Function at 0x409640
Capabilities:
Delete file
Get disk information
Move file
Read file on windows
Set file attributes
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0xc8
lea rbp, [rsp + 0x80]
mov qword [rbp - 0x40], rdx
mov dword [rbp - 0x38], ecx
call fcn.00404490
call fcn.004015df
test eax, eax
mov rdx, qword [rbp - 0x40]
mov ecx, dword [rbp - 0x38]
jne 0x40968d
call qword [sym.imp.msvcrt.dll___iob_func]
lea rcx, str.You_need_to_be_running_at_least_Windows_NT__use_syslinux.com_instead._n
lea rdx, [rax + 0x60]
jmp 0x409720
mov rax, qword [rdx]
mov r8d, 2
mov qword [0x004195e8], rax
call fcn.00401eed
mov rbx, qword [0x0040a490]
test rbx, rbx
je 0x4096c7
movsx ecx, byte [rbx]
call qword [sym.imp.msvcrt.dll_isalpha]
test eax, eax
je 0x4096c7
cmp byte [rbx + 1], 0x3a
jne 0x4096c7
cmp byte [rbx + 2], 0
je 0x4096d6
mov edx, 2
mov ecx, 0x40
call fcn.00401de0
cmp qword [0x0040a460], 0
jne 0x40970f
cmp dword [0x0040a470], 0
jne 0x40970f
cmp qword [0x0040a478], 0
jne 0x40970f
cmp dword [0x0040a480], 0
jg 0x40970f
cmp qword [0x0040a4a0], 0
jne 0x40970f
cmp dword [0x0040a498], 0
je 0x40972f
call qword [sym.imp.msvcrt.dll___iob_func]
lea rcx, str.At_least_one_specified_option_not_yet_implemented_for_this_installer._n
lea rdx, [rax + 0x60]
call sub.msvcrt.dll_fputs
mov ecx, 1
call sub.msvcrt.dll_exit
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov rbx, qword [0x0040a490]
mov r12d, eax
mov dil, byte [rbx]
movsx esi, dil
mov ecx, esi
call qword [sym.imp.msvcrt.dll_tolower]
sub eax, 0x61
bt r12d, eax
jb 0x409772
call qword [sym.imp.msvcrt.dll___iob_func]
lea rdx, str.No_such_drive__c:_n
lea rcx, [rax + 0x60]
mov r8d, esi
call sub.msvcrt.dll_fprintf
jmp 0x409725
mov byte [0x0040a004], dil
mov al, byte [rbx]
lea rcx, [0x0040a017]
mov byte [str._:ldlinux.sys], al
mov al, byte [rbx]
mov byte [0x0040a017], al
call qword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
jne 0x4097ba
cmp dword [0x0040a4a8], 0
jne 0x4097ba
call qword [sym.imp.msvcrt.dll___iob_func]
lea rcx, str.Not_a_removable_drive__use__f_to_override___n
lea rdx, [rax + 0x60]
jmp 0x409720
sub eax, 2
cmp eax, 1
jbe 0x4097d8
call qword [sym.imp.msvcrt.dll___iob_func]
lea rcx, str.Unsupported_media_n
lea rdx, [rax + 0x60]
jmp 0x409720
xor r9d, r9d
lea rcx, str.._:
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
mov r8d, 3
mov edx, 0xc0000000
mov rbx, qword [sym.imp.KERNEL32.dll_CreateFileA]
call rbx
cmp rax, 0xffffffffffffffff
mov rsi, rax
lea rcx, str.Could_not_open_drive
je 0x409d52
mov rcx, rax
mov qword [rsp + 0x20], 0
lea r9, [rbp - 0x24]
mov r8d, 0x200
lea rdx, [0x00418030]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
lea rcx, str.Reading_boot_sector
je 0x409d52
cmp dword [rbp - 0x24], 0x200
je 0x409874
call qword [sym.imp.msvcrt.dll___iob_func]
lea rcx, str.Could_not_read_the_whole_boot_sector_n
lea rdx, [rax + 0x60]
jmp 0x409720
lea rdx, [rbp - 0x1c]
lea rcx, [0x00418030]
call fcn.0040266f
test rax, rax
je 0x4098ac
mov qword [rbp - 0x38], rax
call qword [sym.imp.msvcrt.dll___iob_func]
mov r8, qword [rbp - 0x38]
lea rcx, [rax + 0x60]
lea rdx, [0x004142b4]
call sub.msvcrt.dll_fprintf
jmp 0x409725
mov edx, pe_nt_image_headers64
lea rcx, str._:ldlinux.sys
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, str._:ldlinux.sys
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rcx, [0x00419600]
call fcn.00402546
xor r9d, r9d
lea rcx, str._:ldlinux.sys
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 7
mov dword [rsp + 0x20], 2
mov r8d, 3
mov edx, 0xc0000000
call rbx
cmp rax, 0xffffffffffffffff
mov rbx, rax
lea rcx, str.Unable_to_create_ldlinux.sys
je 0x409d52
mov edi, dword [0x00414c24]
mov qword [rsp + 0x20], 0
lea r9, [rbp - 0x20]
lea rdx, str._r_nSYSLINUX_4.06
mov rcx, rax
mov r13, qword [sym.imp.KERNEL32.dll_WriteFile]
mov r8d, edi
call r13
test eax, eax
jne 0x409955
lea rcx, str.Could_not_write_ldlinux.sys
jmp 0x409d52
mov r12d, dword [rbp - 0x20]
cmp r12d, edi
jne 0x409949
mov qword [rsp + 0x20], 0
lea r9, [rbp - 0x20]
mov r8d, 0x400
lea rdx, [0x00419600]
mov rcx, rbx
call r13
test eax, eax
je 0x40998b
cmp dword [rbp - 0x20], 0x400
je 0x409997
lea rcx, str.Could_not_write_ADV_to_ldlinux.sys
jmp 0x409d52
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test eax, eax
lea rcx, str.FlushFileBuffers_failed
je 0x409d52
add r12d, 0x5ff
mov edx, 8
shr r12d, 9
mov ecx, r12d
call sub.msvcrt.dll_calloc
cmp dword [rbp - 0x1c], 4
mov r13, rax
jne 0x409a87
lea rcx, [0x0040a004]
lea rdx, [rbp + 0x20]
call fcn.00401b8e
test eax, eax
lea rcx, str.Could_not_fetch_NTFS_volume_info
jne 0x409d52
mov qword [rbp - 0x18], 0
mov r14, r13
xor edi, edi
lea r15, [rbp + 0x18]
jmp 0x409a71
lea r8, [rbp - 0x10]
lea rcx, [rbp + 0x20]
mov rdx, r15
call fcn.00401a5e
test eax, eax
je 0x409a26
lea rcx, str.Could_not_translate_LDLINUX.SYS_LCN_to_disk_LBA
jmp 0x409d52
mov rax, qword [rbp + 0x38]
mov edx, dword [rbp + 0x34]
sub qword [rbp - 0x10], rax
mov rax, qword [rbp + 0x10]
sub rax, qword [rbp + 8]
imul rax, rdx
xor edx, edx
jmp 0x409a56
mov rcx, qword [rbp - 0x10]
inc rdx
mov qword [r14], rcx
inc rcx
add r14, 8
mov qword [rbp - 0x10], rcx
cmp rdx, rax
lea ecx, [rdi + rdx]
jne 0x409a6a
mov rax, qword [rbp + 0x10]
mov edi, ecx
mov qword [rbp - 0x18], rax
jmp 0x409a71
cmp ecx, r12d
jl 0x409a41
jmp 0x409a5e
lea r8, [rbp + 8]
lea rdx, [rbp - 0x18]
mov rcx, rbx
call fcn.004019a0
test eax, eax
je 0x409a06
jmp 0x409ae4
lea rcx, [0x004014f0]
mov rdx, rsi
xor r15d, r15d
call fcn.00402970
lea r8, str.LDLINUX_SYS
mov r14, rax
xor r9d, r9d
xor edx, edx
mov rcx, rax
call fcn.00402af0
mov rcx, r14
mov edx, eax
call fcn.00402bd0
jmp 0x409acf
mov qword [r13 + r15*8], rax
mov rdx, rax
mov rcx, r14
inc r15
call fcn.00402c03
cmp r15d, r12d
mov edi, r15d
jge 0x409adc
test rax, rax
jne 0x409abc
mov rcx, r14
call fcn.00402ad5
mov qword [rsp + 0x28], 0
mov rax, qword [0x0040a488]
mov edx, edi
mov rcx, r13
mov qword [rsp + 0x20], rax
mov r9d, dword [0x0040a468]
mov r8d, dword [0x0040a46c]
call fcn.00402d80
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
jne 0x409949
mov edi, dword [0x00414c24]
mov qword [rsp + 0x20], 0
lea r9, [rbp - 0x20]
lea rdx, str._r_nSYSLINUX_4.06
mov rcx, rbx
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x409949
cmp dword [rbp - 0x20], edi
jne 0x409949
cmp dword [0x0040a4ac], 0
jne 0x409b73
cmp dword [0x0040a4b0], 0
je 0x409bc9
lea rdx, [rbp - 4]
mov rcx, rsi
call fcn.0040193e
test eax, eax
je 0x409bb3
mov r9d, dword [0x0040a4b0]
mov r8d, dword [0x0040a4ac]
mov edx, dword [rbp + 4]
mov ecx, dword [rbp]
call fcn.0040169a
test eax, eax
jne 0x409bc9
call qword [sym.imp.msvcrt.dll___iob_func]
lea rcx, str.Did_not_successfully_update_the_MBR__continuing..._n
lea rdx, [rax + 0x60]
jmp 0x409bc4
call qword [sym.imp.msvcrt.dll___iob_func]
lea rcx, str.Could_not_find_device_number_for_updating_MBR__continuing..._n
lea rdx, [rax + 0x60]
call sub.msvcrt.dll_fputs
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9, qword [0x0040a488]
test r9, r9
je 0x409cc8
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r9
repne scasb al, byte [rdi]
mov rbx, rsp
not rcx
lea rax, [rcx + 0x1e]
and rax, 0xfffffffffffffff0
call fcn.004048b0
sub rsp, rax
mov rax, qword [0x0040a490]
lea rdx, [rsp + 0x43]
lea rdi, [rsp + 0x40]
mov al, byte [rax]
mov r8, rdx
mov byte [rsp + 0x41], 0x3a
mov byte [rsp + 0x42], 0x5c
mov byte [rsp + 0x40], al
mov eax, 1
jmp 0x409c57
cmp r10b, 0x5c
je 0x409c3a
cmp r10b, 0x2f
jne 0x409c45
test eax, eax
jne 0x409c4f
mov r10b, 0x5c
mov al, 1
jmp 0x409c47
xor eax, eax
mov byte [r8], r10b
inc r8
jmp 0x409c54
mov eax, 1
inc r9
mov r10b, byte [r9]
test r10b, r10b
jne 0x409c2e
cmp r8, rdx
jbe 0x409cc5
test eax, eax
jne 0x409c6f
mov byte [r8], 0x5c
inc r8
movabs rax, 0x2e78756e696c646c
mov dword [r8 + 8], 0x737973
mov edx, pe_nt_image_headers64
mov qword [r8], rax
mov rcx, rdi
mov r12, qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
call r12
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rdx, rdi
lea rcx, str._:ldlinux.sys
call qword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
mov edx, 7
lea rcx, str._:ldlinux.sys
je 0x409cc2
mov rcx, rdi
call r12
mov rsp, rbx
mov edx, dword [rbp - 0x1c]
lea rcx, [0x00418030]
call fcn.00402610
mov rcx, qword [0x0040a4b8]
test rcx, rcx
je 0x409d67
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 2
mov r8d, 3
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
mov rbx, rax
lea rcx, str.Unable_to_create_bootsector_file
je 0x409d52
mov qword [rsp + 0x20], 0
lea r9, [rbp - 0x20]
mov r8d, 0x200
lea rdx, [0x00418030]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x409d5c
lea rcx, str.Could_not_write_boot_sector_file
call fcn.00401621
jmp 0x409725
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x409d9b
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov qword [rsp + 0x20], 0
lea r9, [rbp - 0x20]
mov r8d, 0x200
lea rdx, [0x00418030]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [rbp - 0x20], 0x200
je 0x409dba
call qword [sym.imp.msvcrt.dll___iob_func]
lea rcx, str.Could_not_write_the_whole_boot_sector_n
lea rdx, [rax + 0x60]
jmp 0x409720
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lea rsp, [rbp + 0x48]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret