Function at 0x403871
Capabilities:
Accept command line arguments
Check os version
Delete file
Get common file path
Get file system object information
Set environment variable
Shutdown system
Terminate process

Disassembly:
sub esp, 0x3e8
push ebx
push ebp
push esi
push edi
xor ebp, ebp
xor ebx, ebx
push 0x8001
mov edi, str.Error_writing_temporary_file._Make_sure_your_temp_folder_is_valid.
mov dword [esp + 0x18], ebp
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
and dword [esp + 0x3c], ebx
lea eax, [esp + 0x28]
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
xorps xmm0, xmm0
push eax
movlpd qword [esp + 0x140], xmm0
mov dword [esp + 0x2c], 0x11c
call esi
test eax, eax
jne 0x4038f3
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 0x114
push eax
call esi
push 0x53
pop eax
mov dl, 4
mov byte [esp + 0x142], dl
cmp word [esp + 0x3c], ax
jne 0x4038ef
mov eax, dword [esp + 0x56]
add eax, 0xffffffd0
mov word [esp + 0x13c], ax
jmp 0x4038fa
xor eax, eax
jmp 0x4038e5
mov dl, byte [esp + 0x142]
cmp dword [esp + 0x2c], 0xa
jae 0x40390c
movzx eax, word [esp + 0x34]
mov dword [esp + 0x34], eax
jmp 0x403910
mov eax, dword [esp + 0x34]
mov dword [0x435318], eax
movzx eax, byte [esp + 0x2c]
shl ax, 8
movzx ecx, ax
movzx eax, byte [esp + 0x30]
or ecx, eax
movzx eax, byte [esp + 0x13c]
shl ax, 8
shl ecx, 0x10
movzx eax, ax
or ecx, eax
movzx eax, dl
or ecx, eax
mov eax, 0x600
mov dword [0x43531c], ecx
sar ecx, 0x10
cmp cx, ax
je 0x403966
push 0
call fcn.004068bb
test eax, eax
je 0x403966
push 0xc00
call eax
mov esi, str.UXTHEME
push esi
call fcn.00406173
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc esi
add esi, eax
cmp byte [esi], bl
jne 0x40396b
push 0xc
call fcn.004068bb
push 0xa
call fcn.004068bb
push 8
mov dword [0x434210], eax
call fcn.004068bb
test eax, eax
je 0x4039ac
push 0x1e
call eax
test eax, eax
je 0x4039ac
or byte [0x43531c], 0x80
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
xor esi, esi
push esi
call dword [sym.imp.ole32.dll_OleInitialize]
push esi
push 0x2b4
mov dword [0x435280], eax
lea eax, [esp + 0x14c]
push eax
push esi
push 0x4095cc
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push str.NSIS_Error
push 0x434220
call fcn.00406aef
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
mov esi, 0x440000
push esi
call fcn.00406aef
movzx ecx, word [0x440000]
push 0x22
pop eax
push 0x20
pop edx
cmp cx, ax
mov dword [esp + 0x10], eax
mov dword [0x434214], 0x400000
cmovne eax, edx
movzx eax, ax
push eax
push 0x22
pop edx
cmp cx, dx
mov eax, 0x440002
cmove esi, eax
push esi
call fcn.004065cb
push eax
call dword [sym.imp.USER32.dll_CharNextW]
mov ecx, eax
movzx eax, word [ecx]
test ax, ax
je 0x403b25
mov edx, eax
push 0x20
pop ebp
movzx eax, dx
cmp dx, bp
jne 0x403a61
add ecx, 2
movzx eax, word [ecx]
cmp ax, bp
je 0x403a56
movzx esi, ax
movzx edx, ax
cmp ax, word [esp + 0x10]
jne 0x403a77
movzx edx, word [ecx + 2]
push 0x22
pop eax
mov ebp, eax
cmp si, word [esp + 0x10]
lea eax, [ecx + 2]
cmovne eax, ecx
cmp dx, 0x2f
jne 0x403ae3
push 0x53
add eax, 2
pop ecx
push 0x20
pop edx
cmp word [eax], cx
jne 0x403aae
movzx ecx, word [eax + 2]
cmp cx, dx
je 0x403aa4
test cx, cx
jne 0x403aae
mov dword [0x435300], 1
cmp dword [eax], 0x43004e
jne 0x403ad2
cmp dword [eax + 4], 0x430052
jne 0x403ad2
movzx ecx, word [eax + 8]
cmp cx, dx
je 0x403acd
test cx, cx
jne 0x403ad2
or dword [esp + 0x14], 4
cmp dword [eax - 4], 0x2f0020
jne 0x403ae3
cmp dword [eax], 0x3d0044
je 0x403b0d
push ebp
push eax
call fcn.004065cb
mov ecx, eax
push 0x22
pop edx
movzx eax, word [ecx]
mov esi, eax
cmp ax, dx
jne 0x403aff
add ecx, 2
movzx esi, word [ecx]
movzx edx, si
test si, si
jne 0x403a4b
jmp 0x403b21
xor ecx, ecx
mov word [eax - 4], cx
add eax, 4
push eax
push 0x440800
call fcn.00406aef
mov ebp, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x442800
push 0x400
call esi
call fcn.00403c89
test eax, eax
jne 0x403ba7
push 0x3fb
push 0x442800
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.Temp
push 0x442800
call sub.KERNEL32.dll_lstrcatW
call fcn.00403c89
test eax, eax
jne 0x403ba7
push 0x442800
push 0x3fc
call esi
push 0x4095f4
mov esi, 0x442800
push esi
call sub.KERNEL32.dll_lstrcatW
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push str.TEMP
call esi
push 0x442800
push 0x409608
call esi
call fcn.00403c89
test eax, eax
je 0x403bcc
push 0x442000
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebp
call fcn.004034d7
mov edi, eax
test edi, edi
jne 0x403bcc
or dword [0x43530c], 0xffffffff
call fcn.00405a22
mov ebx, eax
call fcn.0040382f
call dword [sym.imp.ole32.dll_OleUninitialize]
test edi, edi
je 0x403bee
push 0x200010
push edi
call fcn.00406a7d
push 2
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x4352f4], 0
je 0x403c75
lea eax, [esp + 0x10]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
xor ebp, ebp
test eax, eax
je 0x403c45
lea eax, [esp + 0x1c]
push eax
push str.SeShutdownPrivilege
push ebp
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push ebp
push ebp
push ebp
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 1
push eax
push ebp
push dword [esp + 0x24]
mov dword [esp + 0x3c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 4
call fcn.004068bb
mov esi, 0x80040002
test eax, eax
je 0x403c61
push esi
push 0x25
push ebp
push ebp
push ebp
call eax
test eax, eax
je 0x403c6e
push esi
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x403c75
push 9
call fcn.00401533
cmp dword [0x43530c], 0xffffffff
cmovne ebx, dword [0x43530c]
push ebx
jmp 0x403be8