Function at 0x4bfe6f
Capabilities:
Manipulate boot configuration

Disassembly:
push ebp
sub esp, 0x88
lea ebp, [esp - 4]
mov eax, dword [0x67d978]
xor eax, ebp
mov dword [ebp + 0x88], eax
push 0x40
mov eax, 0x58162c
call fcn.0053d7cf
mov ebx, dword [ebp + 0x94]
mov dword [ebp - 0x44], ebx
mov ecx, dword [ebx + 4]
xor edi, edi
mov esi, 0x6cec7c
cmp ecx, edi
je 0x4bff5e
mov eax, dword [ecx]
push esi
call dword [eax + 0x24]
mov dword [ebp - 0x14], eax
cmp eax, edi
je 0x4bfec5
push str.CRemoteReboot::UndoChanges_OnServiceStop
call fcn.00438337
cmp dword [ebp - 0x14], 2
je 0x4bfedb
cmp dword [ebp - 0x14], 4
je 0x4bfedb
cmp dword [ebp - 0x14], 5
jne 0x4bff5e
mov dword [ebp + 0x68], 7
push edi
lea ecx, [ebp + 0x50]
call fcn.00412c1b
mov dword [ebp - 4], edi
lea eax, [ebp + 0x50]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.0045da46
pop ecx
pop ecx
mov dword [ebp - 0x40], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebx + 4]
mov eax, dword [ecx]
push edi
lea edx, [ebp - 0x40]
push edx
push 0x6cec28
call dword [eax + 8]
mov byte [ebp - 4], 0
lea edx, [ebp - 0x40]
call fcn.00407770
or dword [ebp - 4], 0xffffffff
push edi
xor edi, edi
inc edi
push edi
lea ecx, [ebp + 0x50]
call fcn.0041382c
and dword [ebp + 0x30], 0
mov dword [ebp + 0x28], edi
mov dword [ebp - 4], 2
mov ecx, dword [ebx + 4]
mov eax, dword [ecx]
push 0
lea edx, [ebp + 0x28]
push edx
push esi
call dword [eax + 8]
or dword [ebp - 4], 0xffffffff
lea edx, [ebp + 0x28]
call fcn.00407770
jmp 0x4bff61
xor edi, edi
inc edi
mov ecx, dword [ebx + 4]
mov eax, dword [ecx]
push esi
call dword [eax + 0x24]
cmp eax, edi
jne 0x4bff9a
mov dword [ebp - 0x38], 4
mov dword [ebp - 0x40], edi
mov dword [ebp - 4], 3
mov ecx, dword [ebx + 4]
mov eax, dword [ecx]
push 0
lea edx, [ebp - 0x40]
push edx
push esi
call dword [eax + 8]
or dword [ebp - 4], 0xffffffff
lea edx, [ebp - 0x40]
call fcn.00407770
mov ecx, dword [ebx + 4]
mov eax, dword [ecx]
push 0x6cec60
call dword [eax + 0x24]
or dword [ebx], eax
je 0x4bffb5
push str.CRemoteReboot::UndoChanges_OnServiceStart
call fcn.00438337
test byte [ebx], 0x10
je 0x4c0042
xor esi, esi
mov dword [ebp - 0x14], esi
lea eax, [ebp - 0x14]
push eax
call fcn.004c0579
push str.CRemoteReboot::UndoChanges___BCDEditWasCalled
call fcn.00438337
push esi
push esi
push str._deletevalue_safeboot
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x4c], esp
push str.bcdedit
call fcn.00415a69
mov dword [ebp - 4], 4
or dword [ebp - 4], 0xffffffff
lea esi, [ebp - 0x34]
call fcn.0045f0bc
add esp, 0x1c
mov dword [ebp - 4], 5
cmp dword [eax + 0x18], 8
jb 0x4c0017
mov eax, dword [eax + 4]
jmp 0x4c001a
add eax, 4
push eax
push 0x625fb0
push 0
call dword [0x6894fc]
or dword [ebp - 4], 0xffffffff
push 0
push edi
lea ecx, [ebp - 0x34]
call fcn.0041382c
and dword [ebx], 0xffffffef
push dword [ebp - 0x14]
call fcn.004c0625
test byte [ebx], 4
je 0x4c0229
push str.CRemoteReboot::UndoChanges___BootIniWasModified
call fcn.00438337
lea eax, [ebp - 0x34]
push eax
call fcn.004bf16f
mov dword [ebp - 4], 6
push eax
lea eax, [ebp + 0x50]
push eax
call fcn.0045d462
mov byte [ebp - 4], 8
push 0
push edi
lea ecx, [ebp - 0x34]
call fcn.0041382c
push str.default
lea ecx, [ebp - 0x34]
call fcn.00415a69
mov byte [ebp - 4], 9
push str.boot_loader
lea ecx, [ebp + 0x34]
call fcn.00415a69
mov byte [ebp - 4], 0xa
mov dword [ebp + 0x84], 7
push 0
lea ecx, [ebp + 0x6c]
call fcn.00412c1b
mov byte [ebp - 4], 0xb
lea eax, [ebp + 0x6c]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp + 0x34]
push eax
lea eax, [ebp]
push eax
lea edi, [ebp + 0x50]
call fcn.0047579d
mov byte [ebp - 4], 0xd
xor edi, edi
push edi
push 1
lea ecx, [ebp + 0x6c]
call fcn.0041382c
mov byte [ebp - 4], 0xe
push edi
push 1
lea ecx, [ebp + 0x34]
call fcn.0041382c
mov byte [ebp - 4], 0xf
push edi
push 1
lea ecx, [ebp - 0x34]
call fcn.0041382c
cmp dword [ebp + 0x14], edi
je 0x4c0200
mov esi, str.operating_systems
push esi
lea ecx, [ebp - 0x34]
call fcn.00415a69
mov byte [ebp - 4], 0x10
mov dword [ebp + 0x4c], 7
push edi
lea ecx, [ebp + 0x34]
call fcn.00412c1b
mov byte [ebp - 4], 0x11
lea eax, [ebp + 0x34]
push eax
lea eax, [ebp]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp + 0x6c]
push eax
lea edi, [ebp + 0x50]
call fcn.0047579d
mov byte [ebp - 4], 0x13
xor edi, edi
push edi
push 1
lea ecx, [ebp + 0x34]
call fcn.0041382c
mov byte [ebp - 4], 0x14
push edi
push 1
lea ecx, [ebp - 0x34]
call fcn.0041382c
cmp dword [ebp + 0x80], edi
je 0x4c01e7
lea ecx, [ebp - 0x14]
call fcn.00415850
mov byte [ebp - 4], 0x15
push eax
lea eax, [ebp + 0x6c]
push eax
call fcn.004c07bf
pop ecx
pop ecx
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x14]
call fcn.00415838
push str.__NoExecuteOptIn
lea ecx, [ebp + 0x6c]
call fcn.00412eb0
push esi
lea ecx, [ebp - 0x34]
call fcn.00415a69
mov byte [ebp - 4], 0x16
lea eax, [ebp + 0x50]
push eax
lea ecx, [ebp + 0x6c]
lea edx, [ebp]
lea edi, [ebp - 0x34]
call fcn.004758f0
mov byte [ebp - 0x15], al
mov byte [ebp - 4], 0x14
push 0
push 1
mov ecx, edi
call fcn.0041382c
cmp byte [ebp - 0x15], 0
je 0x4c01db
and dword [ebx], 0xfffffffb
jmp 0x4c01ec
push str.CRemoteReboot::UndoChanges___write_boot.ini_failed_
call fcn.0042e877
jmp 0x4c01ec
call fcn.004c0817
mov byte [ebp - 4], 0xf
push 0
push 1
lea ecx, [ebp + 0x6c]
call fcn.0041382c
xor edi, edi
jmp 0x4c020a
push str.CRemoteReboot::UndoChanges___boot.ini_boot_loader_not_found_
call fcn.0042e877
mov byte [ebp - 4], 8
push edi
push 1
lea ecx, [ebp]
call fcn.0041382c
or dword [ebp - 4], 0xffffffff
lea eax, [ebp + 0x50]
push eax
call fcn.0046b553
xor edi, edi
inc edi
test byte [ebx], 8
je 0x4c02b2
push str.CRemoteReboot::UndoChanges___BootIniReadOnlyRemoved
call fcn.00438337
lea eax, [ebp + 0x6c]
push eax
call fcn.004bf16f
mov dword [ebp - 4], 0x17
cmp dword [ebp + 0x84], 8
mov eax, dword [ebp + 0x70]
jae 0x4c025b
lea eax, [ebp + 0x70]
push eax
call dword [0x689474]
cmp eax, 0xffffffff
je 0x4c0299
test al, 1
jne 0x4c02a3
cmp dword [ebp + 0x84], 8
mov ecx, dword [ebp + 0x70]
jae 0x4c027a
lea ecx, [ebp + 0x70]
or eax, edi
push eax
push ecx
call dword [0x6894d0]
test eax, eax
je 0x4c028d
and dword [ebx], 0xfffffff7
jmp 0x4c02a3
push str.CRemoteReboot::UndoChanges___SetFileAttributes_failed_
call fcn.0042e877
jmp 0x4c02a3
push str.CRemoteReboot::UndoChanges___GetFileAttributes___failed_
call fcn.0042e877
or dword [ebp - 4], 0xffffffff
push 0
push edi
lea ecx, [ebp + 0x6c]
call fcn.0041382c
test byte [ebx], 2
je 0x4c0365
push str.CRemoteReboot::UndoChanges___RegistryKeyWasCreated
call fcn.00438337
mov dword [ebp - 4], 0x18
push str.SystemCurrentControlSetControlSafeBootNetwork
lea ecx, [ebp - 0x34]
call fcn.00415a69
mov byte [ebp - 4], 0x19
xor esi, esi
push esi
push esi
lea eax, [ebp - 0x34]
push eax
push reloc.WS2_32.dll_bind
lea eax, [ebp + 0x1c]
push eax
call fcn.0047e3a1
mov byte [ebp - 4], 0x1b
push esi
push edi
lea ecx, [ebp - 0x34]
call fcn.0041382c
mov ecx, 0x6ce42c
lea edx, [ebp + 0x1c]
call fcn.0047f8fe
and dword [ebx], 0xfffffffd
mov byte [ebp - 4], 0x18
lea ecx, [ebp + 0x1c]
call fcn.0045f4f0
or dword [ebp - 4], 0xffffffff
jmp 0x4c0365
test byte [ebx], 1
je 0x4c039e
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 4], 0x1e
mov ecx, dword [ebx + 4]
mov eax, dword [ecx]
push 0
lea edx, [ebp - 0x40]
push edx
push 0x6ce3a0
call dword [eax + 8]
or dword [ebp - 4], 0xffffffff
lea edx, [ebp - 0x40]
call fcn.00407770
and dword [ebx], 0xfffffffe
call fcn.004c0862
mov eax, dword [ebx]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x40], edi
mov dword [ebp - 4], 0x1f
mov ebx, dword [ebx + 4]
mov eax, dword [ebx]
push 0
lea ecx, [ebp - 0x40]
push ecx
push 0x6cec60
mov ecx, ebx
call dword [eax + 8]
or dword [ebp - 4], 0xffffffff
lea edx, [ebp - 0x40]
call fcn.00407770
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x88]
xor ecx, ebp
call fcn.00536476
add ebp, 0x8c
leave
ret 4