Function at 0x402680
Capabilities:
Copy file
Create directory
Create process on windows
Get file attributes
Manipulate boot configuration
Print debug messages
Set file attributes

Disassembly:
call fcn.004030d0
cmp al, 5
mov byte [0x40d030], al
jne 0x402693
jmp 0x402ad0
cmp al, 6
jne 0x40269c
jmp 0x402ac0
jmp 0x402910
push 0xffffffffffffffff
push 0x408958
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00402eb0
lea ecx, [esp + 0xc]
mov bl, al
call fcn.0040809a
movsx eax, bl
push eax
lea ecx, [esp + 0x10]
push str._c:Ghost
push ecx
mov dword [esp + 0x34], 0
call sub.MFC42.DLL_CString::Format
mov edx, dword [esp + 0x18]
add esp, 0xc
push 0
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push eax
call esi
mov ecx, dword [esp + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
or al, 2
push eax
push ecx
call edi
lea edx, [esp + 0xc]
push str._boot.ini
lea eax, [esp + 0x18]
push edx
push eax
call sub.MFC42.DLL_operator
mov eax, dword [eax]
mov ebx, dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0
push eax
push str.C:_boot.ini
call ebx
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString
push 0
push str.C:SOSGhost_boot.ini
push str.C:_boot.ini
call ebx
push str.C:_boot.ini
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::operator_1
mov ecx, dword [esp + 0xc]
push ecx
call esi
mov edx, dword [esp + 0xc]
and al, 0xfe
push eax
push edx
call edi
push str.C:_sbldr
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::operator_1
mov eax, dword [esp + 0xc]
push eax
call esi
mov ecx, dword [esp + 0xc]
or al, 2
push eax
push ecx
call edi
call fcn.004026b0
push str.C:_boot.ini
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::operator_1
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x18]
push edx
call fcn.00404d80
mov ebx, 1
mov byte [esp + 0x28], bl
lea ecx, [esp + 0x10]
call fcn.0040809a
push 4
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 2
call sub.MFC42.DLL_CString::LoadStringA
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
push str.C:_sbldr
push str.operating_systems
call fcn.00404f20
push 2
push str.timeout
push str.boot_loader
lea ecx, [esp + 0x24]
call fcn.00404e90
push 0
call fcn.00402ff0
add esp, 4
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], 0
call fcn.00404d70
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x20]
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret
mov eax, 1
ret
push 0xffffffffffffffff
push 0x408990
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
push edi
call fcn.00402eb0
lea ecx, [esp + 0x10]
mov bl, al
call fcn.0040809a
movsx eax, bl
push eax
lea ecx, [esp + 0x14]
push str._c:Ghost
push ecx
mov dword [esp + 0x38], 0
call sub.MFC42.DLL_CString::Format
mov edx, dword [esp + 0x1c]
add esp, 0xc
push 0
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov eax, dword [esp + 0x10]
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push eax
call ebp
mov ecx, dword [esp + 0x10]
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
or al, 2
push eax
push ecx
call ebx
lea ecx, [esp + 0x14]
call fcn.0040809a
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push str._export_C:SOSGhostBCDBack
push eax
mov byte [esp + 0x38], 1
call sub.MFC42.DLL_CString::Format
mov ecx, dword [esp + 0x20]
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0xc
push ecx
call edi
mov edx, dword [esp + 0x14]
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0
push 0
push edx
push str.C:SOSGhostBCDEDIT.EXE
push 0
push 0
call esi
lea ecx, [esp + 0x1c]
mov dword [esp + 0x20], eax
call fcn.0040809a
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x1c]
push eax
push str._X___lu
push ecx
mov byte [esp + 0x38], 2
call sub.MFC42.DLL_CString::Format
mov edx, dword [esp + 0x28]
add esp, 0xc
push edx
call edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x320
call edi
lea eax, [esp + 0x10]
push str.BCDBack
lea ecx, [esp + 0x24]
push eax
push ecx
call sub.MFC42.DLL_operator
mov eax, dword [eax]
push 0
push eax
push str.C:SOSGhostBCDBack
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CString::CString
push 0
push 0
push str._create_cc7f891e_b014_45a3_a394_df75d832e97b__d__SOSGhost___application_bootsector
push str.C:SOSGhostBCDEDIT.EXE
push 0
push 0
call esi
push 0x320
call edi
lea ecx, [esp + 0x18]
call fcn.0040809a
movsx edx, byte [0x40d031]
push edx
lea eax, [esp + 0x1c]
push str._set_cc7f891e_b014_45a3_a394_df75d832e97b_device_partition_c:
push eax
mov byte [esp + 0x38], 3
call sub.MFC42.DLL_CString::Format
mov ecx, dword [esp + 0x24]
add esp, 0xc
push 0
push 0
push ecx
push str.C:SOSGhostBCDEDIT.EXE
push 0
push 0
call esi
push 0x320
call edi
push 0
push 0
push str._set_cc7f891e_b014_45a3_a394_df75d832e97b_path__sbldr.mbr
push str.C:SOSGhostBCDEDIT.EXE
push 0
push 0
call esi
push 0x320
call edi
push 0
push 0
push str._displayorder_cc7f891e_b014_45a3_a394_df75d832e97b__addlast
push str.C:SOSGhostBCDEDIT.EXE
push 0
push 0
call esi
push 0x320
call edi
push 0
push 0
push str._timeout_2
push str.C:SOSGhostBCDEDIT.EXE
push 0
push 0
call esi
push 0x320
call edi
movsx edx, byte [0x40d031]
push edx
lea eax, [esp + 0x14]
push str._c:_sbldr
push eax
call sub.MFC42.DLL_CString::Format
mov ecx, dword [esp + 0x1c]
add esp, 0xc
push ecx
call ebp
mov edx, dword [esp + 0x10]
or al, 2
push eax
push edx
call ebx
movsx eax, byte [0x40d031]
push eax
push str._c:_sbldr.mbr
lea ecx, [esp + 0x18]
push ecx
call sub.MFC42.DLL_CString::Format
mov edx, dword [esp + 0x1c]
add esp, 0xc
push edx
call ebp
or al, 2
push eax
mov eax, dword [esp + 0x14]
push eax
call ebx
push 0
call fcn.00402ff0
add esp, 4
lea ecx, [esp + 0x18]
mov byte [esp + 0x2c], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2c], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret