Function at 0x40371a
Capabilities:
Accept command line arguments
Copy file
Create directory
Delete file
Get common file path
Get file system object information
Set current directory
Shutdown system
Terminate process

Disassembly:
sub esp, 0x310
push ebx
push ebp
push esi
push edi
push 0x20
xor ebp, ebp
pop ebx
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x18], str.Error_writing_temporary_file._Make_sure_your_temp_folder_is_valid.
mov dword [esp + 0x10], ebp
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push 0x8001
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push ebp
call dword [sym.imp.ole32.dll_OleInitialize]
push 8
mov dword [0x4746b8], eax
call fcn.00406145
push ebp
push 0x2b4
mov dword [0x4745d0], eax
lea eax, [esp + 0x74]
push eax
push ebp
push 0x408678
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push str.NSIS_Error
push 0x46c5c0
call fcn.00405fcf
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
mov edi, 0x4c50a0
push edi
call fcn.00405fcf
push edi
call sub.KERNEL32.dll_lstrlenW
push str._callwnd:
push edi
mov esi, eax
call fcn.00405d73
pop ecx
pop ecx
cmp eax, ebp
je 0x4037e2
mov ecx, eax
sub ecx, edi
sar ecx, 1
add ecx, 9
add esi, 0xfffffffe
cmp ecx, esi
jge 0x4037e2
add eax, 0x12
push eax
call fcn.00405f2f
push eax
mov dword [0x43a210], eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x4037e2
mov dword [0x43a210], ebp
push ebp
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp word [0x4c50a0], 0x22
mov dword [0x4745d8], eax
mov eax, edi
jne 0x403802
push 0x22
pop ebx
mov eax, 0x4c50a2
push ebx
push eax
call fcn.00405c6c
push eax
call dword [sym.imp.USER32.dll_CharNextW]
mov esi, eax
mov dword [esp + 0x14], esi
jmp 0x4038a8
push 0x20
pop ecx
cmp ax, cx
jne 0x40382a
inc esi
inc esi
cmp word [esi], cx
je 0x403823
cmp word [esi], 0x22
mov ebx, ecx
jne 0x403837
inc esi
push 0x22
inc esi
pop ebx
cmp word [esi], 0x2f
jne 0x403897
inc esi
inc esi
cmp word [esi], 0x53
jne 0x403858
movzx eax, word [esi + 2]
cmp ax, cx
je 0x403853
cmp ax, bp
jne 0x403858
or dword [esp + 0x10], 2
push 4
push str.NCRC
push esi
call fcn.00403681
add esp, 0xc
test eax, eax
jne 0x403880
movzx eax, word [esi + 8]
cmp ax, 0x20
je 0x40387b
cmp ax, bp
jne 0x403880
or dword [esp + 0x10], 4
push 4
lea eax, [esi - 4]
push str.__D
push eax
call fcn.00403681
add esp, 0xc
test eax, eax
je 0x4038b6
push ebx
push esi
call fcn.00405c6c
mov esi, eax
cmp word [esi], 0x22
jne 0x4038a8
inc esi
inc esi
movzx eax, word [esi]
cmp ax, bp
jne 0x40381b
jmp 0x4038d3
push 8
lea eax, [esi - 4]
push ebp
push eax
call fcn.004077b0
add esp, 0xc
add esi, 4
push esi
push 0x4c90a8
call fcn.00405fcf
mov ebx, 0x4d90c8
push ebx
push 0x2004
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call fcn.0040364d
test eax, eax
jne 0x403911
push 0x1fff
push ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.Temp
push ebx
call sub.KERNEL32.dll_lstrcatW
call fcn.0040364d
test eax, eax
je 0x4039a2
push 0x4d50c0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [esp + 0x10]
call fcn.004032a3
mov dword [esp + 0x18], eax
cmp eax, ebp
jne 0x4039a2
cmp dword [0x474624], ebp
je 0x403992
push ebp
push edi
call fcn.00405c6c
mov esi, eax
jmp 0x403956
push 4
push 0x408630
push esi
call fcn.00403681
add esp, 0xc
test eax, eax
je 0x40395a
dec esi
dec esi
cmp esi, edi
jae 0x403940
mov dword [esp + 0x18], str.Error_launching_installer
cmp esi, edi
jb 0x4039cd
xor eax, eax
mov word [esi], ax
add esi, 8
push esi
call fcn.004065c8
test eax, eax
je 0x4039a2
push esi
push 0x4c90a8
call fcn.00405fcf
push esi
push 0x4cd0b0
call fcn.00405fcf
mov dword [esp + 0x18], ebp
or dword [0x4746ac], 0xffffffff
call fcn.004058b1
mov dword [esp + 0x1c], eax
call fcn.004036d8
call dword [sym.imp.ole32.dll_OleUninitialize]
cmp dword [esp + 0x18], ebp
je 0x403b6d
push 0x200010
push dword [esp + 0x1c]
call fcn.00405c06
push 2
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x40861c
push ebx
call sub.KERNEL32.dll_lstrcatW
mov esi, 0x4d10b8
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4039a2
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push ebx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cmp word [0x4c90a8], bp
jne 0x403a0c
push esi
push 0x4c90a8
call fcn.00405fcf
push dword [esp + 0x14]
push section..ndata
call fcn.00405fcf
push 0x408618
push 0x479008
call fcn.00405fcf
mov dword [esp + 0x14], 0x1a
mov ebp, dword [esp + 0x14]
mov esi, 0x436200
mov edi, 0x4321f8
mov eax, dword [0x4745dc]
push dword [eax + 0x120]
push esi
call fcn.00406650
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [esp + 0x18], 0
je 0x403b4d
push 1
push esi
push 0x4e10d8
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x403b4d
push 0
push esi
call fcn.00406aac
mov eax, dword [0x4745dc]
push dword [eax + 0x124]
push esi
call fcn.00406650
push 0
push esi
call fcn.00405c6c
mov ebx, eax
jmp 0x403ab3
push 4
push 0x408630
push ebx
call fcn.00403681
add esp, 0xc
test eax, eax
je 0x403ab7
dec ebx
dec ebx
cmp ebx, esi
jae 0x403a9d
test ebx, ebx
je 0x403b2c
cmp ebx, 0x436202
jbe 0x403b2c
xor eax, eax
mov word [ebx - 2], ax
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.004035bd
test eax, eax
jl 0x403b2c
cmp dword [esp + 0x10], 0
je 0x403b2c
push esi
push edi
call sub.KERNEL32.dll_lstrcatW
push 0x408608
push edi
call sub.KERNEL32.dll_lstrcatW
push 0x1e
lea eax, [esp + 0x34]
push eax
push dword [esp + 0x18]
call fcn.00405feb
lea eax, [esp + 0x30]
push eax
push edi
call sub.KERNEL32.dll_lstrcatW
push 0x408604
push edi
call sub.KERNEL32.dll_lstrcatW
push ebx
push edi
call sub.KERNEL32.dll_lstrcatW
push edi
call fcn.00405ba5
mov ebp, eax
test ebp, ebp
jne 0x403b3c
push esi
call fcn.00405ba5
mov ebp, eax
test ebp, ebp
je 0x403b48
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [esp + 0x18], 0
mov ebx, 0x4d90c8
inc word [0x479008]
dec dword [esp + 0x14]
jne 0x403a3f
push 0
push ebx
call fcn.00406aac
xor ebp, ebp
jmp 0x4039a2
cmp dword [0x474694], ebp
je 0x403bf0
push 3
call fcn.00406145
push 4
mov ebx, eax
call fcn.00406145
push 5
mov esi, eax
call fcn.00406145
mov edi, eax
cmp ebx, ebp
je 0x403bdc
cmp esi, ebp
je 0x403bdc
cmp edi, ebp
je 0x403bdc
lea eax, [esp + 0x14]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
test eax, eax
je 0x403bdc
lea eax, [esp + 0x24]
push eax
push str.SeShutdownPrivilege
push ebp
call esi
push ebp
push ebp
push ebp
lea eax, [esp + 0x2c]
push eax
push ebp
push dword [esp + 0x28]
mov dword [esp + 0x38], 1
mov dword [esp + 0x44], 2
call edi
push ebp
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x403bf0
push 9
call fcn.004014dd
mov eax, dword [0x4746ac]
cmp eax, 0xffffffff
je 0x403bfe
mov dword [esp + 0x1c], eax
push dword [esp + 0x1c]
jmp 0x4039c7