Function at 0x423470
Capabilities:
Check os version
Create process on windows
Manipulate boot configuration
Query environment variable
Read .ini file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x474
mov eax, dword [0x4f5568]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x434]
mov dword [ebp - 0x434], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x430], 6
jae 0x4235f8
push 0x96
lea eax, [ebp - 0x9c]
push eax
push str.SYSTEMDRIVE
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea ecx, [ebp - 0x9c]
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x4234c6
mov eax, dword [str._boot.ini]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [ecx], eax
mov eax, dword [0x4e1980]
mov dword [ecx + 4], eax
mov ax, word [0x4e1984]
mov word [ecx + 8], ax
lea eax, [ebp - 0x9c]
push eax
push 0x96
lea eax, [ebp - 0x1a0]
push eax
push 0x4d9f42
push str.default
push str.boot_loader
call esi
lea ecx, [ebp - 0x1a0]
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x423520
sub ecx, edx
je 0x423919
lea eax, [ebp - 0x9c]
push eax
push 0x200
lea eax, [ebp - 0x3a0]
push eax
push 0x4d9f42
lea eax, [ebp - 0x1a0]
push eax
push str.operating_systems
call esi
lea ecx, [ebp - 0x3a0]
lea edx, [ecx + 1]
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x423560
sub ecx, edx
je 0x423919
lea ecx, [ebp - 0x3a0]
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x423576
mov eax, dword [str.__safeboot:network]
mov dword [ecx], eax
mov eax, dword [0x4e19b4]
mov dword [ecx + 4], eax
mov eax, dword [0x4e19b8]
mov dword [ecx + 8], eax
mov eax, dword [0x4e19bc]
mov dword [ecx + 0xc], eax
mov ax, word [0x4e19c0]
mov word [ecx + 0x10], ax
mov al, byte [0x4e19c2]
mov byte [ecx + 0x12], al
lea eax, [ebp - 0x9c]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x3a0]
push eax
lea eax, [ebp - 0x1a0]
push eax
push str.operating_systems
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aca59
mov esp, ebp
pop ebp
ret
push ebx
push str.Wow64DisableWow64FsRedirection
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
push str.Wow64RevertWow64FsRedirection
push str.kernel32
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call esi
mov esi, eax
test ebx, ebx
je 0x4237ee
test esi, esi
je 0x4237ee
lea eax, [ebp - 0x438]
push eax
call ebx
push 0x96
cmp eax, 1
lea eax, [ebp - 0x1a0]
push eax
push str.SystemRoot
jne 0x423780
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
xor ecx, ecx
mov al, byte [ebp + ecx - 0x1a0]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x109], al
test al, al
jne 0x423664
lea ecx, [ebp - 0x108]
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x423680
mov eax, dword [str._system32_]
mov dword [ecx], eax
mov eax, dword [0x4e1a14]
mov dword [ecx + 4], eax
mov ax, word [0x4e1a18]
mov word [ecx + 8], ax
mov al, byte [0x4e1a1a]
mov byte [ecx + 0xa], al
lea ecx, [ebp - 0x108]
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x4236b2
mov eax, dword [str.bcdedit.exe]
movdqu xmm0, xmmword [str._set_safeboot_network]
mov dword [ecx], eax
mov eax, dword [0x4e1a20]
mov dword [ecx + 4], eax
mov eax, dword [0x4e1a24]
mov dword [ecx + 8], eax
mov eax, dword [0x4e1a38]
mov dword [ebp - 0x294], eax
mov ax, word [0x4e1a3c]
movdqu xmmword [ebp - 0x2a4], xmm0
mov word [ebp - 0x290], ax
mov dword [ebp - 0x474], 0x3c
mov dword [ebp - 0x470], 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0x46c], eax
lea eax, [ebp - 0x108]
mov dword [ebp - 0x464], eax
lea eax, [ebp - 0x2a4]
mov dword [ebp - 0x460], eax
lea eax, [ebp - 0x474]
push eax
mov dword [ebp - 0x468], str.runas
mov dword [ebp - 0x45c], 0
mov dword [ebp - 0x458], 0
mov dword [ebp - 0x454], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
push dword [ebp - 0x438]
call esi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aca59
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
xor ecx, ecx
jmp 0x423790
mov al, byte [ebp + ecx - 0x1a0]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x2a5], al
test al, al
jne 0x423790
lea ecx, [ebp - 0x2a4]
dec ecx
lea esp, [esp]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x4237b0
mov eax, dword [str._system32_]
mov dword [ecx], eax
mov eax, dword [0x4e1a14]
mov dword [ecx + 4], eax
mov ax, word [0x4e1a18]
mov word [ecx + 8], ax
mov al, byte [0x4e1a1a]
mov byte [ecx + 0xa], al
lea ecx, [ebp - 0x2a4]
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x4237e2
jmp 0x42386c
push 0x96
lea eax, [ebp - 0x1a0]
push eax
push str.SystemRoot
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
xor ecx, ecx
jmp 0x423810
mov al, byte [ebp + ecx - 0x1a0]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x2a5], al
test al, al
jne 0x423810
lea ecx, [ebp - 0x2a4]
dec ecx
lea esp, [esp]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x423830
mov eax, dword [str._system32_]
mov dword [ecx], eax
mov eax, dword [0x4e1a14]
mov dword [ecx + 4], eax
mov ax, word [0x4e1a18]
mov word [ecx + 8], ax
mov al, byte [0x4e1a1a]
mov byte [ecx + 0xa], al
lea ecx, [ebp - 0x2a4]
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x423862
mov eax, dword [str.bcdedit.exe]
movdqu xmm0, xmmword [str._set_safeboot_network]
mov dword [ecx], eax
mov eax, dword [0x4e1a20]
mov dword [ecx + 4], eax
mov eax, dword [0x4e1a24]
mov dword [ecx + 8], eax
mov eax, dword [0x4e1a38]
mov dword [ebp - 0xf8], eax
mov ax, word [0x4e1a3c]
movdqu xmmword [ebp - 0x108], xmm0
mov word [ebp - 0xf4], ax
mov dword [ebp - 0x474], 0x3c
mov dword [ebp - 0x470], 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0x46c], eax
lea eax, [ebp - 0x2a4]
mov dword [ebp - 0x464], eax
lea eax, [ebp - 0x108]
mov dword [ebp - 0x460], eax
lea eax, [ebp - 0x474]
push eax
mov dword [ebp - 0x468], str.runas
mov dword [ebp - 0x45c], 0
mov dword [ebp - 0x458], 0
mov dword [ebp - 0x454], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004aca59
mov esp, ebp
pop ebp
ret