Function at 0x403ee0
Capabilities:
Accept command line arguments
Check if file exists
Copy file
Create directory
Delete file
Get common file path
Get file attributes
Get file system object information
Link many functions at runtime
Query or enumerate registry value
Set current directory
Shutdown system
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x180
push ebx
push ebp
push esi
push edi
xor edi, edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x1c], str.Error_writing_temporary_file._Make_sure_your_temp_folder_is_valid.
mov dword [esp + 0x10], edi
mov bl, 0x20
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push 0x8001
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push edi
call dword [sym.imp.ole32.dll_OleInitialize]
mov esi, dword [str.SHFOLDER]
mov ebp, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push esi
mov dword [0x425cb8], eax
call ebp
cmp eax, edi
jne 0x403f43
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, edi
jne 0x403f43
xor eax, eax
jmp 0x403f51
mov ecx, dword [str.SHGetFolderPathA]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 0x160
lea edx, [esp + 0x38]
push edx
push 0
push 0x409433
mov dword [0x425bc0], eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpynA]
push 0x400
push str.NSIS_Error
push 0x4253c0
call edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0x400
push eax
push 0x42b000
call edi
push 0
call ebp
cmp byte [0x42b000], 0x22
mov dword [0x425bc8], eax
mov eax, 0x42b000
jne 0x403fb7
mov bl, 0x22
mov eax, 0x42b001
mov cl, byte [eax]
test cl, cl
mov esi, dword [sym.imp.USER32.dll_CharNextA]
je 0x403fd0
cmp cl, bl
je 0x403fd0
push eax
call esi
mov cl, byte [eax]
test cl, cl
jne 0x403fc3
push eax
call esi
mov cl, byte [eax]
test cl, cl
mov dword [esp + 0x18], eax
je 0x404080
mov ebp, dword [esp + 0x10]
cmp cl, 0x20
jne 0x403ff8
lea ebx, [ebx]
add eax, 1
cmp byte [eax], 0x20
je 0x403ff0
cmp byte [eax], 0x22
mov bl, 0x20
jne 0x404004
add eax, 1
mov bl, 0x22
cmp byte [eax], 0x2f
jne 0x40403e
add eax, 1
cmp byte [eax], 0x53
jne 0x40401f
mov cl, byte [eax + 1]
or cl, 0x20
cmp cl, 0x20
jne 0x40401f
or ebp, 2
cmp dword [eax], 0x4352434e
jne 0x404035
mov dl, byte [eax + 4]
or dl, 0x20
cmp dl, 0x20
jne 0x404035
or ebp, 4
cmp dword [eax - 2], 0x3d442f20
je 0x404065
mov cl, byte [eax]
test cl, cl
je 0x404051
cmp cl, bl
je 0x404051
push eax
call esi
mov cl, byte [eax]
test cl, cl
jne 0x404044
cmp byte [eax], 0x22
jne 0x404059
add eax, 1
mov cl, byte [eax]
test cl, cl
jne 0x403fe5
mov dword [esp + 0x10], ebp
jmp 0x404080
mov dword [eax - 2], 0
push 0x400
add eax, 2
push eax
push 0x42b400
mov dword [esp + 0x1c], ebp
call edi
push 0x42c400
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
call fcn.00403e60
test eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
jne 0x4040c8
push 0x3fb
push 0x42c400
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.Temp
push 0x42c400
call ebx
call fcn.00403e60
test eax, eax
je 0x404705
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x42c000
call ebp
mov eax, dword [esp + 0x10]
push eax
call fcn.00403510
test eax, eax
mov dword [esp + 0x1c], eax
jne 0x404705
cmp dword [0x425c24], eax
je 0x404172
mov cl, byte [0x42b000]
test cl, cl
mov eax, 0x42b000
je 0x40410b
push eax
call esi
mov cl, byte [eax]
test cl, cl
jne 0x404102
cmp eax, 0x42b000
mov esi, eax
jb 0x404127
cmp dword [esi], 0x3d3f5f20
je 0x404127
sub esi, 1
cmp esi, 0x42b000
jae 0x404114
cmp esi, 0x42b000
mov dword [esp + 0x1c], str.Error_launching_installer
jb 0x4041e2
mov byte [esi], 0
add esi, 4
mov eax, esi
call fcn.00407060
test eax, eax
je 0x404705
push 0x400
push esi
push 0x42b400
call edi
push 0x400
push esi
push 0x42b800
call edi
mov dword [esp + 0x1c], 0
mov esi, dword [str.KERNEL32]
mov ebp, dword [0x425bcc]
push esi
mov dword [0x425cac], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
jne 0x4041ae
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x4042f0
mov ecx, dword [str.GetUserDefaultUILanguage]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4042f0
call eax
movzx eax, ax
push eax
push 0x4095f8
push 0x42c000
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x4043f6
push str.nsu.tmp
push 0x42c400
call ebx
push 0x42bc00
push 0x42c400
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x404705
push 0
push 0x42c400
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0x42c400
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
cmp byte [0x42b400], 0
jne 0x404238
push 0x400
push 0x42bc00
push 0x42b400
call edi
mov ecx, dword [esp + 0x18]
push 0x400
push ecx
push section..ndata
call edi
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov ebx, dword [esp + 0x1c]
mov word [0x426400], 0x41
mov edi, 0x1a
mov edx, dword [0x425bcc]
mov eax, dword [edx + 0x120]
push eax
push 0x421178
call fcn.00407620
push 0x421178
call ebp
test ebx, ebx
je 0x4042cf
push 1
push 0x421178
push 0x42cc00
call esi
test eax, eax
je 0x4042cf
push 0x421178
xor eax, eax
call fcn.004072c0
mov ecx, dword [0x425bcc]
mov edx, dword [ecx + 0x124]
push edx
push 0x421178
call fcn.00407620
mov ecx, 0x421178
call fcn.00406c00
test eax, eax
je 0x4042cf
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
add byte [0x426400], 1
sub edi, 1
jne 0x404261
push 0x42c400
xor eax, eax
mov dword [esp + 0x20], ebx
call fcn.004072c0
jmp 0x404705
lea edx, [esp + 0x10]
push edx
push 0x20019
push 0
push str.Control_PanelDesktopResourceLocale
push 0x80000001
mov dword [0x42c000], 0x7830
mov byte [0x422598], 0
call ebx
test eax, eax
jne 0x40436a
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
push 0x422598
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0
push edx
mov dword [esp + 0x30], 0x400
call edi
test eax, eax
jne 0x404351
mov eax, dword [esp + 0x14]
cmp eax, 1
je 0x404358
cmp eax, 2
je 0x404358
mov byte [0x422598], 0
mov eax, dword [esp + 0x10]
push eax
mov byte [0x422997], 0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [0x422598], 0
jne 0x4043e6
lea ecx, [esp + 0x10]
push ecx
push 0x20019
push 0
push str..DEFAULTControl_PanelInternational
push 0x80000003
mov byte [0x422598], 0
call ebx
test eax, eax
jne 0x4043e6
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x18]
push edx
push 0x422598
lea eax, [esp + 0x1c]
push eax
push 0
push 0x409486
push ecx
mov dword [esp + 0x30], 0x400
call edi
test eax, eax
jne 0x4043cd
mov eax, dword [esp + 0x14]
cmp eax, 1
je 0x4043d4
cmp eax, 2
je 0x4043d4
mov byte [0x422598], 0
mov edx, dword [esp + 0x10]
push edx
mov byte [0x422997], 0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x422598
push 0x42c000
call dword [sym.imp.KERNEL32.dll_lstrcatA]
call fcn.00404cd0
mov eax, dword [0x425c28]
and eax, 0x20
mov dword [0x425c80], eax
mov eax, 0x42b400
call fcn.00407060
test eax, eax
jne 0x404527
mov ecx, dword [ebp + 0x48]
test ecx, ecx
je 0x404527
mov esi, dword [ebp + 0x4c]
mov eax, dword [0x425bf8]
lea edx, [esp + 0x10]
push edx
push 0x20019
add esi, eax
add eax, ecx
mov ecx, dword [ebp + 0x44]
push 0
push eax
push ecx
mov byte [0x424b80], 0
call ebx
test eax, eax
jne 0x40449b
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
push 0x424b80
lea ecx, [esp + 0x1c]
push ecx
push 0
push esi
push edx
mov dword [esp + 0x30], 0x400
call edi
test eax, eax
jne 0x404482
mov eax, dword [esp + 0x14]
cmp eax, 1
je 0x404489
cmp eax, 2
je 0x404489
mov byte [0x424b80], 0
mov eax, dword [esp + 0x10]
push eax
mov byte [0x424f7f], 0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [0x424b80]
test al, al
je 0x404527
cmp al, 0x22
mov esi, 0x424b80
jne 0x4044c2
mov esi, 0x424b81
mov bl, al
mov eax, esi
call fcn.00406f80
mov byte [eax], 0
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
call edi
lea eax, [eax + esi - 4]
cmp eax, esi
jbe 0x4044f8
push str..exe
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4044f8
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4044f3
test al, 0x10
jne 0x4044f8
call fcn.00406fa0
push esi
call edi
add eax, esi
push eax
push esi
call dword [sym.imp.USER32.dll_CharPrevA]
cmp byte [eax], 0x5c
je 0x404516
push 0x4092dc
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x400
push esi
push 0x42b400
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov eax, 0x42b400
call fcn.00407060
test eax, eax
jne 0x404546
mov ecx, dword [ebp + 0x118]
push ecx
push 0x42b400
call fcn.00407620
mov edx, dword [0x425bc8]
push 0x8040
xor ebx, ebx
push ebx
push ebx
push 1
push 0x67
push edx
call dword [sym.imp.USER32.dll_LoadImageA]
cmp dword [ebp + 0x50], 0xffffffff
mov edi, dword [sym.imp.USER32.dll_RegisterClassA]
mov dword [0x425388], eax
je 0x4045fe
mov ecx, dword [0x425bc8]
lea edx, [esp + 0x10]
push 0x424b40
mov dword [esp + 0x14], 0x624e5f
mov dword [0x424b44], 0x401000
mov dword [0x424b50], ecx
mov dword [0x424b54], eax
mov dword [0x424b64], edx
call edi
test ax, ax
je 0x404701
push ebx
lea eax, [esp + 0x24]
push eax
push ebx
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
mov ecx, dword [0x425bc8]
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x2c]
push ebx
push ecx
mov ecx, dword [esp + 0x28]
push ebx
push ebx
sub edx, eax
push edx
mov edx, dword [esp + 0x3c]
sub edx, ecx
push edx
push eax
push ecx
push 0x80000000
push ebx
lea eax, [esp + 0x38]
push eax
push 0x80
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x421994], eax
mov ecx, dword [0x425bcc]
mov edx, dword [ecx + 0x6c]
push ebx
push edx
call fcn.00401510
test eax, eax
je 0x40461f
mov dword [esp + 0x14], 2
jmp 0x404705
call fcn.00404cd0
cmp dword [0x425ca0], ebx
jne 0x4046c6
mov eax, dword [0x421994]
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.RichEd20
call esi
test eax, eax
jne 0x404656
push str.RichEd32
call esi
mov esi, dword [sym.imp.USER32.dll_GetClassInfoA]
push 0x424b40
push 0x4094d8
push ebx
call esi
test eax, eax
jne 0x40468b
push 0x424b40
push str.RichEdit
push ebx
call esi
push 0x424b40
mov dword [0x424b64], 0x4094d8
call edi
mov ecx, dword [0x425394]
mov eax, dword [0x425bc8]
push ebx
push 0x404e70
add ecx, 0x69
movzx edx, cx
push ebx
push edx
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
mov ecx, dword [0x425bcc]
mov edx, dword [ecx + 0x80]
push ebx
push edx
mov esi, eax
call fcn.00401510
mov dword [esp + 0x14], esi
jmp 0x404705
push ebx
call fcn.00406710
test eax, eax
je 0x4046f1
cmp dword [0x42538c], ebx
jne 0x4046e7
mov eax, dword [0x425bcc]
mov ecx, dword [eax + 0x74]
push ebx
push ecx
call fcn.00401510
mov dword [esp + 0x14], 2
jmp 0x404705
mov edx, dword [0x425bcc]
mov eax, dword [edx + 0x70]
push ebx
push eax
call fcn.00401510
mov dword [esp + 0x14], ebx
mov eax, dword [0x40b088]
cmp eax, 0xffffffff
je 0x404720
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x40b088], 0xffffffff
push 7
push 0x42c800
call fcn.00406cc0
call dword [sym.imp.ole32.dll_OleUninitialize]
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x404796
cmp dword [0x425ca0], 0
mov eax, 0x10
jne 0x40478e
cmp dword [0x425ca8], 0
je 0x404756
mov eax, 0x180010
mov edx, dword [0x425bc4]
mov dword [0x40b004], edx
mov edx, dword [0x425bc8]
push section..data
mov dword [0x40b008], edx
mov dword [0x40b00c], ecx
mov dword [0x40b010], 0x4253c0
mov dword [0x40b014], eax
call dword [sym.imp.USER32.dll_MessageBoxIndirectA]
push 2
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x425c94], 0
je 0x4048a3
mov esi, dword [str.ADVAPI32]
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push esi
call edi
test eax, eax
jne 0x4047c5
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
jne 0x4047c5
xor ebx, ebx
jmp 0x4047d5
mov ecx, dword [str.OpenProcessToken]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
mov esi, dword [str.ADVAPI32]
push esi
call edi
test eax, eax
jne 0x4047f1
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
jne 0x4047f1
xor edi, edi
jmp 0x404801
mov edx, dword [str.LookupPrivilegeValueA]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
mov esi, dword [str.ADVAPI32]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x404821
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
jne 0x404821
xor esi, esi
jmp 0x404831
mov ecx, dword [str.AdjustTokenPrivileges]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test ebx, ebx
je 0x404883
test edi, edi
je 0x404883
test esi, esi
je 0x404883
lea edx, [esp + 0x18]
push edx
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
test eax, eax
je 0x404883
lea eax, [esp + 0x24]
push eax
push str.SeShutdownPrivilege
push 0
call edi
mov edx, dword [esp + 0x18]
push 0
push 0
push 0
lea ecx, [esp + 0x2c]
push ecx
push 0
push edx
mov dword [esp + 0x38], 1
mov dword [esp + 0x44], 2
call esi
push 0
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x4048a3
push eax
mov eax, dword [0x425bcc]
mov ecx, dword [eax + 0x90]
push ecx
call fcn.00401510
mov eax, dword [0x425cac]
cmp eax, 0xffffffff
jne 0x4048b1
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]