Function at 0x4044b3
Capabilities:
Accept command line arguments
Check if file exists
Delete file
Extract resource via kernel32 functions
Get common file path
Move file
Print debug messages

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x84
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push edi
push 4
lea eax, [esp + 0x18]
push eax
push 0x1d
mov dword [esp + 0x20], 1
call esi
push eax
call dword [sym.imp.ntdll.dll_ZwSetInformationProcess]
push str.kernel32.dll
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, eax
test ebx, ebx
je 0x404513
push 0x10
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x404513
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x404513
mov edi, dword [eax + 0x30]
push 0x7fff
shr edi, 0x10
cmp di, 5
push 0x41ae68
seta al
push 0
mov byte [0x40a44c], al
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x104
push 0x41a458
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call fcn.00406968
mov ebx, eax
xor edi, edi
cmp ebx, edi
je 0x404564
push ebx
call fcn.00402946
pop ecx
push ebx
mov dword [0x42ae68], eax
call fcn.0040241e
pop ecx
cmp dword [0x40a004], 0x100007f
jne 0x4045b9
movzx eax, word [0x40a31e]
push eax
movzx eax, word [0x40a31c]
push eax
movzx eax, word [0x40a31a]
push eax
movzx eax, word [0x40a318]
push eax
lea eax, [esp + 0x38]
push str._d._d._d._d
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push eax
call ebx
lea eax, [esp + 0x28]
push eax
call ebx
lea eax, [esp + 0x14]
push eax
push 8
mov byte [esp + 0x17], 0
call esi
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov esi, str.shit
test eax, eax
je 0x404627
push dword [esp + 0x14]
call fcn.00405c15
mov ebx, eax
pop ecx
cmp ebx, edi
je 0x4045ff
push 0x16
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_IsWellKnownSid]
test eax, eax
push ebx
setne byte [esp + 0x13]
call fcn.0040241e
pop ecx
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [esp + 0xf], 0
je 0x404627
push esi
xor ebx, ebx
push ecx
inc ebx
push ebx
call fcn.00403ad5
pop ecx
pop ecx
push eax
call fcn.00405875
pop ecx
pop ecx
jmp 0x40462a
xor ebx, ebx
inc ebx
mov dword [esp + 0x18], esi
push ebx
mov esi, 0x42b080
push esi
mov dword [esp + 0x24], 0x4054db
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push edi
push edi
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
lea eax, [esp + 0x18]
push eax
mov dword [0x42b094], 0xc
mov dword [0x42b098], esi
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
test eax, eax
jne 0x4046da
push edi
call dword [sym.imp.ole32.dll_CoInitialize]
call fcn.004067bb
mov byte [esp + 0x10], al
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x18], edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
cmp dword [esp + 0x14], ebx
jle 0x404736
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push 0x407c30
push dword [edi + 4]
call esi
test eax, eax
jne 0x4046df
push dword [edi + 8]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov esi, eax
test esi, esi
je 0x4046da
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00403b8f
push 0x407c38
push dword [edi + 4]
call esi
test eax, eax
jne 0x404769
xor ebx, ebx
mov esi, dword [edi + 8]
call fcn.004061d5
test eax, eax
jne 0x404717
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x404717
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0xa
jl 0x4046ef
push 4
push 0
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp byte [esp + 0x10], 0
je 0x404769
call fcn.00405827
test al, al
je 0x404769
jmp 0x4046da
jne 0x404769
cmp byte [esp + 0x10], 0
jne 0x404746
call fcn.00405f0b
jmp 0x404769
push str.BCB_ChangeMeToSomeThingBetter1122334
push ebx
push ebx
push 0x42b094
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov bl, byte [esp + 0x10]
call fcn.00403a72
test al, al
jne 0x40477d
push 0
call fcn.00403380
cmp byte [esp + 0x10], 0
je 0x404791
call fcn.00405827
test al, al
jne 0x4046da
push dword [esp + 0x10]
call fcn.004042a9
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x4046da