0040563a
cmp dword [0x792cc0], 0
jne 0x405339
push 5
push dword [0x78d5c4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.RichEd20
call esi
test eax, eax
jne 0x4052c5
push str.RichEd32
call esi
mov esi, dword [sym.imp.USER32.dll_GetClassInfoA]
push 0x790b80
push str.RichEdit20A
push ebx
call esi
test eax, eax
jne 0x4052fa
push 0x790b80
push str.RichEdit
push ebx
call esi
push 0x790b80
mov dword [0x790ba4], 0x409c9c
call edi
mov eax, dword [0x791fc8]
push ebx
push 0x405779
add eax, 0x69
push ebx
movzx eax, ax
push eax
push dword [0x791ff0]
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 5
pop ecx
mov ebx, eax
call fcn.0040213a
mov esi, dword [0x40b0b0]
jmp 0x405333
push 1
call dword [esi + 4]
mov esi, dword [esi]
pop ecx
test esi, esi
jne 0x40532b
jmp 0x405365
push ebx
call fcn.00406db5
test eax, eax
je 0x40535d
cmp dword [0x791fdc], 0
jne 0x405285
push 2
pop ecx
call fcn.0040213a
jmp 0x405285
xor ecx, ecx
inc ecx
call fcn.0040213a
xor ecx, ecx
inc ecx
call fcn.00407d94
mov eax, dword [0x40b018]
cmp eax, 0xffffffff
je 0x405385
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [0x40b018], 0xffffffff
mov edi, dword [0x40b0b0]
mov esi, edi
test edi, edi
je 0x4053b5
push 0
call dword [esi + 4]
mov esi, dword [esi]
pop ecx
test esi, esi
jne 0x405391
mov esi, edi
mov edi, dword [edi]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
test edi, edi
jne 0x40539d
and dword [0x40b0b0], 0
mov ecx, 0x79a800
push 7
pop edx
call fcn.004072f2
call dword [sym.imp.ole32.dll_OleUninitialize]
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4053eb
mov edx, 0x200010
mov ecx, eax
call fcn.0040724c
push 2
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x792cb4], 0
je 0x405482
push 3
pop ecx
call fcn.00407f66
push 4
pop ecx
mov dword [esp + 0x14], eax
call fcn.00407f66
push 5
pop ecx
mov esi, eax
call fcn.00407f66
cmp dword [esp + 0x14], 0
mov edi, eax
je 0x40546c
test esi, esi
je 0x40546c
test edi, edi
je 0x40546c
lea eax, [esp + 0x1c]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [esp + 0x20]
test eax, eax
je 0x40546c
lea eax, [esp + 0x24]
push eax
push str.SeShutdownPrivilege
push 0
call esi
xor ecx, ecx
mov dword [esp + 0x20], 1
push ecx
push ecx
push ecx
lea eax, [esp + 0x2c]
mov dword [esp + 0x38], 2
push eax
push ecx
push dword [esp + 0x30]
call edi
push 0
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x405482
push 9
pop ecx
call fcn.0040213a
cmp dword [0x792ccc], 0xffffffff
cmovne ebx, dword [0x792ccc]
push ebx
jmp 0x4053e5