Function at 0x403fef
Capabilities:
Accept command line arguments
Copy file
Delete file
Get common file path
Get file system object information
Set current directory
Set environment variable
Shutdown system
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x3e8
push 0x8001
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
xor esi, esi
lea edi, [esp + 0x18]
mov dword [edi + 0x14], esi
mov dword [edi + 0x118], esi
mov dword [edi + 0x114], esi
mov dword [edi], 0x11c
push edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x404059
mov dword [esp + 0x18], 0x114
push edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov byte [esp + 0x132], 4
cmp word [esp + 0x2c], 0x53
jne 0x404051
movzx esi, word [esp + 0x46]
add esi, 0xffffffd0
mov word [esp + 0x12c], si
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
cmp eax, 9
ja 0x40406d
movzx ecx, cx
mov dword [esp + 0x24], ecx
mov edi, dword [0x40b044]
mov dword [edi + 0x38], ecx
movzx edx, byte [esp + 0x132]
mov ecx, dword [esp + 0x12c]
shl ecx, 8
mov esi, 0xffff
and ecx, esi
or ecx, edx
movzx edx, byte [esp + 0x20]
shl eax, 8
and eax, esi
or eax, edx
mov edx, eax
shl edx, 0x10
or edx, ecx
mov dword [edi + 0x3c], edx
cmp eax, 0x600
je 0x4040c0
push 0
call fcn.00406d65
test eax, eax
je 0x4040c0
push 0xc00
call eax
mov esi, str.UXTHEME
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
call fcn.004080ab
push esi
call edi
lea esi, [eax + esi + 1]
cmp byte [esi], 0
jne 0x4040cb
push 0xb
call fcn.00406d65
push 9
call fcn.00406d65
mov dword [0x440278], eax
push 7
call fcn.00406d65
test eax, eax
je 0x40410c
push 0x1e
call eax
test eax, eax
je 0x40410c
mov eax, dword [0x40b044]
or byte [eax + 0x3c], 0x80
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
xor ebx, ebx
push ebx
call dword [sym.imp.ole32.dll_OleInitialize]
mov ecx, dword [0x40b1d8]
mov dword [ecx], eax
lea eax, [esp + 0x134]
push ebx
push 0x2b4
push eax
push ebx
push 0x40b120
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push str.NSIS_Error
push 0x44027c
call fcn.00407239
mov eax, dword [0x40ae14]
mov esi, dword [eax]
lea edi, [esi + 0x50000]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
push edi
call fcn.00407239
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [0x44827c], eax
xor eax, eax
cmp word [esi + 0x50000], 0x22
sete cl
mov dword [esp + 4], esi
mov dword [esp + 0x10], edi
je 0x404194
mov dword [esp], 0
mov edx, edi
jmp 0x4041a1
mov dword [esp], 0
lea edx, [esi + 0x50002]
mov al, cl
lea eax, [eax + eax + 0x20]
push eax
push edx
call fcn.00407351
push eax
call dword [sym.imp.USER32.dll_CharNextW]
mov dword [esp + 0xc], eax
movzx edx, word [eax]
test dx, dx
je 0x40429e
mov dword [esp], 0
mov ebx, 0x2f0020
mov eax, dword [esp + 0xc]
add eax, 2
cmp dx, 0x20
jne 0x4041e3
movzx edx, word [eax]
jmp 0x4041d5
movzx ecx, dx
cmp ecx, 0x22
jne 0x4041f4
movzx edx, word [eax]
mov cx, 0x22
jmp 0x4041fb
add eax, 0xfffffffe
mov cx, 0x20
cmp dx, 0x2f
jne 0x404260
cmp word [eax + 2], 0x53
jne 0x404221
movzx edx, word [eax + 4]
test edx, 0xffdf
jne 0x404221
mov edx, dword [0x40b044]
mov dword [edx + 0x20], 1
lea edx, [eax + 2]
mov ebp, dword [edx + 4]
mov edi, 0x430052
xor ebp, edi
mov edi, dword [edx]
mov esi, 0x43004e
xor edi, esi
or edi, ebp
jne 0x40424b
movzx edi, word [eax + 0xa]
test edi, 0xffdf
jne 0x40424b
or dword [esp], 4
mov edi, dword [eax + 2]
mov esi, 0x3d0044
xor edi, esi
mov ebp, dword [eax - 2]
xor ebp, ebx
or ebp, edi
je 0x404284
mov eax, edx
movzx ecx, cx
push ecx
push eax
call fcn.00407351
xor ecx, ecx
cmp word [eax], 0x22
sete cl
lea eax, [eax + ecx*2]
movzx edx, word [eax]
test dx, dx
jne 0x4041d5
jmp 0x40429e
mov word [eax - 2], 0
mov ecx, dword [esp + 4]
add ecx, 0x54000
add eax, 6
push eax
push ecx
call fcn.00407239
mov esi, dword [esp + 4]
lea edi, [esi + 0x64000]
push edi
push 0x2000
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call fcn.00403fb0
test eax, eax
jne 0x404325
push 0x1ffb
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.Temp
push edi
call sub.KERNEL32.dll_lstrcatW
call fcn.00403fb0
test eax, eax
jne 0x404325
push edi
push 0x1ffc
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x40b144
push edi
call sub.KERNEL32.dll_lstrcatW
mov esi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push edi
push str.TEMP
call esi
push edi
push 0x40b156
call esi
mov esi, dword [esp + 4]
call fcn.00403fb0
test eax, eax
jne 0x404325
mov dword [esp], 0
mov ebx, 0x40b048
jmp 0x404374
lea eax, [esi + 0x60000]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [esp]
call fcn.00403a39
test eax, eax
jne 0x40436b
mov eax, dword [0x40b1dc]
cmp dword [eax], 0
jne 0x404449
mov eax, dword [0x40b044]
mov dword [eax + 0x2c], 0xffffffff
call fcn.00404726
mov dword [esp], eax
push 1
call fcn.00407e33
xor ebx, ebx
jmp 0x404374
mov ebx, eax
mov dword [esp], 0
call fcn.004045f0
call dword [sym.imp.ole32.dll_OleUninitialize]
test ebx, ebx
jne 0x404436
mov eax, dword [0x40b044]
cmp dword [eax + 0x14], 0
je 0x40441d
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [esp + 0x14]
push ecx
push 0x28
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4043e8
lea edi, [esp + 0x138]
xor esi, esi
push edi
push str.SeShutdownPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov dword [edi - 4], 1
mov dword [edi + 8], 2
push esi
push esi
push esi
lea eax, [esp + 0x140]
push eax
push esi
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 4
call fcn.00406d65
test eax, eax
je 0x404405
xor ecx, ecx
push 0x80040002
push 0x25
push ecx
push ecx
push ecx
call eax
test eax, eax
je 0x404416
push 0x80040002
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x40441d
push 9
call fcn.004036fd
mov eax, dword [0x40b044]
mov eax, dword [eax + 0x2c]
cmp eax, 0xffffffff
mov ecx, dword [esp]
je 0x40442f
mov ecx, eax
push ecx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x200010
push ebx
call fcn.00406e20
push 2
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [esp], 0
mov dword [esp + 8], edi
push 0
mov edi, dword [esp + 0x14]
push edi
call fcn.00407351
cmp eax, edi
jb 0x404485
mov ebp, eax
mov eax, 0x3d003f
mov ecx, 0x5f0020
mov edx, dword [ebp + 4]
xor edx, eax
mov esi, dword [ebp]
xor esi, ecx
or esi, edx
je 0x4044e0
add ebp, 0xfffffffe
cmp ebp, edi
jae 0x404470
call fcn.00406d4b
mov ebp, eax
push str.nsu
mov edi, dword [esp + 0xc]
push edi
call sub.KERNEL32.dll_lstrcatW
test ebp, ebp
je 0x4044aa
push 0x40b19c
push edi
call sub.KERNEL32.dll_lstrcatW
push 0x40b1a0
push edi
call sub.KERNEL32.dll_lstrcatW
mov eax, dword [esp + 4]
lea esi, [eax + 0x5c000]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov ebx, str.Error_launching_installer
test eax, eax
je 0x404374
test ebp, ebp
jne 0x40451f
push edi
call fcn.00406d2d
jmp 0x404525
mov word [ebp], 0
add ebp, 8
push ebp
call fcn.0040719e
mov ebx, str.Error_launching_installer
test eax, eax
je 0x404374
mov esi, dword [esp + 4]
lea eax, [esi + 0x54000]
push ebp
push eax
call fcn.00407239
add esi, 0x58000
push ebp
push esi
call fcn.00407239
jmp 0x40434c
push edi
call fcn.00406cb0
push edi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov edi, dword [esp + 4]
cmp word [edi + 0x54000], 0
jne 0x404547
lea eax, [edi + 0x54000]
push esi
push eax
call fcn.00407239
push dword [esp + 0xc]
push edi
call fcn.00407239
mov dword [edi + 0x4000], 0x41
lea eax, [edi + 0x6c000]
mov dword [esp], eax
mov ebx, str.Error_launching_installer
mov edi, 0x1a
mov ebp, dword [0x40a004]
mov esi, 0x448280
mov eax, dword [ebp]
push dword [eax + 0x120]
push esi
call fcn.00407938
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test ebx, ebx
je 0x4045d0
push 1
push 0x448280
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x4045d2
push 0
push esi
call fcn.004072cb
mov eax, dword [ebp]
push dword [eax + 0x124]
push esi
call fcn.00407938
push esi
call fcn.00406d9e
test eax, eax
je 0x4045d2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
mov eax, dword [esp + 4]
inc word [eax + 0x4000]
dec edi
jne 0x404579
push 0
push dword [esp + 0xc]
call fcn.004072cb
jmp 0x40436d