Function at 0x140004268
Capabilities:
Accept command line arguments
Copy file
Delete file
Get common file path
Get file attributes
Get file system object information
Set current directory
Set environment variable
Shutdown system
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x438
mov ecx, 0x8001
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
lea rsi, [rsp + 0x318]
mov dword [rsi], 0x11c
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [rsi + 0xc]
mov r12, qword [0x14000b2b8]
mov dword [r12 + 0x38], eax
movzx eax, byte [rsi + 0x11a]
mov ecx, dword [rsi + 0x114]
shl ecx, 8
movzx ecx, cx
or ecx, eax
mov eax, dword [rsi + 4]
mov edx, dword [rsi + 8]
shl eax, 0x18
movzx edx, dl
shl edx, 0x10
or edx, eax
or ecx, edx
mov dword [r12 + 0x3c], ecx
cmp edx, 0x6000000
je 0x1400042f4
xor ecx, ecx
call fcn.1400074fa
test rax, rax
je 0x1400042f4
mov ecx, 0xc00
call rax
lea rsi, str.UXTHEME
mov rdi, qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, rsi
call fcn.1400085b6
mov rcx, rsi
call rdi
cdqe
add rsi, rax
inc rsi
cmp byte [rsi], 0
jne 0x140004302
mov ecx, 8
call fcn.1400074fa
mov ecx, 6
call fcn.1400074fa
mov qword [0x1400386c0], rax
call qword [sym.imp.COMCTL32.dll_InitCommonControls]
xor r14d, r14d
xor ecx, ecx
call qword [sym.imp.ole32.dll_OleInitialize]
mov rcx, qword [0x14000b460]
mov dword [rcx], eax
mov dword [rsp + 0x20], 0
lea rcx, [0x14000b3a2]
lea r8, [rsp + 0x60]
xor edx, edx
mov r9d, 0x2b8
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea rcx, [0x1400386d0]
lea rdx, str.NSIS_Error
call fcn.140007a2e
mov rax, qword [0x14000b058]
mov r13, qword [rax]
lea rbx, [r13 + 0xa000]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rbx
mov rdx, rax
call fcn.140007a2e
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [0x1400396d0], rax
lea rcx, [r13 + 0xa002]
xor eax, eax
cmp word [r13 + 0xa000], 0x22
sete al
cmovne rcx, rbx
lea edx, [rax + rax]
add edx, 0x20
call fcn.140007b14
mov rcx, rax
call qword [sym.imp.USER32.dll_CharNextW]
mov r15, rax
movzx ecx, word [rax]
test cx, cx
je 0x1400044b9
xor r14d, r14d
movabs rsi, 0x4300520043004e
movabs rdi, 0x3d0044002f0020
mov rax, r15
add rax, 2
cmp cx, 0x20
jne 0x14000441c
movzx ecx, word [rax]
jmp 0x14000440d
movzx edx, cx
cmp edx, 0x22
jne 0x14000442d
movzx ecx, word [rax]
mov dx, 0x22
jmp 0x140004435
add rax, 0xfffffffffffffffe
mov dx, 0x20
cmp cx, 0x2f
jne 0x14000447d
lea rcx, [rax + 2]
cmp word [rax + 2], 0x53
jne 0x14000445d
movzx r8d, word [rax + 4]
test r8d, 0xffdf
jne 0x14000445d
mov dword [r12 + 0x20], 1
cmp qword [rcx], rsi
jne 0x140004474
movzx r8d, word [rax + 0xa]
test r8d, 0xffdf
jne 0x140004474
or r14d, 4
cmp qword [rax - 2], rdi
je 0x1400044a0
mov rax, rcx
mov rcx, rax
call fcn.140007b14
xor ecx, ecx
cmp word [rax], 0x22
sete cl
lea rax, [rax + rcx*2]
movzx ecx, word [rax]
test cx, cx
jne 0x14000440d
jmp 0x1400044b9
mov word [rax - 2], 0
lea rcx, [r13 + 0xa800]
add rax, 6
mov rdx, rax
call fcn.140007a2e
lea rdi, [r13 + 0xc800]
mov ecx, 0x400
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
call fcn.14000420c
test rax, rax
jne 0x140004550
mov rcx, rdi
mov edx, 0x3fb
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea rdx, str.Temp
mov rcx, rdi
call sub.KERNEL32.dll_lstrcatW
call fcn.14000420c
test rax, rax
jne 0x140004550
mov ecx, 0x3fc
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rdx, [0x14000b3c6]
mov rcx, rdi
call sub.KERNEL32.dll_lstrcatW
lea rcx, str.TEMP
mov rsi, qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rdx, rdi
call rsi
lea rcx, [0x14000b3d8]
mov rdx, rdi
call rsi
call fcn.14000420c
test rax, rax
jne 0x140004550
xor ebp, ebp
lea rsi, str.Error_writing_temporary_file._Make_sure_your_temp_folder_is_valid.
jmp 0x140004593
lea rcx, [r13 + 0xc000]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, r14d
call fcn.140003be6
test rax, rax
jne 0x14000458e
mov rax, qword [0x14000b468]
cmp dword [rax], 0
jne 0x140004685
mov dword [r12 + 0x2c], 0xffffffff
xor esi, esi
call fcn.140004a38
mov ebp, eax
jmp 0x140004593
mov rsi, rax
xor ebp, ebp
call fcn.1400048e7
call qword [sym.imp.ole32.dll_OleUninitialize]
test rsi, rsi
jne 0x14000466d
cmp dword [r12 + 0x14], 0
je 0x14000465a
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x58]
mov rcx, rax
mov edx, 0x28
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140004612
lea rsi, [rsp + 0x64]
lea rdx, str.SeShutdownPrivilege
xor ecx, ecx
mov r8, rsi
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov dword [rsi - 4], 1
mov dword [rsi + 8], 2
mov rcx, qword [rsp + 0x58]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
lea r8, [rsp + 0x60]
xor edx, edx
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov ecx, 1
call fcn.1400074fa
test rax, rax
je 0x14000463c
mov dword [rsp + 0x20], 0x80040002
xor ecx, ecx
xor edx, edx
xor r8d, r8d
mov r9d, 0x25
call rax
test eax, eax
je 0x140004650
mov ecx, 2
mov edx, 0x80040002
call qword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x14000465a
mov ecx, 9
call fcn.140003804
mov eax, dword [r12 + 0x2c]
cmp eax, 0xffffffff
cmovne ebp, eax
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, rsi
mov edx, 0x200010
call fcn.1400075f2
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, rbx
xor edx, edx
call fcn.140007b14
cmp rax, rbx
jb 0x1400046b3
mov rsi, rax
movabs rax, 0x3d003f005f0020
cmp qword [rsi], rax
je 0x140004872
add rsi, 0xfffffffffffffffe
cmp rsi, rbx
jae 0x1400046a1
call fcn.1400074d3
mov r12d, eax
mov rcx, rdi
call sub.KERNEL32.dll_lstrlenW
movsxd rsi, eax
mov rcx, r13
mov rdx, r15
call fcn.140007a2e
cmp word [r13 + 0xa800], 0
jne 0x1400046ef
lea rcx, [r13 + 0xa800]
lea rdx, [r13 + 0xb800]
call fcn.140007a2e
lea r14, [r13 + 0x2800]
lea rax, [r13 + 0x3000]
mov qword [rsp + 0x48], rax
mov rax, r13
lea r13, [rdi + rsi*2]
add rax, 0xd800
mov qword [rsp + 0x50], rax
mov r15d, 1
lea rbx, str.nsu_X.tmp
mov rbp, qword [sym.imp.USER32.dll_wsprintfW]
mov qword [rsp + 0x40], r13
mov sil, 1
mov dword [rsp + 0x3c], r15d
mov rcx, r13
mov rdx, rbx
mov r8d, r15d
call rbp
mov rax, qword [0x14000b008]
mov rax, qword [rax]
mov edx, dword [rax + 0x140]
mov rcx, r14
call fcn.14000827a
mov rcx, rdi
test r12d, r12d
je 0x140004767
call fcn.140007450
jmp 0x14000476c
call fcn.1400074b1
test eax, eax
je 0x1400047b1
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
bt eax, 0xa
jb 0x140004857
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x140004857
mov rcx, rdi
mov edx, 1
call fcn.1400076f6
test sil, 1
mov esi, 0
jne 0x140004735
jmp 0x140004857
mov r13, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
xor ebp, ebp
mov r15, rdi
mov rcx, rdi
xor edx, edx
call fcn.140007a88
mov rcx, qword [rsp + 0x50]
mov rdx, r14
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x140004869
mov ebp, r12d
mov rdi, r14
mov rcx, r14
xor edx, edx
call fcn.140007a88
mov rax, qword [0x14000b008]
mov rax, qword [rax]
mov edx, dword [rax + 0x144]
mov r12, qword [rsp + 0x48]
mov rcx, r12
call fcn.14000827a
mov rcx, r12
call fcn.14000754d
test rax, rax
jne 0x140004895
test sil, 1
je 0x1400048ae
mov r14, rdi
mov rcx, rdi
call fcn.140007aa7
xor esi, esi
test rax, rax
mov r12d, ebp
mov rbp, r13
mov r13, qword [rsp + 0x40]
mov rdi, r15
mov r15d, dword [rsp + 0x3c]
je 0x140004735
jmp 0x140004867
inc r15d
cmp r15d, 0x10000
jne 0x14000472d
xor ebp, ebp
mov r12, qword [0x14000b2b8]
jmp 0x140004889
mov word [rsi], 0
add rsi, 8
mov rcx, rsi
call fcn.14000795e
test eax, eax
jne 0x1400048c1
xor ebp, ebp
lea rsi, str.Error_launching_installer
jmp 0x140004593
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
xor ebp, ebp
mov r12, qword [0x14000b2b8]
jmp 0x140004593
mov r12, qword [0x14000b2b8]
lea rsi, str.Error_launching_installer
jmp 0x140004591
lea rcx, [r13 + 0xa800]
mov rdx, rsi
call fcn.140007a2e
add r13, 0xb000
mov rcx, r13
mov rdx, rsi
call fcn.140007a2e
jmp 0x14000457a