Function at 0x404091
Capabilities:
Accept command line arguments
Check for time delay via gettickcount
Copy file
Delete file
Get common file path
Get file size
Terminate process

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [0x409290]
add eax, 0x3e8
mov dword [esp + 0x14], eax
mov bl, 0x20
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
mov edi, 0x400
push 0x42bf80
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
push dword [0x409290]
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
cmp byte [esi], 0x22
jne 0x4040e3
add bl, 2
inc esi
mov al, byte [esi]
mov ebp, dword [sym.imp.USER32.dll_CharNextA]
test al, al
je 0x404108
cmp al, bl
je 0x4040fe
push esi
call ebp
mov esi, eax
mov al, byte [esi]
test al, al
jne 0x4040ef
cmp byte [esi], 0
je 0x404108
push esi
call ebp
mov esi, eax
mov dword [esp + 0x18], esi
jmp 0x404113
push esi
call ebp
mov esi, eax
cmp byte [esi], 0x20
je 0x40410e
cmp byte [esi], 0x2f
jne 0x404168
inc esi
cmp byte [esi], 0x53
jne 0x404132
mov al, byte [esi + 1]
or al, 0x20
cmp al, 0x20
jne 0x404132
inc byte [0x422e98]
cmp dword [esi], 0x4352434e
jne 0x404149
mov al, byte [esi + 4]
or al, 0x20
cmp al, 0x20
jne 0x404149
inc byte [0x422e99]
cmp word [esi], 0x3d44
jne 0x4041c2
and byte [esi - 2], 0
add esi, 2
push esi
push dword [0x409294]
call sub.KERNEL32.dll_lstrcpyA
mov esi, 0x40c468
push str.NSIS_ERROR
push 0x42c3c0
call sub.KERNEL32.dll_lstrcpyA
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push edi
mov dword [0x425360], eax
push dword [0x40929c]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 3
push 0x80000000
push dword [0x40929c]
call fcn.00406840
cmp eax, 0xffffffff
mov dword [0x42cbd4], eax
jne 0x4041cf
mov dword [0x422038], str.Error_launching_installer
jmp 0x404450
push esi
call ebp
mov esi, eax
mov al, byte [esi]
or al, 0x20
cmp al, 0x20
jne 0x4041bd
jmp 0x404113
push dword [0x40929c]
call fcn.004066bb
push 0
push dword [0x42cbd4]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
mov dword [0x42cbcc], eax
test edi, edi
jle 0x404338
mov ebx, 0x422ea0
mov eax, 0x200
mov ebp, edi
cmp edi, eax
jbe 0x404209
mov ebp, eax
push ebp
push 0x422040
call fcn.00403fc9
test eax, eax
je 0x404315
cmp dword [0x42cbc4], 0
jne 0x404288
push 0x422040
call fcn.00403d1a
test eax, eax
je 0x4042ca
mov ecx, dword [0x42cbc0]
cmp eax, edi
mov dword [0x42cbc4], ecx
jg 0x404352
mov cl, byte [0x422040]
test cl, 4
je 0x40425c
inc byte [0x422e98]
cmp byte [0x422e99], 0
je 0x40426e
test cl, 8
je 0x404338
test cl, 1
je 0x404338
inc byte [0x422240]
lea edi, [eax - 4]
cmp ebp, edi
jbe 0x4042ca
mov ebp, edi
jmp 0x4042ca
cmp byte [0x422e98], 0
jne 0x4042ca
cmp dword [0x422690], 0
jne 0x404301
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [esp + 0x14]
jbe 0x4042ca
push str.verifying_installer:__d__
push 0x404014
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0x6f
push dword [0x425360]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov dword [0x422690], eax
cmp edi, dword [0x42cbcc]
jge 0x4042e8
push ebp
push 0x422040
push dword [0x422648]
call fcn.004021f5
mov dword [0x422648], eax
add dword [0x42cbc0], ebp
sub edi, ebp
test edi, edi
jg 0x4041fc
jmp 0x404338
push ebx
call dword [sym.imp.USER32.dll_DispatchMessageA]
xor eax, eax
push 1
push eax
push eax
push eax
push ebx
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x4042fa
jmp 0x4042ca
mov eax, dword [0x422690]
mov dword [0x422038], 0x4090d0
test eax, eax
je 0x404436
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
jmp 0x404436
mov eax, dword [0x422690]
xor edi, edi
cmp eax, edi
je 0x40434a
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
cmp dword [0x42cbc4], edi
jne 0x404361
mov dword [0x422038], str.Installer_corrupted_or_incomplete._r_n_r_nThis_could_be_the_result_of_a_failed_download_or_corruption_from_a_virus._r_n_r_nIf_desperate__try_the__NCRC_command_line_switch__NOT_recommended_
jmp 0x404436
cmp byte [0x422240], 0
je 0x404391
push edi
push dword [0x42cbc0]
call fcn.00403ffb
lea eax, [esp + 0x14]
push 4
push eax
call fcn.00403fc9
test eax, eax
je 0x404352
mov eax, dword [0x422648]
cmp eax, dword [esp + 0x14]
jne 0x404352
push edi
push dword [0x42cbc4]
call fcn.00403ffb
call fcn.00403d54
cmp eax, edi
mov dword [0x422038], eax
jne 0x404436
xor eax, eax
cmp dword [0x42c3a8], eax
je 0x404418
cmp byte [esi], al
mov edi, esi
je 0x4043cd
inc edi
cmp byte [edi], 0
jne 0x4043bf
cmp edi, esi
jb 0x404492
cmp byte [edi], 0x5f
jne 0x4043de
cmp byte [edi + 1], 0x3f
jne 0x4043de
cmp byte [edi + 2], 0x3d
je 0x4043e3
dec edi
cmp edi, esi
jae 0x4043cd
cmp edi, esi
jb 0x404492
and byte [edi - 1], 0
add edi, 3
push edi
call fcn.0040673a
test eax, eax
je 0x4045a5
push edi
push dword [0x409294]
call sub.KERNEL32.dll_lstrcpyA
push edi
push dword [0x409298]
call sub.KERNEL32.dll_lstrcpyA
mov eax, dword [0x42c39c]
cmp byte [eax + 0x42], 0
jne 0x40442c
mov cl, byte [0x422e98]
mov byte [eax + 0x42], cl
call fcn.004045b4
mov dword [0x422e9c], eax
mov eax, dword [0x42cbd4]
cmp eax, 0xffffffff
je 0x404447
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x422038], 0
je 0x40445d
push 0x10
push dword [0x422038]
call fcn.004065f8
cmp byte [0x40c068], 0
pop edi
pop esi
pop ebp
pop ebx
je 0x404476
push 1
push 0x40c068
call fcn.00406623
mov eax, dword [0x42c3b4]
test eax, eax
je 0x404486
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push dword [0x422e9c]
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov ebx, 0x422699
mov esi, 0x422698
mov ebp, 0x422248
push 0x42bf80
push ebx
mov byte [0x422698], 0x22
call sub.KERNEL32.dll_lstrcpyA
push str.ANSISu_.exe
push esi
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [esp + 0x14], 0
jne 0x404585
push 0x400
push ebp
push dword [0x425360]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [eax + 0x42223d]
push 0x40918d
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x4045a5
push 0
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x404585
push 0
push ebx
call fcn.0040685c
mov eax, dword [0x409294]
cmp byte [eax], 0
je 0x404530
push eax
push ebp
call sub.KERNEL32.dll_lstrcpyA
jmp 0x404536
push ebp
call fcn.004066bb
push ebp
call fcn.0040673a
test eax, eax
je 0x4045a5
push 0x4091c0
push esi
mov dword [esp + 0x1c], 1
call edi
push dword [esp + 0x18]
push esi
call edi
push str.___
push esi
call edi
push ebp
push esi
call edi
push 0x42bf80
push esi
call fcn.00406582
test eax, eax
je 0x40457b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x404585
mov eax, dword [str.Error_launching_installer]
mov dword [0x422038], eax
inc byte [str.ANSISu_.exe]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x1a
jl 0x4044af
cmp dword [esp + 0x14], 0
jne 0x404436
mov eax, dword [str.Error_launching_installer]
mov dword [0x422038], eax
jmp 0x404436