Function at 0x14000443d
Capabilities:
Accept command line arguments
Copy file
Delete file
Get common file path
Get file attributes
Get file system object information
Set current directory
Set environment variable
Shutdown system
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x448
mov ecx, 0x8001
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
lea rcx, [rsp + 0x6c]
mov dword [rsp + 0x6c], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov rsi, qword [0x140010c90]
mov eax, dword [rsp + 0x78]
mov edx, dword [rsp + 0x70]
movzx ecx, byte [rsp + 0x180]
mov dword [rsi + 0x38], eax
movzx eax, byte [rsp + 0x74]
shl edx, 8
shl ecx, 8
or eax, edx
movzx edx, byte [rsp + 0x186]
shl eax, 0x10
or edx, ecx
movzx edx, dx
or eax, edx
mov dword [rsi + 0x3c], eax
shr eax, 0x10
cmp ax, 0x600
je 0x1400044c6
xor ecx, ecx
call fcn.1400095b6
test rax, rax
je 0x1400044c6
mov ecx, 0xc00
call rax
mov rdi, qword [sym.imp.KERNEL32.dll_lstrlenA]
lea rbx, str.UXTHEME
cmp byte [rbx], 0
je 0x1400044ef
mov rcx, rbx
call fcn.14000952d
mov rcx, rbx
call rdi
inc eax
cdqe
add rbx, rax
jmp 0x1400044d4
mov ecx, 8
call fcn.1400095b6
mov ecx, 6
call fcn.1400095b6
mov qword [0x1400312a8], rax
call qword [sym.imp.COMCTL32.dll_InitCommonControls]
xor ecx, ecx
call qword [sym.imp.ole32.dll_OleInitialize]
mov rdx, qword [0x140010ce0]
mov r9d, 0x2b8
lea rcx, [0x14000e17a]
mov dword [rdx], eax
lea rax, [rsp + 0x188]
xor edx, edx
mov r8, rax
mov dword [rsp + 0x20], edx
xor edx, edx
mov qword [rsp + 0x48], rax
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea rdx, str.NSIS_Error
lea rcx, [0x1400312c0]
call fcn.140008c13
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdx, rax
mov rax, qword [0x140010d30]
mov rbx, qword [rax]
lea rbp, [rbx + 0x28000]
mov rcx, rbp
call fcn.140008c13
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
movzx edx, word [rbx + 0x28000]
lea rcx, [rbx + 0x28002]
mov qword [0x1400312b0], rax
cmp dx, 0x22
je 0x1400045ac
mov rcx, rbp
mov edx, 0x20
call main
xor r14d, r14d
movabs r13, 0x4300520043004e
movabs r15, 0x3d0044002f0020
mov rcx, rax
call qword [sym.imp.USER32.dll_CharNextW]
mov rdi, rax
mov rcx, rax
cmp word [rcx], 0
je 0x140004673
movzx edx, word [rcx]
cmp dx, 0x20
jne 0x1400045f0
add rcx, 2
jmp 0x1400045e1
cmp dx, 0x22
jne 0x1400045fc
add rcx, 2
jmp 0x140004601
mov edx, 0x20
cmp word [rcx], 0x2f
jne 0x140004658
cmp word [rcx + 2], 0x53
lea rax, [rcx + 2]
jne 0x140004621
test word [rcx + 4], 0xffdf
jne 0x140004621
mov dword [rsi + 0x20], 1
cmp qword [rcx + 2], r13
jne 0x140004637
test word [rcx + 0xa], 0xffdf
mov r8d, 4
cmove r14d, r8d
cmp qword [rcx - 2], r15
jne 0x140004655
mov word [rcx - 2], 0
lea rdx, [rcx + 6]
lea rcx, [rbx + 0x2a000]
call fcn.140008c13
jmp 0x140004673
mov rcx, rax
call main
cmp word [rax], 0x22
mov rcx, rax
jne 0x1400045d7
add rcx, 2
jmp 0x1400045d7
lea rax, [rbx + 0x32000]
mov ecx, 0x1000
mov r13, qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov rdx, rax
mov qword [rsp + 0x30], rax
call r13
call fcn.140004380
test rax, rax
jne 0x14000472e
mov rcx, qword [rsp + 0x30]
mov edx, 0xffb
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov rcx, qword [rsp + 0x30]
lea rdx, str.Temp
call sub.KERNEL32.dll_lstrcatW
call fcn.140004380
test rax, rax
jne 0x14000472e
mov rdx, qword [rsp + 0x30]
mov ecx, 0xffc
call r13
mov rcx, qword [rsp + 0x30]
lea rdx, [0x14000e19e]
call sub.KERNEL32.dll_lstrcatW
mov rdx, qword [rsp + 0x30]
lea rcx, str.TEMP
mov r13, qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
call r13
mov rdx, qword [rsp + 0x30]
lea rcx, [0x14000e1b0]
call r13
call fcn.140004380
test rax, rax
jne 0x14000472e
call fcn.1400043d9
lea r14, str.Error_writing_temporary_file._Make_sure_your_temp_folder_is_valid.
call qword [sym.imp.ole32.dll_OleUninitialize]
jmp 0x1400049ad
lea rcx, [rbx + 0x30000]
mov r13, qword [sym.imp.KERNEL32.dll_DeleteFileW]
call r13
mov ecx, r14d
call fcn.14000402f
mov r14, rax
test rax, rax
jne 0x14000498e
mov rax, qword [0x140010d00]
cmp dword [rax], 0
je 0x140004969
xor edx, edx
mov rcx, rbp
call main
movabs rdx, 0x3d003f005f0020
cmp rax, rbp
jb 0x1400047c3
cmp qword [rax], rdx
je 0x140004787
sub rax, 2
jmp 0x140004777
mov word [rax], 0
lea rdi, [rax + 8]
mov rcx, rdi
call fcn.1400091ec
test eax, eax
je 0x14000499b
lea rcx, [rbx + 0x2a000]
mov rdx, rdi
call fcn.140008c13
lea rcx, [rbx + 0x2c000]
mov rdx, rdi
call fcn.140008c13
jmp 0x140004969
call fcn.140009610
mov rcx, qword [rsp + 0x30]
mov r12d, eax
call sub.KERNEL32.dll_lstrlenW
mov rdx, rdi
mov rcx, rbx
movsxd rbp, eax
lea rax, [rbx + 0xa000]
mov qword [rsp + 0x38], rax
lea rax, [rbx + 0xc000]
mov qword [rsp + 0x40], rax
call fcn.140008c13
cmp word [rbx + 0x2a000], 0
jne 0x140004818
lea rdx, [rbx + 0x2e000]
lea rcx, [rbx + 0x2a000]
call fcn.140008c13
lea rax, [rbx + rbp*2 + 0x32000]
mov r15, qword [sym.imp.USER32.dll_wsprintfW]
mov edi, 1
mov r14, qword [0x140010cd0]
mov qword [rsp + 0x50], rax
movzx eax, di
xor ebp, ebp
mov dword [rsp + 0x5c], eax
mov r8d, dword [rsp + 0x5c]
mov rcx, qword [rsp + 0x50]
lea rdx, str.nsu_X.tmp
call r15
mov rax, qword [r14]
mov rcx, qword [rsp + 0x38]
mov edx, dword [rax + 0x140]
call fcn.140009635
mov rcx, qword [rsp + 0x30]
test r12d, r12d
je 0x140004879
call fcn.140008436
jmp 0x14000487e
call fcn.14000849b
test eax, eax
je 0x1400048c8
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
bt eax, 0xa
jb 0x14000495e
mov rcx, qword [rsp + 0x38]
call r13
test eax, eax
je 0x14000495e
mov rcx, qword [rsp + 0x30]
mov edx, 1
call fcn.14000928e
test ebp, ebp
jne 0x14000495e
mov ebp, 1
jmp 0x140004841
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov rcx, qword [rsp + 0x30]
xor edx, edx
call fcn.1400089a9
mov rdx, qword [rsp + 0x38]
lea rcx, [rbx + 0x36000]
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x14000499b
mov rcx, qword [rsp + 0x38]
xor edx, edx
call fcn.1400089a9
mov rax, qword [r14]
mov rcx, qword [rsp + 0x40]
mov edx, dword [rax + 0x144]
call fcn.140009635
mov rcx, qword [rsp + 0x40]
call fcn.1400084bd
mov rcx, rax
test rax, rax
je 0x140004945
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
call fcn.1400043d9
call qword [sym.imp.ole32.dll_OleUninitialize]
jmp 0x1400049c4
test ebp, ebp
jne 0x14000499b
mov rcx, qword [rsp + 0x38]
call fcn.1400091bd
test rax, rax
je 0x1400048be
jmp 0x14000499b
inc di
jne 0x140004838
jmp 0x14000499b
mov dword [rsi + 0x2c], 0xffffffff
call fcn.140006029
mov ecx, 1
mov ebx, eax
call fcn.140008e02
call fcn.1400043d9
call qword [sym.imp.ole32.dll_OleUninitialize]
jmp 0x1400049c4
call fcn.1400043d9
call qword [sym.imp.ole32.dll_OleUninitialize]
jmp 0x1400049ad
call fcn.1400043d9
lea r14, str.Error_launching_installer
call qword [sym.imp.ole32.dll_OleUninitialize]
mov rcx, r14
mov edx, 0x200010
call fcn.14000855f
mov ecx, 2
jmp 0x140004a8e
cmp dword [rsi + 0x14], 0
je 0x140004a83
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x60]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140004a39
lea r8, [rsp + 0x18c]
lea rdx, str.SeShutdownPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
xor eax, eax
mov r8, qword [rsp + 0x48]
xor r9d, r9d
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x60]
xor edx, edx
mov dword [rsp + 0x188], 1
mov dword [rsp + 0x194], 2
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov ecx, 1
call fcn.1400095b6
test rax, rax
jne 0x140004a5e
mov edx, 0x80040002
mov ecx, 2
call qword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
je 0x140004a79
jmp 0x140004a83
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0x80040002
mov r9d, 0x25
call rax
test eax, eax
jne 0x140004a48
mov ecx, 9
call fcn.140003b64
mov eax, dword [rsi + 0x2c]
cmp eax, 0xffffffff
cmovne ebx, eax
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_ExitProcess]