Function at 0x403404
Capabilities:
Accept command line arguments
Copy file
Create directory
Create process on windows
Delete file
Get common file path
Get file system object information
Set current directory
Shutdown system
Terminate process

Disassembly:
sub esp, 0x2d4
push ebx
push ebp
push esi
push edi
push 0x20
xor ebp, ebp
pop esi
mov dword [esp + 0x18], ebp
mov dword [esp + 0x10], str.Error_writing_temporary_file._Make_sure_your_temp_folder_is_valid.
mov dword [esp + 0x14], ebp
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push 0x8001
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push ebp
call dword [sym.imp.ole32.dll_OleInitialize]
push 8
mov dword [0x42a5d8], eax
call fcn.00405bc6
push ebp
push 0x2b4
mov dword [0x42a4e0], eax
lea eax, [esp + 0x38]
push eax
push ebp
push 0x40845c
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push 0x40844c
push 0x4294e0
call fcn.00405ac1
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
mov edi, 0x435000
push edi
call fcn.00405ac1
push ebp
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp word [0x435000], 0x22
mov dword [0x42a4e8], eax
mov eax, edi
jne 0x4034a4
push 0x22
pop esi
mov eax, 0x435002
push esi
push eax
call fcn.004057be
push eax
call dword [sym.imp.USER32.dll_CharNextW]
mov esi, eax
mov dword [esp + 0x1c], esi
jmp 0x40354b
push 0x20
pop ebx
cmp ax, bx
jne 0x4034cd
add esi, 2
cmp word [esi], bx
je 0x4034c5
cmp word [esi], 0x22
jne 0x4034d9
push 0x22
add esi, 2
pop ebx
cmp word [esi], 0x2f
jne 0x403539
add esi, 2
cmp word [esi], 0x53
jne 0x4034fb
movzx eax, word [esi + 2]
cmp eax, 0x20
je 0x4034f6
cmp ax, bp
jne 0x4034fb
or dword [esp + 0x14], 2
push 4
push str.NCRC
push esi
call fcn.00403381
add esp, 0xc
test eax, eax
jne 0x403522
movzx eax, word [esi + 8]
cmp eax, 0x20
je 0x40351d
cmp ax, bp
jne 0x403522
or dword [esp + 0x14], 4
push 4
lea eax, [esi - 4]
push str.__D
push eax
call fcn.00403381
add esp, 0xc
test eax, eax
je 0x403559
push ebx
push esi
call fcn.004057be
mov esi, eax
cmp word [esi], 0x22
jne 0x40354b
add esi, 2
movzx eax, word [esi]
cmp ax, bp
jne 0x4034bd
jmp 0x403576
push 8
lea eax, [esi - 4]
push ebp
push eax
call fcn.004075c8
add esp, 0xc
add esi, 4
push esi
push 0x435800
call fcn.00405ac1
mov ebx, 0x437800
push ebx
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call fcn.0040334d
test eax, eax
jne 0x4035b4
push 0x3fb
push ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.Temp
push ebx
call sub.KERNEL32.dll_lstrcatW
call fcn.0040334d
test eax, eax
je 0x40364a
push 0x437000
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [esp + 0x14]
call fcn.00403108
mov dword [esp + 0x10], eax
cmp eax, ebp
jne 0x40364a
cmp dword [0x42a544], ebp
je 0x40363a
push ebp
push edi
call fcn.004057be
mov esi, eax
jmp 0x4035fa
push 4
push 0x40841c
push esi
call fcn.00403381
add esp, 0xc
test eax, eax
je 0x4035fe
sub esi, 2
cmp esi, edi
jae 0x4035e3
mov dword [esp + 0x10], str.Error_launching_installer
cmp esi, edi
jb 0x40368e
xor eax, eax
mov word [esi], ax
add esi, 8
push esi
call fcn.00406049
test eax, eax
je 0x40364a
push esi
push 0x435800
call fcn.00405ac1
push esi
push 0x436000
call fcn.00405ac1
mov dword [esp + 0x10], ebp
or dword [0x42a5cc], 0xffffffff
call fcn.00405403
mov dword [esp + 0x18], eax
call fcn.004033da
call dword [sym.imp.ole32.dll_OleUninitialize]
cmp dword [esp + 0x10], ebp
je 0x403765
push 0x400011
push dword [esp + 0x14]
call fcn.00405758
cmp eax, 1
jne 0x403686
push eax
push ebp
push ebp
push str.http:__www.uc.cn_
push str.open
push ebp
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 2
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x4083d8
push ebx
call sub.KERNEL32.dll_lstrcatW
mov esi, 0x436800
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x40364a
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push ebx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cmp word [0x435800], bp
jne 0x4036cd
push esi
push 0x435800
call fcn.00405ac1
push dword [esp + 0x1c]
push section..ndata
call fcn.00405ac1
push 0x4083d4
push 0x42b800
call fcn.00405ac1
push 0x1a
pop edi
mov esi, 0x4209a0
mov eax, dword [0x42a4ec]
push dword [eax + 0x120]
push esi
call fcn.004060d0
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [esp + 0x10], ebp
je 0x40374f
push 1
push esi
push 0x438800
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x40374f
push ebp
push esi
call fcn.00406530
mov eax, dword [0x42a4ec]
push dword [eax + 0x124]
push esi
call fcn.004060d0
push esi
call fcn.004056f7
cmp eax, ebp
je 0x40374f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x10], ebp
inc word [0x42b800]
dec edi
jne 0x4036f2
push ebp
push ebx
call fcn.00406530
jmp 0x40364a
cmp dword [0x42a5b4], ebp
je 0x4037e8
push 3
call fcn.00405bc6
push 4
mov ebx, eax
call fcn.00405bc6
push 5
mov esi, eax
call fcn.00405bc6
mov edi, eax
cmp ebx, ebp
je 0x4037d4
cmp esi, ebp
je 0x4037d4
cmp edi, ebp
je 0x4037d4
lea eax, [esp + 0x1c]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
test eax, eax
je 0x4037d4
lea eax, [esp + 0x24]
push eax
push str.SeShutdownPrivilege
push ebp
call esi
push ebp
push ebp
push ebp
lea eax, [esp + 0x2c]
push eax
push ebp
push dword [esp + 0x30]
mov dword [esp + 0x38], 1
mov dword [esp + 0x44], 2
call edi
push ebp
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x4037e8
push 9
call fcn.0040141a
mov eax, dword [0x42a5cc]
cmp eax, 0xffffffff
je 0x4037f6
mov dword [esp + 0x18], eax
push dword [esp + 0x18]
jmp 0x403688