Function at 0x404520
Capabilities:
Create process on windows
Set current directory

Disassembly:
sub esp, 0x6a4
mov eax, dword [0x420044]
xor eax, esp
mov dword [esp + 0x69c], eax
movzx eax, word [esp + 0x6ac]
push ebx
push ebp
push esi
push edi
push eax
movzx ecx, cx
push ecx
mov esi, edx
lea edx, [esp + 0x290]
push str.VID__04XPID__04X
push edx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], 0
mov byte [esp + 0x27], 0
call fcn.00407696
mov bl, byte [esp + 0x6c8]
add esp, 0x10
mov eax, str.Install
cmp bl, 1
je 0x404583
mov eax, str.Uninstall
lea ecx, [esp + 0x288]
push ecx
push eax
push str.2.3_InstallDriverFilter_to__s_for__s_n
call fcn.00403380
add esp, 0xc
test bl, bl
je 0x4045ac
call section..text
mov dword [esp + 0x78], 0x646461
jmp 0x4045b4
mov dword [esp + 0x78], 0x6d6572
lea eax, [esp + 0x78]
dec eax
cmp dword [0x42106c], 0
je 0x404610
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4045c2
mov edx, dword [str.filter64.exe]
mov ecx, dword [0x41cf54]
mov dword [eax], edx
mov edx, dword [0x41cf58]
mov dword [eax + 4], ecx
mov cl, byte [0x41cf5c]
mov dword [eax + 8], edx
mov edx, dword [str.amd64]
mov byte [eax + 0xc], cl
mov ax, word [0x41cf64]
mov dword [esp + 0x180], edx
mov word [esp + 0x184], ax
jmp 0x404646
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x404610
mov ecx, dword [str.filter86.exe]
mov edx, dword [0x41cf6c]
mov dword [eax], ecx
mov ecx, dword [0x41cf70]
mov dword [eax + 4], edx
mov dl, byte [0x41cf74]
mov dword [eax + 8], ecx
mov byte [eax + 0xc], dl
mov dword [esp + 0x180], 0x363878
push esi
lea eax, [esp + 0x394]
push str._sDriverFilter
push eax
call fcn.00407696
lea ecx, [esp + 0x18c]
push ecx
lea edx, [esp + 0x3a0]
push edx
lea eax, [esp + 0x4ac]
push str._s_s_vl810filter.sys
push eax
call fcn.00407696
lea ecx, [esp + 0x4b4]
push 0x41bd14
push ecx
call fcn.004077d7
add esp, 0x24
test eax, eax
jne 0x4046b0
lea edx, [esp + 0x498]
push edx
push str.___Error__s_not_fopen__n
call fcn.004032b0
add esp, 8
mov al, 1
jmp 0x404857
lea eax, [esp + 0x288]
push eax
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x5a8]
push str._s_vl810filter__device___s_
push edx
call fcn.00407696
lea eax, [esp + 0x5b0]
push eax
push str.cmd:__s_n
call fcn.004032b0
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ebp, dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0x18
lea esp, [esp]
lea ecx, [esp + 0x390]
push ecx
call esi
push 0x44
lea edx, [esp + 0x34]
push 0
push edx
call fcn.00409780
add esp, 0xc
xor eax, eax
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x34]
push edx
push eax
push eax
push eax
push eax
push eax
push eax
mov word [esp + 0x80], ax
lea eax, [esp + 0x5c0]
push eax
push 0
mov dword [esp + 0x58], 0x44
mov dword [esp + 0x84], 1
call ebp
mov dword [esp + 0x18], eax
test eax, eax
je 0x404789
mov ecx, dword [esp + 0x24]
push ecx
call edi
mov edx, dword [esp + 0x20]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov edx, dword [esp + 0x20]
push edx
call edi
jmp 0x404791
mov dword [esp + 0x18], 5
mov eax, dword [esp + 0x1c]
push eax
call esi
mov eax, dword [esp + 0x18]
test eax, eax
je 0x40481a
cmp eax, 1
jne 0x4047ac
push str.Filter_Driver_Fail_for_no_command_n
jmp 0x4047da
cmp eax, 2
jne 0x4047b8
push str.Filter_Driver_Fail_to_get_service_n
jmp 0x4047da
cmp eax, 3
jne 0x4047c4
push str.Filter_Driver_Fail_for_no_match_device_n
jmp 0x4047da
cmp eax, 4
jne 0x4047d0
push str.Filter_Driver_Fail_to_need_reboot_n
jmp 0x4047da
cmp eax, 5
jne 0x4047e6
push str.Filter_Driver_Fail_to_CreateProcessA_n
call fcn.00403380
mov eax, dword [esp + 0x1c]
add esp, 4
cmp eax, 4
jne 0x40484d
cmp byte [esp + 0x17], 0
jne 0x404849
cmp byte [esp + 0x6b8], 1
jne 0x404849
push str.Retry_for_InstallDriverFilter___n
mov byte [esp + 0x1b], 1
call fcn.00403380
add esp, 4
push 0xbb8
call ebx
jmp 0x404700
cmp byte [esp + 0x6b8], 1
mov eax, str.Install
je 0x40482e
mov eax, str.Uninstall
push eax
push str._s_Filter_Driver_OK_n
call fcn.00403380
add esp, 8
push 0xbb8
call ebx
mov eax, dword [esp + 0x18]
jmp 0x404852
xor eax, eax
jmp 0x404852
mov eax, 1
test eax, eax
setne al
mov ecx, dword [esp + 0x6ac]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004071fc
add esp, 0x6a4
ret 8