Function at 0x40400b
Capabilities:
Accept command line arguments
Copy file
Delete file
Get common file path
Get file system object information
Set current directory
Set environment variable
Shutdown system
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x3e8
push 0x8001
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
xor esi, esi
lea edi, [esp + 0x18]
mov dword [edi + 0x14], esi
mov dword [edi + 0x118], esi
mov dword [edi + 0x114], esi
mov dword [edi], 0x11c
push edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x404076
mov dword [esp + 0x18], 0x114
push edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov byte [esp + 0x132], 4
movzx eax, word [esp + 0x46]
add eax, 0xffffffd0
cmp word [esp + 0x2c], 0x53
cmove esi, eax
mov word [esp + 0x12c], si
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
cmp eax, 9
ja 0x40408a
movzx ecx, cx
mov dword [esp + 0x24], ecx
mov edi, dword [0x40b054]
mov dword [edi + 0x38], ecx
movzx edx, byte [esp + 0x132]
mov ecx, dword [esp + 0x12c]
shl ecx, 8
mov esi, 0xffff
and ecx, esi
or ecx, edx
movzx edx, byte [esp + 0x20]
shl eax, 8
and eax, esi
or eax, edx
mov edx, eax
shl edx, 0x10
or edx, ecx
mov dword [edi + 0x3c], edx
cmp eax, 0x600
je 0x4040dd
push 0
call fcn.00406dd1
test eax, eax
je 0x4040dd
push 0xc00
call eax
mov esi, str.UXTHEME
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
call fcn.0040816e
push esi
call edi
add esi, eax
inc esi
cmp byte [esi], 0
jne 0x4040e8
push 0xb
call fcn.00406dd1
push 9
call fcn.00406dd1
mov dword [0x7beab4], eax
push 7
call fcn.00406dd1
test eax, eax
je 0x404128
push 0x1e
call eax
test eax, eax
je 0x404128
mov eax, dword [0x40b054]
or byte [eax + 0x3c], 0x80
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
xor ebx, ebx
push ebx
call dword [sym.imp.ole32.dll_OleInitialize]
mov ecx, dword [0x40b200]
mov dword [ecx], eax
lea eax, [esp + 0x134]
push ebx
push 0x2b4
push eax
push ebx
push 0x40b148
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push str.NSIS_Error
push 0x7beab8
call fcn.004072c6
mov eax, dword [0x40ae14]
mov esi, dword [eax]
lea edi, [esi + 0x50000]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
push edi
call fcn.004072c6
mov dword [esp], 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [0x7c6ab8], eax
xor eax, eax
cmp word [esi + 0x50000], 0x22
mov dword [esp + 4], esi
lea ecx, [esi + 0x50002]
sete al
mov dword [esp + 0x10], edi
cmovne ecx, edi
lea eax, [eax*2 + 0x20]
push eax
push ecx
call fcn.004073de
push eax
call dword [sym.imp.USER32.dll_CharNextW]
mov dword [esp + 0xc], eax
movzx edx, word [eax]
test dx, dx
je 0x4042b1
mov dword [esp], 0
mov ebx, 0x2f0020
mov eax, dword [esp + 0xc]
add eax, 2
cmp dx, 0x20
jne 0x4041f6
movzx edx, word [eax]
jmp 0x4041e8
movzx ecx, dx
cmp ecx, 0x22
jne 0x404207
movzx edx, word [eax]
mov cx, 0x22
jmp 0x40420e
add eax, 0xfffffffe
mov cx, 0x20
cmp dx, 0x2f
jne 0x404273
cmp word [eax + 2], 0x53
jne 0x404234
movzx edx, word [eax + 4]
test edx, 0xffdf
jne 0x404234
mov edx, dword [0x40b054]
mov dword [edx + 0x20], 1
lea edx, [eax + 2]
mov ebp, dword [edx + 4]
mov edi, 0x430052
xor ebp, edi
mov edi, dword [edx]
mov esi, 0x43004e
xor edi, esi
or edi, ebp
jne 0x40425e
movzx edi, word [eax + 0xa]
test edi, 0xffdf
jne 0x40425e
or dword [esp], 4
mov edi, dword [eax + 2]
mov esi, 0x3d0044
xor edi, esi
mov ebp, dword [eax - 2]
xor ebp, ebx
or ebp, edi
je 0x404297
mov eax, edx
movzx ecx, cx
push ecx
push eax
call fcn.004073de
xor ecx, ecx
cmp word [eax], 0x22
sete cl
lea eax, [eax + ecx*2]
movzx edx, word [eax]
test dx, dx
jne 0x4041e8
jmp 0x4042b1
mov word [eax - 2], 0
mov ecx, dword [esp + 4]
add ecx, 0x54000
add eax, 6
push eax
push ecx
call fcn.004072c6
mov esi, dword [esp + 4]
lea edi, [esi + 0x64000]
push edi
push 0x2000
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call fcn.00403fcc
test eax, eax
jne 0x404338
push 0x1ffb
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.Temp
push edi
call sub.KERNEL32.dll_lstrcatW
call fcn.00403fcc
test eax, eax
jne 0x404338
push edi
push 0x1ffc
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x40b16c
push edi
call sub.KERNEL32.dll_lstrcatW
mov esi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push edi
push str.TEMP
call esi
push edi
push 0x40b17e
call esi
mov esi, dword [esp + 4]
call fcn.00403fcc
test eax, eax
jne 0x404338
mov dword [esp], 0
mov ebx, 0x40b070
jmp 0x404387
lea eax, [esi + 0x60000]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [esp]
call fcn.00403a70
test eax, eax
jne 0x40437e
mov eax, dword [0x40b204]
cmp dword [eax], 0
jne 0x404465
mov eax, dword [0x40b054]
mov dword [eax + 0x2c], 0xffffffff
call fcn.00404742
mov dword [esp], eax
push 1
call fcn.00407ee1
xor ebx, ebx
jmp 0x404387
mov ebx, eax
mov dword [esp], 0
call fcn.0040460c
call dword [sym.imp.ole32.dll_OleUninitialize]
test ebx, ebx
jne 0x404452
mov eax, dword [0x40b054]
cmp dword [eax + 0x14], 0
je 0x40443a
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [esp + 0x14]
push ecx
push 0x28
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4043fb
lea edi, [esp + 0x138]
xor esi, esi
push edi
push str.SeShutdownPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov dword [edi - 4], 1
mov dword [edi + 8], 2
push esi
push esi
push esi
lea eax, [esp + 0x140]
push eax
push esi
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 4
call fcn.00406dd1
test eax, eax
je 0x404422
sub esp, 0x14
movaps xmm0, xmmword [0x40b060]
movups xmmword [esp], xmm0
mov dword [esp + 0x10], 0x80040002
call eax
test eax, eax
je 0x404433
push 0x80040002
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x40443a
push 9
call fcn.00403728
mov eax, dword [0x40b054]
mov eax, dword [eax + 0x2c]
cmp eax, 0xffffffff
mov ecx, dword [esp]
cmovne ecx, eax
push ecx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x200010
push ebx
call fcn.00406ead
push 2
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [esp], 0
mov dword [esp + 8], edi
push 0
mov edi, dword [esp + 0x14]
push edi
call fcn.004073de
cmp eax, edi
jb 0x4044a1
mov ebp, eax
mov eax, 0x3d003f
mov ecx, 0x5f0020
mov edx, dword [ebp + 4]
xor edx, eax
mov esi, dword [ebp]
xor esi, ecx
or esi, edx
je 0x4044fc
add ebp, 0xfffffffe
cmp ebp, edi
jae 0x40448c
call fcn.00406db7
mov ebp, eax
push str.nsu
mov edi, dword [esp + 0xc]
push edi
call sub.KERNEL32.dll_lstrcatW
test ebp, ebp
je 0x4044c6
push 0x40b1c4
push edi
call sub.KERNEL32.dll_lstrcatW
push 0x40b1c8
push edi
call sub.KERNEL32.dll_lstrcatW
mov eax, dword [esp + 4]
lea esi, [eax + 0x5c000]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov ebx, str.Error_launching_installer
test eax, eax
je 0x404387
test ebp, ebp
jne 0x40453b
push edi
call fcn.00406d99
jmp 0x404541
mov word [ebp], 0
add ebp, 8
push ebp
call fcn.0040722b
mov ebx, str.Error_launching_installer
test eax, eax
je 0x404387
mov esi, dword [esp + 4]
lea eax, [esi + 0x54000]
push ebp
push eax
call fcn.004072c6
add esi, 0x58000
push ebp
push esi
call fcn.004072c6
jmp 0x40435f
push edi
call fcn.00406d1c
push edi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov edi, dword [esp + 4]
cmp word [edi + 0x54000], 0
jne 0x404563
lea eax, [edi + 0x54000]
push esi
push eax
call fcn.004072c6
push dword [esp + 0xc]
push edi
call fcn.004072c6
mov dword [edi + 0x4000], 0x41
lea eax, [edi + 0x6c000]
mov dword [esp], eax
mov ebx, str.Error_launching_installer
mov edi, 0x1a
mov ebp, dword [0x40a004]
mov esi, 0x7c6abc
mov eax, dword [ebp]
push dword [eax + 0x120]
push esi
call fcn.004079d8
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test ebx, ebx
je 0x4045ec
push 1
push 0x7c6abc
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x4045ee
push 0
push esi
call fcn.00407358
mov eax, dword [ebp]
push dword [eax + 0x124]
push esi
call fcn.004079d8
push esi
call fcn.00406e0a
test eax, eax
je 0x4045ee
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
mov eax, dword [esp + 4]
inc word [eax + 0x4000]
dec edi
jne 0x404595
push 0
push dword [esp + 0xc]
call fcn.00407358
jmp 0x404380