Function at 0x140004520
Capabilities:
Accept command line arguments
Copy file
Delete file
Get common file path
Get file attributes
Get file system object information
Set current directory
Set environment variable
Shutdown system
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x438
mov ecx, 0x8001
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
lea rcx, [rsp + 0x5c]
mov dword [rsp + 0x5c], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov rbp, qword [0x14000d1c0]
mov eax, dword [rsp + 0x68]
mov edx, dword [rsp + 0x60]
mov dword [rbp + 0x38], eax
movzx eax, byte [rsp + 0x64]
shl edx, 8
or eax, edx
movzx edx, byte [rsp + 0x170]
shl eax, 0x10
shl edx, 8
mov ecx, edx
movzx edx, byte [rsp + 0x176]
or edx, ecx
movzx edx, dx
or eax, edx
mov dword [rbp + 0x3c], eax
shr eax, 0x10
cmp ax, 0x600
je 0x1400045ab
xor ecx, ecx
call fcn.140008514
test rax, rax
je 0x1400045ab
mov ecx, 0xc00
call rax
mov rsi, qword [sym.imp.KERNEL32.dll_lstrlenA]
lea rbx, str.UXTHEME
mov rcx, rbx
call fcn.140008489
mov rcx, rbx
call rsi
inc eax
cdqe
add rbx, rax
cmp byte [rbx], 0
jne 0x1400045b9
mov ecx, 8
call fcn.140008514
mov ecx, 6
call fcn.140008514
mov qword [0x1400342a8], rax
call qword [sym.imp.COMCTL32.dll_InitCommonControls]
xor ecx, ecx
call qword [sym.imp.ole32.dll_OleInitialize]
mov rdx, qword [0x14000d210]
mov r9d, 0x2b8
lea rcx, [0x14000c17a]
mov dword [rdx], eax
lea rax, [rsp + 0x178]
xor edx, edx
mov r8, rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], 0
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea rdx, str.NSIS_Error
lea rcx, [0x1400342c0]
call fcn.140007be7
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdx, rax
mov rax, qword [0x14000d260]
mov rbx, qword [rax]
lea rdi, [rbx + 0x28000]
mov rcx, rdi
call fcn.140007be7
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
movzx edx, word [rbx + 0x28000]
lea rcx, [rbx + 0x28002]
mov qword [0x1400342b0], rax
cmp dx, 0x22
je 0x140004691
mov rcx, rdi
mov edx, 0x20
call fcn.14000757d
xor r15d, r15d
movabs rsi, 0x4300520043004e
movabs r12, 0x3d0044002f0020
mov rcx, rax
call qword [sym.imp.USER32.dll_CharNextW]
mov r14, rax
mov rcx, rax
cmp word [rcx], 0
je 0x140004758
movzx edx, word [rcx]
cmp dx, 0x20
jne 0x1400046d5
add rcx, 2
jmp 0x1400046c6
cmp dx, 0x22
jne 0x1400046e1
add rcx, 2
jmp 0x1400046e6
mov edx, 0x20
cmp word [rcx], 0x2f
jne 0x14000473d
cmp word [rcx + 2], 0x53
lea rax, [rcx + 2]
jne 0x140004706
test word [rcx + 4], 0xffdf
jne 0x140004706
mov dword [rbp + 0x20], 1
cmp qword [rcx + 2], rsi
jne 0x14000471c
test word [rcx + 0xa], 0xffdf
mov r8d, 4
cmove r15d, r8d
cmp qword [rcx - 2], r12
jne 0x14000473a
mov word [rcx - 2], 0
lea rdx, [rcx + 6]
lea rcx, [rbx + 0x2a000]
call fcn.140007be7
jmp 0x140004758
mov rcx, rax
call fcn.14000757d
cmp word [rax], 0x22
mov rcx, rax
jne 0x1400046bc
add rcx, 2
jmp 0x1400046bc
lea rsi, [rbx + 0x32000]
mov ecx, 0x1000
mov r12, qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov rdx, rsi
call r12
call fcn.140004460
test rax, rax
je 0x1400047a1
lea rcx, [rbx + 0x30000]
xor r12d, r12d
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, r15d
call fcn.140004106
mov r13, rax
test rax, rax
jne 0x140004a47
jmp 0x140004820
mov edx, 0xffb
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea rdx, str.Temp
mov rcx, rsi
call sub.KERNEL32.dll_lstrcatW
call fcn.140004460
test rax, rax
jne 0x14000477b
mov rdx, rsi
mov ecx, 0xffc
lea r13, str.Error_writing_temporary_file._Make_sure_your_temp_folder_is_valid.
call r12
lea rdx, [0x14000c19e]
mov rcx, rsi
call sub.KERNEL32.dll_lstrcatW
mov r12, qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rdx, rsi
lea rcx, str.TEMP
call r12
mov rdx, rsi
lea rcx, [0x14000c1b0]
call r12
xor r12d, r12d
call fcn.140004460
test rax, rax
jne 0x14000477b
jmp 0x140004a47
mov rax, qword [0x14000d230]
cmp dword [rax], 0
je 0x140004a2e
xor edx, edx
mov rcx, rdi
call fcn.14000757d
movabs rdx, 0x3d003f005f0020
cmp rdi, rax
ja 0x140004898
cmp qword [rax], rdx
je 0x140004854
sub rax, 2
jmp 0x140004844
mov word [rax], 0
lea r12, [rax + 8]
mov rcx, r12
call fcn.140008142
test eax, eax
jne 0x140004875
lea r13, str.Error_launching_installer
jmp 0x1400049f7
lea rcx, [rbx + 0x2a000]
mov rdx, r12
call fcn.140007be7
lea rcx, [rbx + 0x2c000]
mov rdx, r12
call fcn.140007be7
jmp 0x140004a2e
call fcn.140008574
mov rcx, rsi
lea rdi, [rbx + 0xa000]
lea r15, [rbx + 0xc000]
mov dword [rsp + 0x44], eax
call sub.KERNEL32.dll_lstrlenW
mov rdx, r14
mov rcx, rbx
movsxd r12, eax
call fcn.140007be7
cmp word [rbx + 0x2a000], 0
jne 0x1400048e2
lea rdx, [rbx + 0x2e000]
lea rcx, [rbx + 0x2a000]
call fcn.140007be7
lea rax, [rbx + r12*2 + 0x32000]
mov word [rsp + 0x42], 1
xor r12d, r12d
mov r14, qword [0x14000d200]
mov qword [rsp + 0x38], rax
mov rax, qword [sym.imp.USER32.dll_wsprintfW]
mov qword [rsp + 0x48], rax
movzx r8d, word [rsp + 0x42]
mov rcx, qword [rsp + 0x38]
lea rdx, str.nsu_X.tmp
mov rax, qword [rsp + 0x48]
call rax
mov rax, qword [r14]
mov rcx, rdi
mov edx, dword [rax + 0x140]
call fcn.14000859d
cmp dword [rsp + 0x44], 0
mov rcx, rsi
je 0x140004947
call fcn.1400073d0
jmp 0x14000494c
call fcn.140007439
test eax, eax
je 0x140004995
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
bt eax, 0xa
jb 0x140004a1b
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x140004a1b
mov edx, 1
mov rcx, rsi
call fcn.1400081f7
test r12d, r12d
jne 0x140004a1b
mov r12d, 1
jmp 0x14000490c
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
xor edx, edx
mov rcx, rsi
call fcn.140007965
lea rcx, [rbx + 0x36000]
mov r8d, 1
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x140004869
xor edx, edx
mov rcx, rdi
call fcn.140007965
mov rax, qword [r14]
mov rcx, r15
mov edx, dword [rax + 0x144]
call fcn.14000859d
mov rcx, r15
call fcn.14000745b
mov rcx, rax
test rax, rax
je 0x1400049fc
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r12d, r12d
jmp 0x140004a47
test r12d, r12d
jne 0x140004869
mov rcx, rdi
call fcn.140008114
test rax, rax
je 0x14000498a
jmp 0x140004869
inc word [rsp + 0x42]
je 0x140004869
xor r12d, r12d
jmp 0x14000490c
mov dword [rbp + 0x2c], 0xffffffff
call fcn.1400060df
mov ecx, 1
mov r12d, eax
call fcn.140007d55
call fcn.1400044bc
call qword [sym.imp.ole32.dll_OleUninitialize]
test r13, r13
mov rbx, qword [sym.imp.KERNEL32.dll_ExitProcess]
je 0x140004a75
mov rcx, r13
mov edx, 0x200010
call fcn.140007509
mov ecx, 2
jmp 0x140004b47
cmp dword [rbp + 0x14], 0
je 0x140004b3a
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x50]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140004af0
lea r8, [rsp + 0x17c]
lea rdx, str.SeShutdownPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov r8, qword [rsp + 0x30]
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x178], 1
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x184], 2
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov ecx, 1
call fcn.140008514
test rax, rax
jne 0x140004b15
mov edx, 0x80040002
mov ecx, 2
call qword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
je 0x140004b30
jmp 0x140004b3a
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0x80040002
mov r9d, 0x25
call rax
test eax, eax
jne 0x140004aff
mov ecx, 9
call fcn.140003c0b
mov eax, dword [rbp + 0x2c]
cmp eax, 0xffffffff
cmovne r12d, eax
mov ecx, r12d
call rbx
nop
nop
nop
nop
nop
nop
nop