Function at 0x401020
Capabilities:
Copy file
Create service
Delete service
Get common file path
Start service
Stop service
Terminate process

Disassembly:
push str.Error_in_arguments__nUse:_n_bdrvinst.exe__i__to_install_driver_and_n_bdrvinst.exe__u__to_uninstall._n
call fcn.00401368
add esp, 4
push 0xa
call fcn.004016bd
int3
sub esp, 0x120
mov eax, dword [0x40d400]
xor eax, esp
mov dword [esp + 0x11c], eax
cmp dword [esp + 0x124], 2
je 0x401043
jmp section..text
mov eax, dword [esp + 0x128]
mov eax, dword [eax + 4]
push esi
push edi
mov edi, 0x40b3dc
mov esi, eax
mov ecx, 3
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x4010de
mov edi, 0x40b3e0
mov esi, eax
mov ecx, 3
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x4010de
mov edi, 0x40b3e4
mov esi, eax
mov ecx, 3
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x40109c
mov esi, eax
mov edi, 0x40b3e8
mov ecx, 3
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x40109c
jmp section..text
xor edi, edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
test esi, esi
jne 0x4011d3
push str.Unable_to_open_Service_control_manager__n
call fcn.00401368
add esp, 4
pop edi
lea eax, [esi + 4]
pop esi
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.00401749
add esp, 0x120
ret
push 0x80
lea ecx, [esp + 0x28]
push ecx
mov edi, 1
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
lea eax, [esp + 0x24]
add eax, 0xffffffff
lea ebx, [ebx]
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x401100
mov edx, dword [str.drivers_bukadrv.sys]
mov ecx, dword [0x40b3f0]
mov dword [eax], edx
mov edx, dword [0x40b3f4]
mov dword [eax + 4], ecx
mov ecx, dword [0x40b3f8]
mov dword [eax + 8], edx
mov edx, dword [0x40b3fc]
mov dword [eax + 0xc], ecx
mov cl, byte [0x40b400]
mov dword [eax + 0x10], edx
lea edx, [esp + 0xa4]
push edx
push 0x80
mov byte [eax + 0x14], cl
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryA]
lea eax, [esp + 0xa4]
add eax, 0xffffffff
lea esp, [esp]
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x401160
mov ecx, dword [str._bukadrv.sys]
mov edx, dword [0x40b408]
mov dword [eax], ecx
mov ecx, dword [0x40b40c]
mov dword [eax + 4], edx
mov dl, byte [0x40b410]
mov dword [eax + 8], ecx
mov byte [eax + 0xc], dl
push 0
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0xac]
push ecx
call dword [sym.imp.KERNEL32.DLL_CopyFileA]
test eax, eax
jne 0x40109e
push str.Unable_to_copy_Accord_files_to_system_directory__n
call fcn.00401368
add esp, 4
pop edi
mov eax, 2
pop esi
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.00401749
add esp, 0x120
ret
test edi, edi
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
je 0x401275
push 0
push 0
push 0
push 0
push 0
push str.SystemRootSystem32drivers_bukadrv.sys
push 1
push 1
push 1
push 0xf01ff
push str.bukadrv
push str.bukadrv
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
test eax, eax
jne 0x401272
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x431
jne 0x401248
push str.Driver_already_installed__n
call fcn.00401368
add esp, 4
pop ebx
pop edi
mov eax, 3
pop esi
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.00401749
add esp, 0x120
ret
push str.Unable_to_install_driver__n
call fcn.00401368
add esp, 4
pop ebx
pop edi
mov eax, 4
pop esi
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.00401749
add esp, 0x120
ret
push eax
call ebx
push 0xf01ff
push str.bukadrv
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x4012b4
push str.Unable_to_open_driver__n
call fcn.00401368
add esp, 4
pop ebx
pop edi
lea eax, [esi + 5]
pop esi
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.00401749
add esp, 0x120
ret
test edi, edi
je 0x4012fb
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
push esi
mov edi, eax
call ebx
test edi, edi
jne 0x4012f4
push str.Unable_to_run_driver__n
call fcn.00401368
add esp, 4
pop ebx
lea eax, [edi + 6]
pop edi
pop esi
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.00401749
add esp, 0x120
ret
push str.Driver_successfully_installed._n
jmp 0x401346
lea edx, [esp + 0xc]
push edx
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
mov edi, eax
call ebx
test edi, edi
jne 0x401341
push str.Unable_to_remove_driver__n
call fcn.00401368
add esp, 4
pop ebx
lea eax, [edi + 7]
pop edi
pop esi
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.00401749
add esp, 0x120
ret
push str.Driver_successfully_uninstalled._n
call fcn.00401368
mov ecx, dword [esp + 0x12c]
add esp, 4
pop ebx
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.00401749
add esp, 0x120
ret