Function at 0x403e91
Capabilities:
Accept command line arguments
Check for time delay via gettickcount
Copy file
Delete file
Get common file path
Get file size
Terminate process

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [0x4092a0]
add eax, 0x3e8
mov dword [esp + 0x14], eax
mov bl, 0x20
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
mov edi, 0x400
push 0x79fb00
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
push dword [0x4092a0]
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
cmp byte [esi], 0x22
jne 0x403ee3
add bl, 2
inc esi
mov al, byte [esi]
mov ebp, dword [sym.imp.USER32.dll_CharNextA]
test al, al
je 0x403efe
cmp al, bl
je 0x403efe
push esi
call ebp
mov esi, eax
mov al, byte [esi]
test al, al
jne 0x403eef
push esi
call ebp
mov ebx, eax
mov dword [esp + 0x18], ebx
cmp byte [ebx], 0x20
jne 0x403f13
push ebx
call ebp
mov ebx, eax
jmp 0x403f07
cmp byte [ebx], 0x2f
jne 0x403f72
inc ebx
cmp byte [ebx], 0x53
jne 0x403f2d
mov al, byte [ebx + 1]
or al, 0x20
cmp al, 0x20
jne 0x403f2d
inc byte [0x796a34]
cmp dword [ebx], 0x4352434e
jne 0x403f44
mov al, byte [ebx + 4]
or al, 0x20
cmp al, 0x20
jne 0x403f44
inc byte [0x796a35]
cmp word [ebx], 0x3d44
je 0x403f5a
mov al, byte [ebx]
or al, 0x20
cmp al, 0x20
je 0x403f07
push ebx
call ebp
mov ebx, eax
jmp 0x403f4b
and byte [ebx - 2], 0
add ebx, 2
push ebx
push dword [0x4092a4]
call fcn.004069d5
mov ebx, 0x40b2e0
push str.NSIS_ERROR
push 0x79ff60
call fcn.004069d5
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push edi
mov dword [0x798efc], eax
push dword [0x4092ac]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 3
push 0x80000000
push dword [0x4092ac]
call fcn.00406695
cmp eax, 0xffffffff
mov dword [0x7a0774], eax
jne 0x403fc7
mov dword [0x795be0], str.Error_launching_installer
jmp 0x40423f
push dword [0x4092ac]
call fcn.00406510
push 0
push dword [0x7a0774]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
mov dword [0x7a076c], eax
test esi, esi
jle 0x404106
mov ebp, 0x796a40
mov eax, 0x200
mov edi, esi
cmp esi, eax
jbe 0x404001
mov edi, eax
push edi
push 0x795be8
call fcn.00403dc9
test eax, eax
je 0x404127
cmp dword [0x7a0764], 0
jne 0x404080
push 0x795be8
call fcn.0040391a
test eax, eax
je 0x4040d8
mov ecx, dword [0x7a0760]
cmp eax, esi
mov dword [0x7a0764], ecx
jg 0x40417a
mov cl, byte [0x795be8]
test cl, 4
je 0x404054
inc byte [0x796a34]
cmp byte [0x796a35], 0
je 0x404066
test cl, 8
je 0x404106
test cl, 1
je 0x404106
inc byte [0x795de8]
lea esi, [eax - 4]
cmp edi, esi
jbe 0x4040d8
mov edi, esi
jmp 0x4040d8
cmp byte [0x796a34], 0
jne 0x4040d8
cmp dword [0x796230], 0
je 0x4040ad
xor eax, eax
push 1
push eax
push eax
push eax
push ebp
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x4040d8
push ebp
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x404092
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [esp + 0x14]
jbe 0x4040d8
push str.verifying_installer:__d__
push 0x403e14
push 0
push 0x6f
push dword [0x798efc]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov dword [0x796230], eax
cmp esi, dword [0x7a076c]
jge 0x4040f6
push edi
push 0x795be8
push dword [0x7961ec]
call fcn.00401e22
mov dword [0x7961ec], eax
add dword [0x7a0760], edi
sub esi, edi
test esi, esi
jg 0x403ff4
mov eax, dword [0x796230]
xor esi, esi
cmp eax, esi
je 0x404118
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
cmp dword [0x7a0764], esi
jne 0x40414a
mov eax, str.Installer_corrupted_or_incomplete._r_n_r_nThis_could_be_the_result_of_a_failed_download_or_corruption_from_a_virus._r_n_r_nIf_desperate__try_the__NCRC_command_line_switch__NOT_recommended_
jmp 0x40419a
mov eax, dword [0x796230]
mov dword [0x795be0], 0x4090a8
test eax, eax
je 0x40422e
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
jmp 0x40422e
cmp byte [0x795de8], 0
je 0x404189
push esi
push dword [0x7a0760]
call fcn.00403dfb
lea eax, [esp + 0x14]
push 4
push eax
call fcn.00403dc9
test eax, eax
je 0x40417a
mov eax, dword [0x7961ec]
cmp eax, dword [esp + 0x14]
je 0x404189
mov dword [0x795be0], str.Installer_corrupted_or_incomplete._r_n_r_nThis_could_be_the_result_of_a_failed_download_or_corruption_from_a_virus._r_n_r_nIf_desperate__try_the__NCRC_command_line_switch__NOT_recommended_
jmp 0x40422e
push esi
push dword [0x7a0764]
call fcn.00403dfb
call fcn.00403954
cmp eax, esi
mov dword [0x795be0], eax
jne 0x40422e
xor eax, eax
cmp dword [0x79ff2c], eax
je 0x404210
cmp byte [ebx], al
mov esi, ebx
je 0x4041c5
inc esi
cmp byte [esi], 0
jne 0x4041b7
cmp esi, ebx
jb 0x40429c
cmp byte [esi], 0x5f
jne 0x4041d6
cmp byte [esi + 1], 0x3f
jne 0x4041d6
cmp byte [esi + 2], 0x3d
je 0x4041db
dec esi
cmp esi, ebx
jae 0x4041c5
cmp esi, ebx
jb 0x40429c
and byte [esi - 1], 0
add esi, 3
push esi
call fcn.0040658f
test eax, eax
je 0x4043af
push esi
push dword [0x4092a4]
call fcn.004069d5
push esi
push dword [0x4092a8]
call fcn.004069d5
mov eax, dword [0x79ff20]
cmp byte [eax + 0x42], 0
jne 0x404224
mov cl, byte [0x796a34]
mov byte [eax + 0x42], cl
call fcn.004043be
mov dword [0x796a38], eax
mov eax, dword [0x7a0774]
cmp eax, 0xffffffff
je 0x40423f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x4090a4]
pop edi
pop esi
pop ebp
cmp eax, 0xffffffff
pop ebx
je 0x404254
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x795be0]
test eax, eax
je 0x404265
push 0x10
push eax
call fcn.0040645b
cmp byte [0x40aee0], 0
je 0x40427a
push 1
push 0x40aee0
call fcn.00406486
mov eax, dword [0x79ff38]
test eax, eax
je 0x40428a
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push dword [0x796a38]
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov ebx, 0x796235
mov esi, 0x796234
mov ebp, 0x795dec
push 0x79fb00
push ebx
mov byte [0x796234], 0x22
call fcn.004069d5
push str.ANSISu_.exe
push esi
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [esp + 0x14], 0
jne 0x40438f
push 0x400
push ebp
push dword [0x798efc]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [eax + 0x795de1]
push 0x409195
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x4043af
push 0
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x40438f
push 0
push ebx
call fcn.004066b1
mov eax, dword [0x4092a4]
cmp byte [eax], 0
je 0x40433a
push eax
push ebp
call fcn.004069d5
jmp 0x404340
push ebp
call fcn.00406510
push ebp
call fcn.0040658f
test eax, eax
je 0x4043af
push 0x4091c8
push esi
mov dword [esp + 0x1c], 1
call edi
push dword [esp + 0x18]
push esi
call edi
push str.___
push esi
call edi
push ebp
push esi
call edi
push 0x79fb00
push esi
call fcn.004063d6
test eax, eax
je 0x404385
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40438f
mov eax, dword [str.Error_launching_installer]
mov dword [0x795be0], eax
inc byte [str.ANSISu_.exe]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x1a
jl 0x4042b9
cmp dword [esp + 0x14], 0
jne 0x40422e
mov eax, dword [str.Error_launching_installer]
mov dword [0x795be0], eax
jmp 0x40422e