Function at 0x403948
Capabilities:
Accept command line arguments
Copy file
Create directory
Delete file
Get common file path
Get file system object information
Resolve function by parsing pe exports
Set current directory
Shutdown system
Terminate process

Disassembly:
sbb al, 0xad
cmp byte [eax + 0x1c], 0x18
je 0x403952
xchg esi, eax
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.0040178e
je 0x40396c
jns 0x403982
mov edi, eax
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
sbb byte [ebx - 0x20fcdfa6], cl
call fcn.0040178e
ficom dword [eax - 0x74b6775b]
xor al, 0x8b
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
inc edi
je 0x4039d6
cmp dword [esi], eax
jne 0x40397b
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x40397b
call fcn.0040178e
jno 0x4039f8
pop edi
and dword [ebx - 0x20fcdba6], ecx
mov cx, word [ebx + ecx*2]
mov ebx, dword [edx + 0x1c]
add ebx, edi
mov eax, dword [ebx + ecx*4]
add eax, edi
push eax
call fcn.0040178e
jnp 0x403a29
or byte [ecx - 0xf78a01], al
jne 0x4039c4
push dword [ebp]
call fcn.00401f8e
salc
or dword [0x40b014], 0xffffffff
call fcn.00403de3
push 7
invalid
pop es
push 0x4db0d0
call fcn.00406dfc
pop esi
ret
and al, 0x10
fcom dword [ecx + 0x6c890040]
and al, 0x14
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push 0x8001
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push ebp
call dword [sym.imp.ole32.dll_OleInitialize]
push 8
mov dword [0x472eb8], eax
call fcn.0040645d
push ebp
push 0x2b4
mov dword [0x472dd0], eax
add al, byte [eax]
add byte [ebx + 0x472dd0], ah
lea eax, [esp + 0x38]
push eax
push ebp
push 0x40931c
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push str.NSIS_Error
push 0x46adc0
call fcn.0040616a
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
mov edi, 0x4c30a0
push edi
call fcn.0040616a
push ebp
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp word [0x4c30a0], 0x22
mov dword [0x472dd8], eax
mov eax, edi
jne 0x403a83
push 0x22
pop esi
mov eax, 0x4c30a2
push esi
push eax
call fcn.00405e66
push eax
call dword [sym.imp.USER32.dll_CharNextW]
mov esi, eax
mov dword [esp + 0x1c], esi
jmp 0x403b2a
push 0x20
pop ebx
cmp ax, bx
jne 0x403aac
add esi, 2
cmp word [esi], bx
je 0x403aa4
cmp word [esi], 0x22
jne 0x403ab8
push 0x22
add esi, 2
pop ebx
cmp word [esi], 0x2f
jne 0x403b18
add esi, 2
cmp word [esi], 0x53
jne 0x403ada
movzx eax, word [esi + 2]
cmp eax, 0x20
je 0x403ad5
cmp ax, bp
jne 0x403ada
or dword [esp + 0x14], 2
push 4
push str.NCRC
push esi
call fcn.00403948
add esp, 0xc
test eax, eax
jne 0x403b01
movzx eax, word [esi + 8]
cmp eax, 0x20
je 0x403afc
cmp ax, bp
jne 0x403b01
or dword [esp + 0x14], 4
push 4
lea eax, [esi - 4]
push str.__D
push eax
call fcn.00403948
add esp, 0xc
test eax, eax
je 0x403b38
push ebx
push esi
call fcn.00405e66
mov esi, eax
cmp word [esi], 0x22
jne 0x403b2a
add esi, 2
movzx eax, word [esi]
cmp ax, bp
jne 0x403a9c
jmp 0x403b55
push 8
lea eax, [esi - 4]
push ebp
push eax
call fcn.00407ecf
add esp, 0xc
add esi, 4
push esi
push 0x4c70a8
call fcn.0040616a
mov ebx, 0x4d70c8
push ebx
push 0x2004
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call fcn.00403914
test eax, eax
jne 0x403b93
push 0x1fff
push ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.Temp
push ebx
call sub.KERNEL32.dll_lstrcatW
call fcn.00403914
test eax, eax
je 0x403c2c
push 0x4d30c0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [esp + 0x14]
call fcn.00403679
mov dword [esp + 0x10], eax
cmp eax, ebp
jne 0x403c2c
cmp dword [0x472e24], ebp
je 0x403c15
push ebp
push edi
call fcn.00405e66
mov esi, eax
jmp 0x403bd9
push 4
push str.___
push esi
call fcn.00403948
add esp, 0xc
test eax, eax
je 0x403bdd
sub esi, 2
cmp esi, edi
jae 0x403bc2
mov dword [esp + 0x10], str.Error_launching_installer
cmp esi, edi
jb 0x403c57
xor eax, eax
mov word [esi], ax
add esi, 8
push esi
call fcn.004068df
test eax, eax
je 0x403c2c
push esi
push 0x4c70a8
call fcn.0040616a
push esi
push 0x4cb0b0
call fcn.0040616a
mov dword [esp + 0x10], ebp
or dword [0x472eac], 0xffffffff
call fcn.00405a8c
push 1
mov dword [esp + 0x1c], eax
call fcn.00406248
call 0x4039a1
call dword [sym.imp.ole32.dll_OleUninitialize]
cmp dword [esp + 0x10], ebp
je 0x403d2e
push 0x200010
push dword [esp + 0x14]
call fcn.00405e00
push 2
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x4092c0
push ebx
call sub.KERNEL32.dll_lstrcatW
mov esi, 0x4cf0b8
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x403c2c
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push ebx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cmp word [0x4c70a8], bp
jne 0x403c96
push esi
push 0x4c70a8
call fcn.0040616a
push dword [esp + 0x1c]
push section..ndata
call fcn.0040616a
push 0x4092bc
push 0x477008
call fcn.0040616a
push 0x1a
pop edi
mov esi, 0x4331f8
mov eax, dword [0x472ddc]
push dword [eax + 0x120]
push esi
call fcn.00406966
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [esp + 0x10], ebp
je 0x403d18
push 1
push esi
push 0x4df0d8
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x403d18
push ebp
push esi
call fcn.00406dc9
mov eax, dword [0x472ddc]
push dword [eax + 0x124]
push esi
call fcn.00406966
push esi
call fcn.00405d9f
cmp eax, ebp
je 0x403d18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x10], ebp
inc word [0x477008]
dec edi
jne 0x403cbb
push ebp
push ebx
call fcn.00406dc9
jmp 0x403c2c
cmp dword [0x472e94], ebp
je 0x403db1
push 3
call fcn.0040645d
push 4
mov ebx, eax
call fcn.0040645d
push 5
mov esi, eax
call fcn.0040645d
mov edi, eax
cmp ebx, ebp
je 0x403d9d
cmp esi, ebp
je 0x403d9d
cmp edi, ebp
je 0x403d9d
lea eax, [esp + 0x1c]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
test eax, eax
je 0x403d9d
lea eax, [esp + 0x24]
push eax
push str.SeShutdownPrivilege
push ebp
call esi
push ebp
push ebp
push ebp
lea eax, [esp + 0x2c]
push eax
push ebp
push dword [esp + 0x30]
mov dword [esp + 0x38], 1
mov dword [esp + 0x44], 2
call edi
push ebp
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x403db1
push 9
call fcn.0040141d
mov eax, dword [0x472eac]
cmp eax, 0xffffffff
je 0x403dbf
mov dword [esp + 0x18], eax
push dword [esp + 0x18]
jmp 0x403c51