Function at 0x100da61
Capabilities:
Manipulate boot configuration

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xd70
mov eax, dword [0x1036a44]
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
or dword [ebp - 0xd44], 0xffffffff
push ebx
push esi
xor esi, esi
cmp edx, esi
mov dword [ebp - 4], eax
mov eax, 0x800
push edi
mov dword [ebp - 0xd5c], edx
mov dword [ebp - 0xd60], ecx
mov dword [ebp - 0xd50], esi
mov byte [ebp - 0xd3d], 0
mov ebx, eax
mov dword [ebp - 0xd3c], esi
mov dword [ebp - 0xd48], esi
mov dword [ebp - 0xd58], esi
je 0x100e165
cmp ecx, esi
je 0x100e165
push eax
call int.0102ec4e
mov edi, eax
cmp edi, esi
pop ecx
mov dword [ebp - 0xd4c], edi
jne 0x100dae5
mov eax, 0x8007000e
jmp 0x100e16a
push esi
xor eax, eax
push esi
mov ecx, 0x200
rep stosd dword es:[edi], eax
push 0x208
lea eax, [ebp - 0x928]
push eax
call sub.dmutil.dll_GetSystemVolume
test eax, eax
jne 0x100e152
lea eax, [ebp - 0x928]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
test eax, eax
pop ecx
je 0x100e152
xor eax, eax
mov ecx, 0x82
lea edi, [ebp - 0x20c]
rep stosd dword es:[edi], eax
push 0x1001744
lea eax, [ebp - 0x928]
push eax
lea eax, [ebp - 0x20c]
push 0x1001738
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0x10
lea eax, [ebp - 0xd44]
push eax
push 0x180
lea eax, [ebp - 0x20c]
push eax
call fcn.0101ee58
cmp eax, esi
jl 0x100e0e6
cmp dword [ebp - 0xd44], esi
je 0x100e0e6
cmp dword [ebp - 0xd44], 0xffffffff
je 0x100e0e6
push dword [ebp - 0xd44]
call sub.dmutil.dll_LowNtReadOnlyAttributeOff
cmp eax, esi
jl 0x100e0e6
push dword [ebp - 0xd44]
call fcn.0101f4b2
or dword [ebp - 0xd44], 0xffffffff
lea eax, [ebp - 0xd44]
push eax
push 0xc0000000
lea eax, [ebp - 0x20c]
push eax
call fcn.0101ee58
cmp eax, esi
jl 0x100e0e6
cmp dword [ebp - 0xd44], esi
je 0x100e0e6
cmp dword [ebp - 0xd44], 0xffffffff
je 0x100e0e6
mov edi, dword [ebp - 0xd4c]
lea eax, [ebp - 0xd3c]
push eax
push ebx
push edi
push esi
push esi
push dword [ebp - 0xd44]
call sub.dmutil.dll_LowNtReadFile
cmp eax, 0xc0000011
je 0x100dc11
cmp eax, esi
jne 0x100e0e6
cmp eax, esi
mov eax, dword [ebp - 0xd3c]
jne 0x100dc1f
cmp eax, ebx
je 0x100dc26
lea ecx, [ebx - 2]
cmp eax, ecx
jbe 0x100dc5a
push edi
call fcn.0102ec42
add ebx, ebx
push ebx
call int.0102ec4e
mov edi, eax
cmp edi, esi
pop ecx
pop ecx
mov dword [ebp - 0xd4c], edi
je 0x100e146
mov ecx, ebx
mov edx, ecx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
jmp 0x100dbe6
mov dword [ebp - 0xd70], eax
lea eax, [edi + eax - 1]
mov dword [ebp - 0xd64], eax
mov eax, dword [ebp - 0xd5c]
mov eax, dword [eax + 0x94]
mov esi, dword [eax + 4]
jmp 0x100df57
mov eax, dword [ebp - 0xd5c]
mov eax, dword [eax + 0x94]
mov eax, dword [eax]
mov eax, dword [eax + esi*4]
test eax, eax
mov dword [ebp - 0xd6c], eax
je 0x100df57
cmp byte [ebp - 0xd3d], 0
je 0x100dcb1
cmp dword [eax + 0x30], 3
je 0x100dcbb
jmp 0x100df57
cmp dword [eax + 0x30], 4
jne 0x100df57
push eax
push dword [ebp - 0xd5c]
lea eax, [ebp - 0xd58]
push eax
call fcn.0100d9d7
xor eax, eax
mov ebx, 0x82
mov ecx, ebx
lea edi, [ebp - 0xd38]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xd38]
push eax
push dword [ebp - 0xd5c]
lea eax, [ebp - 0xd58]
push 0
push eax
call fcn.010293f7
test eax, eax
jne 0x100ddb5
lea eax, [ebp - 0xd38]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
test eax, eax
pop ecx
je 0x100ddb5
xor eax, eax
mov ecx, ebx
lea edi, [ebp - 0x720]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xd38]
push eax
lea eax, [ebp - 0x720]
push 0x1001734
push eax
call dword [sym.imp.msvcrt.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0x720]
test eax, eax
je 0x100df57
mov cl, byte [eax]
inc eax
cmp cl, 0x29
jne 0x100dd46
test eax, eax
je 0x100df57
mov cl, byte [eax]
inc eax
cmp cl, 0x29
jne 0x100dd56
test eax, eax
je 0x100df57
push eax
push dword [ebp - 0xd4c]
call dword [sym.imp.msvcrt.dll_strstr]
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
je 0x100df57
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100dd8a
sub eax, edx
mov dword [ebp - 0xd68], eax
je 0x100df57
jmp 0x100dda2
inc ebx
cmp byte [ebx], 0x29
jne 0x100dda1
jmp 0x100ddaa
inc ebx
cmp byte [ebx], 0x28
jne 0x100dda9
inc ebx
jmp 0x100dead
mov eax, dword [ebp - 0xd5c]
push dword [eax + 0xa8]
lea eax, [ebp - 0x310]
push 0x1001720
push eax
call dword [sym.imp.msvcrt.dll_sprintf]
mov ebx, dword [ebp - 0xd4c]
add esp, 0xc
test ebx, ebx
je 0x100df57
lea eax, [ebp - 0x310]
push eax
push ebx
call dword [sym.imp.msvcrt.dll_strstr]
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
je 0x100df57
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100de01
sub eax, edx
mov dword [ebp - 0xd68], eax
je 0x100de8b
mov eax, dword [ebp - 0xd64]
cmp ebx, eax
je 0x100dddc
mov cl, byte [ebx]
inc ebx
cmp cl, 0x29
jne 0x100de18
cmp ebx, eax
je 0x100dddc
mov cl, byte [ebx]
inc ebx
cmp cl, 0x29
jne 0x100de24
cmp ebx, eax
je 0x100dddc
mov cl, byte [ebx]
inc ebx
cmp cl, 0x29
jne 0x100de30
cmp ebx, eax
je 0x100dddc
mov cl, byte [ebx]
inc ebx
cmp cl, 0x28
jne 0x100de3c
cmp ebx, eax
je 0x100dddc
push dword [ebp - 0xd58]
lea eax, [ebp - 0x518]
push 0x100171c
push eax
call dword [sym.imp.msvcrt.dll_sprintf]
mov cl, byte [ebx]
add esp, 0xc
cmp cl, 0x29
lea eax, [ebp - 0x518]
je 0x100de8b
mov edx, ebx
mov edi, eax
sub edx, edi
cmp cl, byte [eax]
jne 0x100dddc
inc eax
mov cl, byte [edx + eax]
cmp cl, 0x29
jne 0x100de7a
test ebx, ebx
je 0x100df57
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100de98
sub eax, edx
mov dword [ebp - 0xd68], eax
je 0x100df57
mov edx, dword [ebp - 0xd60]
mov eax, dword [edx + 0x94]
inc dword [ebp - 0xd54]
xor edi, edi
xor esi, esi
cmp dword [eax + 4], edi
jle 0x100df05
mov eax, dword [eax]
mov ecx, dword [eax + edi*4]
test ecx, ecx
je 0x100def9
cmp dword [ecx + 0x30], 3
jne 0x100def9
push dword [ebp - 0xd6c]
inc esi
call fcn.01006149
test al, al
je 0x100def3
cmp esi, dword [ebp - 0xd58]
jne 0x100df7d
mov edx, dword [ebp - 0xd60]
mov eax, dword [edx + 0x94]
inc edi
cmp edi, dword [eax + 4]
jl 0x100dec8
mov eax, dword [edx + 0x94]
xor edi, edi
cmp dword [eax + 4], edi
jle 0x100df4b
mov eax, dword [eax]
mov ecx, dword [eax + edi*4]
test ecx, ecx
je 0x100df39
cmp dword [ecx + 0x30], 4
jne 0x100df39
push dword [ebp - 0xd6c]
inc esi
call fcn.01006149
test al, al
je 0x100df39
cmp esi, dword [ebp - 0xd58]
jne 0x100df7d
mov eax, dword [ebp - 0xd60]
mov eax, dword [eax + 0x94]
inc edi
cmp edi, dword [eax + 4]
jl 0x100df12
dec dword [ebp - 0xd54]
mov esi, dword [ebp - 0xd54]
dec esi
mov dword [ebp - 0xd54], esi
jns 0x100dc7e
cmp byte [ebp - 0xd3d], 0
jne 0x100e0f1
mov byte [ebp - 0xd3d], 1
jmp 0x100dc6a
cmp dword [ebp - 0xd48], 0
je 0x100df92
push dword [ebp - 0xd48]
call fcn.0102ec42
pop ecx
push dword [ebp - 0xd3c]
call int.0102ec4e
test eax, eax
pop ecx
mov dword [ebp - 0xd48], eax
je 0x100e146
mov ecx, dword [ebp - 0xd3c]
mov edi, dword [ebp - 0xd48]
mov edx, ecx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
and dword [ebp - 0xd3c], 0
cmp dword [ebp - 0xd64], ebx
mov edi, dword [ebp - 0xd48]
mov eax, ebx
je 0x100dff3
mov cl, byte [eax]
mov byte [edi], cl
inc edi
inc eax
inc dword [ebp - 0xd3c]
cmp eax, dword [ebp - 0xd64]
jne 0x100dfdf
mov al, byte [eax]
mov byte [edi], al
inc dword [ebp - 0xd3c]
mov ecx, dword [ebp - 0xd3c]
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
cmp esi, 0x63
rep stosb byte es:[edi], al
mov ecx, esi
jle 0x100e04a
xor edx, edx
push 0x64
pop ecx
mov eax, esi
div ecx
mov ecx, esi
xor edx, edx
push 0xa
pop edi
add al, 0x30
mov byte [ebx], al
inc ebx
movsx eax, byte [ebx]
imul eax, eax, 0x64
sub ecx, eax
mov eax, ecx
div edi
add al, 0x30
mov byte [ebx], al
inc ebx
movsx eax, byte [ebx]
imul eax, eax, 0xfffffff6
add ecx, eax
cmp esi, 9
jle 0x100e065
xor edx, edx
push 0xa
mov eax, ecx
pop esi
div esi
add al, 0x30
mov byte [ebx], al
inc ebx
movsx eax, byte [ebx]
imul eax, eax, 0xfffffff6
add ecx, eax
mov eax, dword [ebp - 0xd48]
add cl, 0x30
mov byte [ebx], cl
inc ebx
cmp dword [ebp - 0xd58], 0x63
jle 0x100e086
add eax, 3
sub dword [ebp - 0xd3c], 3
jmp 0x100e0a2
cmp dword [ebp - 0xd58], 9
jle 0x100e09b
add eax, 2
sub dword [ebp - 0xd3c], 2
jmp 0x100e0a2
inc eax
dec dword [ebp - 0xd3c]
cmp dword [ebp - 0xd3c], 0
je 0x100e0c3
mov ecx, dword [ebp - 0xd3c]
mov esi, eax
mov eax, ecx
shr ecx, 2
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push dword [ebp - 0xd70]
push dword [ebp - 0xd4c]
push 0
push 0
push dword [ebp - 0xd44]
call sub.dmutil.dll_LowNtWriteFile
test eax, eax
jge 0x100df51
or eax, 0x10000000
mov dword [ebp - 0xd50], eax
xor esi, esi
cmp dword [ebp - 0xd44], esi
je 0x100e116
cmp dword [ebp - 0xd44], 0xffffffff
je 0x100e116
push dword [ebp - 0xd44]
call fcn.0101f4b2
or dword [ebp - 0xd44], 0xffffffff
cmp dword [ebp - 0xd4c], esi
je 0x100e12a
push dword [ebp - 0xd4c]
call fcn.0102ec42
pop ecx
cmp dword [ebp - 0xd48], esi
je 0x100e13e
push dword [ebp - 0xd48]
call fcn.0102ec42
pop ecx
mov eax, dword [ebp - 0xd50]
jmp 0x100e16a
mov dword [ebp - 0xd50], 0x8007000e
jmp 0x100e0f1
push dword [ebp - 0xd4c]
call fcn.0102ec42
pop ecx
mov eax, 0x80004005
jmp 0x100e16a
mov eax, 0x80070057
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0102e95a
leave
ret 8