Function at 0x433d90
Capabilities:
Check os version
Create process on windows
Manipulate boot configuration
Query environment variable
Read .ini file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x474
mov eax, dword [0x5c3040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x434]
mov dword [ebp - 0x434], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x430], 6
jae 0x433ed9
push 0x96
lea eax, [ebp - 0x9c]
push eax
push str.SYSTEMDRIVE
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push str._boot.ini
lea eax, [ebp - 0x9c]
push 0x96
push eax
call fcn.0052c1fd
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x9c]
add esp, 0xc
push eax
push 0x96
lea eax, [ebp - 0x1a0]
push eax
push 0x579be0
push str.default
push str.boot_loader
call esi
lea ecx, [ebp - 0x1a0]
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x433e30
sub ecx, edx
je 0x434107
lea eax, [ebp - 0x9c]
push eax
push 0x200
lea eax, [ebp - 0x3a0]
push eax
push 0x579be0
lea eax, [ebp - 0x1a0]
push eax
push str.operating_systems
call esi
lea ecx, [ebp - 0x3a0]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x433e70
sub ecx, edx
je 0x434107
lea eax, [ebp - 0x3a0]
push 0x2f
push eax
call fcn.00525fd0
add esp, 8
test eax, eax
je 0x434107
mov byte [eax], 0
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x3a0]
push eax
lea eax, [ebp - 0x1a0]
push eax
push str.operating_systems
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push 1
lea eax, [ebp - 0x9c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00524763
mov esp, ebp
pop ebp
ret
push ebx
push str.Wow64DisableWow64FsRedirection
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
push str.Wow64RevertWow64FsRedirection
push str.kernel32
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call esi
mov esi, eax
test ebx, ebx
je 0x434025
test esi, esi
je 0x434025
lea eax, [ebp - 0x438]
push eax
call ebx
push 0x96
cmp eax, 1
lea eax, [ebp - 0x1a0]
push eax
push str.SystemRoot
jne 0x434036
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea eax, [ebp - 0x1a0]
push eax
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.0052c1a3
push str._system32_
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.0052c1fd
push str.bcdedit.exe
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.0052c1fd
push str._deletevalue_safeboot
lea eax, [ebp - 0x2a4]
push 0x104
push eax
call fcn.0052c1a3
add esp, 0x30
mov dword [ebp - 0x474], 0x3c
mov dword [ebp - 0x470], 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0x46c], eax
lea eax, [ebp - 0x108]
mov dword [ebp - 0x464], eax
lea eax, [ebp - 0x2a4]
mov dword [ebp - 0x460], eax
lea eax, [ebp - 0x474]
push eax
mov dword [ebp - 0x468], str.runas
mov dword [ebp - 0x45c], 0
mov dword [ebp - 0x458], 0
mov dword [ebp - 0x454], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
push dword [ebp - 0x438]
call esi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00524763
mov esp, ebp
pop ebp
ret
push 0x96
lea eax, [ebp - 0x1a0]
push eax
push str.SystemRoot
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea eax, [ebp - 0x1a0]
push eax
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.0052c1a3
push str._system32_
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.0052c1fd
push str.bcdedit.exe
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.0052c1fd
push str._deletevalue_safeboot
lea eax, [ebp - 0x2a4]
push 0x104
push eax
call fcn.0052c1a3
add esp, 0x30
mov dword [ebp - 0x474], 0x3c
mov dword [ebp - 0x470], 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0x46c], eax
lea eax, [ebp - 0x108]
mov dword [ebp - 0x464], eax
lea eax, [ebp - 0x2a4]
mov dword [ebp - 0x460], eax
lea eax, [ebp - 0x474]
push eax
mov dword [ebp - 0x468], str.runas
mov dword [ebp - 0x45c], 0
mov dword [ebp - 0x458], 0
mov dword [ebp - 0x454], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00524763
mov esp, ebp
pop ebp
ret