Function at 0x404510
Capabilities:
Check if file exists
Create process on windows
Delete file
Get file attributes
Manipulate boot configuration
Read .ini file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x463988
mov eax, dword fs:[0]
push eax
sub esp, 0xff8
mov eax, dword [0x482308]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xff8], ecx
mov edi, dword [ebp + 8]
mov ecx, edi
mov dword [ebp - 4], 0
mov dword [ebp - 0x1004], edi
mov dword [ebp - 0xfd0], edi
mov dword [ebp - 0xff4], 0
call fcn.0041441e
mov dword [ebp - 4], 0
lea ecx, [ebp - 0xb28]
mov dword [ebp - 0xff4], 1
call fcn.0041441e
lea ecx, [ebp - 0xe40]
mov dword [ebp - 4], 1
call fcn.0041441e
lea ecx, [ebp - 0xdbc]
mov byte [ebp - 4], 2
call fcn.0041441e
lea ecx, [ebp - 0xd38]
mov byte [ebp - 4], 3
call fcn.0041441e
lea ecx, [ebp - 0xcb4]
mov byte [ebp - 4], 4
call fcn.0041441e
lea ecx, [ebp - 0xc30]
mov byte [ebp - 4], 5
call fcn.0041441e
lea ecx, [ebp - 0x918]
mov byte [ebp - 4], 6
call fcn.0041441e
lea ecx, [ebp - 0xfcc]
mov byte [ebp - 4], 7
call fcn.0041441e
movzx esi, word [ebp + 0x10]
lea eax, [ebp - 0xd38]
push esi
push 0x47a2e0
push eax
mov byte [ebp - 4], 8
call fcn.00414a20
push esi
lea eax, [ebp - 0xc30]
push str._c:msdncc.wim
push eax
call fcn.00414a20
push esi
lea eax, [ebp - 0xdbc]
push str._c:_bcdedit.exe
push eax
call fcn.00414a20
push esi
lea eax, [ebp - 0x918]
push str._c:_boot.ini
push eax
call fcn.00414a20
add esp, 0x30
lea ecx, [ebp - 0x918]
call fcn.00411afa
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push eax
call esi
test eax, eax
je 0x404a77
movzx esi, word [ebp + 0x10]
lea eax, [ebp - 0xb28]
push esi
push str._c:waldr
push eax
call fcn.00414a20
push esi
lea eax, [ebp - 0xe40]
push str._c:_boot
push eax
call fcn.00414a20
push esi
lea eax, [ebp - 0xcb4]
push str._c:windows_system32_boot
push eax
call fcn.00414a20
lea eax, [ebp - 0xfcc]
push str.operating_systems
push eax
call fcn.00414a20
add esp, 0x2c
lea ecx, [ebp - 0x918]
call fcn.00411afa
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0x82
lea ecx, [ebp - 0x918]
mov dword [ebp - 0xfe0], eax
call fcn.00411afa
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov dword [ebp - 0xfdc], 0
mov dword [ebp - 0xfd8], 0
mov dword [ebp - 0xfd4], 0
push 0x800
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 9
push 0
push eax
call fcn.00447640
add esp, 0xc
lea ecx, [ebp - 0x918]
call fcn.00411afa
push eax
push 0x400
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0xfcc]
call fcn.00411afa
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
mov edi, eax
test edi, edi
je 0x404808
lea eax, [ebp - 0x810]
lea esi, [ebp - 0x80e]
nop word [eax + eax]
cmp word [esi - 2], 0
jne 0x4047fc
push 0xffffffffffffffff
push eax
lea ecx, [ebp - 0xbac]
call fcn.004143fa
push 0
push 0x47a9dc
lea ecx, [ebp - 0xbac]
mov byte [ebp - 4], 0xa
call fcn.004148d9
push eax
lea eax, [ebp - 0xec4]
push eax
lea ecx, [ebp - 0xbac]
call fcn.00414caf
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0xec4]
mov eax, dword [ebp - 0xfd8]
push ecx
cmp eax, dword [ebp - 0xfd4]
je 0x4047ce
mov ecx, eax
call fcn.004143d5
add dword [ebp - 0xfd8], 0x84
jmp 0x4047da
push eax
lea ecx, [ebp - 0xfdc]
call fcn.00406df0
lea ecx, [ebp - 0xec4]
mov dword [ebp - 0xffc], esi
call fcn.00414510
lea ecx, [ebp - 0xbac]
mov byte [ebp - 4], 9
call fcn.00414510
mov eax, esi
add esi, 2
sub edi, 1
jne 0x404760
mov esi, dword [ebp - 0xfd8]
lea ecx, [ebp - 0xfdc]
mov edi, dword [ebp - 0xfdc]
mov eax, dword [ebp - 0xfd4]
mov dword [ebp - 0xff4], 3
mov dword [ebp - 0xfe8], esi
mov dword [ebp - 0xfec], edi
mov dword [ebp - 0xfe4], eax
mov dword [ebp - 0xfd4], 0
mov dword [ebp - 0xfd8], 0
mov dword [ebp - 0xfdc], 0
call fcn.00406830
mov byte [ebp - 4], 0xc
cmp edi, esi
jne 0x404947
lea ecx, [ebp - 0x894]
call fcn.0041441e
lea eax, [ebp - 0xffc]
mov byte [ebp - 4], 0xd
push eax
lea eax, [ebp - 0x1000]
push eax
push dword [ebp + 0xc]
call fcn.00404f20
push dword [ebp - 0xffc]
lea eax, [ebp - 0x894]
push str.multi_0_disk_0_rdisk_0_partition__d_Windows
push eax
call fcn.00414a20
add esp, 0xc
lea ecx, [ebp - 0x918]
call fcn.00411afa
push eax
lea ecx, [ebp - 0x894]
call fcn.00411afa
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push eax
push str.default
push str.boot_loader
call esi
test eax, eax
jne 0x404911
mov edi, dword [ebp - 0xfd0]
push 0x47a414
push edi
call fcn.00414a20
add esp, 8
lea ecx, [ebp - 0x894]
call fcn.00414510
lea ecx, [ebp - 0xfec]
mov byte [ebp - 4], 8
call fcn.00406830
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
jmp 0x404da9
lea ecx, [ebp - 0x918]
call fcn.00411afa
push eax
push str.__Microsoft_Windows_XP___noexecute__optin__fastdetect
lea ecx, [ebp - 0x894]
call fcn.00411afa
push eax
push str.operating_systems
call esi
test eax, eax
jne 0x404a35
push 0x47a4a0
jmp 0x404a01
sub esi, edi
mov eax, 0x3e0f83e1
imul esi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x404f12
push edi
lea ecx, [ebp - 0x894]
call fcn.004143d5
lea ecx, [ebp - 0x918]
mov byte [ebp - 4], 0xe
call fcn.00411afa
push eax
push 0
lea ecx, [ebp - 0xb28]
call fcn.00411afa
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push eax
push str.operating_systems
call esi
test eax, eax
jne 0x4049d4
mov edi, dword [ebp - 0xfd0]
push 0x47a4b4
push edi
call fcn.00414a20
add esp, 8
lea ecx, [ebp - 0x894]
call fcn.00414510
lea ecx, [ebp - 0xfec]
mov byte [ebp - 4], 8
call fcn.00406830
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
jmp 0x404da9
lea ecx, [ebp - 0x918]
call fcn.00411afa
push eax
lea ecx, [ebp - 0x894]
call fcn.00411afa
push eax
push str.default
push str.boot_loader
call esi
test eax, eax
jne 0x404a35
push 0x47a4c4
mov edi, dword [ebp - 0xfd0]
push edi
call fcn.00414a20
add esp, 8
lea ecx, [ebp - 0x894]
call fcn.00414510
lea ecx, [ebp - 0xfec]
mov byte [ebp - 4], 8
call fcn.00406830
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
jmp 0x404da9
lea ecx, [ebp - 0x894]
mov byte [ebp - 4], 0xc
call fcn.00414510
push dword [ebp - 0xfe0]
lea ecx, [ebp - 0x918]
call fcn.00411afa
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [ebp - 0xfec]
mov byte [ebp - 4], 8
call fcn.00406830
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edi, dword [ebp - 0xfd0]
lea ecx, [ebp - 0xa20]
call fcn.0041441e
lea ecx, [ebp - 0xaa4]
mov byte [ebp - 4], 0xf
call fcn.0041441e
lea ecx, [ebp - 0x99c]
mov byte [ebp - 4], 0x10
call fcn.0041441e
lea ecx, [ebp - 0xf48]
mov byte [ebp - 4], 0x11
call fcn.0041441e
movzx eax, word [ebp + 0x10]
push eax
lea eax, [ebp - 0x99c]
mov byte [ebp - 4], 0x12
push str._c:_bootBCD
push eax
call fcn.00414a20
add esp, 0xc
lea ecx, [ebp - 0x99c]
call fcn.00411afa
push eax
call esi
test eax, eax
jne 0x404af7
movzx eax, word [ebp + 0x10]
push eax
lea eax, [ebp - 0x99c]
push str._c:EFIMicrosoftBootBCD
push eax
call fcn.00414a20
add esp, 0xc
lea ecx, [ebp - 0x99c]
call fcn.00411afa
push eax
call esi
test eax, eax
je 0x404d73
mov ecx, dword [ebp - 0xff8]
lea eax, [ebp - 0xbac]
push 1
push str.bcdedit.exe
push eax
call fcn.00405f00
push eax
lea ecx, [ebp - 0xaa4]
mov byte [ebp - 4], 0x13
call fcn.00414593
lea ecx, [ebp - 0xbac]
mov byte [ebp - 4], 0x12
call fcn.00414510
lea ecx, [ebp - 0x99c]
call fcn.00411afa
push eax
lea ecx, [ebp - 0xaa4]
call fcn.00411afa
push eax
lea eax, [ebp - 0xa20]
push str._s__store__s__delete_614F7461_279D_4927_B5AC_61A8F3E49EEF
push eax
call fcn.00414a20
add esp, 0x10
lea ecx, [ebp - 0xa20]
call fcn.00411afa
xor ecx, ecx
mov dword [ebp - 0x854], 0x44
mov word [ebp - 0x812], cx
xorps xmm0, xmm0
mov word [ebp - 0x824], cx
lea ecx, [ebp - 0xff0]
push ecx
lea ecx, [ebp - 0x854]
movlpd qword [ebp - 0x850], xmm0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0
movups xmmword [ebp - 0xff0], xmm0
mov dword [ebp - 0x828], 1
movlpd qword [ebp - 0x848], xmm0
movlpd qword [ebp - 0x840], xmm0
movlpd qword [ebp - 0x838], xmm0
movlpd qword [ebp - 0x830], xmm0
movlpd qword [ebp - 0x822], xmm0
movlpd qword [ebp - 0x81a], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x404d59
push 0xffffffffffffffff
push dword [ebp - 0xff0]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0xfe0]
push eax
push dword [ebp - 0xff0]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0xfec]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xff0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0xfe0], 0
jne 0x404d59
lea ecx, [ebp - 0x99c]
call fcn.00411afa
push eax
lea ecx, [ebp - 0xaa4]
call fcn.00411afa
push eax
lea eax, [ebp - 0xa20]
push str._s__store__s__delete_6E1D30FC_4BE2_4359_8B24_FAA408C2FB36
push eax
call fcn.00414a20
add esp, 0x10
lea ecx, [ebp - 0xa20]
call fcn.00411afa
xor ecx, ecx
mov dword [ebp - 0x854], 0x44
mov word [ebp - 0x812], cx
xorps xmm0, xmm0
mov word [ebp - 0x824], cx
lea ecx, [ebp - 0xff0]
push ecx
lea ecx, [ebp - 0x854]
movlpd qword [ebp - 0x850], xmm0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0
movups xmmword [ebp - 0xff0], xmm0
mov dword [ebp - 0x828], 1
movlpd qword [ebp - 0x848], xmm0
movlpd qword [ebp - 0x840], xmm0
movlpd qword [ebp - 0x838], xmm0
movlpd qword [ebp - 0x830], xmm0
movlpd qword [ebp - 0x822], xmm0
movlpd qword [ebp - 0x81a], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x404d59
push 0xffffffffffffffff
push dword [ebp - 0xff0]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0xfe0]
push eax
push dword [ebp - 0xff0]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0xfec]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xff0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0xfe0], 0
je 0x404d73
lea ecx, [ebp - 0xa20]
call fcn.00411afa
push eax
push 0x47a5c0
push edi
call fcn.00414a20
add esp, 0xc
lea ecx, [ebp - 0xf48]
call fcn.00414510
lea ecx, [ebp - 0x99c]
call fcn.00414510
lea ecx, [ebp - 0xaa4]
call fcn.00414510
lea ecx, [ebp - 0xa20]
mov byte [ebp - 4], 8
call fcn.00414510
mov edi, dword [ebp - 0xfd0]
lea ecx, [ebp - 0xb28]
call fcn.00411afa
push eax
call esi
test eax, eax
je 0x404dcd
lea ecx, [ebp - 0xb28]
call fcn.00411afa
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0xd38]
call fcn.00411afa
push eax
call esi
test eax, eax
je 0x404df1
lea ecx, [ebp - 0xd38]
call fcn.00411afa
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0xc30]
call fcn.00411afa
push eax
call esi
test eax, eax
je 0x404e15
lea ecx, [ebp - 0xc30]
call fcn.00411afa
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0xdbc]
call fcn.00411afa
push eax
call esi
test eax, eax
je 0x404e39
lea ecx, [ebp - 0xdbc]
call fcn.00411afa
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0xe40]
call fcn.00411afa
push eax
call esi
test eax, eax
je 0x404e6a
sub esp, 0x84
lea eax, [ebp - 0xe40]
mov ecx, esp
push eax
call fcn.004143d5
mov ecx, dword [ebp - 0xff8]
call fcn.004064b0
lea ecx, [ebp - 0xcb4]
call fcn.00411afa
push eax
call esi
test eax, eax
je 0x404e9b
sub esp, 0x84
lea eax, [ebp - 0xcb4]
mov ecx, esp
push eax
call fcn.004143d5
mov ecx, dword [ebp - 0xff8]
call fcn.004064b0
lea ecx, [ebp - 0xfcc]
call fcn.00414510
lea ecx, [ebp - 0x918]
call fcn.00414510
lea ecx, [ebp - 0xc30]
call fcn.00414510
lea ecx, [ebp - 0xcb4]
call fcn.00414510
lea ecx, [ebp - 0xd38]
call fcn.00414510
lea ecx, [ebp - 0xdbc]
call fcn.00414510
lea ecx, [ebp - 0xe40]
call fcn.00414510
lea ecx, [ebp - 0xb28]
call fcn.00414510
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00445e0f
mov esp, ebp
pop ebp
ret 0xc
call fcn.00406820
int3