You need to go into the Advanced permissions on setup.exe. Remove all rights for the users/groups (removing inherited perms if necessary), then go into the advanced permissions and add the users/groups with just the permission "Travers folder / execute file".
This allows the users to execute setup.exe, but they could not open it in a e.g. a hex editor and view it's contents.
JR
I had another look at this following Evan's commnents. It turns out that I'm correct (of course :-) but that Evan is also correct; sort of.
Here are the details. I created a folder C:\test and left the ACLs at the defaults. The ACL on the folder doesn't seem to matter. Into this folder I copied a few Windows applets like Paint and Notepad. I also copied a ultrasimple Windows app that I wrote myself. The source for the ultrasimple app is:
#include <windows.h>
int PASCAL WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nCmdShow)
{
MessageBox(NULL, "Hello world\n", "Hello world\n", 0);
return 0;
}
which I'm sure you'll agree is pretty simple. Now I edited the permissions on all the files. I disabled inheritance, removed all the permissions and set the ACLs to contain just the one entry granting Everyone the permission "Traverse folder / Execute file".
Now if I drag any of the files into Notepad I immediately get an access denied error. If I try to copy any of the files into another folder I get an access denied error. This shows that read access to the files has been denied.
Now I double click my simple app, and it launches. Just for completeness I copied in another rather bigger app I'm working on, and after setting the permissions this too worked. This is the point I got to when I first posted, and it's why I was confident my answer was correct.
But, when I try to run mspaint.exe or notepad.exe they do not run. Instead I get an access denied error. This is the point where I'm grudgingly inclined to admit Evan may have a point :-)
My interpretation of this is that both Notepad and MSPaint have resources that Windows tries to load when they are started. This requires read access to the file, in order to read the resource, and because read access has been denied the attempt to launch the file fails. Because my app has no resources Windows manages to launch it quite happily. I imagine this would apply to any but the most simple of Windows apps, so although my original posting was technically correct, in practice just setting execute permission will not allow you to run anything useful. You will need read access as well.