Function at 0x4040a0
Capabilities:
Copy file
Create process on windows
Get common file path
Stop service

Disassembly:
push 0xffffffffffffffff
push 0x4086bb
mov eax, dword fs:[0]
push eax
mov eax, 0x1104
call fcn.00408610
mov eax, dword [0x40d018]
xor eax, esp
mov dword [esp + 0x1100], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x40d018]
xor eax, esp
push eax
lea eax, [esp + 0x1118]
mov dword fs:[0], eax
push 0x3fe
xor ebp, ebp
lea ecx, [esp + 0x51a]
xor eax, eax
push ebp
push ecx
mov word [esp + 0x520], ax
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x3fe
lea eax, [esp + 0x11a]
xor edx, edx
push ebp
push eax
mov word [esp + 0x120], dx
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x3fe
lea edx, [esp + 0xd1a]
xor ecx, ecx
push ebp
push edx
mov word [esp + 0xd20], cx
call sub.MSVCR90.dll_memset
mov edi, dword [sym.imp.MSVCR90.dll_wcscpy_s]
add esp, 0xc
push str.BkpDrv
lea eax, [esp + 0x4c]
push 0x64
push eax
mov dword [esp + 0x28], vtable.ServiceControlMgr.0
call edi
add esp, 0xc
push 0xf003f
push ebp
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x20], eax
call esi
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x20]
cmp eax, ebp
je 0x4041a0
push 0xf01ff
lea ecx, [esp + 0x4c]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [esp + 0x24], eax
call esi
mov dword [esp + 0x28], eax
mov dword [esp + 0x1120], ebp
mov ecx, dword [0x40d550]
cmp ecx, ebp
jne 0x4041d5
push 0xe60
call sub.MSVCR90.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
cmp eax, ebp
je 0x4041cb
mov esi, eax
call fcn.00403000
jmp 0x4041cd
xor eax, eax
mov ecx, eax
mov dword [0x40d550], ecx
lea esi, [ecx + 0x618]
mov eax, esi
lea ebx, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x4041e0
sub eax, ebx
sar eax, 1
jne 0x404210
call fcn.004031a0
push eax
push 0x104
push esi
call edi
add esp, 0xc
push esi
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push esi
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
push esi
lea edx, [esp + 0xd18]
push 0x200
push edx
call edi
mov esi, dword [sym.imp.MSVCR90.dll_wcscat_s]
add esp, 0xc
push str.DATAPROT
lea eax, [esp + 0xd18]
push 0x200
push eax
call esi
add esp, 0xc
push 0x200
lea ecx, [esp + 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.System32driversBkpDrv.sys
lea edx, [esp + 0x118]
push 0x200
push edx
call esi
add esp, 0xc
xor eax, eax
push 0x3fe
push eax
lea ecx, [esp + 0x91e]
push ecx
mov word [esp + 0x920], ax
call sub.MSVCR90.dll_memset
add esp, 0xc
lea edx, [esp + 0xd14]
push edx
push str.rundll32_syssetup_SetupInfObjectInstallAction_DefaultInstall_128__sBKPDRV.INF
lea edx, [esp + 0x91c]
call fcn.004067c0
lea eax, [esp + 0xd1c]
push eax
push str._sBkpDrv.sys
lea edx, [esp + 0x524]
call fcn.004067c0
call fcn.00404500
lea ecx, [esp + 0x524]
push ecx
lea ecx, [esp + 0x128]
call fcn.004047c0
add esp, 0x14
cmp eax, 0xfffffffe
jne 0x40431d
mov ecx, dword [0x40d550]
test ecx, ecx
jne 0x40430b
push 0xe60
call sub.MSVCR90.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x404301
mov esi, eax
call fcn.00403000
jmp 0x404303
xor eax, eax
mov ecx, eax
mov dword [0x40d550], ecx
push str.Error_:__2_So_Try_To_Install_Driver_using_BKPDRV.INF
call fcn.00403540
add esp, 4
jmp 0x404499
cmp eax, 0xffffffff
jne 0x4043f3
mov eax, dword [0x40d550]
test eax, eax
jne 0x404350
push 0xe60
call sub.MSVCR90.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x404349
mov esi, eax
call fcn.00403000
jmp 0x40434b
xor eax, eax
mov dword [0x40d550], eax
push str.Newer_version_Of_Driver_Available
mov ecx, eax
call fcn.00403540
add esp, 4
lea eax, [esp + 0x1c]
call fcn.004039b0
test eax, eax
je 0x4043c0
call fcn.00404bb0
mov esi, dword [sym.imp.KERNEL32.dll_WinExec]
test eax, eax
je 0x404384
push 0
push str.fltmc_unload_BkpDrv
call esi
push 0
lea edx, [esp + 0x118]
push edx
lea eax, [esp + 0x51c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0
push str.fltmc_load_BkpDrv
mov ebp, eax
call esi
push str.Driver_Unload_Copy_Driver_And_Again_Load
call fcn.00402fc0
mov ecx, eax
call fcn.00403540
add esp, 4
jmp 0x4044b2
push 0
lea ecx, [esp + 0x118]
push ecx
lea edx, [esp + 0x51c]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push str.Install_Driver_using_BKPDRV.INF_after_copying_new_version
mov ebp, eax
call fcn.00402fc0
mov ecx, eax
call fcn.00403540
add esp, 4
jmp 0x404499
test eax, eax
jne 0x40441a
lea eax, [esp + 0x1c]
call fcn.004039b0
test eax, eax
je 0x404499
call fcn.00404bb0
test eax, eax
jne 0x4044b2
jmp 0x4044a5
cmp eax, 1
jne 0x4044b2
push str.Drivers_vdrv_is_newer_than_zvpath_then_replace_At_ZVscan_and_then_restart
call fcn.00402fc0
mov ecx, eax
call fcn.00403540
add esp, 4
lea eax, [esp + 0x1c]
call fcn.004039b0
test eax, eax
je 0x40447f
call fcn.00404bb0
test eax, eax
je 0x404463
mov eax, dword [esp + 0x24]
test eax, eax
je 0x404463
lea ecx, [esp + 0x2c]
push ecx
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
push 0
lea edx, [esp + 0x118]
push edx
lea eax, [esp + 0x51c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ebp, eax
jmp 0x4044a5
push 0
lea ecx, [esp + 0x118]
push ecx
lea edx, [esp + 0x51c]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ebp, eax
lea esi, [esp + 0x914]
call fcn.00404d40
push 0
push str.fltmc_load_BkpDrv
call dword [sym.imp.KERNEL32.dll_WinExec]
mov eax, dword [esp + 0x24]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [esp + 0x1c], vtable.ServiceControlMgr.0
test eax, eax
je 0x4044cb
push eax
call esi
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4044d6
push eax
call esi
mov eax, ebp
mov ecx, dword [esp + 0x1118]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1100]
xor ecx, esp
call fcn.00407c9c
add esp, 0x1110
ret