Function at 0x403f4e
Capabilities:
Accept command line arguments
Check if file exists
Copy file
Create directory
Delete file
Get common file path
Get file attributes
Get file system object information
Set current directory
Set environment variable
Shutdown system
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2d4
push ebx
push esi
push edi
push 0x20
xor edi, edi
pop esi
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], str.Error_writing_temporary_file._Make_sure_your_temp_folder_is_valid.
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push 0x8001
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push edi
call dword [sym.imp.ole32.dll_OleInitialize]
push 8
mov dword [0x799e38], eax
pop eax
call fcn.004071c4
push edi
push 0x2b4
mov dword [0x799520], eax
lea eax, [esp + 0x30]
push eax
push edi
push 0x40a258
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov ebx, 0x400
push ebx
push str.NSIS_Error
push 0x798520
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
mov edi, 0x7a5000
push edi
call fcn.00406c86
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp word [0x7a5000], 0x22
mov dword [0x799528], eax
mov eax, edi
jne 0x403ff8
push 0x22
pop esi
mov eax, 0x7a5002
push esi
call fcn.0040673b
push eax
call dword [sym.imp.USER32.dll_CharNextW]
movzx ecx, word [eax]
mov dword [esp + 0x14], eax
test cx, cx
je 0x4040bb
push 0x20
pop esi
cmp cx, si
jne 0x404025
add eax, 2
cmp word [eax], si
je 0x40401d
cmp word [eax], 0x22
mov edx, esi
jne 0x404033
push 0x22
add eax, 2
pop edx
cmp word [eax], 0x2f
jne 0x40408a
add eax, 2
cmp word [eax], 0x53
jne 0x404055
movzx ecx, word [eax + 2]
cmp cx, si
je 0x404050
test cx, cx
jne 0x404055
or dword [esp + 0xc], 2
cmp dword [eax], 0x43004e
jne 0x404079
cmp dword [eax + 4], 0x430052
jne 0x404079
movzx ecx, word [eax + 8]
cmp cx, si
je 0x404074
test cx, cx
jne 0x404079
or dword [esp + 0xc], 4
cmp dword [eax - 4], 0x2f0020
jne 0x40408a
cmp dword [eax], 0x3d0044
je 0x4040a7
push edx
call fcn.0040673b
cmp word [eax], 0x22
jne 0x404099
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x404018
jmp 0x4040bb
xor ecx, ecx
mov word [eax - 4], cx
add eax, 4
push eax
push 0x7a5800
call fcn.00406c86
mov esi, 0x7a7800
push esi
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTempPathW]
call ebx
call fcn.00403f18
test eax, eax
jne 0x40412b
push 0x3fb
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.Temp
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
call fcn.00403f18
test eax, eax
jne 0x40412b
push esi
push 0x3fc
call ebx
push 0x40a280
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov ebx, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push esi
push str.TEMP
call ebx
push esi
push 0x40a294
call ebx
call fcn.00403f18
test eax, eax
je 0x4045be
push 0x7a7000
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [esp + 0xc]
call fcn.0040334a
xor ebx, ebx
mov dword [esp + 0x10], eax
cmp eax, ebx
jne 0x4045be
cmp dword [0x799584], ebx
je 0x4041b8
push ebx
mov eax, edi
call fcn.0040673b
mov ebx, eax
jmp 0x404175
cmp dword [ebx], 0x5f0020
jne 0x404172
cmp dword [ebx + 4], 0x3d003f
je 0x404179
sub ebx, 2
cmp ebx, edi
jae 0x404161
mov dword [esp + 0x10], str.Error_launching_installer
cmp ebx, edi
jb 0x4041ea
xor eax, eax
mov word [ebx], ax
add ebx, 8
push ebx
call fcn.004067ff
test eax, eax
je 0x4045be
push ebx
push 0x7a5800
call fcn.00406c86
push ebx
push 0x7a6000
call fcn.00406c86
and dword [esp + 0x10], 0
xor ebx, ebx
or dword [0x799e2c], 0xffffffff
mov edi, dword [0x79952c]
push 6
pop eax
call fcn.004071c4
cmp eax, ebx
je 0x4042cb
call eax
movzx eax, ax
push eax
push 0x7a7000
call fcn.00406bd1
jmp 0x404325
push str.nsu.tmp
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov edi, 0x7a6800
push edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4045be
xor ebx, ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cmp word [0x7a5800], bx
jne 0x404230
push edi
push 0x7a5800
call fcn.00406c86
push dword [esp + 0x14]
push section..ndata
call fcn.00406c86
mov dword [0x79b800], 0x41
mov dword [esp + 0x14], 0x1a
mov edi, 0x78edb8
mov eax, dword [0x79952c]
push dword [eax + 0x120]
push edi
call fcn.00406c9e
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [esp + 0x10], ebx
je 0x4042b2
push 1
push edi
push 0x7a8800
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x4042b2
push ebx
push edi
call fcn.00406b26
mov eax, dword [0x79952c]
push dword [eax + 0x124]
push edi
call fcn.00406c9e
push edi
call fcn.004063db
cmp eax, ebx
je 0x4042b2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x10], ebx
inc word [0x79b800]
dec dword [esp + 0x14]
jne 0x404255
push ebx
push esi
call fcn.00406b26
jmp 0x4045be
push 0x30
pop eax
push 0x78
mov word [0x7a7000], ax
pop eax
push ebx
mov word [0x7a7002], ax
push str.Control_PanelDesktopResourceLocale
xor eax, eax
push 0x80000001
mov esi, 0x7915d8
mov word [0x7a7004], ax
call fcn.00406b5a
cmp word [0x7915d8], bx
jne 0x404319
push 0x40a32c
push str..DEFAULTControl_PanelInternational
push 0x80000003
xor eax, eax
call fcn.00406b5a
push esi
push 0x7a7000
call dword [sym.imp.KERNEL32.dll_lstrcatW]
call fcn.0040489c
mov eax, dword [0x799da0]
and eax, 0x20
push 0x7a5800
mov dword [0x799e00], eax
mov dword [0x799e1c], 0x10000
call fcn.004067ff
test eax, eax
jne 0x4043e5
mov ecx, dword [edi + 0x48]
cmp ecx, ebx
je 0x4043e5
mov eax, dword [0x799558]
mov edx, dword [edi + 0x4c]
lea edx, [eax + edx*2]
push edx
lea eax, [eax + ecx*2]
push eax
push dword [edi + 0x44]
xor eax, eax
mov esi, 0x796ce0
call fcn.00406b5a
mov ax, word [0x796ce0]
cmp ax, bx
je 0x4043e5
cmp ax, 0x22
jne 0x4043a1
mov eax, 0x796ce2
push 0x22
mov esi, eax
call fcn.0040673b
xor ecx, ecx
mov word [eax], cx
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [esi + eax*2 - 8]
cmp eax, esi
jbe 0x4043d5
push str..exe
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4043d5
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4043d0
test al, 0x10
jne 0x4043d5
call fcn.00406759
call fcn.00406714
push eax
push 0x7a5800
call fcn.00406c86
mov esi, 0x7a5800
push esi
call fcn.004067ff
test eax, eax
jne 0x404400
push dword [edi + 0x118]
push esi
call fcn.00406c9e
test byte [0x799da0], 0x10
je 0x404420
cmp dword [0x799584], ebx
jne 0x404420
call fcn.00404877
mov dword [0x795cc8], 1
push 0x8040
push ebx
push ebx
push 1
push 0x67
push dword [0x799528]
call dword [sym.imp.USER32.dll_LoadImageW]
cmp dword [edi + 0x50], 0xffffffff
mov dword [0x7984e8], eax
mov esi, 0x795ca0
je 0x4044c6
mov ecx, dword [0x799528]
mov edi, 0x40a398
push esi
mov dword [0x795ca4], 0x401000
mov dword [0x795cb0], ecx
mov dword [0x795cb4], eax
mov dword [0x795cc4], edi
call dword [sym.imp.USER32.dll_RegisterClassW]
test ax, ax
je 0x4045b3
push ebx
lea eax, [esp + 0x1c]
push eax
push ebx
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov eax, dword [esp + 0x24]
sub eax, dword [esp + 0x1c]
push ebx
push dword [0x799528]
push ebx
push ebx
push eax
mov eax, dword [esp + 0x34]
sub eax, dword [esp + 0x2c]
push eax
push dword [esp + 0x34]
push dword [esp + 0x34]
push 0x80000000
push ebx
push edi
push 0x80
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [0x78f5d4], eax
xor ecx, ecx
call fcn.0040149c
test eax, eax
je 0x4044de
mov dword [esp + 0xc], 2
jmp 0x4045b7
call fcn.0040489c
cmp dword [0x799e20], ebx
jne 0x404588
push 5
push dword [0x78f5d4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.RichEd20
call edi
test eax, eax
jne 0x404515
push str.RichEd32
call edi
mov edi, dword [sym.imp.USER32.dll_GetClassInfoW]
push esi
push str.RichEdit20A
push ebx
call edi
test eax, eax
jne 0x404542
push esi
push str.RichEdit
push ebx
call edi
push esi
mov dword [0x795cc4], 0x40a3c8
call dword [sym.imp.USER32.dll_RegisterClassW]
mov eax, dword [0x7984f4]
push ebx
push 0x4049de
add eax, 0x69
movzx eax, ax
push ebx
push eax
push dword [0x799528]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
push 5
pop ecx
mov edi, eax
call fcn.0040149c
mov eax, dword [0x795c88]
mov esi, eax
cmp eax, ebx
je 0x404582
push 1
call dword [esi + 4]
mov esi, dword [esi]
pop ecx
cmp esi, ebx
jne 0x404576
mov dword [esp + 0xc], edi
jmp 0x4045b7
push ebx
call fcn.00405f95
test eax, eax
je 0x4045ab
cmp dword [0x7984ec], ebx
jne 0x4044d1
push 2
pop ecx
call fcn.0040149c
jmp 0x4044d1
xor ecx, ecx
inc ecx
call fcn.0040149c
mov dword [esp + 0xc], ebx
push 1
call fcn.00406ff2
mov eax, dword [0x40c08c]
cmp eax, 0xffffffff
je 0x4045d6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [0x40c08c], 0xffffffff
mov eax, dword [0x795c88]
xor edi, edi
mov esi, eax
mov ebx, eax
cmp eax, edi
je 0x404608
push edi
call dword [ebx + 4]
mov ebx, dword [ebx]
pop ecx
cmp ebx, edi
jne 0x4045e5
mov ebx, esi
push dword [ebx + 8]
mov esi, dword [esi]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp esi, edi
jne 0x4045f0
push 7
push 0x7a8000
mov dword [0x795c88], edi
call fcn.004064e3
call dword [sym.imp.ole32.dll_OleUninitialize]
cmp dword [esp + 0x10], edi
je 0x40463c
push dword [esp + 0x10]
mov eax, 0x200010
call fcn.0040643a
push 2
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x799e14], edi
je 0x4046cd
push 3
pop eax
call fcn.004071c4
push 4
mov dword [esp + 0x18], eax
pop eax
call fcn.004071c4
push 5
mov esi, eax
pop eax
call fcn.004071c4
mov ebx, eax
cmp dword [esp + 0x14], edi
je 0x4046b8
cmp esi, edi
je 0x4046b8
cmp ebx, edi
je 0x4046b8
lea eax, [esp + 0x10]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [esp + 0x20]
test eax, eax
je 0x4046b8
lea eax, [esp + 0x1c]
push eax
push str.SeShutdownPrivilege
push edi
call esi
push edi
push edi
push edi
lea eax, [esp + 0x24]
push eax
push edi
push dword [esp + 0x24]
mov dword [esp + 0x30], 1
mov dword [esp + 0x3c], 2
call ebx
push edi
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x4046cd
push 9
pop ecx
call fcn.0040149c
mov eax, dword [0x799e2c]
cmp eax, 0xffffffff
je 0x4046db
mov dword [esp + 0xc], eax
push dword [esp + 0xc]
jmp 0x404636