Function at 0x47b350
Capabilities:
Copy file
Create process on windows
Delete file
Get common file path
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53ad72
mov eax, dword fs:[0]
push eax
sub esp, 0x5d4
mov eax, dword [0x5954a0]
xor eax, ebp
mov dword [ebp - 0x30], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
call fcn.00402330
test eax, eax
je 0x47b3cd
push str.InstallDriver
call fcn.0047c040
add esp, 4
mov dword [ebp - 0x49c], 1
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
sub eax, 0x10
mov dword [ebp - 0x538], eax
mov ecx, dword [ebp - 0x538]
call fcn.00451230
mov eax, dword [ebp - 0x49c]
jmp 0x47bae9
call fcn.004c02e6
push eax
lea ecx, [ebp - 0x2c]
call fcn.004514d0
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], 0
call fcn.004c02e6
push eax
lea ecx, [ebp - 0x10]
call fcn.004514d0
mov byte [ebp - 4], 2
call fcn.004c02e6
push eax
lea ecx, [ebp - 0x484]
call fcn.004514d0
mov byte [ebp - 4], 3
xor ecx, ecx
mov word [ebp - 0x434], cx
push 0x3fe
push 0
lea edx, [ebp - 0x432]
push edx
call fcn.004f8090
add esp, 0xc
push 0x200
lea eax, [ebp - 0x434]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.drivers_
lea ecx, [ebp - 0x434]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x5668c4
lea edx, [ebp - 0x434]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push str..sys
lea eax, [ebp - 0x434]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x80
lea ecx, [ebp - 0x434]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea edx, [ebp - 0x434]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.0047bee0
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
push 0x54b334
call fcn.0047c040
add esp, 8
cmp dword [ebp - 0x14], 0
je 0x47b649
lea ecx, [ebp + 8]
push ecx
lea ecx, [ebp - 0x10]
call fcn.0044f9d0
mov edx, 0x5668c4
test edx, edx
jne 0x47b4d7
mov dword [ebp - 0x53c], 0
jmp 0x47b4ea
push 0x5668c4
call fcn.004f810a
add esp, 4
mov dword [ebp - 0x53c], eax
mov eax, dword [ebp - 0x53c]
push eax
push 0x5668c4
lea ecx, [ebp - 0x10]
call fcn.0044ecb0
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x484]
call fcn.0044f9d0
mov edx, str..sys
test edx, edx
jne 0x47b522
mov dword [ebp - 0x540], 0
jmp 0x47b535
push str..sys
call fcn.004f810a
add esp, 4
mov dword [ebp - 0x540], eax
mov eax, dword [ebp - 0x540]
push eax
push str..sys
lea ecx, [ebp - 0x10]
call fcn.0044ecb0
mov ecx, str.64.sys
test ecx, ecx
jne 0x47b55e
mov dword [ebp - 0x544], 0
jmp 0x47b571
push str.64.sys
call fcn.004f810a
add esp, 4
mov dword [ebp - 0x544], eax
mov edx, dword [ebp - 0x544]
push edx
push str.64.sys
lea ecx, [ebp - 0x484]
call fcn.0044ecb0
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x548], ecx
push 0
mov edx, dword [ebp - 0x548]
push edx
mov eax, dword [ebp - 0x484]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov dword [ebp - 0x494], 3
mov ecx, dword [ebp - 0x484]
mov dword [ebp - 0x54c], ecx
lea edx, [ebp - 0x51c]
mov dword [ebp - 0x520], edx
push 3
mov eax, dword [ebp - 0x54c]
push eax
lea ecx, [ebp - 0x520]
call fcn.00470670
lea ecx, [ebp - 0x520]
mov dword [ebp - 0x5d0], ecx
mov byte [ebp - 4], 4
mov esi, dword [ebp - 0x5d0]
sub esp, 0x84
mov ecx, 0x21
mov edi, esp
rep movsd dword es:[edi], dword [esi]
push str.szDriverSource64__s_
call fcn.0047c040
add esp, 0x88
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x520]
mov dword [ebp - 0x550], edx
lea eax, [ebp - 0x51c]
cmp dword [ebp - 0x550], eax
je 0x47b649
mov ecx, dword [ebp - 0x550]
push ecx
call fcn.004f84cf
add esp, 4
call fcn.004c02e6
push eax
lea ecx, [ebp - 0x480]
call fcn.004514d0
mov byte [ebp - 4], 5
call fcn.004c02e6
push eax
lea ecx, [ebp - 0x18]
call fcn.004514d0
mov byte [ebp - 4], 6
cmp dword [ebp - 0x14], 0
je 0x47b739
mov edx, str.InstallDrv__keepit__service:
test edx, edx
jne 0x47b68f
mov dword [ebp - 0x554], 0
jmp 0x47b6a2
push str.InstallDrv__keepit__service:
call fcn.004f810a
add esp, 4
mov dword [ebp - 0x554], eax
mov eax, dword [ebp - 0x554]
push eax
push str.InstallDrv__keepit__service:
lea ecx, [ebp - 0x480]
call fcn.0044fb50
mov ecx, 0x5668c4
test ecx, ecx
jne 0x47b6ce
mov dword [ebp - 0x558], 0
jmp 0x47b6e1
push 0x5668c4
call fcn.004f810a
add esp, 4
mov dword [ebp - 0x558], eax
mov edx, dword [ebp - 0x558]
push edx
push 0x5668c4
lea ecx, [ebp - 0x480]
call fcn.0044ecb0
mov eax, 0x54b2b4
test eax, eax
jne 0x47b70d
mov dword [ebp - 0x55c], 0
jmp 0x47b720
push 0x54b2b4
call fcn.004f810a
add esp, 4
mov dword [ebp - 0x55c], eax
mov ecx, dword [ebp - 0x55c]
push ecx
push 0x54b2b4
lea ecx, [ebp - 0x18]
call fcn.0044fb50
jmp 0x47b7f3
mov edx, str.InstallDrv__keepit__service:
test edx, edx
jne 0x47b74e
mov dword [ebp - 0x560], 0
jmp 0x47b761
push str.InstallDrv__keepit__service:
call fcn.004f810a
add esp, 4
mov dword [ebp - 0x560], eax
mov eax, dword [ebp - 0x560]
push eax
push str.InstallDrv__keepit__service:
lea ecx, [ebp - 0x480]
call fcn.0044fb50
mov ecx, 0x5668c4
test ecx, ecx
jne 0x47b78d
mov dword [ebp - 0x564], 0
jmp 0x47b7a0
push 0x5668c4
call fcn.004f810a
add esp, 4
mov dword [ebp - 0x564], eax
mov edx, dword [ebp - 0x564]
push edx
push 0x5668c4
lea ecx, [ebp - 0x480]
call fcn.0044ecb0
mov eax, 0x5480e0
test eax, eax
jne 0x47b7cc
mov dword [ebp - 0x568], 0
jmp 0x47b7df
push 0x5480e0
call fcn.004f810a
add esp, 4
mov dword [ebp - 0x568], eax
mov ecx, dword [ebp - 0x568]
push ecx
push 0x5480e0
lea ecx, [ebp - 0x18]
call fcn.0044fb50
lea edx, [ebp + 8]
push edx
push 0x546398
lea eax, [ebp - 0x524]
push eax
call fcn.0046fd10
add esp, 0xc
mov dword [ebp - 0x5d4], eax
mov ecx, dword [ebp - 0x5d4]
mov dword [ebp - 0x5d8], ecx
mov byte [ebp - 4], 7
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x5d8]
push eax
lea ecx, [ebp - 0x528]
push ecx
call fcn.00451150
add esp, 0xc
mov dword [ebp - 0x5dc], eax
mov edx, dword [ebp - 0x5dc]
mov dword [ebp - 0x5e0], edx
mov byte [ebp - 4], 8
push 0x54b2ac
mov eax, dword [ebp - 0x5e0]
push eax
lea ecx, [ebp - 0x488]
push ecx
call fcn.0044e7e0
add esp, 0xc
mov byte [ebp - 4], 0xa
mov edx, dword [ebp - 0x528]
sub edx, 0x10
mov dword [ebp - 0x56c], edx
mov ecx, dword [ebp - 0x56c]
call fcn.00451230
mov byte [ebp - 4], 0xb
mov eax, dword [ebp - 0x524]
sub eax, 0x10
mov dword [ebp - 0x570], eax
mov ecx, dword [ebp - 0x570]
call fcn.00451230
mov ecx, dword [ebp - 0x480]
mov edx, dword [ecx - 0xc]
mov dword [ebp - 0x574], edx
mov eax, dword [ebp - 0x574]
push eax
mov ecx, dword [ebp - 0x480]
push ecx
lea ecx, [ebp - 0x488]
call fcn.0044ecb0
mov dword [ebp - 0x47c], 0
push 0x40
push 0
lea edx, [ebp - 0x478]
push edx
call fcn.004f8090
add esp, 0xc
mov dword [ebp - 0x47c], 0x44
xor eax, eax
mov word [ebp - 0x44c], ax
mov dword [ebp - 0x28], 0
xor ecx, ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x488]
mov dword [ebp - 0x578], edx
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x47c]
push ecx
push 0
push 0
push 0x20000
push 0
push 0
push 0
mov edx, dword [ebp - 0x578]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x47b9c0
mov dword [ebp - 0x52c], 0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x488]
call fcn.0044f990
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x18]
call fcn.0044f990
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x480]
call fcn.0044f990
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x484]
call fcn.0044f990
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.0044f990
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.0044f990
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0044f990
mov eax, dword [ebp - 0x52c]
jmp 0x47bae9
push 0xffffffffffffffff
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [ebp - 0x14], 0
je 0x47b9da
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00402330
test eax, eax
jne 0x47ba6c
push str.Driver_is_not_Installed...
call fcn.0047c040
add esp, 4
mov dword [ebp - 0x530], 0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x488]
call fcn.0044f990
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x18]
call fcn.0044f990
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x480]
call fcn.0044f990
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x484]
call fcn.0044f990
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.0044f990
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.0044f990
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0044f990
mov eax, dword [ebp - 0x530]
jmp 0x47bae9
push str.Driver_is_Installed...
call fcn.0047c040
add esp, 4
mov dword [ebp - 0x534], 1
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x488]
call fcn.0044f990
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x18]
call fcn.0044f990
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x480]
call fcn.0044f990
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x484]
call fcn.0044f990
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.0044f990
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.0044f990
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0044f990
mov eax, dword [ebp - 0x534]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x30]
xor ecx, ebp
call fcn.004f8124
mov esp, ebp
pop ebp
ret