Function at 0x401f10
Capabilities:
Check os version
Create process on windows
Create process suspended
Delete registry key
Delete service
Get common file path
Hide graphical window
Query or enumerate registry key
Self delete
Set registry value
Shutdown system
Stop service

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1d24
call fcn.00402de0
push ebx
push esi
push edi
lea eax, [esp + 0x498]
push eax
mov dword [esp + 0x49c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
xor eax, eax
mov ecx, 0x11
lea edi, [esp + 0x50]
rep stosd dword es:[edi], eax
xor ecx, ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ecx
mov byte [esp + 0x1930], cl
mov dword [esp + 0x24], ecx
mov byte [esp + 0xf], cl
mov byte [esp + 0xe], cl
mov byte [esp + 0xd], cl
mov dword [esp + 0x10], ecx
mov ecx, 0xff
lea edi, [esp + 0x1931]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x530], 0
mov ecx, 0xff
lea edi, [esp + 0x531]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0xd30], 0
mov ecx, 0xff
lea edi, [esp + 0xd31]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x98], 0
mov ecx, 0xff
lea edi, [esp + 0x99]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x1530], 0
mov ecx, 0xff
lea edi, [esp + 0x1531]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [esp + 0x930], 0
xor eax, eax
mov ecx, 0xff
lea edi, [esp + 0x931]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x400
lea edx, [esp + 0x1534]
push edx
mov dword [esp + 0x58], 0x44
stosb byte es:[edi], al
mov dword [esp + 0x34], 0x400
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp dword [esp + 0x4a8], 2
jne 0x402437
mov eax, dword [esp + 0x49c]
cmp eax, 4
ja 0x402424
mov byte [esp + 0xf], 1
mov ecx, dword [ebp + 0x10]
push str.quietmode
push ecx
call fcn.00402e80
add esp, 8
test eax, eax
jne 0x402081
push 1
push str.Matrox_Imaging_Uninstall
push str.Are_you_sure_to_uninstall_MIL
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 1
jne 0x402bf9
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
mov edx, dword [ebp + 8]
push 0
push edx
push 0
push 0
push 0x32
push 0x154
push 0xc8
push 0xc8
push 0x80c80000
push str.Matrox_Imaging_Uninstall
push str.msctls_progress32
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push 0xc80000
push 0
mov ebx, eax
push 0x401
push ebx
call esi
push 0xa
push 0xa
push 0x404
push ebx
call esi
push 1
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
push 0x405
push ebx
call esi
lea eax, [esp + 0x14]
push eax
push 0xf003f
push 0
push str.SoftwareMatroxImaging_Board
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, dword [esp + 0x14]
mov edi, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
push str.Host
push ecx
mov esi, eax
call edi
mov edx, dword [esp + 0x14]
push 0x4091a0
push edx
call edi
push str.Uninstall_all_board
push ebx
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 0
push 0
push 0x405
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
test esi, esi
jne 0x402bfd
lea esp, [esp]
mov edx, dword [esp + 0x14]
push 0
push 0
push 0
push 0
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0xd44]
push ecx
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov ecx, dword [0x409184]
mov dx, word [0x409188]
mov dword [esp + 0x28], eax
mov eax, dword [str.Unistall]
mov dword [esp + 0x930], eax
lea eax, [esp + 0xd30]
mov dword [esp + 0x934], ecx
mov word [esp + 0x938], dx
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4021b7
lea edi, [esp + 0x930]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4021c8
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [esp + 0x930]
push eax
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 0
push 0
push 0x405
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
push 7
lea ecx, [esp + 0xd34]
push ecx
push str.Odyssey
call fcn.00402e40
add esp, 0xc
test eax, eax
jne 0x4022c7
push eax
push str.odcmon.exe
push str.odcmon.exe
push 1
call fcn.00402e1d
add esp, 0x10
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push str.OdcMonWnd
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
test esi, esi
je 0x402278
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0x8008
push 0x111
push esi
call edi
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0x10
push esi
call edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
je 0x4022c7
push 0xf01ff
push str.TrkServer
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x4022c0
lea edx, [esp + 0x34]
push edx
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [esp + 0x28]
test eax, eax
je 0x4022da
cmp eax, 0xea
jne 0x4027c2
mov al, byte [esp + 0xf]
test al, al
je 0x402459
lea eax, [esp + 0x1130]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [esp + 0x1130]
mov word [esp + 0x530], 0x22
mov edx, eax
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402310
lea edi, [esp + 0x530]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x402321
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x530]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x402341
mov ecx, dword [str.mildrv.exe_]
mov edx, dword [0x409150]
mov eax, dword [0x409154]
mov dword [edi], ecx
mov cx, word [0x409158]
mov dword [edi + 4], edx
mov dword [edi + 8], eax
mov word [edi + 0xc], cx
xor eax, eax
nop
mov cl, byte [esp + eax + 0xd30]
mov byte [esp + eax + 0x98], cl
inc eax
test cl, cl
jne 0x402370
lea edi, [esp + 0x98]
dec edi
jmp 0x402390
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x402390
mov edx, dword [str.__remove__noinfo]
mov eax, dword [0x40913c]
mov ecx, dword [0x409140]
mov dword [edi], edx
mov edx, dword [0x409144]
mov dword [edi + 4], eax
mov al, byte [0x409148]
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x54]
push edx
push 0
push 0
push 0
push 0
push 0
mov byte [edi + 0x10], al
push 0
lea eax, [esp + 0xb8]
push eax
lea ecx, [esp + 0x554]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edx, dword [esp + 0x18]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 0x1c]
push ecx
call esi
push 0
push 0
push 0x405
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x4027c2
cmp eax, 5
jne 0x402050
mov byte [esp + 0xe], 1
jmp 0x402050
push 0x40
push str.Matrox_Imaging_Setup
lea eax, [esp + 0x1938]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov al, byte [esp + 0xe]
test al, al
je 0x4027c2
push 5
lea edx, [esp + 0xd34]
push edx
push str.Orion
call fcn.00402e40
add esp, 0xc
test eax, eax
lea eax, [esp + 0x1130]
push eax
push 0x400
jne 0x40262d
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [esp + 0x1130]
mov word [esp + 0x530], 0x22
mov edx, eax
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4024b0
lea edi, [esp + 0x530]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4024c1
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x530]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4024e1
mov ecx, dword [str.mildrv.exe_]
mov edx, dword [0x409150]
mov eax, dword [0x409154]
mov dword [edi], ecx
mov cx, word [0x409158]
mov dword [edi + 4], edx
mov edx, dword [str.Orion]
mov dword [edi + 8], eax
mov ax, word [0x40911c]
mov word [edi + 0xc], cx
lea edi, [esp + 0x98]
mov dword [esp + 0x98], edx
mov word [esp + 0x9c], ax
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x402530
mov ecx, dword [str.__remove__noinfo]
mov edx, dword [0x40913c]
mov eax, dword [0x409140]
mov dword [edi], ecx
mov ecx, dword [0x409144]
mov dword [edi + 4], edx
mov dl, byte [0x409148]
mov dword [edi + 8], eax
mov dword [edi + 0xc], ecx
mov byte [edi + 0x10], dl
xor eax, eax
jmp 0x402570
mov cl, byte [esp + eax + 0x530]
mov byte [esp + eax + 0x930], cl
inc eax
test cl, cl
jne 0x402570
lea eax, [esp + 0x98]
mov esi, eax
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402590
lea edi, [esp + 0x930]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4025a1
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push str.Orion
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0x405
push ebx
call edi
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x54]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0x950]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov eax, dword [esp + 0x18]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 0x1c]
push edx
call esi
push 0
push 0
push 0x405
push ebx
call edi
jmp 0x40276f
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
xor eax, eax
jmp 0x402640
mov cl, byte [esp + eax + 0x1130]
mov byte [esp + eax + 0x530], cl
inc eax
test cl, cl
jne 0x402640
lea edi, [esp + 0x530]
dec edi
jmp 0x402660
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x402660
mov ecx, dword [str.drvinst.exe]
mov edx, dword [0x40910c]
mov eax, dword [0x409110]
mov dword [edi], ecx
mov cl, byte [0x409114]
mov dword [edi + 4], edx
mov edx, dword [str.__remove]
mov dword [edi + 8], eax
mov eax, dword [0x409100]
mov byte [edi + 0xc], cl
mov cx, word [0x409104]
mov dword [esp + 0x9c], eax
lea eax, [esp + 0xd30]
mov dword [esp + 0x98], edx
mov word [esp + 0xa0], cx
mov edx, eax
jmp 0x4026c0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4026c0
lea edi, [esp + 0x98]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4026d1
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x98]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4026f1
mov edx, dword [str.__noback]
mov eax, dword [0x4090f4]
mov cl, byte [0x4090f8]
mov dword [edi], edx
mov dword [edi + 4], eax
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x54]
push eax
push 0
push 0
push 0
push 0
push 0
mov byte [edi + 8], cl
push 0
lea ecx, [esp + 0xb8]
push ecx
lea edx, [esp + 0x554]
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov eax, dword [esp + 0x18]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 0x1c]
push edx
call esi
push 0
push 0
push 0x405
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
mov al, byte [esp + 0xd]
test al, al
jne 0x4027c2
lea eax, [esp + 0x30]
push eax
push 0xf003f
push 0
push str.SoftwareMatroxImaging_Board
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, dword [esp + 0x30]
push 9
push str.scandone
push 1
push 0
push str.scandone
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x28], eax
mov byte [esp + 0xd], 1
push 0
push 0
push 0x405
push ebx
mov dword [esp + 0x3c], 0x400
mov byte [esp + 0xd40], 0
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x28]
inc ecx
test eax, eax
mov dword [esp + 0x10], ecx
jne 0x40280b
mov eax, ecx
cmp eax, 0x118
jne 0x402160
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x1130]
push ecx
push 0x400
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [esp + 0x1130]
mov word [esp + 0x530], 0x22
mov ecx, eax
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x402840
lea edi, [esp + 0x530]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x402853
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x530]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x402871
mov edx, dword [str.mildrv.exe_]
mov eax, dword [0x409150]
mov ecx, dword [0x409154]
mov dword [edi], edx
mov dx, word [0x409158]
mov dword [edi + 4], eax
mov eax, dword [str.mtxdma]
mov dword [edi + 8], ecx
mov cx, word [0x4090e0]
mov word [edi + 0xc], dx
mov dl, byte [0x4090e2]
lea edi, [esp + 0x98]
mov dword [esp + 0x98], eax
mov word [esp + 0x9c], cx
mov byte [esp + 0x9e], dl
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4028d0
mov eax, dword [str.__remove__noinfo]
mov ecx, dword [0x40913c]
mov edx, dword [0x409140]
mov dword [edi], eax
mov eax, dword [0x409144]
mov dword [edi + 4], ecx
mov cl, byte [0x409148]
mov dword [edi + 8], edx
mov dword [edi + 0xc], eax
mov byte [edi + 0x10], cl
xor eax, eax
jmp 0x402910
mov cl, byte [esp + eax + 0x530]
mov byte [esp + eax + 0x930], cl
inc eax
test cl, cl
jne 0x402910
lea eax, [esp + 0x98]
mov esi, eax
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402930
lea edi, [esp + 0x930]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x402941
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea edx, [esp + 0x930]
mov ecx, eax
push edx
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0x405
push ebx
call edi
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x54]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0x950]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov eax, dword [esp + 0x18]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 0x1c]
push edx
call esi
push 0
push 0
push 0x405
push ebx
call edi
call fcn.00401aa0
call section..text
call fcn.00401450
mov eax, dword [str.del__f__s__q]
mov ecx, dword [0x408180]
mov edx, dword [0x408184]
mov dword [esp + 0x98], eax
mov ax, word [0x408188]
mov word [esp + 0xa4], ax
lea eax, [esp + 0x1530]
mov dword [esp + 0x9c], ecx
mov dword [esp + 0xa0], edx
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x402a17
lea edi, [esp + 0x98]
sub eax, ecx
mov esi, ecx
dec edi
lea ebx, [ebx]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x402a30
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x98]
dec edi
mov edi, edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x402a50
mov ecx, dword [str.System32Odclib.dll]
mov edx, dword [0x4090c8]
mov eax, dword [0x4090cc]
mov dword [edi], ecx
mov ecx, dword [0x4090d0]
mov dword [edi + 4], edx
mov edx, dword [0x4090d4]
mov dword [edi + 8], eax
mov al, byte [0x4090d8]
mov dword [edi + 0xc], ecx
lea ecx, [esp + 0x98]
mov dword [edi + 0x10], edx
push ecx
mov byte [edi + 0x14], al
call fcn.00402d3d
mov edx, dword [str.del__f__s__q]
mov eax, dword [0x408180]
mov ecx, dword [0x408184]
mov dword [esp + 0x9c], edx
mov dx, word [0x408188]
mov dword [esp + 0xa0], eax
lea eax, [esp + 0x1534]
mov word [esp + 0xa8], dx
add esp, 4
mov dword [esp + 0xa0], ecx
mov edx, eax
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402ae0
lea edi, [esp + 0x98]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x402af1
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x98]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x402b11
mov eax, dword [str.System32mil.dll]
mov ecx, dword [0x4090b4]
mov edx, dword [0x4090b8]
mov dword [edi], eax
mov eax, dword [0x4090bc]
mov dword [edi + 4], ecx
mov cx, word [0x4090c0]
mov dword [edi + 8], edx
mov dl, byte [0x4090c2]
mov dword [edi + 0xc], eax
lea eax, [esp + 0x98]
mov word [edi + 0x10], cx
push eax
mov byte [edi + 0x12], dl
call fcn.00402d3d
mov ecx, dword [str.del__f__s__q]
mov eax, dword [0x408184]
mov edx, dword [0x408180]
mov dword [esp + 0x9c], ecx
mov cx, word [0x408188]
mov dword [esp + 0xa4], eax
lea eax, [esp + 0x1534]
mov dword [esp + 0xa0], edx
add esp, 4
mov word [esp + 0xa4], cx
mov edx, eax
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402ba0
lea edi, [esp + 0x98]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x402bb1
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x98]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x402bd1
mov ecx, 7
mov esi, str.System32driversMtxDma.sys
rep movsd dword es:[edi], dword [esi]
lea edx, [esp + 0x98]
push edx
movsw word es:[edi], word [esi]
call fcn.00402d3d
add esp, 4
jmp 0x402bfd
mov ebx, dword [esp + 0x2c]
mov eax, dword [ebp + 0x10]
push str.noreboot
push eax
call fcn.00402e80
add esp, 8
test eax, eax
jne 0x402d2b
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
push 0x40
push str.Matrox_Imaging_Setup
push str.You_must_reboot_your_system.
push eax
call esi
push 0x30
push str.Matrox_Imaging_Setup
push str.Clean_Mil_will_now_reboot_the_sytem._nPlease_save_your_work_and_close_any_open_documments__nor_you_risk_losing_data.
push 0
call esi
cmp dword [esp + 0x4a8], 2
push 0
jne 0x402d23
call dword [sym.imp.KERNEL32.dll_SetLastError]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call edi
test eax, eax
je 0x402c87
push 0
push str.Error_
push str.couldnt_get_process_handle
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
lea ecx, [esp + 0x10]
push ecx
push 0x28
push esi
mov dword [esp + 0x40], 1
mov dword [esp + 0x4c], 2
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x402d01
call edi
test eax, eax
jne 0x402d01
lea edx, [esp + 0x38]
push edx
push str.SeShutdownPrivilege
push eax
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov ecx, dword [esp + 0x10]
push 0
push 0
push 0
lea eax, [esp + 0x40]
push eax
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
cmp eax, 0x514
push 0
jne 0x402d23
push str.Error_
push str.Couldnt_adjust_privilege
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0
push str.Error_
push str.Couldnt_open_current_access_control_token
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
push ebx
call dword [sym.imp.USER32.dll_DestroyWindow]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10