Function at 0x436b6f
Capabilities:
Contain obfuscated stackstrings
Delete file
Manipulate boot configuration
Set file attributes

Disassembly:
push ebp
sub esp, 0x458
lea ebp, [esp - 4]
mov eax, dword [0x6d25dc]
xor eax, ebp
mov dword [ebp + 0x458], eax
push 0x2d8
mov eax, 0x5f6425
call fcn.00579aba
mov eax, dword [ebp + 0x464]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x468]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x46c]
push 0x6d9af4
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x8c]
push 0x6da0c0
push eax
call fcn.0042d354
mov esi, 0x6da1a0
push esi
push eax
lea eax, [ebp - 0x70]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.0042d354
push 0x6da018
push eax
lea eax, [ebp - 0xa8]
xor edi, edi
push eax
inc edi
mov byte [ebp - 4], 1
call fcn.0042d354
push 0x6da2e4
push eax
lea eax, [ebp - 0xc4]
push eax
mov byte [ebp - 4], 2
call fcn.0042d354
push 0x6d9fa8
push eax
lea eax, [ebp - 0x54]
push eax
mov byte [ebp - 4], 3
call fcn.0042d354
push 0x6d9f70
push eax
lea eax, [ebp + 0x194]
push eax
mov byte [ebp - 4], 4
call fcn.0042d354
add esp, 0x48
push 0x6d9ec8
push eax
lea eax, [ebp + 0x178]
push eax
mov byte [ebp - 4], 5
call fcn.0042d354
push 0x6d9abc
push eax
lea eax, [ebp + 0x15c]
push eax
mov byte [ebp - 4], 6
call fcn.0042d354
push 0x6d9fe0
push eax
lea eax, [ebp + 0x1cc]
push eax
mov byte [ebp - 4], 7
call fcn.0042d354
add esp, 0x24
push ebx
push edi
lea ecx, [ebp + 0x15c]
call fcn.00415386
push ebx
push edi
lea ecx, [ebp + 0x178]
call fcn.00415386
push ebx
push edi
lea ecx, [ebp + 0x194]
call fcn.00415386
push ebx
push edi
lea ecx, [ebp - 0x54]
call fcn.00415386
push ebx
push edi
lea ecx, [ebp - 0xc4]
call fcn.00415386
push ebx
push edi
lea ecx, [ebp - 0xa8]
call fcn.00415386
push ebx
push edi
lea ecx, [ebp - 0x70]
call fcn.00415386
push ebx
push edi
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 0x10
call fcn.00415386
mov ecx, dword [ebp - 0x1c]
push edi
push ebx
lea eax, [ebp + 0x1cc]
push eax
call fcn.00482da5
test al, al
jne 0x436d32
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp + 0x23c]
push eax
call fcn.0042d81d
cmp dword [eax + 0x18], 0x10
mov byte [ebp - 4], 0x11
jb 0x436d15
mov eax, dword [eax + 4]
jmp 0x436d18
add eax, 4
push eax
push 0x62fbd8
push ebx
call fcn.0048212f
add esp, 0xc
lea ecx, [ebp + 0x23c]
jmp 0x437ae5
push ebx
lea ecx, [ebp + 0x220]
mov dword [ebp + 0x238], 0xf
call fcn.00415e5a
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0xd]
push eax
lea eax, [ebp + 0x220]
push eax
push esi
mov byte [ebp - 4], 0x12
call fcn.00482cb4
test al, al
je 0x437ad2
cmp byte [ebp - 0xd], bl
jne 0x436d77
push str.Switch_requires_a_value_____D
jmp 0x437ad7
cmp dword [ebp + 0x238], 0x10
mov eax, dword [ebp + 0x224]
jae 0x436d8c
lea eax, [ebp + 0x224]
lea ecx, [ebp - 0x25]
push ecx
lea ecx, [ebp - 0x34]
push ecx
mov esi, str._d_c
push esi
push eax
call fcn.0057db7a
add esp, 0x10
cmp eax, edi
jne 0x437ab5
mov eax, dword [ebp - 0x34]
cmp eax, edi
jl 0x437ab5
cmp eax, dword [0x6d9a28]
jg 0x437ab5
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0xd]
push eax
lea eax, [ebp + 0x220]
push eax
push 0x6da018
call fcn.00482cb4
test al, al
je 0x437aae
cmp byte [ebp - 0xd], bl
jne 0x436df1
push str.Switch_requires_a_value_____P
jmp 0x437ad7
cmp dword [ebp + 0x238], 0x10
mov eax, dword [ebp + 0x224]
jae 0x436e06
lea eax, [ebp + 0x224]
lea ecx, [ebp - 0x25]
push ecx
lea ecx, [ebp - 0x30]
push ecx
push esi
push eax
call fcn.0057db7a
add esp, 0x10
cmp eax, edi
jne 0x437a88
cmp dword [ebp - 0x30], edi
jl 0x437a88
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0xd]
push eax
lea eax, [ebp + 0x220]
push eax
push 0x6da2e4
call fcn.00482cb4
test al, al
je 0x436e4b
mov dword [0x6dab10], edi
push str.winnt
lea ecx, [ebp + 0x140]
call fcn.00414b61
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0xd]
push eax
lea eax, [ebp + 0x220]
push eax
push 0x6d9fa8
mov byte [ebp - 4], 0x13
call fcn.00482cb4
test al, al
je 0x436ec3
cmp dword [0x6dab10], edi
je 0x436ea2
push str.Invalid_switch_____SYSFOLDER._This_switch_requires__WINNT
push ebx
call fcn.0048212f
pop ecx
pop ecx
push ebx
push edi
lea ecx, [ebp + 0x140]
call fcn.00415386
jmp 0x437adf
cmp byte [ebp - 0xd], bl
jne 0x436eae
push str.Switch_requires_a_value_____SYSFOLDER
jmp 0x436e88
push 0xffffffffffffffff
push ebx
lea eax, [ebp + 0x220]
push eax
lea ecx, [ebp + 0x140]
call fcn.00415271
push ebx
lea ecx, [ebp + 0x204]
mov dword [ebp + 0x21c], 0xf
call fcn.00415e5a
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0xd]
push eax
lea eax, [ebp + 0x220]
push eax
push 0x6d9f70
mov byte [ebp - 4], 0x14
call fcn.00482cb4
test al, al
je 0x437a7e
cmp byte [ebp - 0xd], bl
jne 0x436f21
push str.Switch_requires_a_value_____DESC
push ebx
call fcn.0048212f
pop ecx
pop ecx
push ebx
push edi
lea ecx, [ebp + 0x204]
call fcn.00415386
jmp 0x436e90
push 0xffffffffffffffff
push ebx
lea eax, [ebp + 0x220]
push eax
lea ecx, [ebp + 0x204]
call fcn.00415271
mov ecx, dword [ebp - 0x20]
xor esi, esi
call fcn.00428b1e
test eax, eax
jbe 0x436f8d
mov ecx, dword [ebp - 0x20]
push esi
call fcn.00428b3f
add eax, 0x1c
cmp dword [eax + 0x18], 0x10
jb 0x436f5b
mov eax, dword [eax + 4]
jmp 0x436f5e
add eax, 4
cmp dword [ebp + 0x21c], 0x10
mov ecx, dword [ebp + 0x208]
jae 0x436f73
lea ecx, [ebp + 0x208]
push eax
push ecx
call fcn.00583f9e
test eax, eax
pop ecx
pop ecx
je 0x436fa1
mov ecx, dword [ebp - 0x20]
inc esi
call fcn.00428b1e
cmp esi, eax
jb 0x436f44
mov eax, dword [ebp - 0x34]
dec eax
call fcn.00429ad0
cmp eax, ebx
mov dword [ebp - 0x24], eax
jne 0x437003
mov esi, edi
jmp 0x436fc8
cmp dword [ebp + 0x21c], 0x10
mov eax, dword [ebp + 0x208]
jae 0x436fb6
lea eax, [ebp + 0x208]
push eax
push str.Entry:___s__already_exists
push ebx
call fcn.0048212f
add esp, 0xc
push 2
pop esi
push ebx
push edi
lea ecx, [ebp + 0x204]
call fcn.00415386
push ebx
push edi
lea ecx, [ebp + 0x140]
call fcn.00415386
push ebx
push edi
lea ecx, [ebp + 0x220]
call fcn.00415386
push ebx
push edi
lea ecx, [ebp + 0x1cc]
call fcn.00415386
mov eax, esi
jmp 0x437afc
push dword [ebp - 0x30]
mov ecx, dword [ebp - 0x24]
call fcn.004833c3
mov esi, eax
cmp esi, ebx
jne 0x43701e
push dword [ebp - 0x30]
push str.Invalid_partition_number_____d
jmp 0x436fbc
mov ecx, esi
call fcn.004806e1
test al, al
je 0x437038
push str.Cannot_boot_from_an_auxiliary_partition
push ebx
call fcn.0048212f
pop ecx
pop ecx
jmp 0x436fc5
mov ecx, esi
call fcn.0048035c
test al, al
jne 0x437a74
mov ecx, esi
call fcn.00480371
test al, al
jne 0x437a74
mov ecx, esi
call fcn.0048012c
cmp byte [eax + 0xd], bl
je 0x437074
push str.Cannot_boot_from_a_hidden_partition._Unhide_the_partition_before_modifying_boot.ini
push ebx
call fcn.0048212f
pop ecx
pop ecx
jmp 0x436f9d
push 0x6583a8
lea ecx, [ebp + 0x1e8]
call fcn.00414b61
mov eax, dword [0x6dab10]
cmp eax, ebx
mov byte [ebp - 4], 0x15
jne 0x437433
mov eax, dword [esi]
push ebx
lea ecx, [ebp + 0x258]
push ecx
push ebx
push edi
push ebx
push ebx
mov ecx, esi
call dword [eax + 8]
test al, al
jne 0x4370cf
push dword [ebp - 0x30]
push str.Error_reading_the_boot_sector_of_the_specified_partition_____P:_d
push ebx
call fcn.0048212f
add esp, 0xc
push ebx
push edi
lea ecx, [ebp + 0x1e8]
call fcn.00415386
jmp 0x436f9d
mov esi, 0x6583a8
push esi
lea ecx, [ebp + 0x15c]
call fcn.00414b61
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0xd]
push eax
lea eax, [ebp + 0x220]
push eax
push 0x6d9abc
mov byte [ebp - 4], 0x16
call fcn.00482cb4
test al, al
je 0x437146
cmp byte [ebp - 0xd], bl
jne 0x437131
push str.Switch_requires_a_value_____BSECTFILE:
push ebx
call fcn.0048212f
pop ecx
pop ecx
push ebx
push edi
lea ecx, [ebp + 0x15c]
call fcn.00415386
push ebx
push edi
lea ecx, [ebp + 0x1e8]
call fcn.00415386
jmp 0x436fc5
push 0xffffffffffffffff
push ebx
lea eax, [ebp + 0x220]
push eax
lea ecx, [ebp + 0x15c]
call fcn.00415271
push esi
lea ecx, [ebp + 0x23c]
call fcn.00414b61
cmp dword [ebp + 0x170], ebx
mov byte [ebp - 4], 0x17
je 0x437178
push 0xffffffffffffffff
push ebx
lea eax, [ebp + 0x15c]
push eax
lea ecx, [ebp + 0x23c]
call fcn.00415271
jmp 0x437270
push str.__:____
lea ecx, [ebp + 0x194]
call fcn.00414b61
xor esi, esi
cmp dword [ebp + 0x218], ebx
mov byte [ebp - 4], 0x18
jbe 0x43720c
push esi
lea ecx, [ebp + 0x204]
call fcn.00429b4c
mov al, byte [eax]
push edi
mov byte [ebp - 0x14], al
push ebx
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp + 0x194]
call fcn.0042a04d
cmp eax, 0xffffffff
jne 0x437203
push esi
lea ecx, [ebp + 0x204]
call fcn.00429b4c
movzx eax, byte [eax]
push eax
push edi
lea ecx, [ebp + 0x178]
call fcn.0042ce05
push 0xffffffffffffffff
push ebx
lea eax, [ebp + 0x178]
push eax
lea ecx, [ebp + 0x23c]
mov byte [ebp - 4], 0x19
call fcn.0042c818
push ebx
push edi
lea ecx, [ebp + 0x178]
mov byte [ebp - 4], 0x18
call fcn.00415386
inc esi
cmp esi, dword [ebp + 0x218]
jb 0x437196
cmp dword [ebp + 0x250], 8
jbe 0x437226
push 0xffffffffffffffff
push 8
lea ecx, [ebp + 0x23c]
call fcn.00415deb
jmp 0x43723e
cmp dword [ebp + 0x250], ebx
jne 0x43723e
push str.gdiskbot
lea ecx, [ebp + 0x23c]
call fcn.00415303
push str..dat
lea ecx, [ebp + 0x23c]
call fcn.0042ce50
push 0x631690
push ebx
lea ecx, [ebp + 0x23c]
call fcn.0042ce81
push ebx
push edi
lea ecx, [ebp + 0x194]
mov byte [ebp - 4], 0x17
call fcn.00415386
mov eax, dword [ebp + 0x240]
push 0x10
pop esi
cmp dword [ebp + 0x254], esi
jae 0x437287
lea eax, [ebp + 0x240]
lea ecx, [ebp]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x4372e6
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 0x254], esi
mov eax, dword [ebp + 0x240]
jae 0x4372b2
lea eax, [ebp + 0x240]
push eax
push str.Boot_sector_file__s_already_exists._Replace_
push 4
call fcn.0048212f
add esp, 0xc
cmp eax, 2
jne 0x4372e6
push ebx
push edi
lea ecx, [ebp + 0x23c]
call fcn.00415386
lea ecx, [ebp + 0x15c]
push ebx
push edi
call fcn.00415386
jmp 0x4370bd
cmp dword [ebp + 0x254], esi
mov eax, dword [ebp + 0x240]
jae 0x4372fa
lea eax, [ebp + 0x240]
push edi
push 0x40
push 0x22
push eax
lea ecx, [ebp - 0x2e4]
call fcn.00435b7d
mov eax, dword [ebp - 0x2e4]
mov eax, dword [eax + 4]
test byte [ebp + eax - 0x2dc], 6
mov byte [ebp - 4], 0x1a
je 0x437359
cmp dword [ebp + 0x254], esi
mov eax, dword [ebp + 0x240]
jae 0x437336
lea eax, [ebp + 0x240]
push eax
push str.Cannot_create__s_file
push ebx
call fcn.0048212f
add esp, 0xc
lea ecx, [ebp - 0x2e4]
mov byte [ebp - 4], 0x17
call fcn.00432737
jmp 0x4372c7
push ebx
push ebx
lea ecx, [ebp - 0x2dc]
call fcn.00431f94
push 0x200
lea eax, [ebp + 0x258]
push eax
lea ecx, [ebp - 0x2dc]
call fcn.004338f9
lea ecx, [ebp - 0x2e4]
call fcn.00430e30
push 0x631644
lea eax, [ebp + 0x23c]
push eax
lea eax, [ebp - 0xa8]
push eax
call fcn.0042ecd5
lea ecx, [ebp + 0x204]
push ecx
push eax
lea eax, [ebp - 0x70]
push eax
mov byte [ebp - 4], 0x1b
call fcn.0042d354
push 0x657560
push eax
lea eax, [ebp - 0x8c]
push eax
mov byte [ebp - 4], 0x1c
call fcn.0042ecd5
add esp, 0x24
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp + 0x1e8]
mov byte [ebp - 4], 0x1d
call fcn.00415271
push ebx
push edi
lea ecx, [ebp - 0x8c]
call fcn.00415386
push ebx
push edi
lea ecx, [ebp - 0x70]
call fcn.00415386
push ebx
push edi
lea ecx, [ebp - 0xa8]
call fcn.00415386
lea ecx, [ebp - 0x2e4]
mov byte [ebp - 4], 0x17
call fcn.00432737
push ebx
push edi
lea ecx, [ebp + 0x23c]
call fcn.00415386
push ebx
push edi
lea ecx, [ebp + 0x15c]
call fcn.00415386
jmp 0x437733
cmp eax, edi
jne 0x437733
mov dword [ebp + 0x188], ebx
mov dword [ebp + 0x18c], ebx
mov dword [ebp + 0x190], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], ebx
mov eax, dword [ebp - 0x24]
cmp dword [eax + 0xf0], ebx
mov byte [ebp - 4], 0x1f
mov dword [ebp - 0x20], ebx
jle 0x4374b2
push dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
call fcn.004832b5
mov ecx, eax
mov dword [ebp - 0x2c], ecx
call fcn.0048046e
test al, al
je 0x437489
lea ecx, [ebp + 0x184]
jmp 0x437498
mov ecx, dword [ebp - 0x2c]
call fcn.004803d9
test al, al
je 0x4374a1
lea ecx, [ebp - 0x48]
lea eax, [ebp - 0x2c]
push eax
call fcn.004327aa
inc dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
cmp ecx, dword [eax + 0xf0]
jl 0x437468
lea eax, [ebp + 0x184]
push eax
lea ecx, [ebp + 0x1a0]
call fcn.004320a1
mov byte [ebp - 4], 0x20
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x44], ebx
je 0x4374fa
mov eax, dword [ebp - 0x40]
sub eax, dword [ebp - 0x44]
sar eax, 2
cmp dword [ebp - 0x20], eax
jae 0x4374fa
push dword [ebp - 0x20]
lea ecx, [ebp - 0x48]
call fcn.00428bcd
push eax
lea ecx, [ebp + 0x1a0]
call fcn.004327aa
inc dword [ebp - 0x20]
jmp 0x4374cb
mov dword [ebp - 0x24], ebx
cmp dword [ebp + 0x1a4], ebx
je 0x43757a
mov eax, dword [ebp + 0x1a8]
sub eax, dword [ebp + 0x1a4]
sar eax, 2
cmp dword [ebp - 0x24], eax
jae 0x43757a
push dword [ebp - 0x24]
lea ecx, [ebp + 0x1a0]
call fcn.00428bcd
mov eax, dword [eax]
mov ecx, dword [eax + 0x50]
cmp ecx, dword [esi + 0x50]
jne 0x43756d
mov ecx, dword [eax + 0x58]
cmp ecx, dword [esi + 0x58]
jne 0x43756d
mov ecx, dword [eax + 0x5c]
cmp ecx, dword [esi + 0x5c]
jne 0x43756d
mov ecx, dword [eax + 0x60]
cmp ecx, dword [esi + 0x60]
jne 0x43756d
mov ecx, dword [eax + 0x64]
cmp ecx, dword [esi + 0x64]
jne 0x43756d
mov ecx, dword [eax + 0x98]
cmp ecx, dword [esi + 0x98]
jne 0x43756d
mov eax, dword [eax + 0x9c]
cmp eax, dword [esi + 0x9c]
je 0x437572
inc dword [ebp - 0x24]
jmp 0x4374fd
mov eax, dword [ebp - 0x24]
inc eax
cmp eax, ebx
jne 0x4375aa
push str.Cannot_create_ARC_style_partition_ID
push ebx
call fcn.0048212f
pop ecx
pop ecx
lea ecx, [ebp + 0x1a0]
call fcn.0042b5ad
lea ecx, [ebp - 0x48]
call fcn.0042b5ad
lea ecx, [ebp + 0x184]
call fcn.0042b5ad
jmp 0x4370bd
push eax
lea eax, [ebp - 0xe0]
push eax
call fcn.0047fa77
mov esi, eax
mov eax, dword [ebp - 0x34]
dec eax
push 0xa
push eax
lea eax, [ebp - 0x21c]
push eax
mov byte [ebp - 4], 0x21
call fcn.0047f5e3
push eax
lea eax, [ebp - 0x238]
push str.multi_0_disk_0_rdisk_
push eax
mov byte [ebp - 4], 0x22
call fcn.0042d39f
push str._partition_
push eax
lea eax, [ebp - 0x254]
push eax
mov byte [ebp - 4], 0x23
call fcn.0042ecd5
push esi
push eax
lea eax, [ebp + 0x23c]
push eax
mov byte [ebp - 4], 0x24
call fcn.0042d354
push 0x6315f4
push eax
lea eax, [ebp + 0x15c]
push eax
mov byte [ebp - 4], 0x25
call fcn.0042ecd5
add esp, 0x44
lea ecx, [ebp + 0x140]
push ecx
push eax
lea eax, [ebp - 0xc4]
push eax
mov byte [ebp - 4], 0x26
call fcn.0042d354
push 0x631644
push eax
lea eax, [ebp - 0xa8]
push eax
mov byte [ebp - 4], 0x27
call fcn.0042ecd5
lea ecx, [ebp + 0x204]
push ecx
push eax
lea eax, [ebp - 0x70]
push eax
mov byte [ebp - 4], 0x28
call fcn.0042d354
push 0x657560
push eax
lea eax, [ebp - 0x8c]
push eax
mov byte [ebp - 4], 0x29
call fcn.0042ecd5
add esp, 0x30
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp + 0x1e8]
mov byte [ebp - 4], 0x2a
call fcn.00415271
push ebx
push edi
lea ecx, [ebp - 0x8c]
call fcn.00415386
push ebx
push edi
lea ecx, [ebp - 0x70]
call fcn.00415386
push ebx
push edi
lea ecx, [ebp - 0xa8]
call fcn.00415386
push ebx
push edi
lea ecx, [ebp - 0xc4]
call fcn.00415386
push ebx
push edi
lea ecx, [ebp + 0x15c]
call fcn.00415386
push ebx
push edi
lea ecx, [ebp + 0x23c]
call fcn.00415386
push ebx
push edi
lea ecx, [ebp - 0x254]
call fcn.00415386
push ebx
push edi
lea ecx, [ebp - 0x238]
call fcn.00415386
push ebx
push edi
lea ecx, [ebp - 0x21c]
call fcn.00415386
push ebx
push edi
lea ecx, [ebp - 0xe0]
call fcn.00415386
lea ecx, [ebp + 0x1a0]
call fcn.0042b5ad
lea ecx, [ebp - 0x48]
call fcn.0042b5ad
lea ecx, [ebp + 0x184]
call fcn.0042b5ad
push ebx
lea ecx, [ebp + 0x1b0]
mov dword [ebp + 0x1c8], 0xf
call fcn.00415e5a
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0xe0]
push eax
mov byte [ebp - 4], 0x2b
call fcn.0042d802
push dword [ebp - 0x38]
lea edx, [ebp + 0x1b0]
mov ecx, eax
mov byte [ebp - 4], 0x2c
call fcn.00435dcd
pop ecx
push ebx
test eax, eax
push edi
lea ecx, [ebp - 0xe0]
setne byte [ebp - 0x14]
mov byte [ebp - 4], 0x2b
call fcn.00415386
cmp byte [ebp - 0x14], bl
je 0x437798
lea ecx, [ebp + 0x1b0]
jmp 0x4372da
mov esi, dword [ebp - 0x38]
lea eax, [ebp - 0x2c]
push eax
call fcn.0042a86d
test eax, eax
pop ecx
jne 0x43778d
cmp dword [esi + 0x18], 0x10
lea eax, [esi + 4]
mov dword [ebp - 0x1c], eax
jb 0x4377b7
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
mov eax, dword [ebp - 0x1c]
jne 0x4377de
cmp dword [esi + 0x18], 0x10
jb 0x4377cd
mov eax, dword [eax]
push eax
push str.Cannot_overwrite__s_file
push ebx
call fcn.0048212f
add esp, 0xc
jmp 0x43778d
cmp dword [esi + 0x18], 0x10
jb 0x4377e6
mov eax, dword [eax]
push edi
push 0x40
push 2
push eax
lea ecx, [ebp - 0x200]
call fcn.00435b7d
cmp dword [ebp + 0x1c8], 0x10
mov eax, dword [ebp + 0x1b4]
mov byte [ebp - 4], 0x2d
jae 0x437810
lea eax, [ebp + 0x1b4]
push edi
push 0x40
push edi
push eax
lea ecx, [ebp - 0x170]
call fcn.00435b7d
mov eax, dword [ebp - 0x200]
mov eax, dword [eax + 4]
test byte [ebp + eax - 0x1f8], 6
mov byte [ebp - 4], 0x2e
je 0x437874
cmp dword [esi + 0x18], 0x10
mov eax, dword [ebp - 0x1c]
jb 0x437842
mov eax, dword [eax]
push eax
push str.Cannot_overwrite__s_file
push ebx
call fcn.0048212f
add esp, 0xc
lea ecx, [ebp - 0x170]
mov byte [ebp - 4], 0x2d
call fcn.00432737
lea ecx, [ebp - 0x200]
mov byte [ebp - 4], 0x2b
call fcn.00432737
jmp 0x43778d
mov eax, dword [ebp - 0x170]
mov eax, dword [eax + 4]
mov eax, dword [ebp + eax - 0x168]
test al, 6
je 0x4378a5
cmp dword [ebp + 0x1c8], 0x10
mov eax, dword [ebp + 0x1b4]
jae 0x43789d
lea eax, [ebp + 0x1b4]
push eax
push str.Cannot_open__s_backup_file
jmp 0x437848
mov byte [ebp - 0x14], bl
mov byte [ebp - 0x15], bl
jmp 0x4379c8
cmp eax, ebx
jne 0x4379d0
push ebx
lea ecx, [ebp + 0x23c]
mov dword [ebp + 0x254], 0xf
call fcn.00415e5a
push 0xa
lea eax, [ebp + 0x23c]
push eax
lea eax, [ebp - 0x170]
push eax
mov byte [ebp - 4], 0x2f
call fcn.004334f0
mov eax, dword [ebp + 0x240]
add esp, 0xc
cmp dword [ebp + 0x254], 0x10
jae 0x4378ff
lea eax, [ebp + 0x240]
push str._operating_systems_
push eax
call fcn.00583f9e
test eax, eax
pop ecx
pop ecx
jne 0x437916
mov byte [ebp - 0x14], 1
jmp 0x437972
cmp byte [ebp - 0x14], bl
je 0x437972
push ebx
push 0x6315a4
lea ecx, [ebp + 0x23c]
call fcn.0042a902
test eax, eax
jne 0x43793a
cmp byte [ebp - 0x15], bl
mov byte [ebp - 0x14], bl
jne 0x437972
jmp 0x437952
cmp byte [ebp - 0x15], bl
jne 0x437972
mov eax, dword [ebp - 0x170]
mov eax, dword [eax + 4]
test byte [ebp + eax - 0x168], 1
je 0x437972
lea eax, [ebp + 0x1e8]
push eax
lea eax, [ebp - 0x1f8]
push eax
call fcn.0043322c
push eax
call fcn.0042841f
mov byte [ebp - 0x15], 1
add esp, 0xc
lea eax, [ebp + 0x23c]
push eax
lea eax, [ebp - 0x1f8]
push eax
call fcn.0043322c
mov eax, dword [ebp - 0x170]
mov eax, dword [eax + 4]
test byte [ebp + eax - 0x168], 1
pop ecx
pop ecx
jne 0x4379a7
lea eax, [ebp - 0x1f8]
push eax
call fcn.0042841f
pop ecx
push ebx
push edi
lea ecx, [ebp + 0x23c]
mov byte [ebp - 4], 0x2e
call fcn.00415386
mov eax, dword [ebp - 0x170]
mov eax, dword [eax + 4]
mov eax, dword [ebp + eax - 0x168]
test al, 1
je 0x4378b0
lea ecx, [ebp - 0x200]
call fcn.00430e30
lea ecx, [ebp - 0x170]
call fcn.00430e30
test byte [ebp - 0x2c], 1
je 0x437a01
cmp dword [esi + 0x18], 0x10
mov eax, dword [ebp - 0x1c]
jb 0x4379f7
mov eax, dword [eax]
push dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x170]
mov byte [ebp - 4], 0x2d
call fcn.00432737
lea ecx, [ebp - 0x200]
mov byte [ebp - 4], 0x2b
call fcn.00432737
push ebx
push edi
lea ecx, [ebp + 0x1b0]
call fcn.00415386
push ebx
push edi
lea ecx, [ebp + 0x1e8]
call fcn.00415386
push ebx
push edi
lea ecx, [ebp + 0x204]
call fcn.00415386
push ebx
push edi
lea ecx, [ebp + 0x140]
call fcn.00415386
push ebx
push edi
lea ecx, [ebp + 0x220]
call fcn.00415386
push ebx
push edi
lea ecx, [ebp + 0x1cc]
call fcn.00415386
xor eax, eax
jmp 0x437afc
push str.Cannot_boot_from_an_extended_partition
jmp 0x43702e
push str.Required_switch_missing_____DESC
jmp 0x436f07
cmp dword [ebp + 0x238], 0x10
mov eax, dword [ebp + 0x224]
jae 0x437a9d
lea eax, [ebp + 0x224]
push eax
push str.Invalid_partition_number_____s
push ebx
call fcn.0048212f
add esp, 0xc
jmp 0x437adf
push str.Required_switch_missing_____P
jmp 0x437ad7
cmp dword [ebp + 0x238], 0x10
mov eax, dword [ebp + 0x224]
jae 0x437aca
lea eax, [ebp + 0x224]
push eax
push str.Invalid_fixed_disk_number_____s
jmp 0x437aa3
push str.Required_switch_missing_____D
push ebx
call fcn.0048212f
pop ecx
pop ecx
lea ecx, [ebp + 0x220]
push ebx
push edi
call fcn.00415386
push ebx
push edi
lea ecx, [ebp + 0x1cc]
call fcn.00415386
push 2
pop eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x458]
xor ecx, ebp
call fcn.00579aab
add ebp, 0x45c
leave
ret