Function at 0x401d87
Capabilities:
Create process on windows
Extract resource via kernel32 functions
Write and execute a file
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0xf94]
mov eax, 0x1014
call fcn.004040f0
mov eax, dword [0x416768]
xor eax, ebp
mov dword [ebp + 0xf90], eax
push ebx
push esi
push str.MbrFix.exe__tCopyright__C__2004_2006_Systemintegrasjon_AS__n__t_thttp:__www.sysint.no_n
call fcn.00402597
mov dword [esp], str.Usage:_nMbrFix__drive__num___command____yes__n_nCommands:_nMbrFix_____________________________________Display_help_page_and_license_nMbrFix__drive__num__driveinfo______________Display_drive_information_nMbrFix__drive__num__drivesize______________Returns_size_in_MB_as_return_value_nMbrFix__drive__num__listpartitions_________Display_partition_information_nMbrFix__drive__num__savembr__file__________Save_MBR_and_partitions_to_file_nMbrFix__drive__num__restorembr__file_______Restore_MBR_and_partitions_from_file_nMbrFix__drive__num__fixmbr__vista________Update_MBR_to_W2K_XP_2003_or_Vista_nMbrFix__drive__num__clean__________________Delete_all_partitions_in_MBR_nMbrFix__drive__num__readsignature__byte__Read_disk_signature_from_MBR_nMbrFix__drive__num__generatesignature______Generate_disk_signature_in_MBR_nMbrFix__drive__num__writesignature__bytes__Write_disk_signature_in_MBR_nMbrFix__drive__num__readstate______________Read_state_from_byte_0x1b2_in_MBR_nMbrFix__drive__num__writestate__state______Write_state_to_byte_0x1b2_in_MBR_nMbrFix__drive__num__readdrive__startsector___sectorcount___file__n___________________________________________Save_sectors_from_drive_to_file_nMbrFix_volumeinformation_driveletter_______Get_volume_information_for_partition_n
call fcn.00402597
xor ebx, ebx
cmp dword [ebp + 0xf9c], ebx
pop ecx
je 0x401dd4
push str._nDrive_numbering__num__starts_on_0._nCommands_restorembr__fixmbr__generatesignature__writestate__writesignature_and_nclean_will_ask_for_confirmation_unless__yes_is_included._n_nIf_the__byte_option_is_given_for_the_readsignature_command__the_signature_is_nreturned_as_a_byte_array_instead_of_as_a_DWORD._n_nIf__vista_is_used_with_the_fixmbr_command__a_Windows_Vista_MBR_is_written_ninstead_of_a_Win2000_XP_2003_MBR._The_Vista_MBR_should_work_with_the_others._n_nThe_program_reports_an_errorlevel_as_0_for_OK_and_other_values_for_errors__nexcept_ReadState_which_returns_the_state_as_a_return_code_as_well_as_printing_nto_stdout._Any_errors_for_this_command_are_returned_as_negative_values_because_nof_this._n_nSamples:_nMbrFix__drive_0_listpartitions_nMbrFix__drive_0_savembr_Backup_MBR_0.bin_nMbrFix__drive_0_restorembr_Backup_MBR_0.bin_nMbrFix__drive_0_fixmbr__yes_nMbrFix__drive_0_fixmbr__vista__yes_n_nUser_License_Agreement:_nThe_program_is_delivered_AS_IS__that_is_without_any_form_of_guarantee._You_may_nfreely_use_the_program_for_any_legal_purpose__and_you_may_freely_distribute_it__nas_long_as_this_file_is_distributed_along_the_program_file._n_nIncorrect_use_of_this_program_may_cause_loss_of_all_data_on_your_disk_drives._nAll_use_of_this_program_is_at_the_risk_of_the_user._nSystemintegrasjon_AS_does_not_accept_any_liability_for_any_damage_nthe_program_might_cause._nIf_you_do_not_accept_these_terms__you_must_delete_the_program__at_once__n_nCredits:_nDaniel_B._Sedory__for_his_compilation_of_information_on_nhttp:__www.geocities.com_thestarman3_asm_mbr_MBR_in_detail.htm_nand_for_his_feedback_on_the_program._n_n
call fcn.00402597
pop ecx
push 0x8001
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push ebx
push 0x65
push 0x17
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
mov esi, eax
cmp esi, ebx
je 0x401f2d
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
je 0x401f2d
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push ebx
mov dword [ebp - 0x7c], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x74], eax
mov esi, 0x800
push esi
lea eax, [ebp + 0x790]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jbe 0x401f2d
push edi
lea eax, [ebp + 0x790]
push 0x5c
push eax
call fcn.004033a9
mov edi, eax
cmp edi, ebx
pop ecx
pop ecx
je 0x401f2c
lea eax, [ebp + 0x790]
push eax
lea eax, [ebp - 0x70]
push esi
push eax
mov byte [edi], bl
call fcn.00404083
add esp, 0xc
lea eax, [ebp + 0x790]
push str.MbrFix.htm
push eax
call fcn.004031c0
pop ecx
mov ecx, 0x7ff
sub ecx, eax
push ecx
push edi
call fcn.00404083
push 0x4119c0
lea eax, [ebp + 0x790]
push eax
lea eax, [ebp - 0x78]
push eax
xor esi, esi
call fcn.004029c5
add esp, 0x18
test eax, eax
jne 0x401ece
push 2
push ebx
push dword [ebp - 0x78]
call fcn.00403ffe
push dword [ebp - 0x78]
call fcn.00403f09
add esp, 0x10
cmp eax, dword [ebp - 0x74]
jne 0x401ec1
inc esi
push dword [ebp - 0x78]
call fcn.004026de
cmp esi, ebx
pop ecx
jne 0x401f2c
push 0x4119b0
lea eax, [ebp + 0x790]
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.004029c5
add esp, 0xc
test eax, eax
jne 0x401f2c
push 0x4f
push dword [ebp - 0x74]
push dword [ebp - 0x7c]
call fcn.00401bce
push dword [ebp - 0x80]
push 1
push dword [ebp - 0x74]
push dword [ebp - 0x7c]
call fcn.00402874
push dword [ebp - 0x80]
call fcn.004026de
add esp, 0x20
push 1
lea eax, [ebp - 0x70]
push eax
push ebx
lea eax, [ebp + 0x790]
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
mov ecx, dword [ebp + 0xf90]
pop esi
xor ecx, ebp
or eax, 0xffffffff
pop ebx
call fcn.0040265c
add ebp, 0xf94
leave
ret