Function at 0x404a90
Capabilities:
Accept command line arguments
Copy file
Delete file
Get common file path
Get file system object information
Set current directory
Set environment variable
Shutdown system
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40cb80
push 0x409f68
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, 0x22d4
call fcn.00409ea0
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor eax, eax
mov dword [ebp - 0x28], eax
mov ebx, str.Error_writing_temporary_file._Make_sure_your_temp_folder_is_valid.
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x24], 0x20
push 0x8001
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov esi, str.UXTHEME
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
call fcn.00407930
push esi
call edi
inc esi
add esi, eax
cmp byte [esi], 0
jne 0x404af0
push 9
call fcn.00408260
push 7
call fcn.00408260
mov dword [0x437510], eax
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push 0
call dword [sym.imp.ole32.dll_OleInitialize]
mov dword [0x4395a0], eax
push 0
push 0x2b4
lea eax, [ebp - 0x2ec]
push eax
push 0
push 0x40c6d4
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push str.NSIS_Error
push 0x437520
call fcn.00408510
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
push 0x44f000
call fcn.00408510
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [0x437514], eax
mov eax, 0x44f000
cmp word [0x44f000], 0x22
jne 0x404b8a
mov dword [ebp - 0x24], 0x22
mov eax, 0x44f002
push dword [ebp - 0x24]
push eax
call fcn.00407e20
push eax
call dword [sym.imp.USER32.dll_CharNextW]
mov dword [ebp - 0x20], eax
movzx ecx, word [eax]
test cx, cx
je 0x404c5f
lea esp, [esp]
cmp cx, 0x20
jne 0x404bbf
add eax, 2
cmp word [eax], 0x20
je 0x404bb6
mov edx, 0x20
cmp word [eax], 0x22
jne 0x404bd2
add eax, 2
mov edx, 0x22
cmp word [eax], 0x2f
jne 0x404c2d
add eax, 2
cmp word [eax], 0x53
jne 0x404bf9
movzx ecx, word [eax + 2]
cmp ecx, 0x20
je 0x404bef
test cx, cx
jne 0x404bf9
mov dword [0x439620], 1
cmp dword [eax], 0x43004e
jne 0x404c1c
cmp dword [eax + 4], 0x430052
jne 0x404c1c
movzx ecx, word [eax + 8]
cmp ecx, 0x20
je 0x404c18
test cx, cx
jne 0x404c1c
or dword [ebp - 0x1c], 4
cmp dword [eax - 4], 0x2f0020
jne 0x404c2d
cmp dword [eax], 0x3d0044
je 0x404c4b
push edx
push eax
call fcn.00407e20
cmp word [eax], 0x22
jne 0x404c3d
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x404bb0
jmp 0x404c5f
xor ecx, ecx
mov word [eax - 4], cx
add eax, 4
push eax
push 0x450000
call fcn.00408510
push 0x454000
push 0x800
mov esi, dword [sym.imp.KERNEL32.dll_GetTempPathW]
call esi
push 0x454000
call fcn.00408730
push 0x454000
call fcn.00408840
test eax, eax
je 0x404cb4
push 0x454000
call fcn.00407d50
push 0x454000
call fcn.004075b0
push 0x454000
push 0x453000
call fcn.00408400
test eax, eax
jne 0x404d96
push 0x7fb
push 0x454000
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.Temp
push 0x454000
call sub.KERNEL32.dll_lstrcatW
push 0x454000
call fcn.00408730
push 0x454000
call fcn.00408840
test eax, eax
je 0x404d16
push 0x454000
call fcn.00407d50
push 0x454000
call fcn.004075b0
push 0x454000
push 0x453000
call fcn.00408400
test eax, eax
jne 0x404d96
push 0x454000
push 0x7fc
call esi
push 0x40c6fc
push 0x454000
call sub.KERNEL32.dll_lstrcatW
push 0x454000
push str.TEMP
mov esi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
call esi
push 0x454000
push 0x40c710
call esi
push 0x454000
call fcn.00408730
push 0x454000
call fcn.00408840
test eax, eax
je 0x405076
push 0x454000
call fcn.00407d50
push 0x454000
call fcn.004075b0
push 0x454000
push 0x453000
call fcn.00408400
test eax, eax
je 0x405076
push 0x453000
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
call edi
push dword [ebp - 0x1c]
call fcn.00404490
mov ebx, eax
test ebx, ebx
jne 0x405076
cmp dword [0x439538], eax
je 0x404e2c
push eax
push 0x44f000
call fcn.00407e20
mov esi, eax
cmp esi, 0x44f000
jb 0x404dee
cmp dword [esi], 0x5f0020
jne 0x404de3
cmp dword [esi + 4], 0x3d003f
je 0x404dee
sub esi, 2
cmp esi, 0x44f000
jae 0x404dd2
mov ebx, str.Error_launching_installer
mov dword [ebp - 0x24], ebx
cmp esi, 0x44f000
jb 0x404e42
xor eax, eax
mov word [esi], ax
add esi, 8
push esi
call fcn.00407e80
test eax, eax
je 0x405076
push esi
push 0x450000
call fcn.00408510
push esi
push 0x451000
call fcn.00408510
xor ebx, ebx
mov dword [0x43962c], 0xffffffff
call fcn.004071b0
mov edi, eax
jmp 0x405078
call fcn.00407d10
mov esi, eax
push str.nsu
push 0x454000
call sub.KERNEL32.dll_lstrcatW
test esi, esi
je 0x404e6b
push 0x40c724
push 0x454000
call sub.KERNEL32.dll_lstrcatW
push 0x40c728
push 0x454000
call sub.KERNEL32.dll_lstrcatW
push 0x452000
push 0x454000
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x405076
push 0x454000
test esi, esi
je 0x404ea2
call fcn.004075d0
jmp 0x404ea7
call fcn.004075b0
push 0x454000
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cmp word [0x450000], 0
jne 0x404ecb
push 0x452000
push 0x450000
call fcn.00408510
push dword [ebp - 0x20]
push section..ndata
call fcn.00408510
mov dword [0x43c000], 0x41
xor esi, esi
mov dword [ebp - 0x20], esi
cmp esi, 0x1a
jge 0x405065
mov eax, dword [0x439544]
push dword [eax + 0x120]
push 0x427230
call fcn.00407660
push 0x427230
call edi
test ebx, ebx
je 0x405058
push 1
push 0x427230
push 0x456000
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x405058
push 0
push 0x427230
call fcn.00407a00
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0
call fcn.004049c0
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xffffffff
jmp 0x404f79
push 0x427230
lea eax, [ebp - 0x22ec]
push eax
call fcn.00408510
push 0x40c734
lea eax, [ebp - 0x22ec]
push eax
call sub.KERNEL32.dll_lstrcatW
lea eax, [ebp - 0x22ec]
push eax
call edi
cmp dword [ebp - 0x1c], 0
je 0x40500e
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
lea eax, [ebp - 0x22ec]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40500e
mov dword [ebp - 0x20], 0
push 0
lea eax, [ebp - 0x20]
push eax
push 4
lea eax, [ebp - 0x1c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
lea eax, [ebp - 0x22ec]
cmp dword [ebp - 0x20], 4
je 0x405004
push eax
call edi
jmp 0x405014
push 0
push eax
call fcn.00407a00
jmp 0x405014
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x439544]
push dword [eax + 0x124]
push 0x427230
call fcn.00407660
push 0x427230
call fcn.00407fd0
test eax, eax
je 0x40504c
push eax
call ebx
xor ebx, ebx
mov dword [ebp - 0x24], ebx
inc word [0x43c000]
inc esi
jmp 0x404ee4
lea eax, [ebp - 0x22ec]
push eax
call edi
mov ebx, dword [ebp - 0x24]
inc word [0x43c000]
inc esi
jmp 0x404ee4
push 0
push 0x454000
call fcn.00407a00
mov edi, dword [ebp - 0x28]
jmp 0x405078
xor edi, edi
mov eax, dword [0x40e010]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, 0xffffffff
je 0x405095
push eax
call esi
mov dword [0x40e010], 0xffffffff
mov eax, dword [0x40e014]
cmp eax, 0xffffffff
je 0x4050ac
push eax
call esi
mov dword [0x40e014], 0xffffffff
call fcn.004051e0
push 7
push 0x455000
call fcn.00408030
call dword [sym.imp.ole32.dll_OleUninitialize]
test ebx, ebx
je 0x4050da
push 0x200010
push ebx
call fcn.00408480
push 2
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x439614], 0
je 0x405168
lea eax, [ebp - 0x28]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x405132
lea eax, [ebp - 0x34]
push eax
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x2c], 2
push 0
push 0
push 0
lea eax, [ebp - 0x38]
push eax
push 0
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 4
call fcn.00408260
test eax, eax
je 0x405150
push 0x80040002
push 0x25
push 0
push 0
push 0
call eax
test eax, eax
je 0x405161
push 0x80040002
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x405168
push 9
call fcn.00401490
cmp dword [0x43962c], 0xffffffff
cmovne edi, dword [0x43962c]
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]