Function at 0x401000
Capabilities:
Check if file exists
Check os version
Connect to wmi namespace via wbemlocator
Get file attributes
Get file size
Manipulate boot configuration
Read file on windows
Set file attributes
Terminate process
Write file on windows

Disassembly:
xor ebx, ebx
push 0x402504
call dword [sym.imp.comdlg32.dll_GetOpenFileNameA]
test eax, eax
jne 0x401018
push ebx
call dword [sym.imp.kernel32.dll_ExitProcess]
call dword [sym.imp.kernel32.dll_GetVersion]
test eax, eax
sets byte [0x406308]
js 0x4012cb
mov byte [0x403da4], bl
push ebx
push ebx
push 3
push ebx
push 3
push 0x80000000
push str.._
call dword [sym.imp.kernel32.dll_CreateFileA]
inc eax
jne 0x401063
push 0x10
push ebx
push str.Cannot_query_drive_info._nProbably_it_is_invalid_drive_or_you_are_not_administrator
push ebx
call dword [sym.imp.user32.dll_MessageBoxA]
push ebx
call dword [sym.imp.kernel32.dll_ExitProcess]
lea esi, [eax - 1]
push ebx
push 0x4062b8
push 0xc
push 0x4062bc
push ebx
push ebx
push 0x2d1080
push esi
call dword [sym.imp.kernel32.dll_DeviceIoControl]
test eax, eax
jne 0x40108e
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
jmp 0x40104d
push ebx
push 0x4062b8
push 0x20
push 0x4062c8
push ebx
push ebx
push 0x74004
push esi
call dword [sym.imp.kernel32.dll_DeviceIoControl]
test eax, eax
je 0x401085
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
cmp dword [0x4062bc], 7
je 0x4010c8
push 0x10
push 0
push str.Image_must_be_on_hard_disk_
jmp 0x401055
mov al, byte [0x4062c0]
or al, 0x80
mov byte [0x4030b5], al
mov eax, dword [0x4062c8]
mov edx, dword [0x4062cc]
shrd eax, edx, 9
shr edx, 9
je 0x4010f5
push 0x10
push ebx
push str.Please_mail_to_diamondz_land.ru
jmp 0x401055
mov dword [0x4030b6], eax
mov esi, 0x403da2
mov edi, 0x403ea2
mov byte [esi + 2], 0x5c
push 0x100
push edi
push esi
call dword [sym.imp.kernel32.dll_GetShortPathNameA]
cmp eax, 0x100
jb 0x401129
push 0x10
push ebx
push str.Path_is_too_long
jmp 0x401055
test eax, eax
jne 0x401138
push esi
push edi
mov ecx, 0x40
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
cmp byte [edi], 0
je 0x40114d
cmp byte [edi], 0x41
jb 0x40114a
cmp byte [edi], 0x5a
ja 0x40114a
add byte [edi], 0x20
inc edi
jmp 0x401138
mov esi, 0x403ea2
cmp byte [0x406308], 0
jne 0x401160
cmp byte [esi], 0x63
jne 0x401185
push 0x40
pop ecx
lea edi, [esi + ecx*4]
rep movsd dword es:[edi], dword [esi]
mov edi, esi
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
dec edi
std
mov al, 0x5c
repne scasb al, byte es:[edi]
cld
inc edi
inc edi
mov eax, 0x646c746d
stosd dword es:[edi], eax
mov al, 0x72
stosb byte es:[edi], al
jmp 0x40119e
mov dword [0x403fa2], 0x6d5c3a43
mov dword [0x403fa6], 0x72646c74
mov edi, 0x403faa
and word [edi], 0
push 0x403fa2
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
inc eax
jne 0x4011bb
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 2
je 0x4011e7
cmp byte [edi], 0
jne 0x4011c5
mov byte [edi], 0x30
jmp 0x4011a2
cmp byte [edi], 0x39
jae 0x4011ce
inc byte [edi]
jmp 0x4011a2
ja 0x4011d5
mov byte [edi], 0x41
jmp 0x4011a2
cmp byte [edi], 0x5a
jb 0x4011ca
push 0x10
push ebx
push str.Too_many_mtldrs_found_
jmp 0x401055
cmp byte [0x406308], 0
jne 0x401354
call fcn.00401992
push ecx
call dword [sym.imp.kernel32.dll_GetVersion]
pop ecx
cmp al, 6
jae 0x40166c
mov al, 2
mov edi, 0x4040a2
neg ecx
add ecx, 0x1310
push ebx
push 0x4062b8
push ecx
push edi
push esi
rep stosb byte es:[edi], al
call dword [sym.imp.kernel32.dll_WriteFile]
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
push str.c:_boot.ini
mov edi, 0x4061a7
mov esi, 0x4060a2
mov byte [edi - 1], 0x22
lodsb al, byte [esi]
test al, al
je 0x40124b
stosb byte es:[edi], al
jmp 0x401243
mov word [edi], 0x22
push str.c:_boot.ini
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
push eax
and al, 0xfe
push eax
push str.c:_boot.ini
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
push str.c:_boot.ini
push 0x4061a6
push 0x403fa2
push 0x403fa2
push 0x403fa2
call dword [sym.imp.user32.dll_CharToOemA]
push str.operating_systems
call dword [sym.imp.kernel32.dll_WritePrivateProfileStringA]
xchg dword [esp], eax
push eax
push str.c:_boot.ini
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
pop eax
test eax, eax
jne 0x4012ba
call fcn.00401a04
push 0x10
push ebx
push str.Cannot_write_to_boot.ini._Probably_you_are_not_administrator.
jmp 0x401055
push 0x40
push str.Success
push str.Installation_successful_
jmp 0x401055
mov al, byte [0x403da2]
or al, 0x20
sub al, 0x60
mov byte [0x402b84], al
push ebx
push ebx
push 3
push ebx
push 3
push 0x80000000
push str.._vwin32
call dword [sym.imp.kernel32.dll_CreateFileA]
inc eax
je 0x40104d
dec eax
xchg esi, eax
push ebx
push 0x4062b8
push 0x1c
push 0x402b84
push 0x1c
push 0x402b84
push 1
push esi
call dword [sym.imp.kernel32.dll_DeviceIoControl]
push eax
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
pop eax
test eax, eax
je 0x40104d
mov al, byte [0x402ba3]
cmp al, 0xff
je 0x401321
cmp al, 0x80
jb 0x40104d
mov byte [0x4030b5], al
cmp dword [0x402bac], 0
jne 0x4010e8
mov eax, dword [0x402ba8]
jmp 0x4010f5
push ebx
push ebx
push 3
push ebx
push 1
push 0x80000000
push str.C:config.sys
call dword [sym.imp.kernel32.dll_CreateFileA]
inc eax
jne 0x40137b
push 0x10
push ebx
push str.Cannot_open_config.sys
jmp 0x401055
dec eax
xchg esi, eax
push ebx
push esi
call dword [sym.imp.kernel32.dll_GetFileSize]
inc eax
je 0x40136e
dec eax
xchg ebp, eax
push 4
push 0x1000
push ebp
push ebx
call dword [sym.imp.kernel32.dll_VirtualAlloc]
xchg edi, eax
test edi, edi
je 0x40136e
push ebx
push 0x4062b8
push ebp
push edi
push esi
call dword [sym.imp.kernel32.dll_ReadFile]
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
push ebx
push pe_nt_image_headers32
push 2
push ebx
push ebx
push 0x40000000
push str.C:config.sys
call dword [sym.imp.kernel32.dll_CreateFileA]
inc eax
je 0x40136e
dec eax
xchg esi, eax
mov eax, dword [edi]
or eax, 0x20202000
cmp eax, 0x6e656d5b
je 0x4014f3
push 0x4060a2
call dword [sym.imp.kernel32.dll_lstrlenA]
cmp eax, 0x11
ja 0x40141c
push esi
push edi
mov esi, 0x4060a2
mov edi, 0x4032e8
mov ecx, eax
rep movsb byte es:[edi], byte [esi]
mov dword [edi], 0x795b203f
mov dword [edi + 4], 0x3a5d6e2f
mov word [edi + 8], 0x20
pop edi
pop esi
jmp 0x401432
push 0x403ea5
call dword [sym.imp.kernel32.dll_lstrlenA]
add eax, 0xdf1
mov word [0x4030c7], ax
push ebx
push 0x4062b8
push 8
push 0x4027bd
push esi
call dword [sym.imp.kernel32.dll_WriteFile]
mov eax, 0x403fa2
push eax
push eax
push eax
call dword [sym.imp.user32.dll_CharToOemA]
call dword [sym.imp.kernel32.dll_lstrlenA]
push ebx
push 0x4062b8
push eax
push 0x403fa2
push esi
call dword [sym.imp.kernel32.dll_WriteFile]
push ebx
push 0x4062b8
push 2
push 0x4027c5
push esi
call dword [sym.imp.kernel32.dll_WriteFile]
push ebx
push 0x4062b8
push ebp
push edi
push esi
call dword [sym.imp.kernel32.dll_WriteFile]
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
call fcn.00401992
push 0x4060a2
call dword [sym.imp.kernel32.dll_lstrlenA]
cmp eax, 0xb
jbe 0x4014e7
push ebx
push 0x4062b8
push 0xa
push 0x4027e8
push esi
push ebx
push 0x4062b8
push eax
push 0x4060a2
push esi
push ebx
push 0x4062b8
push 5
push 0x4027e3
push esi
call dword [sym.imp.kernel32.dll_WriteFile]
call dword [sym.imp.kernel32.dll_WriteFile]
call dword [sym.imp.kernel32.dll_WriteFile]
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
jmp 0x4012ba
push edi
or ecx, 0xffffffff
mov al, 0xa
repne scasb al, byte es:[edi]
cmp byte [edi], 0x5b
je 0x401549
cmp dword [edi], 0x756e656d
jne 0x4014f7
cmp dword [edi + 4], 0x6d657469
jne 0x4014f7
cmp byte [edi + 8], 0x3d
jne 0x4014f7
mov eax, dword [edi + 9]
or eax, 0x20202020
cmp eax, 0x696c6f6b
jne 0x4014f7
mov eax, dword [edi + 0xd]
and eax, 0xffffff
or eax, 0x202020
cmp eax, 0x697262
jne 0x4014f7
movzx eax, byte [edi + 0x10]
or al, 0x20
mov byte [eax + 0x406309], 1
jmp 0x4014f7
cmp word [edi - 4], 0xa0d
jne 0x401555
dec edi
dec edi
jmp 0x401549
sub edi, dword [esp]
push ebx
push 0x4062b8
push edi
push dword [esp + 0xc]
push esi
call dword [sym.imp.kernel32.dll_WriteFile]
add dword [esp], edi
sub ebp, edi
mov ecx, 7
cmp byte [0x406329], 0
jne 0x401586
cmp byte [0x406335], 0
je 0x4015cb
mov eax, 0x30
cmp byte [eax + 0x406309], 0
je 0x4015c1
inc eax
cmp al, 0x3a
jb 0x40158b
jne 0x40159f
mov al, 0x61
jmp 0x40158b
cmp al, 0x7a
jbe 0x40158b
push ebx
push 0x4062b8
push ebp
push dword [esp + 0xc]
push esi
call dword [sym.imp.kernel32.dll_WriteFile]
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
jmp 0x4011da
mov byte [0x4027ce], al
mov ecx, 8
push ebx
push 0x4062b8
push ecx
push 0x4027c7
push esi
push ebx
push 0x4062b8
push ecx
push 0x4027c7
push esi
push ebx
push 0x4062b8
push 9
push str.menuitem_Load__r_n_r_n_Load____y_n_:
push esi
call dword [sym.imp.kernel32.dll_WriteFile]
call dword [sym.imp.kernel32.dll_WriteFile]
push ebx
push 0x4062b8
push 6
push 0x4027d8
push esi
call dword [sym.imp.kernel32.dll_WriteFile]
push ebx
push 0x4062b8
push 0x4060a2
call dword [sym.imp.kernel32.dll_lstrlenA]
push eax
push 0x4060a2
push esi
call dword [sym.imp.kernel32.dll_WriteFile]
push ebx
push 0x4062b8
push 5
push 0x4027de
push esi
call dword [sym.imp.kernel32.dll_WriteFile]
call dword [sym.imp.kernel32.dll_WriteFile]
push ebx
push 0x4062b8
push 0xb
push str.__r_ninstall_r_nkolibri
push esi
call dword [sym.imp.kernel32.dll_WriteFile]
mov byte [0x4030af], 0x37
pop edi
jmp 0x401446
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov edi, str.SeBackupPrivilege
call fcn.00401a20
mov edi, str.SeRestorePrivilege
call fcn.00401a20
push ebx
push ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x4016ae
push ebx
push ebx
push ebx
push 3
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push ebx
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
jns 0x4016c0
call dword [sym.imp.ole32.dll_CoUninitialize]
call fcn.00401a04
push 0x10
push ebx
push str.BCD_WMI_API:_initialization_error
jmp 0x401055
push ebx
push esp
push 0x402bb0
push 1
push ebx
push 0x402bc0
call dword [sym.imp.ole32.dll_CoCreateInstance]
pop edi
test eax, eax
js 0x4016a8
push ebx
push esp
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push str.rootwmi
push edi
mov esi, dword [edi]
call dword [esi + 0xc]
push eax
push edi
call dword [esi + 8]
pop eax
pop edi
test eax, eax
js 0x4016a8
push ebx
push ebx
push 3
push 3
push ebx
push ebx
push 0xa
push edi
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jns 0x401715
mov eax, dword [edi]
push edi
call dword [eax + 8]
jmp 0x4016a8
xor esi, esi
push 0x402c30
push str.OpenStore
push str.BcdStore
call fcn.00401ae1
test eax, eax
js 0x40170d
mov esi, 0x4062f8
mov ebp, 0x406309
push esi
call dword [sym.imp.ole32.dll_CoCreateGuid]
push 0x1000
push ebp
push esi
call dword [sym.imp.ole32.dll_StringFromGUID2]
mov esi, dword [0x4062f0]
push str.CreateObject
push str.BcdStore
call fcn.00401ae1
jns 0x401789
mov ebp, str.Cannot_create_BCD_object_for_KolibriOS_loader
mov eax, dword [esi]
push esi
call dword [eax + 8]
mov eax, dword [edi]
push edi
call dword [eax + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
call fcn.00401a04
push 0x10
push ebx
push ebp
jmp 0x401055
pop eax
push esi
push eax
mov ebp, 0x4040a2
mov dword [0x402bf8], ebp
mov dword [0x402c18], 0x12000004
push 0x1000
push ebp
push 0xffffffffffffffff
push 0x4060a2
push ebx
push ebx
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov esi, dword [0x4062f0]
push str.SetStringElement
push str.BcdObject
call fcn.00401ae1
mov ebp, str.Cannot_create_BCD_element_in_object_for_KolibriOS_loader
js 0x401964
sub dword [esp], 0x18
mov byte [0x402c18], 2
push 0x1000
push 0x4040a2
push 0xffffffffffffffff
push 0x403fa4
push ebx
push ebx
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
push str.SetStringElement
push str.BcdObject
call fcn.00401ae1
js 0x401964
mov dword [0x402c18], 0x11000001
mov ecx, 0x4040a2
mov dword [ecx], 0x3f005c
mov dword [ecx + 4], 0x5c003f
xor eax, eax
mov dword [ecx + 0xc], eax
mov al, byte [0x403fa3]
shl eax, 0x10
mov al, byte [0x403fa2]
mov dword [ecx + 8], eax
push str.SetPartitionDeviceElement
push str.BcdObject
call fcn.00401ae1
js 0x401964
mov eax, dword [esi]
push esi
call dword [eax + 8]
pop eax
pop esi
push eax
push str.OpenObject
push str.BcdStore
call fcn.00401ae1
mov ebp, str.Cannot_add_KolibriOS_loader_in_BCD_display_list
js 0x40196d
pop eax
push esi
push eax
mov esi, dword [0x4062f0]
mov dword [0x402c18], 0x24000001
push str.GetElement
push str.BcdObject
call fcn.00401ae1
js 0x401964
push esi
mov esi, dword [0x4062f0]
push ebx
push ebx
push 0x4062e8
push ebx
push 0x402aad
mov eax, dword [esi]
push esi
call dword [eax + 0x10]
push eax
mov eax, dword [esi]
push esi
call dword [eax + 8]
pop eax
pop esi
test eax, eax
js 0x401964
push esi
cmp word [0x4062e8], 0x2008
jne 0x401963
mov esi, dword [0x4062f0]
cmp word [esi], 1
jne 0x401963
push dword [esi + 0x14]
mov eax, dword [esi + 0x10]
inc eax
push eax
push esp
push esi
call dword [sym.imp.oleaut32.dll_SafeArrayRedim]
pop ecx
pop ecx
test eax, eax
js 0x401963
push 0x406309
call dword [sym.imp.oleaut32.dll_SysAllocString]
test eax, eax
je 0x401963
push eax
mov ecx, dword [esi + 0x10]
add ecx, dword [esi + 0x14]
dec ecx
push ecx
mov ecx, esp
push eax
push ecx
push esi
call dword [sym.imp.oleaut32.dll_SafeArrayPutElement]
pop ecx
call dword [sym.imp.oleaut32.dll_SysFreeString]
pop esi
push str.SetObjectListElement
push str.BcdObject
call fcn.00401ae1
js 0x401964
push 0x4062e8
call dword [sym.imp.oleaut32.dll_VariantClear]
mov eax, dword [esi]
push esi
call dword [eax + 8]
pop eax
pop esi
mov eax, dword [esi]
push esi
call dword [eax + 8]
mov eax, dword [edi]
push edi
call dword [eax + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x4012ba
pop esi
mov eax, dword [esi]
push esi
call dword [eax + 8]
pop eax
pop esi
push eax
mov dword [0x402bf8], 0x406309
pop eax
push 0x402cd0
push str.DeleteObject
push str.BcdStore
call fcn.00401ae1
pop eax
jmp 0x401769