Function at 0x100e17e
Capabilities:
Manipulate boot configuration

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xd70
mov eax, dword [0x1036a44]
mov ecx, dword [ebp + 0xc]
or dword [ebp - 0xd40], 0xffffffff
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp esi, edi
mov dword [ebp - 4], eax
mov eax, 0x800
mov dword [ebp - 0xd64], esi
mov dword [ebp - 0xd60], ecx
mov dword [ebp - 0xd50], edi
mov byte [ebp - 0xd41], 1
mov ebx, eax
mov dword [ebp - 0xd3c], edi
mov dword [ebp - 0xd48], edi
mov dword [ebp - 0xd58], edi
je 0x100e889
cmp ecx, edi
je 0x100e889
push eax
call int.0102ec4e
cmp eax, edi
pop ecx
mov dword [ebp - 0xd4c], eax
jne 0x100e200
mov eax, 0x8007000e
jmp 0x100e88e
mov edi, dword [ebp - 0xd4c]
xor eax, eax
push eax
push eax
mov ecx, 0x200
rep stosd dword es:[edi], eax
push 0x208
lea eax, [ebp - 0x928]
push eax
call sub.dmutil.dll_GetSystemVolume
test eax, eax
jne 0x100e876
lea eax, [ebp - 0x928]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
test eax, eax
pop ecx
je 0x100e876
xor eax, eax
mov ecx, 0x82
lea edi, [ebp - 0x310]
rep stosd dword es:[edi], eax
push 0x1001744
lea eax, [ebp - 0x928]
push eax
lea eax, [ebp - 0x310]
push 0x1001738
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0x10
lea eax, [ebp - 0xd40]
push eax
push 0x180
lea eax, [ebp - 0x310]
push eax
call fcn.0101ee58
test eax, eax
jl 0x100e80a
cmp dword [ebp - 0xd40], 0
je 0x100e80a
cmp dword [ebp - 0xd40], 0xffffffff
je 0x100e80a
push dword [ebp - 0xd40]
call sub.dmutil.dll_LowNtReadOnlyAttributeOff
test eax, eax
jl 0x100e80a
push dword [ebp - 0xd40]
call fcn.0101f4b2
or dword [ebp - 0xd40], 0xffffffff
lea eax, [ebp - 0xd40]
push eax
push 0xc0000000
lea eax, [ebp - 0x310]
push eax
call fcn.0101ee58
test eax, eax
jl 0x100e80a
cmp dword [ebp - 0xd40], 0
je 0x100e80a
cmp dword [ebp - 0xd40], 0xffffffff
je 0x100e80a
mov edi, dword [ebp - 0xd4c]
lea eax, [ebp - 0xd3c]
push eax
push ebx
push edi
push 0
push 0
push dword [ebp - 0xd40]
call sub.dmutil.dll_LowNtReadFile
cmp eax, 0xc0000011
je 0x100e336
test eax, eax
jne 0x100e80a
test eax, eax
mov eax, dword [ebp - 0xd3c]
jne 0x100e344
cmp eax, ebx
je 0x100e34b
lea ecx, [ebx - 2]
cmp eax, ecx
jbe 0x100e383
push edi
call fcn.0102ec42
add ebx, ebx
push ebx
call int.0102ec4e
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 0xd4c], eax
je 0x100e86a
mov edi, dword [ebp - 0xd4c]
mov ecx, ebx
mov edx, ecx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
jmp 0x100e309
mov dword [ebp - 0xd70], eax
lea eax, [edi + eax - 1]
mov dword [ebp - 0xd5c], eax
mov eax, dword [esi + 0x94]
and dword [ebp - 0xd54], 0
cmp dword [eax + 4], 0
jle 0x100e688
mov eax, dword [eax]
mov ecx, dword [ebp - 0xd54]
mov eax, dword [eax + ecx*4]
test eax, eax
mov dword [ebp - 0xd68], eax
je 0x100e66d
cmp byte [ebp - 0xd41], 0
je 0x100e3d7
cmp dword [eax + 0x30], 3
je 0x100e3e1
jmp 0x100e66d
cmp dword [eax + 0x30], 4
jne 0x100e66d
push eax
push esi
lea eax, [ebp - 0xd58]
push eax
call fcn.0100d9d7
xor eax, eax
mov ebx, 0x82
mov ecx, ebx
lea edi, [ebp - 0xd38]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xd38]
push eax
push esi
push 0
lea eax, [ebp - 0xd58]
push eax
call fcn.010293f7
test eax, eax
jne 0x100e4d1
lea eax, [ebp - 0xd38]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
test eax, eax
pop ecx
je 0x100e4d1
xor eax, eax
mov ecx, ebx
lea edi, [ebp - 0x518]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xd38]
push eax
lea eax, [ebp - 0x518]
push 0x1001734
push eax
call dword [sym.imp.msvcrt.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0x518]
test eax, eax
je 0x100e66d
mov cl, byte [eax]
inc eax
cmp cl, 0x29
jne 0x100e462
test eax, eax
je 0x100e66d
mov cl, byte [eax]
inc eax
cmp cl, 0x29
jne 0x100e472
test eax, eax
je 0x100e66d
push eax
push dword [ebp - 0xd4c]
call dword [sym.imp.msvcrt.dll_strstr]
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
je 0x100e66d
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100e4a6
sub eax, edx
mov dword [ebp - 0xd6c], eax
je 0x100e66d
jmp 0x100e4be
inc ebx
cmp byte [ebx], 0x29
jne 0x100e4bd
jmp 0x100e4c6
inc ebx
cmp byte [ebx], 0x28
jne 0x100e4c5
inc ebx
jmp 0x100e5c3
push dword [esi + 0xa8]
lea eax, [ebp - 0x108]
push 0x1001720
push eax
call dword [sym.imp.msvcrt.dll_sprintf]
mov ebx, dword [ebp - 0xd4c]
add esp, 0xc
test ebx, ebx
je 0x100e66d
lea eax, [ebp - 0x108]
push eax
push ebx
call dword [sym.imp.msvcrt.dll_strstr]
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
je 0x100e66d
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100e517
sub eax, edx
mov dword [ebp - 0xd6c], eax
je 0x100e5a1
mov eax, dword [ebp - 0xd5c]
cmp ebx, eax
je 0x100e4f2
mov cl, byte [ebx]
inc ebx
cmp cl, 0x29
jne 0x100e52e
cmp ebx, eax
je 0x100e4f2
mov cl, byte [ebx]
inc ebx
cmp cl, 0x29
jne 0x100e53a
cmp ebx, eax
je 0x100e4f2
mov cl, byte [ebx]
inc ebx
cmp cl, 0x29
jne 0x100e546
cmp ebx, eax
je 0x100e4f2
mov cl, byte [ebx]
inc ebx
cmp cl, 0x28
jne 0x100e552
cmp ebx, eax
je 0x100e4f2
push dword [ebp - 0xd58]
lea eax, [ebp - 0x720]
push 0x100171c
push eax
call dword [sym.imp.msvcrt.dll_sprintf]
mov cl, byte [ebx]
add esp, 0xc
cmp cl, 0x29
lea eax, [ebp - 0x720]
je 0x100e5a1
mov edx, ebx
mov edi, eax
sub edx, edi
cmp cl, byte [eax]
jne 0x100e4f2
inc eax
mov cl, byte [edx + eax]
cmp cl, 0x29
jne 0x100e590
test ebx, ebx
je 0x100e66d
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100e5ae
sub eax, edx
mov dword [ebp - 0xd6c], eax
je 0x100e66d
mov edx, dword [ebp - 0xd60]
mov eax, dword [edx + 0x94]
dec dword [ebp - 0xd54]
xor edi, edi
xor esi, esi
cmp dword [eax + 4], edi
jle 0x100e61b
mov eax, dword [eax]
mov ecx, dword [eax + edi*4]
test ecx, ecx
je 0x100e60f
cmp dword [ecx + 0x30], 3
jne 0x100e60f
push dword [ebp - 0xd68]
inc esi
call fcn.01006149
test al, al
je 0x100e609
cmp esi, dword [ebp - 0xd58]
jne 0x100e6a1
mov edx, dword [ebp - 0xd60]
mov eax, dword [edx + 0x94]
inc edi
cmp edi, dword [eax + 4]
jl 0x100e5de
mov eax, dword [edx + 0x94]
xor edi, edi
cmp dword [eax + 4], edi
jle 0x100e661
mov eax, dword [eax]
mov ecx, dword [eax + edi*4]
test ecx, ecx
je 0x100e64f
cmp dword [ecx + 0x30], 4
jne 0x100e64f
push dword [ebp - 0xd68]
inc esi
call fcn.01006149
test al, al
je 0x100e64f
cmp esi, dword [ebp - 0xd58]
jne 0x100e6a1
mov eax, dword [ebp - 0xd60]
mov eax, dword [eax + 0x94]
inc edi
cmp edi, dword [eax + 4]
jl 0x100e628
inc dword [ebp - 0xd54]
mov esi, dword [ebp - 0xd64]
inc dword [ebp - 0xd54]
mov eax, dword [esi + 0x94]
mov ecx, dword [ebp - 0xd54]
cmp ecx, dword [eax + 4]
jl 0x100e3aa
cmp byte [ebp - 0xd41], 0
je 0x100e815
mov byte [ebp - 0xd41], 0
jmp 0x100e393
cmp dword [ebp - 0xd48], 0
je 0x100e6b6
push dword [ebp - 0xd48]
call fcn.0102ec42
pop ecx
push dword [ebp - 0xd3c]
call int.0102ec4e
test eax, eax
pop ecx
mov dword [ebp - 0xd48], eax
je 0x100e86a
mov ecx, dword [ebp - 0xd3c]
mov edi, dword [ebp - 0xd48]
mov edx, ecx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
and dword [ebp - 0xd3c], 0
cmp dword [ebp - 0xd5c], ebx
mov edi, dword [ebp - 0xd48]
mov eax, ebx
je 0x100e717
mov cl, byte [eax]
mov byte [edi], cl
inc edi
inc eax
inc dword [ebp - 0xd3c]
cmp eax, dword [ebp - 0xd5c]
jne 0x100e703
mov al, byte [eax]
mov byte [edi], al
inc dword [ebp - 0xd3c]
mov ecx, dword [ebp - 0xd3c]
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
cmp esi, 0x63
rep stosb byte es:[edi], al
mov ecx, esi
jle 0x100e76e
xor edx, edx
push 0x64
pop ecx
mov eax, esi
div ecx
mov ecx, esi
xor edx, edx
push 0xa
pop edi
add al, 0x30
mov byte [ebx], al
inc ebx
movsx eax, byte [ebx]
imul eax, eax, 0x64
sub ecx, eax
mov eax, ecx
div edi
add al, 0x30
mov byte [ebx], al
inc ebx
movsx eax, byte [ebx]
imul eax, eax, 0xfffffff6
add ecx, eax
cmp esi, 9
jle 0x100e789
xor edx, edx
push 0xa
mov eax, ecx
pop esi
div esi
add al, 0x30
mov byte [ebx], al
inc ebx
movsx eax, byte [ebx]
imul eax, eax, 0xfffffff6
add ecx, eax
mov eax, dword [ebp - 0xd48]
add cl, 0x30
mov byte [ebx], cl
inc ebx
cmp dword [ebp - 0xd58], 0x63
jle 0x100e7aa
add eax, 3
sub dword [ebp - 0xd3c], 3
jmp 0x100e7c6
cmp dword [ebp - 0xd58], 9
jle 0x100e7bf
add eax, 2
sub dword [ebp - 0xd3c], 2
jmp 0x100e7c6
inc eax
dec dword [ebp - 0xd3c]
cmp dword [ebp - 0xd3c], 0
je 0x100e7e7
mov ecx, dword [ebp - 0xd3c]
mov esi, eax
mov eax, ecx
shr ecx, 2
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push dword [ebp - 0xd70]
push dword [ebp - 0xd4c]
push 0
push 0
push dword [ebp - 0xd40]
call sub.dmutil.dll_LowNtWriteFile
test eax, eax
jge 0x100e667
or eax, 0x10000000
mov dword [ebp - 0xd50], eax
xor esi, esi
cmp dword [ebp - 0xd40], esi
je 0x100e83a
cmp dword [ebp - 0xd40], 0xffffffff
je 0x100e83a
push dword [ebp - 0xd40]
call fcn.0101f4b2
or dword [ebp - 0xd40], 0xffffffff
cmp dword [ebp - 0xd4c], esi
je 0x100e84e
push dword [ebp - 0xd4c]
call fcn.0102ec42
pop ecx
cmp dword [ebp - 0xd48], esi
je 0x100e862
push dword [ebp - 0xd48]
call fcn.0102ec42
pop ecx
mov eax, dword [ebp - 0xd50]
jmp 0x100e88e
mov dword [ebp - 0xd50], 0x8007000e
jmp 0x100e815
push dword [ebp - 0xd4c]
call fcn.0102ec42
pop ecx
mov eax, 0x80004005
jmp 0x100e88e
mov eax, 0x80070057
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0102e95a
leave
ret 8