Function at 0x401170
Capabilities:
Acquire debug privileges
Check if file exists
Delete file
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x638
mov eax, dword [0x41c040]
xor eax, esp
mov dword [esp + 0x634], eax
push esi
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x232]
push ecx
mov word [esp + 0x234], ax
call fcn.00406ac0
add esp, 0xc
push 0x104
lea edx, [esp + 0x22c]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x4011f2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._tWinMain_GetSystemDirectory_Failed:__d...
push 0x40
call fcn.004024d0
add esp, 0xc
or eax, 0xffffffff
pop edi
pop esi
mov ecx, dword [esp + 0x634]
xor ecx, esp
call fcn.0040531f
mov esp, ebp
pop ebp
ret 0x10
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x2a]
push ecx
mov word [esp + 0x2c], ax
call fcn.00406ac0
add esp, 0xc
lea edx, [esp + 0x228]
push edx
push str._s_rsreie.dll
lea eax, [esp + 0x28]
push 0x104
push eax
call fcn.00405d08
add esp, 0x10
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4012ae
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4012ae
push 0x206
push eax
lea ecx, [esp + 0x43a]
push ecx
mov word [esp + 0x43c], ax
call fcn.00406ac0
add esp, 0xc
lea edx, [esp + 0x228]
push edx
push str._s_rsreie_CP.dll
lea eax, [esp + 0x438]
push 0x104
push eax
call fcn.00405d08
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
add esp, 0x10
push 1
lea ecx, [esp + 0x434]
push ecx
lea edx, [esp + 0x28]
push edx
call esi
push 4
push 0
lea eax, [esp + 0x438]
push eax
call esi
lea edi, [esp + 0x20]
call fcn.00401000
test eax, eax
jne 0x4012e3
push str._tWinMain_ILDownLoadFile_Failed...
push 0x40
call fcn.004024d0
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
mov ecx, dword [esp + 0x634]
xor ecx, esp
call fcn.0040531f
mov esp, ebp
pop ebp
ret 0x10
lea ecx, [esp + 0xc]
push ecx
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x40132a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._tWinMain_OpenProcessToken_Failed:__d...
push 0x40
call fcn.004024d0
add esp, 0xc
or eax, 0xffffffff
pop edi
pop esi
mov ecx, dword [esp + 0x634]
xor ecx, esp
call fcn.0040531f
mov esp, ebp
pop ebp
ret 0x10
lea edx, [esp + 0x14]
push edx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x40137a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._tWinMain_LookupPrivilegeValue_Failed:__d...
push 0x40
call fcn.004024d0
mov eax, dword [esp + 0x18]
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
pop edi
pop esi
mov ecx, dword [esp + 0x634]
xor ecx, esp
call fcn.0040531f
mov esp, ebp
pop ebp
ret 0x10
mov edx, dword [esp + 0xc]
push 0
push 0
push 0x10
lea ecx, [esp + 0x1c]
push ecx
push 0
push edx
mov dword [esp + 0x28], 1
mov dword [esp + 0x34], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x4013e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._tWinMain_AdjustTokenPrivileges_Failed:__d...
push 0x40
call fcn.004024d0
mov eax, dword [esp + 0x18]
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
pop edi
pop esi
mov ecx, dword [esp + 0x634]
xor ecx, esp
call fcn.0040531f
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
jne 0x40142b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._tWinMain_LoadLibrary_Failed:__d...
push 0x40
call fcn.004024d0
add esp, 0xc
or eax, 0xffffffff
pop edi
pop esi
mov ecx, dword [esp + 0x634]
xor ecx, esp
call fcn.0040531f
mov esp, ebp
pop ebp
ret 0x10
push str.Start
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401442
push str.install
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x63c]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.0040531f
mov esp, ebp
pop ebp
ret 0x10