Function at 0x417640
Capabilities:
Acquire debug privileges
Check os version
Get common file path
Query environment variable

Disassembly:
mov eax, 0x2008
call fcn.0041bfd0
mov eax, dword [0x4417c0]
xor eax, esp
mov dword [esp + 0x2004], eax
push esi
push 0x11c
push 0
push 0x48cf40
call fcn.0041a230
add esp, 0xc
push 0x48cf40
mov dword [0x48cf40], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
call fcn.00419630
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push str.SeDebugPrivilege
mov dword [0x48d07c], eax
call esi
push eax
call fcn.004179c0
add esp, 8
push str.SeBackupPrivilege
call esi
push eax
call fcn.004179c0
push 0
push 1
push 3
push str.RootkitDestroyer
push str.RkDtyr.sys
call fcn.00416db0
add esp, 0x1c
test eax, eax
jne 0x4178a0
push str.System_Reserved
push str.RkDtyrBt
call fcn.00417560
add esp, 8
test eax, eax
mov eax, str.RkDtyrBt
je 0x4176ef
mov eax, str.Boot_Bus_Extender
push eax
push 0
push 0
push str.RkDtyrBt
push str.RkDtyrBt.sys
call fcn.00416db0
add esp, 0x14
test eax, eax
jne 0x4178a0
lea eax, [esp + 4]
push eax
call fcn.00417020
push 0x11c
push 0
push 0x48ae20
mov esi, eax
call fcn.0041a230
add esp, 0x10
test esi, esi
jne 0x4178f5
push ebx
mov ebx, dword [esp + 8]
push edi
lea esi, [ebx + 4]
mov ecx, 0x47
mov edi, 0x48ae20
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebx + 0x20]
push ecx
lea edx, [esp + 0x1014]
push edx
call fcn.004179a0
add esp, 8
cmp dword [0x48cf44], 6
jne 0x4177d6
push 0x800
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [esp + 0x1038]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x417781
lea edi, [esp + 0x10]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x417795
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor eax, eax
jmp 0x4177c0
movzx ecx, word [esp + eax + 0x10]
mov word [eax + 0x48af40], cx
add eax, 2
test cx, cx
jne 0x4177c0
jmp 0x417809
lea ecx, [esp + 0x1010]
push ecx
push 0x25
push 0x25
lea edx, [esp + 0x1c]
push str._cSystemDrive_c_s
push edx
call fcn.0041c953
add esp, 0x14
push 0x800
push 0x48af40
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 1
push 0
push 0x48af40
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [0x48d070], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x48d070], 0
je 0x4178d2
push 0x48d05c
call fcn.00419060
mov edx, dword [0x48d060]
mov edi, dword [0x48ae28]
mov ecx, edx
shr ecx, 2
mov dword [0x48d068], ecx
mov ecx, dword [0x48d070]
mov dword [0x48d078], ecx
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov dword [0x48d074], eax
mov esi, edi
sub esi, dword [eax + 0x34]
mov eax, dword [0x48d05c]
add esp, 4
sub eax, edi
add eax, ecx
lea ecx, [esp + 0xc]
push ecx
push 4
push edx
push eax
mov dword [0x48d06c], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x4178b6
push ebx
call fcn.0041a615
add esp, 4
pop edi
mov eax, 1
pop ebx
pop esi
mov ecx, dword [esp + 0x2004]
xor ecx, esp
call fcn.0041a7bc
add esp, 0x2008
ret
xor eax, eax
cmp dword [0x48d068], eax
jbe 0x4178d2
mov ecx, dword [0x48d06c]
add dword [ecx + eax*4], esi
inc eax
cmp eax, dword [0x48d068]
jb 0x4178c0
push ebx
call fcn.0041a615
add esp, 4
pop edi
pop ebx
xor eax, eax
pop esi
mov ecx, dword [esp + 0x2004]
xor ecx, esp
call fcn.0041a7bc
add esp, 0x2008
ret
mov ecx, dword [esp + 0x2008]
mov eax, esi
pop esi
xor ecx, esp
call fcn.0041a7bc
add esp, 0x2008
ret