Function at 0x4038ba
Capabilities:
Accept command line arguments
Check os version
Copy file
Delete file
Get common file path
Get file system object information
Set current directory
Shutdown system
Terminate process

Disassembly:
sub esp, 0x2d4
push ebx
push ebp
push esi
push edi
push 0x20
pop esi
xor ebp, ebp
push 0x8001
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x14], str.Error_writing_temporary_file._Make_sure_your_temp_folder_is_valid.
mov dword [esp + 0x18], ebp
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp ax, 6
je 0x403901
push ebp
call fcn.00406466
cmp eax, ebp
je 0x403901
push 0xc00
call eax
push str.UXTHEME
call fcn.0040640b
push str.USERENV
call fcn.0040640b
push str.SETUPAPI
call fcn.0040640b
push 0xd
call fcn.00406466
push 0xb
call fcn.00406466
mov dword [0x473df0], eax
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push ebp
call dword [sym.imp.ole32.dll_OleInitialize]
push ebp
push 0x2b4
mov dword [0x473ed8], eax
lea eax, [esp + 0x38]
push eax
push ebp
push 0x40a258
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push str.NSIS_Error
push 0x46bde0
call fcn.00406221
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
mov ebx, 0x4c40a0
push ebx
call fcn.00406221
push ebp
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp word [0x4c40a0], 0x22
mov dword [0x473df8], eax
mov eax, ebx
jne 0x40399c
push 0x22
pop esi
mov eax, 0x4c40a2
push esi
push eax
call fcn.00405ea8
push eax
call dword [sym.imp.USER32.dll_CharNextW]
mov esi, eax
mov dword [esp + 0x1c], esi
jmp 0x403a41
push 0x20
pop edi
cmp ax, di
jne 0x4039c4
inc esi
inc esi
cmp word [esi], di
je 0x4039bd
cmp word [esi], 0x22
jne 0x4039cf
inc esi
push 0x22
inc esi
pop edi
cmp word [esi], 0x2f
jne 0x403a30
inc esi
inc esi
cmp word [esi], 0x53
jne 0x4039f1
movzx eax, word [esi + 2]
cmp ax, 0x20
je 0x4039ec
cmp ax, bp
jne 0x4039f1
or dword [esp + 0x14], 2
push 4
push str.NCRC
push esi
call fcn.00403839
add esp, 0xc
test eax, eax
jne 0x403a19
movzx eax, word [esi + 8]
cmp ax, 0x20
je 0x403a14
cmp ax, bp
jne 0x403a19
or dword [esp + 0x14], 4
push 4
lea eax, [esi - 4]
push str.__D
push eax
call fcn.00403839
add esp, 0xc
test eax, eax
je 0x403a4f
push edi
push esi
call fcn.00405ea8
mov esi, eax
cmp word [esi], 0x22
jne 0x403a41
inc esi
inc esi
movzx eax, word [esi]
cmp ax, bp
jne 0x4039b5
jmp 0x403a6c
push 8
lea eax, [esi - 4]
push ebp
push eax
call fcn.004080be
add esp, 0xc
add esi, 4
push esi
push 0x4c80a8
call fcn.00406221
mov edi, 0x4d80c8
push edi
push 0x2004
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call fcn.00403808
test eax, eax
jne 0x403aaa
push 0x1fff
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.Temp
push edi
call sub.KERNEL32.dll_lstrcatW
call fcn.00403808
test eax, eax
je 0x403c51
push 0x4d40c0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [esp + 0x14]
call fcn.004035c3
mov dword [esp + 0x10], eax
cmp eax, ebp
jne 0x403c51
cmp dword [0x473e44], ebp
je 0x403b33
push ebp
push ebx
call fcn.00405ea8
mov esi, eax
jmp 0x403af3
push 4
push str.___
push esi
call fcn.00403839
add esp, 0xc
test eax, eax
je 0x403af7
dec esi
dec esi
cmp esi, ebx
jae 0x403add
mov dword [esp + 0x10], str.Error_launching_installer
cmp esi, ebx
jb 0x403b4f
xor eax, eax
mov word [esi], ax
add esi, 8
push esi
call fcn.00406904
test eax, eax
je 0x403c51
push esi
push 0x4c80a8
call fcn.00406221
push esi
push 0x4cc0b0
call fcn.00406221
mov dword [esp + 0x10], ebp
or dword [0x473ecc], 0xffffffff
call fcn.00405a2f
push 1
mov dword [esp + 0x1c], eax
call fcn.00406cc8
jmp 0x403c51
call fcn.00406890
push 0x40a204
push edi
mov esi, eax
call sub.KERNEL32.dll_lstrcatW
mov ebp, 0x40a200
test esi, esi
je 0x403b71
push ebp
push edi
call sub.KERNEL32.dll_lstrcatW
push str..tmp
push edi
call sub.KERNEL32.dll_lstrcatW
mov ebx, 0x4d00b8
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x403c4f
push edi
test esi, esi
je 0x403b9d
call fcn.00405d42
jmp 0x403ba2
call fcn.00405dc4
push edi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cmp word [0x4c80a8], 0
jne 0x403bbe
push ebx
push 0x4c80a8
call fcn.00406221
push dword [esp + 0x1c]
push section..ndata
call fcn.00406221
push ebp
push 0x478008
call fcn.00406221
push 0x1a
pop ebp
mov esi, 0x434208
mov eax, dword [0x473dfc]
push dword [eax + 0x120]
push esi
call fcn.00406a37
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor ebx, ebx
cmp dword [esp + 0x10], ebx
je 0x403c3e
push 1
push esi
push 0x4e00d8
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x403c3e
push ebx
push esi
call fcn.00406f9e
mov eax, dword [0x473dfc]
push dword [eax + 0x124]
push esi
call fcn.00406a37
push esi
call fcn.00405de1
cmp eax, ebx
je 0x403c3e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x10], ebx
inc word [0x478008]
dec ebp
jne 0x403bdf
push ebx
push edi
call fcn.00406f9e
xor ebp, ebp
call fcn.00403890
call dword [sym.imp.ole32.dll_OleUninitialize]
cmp dword [esp + 0x10], ebp
je 0x403c78
push 0x200010
push dword [esp + 0x14]
call fcn.00405e42
push 2
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x473eb4], ebp
je 0x403d1b
push 5
call fcn.00406466
push 6
mov ebx, eax
call fcn.00406466
push 7
mov esi, eax
call fcn.00406466
mov edi, eax
cmp ebx, ebp
je 0x403ceb
cmp esi, ebp
je 0x403ceb
cmp edi, ebp
je 0x403ceb
lea eax, [esp + 0x1c]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
test eax, eax
je 0x403ceb
lea eax, [esp + 0x24]
push eax
push str.SeShutdownPrivilege
push ebp
call esi
push ebp
push ebp
push ebp
lea eax, [esp + 0x2c]
push eax
push ebp
push dword [esp + 0x30]
mov dword [esp + 0x38], 1
mov dword [esp + 0x44], 2
call edi
push 8
call fcn.00406466
mov esi, 0x80040002
cmp eax, ebp
je 0x403d07
push esi
push 0x25
push ebp
push ebp
push ebp
call eax
test eax, eax
je 0x403d14
push esi
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x403d1b
push 9
call fcn.0040141d
mov eax, dword [0x473ecc]
cmp eax, 0xffffffff
je 0x403d29
mov dword [esp + 0x18], eax
push dword [esp + 0x18]
jmp 0x403c72