Function at 0x403e7c
Capabilities:
Accept command line arguments
Check if file exists
Copy file
Create directory
Delete file
Get common file path
Get file attributes
Get file system object information
Set current directory
Set environment variable
Shutdown system
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x180
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], str.Error_writing_temporary_file._Make_sure_your_temp_folder_is_valid.
mov byte [esp + 0x18], 0x20
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push 0x8001
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push ebx
call dword [sym.imp.ole32.dll_OleInitialize]
push 8
mov dword [0x793058], eax
pop eax
call fcn.00406f79
push ebx
push 0x160
mov dword [0x792b40], eax
lea eax, [esp + 0x38]
push eax
push ebx
push 0x409af3
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
push str.NSIS_Error
push 0x792340
call fcn.00406a77
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
mov ebp, 0x79a000
push ebp
call fcn.00406a77
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp byte [0x79a000], 0x22
mov dword [0x792b48], eax
mov eax, ebp
jne 0x403f22
mov byte [esp + 0x18], 0x22
mov eax, 0x79a001
push dword [esp + 0x18]
call fcn.00406578
push eax
call dword [sym.imp.USER32.dll_CharNextA]
mov dword [esp + 0x1c], eax
jmp 0x403fa0
cmp cl, 0x20
jne 0x403f43
inc eax
cmp byte [eax], 0x20
je 0x403f3d
cmp byte [eax], 0x22
mov byte [esp + 0x18], 0x20
jne 0x403f53
inc eax
mov byte [esp + 0x18], 0x22
cmp byte [eax], 0x2f
jne 0x403f91
inc eax
cmp byte [eax], 0x53
jne 0x403f6f
mov cl, byte [eax + 1]
cmp cl, 0x20
je 0x403f6a
cmp cl, bl
jne 0x403f6f
or dword [esp + 0x10], 2
cmp dword [eax], 0x4352434e
jne 0x403f88
mov cl, byte [eax + 4]
cmp cl, 0x20
je 0x403f83
cmp cl, bl
jne 0x403f88
or dword [esp + 0x10], 4
cmp dword [eax - 2], 0x3d442f20
je 0x403fa8
push dword [esp + 0x18]
call fcn.00406578
cmp byte [eax], 0x22
jne 0x403fa0
inc eax
mov cl, byte [eax]
cmp cl, bl
jne 0x403f38
jmp 0x403fb9
mov byte [eax - 2], bl
add eax, 2
push eax
push 0x79a400
call fcn.00406a77
mov edi, dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov esi, 0x79b400
push esi
push 0x400
call edi
call fcn.00403e46
test eax, eax
jne 0x40402d
push 0x3fb
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.Temp
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
call fcn.00403e46
test eax, eax
jne 0x40402d
push esi
push 0x3fc
call edi
push 0x409b08
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov edi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push esi
push str.TEMP
call edi
push esi
push 0x409b14
call edi
call fcn.00403e46
test eax, eax
je 0x404483
push 0x79b000
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [esp + 0x10]
call fcn.00403283
mov dword [esp + 0x14], eax
cmp eax, ebx
jne 0x404483
cmp dword [0x792ba4], ebx
je 0x404185
push ebx
mov eax, ebp
call fcn.00406578
mov edi, eax
jmp 0x40406e
cmp dword [edi], 0x3d3f5f20
je 0x404072
dec edi
cmp edi, ebp
jae 0x404065
mov dword [esp + 0x14], str.Error_launching_installer
cmp edi, ebp
jb 0x4040b1
mov byte [edi], bl
add edi, 4
push edi
call fcn.0040661e
test eax, eax
je 0x404483
push edi
mov ebp, 0x79a400
push ebp
call fcn.00406a77
push edi
push 0x79a800
call fcn.00406a77
mov dword [esp + 0x14], ebx
jmp 0x40418a
push str.nsu.tmp
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov edi, 0x79ac00
push edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x404483
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
cmp byte [0x79a400], bl
jne 0x4040f4
push edi
push 0x79a400
call fcn.00406a77
push dword [esp + 0x1c]
push section..ndata
call fcn.00406a77
push 0x41
pop eax
push 0x1a
mov word [0x795400], ax
pop ebp
mov edi, 0x78d1b8
mov eax, dword [0x792b4c]
push dword [eax + 0x120]
push edi
call fcn.00406a8d
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [esp + 0x14], ebx
je 0x404170
push 1
push edi
push 0x79bc00
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x404170
push ebx
push edi
call fcn.00406937
mov eax, dword [0x792b4c]
push dword [eax + 0x124]
push edi
call fcn.00406a8d
push edi
call fcn.00406235
cmp eax, ebx
je 0x404170
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x14], ebx
inc byte [0x795400]
dec ebp
jne 0x404113
push ebx
push esi
call fcn.00406937
jmp 0x404483
mov ebp, 0x79a400
or dword [0x79304c], 0xffffffff
mov edi, dword [0x792b4c]
push 6
pop eax
call fcn.00406f79
cmp eax, ebx
je 0x4041b5
call eax
movzx eax, ax
push eax
push 0x79b000
call fcn.004069da
jmp 0x40420a
push ebx
push str.Control_PanelDesktopResourceLocale
push 0x80000001
xor eax, eax
mov esi, 0x78e5d8
mov byte [0x79b000], 0x30
mov byte [0x79b001], 0x78
mov byte [0x79b002], bl
call fcn.0040696a
cmp byte [0x78e5d8], bl
jne 0x4041fe
push 0x409b62
push str..DEFAULTControl_PanelInternational
push 0x80000003
xor eax, eax
call fcn.0040696a
push esi
push 0x79b000
call dword [sym.imp.KERNEL32.dll_lstrcatA]
call fcn.00404770
mov eax, dword [0x792fc0]
and eax, 0x20
push ebp
mov dword [0x793020], eax
mov dword [0x79303c], 0x10000
call fcn.0040661e
test eax, eax
jne 0x4042b5
mov ecx, dword [edi + 0x48]
cmp ecx, ebx
je 0x4042b5
mov eax, dword [0x792b78]
mov edx, dword [edi + 0x4c]
add edx, eax
push edx
add ecx, eax
push ecx
push dword [edi + 0x44]
xor eax, eax
mov esi, 0x791700
call fcn.0040696a
mov al, byte [0x791700]
cmp al, bl
je 0x4042b5
cmp al, 0x22
jne 0x404275
mov eax, 0x791701
push 0x22
mov esi, eax
call fcn.00406578
mov byte [eax], bl
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [eax + esi - 4]
cmp eax, esi
jbe 0x4042a9
push str..exe
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4042a9
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4042a4
test al, 0x10
jne 0x4042a9
call fcn.00406590
call fcn.00406553
push eax
push ebp
call fcn.00406a77
push ebp
call fcn.0040661e
test eax, eax
jne 0x4042cb
push dword [edi + 0x118]
push ebp
call fcn.00406a8d
test byte [0x792fc0], 0x10
je 0x4042eb
cmp dword [0x792ba4], ebx
jne 0x4042eb
call fcn.0040474b
mov dword [0x790ee8], 1
push 0x8040
push ebx
push ebx
push 1
push 0x67
push dword [0x792b48]
call dword [sym.imp.USER32.dll_LoadImageA]
cmp dword [edi + 0x50], 0xffffffff
mov dword [0x792308], eax
mov esi, 0x790ec0
je 0x404391
mov ecx, dword [0x792b48]
mov edi, 0x409b9c
push esi
mov dword [0x790ec4], 0x401000
mov dword [0x790ed0], ecx
mov dword [0x790ed4], eax
mov dword [0x790ee4], edi
call dword [sym.imp.USER32.dll_RegisterClassA]
test ax, ax
je 0x404478
push ebx
lea eax, [esp + 0x24]
push eax
push ebx
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
mov eax, dword [esp + 0x2c]
sub eax, dword [esp + 0x24]
push ebx
push dword [0x792b48]
push ebx
push ebx
push eax
mov eax, dword [esp + 0x3c]
sub eax, dword [esp + 0x34]
push eax
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push 0x80000000
push ebx
push edi
push 0x80
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x78d5d4], eax
xor ecx, ecx
call fcn.0040149b
test eax, eax
je 0x4043a9
mov dword [esp + 0x10], 2
jmp 0x40447c
call fcn.00404770
cmp dword [0x793040], ebx
jne 0x40444d
push 5
push dword [0x78d5d4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.RichEd20
call edi
test eax, eax
jne 0x4043e0
push str.RichEd32
call edi
mov edi, dword [sym.imp.USER32.dll_GetClassInfoA]
push esi
mov ebp, 0x409bb8
push ebp
push ebx
call edi
test eax, eax
jne 0x40440a
push esi
push str.RichEdit
push ebx
call edi
push esi
mov dword [0x790ee4], ebp
call dword [sym.imp.USER32.dll_RegisterClassA]
mov eax, dword [0x792314]
push ebx
push 0x4048a4
add eax, 0x69
movzx eax, ax
push ebx
push eax
push dword [0x792b48]
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 5
pop ecx
mov edi, eax
call fcn.0040149b
mov esi, dword [0x790b78]
jmp 0x404443
push 1
call dword [esi + 4]
mov esi, dword [esi]
pop ecx
cmp esi, ebx
jne 0x40443b
mov dword [esp + 0x10], edi
jmp 0x40447c
push ebx
call fcn.00405dfc
test eax, eax
je 0x404470
cmp dword [0x79230c], ebx
jne 0x40439c
push 2
pop ecx
call fcn.0040149b
jmp 0x40439c
xor ecx, ecx
inc ecx
call fcn.0040149b
mov dword [esp + 0x10], ebx
push 1
call fcn.00406db1
mov eax, dword [0x40b08c]
cmp eax, 0xffffffff
je 0x40449b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [0x40b08c], 0xffffffff
mov esi, dword [0x790b78]
mov edi, esi
cmp esi, ebx
je 0x4044ca
push ebx
call dword [edi + 4]
mov edi, dword [edi]
pop ecx
cmp edi, ebx
jne 0x4044a7
mov edi, esi
push dword [edi + 8]
mov esi, dword [esi]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp esi, ebx
jne 0x4044b2
push 7
push 0x79b800
mov dword [0x790b78], ebx
call fcn.00406335
call dword [sym.imp.ole32.dll_OleUninitialize]
cmp dword [esp + 0x14], ebx
je 0x4044fe
push dword [esp + 0x14]
mov eax, 0x200010
call fcn.00406291
push 2
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x793034], ebx
je 0x404585
push 3
pop eax
call fcn.00406f79
push 4
mov ebp, eax
pop eax
call fcn.00406f79
push 5
mov esi, eax
pop eax
call fcn.00406f79
mov edi, eax
cmp ebp, ebx
je 0x404570
cmp esi, ebx
je 0x404570
cmp edi, ebx
je 0x404570
lea eax, [esp + 0x1c]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebp
test eax, eax
je 0x404570
lea eax, [esp + 0x24]
push eax
push str.SeShutdownPrivilege
push ebx
call esi
push ebx
push ebx
push ebx
lea eax, [esp + 0x2c]
push eax
push ebx
push dword [esp + 0x30]
mov dword [esp + 0x38], 1
mov dword [esp + 0x44], 2
call edi
push ebx
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x404585
push 9
pop ecx
call fcn.0040149b
mov eax, dword [0x79304c]
cmp eax, 0xffffffff
je 0x404593
mov dword [esp + 0x10], eax
push dword [esp + 0x10]
jmp 0x4044f8