Function at 0x406fe0
Capabilities:
Extract resource via kernel32 functions
Get common file path

Disassembly:
sub esp, 0x28
push esi
push 0x2e
push 0x13304
mov dword [esp + 0x20], 0
call fcn.00401170
mov esi, eax
mov dword [esp + 4], esi
test esi, esi
je 0x40756e
push ebx
push ebp
lea ebp, [esi + 0x3000]
push edi
lea eax, [ebp + 0x10000]
mov dword [esp + 0x20], eax
push 0x10000
add eax, 0x104
push ebp
mov dword [esp + 0x34], eax
call fcn.00401a50
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
movsx eax, byte [esi]
mov ebx, dword [esp + 0x40]
lea esi, [esp + 0x14]
mov edi, ebx
mov dword [esp + 0x18], eax
call fcn.00406540
mov ecx, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
push ecx
push 3
push esi
push 0
push ebx
call fcn.004063c0
test eax, eax
jne 0x40707c
mov edx, dword [esp + 0x3c]
push eax
push 0x409c18
push edx
call fcn.00401c10
jmp 0x40756b
mov eax, 0xaa55
cmp word [esi + 0x1fe], ax
je 0x4070a0
mov ecx, dword [esp + 0x3c]
push 0
push 0x409bf8
push ecx
call fcn.00401c10
jmp 0x40756b
mov edi, dword [esp + 0x44]
cmp edi, 4
je 0x4070d6
cmp edi, 5
je 0x4070d6
push 0x409bec
lea edx, [esi + 0x52]
push edx
call fcn.00401430
test eax, eax
je 0x4070fe
mov eax, dword [esp + 0x3c]
push 0
push 0x409bd0
push eax
call fcn.00401c10
jmp 0x40756b
push str.NTFS
lea ecx, [esi + 3]
push ecx
call fcn.00401430
test eax, eax
je 0x4070fe
mov edx, dword [esp + 0x3c]
push 0
push 0x409ba8
push edx
call fcn.00401c10
jmp 0x40756b
mov eax, dword [esi + 0x1c]
mov dword [esp + 0x34], eax
test edi, edi
jne 0x40710e
lea eax, [edi + 1]
jmp 0x407144
cmp edi, 1
jne 0x407118
lea eax, [edi + 3]
jmp 0x407144
cmp edi, 2
jne 0x407122
lea eax, [edi + 5]
jmp 0x407144
cmp edi, 3
jne 0x40712c
lea eax, [edi + 7]
jmp 0x407144
cmp edi, 4
jne 0x407136
lea eax, [edi + 7]
jmp 0x407144
cmp edi, 5
jne 0x40756b
mov eax, 0xc
lea ecx, [esp + 0x1c]
push ecx
movzx edx, ax
push 0x409700
push edx
call fcn.00401b30
mov dword [esp + 0x28], eax
test eax, eax
je 0x40756b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp dword [esp + 0x1c], 0x200
mov esi, eax
mov edi, ebp
jl 0x4071a2
push 0x200
push esi
push edi
call fcn.00401a00
mov eax, dword [esp + 0x1c]
add edi, dword [esp + 0x14]
sub eax, 0x200
add esi, 0x200
cmp eax, 0x200
mov dword [esp + 0x1c], eax
jge 0x407178
mov eax, dword [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov esi, dword [esp + 0x44]
cmp esi, 4
je 0x4071cb
cmp esi, 5
je 0x4071cb
mov ecx, dword [esp + 0x10]
push 0x3c
add ecx, 0xb
push ecx
lea edx, [ebp + 0xb]
push edx
jmp 0x4071d9
mov eax, dword [esp + 0x10]
push 0x49
add eax, 0xb
push eax
lea ecx, [ebp + 0xb]
push ecx
call fcn.00401a00
test esi, esi
jne 0x4072b6
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push 0x200
lea eax, [esi + edx]
push eax
lea ecx, [esi + ebp]
push ecx
call fcn.00401a00
push esi
push 3
push ebp
push 0
push ebx
call fcn.00406260
test eax, eax
je 0x4074cf
push esi
push 3
push ebp
push 6
push ebx
call fcn.00406260
test eax, eax
je 0x4074cf
mov edi, dword [esp + 0x18]
push 0
push 1
xor ebx, ebx
mov eax, edi
call fcn.00406060
push ebx
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x44]
push 1
call fcn.00406060
mov ecx, dword [esp + 0x44]
cmp eax, ecx
jne 0x4072a0
mov ebx, dword [esp + 0x3c]
push 4
push 0x409b88
push ebx
call fcn.00401c10
cmp eax, 6
jne 0x4072a0
push edi
mov edi, dword [esp + 0x14]
push str._c:MSDOS.BIN
push edi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x200
push ebp
push ebx
mov ebx, dword [esp + 0x2c]
call fcn.00405fc0
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x3c]
push str.MSDOS
push edi
push edx
push eax
call fcn.00406dd0
mov ecx, dword [esp + 0x3c]
push 0
push 0x409b28
push ecx
call fcn.00401c10
jmp 0x407448
cmp esi, 1
je 0x407495
cmp esi, 3
je 0x407495
cmp esi, 2
jne 0x407489
push 5
push 0x40b078
push 0x200
push ebp
call fcn.00401460
test eax, eax
jge 0x4072fd
mov edx, dword [esp + 0x3c]
push 0
push str.SysLinux
push edx
call fcn.00401c10
jmp 0x40756b
mov eax, dword [eax + ebp + 5]
mov esi, dword [esp + 0x3c]
push ebx
push esi
mov dword [esp + 0x4c], eax
call fcn.00406d50
test eax, eax
je 0x40756b
mov edi, dword [esp + 0x2c]
push 0x200
push edi
call fcn.00401a50
lea ecx, [esp + 0x30]
push ecx
push edi
push str.LIVEOSLDLINUX.SYS
push ebx
mov dword [esp + 0x40], 0x40
call fcn.00405c00
test eax, eax
jne 0x407355
push eax
push str.GetFileSectorList__
push esi
call fcn.00401c10
jmp 0x40756b
mov edx, dword [esp + 0x44]
mov eax, dword [esp + 0x10]
push edx
push ebx
push esi
call fcn.00406b70
test eax, eax
je 0x40756b
mov eax, dword [ebp + 0x43]
push eax
push ebx
push esi
call fcn.00406c30
test eax, eax
je 0x40756b
push 9
push 0x40b06c
push 0x200
push ebp
call fcn.00401460
test eax, eax
jge 0x4073a8
push 0
push str.SysLinux_4.03
push esi
call fcn.00401c10
jmp 0x40756b
mov ecx, dword [edi]
mov dword [eax + ebp - 4], ecx
cmp ebx, dword [esp + 0x18]
je 0x4073c7
push 1
push ebp
push 0
push ebx
call fcn.004061b0
test eax, eax
je 0x4074d3
mov edi, dword [esp + 0x18]
push 0
push 1
xor ebx, ebx
mov eax, edi
call fcn.00406060
push ebx
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x44]
push 1
call fcn.00406060
mov ecx, dword [esp + 0x44]
cmp eax, ecx
jne 0x407437
push 4
push 0x409b88
push esi
call fcn.00401c10
cmp eax, 6
jne 0x407437
push edi
mov edi, dword [esp + 0x14]
push str._c:SYSLINUX.BIN
push edi
call dword [sym.imp.USER32.dll_wsprintfA]
mov ebx, dword [esp + 0x2c]
add esp, 0xc
push 0x200
push ebp
push esi
call fcn.00405fc0
mov edx, dword [esp + 0x18]
push 0x409a84
push edi
push edx
push esi
call fcn.00406dd0
push 0
push 0x4099e8
push esi
call fcn.00401c10
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x40]
push 0
push 1
xor ebx, ebx
call fcn.00406060
mov ebp, eax
test ebp, ebp
jl 0x407552
mov edi, dword [esp + 0x10]
push esi
push 1
push edi
push ebx
push ebp
call fcn.004063c0
test eax, eax
jne 0x4074e5
mov ecx, dword [esp + 0x3c]
push eax
push str.MBR_
push ecx
call fcn.00401c10
jmp 0x40756b
mov eax, dword [esp + 0x14]
push eax
push 0x10
push ebp
push 0
jmp 0x4074c1
mov esi, dword [esp + 0x14]
push esi
push 1
push ebp
push 0
push ebx
call fcn.00406260
test eax, eax
je 0x4074cf
push esi
push 1
push ebp
push 6
push ebx
call fcn.00406260
test eax, eax
je 0x4074cf
push esi
push 1
add esi, ebp
push esi
push 0xc
push ebx
call fcn.00406260
test eax, eax
jne 0x407444
mov esi, dword [esp + 0x3c]
push 0
push 0x4099b4
push esi
call fcn.00401c10
jmp 0x40756b
cmp byte [edi], 0
je 0x407500
mov edx, dword [esp + 0x3c]
push 1
push 0x409998
push edx
call fcn.00401c10
cmp eax, 1
jne 0x407552
mov ecx, dword [esp + 0x34]
cmp dword [edi + 0x1c6], ecx
lea eax, [edi + 0x1be]
setne dl
dec dl
and dl, 0x80
cmp dword [eax + 0x18], ecx
mov byte [eax], dl
setne dl
dec dl
and dl, 0x80
cmp dword [eax + 0x28], ecx
mov byte [eax + 0x10], dl
setne dl
dec dl
and dl, 0x80
cmp dword [eax + 0x38], ecx
mov byte [eax + 0x20], dl
mov edx, dword [esp + 0x48]
setne cl
push edx
dec cl
push eax
and cl, 0x80
push ebp
mov ebx, esi
mov byte [eax + 0x30], cl
call fcn.00406f50
mov eax, dword [esp + 0x3c]
push 0
push 0x409974
push eax
call fcn.00401c10
mov dword [esp + 0x24], 1
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 4]
push ecx
call fcn.004029d0
mov eax, dword [esp + 0x18]
pop esi
add esp, 0x28
ret 0x10