Function at 0x404c90
Capabilities:
Accept command line arguments
Check if file exists
Copy file
Create directory
Delete file
Get common file path
Get file attributes
Get file system object information
Link many functions at runtime
Query or enumerate registry value
Set current directory
Set environment variable
Shutdown system
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18c
mov eax, dword [0x42419c]
xor eax, esp
mov dword [esp + 0x188], eax
push ebx
push esi
xor esi, esi
push edi
mov dword [esp + 0x10], esi
mov dword [esp + 0x1c], str.Error_writing_temporary_file._Make_sure_your_temp_folder_is_valid.
mov dword [esp + 0xc], esi
mov byte [esp + 0x1b], 0x20
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push 0x8001
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push esi
call dword [sym.imp.ole32.dll_OleInitialize]
mov edi, dword [str.SHFOLDER]
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push edi
mov dword [0x4436d8], eax
call ebx
cmp eax, esi
jne 0x404d03
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, esi
jne 0x404d03
xor eax, eax
jmp 0x404d11
mov ecx, dword [str.SHGetFolderPathA]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push esi
push 0x160
lea edx, [esp + 0x38]
push edx
push esi
push 0x4202ab
mov dword [0x4415a0], eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpynA]
push 0x400
push str.NSIS_Error
push 0x440da0
call edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0x400
push eax
push 0x449000
call edi
push esi
call ebx
cmp byte [0x449000], 0x22
mov dword [0x4415a8], eax
mov eax, 0x449000
jne 0x404d76
mov bl, 0x22
mov eax, 0x449001
jmp 0x404d7a
mov bl, byte [esp + 0x1b]
mov cl, byte [eax]
mov esi, dword [sym.imp.USER32.dll_CharNextA]
test cl, cl
je 0x404d93
cmp cl, bl
je 0x404d93
push eax
call esi
mov cl, byte [eax]
test cl, cl
jne 0x404d86
push eax
call esi
mov cl, byte [eax]
mov dword [esp + 0x14], eax
test cl, cl
je 0x404e42
mov edi, dword [esp + 0xc]
cmp cl, 0x20
jne 0x404db6
lea ecx, [ecx]
inc eax
cmp byte [eax], 0x20
je 0x404db0
cmp byte [eax], 0x22
mov bl, 0x20
jne 0x404dc0
inc eax
mov bl, 0x22
cmp byte [eax], 0x2f
jne 0x404e01
inc eax
cmp byte [eax], 0x53
jne 0x404de1
mov cl, byte [eax + 1]
cmp cl, 0x20
je 0x404dd7
test cl, cl
jne 0x404de1
mov dword [0x4436c0], 1
cmp dword [eax], 0x4352434e
jne 0x404df8
mov cl, byte [eax + 4]
cmp cl, 0x20
je 0x404df5
test cl, cl
jne 0x404df8
or edi, 4
cmp dword [eax - 2], 0x3d442f20
je 0x404e26
mov cl, byte [eax]
test cl, cl
je 0x404e14
cmp cl, bl
je 0x404e14
push eax
call esi
mov cl, byte [eax]
test cl, cl
jne 0x404e07
cmp byte [eax], 0x22
jne 0x404e1a
inc eax
mov cl, byte [eax]
test cl, cl
jne 0x404da8
mov dword [esp + 0xc], edi
jmp 0x404e42
mov byte [eax - 2], 0
push 0x400
add eax, 2
push eax
push 0x449400
mov dword [esp + 0x18], edi
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0x44a400
push 0x400
call ebx
call fcn.00404bf0
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
test eax, eax
jne 0x404ecb
push 0x3fb
push 0x44a400
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.Temp
push 0x44a400
call edi
call fcn.00404bf0
test eax, eax
jne 0x404ecb
push 0x44a400
push 0x3fc
call ebx
push 0x4202c0
push 0x44a400
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x44a400
push str.TEMP
call ebx
push 0x44a400
push 0x4202cc
call ebx
call fcn.00404bf0
test eax, eax
je 0x405545
push 0x44a000
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp + 0xc]
call fcn.00403630
mov dword [esp + 0x1c], eax
test eax, eax
jne 0x405545
cmp dword [0x441604], eax
je 0x404f7a
mov cl, byte [0x449000]
mov eax, 0x449000
test cl, cl
je 0x404f0f
push eax
call esi
mov cl, byte [eax]
test cl, cl
jne 0x404f06
mov ebx, eax
cmp eax, 0x449000
jb 0x404f29
cmp dword [ebx], 0x3d3f5f20
je 0x404f29
dec ebx
cmp ebx, 0x449000
jae 0x404f18
mov dword [esp + 0x1c], str.Error_launching_installer
cmp ebx, 0x449000
jb 0x404fe4
mov byte [ebx], 0
add ebx, 4
mov eax, ebx
call fcn.00407db0
test eax, eax
je 0x405545
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpynA]
push 0x400
push ebx
push 0x449400
call esi
push 0x400
push ebx
push 0x449800
call esi
mov dword [esp + 0x1c], 0
mov esi, dword [str.KERNEL32]
mov edi, dword [0x4415ac]
push esi
mov dword [0x4436cc], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x404fb0
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x4050fb
mov ecx, dword [str.GetUserDefaultUILanguage]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4050fb
call eax
movzx eax, ax
push eax
push 0x4209cc
push 0x44a000
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x405214
push str.nsu.tmp
push 0x44a400
call edi
push 0x449c00
push 0x44a400
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x405545
push 0
push 0x44a400
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0x44a400
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
cmp byte [0x449400], 0
jne 0x40503e
push 0x400
push 0x449c00
push 0x449400
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov eax, dword [esp + 0x14]
push 0x400
push eax
push section..ndata
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov ecx, 0x41
mov word [0x444400], cx
mov dword [esp + 0xc], 0x1a
mov edx, dword [0x4415ac]
mov eax, dword [edx + 0x120]
push eax
push 0x43b9d8
call fcn.00408330
push 0x43b9d8
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [esp + 0x1c], 0
je 0x4050dd
push 1
push 0x43b9d8
push 0x44ac00
call esi
test eax, eax
je 0x4050dd
xor edi, edi
mov ebx, 0x43b9d8
call fcn.004081d0
mov ecx, dword [0x4415ac]
mov edx, dword [ecx + 0x124]
push edx
push ebx
call fcn.00408330
mov ecx, ebx
call fcn.00407900
test eax, eax
je 0x4050dd
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x1c], edi
inc byte [0x444400]
sub dword [esp + 0xc], 1
jne 0x40506d
xor edi, edi
mov ebx, 0x44a400
call fcn.004081d0
jmp 0x405545
lea edx, [esp + 0xc]
push edx
push 0x20019
push 0
push str.Control_PanelDesktopResourceLocale
push 0x80000001
mov byte [0x44a000], 0x30
mov byte [0x44a001], 0x78
mov byte [0x44a002], 0
mov byte [0x43cdf8], 0
call ebx
test eax, eax
jne 0x405184
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x14]
push eax
push 0x43cdf8
lea ecx, [esp + 0x18]
push ecx
push 0
push 0
push edx
mov dword [esp + 0x2c], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40516b
mov eax, dword [esp + 0x10]
cmp eax, 1
je 0x405172
cmp eax, 2
je 0x405172
mov byte [0x43cdf8], 0
mov eax, dword [esp + 0xc]
push eax
mov byte [0x43d1f7], 0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [0x43cdf8], 0
jne 0x405204
lea ecx, [esp + 0xc]
push ecx
push 0x20019
push 0
push str..DEFAULTControl_PanelInternational
push 0x80000003
mov byte [0x43cdf8], 0
call ebx
test eax, eax
jne 0x405204
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x14]
push edx
push 0x43cdf8
lea eax, [esp + 0x18]
push eax
push 0
push 0x42030e
push ecx
mov dword [esp + 0x2c], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4051eb
mov eax, dword [esp + 0x10]
cmp eax, 1
je 0x4051f2
cmp eax, 2
je 0x4051f2
mov byte [0x43cdf8], 0
mov edx, dword [esp + 0xc]
push edx
mov byte [0x43d1f7], 0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x43cdf8
push 0x44a000
call dword [sym.imp.KERNEL32.dll_lstrcatA]
call fcn.00405910
mov eax, dword [0x441608]
and eax, 0x20
mov dword [0x4436a0], eax
mov eax, 0x449400
mov dword [0x4436bc], 0x10000
call fcn.00407db0
test eax, eax
jne 0x405353
mov ecx, dword [edi + 0x48]
test ecx, ecx
je 0x405353
mov esi, dword [edi + 0x4c]
mov eax, dword [0x4415d8]
lea edx, [esp + 0xc]
push edx
push 0x20019
add esi, eax
add eax, ecx
mov ecx, dword [edi + 0x44]
push 0
push eax
push ecx
mov byte [0x440560], 0
call ebx
test eax, eax
jne 0x4052c7
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x14]
push eax
push 0x440560
lea ecx, [esp + 0x18]
push ecx
push 0
push esi
push edx
mov dword [esp + 0x2c], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4052ae
mov eax, dword [esp + 0x10]
cmp eax, 1
je 0x4052b5
cmp eax, 2
je 0x4052b5
mov byte [0x440560], 0
mov eax, dword [esp + 0xc]
push eax
mov byte [0x44095f], 0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [0x440560]
test al, al
je 0x405353
mov esi, 0x440560
cmp al, 0x22
jne 0x4052ee
mov esi, 0x440561
mov bl, al
mov eax, esi
call fcn.00407cd0
mov byte [eax], 0
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
call ebx
lea eax, [eax + esi - 4]
cmp eax, esi
jbe 0x405324
push str..exe
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x405324
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40531f
test al, 0x10
jne 0x405324
call fcn.00407cf0
push esi
call ebx
add eax, esi
push eax
push esi
call dword [sym.imp.USER32.dll_CharPrevA]
cmp byte [eax], 0x5c
je 0x405342
push 0x420124
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x400
push esi
push 0x449400
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov eax, 0x449400
call fcn.00407db0
test eax, eax
jne 0x405372
mov ecx, dword [edi + 0x118]
push ecx
push 0x449400
call fcn.00408330
mov edx, dword [0x4415a8]
push 0x8040
xor esi, esi
push esi
push esi
push 1
push 0x67
push edx
call dword [sym.imp.USER32.dll_LoadImageA]
cmp dword [edi + 0x50], 0xffffffff
mov ebx, dword [sym.imp.USER32.dll_RegisterClassA]
mov dword [0x440d68], eax
je 0x405421
mov ecx, dword [0x4415a8]
push 0x440520
mov dword [0x440524], 0x401000
mov dword [0x440530], ecx
mov dword [0x440534], eax
mov dword [0x440544], 0x420348
call ebx
test ax, ax
je 0x405541
push esi
lea edx, [esp + 0x24]
push edx
push esi
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
mov eax, dword [0x4415a8]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
push esi
push eax
mov eax, dword [esp + 0x2c]
push esi
push esi
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x34]
sub edx, ecx
push edx
push eax
push ecx
push 0x80000000
push esi
push 0x420348
push 0x80
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x43c1f0], eax
mov eax, dword [0x4415ac]
mov ecx, dword [eax + 0x6c]
push esi
push ecx
call fcn.00401620
test eax, eax
je 0x405441
mov dword [esp + 0x10], 2
jmp 0x405545
call fcn.00405910
cmp dword [0x4436c0], esi
jne 0x405506
mov edx, dword [0x43c1f0]
push 5
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.RichEd20
call esi
test eax, eax
jne 0x405479
push str.RichEd32
call esi
mov esi, dword [sym.imp.USER32.dll_GetClassInfoA]
push 0x440520
push str.RichEdit20A
push 0
call esi
test eax, eax
jne 0x4054af
push 0x440520
push str.RichEdit
push eax
call esi
push 0x440520
mov dword [0x440544], 0x420364
call ebx
mov eax, dword [0x440d74]
mov edx, dword [0x4415a8]
push 0
push 0x405aa0
add eax, 0x69
movzx ecx, ax
push 0
push ecx
push edx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
mov ebx, eax
mov eax, dword [0x4415ac]
mov ecx, dword [eax + 0x80]
push 0
push ecx
call fcn.00401620
mov esi, dword [0x43f3a0]
test esi, esi
je 0x405500
mov edx, dword [esi + 4]
push 1
call edx
mov esi, dword [esi]
add esp, 4
test esi, esi
jne 0x4054f0
mov dword [esp + 0x10], ebx
jmp 0x405545
push esi
call fcn.00407420
test eax, eax
je 0x405531
cmp dword [0x440d6c], esi
jne 0x405527
mov eax, dword [0x4415ac]
mov ecx, dword [eax + 0x74]
push esi
push ecx
call fcn.00401620
mov dword [esp + 0x10], 2
jmp 0x405545
mov edx, dword [0x4415ac]
mov eax, dword [edx + 0x70]
push esi
push eax
call fcn.00401620
mov dword [esp + 0x10], esi
mov eax, dword [0x4255bc]
cmp eax, 0xffffffff
je 0x405560
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4255bc], 0xffffffff
call fcn.00405710
push 7
push 0x44a800
call fcn.00407a30
call dword [sym.imp.ole32.dll_OleUninitialize]
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x4055db
cmp dword [0x4436c0], 0
mov eax, 0x10
jne 0x4055d3
cmp dword [0x4436c8], 0
je 0x40559b
mov eax, 0x180010
mov edx, dword [0x4415a4]
mov dword [0x425538], edx
mov edx, dword [0x4415a8]
push 0x425534
mov dword [0x42553c], edx
mov dword [0x425540], ecx
mov dword [0x425544], 0x440da0
mov dword [0x425548], eax
call dword [sym.imp.USER32.dll_MessageBoxIndirectA]
push 2
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x4436b4], 0
je 0x4056f2
mov ebx, dword [str.ADVAPI32]
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x40560a
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
jne 0x40560a
mov dword [esp + 0xc], eax
jmp 0x40561c
mov ecx, dword [str.OpenProcessToken]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 0xc], eax
mov ebx, dword [str.ADVAPI32]
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x40563c
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
jne 0x40563c
xor esi, esi
jmp 0x40564c
mov edx, dword [str.LookupPrivilegeValueA]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov ebx, dword [str.ADVAPI32]
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x40566c
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
jne 0x40566c
xor edi, edi
jmp 0x40567c
mov ecx, dword [str.AdjustTokenPrivileges]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
mov ebx, dword [esp + 0xc]
test ebx, ebx
je 0x4056d2
test esi, esi
je 0x4056d2
test edi, edi
je 0x4056d2
lea edx, [esp + 0x14]
push edx
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
test eax, eax
je 0x4056d2
lea eax, [esp + 0x24]
push eax
push str.SeShutdownPrivilege
push 0
call esi
mov edx, dword [esp + 0x14]
push 0
push 0
push 0
lea ecx, [esp + 0x2c]
push ecx
push 0
push edx
mov dword [esp + 0x38], 1
mov dword [esp + 0x44], 2
call edi
push 0
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x4056f2
push eax
mov eax, dword [0x4415ac]
mov ecx, dword [eax + 0x90]
push ecx
call fcn.00401620
mov eax, dword [0x4436cc]
cmp eax, 0xffffffff
jne 0x405700
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]