Function at 0x436a52
Capabilities:
Contain obfuscated stackstrings
Delete file
Manipulate boot configuration
Set file attributes

Disassembly:
push ebp
sub esp, 0x458
lea ebp, [esp - 4]
mov eax, dword [0x6d15dc]
xor eax, ebp
mov dword [ebp + 0x458], eax
push 0x2d8
mov eax, 0x5f5d3e
call fcn.0057938a
mov eax, dword [ebp + 0x464]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x468]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x46c]
push 0x6d8ad4
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x8c]
push 0x6d90a0
push eax
call fcn.0042cdad
mov esi, 0x6d9180
push esi
push eax
lea eax, [ebp - 0x70]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.0042cdad
push 0x6d8ff8
push eax
lea eax, [ebp - 0xa8]
xor edi, edi
push eax
inc edi
mov byte [ebp - 4], 1
call fcn.0042cdad
push 0x6d92b4
push eax
lea eax, [ebp - 0xc4]
push eax
mov byte [ebp - 4], 2
call fcn.0042cdad
push 0x6d8f88
push eax
lea eax, [ebp - 0x54]
push eax
mov byte [ebp - 4], 3
call fcn.0042cdad
push 0x6d8f50
push eax
lea eax, [ebp + 0x194]
push eax
mov byte [ebp - 4], 4
call fcn.0042cdad
add esp, 0x48
push 0x6d8ea8
push eax
lea eax, [ebp + 0x178]
push eax
mov byte [ebp - 4], 5
call fcn.0042cdad
push 0x6d8a9c
push eax
lea eax, [ebp + 0x15c]
push eax
mov byte [ebp - 4], 6
call fcn.0042cdad
push 0x6d8fc0
push eax
lea eax, [ebp + 0x1cc]
push eax
mov byte [ebp - 4], 7
call fcn.0042cdad
add esp, 0x24
push ebx
push edi
lea ecx, [ebp + 0x15c]
call fcn.00414e93
push ebx
push edi
lea ecx, [ebp + 0x178]
call fcn.00414e93
push ebx
push edi
lea ecx, [ebp + 0x194]
call fcn.00414e93
push ebx
push edi
lea ecx, [ebp - 0x54]
call fcn.00414e93
push ebx
push edi
lea ecx, [ebp - 0xc4]
call fcn.00414e93
push ebx
push edi
lea ecx, [ebp - 0xa8]
call fcn.00414e93
push ebx
push edi
lea ecx, [ebp - 0x70]
call fcn.00414e93
push ebx
push edi
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 0x10
call fcn.00414e93
mov ecx, dword [ebp - 0x1c]
push edi
push ebx
lea eax, [ebp + 0x1cc]
push eax
call fcn.00482680
test al, al
jne 0x436c15
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp + 0x23c]
push eax
call fcn.0042cf1d
cmp dword [eax + 0x18], 0x10
mov byte [ebp - 4], 0x11
jb 0x436bf8
mov eax, dword [eax + 4]
jmp 0x436bfb
add eax, 4
push eax
push 0x62ed54
push ebx
call fcn.00481a0a
add esp, 0xc
lea ecx, [ebp + 0x23c]
jmp 0x4379c8
push ebx
lea ecx, [ebp + 0x220]
mov dword [ebp + 0x238], 0xf
call fcn.00415967
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0xd]
push eax
lea eax, [ebp + 0x220]
push eax
push esi
mov byte [ebp - 4], 0x12
call fcn.0048258f
test al, al
je 0x4379b5
cmp byte [ebp - 0xd], bl
jne 0x436c5a
push str.Switch_requires_a_value_____D
jmp 0x4379ba
cmp dword [ebp + 0x238], 0x10
mov eax, dword [ebp + 0x224]
jae 0x436c6f
lea eax, [ebp + 0x224]
lea ecx, [ebp - 0x25]
push ecx
lea ecx, [ebp - 0x34]
push ecx
mov esi, str._d_c
push esi
push eax
call fcn.0057d44a
add esp, 0x10
cmp eax, edi
jne 0x437998
mov eax, dword [ebp - 0x34]
cmp eax, edi
jl 0x437998
cmp eax, dword [0x6d8a08]
jg 0x437998
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0xd]
push eax
lea eax, [ebp + 0x220]
push eax
push 0x6d8ff8
call fcn.0048258f
test al, al
je 0x437991
cmp byte [ebp - 0xd], bl
jne 0x436cd4
push str.Switch_requires_a_value_____P
jmp 0x4379ba
cmp dword [ebp + 0x238], 0x10
mov eax, dword [ebp + 0x224]
jae 0x436ce9
lea eax, [ebp + 0x224]
lea ecx, [ebp - 0x25]
push ecx
lea ecx, [ebp - 0x30]
push ecx
push esi
push eax
call fcn.0057d44a
add esp, 0x10
cmp eax, edi
jne 0x43796b
cmp dword [ebp - 0x30], edi
jl 0x43796b
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0xd]
push eax
lea eax, [ebp + 0x220]
push eax
push 0x6d92b4
call fcn.0048258f
test al, al
je 0x436d2e
mov dword [0x6d9310], edi
push str.winnt
lea ecx, [ebp + 0x140]
call fcn.0041466e
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0xd]
push eax
lea eax, [ebp + 0x220]
push eax
push 0x6d8f88
mov byte [ebp - 4], 0x13
call fcn.0048258f
test al, al
je 0x436da6
cmp dword [0x6d9310], edi
je 0x436d85
push str.Invalid_switch_____SYSFOLDER._This_switch_requires__WINNT
push ebx
call fcn.00481a0a
pop ecx
pop ecx
push ebx
push edi
lea ecx, [ebp + 0x140]
call fcn.00414e93
jmp 0x4379c2
cmp byte [ebp - 0xd], bl
jne 0x436d91
push str.Switch_requires_a_value_____SYSFOLDER
jmp 0x436d6b
push 0xffffffffffffffff
push ebx
lea eax, [ebp + 0x220]
push eax
lea ecx, [ebp + 0x140]
call fcn.00414d7e
push ebx
lea ecx, [ebp + 0x204]
mov dword [ebp + 0x21c], 0xf
call fcn.00415967
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0xd]
push eax
lea eax, [ebp + 0x220]
push eax
push 0x6d8f50
mov byte [ebp - 4], 0x14
call fcn.0048258f
test al, al
je 0x437961
cmp byte [ebp - 0xd], bl
jne 0x436e04
push str.Switch_requires_a_value_____DESC
push ebx
call fcn.00481a0a
pop ecx
pop ecx
push ebx
push edi
lea ecx, [ebp + 0x204]
call fcn.00414e93
jmp 0x436d73
push 0xffffffffffffffff
push ebx
lea eax, [ebp + 0x220]
push eax
lea ecx, [ebp + 0x204]
call fcn.00414d7e
mov ecx, dword [ebp - 0x20]
xor esi, esi
call fcn.00428607
test eax, eax
jbe 0x436e70
mov ecx, dword [ebp - 0x20]
push esi
call fcn.00428628
add eax, 0x1c
cmp dword [eax + 0x18], 0x10
jb 0x436e3e
mov eax, dword [eax + 4]
jmp 0x436e41
add eax, 4
cmp dword [ebp + 0x21c], 0x10
mov ecx, dword [ebp + 0x208]
jae 0x436e56
lea ecx, [ebp + 0x208]
push eax
push ecx
call fcn.0058372e
test eax, eax
pop ecx
pop ecx
je 0x436e84
mov ecx, dword [ebp - 0x20]
inc esi
call fcn.00428607
cmp esi, eax
jb 0x436e27
mov eax, dword [ebp - 0x34]
dec eax
call fcn.00429571
cmp eax, ebx
mov dword [ebp - 0x24], eax
jne 0x436ee6
mov esi, edi
jmp 0x436eab
cmp dword [ebp + 0x21c], 0x10
mov eax, dword [ebp + 0x208]
jae 0x436e99
lea eax, [ebp + 0x208]
push eax
push str.Entry:___s__already_exists
push ebx
call fcn.00481a0a
add esp, 0xc
push 2
pop esi
push ebx
push edi
lea ecx, [ebp + 0x204]
call fcn.00414e93
push ebx
push edi
lea ecx, [ebp + 0x140]
call fcn.00414e93
push ebx
push edi
lea ecx, [ebp + 0x220]
call fcn.00414e93
push ebx
push edi
lea ecx, [ebp + 0x1cc]
call fcn.00414e93
mov eax, esi
jmp 0x4379df
push dword [ebp - 0x30]
mov ecx, dword [ebp - 0x24]
call fcn.00482c9e
mov esi, eax
cmp esi, ebx
jne 0x436f01
push dword [ebp - 0x30]
push str.Invalid_partition_number_____d
jmp 0x436e9f
mov ecx, esi
call fcn.004800b6
test al, al
je 0x436f1b
push str.Cannot_boot_from_an_auxiliary_partition
push ebx
call fcn.00481a0a
pop ecx
pop ecx
jmp 0x436ea8
mov ecx, esi
call fcn.0047fd31
test al, al
jne 0x437957
mov ecx, esi
call fcn.0047fd46
test al, al
jne 0x437957
mov ecx, esi
call fcn.0047fb01
cmp byte [eax + 0xd], bl
je 0x436f57
push str.Cannot_boot_from_a_hidden_partition._Unhide_the_partition_before_modifying_boot.ini
push ebx
call fcn.00481a0a
pop ecx
pop ecx
jmp 0x436e80
push 0x657368
lea ecx, [ebp + 0x1e8]
call fcn.0041466e
mov eax, dword [0x6d9310]
cmp eax, ebx
mov byte [ebp - 4], 0x15
jne 0x437316
mov eax, dword [esi]
push ebx
lea ecx, [ebp + 0x258]
push ecx
push ebx
push edi
push ebx
push ebx
mov ecx, esi
call dword [eax + 8]
test al, al
jne 0x436fb2
push dword [ebp - 0x30]
push str.Error_reading_the_boot_sector_of_the_specified_partition_____P:_d
push ebx
call fcn.00481a0a
add esp, 0xc
push ebx
push edi
lea ecx, [ebp + 0x1e8]
call fcn.00414e93
jmp 0x436e80
mov esi, 0x657368
push esi
lea ecx, [ebp + 0x15c]
call fcn.0041466e
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0xd]
push eax
lea eax, [ebp + 0x220]
push eax
push 0x6d8a9c
mov byte [ebp - 4], 0x16
call fcn.0048258f
test al, al
je 0x437029
cmp byte [ebp - 0xd], bl
jne 0x437014
push str.Switch_requires_a_value_____BSECTFILE:
push ebx
call fcn.00481a0a
pop ecx
pop ecx
push ebx
push edi
lea ecx, [ebp + 0x15c]
call fcn.00414e93
push ebx
push edi
lea ecx, [ebp + 0x1e8]
call fcn.00414e93
jmp 0x436ea8
push 0xffffffffffffffff
push ebx
lea eax, [ebp + 0x220]
push eax
lea ecx, [ebp + 0x15c]
call fcn.00414d7e
push esi
lea ecx, [ebp + 0x23c]
call fcn.0041466e
cmp dword [ebp + 0x170], ebx
mov byte [ebp - 4], 0x17
je 0x43705b
push 0xffffffffffffffff
push ebx
lea eax, [ebp + 0x15c]
push eax
lea ecx, [ebp + 0x23c]
call fcn.00414d7e
jmp 0x437153
push str.__:____
lea ecx, [ebp + 0x194]
call fcn.0041466e
xor esi, esi
cmp dword [ebp + 0x218], ebx
mov byte [ebp - 4], 0x18
jbe 0x4370ef
push esi
lea ecx, [ebp + 0x204]
call fcn.004295ed
mov al, byte [eax]
push edi
mov byte [ebp - 0x14], al
push ebx
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp + 0x194]
call fcn.00429ad8
cmp eax, 0xffffffff
jne 0x4370e6
push esi
lea ecx, [ebp + 0x204]
call fcn.004295ed
movzx eax, byte [eax]
push eax
push edi
lea ecx, [ebp + 0x178]
call fcn.0042c863
push 0xffffffffffffffff
push ebx
lea eax, [ebp + 0x178]
push eax
lea ecx, [ebp + 0x23c]
mov byte [ebp - 4], 0x19
call fcn.0042c29c
push ebx
push edi
lea ecx, [ebp + 0x178]
mov byte [ebp - 4], 0x18
call fcn.00414e93
inc esi
cmp esi, dword [ebp + 0x218]
jb 0x437079
cmp dword [ebp + 0x250], 8
jbe 0x437109
push 0xffffffffffffffff
push 8
lea ecx, [ebp + 0x23c]
call fcn.004158f8
jmp 0x437121
cmp dword [ebp + 0x250], ebx
jne 0x437121
push str.gdiskbot
lea ecx, [ebp + 0x23c]
call fcn.00414e10
push str..dat
lea ecx, [ebp + 0x23c]
call fcn.0042c8a9
push 0x6309a0
push ebx
lea ecx, [ebp + 0x23c]
call fcn.0042c8da
push ebx
push edi
lea ecx, [ebp + 0x194]
mov byte [ebp - 4], 0x17
call fcn.00414e93
mov eax, dword [ebp + 0x240]
push 0x10
pop esi
cmp dword [ebp + 0x254], esi
jae 0x43716a
lea eax, [ebp + 0x240]
lea ecx, [ebp]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x4371c9
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 0x254], esi
mov eax, dword [ebp + 0x240]
jae 0x437195
lea eax, [ebp + 0x240]
push eax
push str.Boot_sector_file__s_already_exists._Replace_
push 4
call fcn.00481a0a
add esp, 0xc
cmp eax, 2
jne 0x4371c9
push ebx
push edi
lea ecx, [ebp + 0x23c]
call fcn.00414e93
lea ecx, [ebp + 0x15c]
push ebx
push edi
call fcn.00414e93
jmp 0x436fa0
cmp dword [ebp + 0x254], esi
mov eax, dword [ebp + 0x240]
jae 0x4371dd
lea eax, [ebp + 0x240]
push edi
push 0x40
push 0x22
push eax
lea ecx, [ebp - 0x2e4]
call fcn.00436131
mov eax, dword [ebp - 0x2e4]
mov eax, dword [eax + 4]
test byte [ebp + eax - 0x2dc], 6
mov byte [ebp - 4], 0x1a
je 0x43723c
cmp dword [ebp + 0x254], esi
mov eax, dword [ebp + 0x240]
jae 0x437219
lea eax, [ebp + 0x240]
push eax
push str.Cannot_create__s_file
push ebx
call fcn.00481a0a
add esp, 0xc
lea ecx, [ebp - 0x2e4]
mov byte [ebp - 4], 0x17
call fcn.00432227
jmp 0x4371aa
push ebx
push ebx
lea ecx, [ebp - 0x2dc]
call fcn.00432241
push 0x200
lea eax, [ebp + 0x258]
push eax
lea ecx, [ebp - 0x2dc]
call fcn.0043556c
lea ecx, [ebp - 0x2e4]
call fcn.004313e7
push 0x630954
lea eax, [ebp + 0x23c]
push eax
lea eax, [ebp - 0xa8]
push eax
call fcn.0042db6c
lea ecx, [ebp + 0x204]
push ecx
push eax
lea eax, [ebp - 0x70]
push eax
mov byte [ebp - 4], 0x1b
call fcn.0042cdad
push 0x6565ac
push eax
lea eax, [ebp - 0x8c]
push eax
mov byte [ebp - 4], 0x1c
call fcn.0042db6c
add esp, 0x24
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp + 0x1e8]
mov byte [ebp - 4], 0x1d
call fcn.00414d7e
push ebx
push edi
lea ecx, [ebp - 0x8c]
call fcn.00414e93
push ebx
push edi
lea ecx, [ebp - 0x70]
call fcn.00414e93
push ebx
push edi
lea ecx, [ebp - 0xa8]
call fcn.00414e93
lea ecx, [ebp - 0x2e4]
mov byte [ebp - 4], 0x17
call fcn.00432227
push ebx
push edi
lea ecx, [ebp + 0x23c]
call fcn.00414e93
push ebx
push edi
lea ecx, [ebp + 0x15c]
call fcn.00414e93
jmp 0x437616
cmp eax, edi
jne 0x437616
mov dword [ebp + 0x188], ebx
mov dword [ebp + 0x18c], ebx
mov dword [ebp + 0x190], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], ebx
mov eax, dword [ebp - 0x24]
cmp dword [eax + 0xf0], ebx
mov byte [ebp - 4], 0x1f
mov dword [ebp - 0x20], ebx
jle 0x437395
push dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
call fcn.00482b90
mov ecx, eax
mov dword [ebp - 0x2c], ecx
call fcn.0047fe43
test al, al
je 0x43736c
lea ecx, [ebp + 0x184]
jmp 0x43737b
mov ecx, dword [ebp - 0x2c]
call fcn.0047fdae
test al, al
je 0x437384
lea ecx, [ebp - 0x48]
lea eax, [ebp - 0x2c]
push eax
call fcn.004322a5
inc dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
cmp ecx, dword [eax + 0xf0]
jl 0x43734b
lea eax, [ebp + 0x184]
push eax
lea ecx, [ebp + 0x1a0]
call fcn.0043141b
mov byte [ebp - 4], 0x20
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x44], ebx
je 0x4373dd
mov eax, dword [ebp - 0x40]
sub eax, dword [ebp - 0x44]
sar eax, 2
cmp dword [ebp - 0x20], eax
jae 0x4373dd
push dword [ebp - 0x20]
lea ecx, [ebp - 0x48]
call fcn.004286b6
push eax
lea ecx, [ebp + 0x1a0]
call fcn.004322a5
inc dword [ebp - 0x20]
jmp 0x4373ae
mov dword [ebp - 0x24], ebx
cmp dword [ebp + 0x1a4], ebx
je 0x43745d
mov eax, dword [ebp + 0x1a8]
sub eax, dword [ebp + 0x1a4]
sar eax, 2
cmp dword [ebp - 0x24], eax
jae 0x43745d
push dword [ebp - 0x24]
lea ecx, [ebp + 0x1a0]
call fcn.004286b6
mov eax, dword [eax]
mov ecx, dword [eax + 0x50]
cmp ecx, dword [esi + 0x50]
jne 0x437450
mov ecx, dword [eax + 0x58]
cmp ecx, dword [esi + 0x58]
jne 0x437450
mov ecx, dword [eax + 0x5c]
cmp ecx, dword [esi + 0x5c]
jne 0x437450
mov ecx, dword [eax + 0x60]
cmp ecx, dword [esi + 0x60]
jne 0x437450
mov ecx, dword [eax + 0x64]
cmp ecx, dword [esi + 0x64]
jne 0x437450
mov ecx, dword [eax + 0x98]
cmp ecx, dword [esi + 0x98]
jne 0x437450
mov eax, dword [eax + 0x9c]
cmp eax, dword [esi + 0x9c]
je 0x437455
inc dword [ebp - 0x24]
jmp 0x4373e0
mov eax, dword [ebp - 0x24]
inc eax
cmp eax, ebx
jne 0x43748d
push str.Cannot_create_ARC_style_partition_ID
push ebx
call fcn.00481a0a
pop ecx
pop ecx
lea ecx, [ebp + 0x1a0]
call fcn.0042b038
lea ecx, [ebp - 0x48]
call fcn.0042b038
lea ecx, [ebp + 0x184]
call fcn.0042b038
jmp 0x436fa0
push eax
lea eax, [ebp - 0xe0]
push eax
call fcn.0047f44c
mov esi, eax
mov eax, dword [ebp - 0x34]
dec eax
push 0xa
push eax
lea eax, [ebp - 0x21c]
push eax
mov byte [ebp - 4], 0x21
call fcn.0047efb8
push eax
lea eax, [ebp - 0x238]
push str.multi_0_disk_0_rdisk_
push eax
mov byte [ebp - 4], 0x22
call fcn.0042dbb3
push str._partition_
push eax
lea eax, [ebp - 0x254]
push eax
mov byte [ebp - 4], 0x23
call fcn.0042db6c
push esi
push eax
lea eax, [ebp + 0x23c]
push eax
mov byte [ebp - 4], 0x24
call fcn.0042cdad
push 0x630904
push eax
lea eax, [ebp + 0x15c]
push eax
mov byte [ebp - 4], 0x25
call fcn.0042db6c
add esp, 0x44
lea ecx, [ebp + 0x140]
push ecx
push eax
lea eax, [ebp - 0xc4]
push eax
mov byte [ebp - 4], 0x26
call fcn.0042cdad
push 0x630954
push eax
lea eax, [ebp - 0xa8]
push eax
mov byte [ebp - 4], 0x27
call fcn.0042db6c
lea ecx, [ebp + 0x204]
push ecx
push eax
lea eax, [ebp - 0x70]
push eax
mov byte [ebp - 4], 0x28
call fcn.0042cdad
push 0x6565ac
push eax
lea eax, [ebp - 0x8c]
push eax
mov byte [ebp - 4], 0x29
call fcn.0042db6c
add esp, 0x30
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp + 0x1e8]
mov byte [ebp - 4], 0x2a
call fcn.00414d7e
push ebx
push edi
lea ecx, [ebp - 0x8c]
call fcn.00414e93
push ebx
push edi
lea ecx, [ebp - 0x70]
call fcn.00414e93
push ebx
push edi
lea ecx, [ebp - 0xa8]
call fcn.00414e93
push ebx
push edi
lea ecx, [ebp - 0xc4]
call fcn.00414e93
push ebx
push edi
lea ecx, [ebp + 0x15c]
call fcn.00414e93
push ebx
push edi
lea ecx, [ebp + 0x23c]
call fcn.00414e93
push ebx
push edi
lea ecx, [ebp - 0x254]
call fcn.00414e93
push ebx
push edi
lea ecx, [ebp - 0x238]
call fcn.00414e93
push ebx
push edi
lea ecx, [ebp - 0x21c]
call fcn.00414e93
push ebx
push edi
lea ecx, [ebp - 0xe0]
call fcn.00414e93
lea ecx, [ebp + 0x1a0]
call fcn.0042b038
lea ecx, [ebp - 0x48]
call fcn.0042b038
lea ecx, [ebp + 0x184]
call fcn.0042b038
push ebx
lea ecx, [ebp + 0x1b0]
mov dword [ebp + 0x1c8], 0xf
call fcn.00415967
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0xe0]
push eax
mov byte [ebp - 4], 0x2b
call fcn.0042cf02
push dword [ebp - 0x38]
lea edx, [ebp + 0x1b0]
mov ecx, eax
mov byte [ebp - 4], 0x2c
call fcn.00436430
pop ecx
push ebx
test eax, eax
push edi
lea ecx, [ebp - 0xe0]
setne byte [ebp - 0x14]
mov byte [ebp - 4], 0x2b
call fcn.00414e93
cmp byte [ebp - 0x14], bl
je 0x43767b
lea ecx, [ebp + 0x1b0]
jmp 0x4371bd
mov esi, dword [ebp - 0x38]
lea eax, [ebp - 0x2c]
push eax
call fcn.0042a2e2
test eax, eax
pop ecx
jne 0x437670
cmp dword [esi + 0x18], 0x10
lea eax, [esi + 4]
mov dword [ebp - 0x1c], eax
jb 0x43769a
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
mov eax, dword [ebp - 0x1c]
jne 0x4376c1
cmp dword [esi + 0x18], 0x10
jb 0x4376b0
mov eax, dword [eax]
push eax
push str.Cannot_overwrite__s_file
push ebx
call fcn.00481a0a
add esp, 0xc
jmp 0x437670
cmp dword [esi + 0x18], 0x10
jb 0x4376c9
mov eax, dword [eax]
push edi
push 0x40
push 2
push eax
lea ecx, [ebp - 0x200]
call fcn.00436131
cmp dword [ebp + 0x1c8], 0x10
mov eax, dword [ebp + 0x1b4]
mov byte [ebp - 4], 0x2d
jae 0x4376f3
lea eax, [ebp + 0x1b4]
push edi
push 0x40
push edi
push eax
lea ecx, [ebp - 0x170]
call fcn.00436131
mov eax, dword [ebp - 0x200]
mov eax, dword [eax + 4]
test byte [ebp + eax - 0x1f8], 6
mov byte [ebp - 4], 0x2e
je 0x437757
cmp dword [esi + 0x18], 0x10
mov eax, dword [ebp - 0x1c]
jb 0x437725
mov eax, dword [eax]
push eax
push str.Cannot_overwrite__s_file
push ebx
call fcn.00481a0a
add esp, 0xc
lea ecx, [ebp - 0x170]
mov byte [ebp - 4], 0x2d
call fcn.00432227
lea ecx, [ebp - 0x200]
mov byte [ebp - 4], 0x2b
call fcn.00432227
jmp 0x437670
mov eax, dword [ebp - 0x170]
mov eax, dword [eax + 4]
mov eax, dword [ebp + eax - 0x168]
test al, 6
je 0x437788
cmp dword [ebp + 0x1c8], 0x10
mov eax, dword [ebp + 0x1b4]
jae 0x437780
lea eax, [ebp + 0x1b4]
push eax
push str.Cannot_open__s_backup_file
jmp 0x43772b
mov byte [ebp - 0x14], bl
mov byte [ebp - 0x15], bl
jmp 0x4378ab
cmp eax, ebx
jne 0x4378b3
push ebx
lea ecx, [ebp + 0x23c]
mov dword [ebp + 0x254], 0xf
call fcn.00415967
push 0xa
lea eax, [ebp + 0x23c]
push eax
lea eax, [ebp - 0x170]
push eax
mov byte [ebp - 4], 0x2f
call fcn.00433fcd
mov eax, dword [ebp + 0x240]
add esp, 0xc
cmp dword [ebp + 0x254], 0x10
jae 0x4377e2
lea eax, [ebp + 0x240]
push str._operating_systems_
push eax
call fcn.0058372e
test eax, eax
pop ecx
pop ecx
jne 0x4377f9
mov byte [ebp - 0x14], 1
jmp 0x437855
cmp byte [ebp - 0x14], bl
je 0x437855
push ebx
push 0x6308b4
lea ecx, [ebp + 0x23c]
call fcn.0042a377
test eax, eax
jne 0x43781d
cmp byte [ebp - 0x15], bl
mov byte [ebp - 0x14], bl
jne 0x437855
jmp 0x437835
cmp byte [ebp - 0x15], bl
jne 0x437855
mov eax, dword [ebp - 0x170]
mov eax, dword [eax + 4]
test byte [ebp + eax - 0x168], 1
je 0x437855
lea eax, [ebp + 0x1e8]
push eax
lea eax, [ebp - 0x1f8]
push eax
call fcn.00433e64
push eax
call fcn.00427f2c
mov byte [ebp - 0x15], 1
add esp, 0xc
lea eax, [ebp + 0x23c]
push eax
lea eax, [ebp - 0x1f8]
push eax
call fcn.00433e64
mov eax, dword [ebp - 0x170]
mov eax, dword [eax + 4]
test byte [ebp + eax - 0x168], 1
pop ecx
pop ecx
jne 0x43788a
lea eax, [ebp - 0x1f8]
push eax
call fcn.00427f2c
pop ecx
push ebx
push edi
lea ecx, [ebp + 0x23c]
mov byte [ebp - 4], 0x2e
call fcn.00414e93
mov eax, dword [ebp - 0x170]
mov eax, dword [eax + 4]
mov eax, dword [ebp + eax - 0x168]
test al, 1
je 0x437793
lea ecx, [ebp - 0x200]
call fcn.004313e7
lea ecx, [ebp - 0x170]
call fcn.004313e7
test byte [ebp - 0x2c], 1
je 0x4378e4
cmp dword [esi + 0x18], 0x10
mov eax, dword [ebp - 0x1c]
jb 0x4378da
mov eax, dword [eax]
push dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x170]
mov byte [ebp - 4], 0x2d
call fcn.00432227
lea ecx, [ebp - 0x200]
mov byte [ebp - 4], 0x2b
call fcn.00432227
push ebx
push edi
lea ecx, [ebp + 0x1b0]
call fcn.00414e93
push ebx
push edi
lea ecx, [ebp + 0x1e8]
call fcn.00414e93
push ebx
push edi
lea ecx, [ebp + 0x204]
call fcn.00414e93
push ebx
push edi
lea ecx, [ebp + 0x140]
call fcn.00414e93
push ebx
push edi
lea ecx, [ebp + 0x220]
call fcn.00414e93
push ebx
push edi
lea ecx, [ebp + 0x1cc]
call fcn.00414e93
xor eax, eax
jmp 0x4379df
push str.Cannot_boot_from_an_extended_partition
jmp 0x436f11
push str.Required_switch_missing_____DESC
jmp 0x436dea
cmp dword [ebp + 0x238], 0x10
mov eax, dword [ebp + 0x224]
jae 0x437980
lea eax, [ebp + 0x224]
push eax
push str.Invalid_partition_number_____s
push ebx
call fcn.00481a0a
add esp, 0xc
jmp 0x4379c2
push str.Required_switch_missing_____P
jmp 0x4379ba
cmp dword [ebp + 0x238], 0x10
mov eax, dword [ebp + 0x224]
jae 0x4379ad
lea eax, [ebp + 0x224]
push eax
push str.Invalid_fixed_disk_number_____s
jmp 0x437986
push str.Required_switch_missing_____D
push ebx
call fcn.00481a0a
pop ecx
pop ecx
lea ecx, [ebp + 0x220]
push ebx
push edi
call fcn.00414e93
push ebx
push edi
lea ecx, [ebp + 0x1cc]
call fcn.00414e93
push 2
pop eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x458]
xor ecx, ebp
call fcn.0057937b
add ebp, 0x45c
leave
ret