Function at 0x411390
Capabilities:
Check os version
Create process on windows
Manipulate boot configuration
Query environment variable
Read .ini file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x474
mov eax, dword [0x4ea5e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0x434]
push eax
mov dword [ebp - 0x434], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x430], 6
jae 0x411527
push 0x96
lea ecx, [ebp - 0x9c]
push ecx
push str.SYSTEMDRIVE
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea eax, [ebp - 0x9c]
dec eax
xor ebx, ebx
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x4113f0
mov edx, dword [str._boot.ini]
mov ecx, dword [0x4d6b68]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [eax], edx
mov dx, word [0x4d6b6c]
mov dword [eax + 4], ecx
mov word [eax + 8], dx
lea eax, [ebp - 0x9c]
push eax
push 0x96
lea ecx, [ebp - 0x1a0]
push ecx
push 0x4ce44c
push str.default
push str.boot_loader
call esi
lea eax, [ebp - 0x1a0]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x411447
sub eax, edx
je 0x41191c
lea edx, [ebp - 0x9c]
push edx
push 0x200
lea eax, [ebp - 0x3a0]
push eax
push 0x4ce44c
lea ecx, [ebp - 0x1a0]
push ecx
push str.operating_systems
call esi
lea eax, [ebp - 0x3a0]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x411485
sub eax, edx
je 0x41191c
lea eax, [ebp - 0x3a0]
dec eax
jmp 0x4114a0
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x4114a0
mov edx, dword [str.__safeboot:network]
mov ecx, dword [0x4d6b9c]
mov dword [eax], edx
mov edx, dword [0x4d6ba0]
mov dword [eax + 4], ecx
mov ecx, dword [0x4d6ba4]
mov dword [eax + 8], edx
mov dx, word [0x4d6ba8]
mov dword [eax + 0xc], ecx
mov cl, byte [0x4d6baa]
mov word [eax + 0x10], dx
push 0x80
lea edx, [ebp - 0x9c]
push edx
mov byte [eax + 0x12], cl
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x9c]
push eax
lea ecx, [ebp - 0x3a0]
push ecx
lea edx, [ebp - 0x1a0]
push edx
push str.operating_systems
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a8a2f
mov esp, ebp
pop ebp
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.Wow64DisableWow64FsRedirection
push str.kernel32
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.Wow64RevertWow64FsRedirection
push str.kernel32
mov esi, eax
call edi
push eax
call ebx
xor ebx, ebx
mov edi, eax
cmp esi, ebx
je 0x4117de
cmp edi, ebx
je 0x4117de
lea eax, [ebp - 0x438]
push eax
call esi
push 0x96
lea ecx, [ebp - 0x1a0]
push ecx
push str.SystemRoot
cmp eax, 1
jne 0x4116d5
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
xor eax, eax
jmp 0x4115a0
mov cl, byte [ebp + eax - 0x1a0]
mov byte [ebp + eax - 0x2a4], cl
inc eax
cmp cl, bl
jne 0x4115a0
lea eax, [ebp - 0x2a4]
dec eax
lea ebx, [ebx]
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x4115c0
mov edx, dword [str._system32_]
mov ecx, dword [0x4d6bfc]
mov dword [eax], edx
mov dx, word [0x4d6c00]
mov dword [eax + 4], ecx
mov cl, byte [0x4d6c02]
mov word [eax + 8], dx
mov byte [eax + 0xa], cl
lea eax, [ebp - 0x2a4]
dec eax
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x4115f4
mov edx, dword [str.bcdedit.exe]
mov ecx, dword [0x4d6c08]
mov dword [eax], edx
mov edx, dword [0x4d6c0c]
mov dword [eax + 4], ecx
mov ecx, dword [0x4d6c14]
mov dword [eax + 8], edx
mov eax, dword [str._set_safeboot_network]
mov edx, dword [0x4d6c18]
mov dword [ebp - 0x108], eax
mov eax, dword [0x4d6c1c]
mov dword [ebp - 0x104], ecx
mov ecx, dword [0x4d6c20]
mov dword [ebp - 0x100], edx
mov dx, word [0x4d6c24]
mov dword [ebp - 0xfc], eax
mov dword [ebp - 0xf8], ecx
mov word [ebp - 0xf4], dx
mov dword [ebp - 0x474], 0x3c
mov dword [ebp - 0x470], ebx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0x46c], eax
lea edx, [ebp - 0x474]
lea eax, [ebp - 0x2a4]
lea ecx, [ebp - 0x108]
push edx
mov dword [ebp - 0x468], str.runas
mov dword [ebp - 0x464], eax
mov dword [ebp - 0x460], ecx
mov dword [ebp - 0x45c], ebx
mov dword [ebp - 0x458], ebx
mov dword [ebp - 0x454], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov eax, dword [ebp - 0x438]
push eax
call edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a8a2f
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
xor eax, eax
lea ecx, [ecx]
mov cl, byte [ebp + eax - 0x1a0]
mov byte [ebp + eax - 0x2a4], cl
inc eax
cmp cl, bl
jne 0x4116e0
lea eax, [ebp - 0x2a4]
dec eax
lea ebx, [ebx]
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x411700
mov edx, dword [str._system32_]
mov ecx, dword [0x4d6bfc]
mov dword [eax], edx
mov dx, word [0x4d6c00]
mov dword [eax + 4], ecx
mov cl, byte [0x4d6c02]
mov word [eax + 8], dx
mov byte [eax + 0xa], cl
lea eax, [ebp - 0x2a4]
dec eax
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x411734
mov edx, dword [str.bcdedit.exe]
mov ecx, dword [0x4d6c08]
mov dword [eax], edx
mov edx, dword [0x4d6c0c]
mov dword [eax + 4], ecx
mov ecx, dword [0x4d6c14]
mov dword [eax + 8], edx
mov eax, dword [str._set_safeboot_network]
mov edx, dword [0x4d6c18]
mov dword [ebp - 0x108], eax
mov eax, dword [0x4d6c1c]
mov dword [ebp - 0x104], ecx
mov ecx, dword [0x4d6c20]
mov dword [ebp - 0x100], edx
mov dx, word [0x4d6c24]
mov dword [ebp - 0xfc], eax
mov dword [ebp - 0xf8], ecx
mov word [ebp - 0xf4], dx
mov dword [ebp - 0x474], 0x3c
mov dword [ebp - 0x470], ebx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0x46c], eax
lea eax, [ebp - 0x2a4]
lea ecx, [ebp - 0x108]
lea edx, [ebp - 0x474]
mov dword [ebp - 0x464], eax
mov dword [ebp - 0x460], ecx
push edx
jmp 0x4118f9
push 0x96
lea eax, [ebp - 0x1a0]
push eax
push str.SystemRoot
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
xor eax, eax
jmp 0x411800
mov cl, byte [ebp + eax - 0x1a0]
mov byte [ebp + eax - 0x2a4], cl
inc eax
cmp cl, bl
jne 0x411800
lea eax, [ebp - 0x2a4]
dec eax
lea ebx, [ebx]
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x411820
mov ecx, dword [str._system32_]
mov edx, dword [0x4d6bfc]
mov dword [eax], ecx
mov cx, word [0x4d6c00]
mov dword [eax + 4], edx
mov dl, byte [0x4d6c02]
mov word [eax + 8], cx
mov byte [eax + 0xa], dl
lea eax, [ebp - 0x2a4]
dec eax
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x411854
mov ecx, dword [str.bcdedit.exe]
mov edx, dword [0x4d6c08]
mov dword [eax], ecx
mov ecx, dword [0x4d6c0c]
mov dword [eax + 4], edx
mov edx, dword [str._set_safeboot_network]
mov dword [eax + 8], ecx
mov eax, dword [0x4d6c14]
mov ecx, dword [0x4d6c18]
mov dword [ebp - 0x108], edx
mov edx, dword [0x4d6c1c]
mov dword [ebp - 0x104], eax
mov eax, dword [0x4d6c20]
mov dword [ebp - 0x100], ecx
mov cx, word [0x4d6c24]
mov dword [ebp - 0xfc], edx
mov dword [ebp - 0xf8], eax
mov word [ebp - 0xf4], cx
mov dword [ebp - 0x474], 0x3c
mov dword [ebp - 0x470], ebx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0x46c], eax
lea edx, [ebp - 0x2a4]
lea eax, [ebp - 0x108]
lea ecx, [ebp - 0x474]
mov dword [ebp - 0x464], edx
mov dword [ebp - 0x460], eax
push ecx
mov dword [ebp - 0x468], str.runas
mov dword [ebp - 0x45c], ebx
mov dword [ebp - 0x458], ebx
mov dword [ebp - 0x454], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004a8a2f
mov esp, ebp
pop ebp
ret