Function at 0x140003038
Capabilities:
Create process on windows
Encode data using xor
Extract resource via kernel32 functions
Write and execute a file
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
mov eax, 0x1050
call fcn.140012800
sub rsp, rax
mov rax, qword [0x14001af08]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov ebx, ecx
lea rcx, str.MbrFix.exe__tCopyright__C__2004_2009_Systemintegrasjon_AS__n__t_thttp:__www.sysint.no_n
call fcn.140003e94
lea rcx, str.Usage:_nMbrFix__drive__num___command____yes____verbose__n_nCommands:_nMbrFix_____________________________________Display_help_page_and_license_nMbrFix__drive__num__driveinfo______________Display_drive_information_nMbrFix__drive__num__drivesize______________Returns_size_in_MB_as_return_value_nMbrFix__drive__num__listpartitions_________Display_partition_information_nMbrFix__drive__num__savembr__file__________Save_MBR_and_partitions_to_file_nMbrFix__drive__num__restorembr__file_______Restore_MBR_and_partitions_from_file_nMbrFix__drive__num__fixmbr__vista_win7__Update_MBR_to_W2K_XP_2003__default___n___________________________________________Vista_or_Windows_7_nMbrFix__drive__num__clean__________________Delete_all_partitions_on_drive_nMbrFix__drive__num__readsignature__byte__Read_disk_signature_from_MBR_nMbrFix__drive__num__generatesignature______Generate_disk_signature_in_MBR_nMbrFix__drive__num__writesignature__bytes__Write_disk_signature_in_MBR_nMbrFix__drive__num__readstate______________Read_state_from_byte_0x1b2_in_MBR_nMbrFix__drive__num__writestate__state______Write_state_to_byte_0x1b2_in_MBR_nMbrFix__drive__num__readdrive__startsector___sectorcount___file__n___________________________________________Save_sectors_from_drive_to_file_nMbrFix__drive__num___partition__part__fixbootsector__os_______n___________________________________________Update_Boot_code_in_boot_sector_nMbrFix__drive__num___partition__part__getpartitiontype__n___________________________________________Get_partition_type_nMbrFix__drive__num___partition__part__setpartitiontype__typenum_______n___________________________________________Set_partition_type_nMbrFix__drive__num___partition__part__setactivepartition__n___________________________________________Set_active_partition_nMbrFix__drive__num__getactivepartition_____Get_active_partition_nMbrFix_volumeinformation_driveletter_______Get_volume_information_for_partition_nMbrFix_flush_driveletter_s_______________Flush_files_to_disk_for_partition_nMbrFix_listpartitiontypes__________________List_partition_types_n
call fcn.140003e94
xor edi, edi
cmp ebx, edi
je 0x140003098
lea rcx, str._nDrive_numbering__num__starts_on_0._nPartition_numbering__part__starts_on_1._n_nCommands_restorembr__fixmbr__generatesignature__writestate__writesignature___nclean__fixbootsector_and_setactivepartition_will_ask_for_confirmation_unless__n_yes_is_included.___All_these_commands_may_lead_to_data_loss_if_used_nincorrectly_or_without_intention._n_nIf_the__byte_option_is_given_for_the_readsignature_command__the_signature_is_nreturned_as_a_byte_array_instead_of_as_a_DWORD._nWritesignature_requires_the_new_signature_to_be_specified_as_8_hex_digits._n_nIf__vista_is_used_with_the_fixmbr_command__a_Windows_Vista_MBR_is_written__nif__win7_is_used__a_Windows_7_MBR_is_written_instead_of_the_default_nWin2000_XP_2003_MBR._The_Vista_or_Win7_MBR_should_work_with_the_other_OSes._n_nWhen_fixing_boot_sector_of_a_chosen_partition__the_wanted_OS_version_must_be_nspecified._For_now__the_only_valid_choices_are_WIN98__DOS5_and_DOS6._n_nThe_program_reports_an_errorlevel_as_0_for_OK_and_other_values_for_errors__nexcept_ReadState__GetpartitonType__GetActivePartition_and_DriveSize__which_nreturns_the_state_as_a_return_code_as_well_as_printing_to_stdout._Any__nerrors_for_these_commands_are_returned_as_negative_values_because_nof_this._n_nSamples:_nMbrFix__drive_0_listpartitions_nMbrFix__drive_0_savembr_Backup_MBR_0.bin_nMbrFix__drive_0_restorembr_Backup_MBR_0.bin_nMbrFix__drive_0_fixmbr__yes_nMbrFix__drive_0_fixmbr__vista__yes_nMbrFix__drive_0_fixmbr__win7__yes_nMbrFix__drive_0__partition_2_fixbootsector_WIN98__yes_nMbrFix__drive_0__partition_2_setpartitiontype_14__yes_nMbrFix_flush_________________flush_all_drives__nMbrFix_flush_c:_d:_e:________n_nUser_License_Agreement:_nThe_program_is_delivered_AS_IS__that_is_without_any_form_of_guarantee._You_may_nfreely_use_the_program_for_any_legal_purpose__and_you_may_freely_distribute_it__nexcept_for_commercial_purposes__as_long_as_this_file_is_distributed_along_the__nprogram_file._nIf_re_distributed__CD_DVD_compilations_or_similar__on_Web_pages__or_with_other_nnon_commercial_products___credit_should_be_given_to_K
call fcn.140003e94
mov ecx, 0x8001
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
xor r9d, r9d
xor ecx, ecx
lea edx, [r9 + 0x17]
lea r8d, [r9 + 0x65]
call qword [sym.imp.KERNEL32.dll_FindResourceExA]
mov rbx, rax
cmp rax, rdi
je 0x14000322e
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
cmp rax, rdi
je 0x14000322e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdx, rbx
xor ecx, ecx
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r12d, 0x800
lea rdx, [rsp + 0x40]
xor ecx, ecx
mov r8d, r12d
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp eax, edi
jbe 0x14000322e
lea rcx, [rsp + 0x40]
mov edx, 0x5c
call fcn.140005068
mov rbx, rax
cmp rax, rdi
je 0x14000322e
lea r8, [rsp + 0x40]
lea rcx, [rsp + 0x840]
mov rdx, r12
mov byte [rax], dil
call fcn.140006400
lea rcx, [rsp + 0x40]
call fcn.140004e00
lea edx, [r12 - 1]
lea r8, str.MbrFix.htm
sub rdx, rax
mov rcx, rbx
call fcn.140006400
lea r8, [0x140014dbc]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.14000449c
mov r12d, 1
cmp eax, edi
jne 0x1400031b6
mov rcx, qword [rsp + 0x30]
lea r8d, [r12 + 1]
xor edx, edx
call fcn.140006350
mov rcx, qword [rsp + 0x30]
call fcn.140006234
mov ebx, edi
movsxd rcx, eax
cmp rcx, rsi
mov rcx, qword [rsp + 0x30]
cmove ebx, r12d
call fcn.1400040ac
cmp ebx, edi
jne 0x14000322e
lea r8, [0x140014dac]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x38]
call fcn.14000449c
cmp eax, edi
jne 0x14000322e
cmp esi, edi
mov cl, 0x4f
jle 0x1400031e8
mov rax, rbp
xor byte [rax], cl
add cl, dil
add edi, r12d
add rax, r12
cmp edi, esi
jl 0x1400031d9
mov r9, qword [rsp + 0x38]
mov r8, r12
mov rdx, rsi
mov rcx, rbp
call fcn.1400042c0
mov rcx, qword [rsp + 0x38]
call fcn.1400040ac
lea rax, [rsp + 0x840]
lea r8, [rsp + 0x40]
lea rdx, str.open
xor r9d, r9d
xor ecx, ecx
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
or eax, 0xffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.140004000
lea r11, [rsp + 0x1050]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret