Function at 0x1029823
Capabilities:
Clear file content
Manipulate boot configuration

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x638
mov eax, dword [0x1036a44]
or dword [ebp - 0x620], 0xffffffff
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
cmp ebx, edi
mov dword [ebp - 4], eax
mov eax, 0x800
mov dword [ebp - 0x628], edi
mov esi, eax
mov dword [ebp - 0x630], edi
mov dword [ebp - 0x624], edi
mov dword [ebp - 0x634], edi
jne 0x1029872
mov eax, 0x80070057
jmp 0x1029c4b
push eax
call int.0102ec4e
cmp eax, edi
pop ecx
mov dword [ebp - 0x62c], eax
jne 0x102988d
mov eax, 0x8007000e
jmp 0x1029c4b
mov edi, dword [ebp - 0x62c]
xor eax, eax
push eax
push eax
mov ecx, 0x200
rep stosd dword es:[edi], eax
push 0x208
lea eax, [ebp - 0x414]
push eax
call sub.dmutil.dll_GetSystemVolume
test eax, eax
jne 0x1029c3a
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
test eax, eax
pop ecx
je 0x1029c3a
xor eax, eax
mov ecx, 0x82
lea edi, [ebp - 0x20c]
rep stosd dword es:[edi], eax
push 0x1001744
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push 0x1001738
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0x10
lea eax, [ebp - 0x620]
push eax
push 0x180
lea eax, [ebp - 0x20c]
push eax
call fcn.0101ee58
test eax, eax
jl 0x1029bdb
cmp dword [ebp - 0x620], 0
je 0x1029bdb
cmp dword [ebp - 0x620], 0xffffffff
je 0x1029bdb
push dword [ebp - 0x620]
call sub.dmutil.dll_LowNtReadOnlyAttributeOff
test eax, eax
jl 0x1029bdb
push dword [ebp - 0x620]
call fcn.0101f4b2
or dword [ebp - 0x620], 0xffffffff
lea eax, [ebp - 0x620]
push eax
push 0xc0000000
lea eax, [ebp - 0x20c]
push eax
call fcn.0101ee58
test eax, eax
jl 0x1029bdb
cmp dword [ebp - 0x620], 0
je 0x1029bdb
cmp dword [ebp - 0x620], 0xffffffff
je 0x1029bdb
lea eax, [ebp - 0x630]
push eax
push esi
push dword [ebp - 0x62c]
push 0
push 0
push dword [ebp - 0x620]
call sub.dmutil.dll_LowNtReadFile
cmp eax, 0xc0000011
je 0x10299c2
test eax, eax
jne 0x1029bdb
test eax, eax
jne 0x10299ce
cmp dword [ebp - 0x630], esi
je 0x10299d9
lea eax, [esi - 2]
cmp dword [ebp - 0x630], eax
jbe 0x1029a1d
push dword [ebp - 0x62c]
call fcn.0102ec42
add esi, esi
push esi
call int.0102ec4e
mov edi, eax
test edi, edi
pop ecx
pop ecx
mov dword [ebp - 0x62c], edi
je 0x1029a0e
mov ecx, esi
mov edx, ecx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
jmp 0x1029996
mov dword [ebp - 0x628], 0x8007000e
jmp 0x1029be5
push dword [ebp - 0x630]
call int.0102ec4e
mov esi, eax
test esi, esi
pop ecx
mov dword [ebp - 0x634], esi
je 0x1029a0e
mov ecx, dword [ebp - 0x630]
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
xor eax, eax
mov ecx, 0x82
lea edi, [ebp - 0x61c]
push ebx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x61c]
push 0x1001734
push eax
call dword [sym.imp.msvcrt.dll_sprintf]
mov ebx, dword [ebp - 0x62c]
lea eax, [ebp - 0x61c]
push eax
push ebx
call dword [sym.imp.msvcrt.dll_strstr]
mov edx, eax
add esp, 0x14
test edx, edx
je 0x1029be5
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1029a93
sub eax, edi
mov dword [ebp - 0x638], eax
je 0x1029be5
mov eax, dword [ebp - 0x630]
lea edi, [ebx + eax - 1]
cmp edi, edx
mov eax, edx
mov ecx, esi
je 0x1029ace
mov ebx, edi
sub ebx, edx
mov dword [ebp - 0x624], ebx
mov bl, byte [eax]
mov byte [ecx], bl
inc ecx
inc eax
cmp eax, edi
jne 0x1029ac4
mov al, byte [eax]
inc dword [ebp - 0x624]
mov byte [ecx], al
mov ecx, dword [ebp - 0x624]
mov ebx, ecx
shr ecx, 2
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov ecx, ebx
and ecx, 3
rep stosb byte es:[edi], al
mov ebx, dword [ebp - 0x630]
sub ebx, dword [ebp - 0x624]
push 2
pop ecx
mov al, byte [esi]
cmp al, 0xd
je 0x1029b09
cmp al, 0xa
jne 0x1029b10
inc esi
dec dword [ebp - 0x624]
dec ecx
jne 0x1029aff
jmp 0x1029b29
cmp al, 0xa
je 0x1029b2f
cmp dword [ebp - 0x624], 0
je 0x1029b2f
inc esi
dec dword [ebp - 0x624]
mov al, byte [esi]
cmp al, 0xd
jne 0x1029b15
cmp dword [ebp - 0x624], 2
jbe 0x1029b6a
lea eax, [esi + 2]
mov cl, byte [eax]
cmp cl, 0x5b
je 0x1029b6a
cmp dword [ebp - 0x624], 3
jbe 0x1029b6a
cmp byte [esi], 0xd
jne 0x1029b6a
cmp cl, 0xd
jne 0x1029b6a
cmp byte [esi + 1], 0xa
jne 0x1029b6a
cmp byte [esi + 3], 0xa
jne 0x1029b6a
sub dword [ebp - 0x624], 2
mov esi, eax
cmp dword [ebp - 0x624], 0
je 0x1029b89
mov ecx, dword [ebp - 0x624]
mov eax, ecx
shr ecx, 2
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor ecx, ecx
push ecx
push ecx
push ecx
xor eax, eax
push eax
push dword [ebp - 0x620]
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1029bb1
push dword [ebp - 0x620]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1029bb9
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1029bdb
mov eax, dword [ebp - 0x624]
add ebx, eax
push ebx
push dword [ebp - 0x62c]
push 0
push 0
push dword [ebp - 0x620]
call sub.dmutil.dll_LowNtWriteFile
test eax, eax
jge 0x1029be5
mov dword [ebp - 0x628], 0x80004005
xor esi, esi
cmp dword [ebp - 0x620], esi
je 0x1029c0a
cmp dword [ebp - 0x620], 0xffffffff
je 0x1029c0a
push dword [ebp - 0x620]
call fcn.0101f4b2
or dword [ebp - 0x620], 0xffffffff
cmp dword [ebp - 0x62c], esi
je 0x1029c1e
push dword [ebp - 0x62c]
call fcn.0102ec42
pop ecx
cmp dword [ebp - 0x634], esi
je 0x1029c32
push dword [ebp - 0x634]
call fcn.0102ec42
pop ecx
mov eax, dword [ebp - 0x628]
jmp 0x1029c4b
push dword [ebp - 0x62c]
call fcn.0102ec42
pop ecx
mov eax, 0x80004005
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0102e95a
leave
ret 4