Function at 0x4031f1
Capabilities:
Accept command line arguments
Check os version
Copy file
Delete file
Get common file path
Get file system object information
Set current directory
Set environment variable
Shutdown system
Terminate process

Disassembly:
sub esp, 0x184
push ebx
push esi
push edi
xor ebx, ebx
push 0x8001
mov dword [esp + 0x18], ebx
mov dword [esp + 0x10], str.Error_writing_temporary_file._Make_sure_your_temp_folder_is_valid.
mov dword [esp + 0x20], ebx
mov byte [esp + 0x14], 0x20
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
call dword [sym.imp.KERNEL32.dll_GetVersion]
and eax, 0xbfffffff
cmp ax, 6
mov dword [0x42f40c], eax
je 0x403243
push ebx
call fcn.004062fd
cmp eax, ebx
je 0x403243
push 0xc00
call eax
mov esi, str.UXTHEME
push esi
call fcn.0040628f
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esi + eax + 1]
cmp byte [esi], bl
jne 0x403248
push 0xa
call fcn.004062fd
push 8
call fcn.004062fd
push 6
mov dword [0x42f404], eax
call fcn.004062fd
cmp eax, ebx
je 0x40328a
push 0x1e
call eax
test eax, eax
je 0x40328a
or byte [0x42f40f], 0x40
push ebp
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push ebx
call dword [sym.imp.ole32.dll_OleInitialize]
mov dword [0x42f4d8], eax
push ebx
lea eax, [esp + 0x38]
push 0x160
push eax
push ebx
push 0x429830
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
push str.NSIS_Error
push 0x42ec00
call fcn.00405f65
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov ebp, 0x435000
push eax
push ebp
call fcn.00405f65
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp byte [0x435000], 0x22
mov dword [0x42f400], eax
mov eax, ebp
jne 0x4032f6
mov byte [esp + 0x14], 0x22
mov eax, 0x435001
push dword [esp + 0x14]
push eax
call fcn.00405928
push eax
call dword [sym.imp.USER32.dll_CharNextA]
mov dword [esp + 0x1c], eax
jmp 0x4033d0
cmp cl, 0x20
jne 0x40331b
inc eax
cmp byte [eax], 0x20
je 0x403315
cmp byte [eax], 0x22
mov byte [esp + 0x14], 0x20
jne 0x40332b
inc eax
mov byte [esp + 0x14], 0x22
cmp byte [eax], 0x2f
jne 0x883d3727
into
add edi, 0x83c
jno 0x403341
inc ebx
add ecx, ecx
xchg ebx, edx
test dl, 0x48
jmp 0x403354
imul ebx, eax, 0x3538d74a
mov ebx, ecx
mov ebp, eax
jmp 0x403362
push edi
imul ecx, edi, 0x465d76b4
movzx ebx, dl
mov ah, dl
je 0x40337a
test al, 4
xor ah, bl
and eax, 0x964a4a7f
add al, 0x45
lea esi, [edx]
cmp ecx, 0xe2a4
jne 0x403390
xchg ebx, ebx
test eax, 0x2a7dba07
and al, 0xd2
cmp ecx, 0x3e4f
ja 0x4033a3
imul ecx, esi
imul ebp, edi, 0x1c002f16
or bh, ah
xor edx, esi
and al, 0x37
cmp eax, 0x91e81c23
lea edx, [0x4c40e371]
mov ecx, 0x23f7b72f
and al, 0x6c
ret
mov cl, byte [eax]
cmp cl, bl
jne 0x403310
jmp 0x4033ed
mov edi, dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov esi, 0x436400
push esi
push 0x400
call edi
call fcn.004031c0
test eax, eax
jne 0x40345f
push 0x3fb
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.Temp
push esi
call sub.KERNEL32.dll_lstrcatA
call fcn.004031c0
test eax, eax
jne 0x40345f
push esi
push 0x3fc
call edi
push 0x40a16c
push esi
call sub.KERNEL32.dll_lstrcatA
mov edi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push esi
push str.TEMP
call edi
push esi
push 0x40a160
call edi
call fcn.004031c0
test eax, eax
je 0x40350d
push 0x436000
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [esp + 0x20]
call fcn.00402d48
cmp eax, ebx
mov dword [esp + 0x10], eax
jne 0x40350d
cmp dword [0x42f420], ebx
je 0x4034fd
push ebx
push ebp
call fcn.00405928
mov edi, eax
cmp edi, ebp
jb 0x4034c8
movsx eax, byte [0x40a15b]
movsx ecx, byte [0x40a15a]
shl eax, 8
or eax, ecx
movsx ecx, byte [0x40a159]
shl eax, 8
or eax, ecx
movsx ecx, byte [str.___]
shl eax, 8
or eax, ecx
cmp dword [edi], eax
je 0x4034c8
dec edi
cmp edi, ebp
jae 0x4034bf
cmp edi, ebp
mov dword [esp + 0x10], str.Error_launching_installer
jb 0x403539
mov byte [edi], bl
add edi, 4
push edi
call fcn.004059eb
test eax, eax
je 0x40350d
push edi
push 0x435400
call fcn.00405f65
push edi
push 0x435800
call fcn.00405f65
mov dword [esp + 0x10], ebx
or dword [0x42f4cc], 0xffffffff
call fcn.004037b5
mov dword [esp + 0x18], eax
call fcn.004036db
call dword [sym.imp.ole32.dll_OleUninitialize]
cmp dword [esp + 0x10], ebx
pop ebp
je 0x403641
push 0x200010
push dword [esp + 0x10]
call fcn.00405681
push 2
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.004055ec
push str.nsu
push esi
mov edi, eax
call sub.KERNEL32.dll_lstrcatA
cmp edi, ebx
je 0x40355a
push 0x40a14c
push esi
call sub.KERNEL32.dll_lstrcatA
push str..tmp
push esi
call sub.KERNEL32.dll_lstrcatA
mov ebp, 0x435c00
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x40350d
cmp edi, ebx
push esi
je 0x403582
call fcn.00405552
jmp 0x403587
call fcn.004055cf
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
cmp byte [0x435400], bl
jne 0x4035a1
push ebp
push 0x435400
call fcn.00405f65
push dword [esp + 0x1c]
push section..ndata
call fcn.00405f65
movsx cx, byte [0x40a140]
xor eax, eax
push 0x1a
mov ah, byte [0x40a141]
pop ebp
or eax, ecx
mov edi, 0x429430
mov word [0x430400], ax
mov eax, dword [0x42f414]
push dword [eax + 0x120]
push edi
call fcn.00405f87
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [esp + 0x10], ebx
je 0x40362c
push 1
push edi
push 0x436c00
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x40362c
push ebx
push edi
call fcn.00405d44
mov eax, dword [0x42f414]
push dword [eax + 0x124]
push edi
call fcn.00405f87
push edi
call fcn.00405604
cmp eax, ebx
je 0x40362c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x10], ebx
inc byte [0x430400]
dec ebp
jne 0x4035cf
push ebx
push esi
call fcn.00405d44
jmp 0x40350d
cmp dword [0x42f4b4], ebx
je 0x4036c3
lea eax, [esp + 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
push 2
test eax, eax
pop edi
je 0x403694
lea eax, [esp + 0x24]
push eax
push str.SeShutdownPrivilege
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push ebx
push ebx
lea eax, [esp + 0x28]
push ebx
push eax
push ebx
push dword [esp + 0x2c]
mov dword [esp + 0x38], 1
mov dword [esp + 0x44], edi
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 4
call fcn.004062fd
cmp eax, ebx
mov esi, 0x80040002
je 0x4036b0
push esi
push 0x25
push ebx
push ebx
push ebx
call eax
test eax, eax
je 0x4036bc
push esi
push edi
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x4036c3
push 9
call fcn.0040140b
mov eax, dword [0x42f4cc]
cmp eax, 0xffffffff
je 0x4036d1
mov dword [esp + 0x14], eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_ExitProcess]