Function at 0x404f00
Capabilities:
Accept command line arguments
Copy file
Delete file
Get common file path
Get file system object information
Set current directory
Set environment variable
Shutdown system
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40ccd0
push 0x40a5e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, 0x42d8
call fcn.0040a520
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor eax, eax
mov dword [ebp - 0x2c], eax
mov edi, str.Error_writing_temporary_file._Make_sure_your_temp_folder_is_valid.
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x24], 0x20
push 0x8001
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov esi, str.UXTHEME
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
call fcn.00407f20
push esi
call ebx
inc esi
add esi, eax
cmp byte [esi], 0
jne 0x404f60
push 9
call fcn.004088e0
push 7
call fcn.004088e0
mov dword [0x437510], eax
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push 0
call dword [sym.imp.ole32.dll_OleInitialize]
mov dword [0x4395a0], eax
push 0
push 0x2b4
lea eax, [ebp - 0x2f0]
push eax
push 0
push 0x40c85c
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push str.NSIS_Error
push 0x437520
call fcn.00408b90
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
push 0x44f000
call fcn.00408b90
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [0x437514], eax
mov eax, 0x44f000
cmp word [0x44f000], 0x22
jne 0x404ffa
mov dword [ebp - 0x24], 0x22
mov eax, 0x44f002
push dword [ebp - 0x24]
push eax
call fcn.004084a0
push eax
call dword [sym.imp.USER32.dll_CharNextW]
mov dword [ebp - 0x20], eax
movzx ecx, word [eax]
test cx, cx
je 0x4050cf
lea esp, [esp]
cmp cx, 0x20
jne 0x40502f
add eax, 2
cmp word [eax], 0x20
je 0x405026
mov edx, 0x20
cmp word [eax], 0x22
jne 0x405042
add eax, 2
mov edx, 0x22
cmp word [eax], 0x2f
jne 0x40509d
add eax, 2
cmp word [eax], 0x53
jne 0x405069
movzx ecx, word [eax + 2]
cmp ecx, 0x20
je 0x40505f
test cx, cx
jne 0x405069
mov dword [0x439620], 1
cmp dword [eax], 0x43004e
jne 0x40508c
cmp dword [eax + 4], 0x430052
jne 0x40508c
movzx ecx, word [eax + 8]
cmp ecx, 0x20
je 0x405088
test cx, cx
jne 0x40508c
or dword [ebp - 0x1c], 4
cmp dword [eax - 4], 0x2f0020
jne 0x40509d
cmp dword [eax], 0x3d0044
je 0x4050bb
push edx
push eax
call fcn.004084a0
cmp word [eax], 0x22
jne 0x4050ad
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x405020
jmp 0x4050cf
xor ecx, ecx
mov word [eax - 4], cx
add eax, 4
push eax
push 0x450000
call fcn.00408b90
push 0x454000
push 0x800
mov esi, dword [sym.imp.KERNEL32.dll_GetTempPathW]
call esi
push 0x454000
call fcn.00408db0
push 0x454000
call fcn.00408ec0
test eax, eax
je 0x405124
push 0x454000
call fcn.004083d0
push 0x454000
call fcn.00407ba0
push 0x454000
push 0x453000
call fcn.00408a80
test eax, eax
jne 0x405206
push 0x7fb
push 0x454000
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 0x40c878
push 0x454000
call sub.KERNEL32.dll_lstrcatW
push 0x454000
call fcn.00408db0
push 0x454000
call fcn.00408ec0
test eax, eax
je 0x405186
push 0x454000
call fcn.004083d0
push 0x454000
call fcn.00407ba0
push 0x454000
push 0x453000
call fcn.00408a80
test eax, eax
jne 0x405206
push 0x454000
push 0x7fc
call esi
push 0x40c884
push 0x454000
call sub.KERNEL32.dll_lstrcatW
push 0x454000
push str.TEMP
mov esi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
call esi
push 0x454000
push 0x40c898
call esi
push 0x454000
call fcn.00408db0
push 0x454000
call fcn.00408ec0
test eax, eax
je 0x40555a
push 0x454000
call fcn.004083d0
push 0x454000
call fcn.00407ba0
push 0x454000
push 0x453000
call fcn.00408a80
test eax, eax
je 0x40555a
push 0x453000
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
call ebx
push dword [ebp - 0x1c]
call fcn.00404520
mov edi, eax
test edi, edi
jne 0x40555a
mov eax, dword [0x439538]
test eax, eax
je 0x4052a6
push edi
push 0x44f000
call fcn.004084a0
mov esi, eax
cmp esi, 0x44f000
jb 0x40525f
cmp dword [esi], 0x5f0020
jne 0x405254
cmp dword [esi + 4], 0x3d003f
je 0x40525f
sub esi, 2
cmp esi, 0x44f000
jae 0x405243
mov edi, str.Error_launching_installer
mov dword [ebp - 0x24], edi
cmp esi, 0x44f000
jb 0x4052c1
xor eax, eax
mov word [esi], ax
add esi, 8
push esi
call fcn.00408500
test eax, eax
je 0x40555a
push esi
push 0x450000
call fcn.00408b90
push esi
push 0x451000
call fcn.00408b90
xor edi, edi
mov eax, dword [0x439538]
test eax, eax
jne 0x4052ab
call fcn.00404a50
mov dword [0x43962c], 0xffffffff
call fcn.004077a0
mov ebx, eax
jmp 0x40555c
call fcn.00408300
mov esi, eax
mov dword [ebp - 0x28], esi
push str.nsu
push 0x454000
call sub.KERNEL32.dll_lstrcatW
test esi, esi
je 0x4052ed
push 0x40c8ac
push 0x454000
call sub.KERNEL32.dll_lstrcatW
push 0x40c8b0
push 0x454000
call sub.KERNEL32.dll_lstrcatW
push 0x452000
push 0x454000
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x40555a
push 0x454000
test esi, esi
je 0x405324
call fcn.00407bc0
jmp 0x405329
call fcn.00407ba0
push 0x454000
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cmp word [0x450000], 0
jne 0x40534d
push 0x452000
push 0x450000
call fcn.00408b90
push dword [ebp - 0x20]
push section..ndata
call fcn.00408b90
mov dword [0x43c000], 0x41
xor esi, esi
mov dword [ebp - 0x20], esi
cmp esi, 0x1a
jge 0x405549
mov eax, dword [0x439544]
push dword [eax + 0x120]
push 0x427230
call fcn.00407c50
push 0x427230
call ebx
test edi, edi
je 0x40553c
push 1
push 0x427230
push 0x456000
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x40553c
push 0
push 0x427230
call fcn.00407ff0
cmp dword [ebp - 0x28], 0
je 0x405400
xor eax, eax
mov word [ebp - 0x42f0], ax
push 0x1ffe
push eax
lea eax, [ebp - 0x42ee]
push eax
call fcn.0040a550
add esp, 0xc
push 0x427230
lea eax, [ebp - 0x42f0]
push eax
call fcn.00408b90
lea eax, [ebp - 0x42f0]
push eax
call fcn.00405670
add esp, 4
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0
call fcn.00404dd0
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xffffffff
jmp 0x40543f
xor eax, eax
mov word [ebp - 0x22f0], ax
push 0x1ffe
push eax
lea eax, [ebp - 0x22ee]
push eax
call fcn.0040a550
add esp, 0xc
push 0x427230
lea eax, [ebp - 0x22f0]
push eax
call fcn.00408b90
push 0x40c8bc
lea eax, [ebp - 0x22f0]
push eax
call sub.KERNEL32.dll_lstrcatW
lea eax, [ebp - 0x22f0]
push eax
call ebx
cmp dword [ebp - 0x1c], 0
je 0x4054f2
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
lea eax, [ebp - 0x22f0]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4054f2
mov dword [ebp - 0x20], 0
push 0
lea eax, [ebp - 0x20]
push eax
push 4
lea eax, [ebp - 0x1c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
lea eax, [ebp - 0x22f0]
cmp dword [ebp - 0x20], 4
je 0x4054e8
push eax
call ebx
jmp 0x4054f8
push 0
push eax
call fcn.00407ff0
jmp 0x4054f8
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x439544]
push dword [eax + 0x124]
push 0x427230
call fcn.00407c50
push 0x427230
call fcn.00408650
test eax, eax
je 0x405530
push eax
call edi
xor edi, edi
mov dword [ebp - 0x24], edi
inc word [0x43c000]
inc esi
jmp 0x405366
lea eax, [ebp - 0x22f0]
push eax
call ebx
mov edi, dword [ebp - 0x24]
inc word [0x43c000]
inc esi
jmp 0x405366
push 0
push 0x454000
call fcn.00407ff0
mov ebx, dword [ebp - 0x2c]
jmp 0x40555c
xor ebx, ebx
mov eax, dword [0x40e010]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, 0xffffffff
je 0x405579
push eax
call esi
mov dword [0x40e010], 0xffffffff
mov eax, dword [0x40e014]
cmp eax, 0xffffffff
je 0x405590
push eax
call esi
mov dword [0x40e014], 0xffffffff
call fcn.004057c0
push 7
push 0x455000
call fcn.004086b0
call fcn.00404a50
call dword [sym.imp.ole32.dll_OleUninitialize]
test edi, edi
je 0x4055c3
push 0x200010
push edi
call fcn.00408b00
push 2
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x439614], 0
je 0x405651
lea eax, [ebp - 0x28]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40561b
lea eax, [ebp - 0x38]
push eax
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov dword [ebp - 0x3c], 1
mov dword [ebp - 0x30], 2
push 0
push 0
push 0
lea eax, [ebp - 0x3c]
push eax
push 0
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 4
call fcn.004088e0
test eax, eax
je 0x405639
push 0x80040002
push 0x25
push 0
push 0
push 0
call eax
test eax, eax
je 0x40564a
push 0x80040002
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x405651
push 9
call fcn.00401490
cmp dword [0x43962c], 0xffffffff
cmovne ebx, dword [0x43962c]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]