Function at 0x4e7c84
Capabilities:
Manipulate boot configuration
Move file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xf
push 0
push 0
dec ecx
jne 0x4e7c8c
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4e811b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.004eb238
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x4e80d9
xor edx, edx
push ebp
push 0x4e80cb
push dword fs:[edx]
mov dword fs:[edx], esp
lea ecx, [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.004e9c78
lea eax, [ebp - 0x1c]
mov edx, 0x4e813c
call fcn.00406c98
mov eax, dword [ebp - 0x1c]
call fcn.004d70bc
lea ecx, [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.004e9c78
lea eax, [ebp - 0x20]
mov edx, 0x4e815c
call fcn.00406c98
mov eax, dword [ebp - 0x20]
call fcn.00411eb8
test al, al
je 0x4e7e76
mov dl, 1
mov eax, dword [0x427864]
call fcn.004331e0
mov dword [ebp - 0x14], eax
xor edx, edx
push ebp
push 0x4e7e4d
push dword fs:[edx]
mov dword fs:[edx], esp
lea ecx, [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.004e9c78
lea eax, [ebp - 0x24]
mov edx, 0x4e815c
call fcn.00406c98
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x68]
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4e7e37
inc eax
mov dword [ebp - 0x18], eax
xor esi, esi
lea ecx, [ebp - 8]
mov edx, esi
mov eax, dword [ebp - 0x14]
mov ebx, dword [eax]
call dword [ebx + 0xc]
lea ecx, [ebp - 0x28]
mov edx, esi
mov eax, dword [ebp - 0x14]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov ebx, dword [ebp - 0x2c]
test ebx, ebx
je 0x4e7d9c
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x30]
mov edx, esi
mov eax, dword [ebp - 0x14]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x30]
mov eax, 0x4e817c
call fcn.004072dc
mov edx, eax
add edx, 5
mov ecx, ebx
mov eax, dword [ebp - 8]
call fcn.00406fc4
lea eax, [ebp - 4]
push eax
mov edx, dword [ebp - 4]
mov eax, 0x4e8194
call fcn.004072dc
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00406fc4
lea eax, [ebp - 0x34]
push eax
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.004e6074
mov edx, dword [ebp - 0x34]
lea eax, [ebp - 4]
call fcn.004068c8
mov eax, dword [ebp - 4]
call fcn.004d7efc
test al, al
jne 0x4e7e1a
mov eax, dword [ebp - 4]
call fcn.004d70bc
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 4]
call fcn.00412324
mov eax, dword [ebp - 0x38]
call fcn.0041293c
inc esi
dec dword [ebp - 0x18]
jne 0x4e7d70
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e7e54
mov eax, dword [ebp - 0x14]
call fcn.00404da0
ret
call fcn.004d8fdc
test al, al
je 0x4e7ed5
lea ecx, [ebp - 0x40]
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.004e9c78
lea eax, [ebp - 0x40]
mov edx, 0x4e81a4
call fcn.00406c98
mov eax, dword [ebp - 0x40]
call fcn.00411eb8
test al, al
je 0x4e7fa8
lea ecx, [ebp - 0x44]
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.004e9c78
lea eax, [ebp - 0x44]
mov edx, 0x4e81a4
call fcn.00406c98
mov ecx, dword [ebp - 0x44]
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.004ec34c
jmp 0x4e7fa8
lea ecx, [ebp - 0x48]
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.004e9c78
lea eax, [ebp - 0x48]
mov edx, 0x4e81c4
call fcn.00406c98
mov eax, dword [ebp - 0x48]
call fcn.00411eb8
test al, al
je 0x4e7fa8
lea ecx, [ebp - 0x4c]
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.004e9c78
lea eax, [ebp - 0x4c]
mov edx, 0x4e81e4
call fcn.00406c98
mov eax, dword [ebp - 0x4c]
call fcn.004d70bc
lea ecx, [ebp - 0x50]
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.004e9c78
lea eax, [ebp - 0x50]
mov edx, 0x4e81c4
call fcn.00406c98
mov ebx, dword [ebp - 0x50]
lea ecx, [ebp - 0x54]
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.004e9c78
lea eax, [ebp - 0x54]
mov edx, 0x4e81e4
call fcn.00406c98
mov esi, dword [ebp - 0x54]
mov dword [ebp - 0x2c], esi
mov eax, dword [ebp - 0x2c]
call fcn.00406900
push eax
mov dword [ebp - 0x58], ebx
mov eax, dword [ebp - 0x58]
call fcn.00406900
push eax
call sub.kernel32.dll_MoveFileW
cmp eax, 1
sbb eax, eax
inc eax
push 7
lea ecx, [ebp - 0x5c]
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.004e9c78
lea eax, [ebp - 0x5c]
mov edx, 0x4e81e4
call fcn.00406c98
mov eax, dword [ebp - 0x5c]
call fcn.00406900
push eax
call sub.kernel32.dll_SetFileAttributesW
lea ecx, [ebp - 0x60]
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.004e9c78
lea eax, [ebp - 0x60]
mov edx, 0x4e8204
call fcn.00406c98
mov eax, dword [ebp - 0x60]
push eax
lea ecx, [ebp - 0x64]
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.004e9c78
lea eax, [ebp - 0x64]
mov edx, 0x4e821c
call fcn.00406c98
mov edx, dword [ebp - 0x64]
mov eax, dword [ebp - 0xc]
pop ecx
call fcn.004ecb24
call fcn.004d8fdc
test al, al
je 0x4e8039
lea ecx, [ebp - 0x68]
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.004e9c78
lea eax, [ebp - 0x68]
mov edx, 0x4e8238
call fcn.00406c98
mov eax, dword [ebp - 0x68]
push eax
lea ecx, [ebp - 0x6c]
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.004e9c78
lea eax, [ebp - 0x6c]
mov edx, 0x4e8258
call fcn.00406c98
mov edx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0xc]
pop ecx
call fcn.004ecb24
lea ecx, [ebp - 0x70]
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.004e9c78
lea eax, [ebp - 0x70]
mov edx, 0x4e8278
call fcn.00406c98
mov eax, dword [ebp - 0x70]
push eax
lea ecx, [ebp - 0x74]
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.004e9c78
lea eax, [ebp - 0x74]
mov edx, 0x4e8298
call fcn.00406c98
mov edx, dword [ebp - 0x74]
mov eax, dword [ebp - 0xc]
pop ecx
call fcn.004ecb24
lea ecx, [ebp - 0x78]
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.004e9c78
lea eax, [ebp - 0x78]
mov edx, 0x4e82b8
call fcn.00406c98
mov eax, dword [ebp - 0x78]
push eax
lea ecx, [ebp - 0x7c]
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.004e9c78
lea eax, [ebp - 0x7c]
mov edx, 0x4e82d8
call fcn.00406c98
mov edx, dword [ebp - 0x7c]
mov eax, dword [ebp - 0xc]
pop ecx
call fcn.004ecb24
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4e80d9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e8122
lea eax, [ebp - 0x7c]
mov edx, 9
call fcn.0040686c
lea eax, [ebp - 0x54]
mov edx, 0xa
call fcn.0040686c
lea eax, [ebp - 0x28]
mov edx, 4
call fcn.0040686c
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040686c
ret