There is no point in protecting setup.exe and in most cases this is even not possible. Such files (usually self-extracting archives) contain integrity checks (against archive damage or virus attack) and will refuse to work after protection.
You should protect your program before it is set up with installation program and include protected version in distribution archive (setup.exe).
If you really need to protect installation executable you can use NSIS Installer to create installation application (setup.exe). Please note that you need to set CrcCheck option to OFF in your script in order to prevent installer from doing self-integrity checks.