Function at 0x14000442d
Capabilities:
Accept command line arguments
Copy file
Delete file
Get common file path
Get file attributes
Get file system object information
Set current directory
Set environment variable
Shutdown system
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x448
mov ecx, 0x8001
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
lea rcx, [rsp + 0x6c]
mov dword [rsp + 0x6c], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov rsi, qword [0x140010c90]
mov eax, dword [rsp + 0x78]
mov edx, dword [rsp + 0x70]
movzx ecx, byte [rsp + 0x180]
mov dword [rsi + 0x38], eax
movzx eax, byte [rsp + 0x74]
shl edx, 8
shl ecx, 8
or eax, edx
movzx edx, byte [rsp + 0x186]
shl eax, 0x10
or edx, ecx
movzx edx, dx
or eax, edx
mov dword [rsi + 0x3c], eax
shr eax, 0x10
cmp ax, 0x600
je 0x1400044b6
xor ecx, ecx
call fcn.1400095a6
test rax, rax
je 0x1400044b6
mov ecx, 0xc00
call rax
mov rdi, qword [sym.imp.KERNEL32.dll_lstrlenA]
lea rbx, str.UXTHEME
cmp byte [rbx], 0
je 0x1400044df
mov rcx, rbx
call fcn.14000951d
mov rcx, rbx
call rdi
inc eax
cdqe
add rbx, rax
jmp 0x1400044c4
mov ecx, 8
call fcn.1400095a6
mov ecx, 6
call fcn.1400095a6
mov qword [0x1400312a8], rax
call qword [sym.imp.COMCTL32.dll_InitCommonControls]
xor ecx, ecx
call qword [sym.imp.ole32.dll_OleInitialize]
mov rdx, qword [0x140010ce0]
mov r9d, 0x2b8
lea rcx, [0x14000e17a]
mov dword [rdx], eax
lea rax, [rsp + 0x188]
xor edx, edx
mov r8, rax
mov dword [rsp + 0x20], edx
xor edx, edx
mov qword [rsp + 0x48], rax
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea rdx, str.NSIS_Error
lea rcx, [0x1400312c0]
call fcn.140008c03
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdx, rax
mov rax, qword [0x140010d30]
mov rbx, qword [rax]
lea rbp, [rbx + 0x28000]
mov rcx, rbp
call fcn.140008c03
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
movzx edx, word [rbx + 0x28000]
lea rcx, [rbx + 0x28002]
mov qword [0x1400312b0], rax
cmp dx, 0x22
je 0x14000459c
mov rcx, rbp
mov edx, 0x20
call main
xor r14d, r14d
movabs r13, 0x4300520043004e
movabs r15, 0x3d0044002f0020
mov rcx, rax
call qword [sym.imp.USER32.dll_CharNextW]
mov rdi, rax
mov rcx, rax
cmp word [rcx], 0
je 0x140004663
movzx edx, word [rcx]
cmp dx, 0x20
jne 0x1400045e0
add rcx, 2
jmp 0x1400045d1
cmp dx, 0x22
jne 0x1400045ec
add rcx, 2
jmp 0x1400045f1
mov edx, 0x20
cmp word [rcx], 0x2f
jne 0x140004648
cmp word [rcx + 2], 0x53
lea rax, [rcx + 2]
jne 0x140004611
test word [rcx + 4], 0xffdf
jne 0x140004611
mov dword [rsi + 0x20], 1
cmp qword [rcx + 2], r13
jne 0x140004627
test word [rcx + 0xa], 0xffdf
mov r8d, 4
cmove r14d, r8d
cmp qword [rcx - 2], r15
jne 0x140004645
mov word [rcx - 2], 0
lea rdx, [rcx + 6]
lea rcx, [rbx + 0x2a000]
call fcn.140008c03
jmp 0x140004663
mov rcx, rax
call main
cmp word [rax], 0x22
mov rcx, rax
jne 0x1400045c7
add rcx, 2
jmp 0x1400045c7
lea rax, [rbx + 0x32000]
mov ecx, 0x1000
mov r13, qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov rdx, rax
mov qword [rsp + 0x30], rax
call r13
call fcn.140004370
test rax, rax
jne 0x14000471e
mov rcx, qword [rsp + 0x30]
mov edx, 0xffb
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov rcx, qword [rsp + 0x30]
lea rdx, str.Temp
call sub.KERNEL32.dll_lstrcatW
call fcn.140004370
test rax, rax
jne 0x14000471e
mov rdx, qword [rsp + 0x30]
mov ecx, 0xffc
call r13
mov rcx, qword [rsp + 0x30]
lea rdx, [0x14000e19e]
call sub.KERNEL32.dll_lstrcatW
mov rdx, qword [rsp + 0x30]
lea rcx, str.TEMP
mov r13, qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
call r13
mov rdx, qword [rsp + 0x30]
lea rcx, [0x14000e1b0]
call r13
call fcn.140004370
test rax, rax
jne 0x14000471e
call fcn.1400043c9
lea r14, str.Error_writing_temporary_file._Make_sure_your_temp_folder_is_valid.
call qword [sym.imp.ole32.dll_OleUninitialize]
jmp 0x14000499d
lea rcx, [rbx + 0x30000]
mov r13, qword [sym.imp.KERNEL32.dll_DeleteFileW]
call r13
mov ecx, r14d
call fcn.14000401f
mov r14, rax
test rax, rax
jne 0x14000497e
mov rax, qword [0x140010d00]
cmp dword [rax], 0
je 0x140004959
xor edx, edx
mov rcx, rbp
call main
movabs rdx, 0x3d003f005f0020
cmp rax, rbp
jb 0x1400047b3
cmp qword [rax], rdx
je 0x140004777
sub rax, 2
jmp 0x140004767
mov word [rax], 0
lea rdi, [rax + 8]
mov rcx, rdi
call fcn.1400091dc
test eax, eax
je 0x14000498b
lea rcx, [rbx + 0x2a000]
mov rdx, rdi
call fcn.140008c03
lea rcx, [rbx + 0x2c000]
mov rdx, rdi
call fcn.140008c03
jmp 0x140004959
call fcn.140009600
mov rcx, qword [rsp + 0x30]
mov r12d, eax
call sub.KERNEL32.dll_lstrlenW
mov rdx, rdi
mov rcx, rbx
movsxd rbp, eax
lea rax, [rbx + 0xa000]
mov qword [rsp + 0x38], rax
lea rax, [rbx + 0xc000]
mov qword [rsp + 0x40], rax
call fcn.140008c03
cmp word [rbx + 0x2a000], 0
jne 0x140004808
lea rdx, [rbx + 0x2e000]
lea rcx, [rbx + 0x2a000]
call fcn.140008c03
lea rax, [rbx + rbp*2 + 0x32000]
mov r15, qword [sym.imp.USER32.dll_wsprintfW]
mov edi, 1
mov r14, qword [0x140010cd0]
mov qword [rsp + 0x50], rax
movzx eax, di
xor ebp, ebp
mov dword [rsp + 0x5c], eax
mov r8d, dword [rsp + 0x5c]
mov rcx, qword [rsp + 0x50]
lea rdx, str.nsu_X.tmp
call r15
mov rax, qword [r14]
mov rcx, qword [rsp + 0x38]
mov edx, dword [rax + 0x140]
call fcn.140009625
mov rcx, qword [rsp + 0x30]
test r12d, r12d
je 0x140004869
call fcn.140008426
jmp 0x14000486e
call fcn.14000848b
test eax, eax
je 0x1400048b8
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
bt eax, 0xa
jb 0x14000494e
mov rcx, qword [rsp + 0x38]
call r13
test eax, eax
je 0x14000494e
mov rcx, qword [rsp + 0x30]
mov edx, 1
call fcn.14000927e
test ebp, ebp
jne 0x14000494e
mov ebp, 1
jmp 0x140004831
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov rcx, qword [rsp + 0x30]
xor edx, edx
call fcn.140008999
mov rdx, qword [rsp + 0x38]
lea rcx, [rbx + 0x36000]
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x14000498b
mov rcx, qword [rsp + 0x38]
xor edx, edx
call fcn.140008999
mov rax, qword [r14]
mov rcx, qword [rsp + 0x40]
mov edx, dword [rax + 0x144]
call fcn.140009625
mov rcx, qword [rsp + 0x40]
call fcn.1400084ad
mov rcx, rax
test rax, rax
je 0x140004935
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
call fcn.1400043c9
call qword [sym.imp.ole32.dll_OleUninitialize]
jmp 0x1400049b4
test ebp, ebp
jne 0x14000498b
mov rcx, qword [rsp + 0x38]
call fcn.1400091ad
test rax, rax
je 0x1400048ae
jmp 0x14000498b
inc di
jne 0x140004828
jmp 0x14000498b
mov dword [rsi + 0x2c], 0xffffffff
call fcn.140006019
mov ecx, 1
mov ebx, eax
call fcn.140008df2
call fcn.1400043c9
call qword [sym.imp.ole32.dll_OleUninitialize]
jmp 0x1400049b4
call fcn.1400043c9
call qword [sym.imp.ole32.dll_OleUninitialize]
jmp 0x14000499d
call fcn.1400043c9
lea r14, str.Error_launching_installer
call qword [sym.imp.ole32.dll_OleUninitialize]
mov rcx, r14
mov edx, 0x200010
call fcn.14000854f
mov ecx, 2
jmp 0x140004a7e
cmp dword [rsi + 0x14], 0
je 0x140004a73
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x60]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140004a29
lea r8, [rsp + 0x18c]
lea rdx, str.SeShutdownPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
xor eax, eax
mov r8, qword [rsp + 0x48]
xor r9d, r9d
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x60]
xor edx, edx
mov dword [rsp + 0x188], 1
mov dword [rsp + 0x194], 2
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov ecx, 1
call fcn.1400095a6
test rax, rax
jne 0x140004a4e
mov edx, 0x80040002
mov ecx, 2
call qword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
je 0x140004a69
jmp 0x140004a73
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0x80040002
mov r9d, 0x25
call rax
test eax, eax
jne 0x140004a38
mov ecx, 9
call fcn.140003b48
mov eax, dword [rsi + 0x2c]
cmp eax, 0xffffffff
cmovne ebx, eax
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_ExitProcess]