Function at 0x140004250
Capabilities:
Accept command line arguments
Copy file
Delete file
Get common file path
Get file attributes
Get file system object information
Set current directory
Set environment variable
Shutdown system
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x368]
sub rsp, 0x440
mov rax, qword [0x14000d188]
xor rax, rsp
mov qword [rbp + 0x330], rax
call fcn.140009904
xor r13d, r13d
lea rdi, str.Error_writing_temporary_file._Make_sure_your_temp_folder_is_valid.
mov ecx, 0x8001
mov r15d, r13d
mov esi, r13d
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [rsp + 0x5c]
mov dword [0x140078e58], eax
movzx eax, byte [rsp + 0x54]
shl ax, 8
movzx edx, ax
movzx eax, byte [rsp + 0x58]
or edx, eax
movzx eax, byte [rbp + 0x64]
shl ax, 8
shl edx, 0x10
movzx ecx, ax
movzx eax, byte [rbp + 0x6a]
or edx, ecx
or edx, eax
mov eax, 0x600
mov dword [0x140078e5c], edx
shr edx, 0x10
cmp dx, ax
je 0x140004317
xor ecx, ecx
call fcn.140007e50
test rax, rax
je 0x140004317
mov ecx, 0xc00
call qword [0x14000a5a0]
lea rbx, str.UXTHEME
mov r14d, 1
mov rcx, rbx
call fcn.140007648
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, r14d
cdqe
add rbx, rax
cmp byte [rbx], r13b
jne 0x140004324
mov ecx, 8
call fcn.140007e50
mov ecx, 6
call fcn.140007e50
mov qword [0x140070d10], rax
call qword [sym.imp.COMCTL32.dll_InitCommonControls]
xor ecx, ecx
call qword [sym.imp.ole32.dll_OleInitialize]
mov r9d, 0x2b8
mov dword [rsp + 0x20], r13d
lea r8, [rbp + 0x70]
mov dword [0x140078dc0], eax
xor edx, edx
lea rcx, [0x14000a954]
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea rdx, str.NSIS_Error
lea rcx, [0x140070d40]
call fcn.140008170
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea r12, [0x1400ca000]
mov rdx, rax
mov rcx, r12
call fcn.140008170
mov ebx, 0x22
lea rax, [0x140000000]
cmp word [0x1400ca000], bx
mov edx, ebx
mov qword [0x140070d18], rax
lea ecx, [rbx - 2]
cmovne dx, cx
lea rcx, [0x1400ca002]
cmovne rcx, r12
call fcn.140007a84
mov rcx, rax
call qword [sym.imp.USER32.dll_CharNextW]
mov r12, rax
movzx edx, word [rax]
test dx, dx
je 0x1400044bd
mov r10d, 0xffdf
mov ecx, 0x20
jmp 0x140004419
add rax, 2
movzx edx, word [rax]
cmp dx, cx
je 0x140004412
movzx r9d, cx
movzx r8d, dx
cmp dx, bx
jne 0x140004433
movzx r8d, word [rax + 2]
mov r9d, ebx
lea rcx, [rax + 2]
cmovne rcx, rax
cmp r8w, 0x2f
jne 0x14000448a
add rcx, 2
cmp word [rcx], 0x53
jne 0x140004461
test word [rcx + 2], r10w
mov eax, dword [0x140078e40]
cmove eax, r14d
mov dword [0x140078e40], eax
movabs rax, 0x4300520043004e
cmp qword [rcx], rax
jne 0x14000447a
test word [rcx + 8], r10w
jne 0x14000447a
or esi, 4
movabs rax, 0x3d0044002f0020
cmp qword [rcx - 4], rax
je 0x1400044a8
movzx edx, r9w
call fcn.140007a84
movzx edx, word [rax]
cmp dx, bx
jne 0x1400043fc
add rax, 2
jmp 0x1400043f9
mov word [rcx - 4], r13w
lea rdx, [rcx + 4]
lea rcx, [0x1400ce000]
call fcn.140008170
lea r14, [0x1400de000]
mov ecx, 0x2000
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
call fcn.140004894
test rax, rax
jne 0x14000454e
mov edx, 0x1ffb
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea rdx, str.Temp
mov rcx, r14
call sub.KERNEL32.dll_lstrcatW
call fcn.140004894
test rax, rax
jne 0x14000454e
mov rdx, r14
mov ecx, 0x1ffc
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rdx, [0x14000a980]
mov rcx, r14
call sub.KERNEL32.dll_lstrcatW
mov rdx, r14
lea rcx, str.TEMP
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rdx, r14
lea rcx, [0x14000a998]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
call fcn.140004894
test rax, rax
je 0x140004789
lea rcx, [0x1400da000]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, esi
call fcn.140003d68
mov rdi, rax
test rax, rax
jne 0x140004789
cmp dword [0x140078d44], r13d
je 0x1400045ed
lea rsi, [0x1400ca000]
xor edx, edx
mov rcx, rsi
call fcn.140007a84
mov rbx, rax
cmp rax, rsi
jb 0x1400045a8
movabs rax, 0x3d003f005f0020
cmp qword [rbx], rax
je 0x1400045a8
sub rbx, 2
cmp rbx, rsi
jae 0x140004590
lea rdi, str.Error_launching_installer
cmp rbx, rsi
jb 0x140004601
mov word [rbx], r13w
add rbx, 8
mov rcx, rbx
call fcn.140007ac8
test eax, eax
je 0x140004789
mov rdx, rbx
lea rcx, [0x1400ce000]
call fcn.140008170
mov rdx, rbx
lea rcx, [0x1400d2000]
call fcn.140008170
mov rdi, r13
or dword [0x140078e4c], 0xffffffff
call fcn.140006d78
mov r15d, eax
jmp 0x140004789
call fcn.140007938
mov rcx, r14
movsxd rbx, eax
call sub.KERNEL32.dll_lstrlenW
mov rdx, r12
movsxd r14, eax
lea rcx, [section..ndata]
call fcn.140008170
cmp word [0x1400ce000], r13w
jne 0x140004640
lea rdx, [0x1400d6000]
lea rcx, [0x1400ce000]
call fcn.140008170
lea rax, [0x1400de000]
mov esi, 1
lea r13, [rax + r14*2]
mov r12, rbx
xor ebx, ebx
movzx r14d, si
mov r8d, r14d
lea rdx, str.nsu_X.tmp
mov rcx, r13
call qword [sym.imp.USER32.dll_wsprintfW]
mov rax, qword [0x140078d50]
lea rcx, [0x14008e000]
mov edx, dword [rax + 0x140]
call fcn.1400072a4
lea rcx, [0x1400de000]
test r12, r12
je 0x140004698
call fcn.140007238
jmp 0x14000469d
call fcn.140007214
test eax, eax
je 0x1400046f8
lea rcx, [0x14008e000]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
bt eax, 0xa
jb 0x1400046e2
lea rcx, [0x14008e000]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x1400046e2
mov edx, 1
lea rcx, [0x1400de000]
call fcn.140007bfc
mov eax, ebx
inc ebx
test eax, eax
je 0x140004659
mov ebx, 1
add si, bx
jne 0x140004653
xor r13d, r13d
jmp 0x14000478e
lea rcx, [0x1400de000]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
xor edx, edx
lea rcx, [0x1400de000]
call fcn.14000772c
mov r8d, 1
lea rdx, [0x14008e000]
lea rcx, [0x1400e6000]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x140004786
xor edx, edx
lea rcx, [0x14008e000]
call fcn.14000772c
mov rax, qword [0x140078d50]
lea rcx, [0x140092000]
mov edx, dword [rax + 0x144]
call fcn.1400072a4
lea rcx, [0x140092000]
call fcn.140007b90
test rax, rax
jne 0x1400047b7
mov eax, ebx
inc ebx
test eax, eax
jne 0x140004786
lea rcx, [0x14008e000]
call fcn.140007a54
test rax, rax
je 0x140004659
xor r13d, r13d
mov ebx, 1
call fcn.1400041fc
call qword [sym.imp.ole32.dll_OleUninitialize]
test rdi, rdi
je 0x1400047c8
mov edx, 0x200010
mov rcx, rdi
call fcn.1400080ec
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r13d, r13d
mov edi, r13d
jmp 0x140004789
cmp dword [0x140078e34], r13d
je 0x140004878
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140004831
lea r8, [rsp + 0x3c]
xor ecx, ecx
lea rdx, str.SeShutdownPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x38]
xor r9d, r9d
mov qword [rsp + 0x28], r13
xor edx, edx
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x44], 2
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov ecx, ebx
call fcn.140007e50
mov ebx, 0x80040002
test rax, rax
je 0x14000485d
mov r9d, 0x25
mov dword [rsp + 0x20], ebx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [0x14000a5a0]
test eax, eax
je 0x14000486e
mov edx, ebx
mov ecx, 2
call qword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x140004878
mov ecx, 9
call fcn.140001624
cmp dword [0x140078e4c], 0xffffffff
cmovne r15d, dword [0x140078e4c]
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ExitProcess]