Function at 0x40a648
Capabilities:
Manipulate boot configuration
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc98
mov eax, 0x5109d8
push ebx
push esi
push edi
call fcn.004e1410
xor edx, edx
xor ecx, ecx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], 0xa
push 0x105
call fcn.004e0050
pop ecx
mov dword [ebp - 0x2c], eax
test eax, eax
je 0x40a9d6
push 0x105
call fcn.004e0050
pop ecx
mov dword [ebp - 0x30], eax
test eax, eax
je 0x40a9d6
push 0x105
call fcn.004e0050
pop ecx
mov dword [ebp - 0x34], eax
test eax, eax
je 0x40a9d6
mov dx, word [ebp + 0xc]
push edx
mov cx, word [ebp + 8]
push ecx
call fcn.0040c7bc
add esp, 8
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
je 0x40a6d1
jmp 0x40a9d6
mov byte [ebp - 0x39], 0
mov eax, dword [0x54f650]
lea edx, [ebp - 0x264]
add eax, 0x41
push eax
push str._c:_boot.ini
push edx
call sub.USER32.DLL_wsprintfA
add esp, 0xc
lea ecx, [ebp - 0x264]
lea eax, [ebp - 0x160]
push ecx
push 0x104
push eax
push 0x51096c
push str.default
push str.boot_loader
call sub.KERNEL32.DLL_GetPrivateProfileStringA
test eax, eax
jne 0x40a71f
jmp 0x40a774
lea edx, [ebp - 0x160]
push edx
call fcn.004e0ef8
pop ecx
mov ebx, eax
lea esi, [ebp + ebx - 0x160]
test ebx, ebx
jle 0x40a747
movsx eax, byte [esi]
cmp eax, 0x5c
je 0x40a747
dec ebx
dec esi
test ebx, ebx
jg 0x40a739
test ebx, ebx
je 0x40a774
inc ebx
lea edx, [ebp - 0x160]
add ebx, edx
mov ecx, dword [0x54f650]
add ecx, 0x41
push ebx
push ecx
push 0x51096d
mov eax, dword [ebp - 0x34]
push eax
call sub.USER32.DLL_wsprintfA
mov byte [ebp - 0x39], 1
add esp, 0x10
cmp byte [ebp - 0x39], 0
jne 0x40a79a
push str.Windows
mov edx, dword [0x54f650]
add edx, 0x41
push edx
push str._c:_s
mov ecx, dword [ebp - 0x34]
push ecx
call sub.USER32.DLL_wsprintfA
add esp, 0x10
mov word [ebp - 0x18], 0xc
lea eax, [ebp - 4]
push eax
call fcn.004efb10
pop ecx
inc dword [ebp - 0xc]
mov word [ebp - 0x18], 0x18
xor esi, esi
xor ebx, ebx
push 0x105
call fcn.004e0050
pop ecx
mov edi, eax
test eax, eax
je 0x40a8d9
push 0x105
call fcn.004e0050
pop ecx
mov esi, eax
test eax, eax
je 0x40a8d9
xor ebx, ebx
mov eax, dword [ebp - 0x34]
push eax
push str._s_system32config_software
push esi
call sub.USER32.DLL_wsprintfA
add esp, 0xc
push esi
lea edx, [ebp - 4]
push edx
call fcn.004efb60
add esp, 8
test al, al
je 0x40a8d9
lea ecx, [ebp - 0x40]
push ecx
push 0x20019
push 0
push str.Phantosys
mov ecx, dword [ebp - 4]
push ecx
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
je 0x40a848
lea eax, [ebp - 0x40]
push eax
push 0x20019
push 0
push str.Phantom
mov edx, dword [ebp - 4]
push edx
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x40a8cd
mov dword [ebp - 0x48], 0x104
mov ecx, dword [ebp - 0x30]
lea edx, [ebp - 0x48]
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x50], eax
push edx
mov ecx, dword [ebp - 0x4c]
lea eax, [ebp - 0x44]
push ecx
push eax
push 0
push str.path
mov edx, dword [ebp - 0x50]
push edx
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
jne 0x40a8c2
mov eax, dword [ebp - 0x30]
mov bl, 1
mov dword [ebp - 0x54], eax
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x58], edx
mov ecx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x54]
push esi
push edi
mov edi, eax
xor eax, eax
mov esi, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x2c]
pop edi
mov cl, byte [0x54f650]
pop esi
add cl, 0x41
mov byte [eax], cl
mov eax, dword [ebp - 0x40]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
test bl, bl
lea edx, [ebp - 4]
push edx
call fcn.004efba8
pop ecx
test bl, bl
test edi, edi
je 0x40a8e4
push edi
call fcn.004e0060
pop ecx
test esi, esi
je 0x40a8ef
push esi
call fcn.004e0060
pop ecx
test bl, bl
jne 0x40a910
mov dword [ebp - 0x38], 0x27
dec dword [ebp - 0xc]
push 2
lea ecx, [ebp - 4]
push ecx
call fcn.004efae8
add esp, 8
jmp 0x40a9cb
dec dword [ebp - 0xc]
push 2
lea eax, [ebp - 4]
push eax
call fcn.004efae8
mov word [ebp - 0x18], 0
add esp, 8
mov dword [ebp - 0x5c], 0x54f96c
xor ebx, ebx
mov esi, 0x54f94c
cmp ebx, 2
jg 0x40a95a
mov edx, dword [0x51fcd8]
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [edx + ebx*4 + 0x30]
push ecx
lea ecx, [ebp - 0x368]
push ecx
call sub.USER32.DLL_wsprintfA
add esp, 0xc
jmp 0x40a978
mov edx, dword [0x51fcd8]
mov eax, dword [ebp - 0x34]
push eax
lea eax, [ebp - 0x368]
mov ecx, dword [edx + ebx*4 + 0x30]
push ecx
push eax
call sub.USER32.DLL_wsprintfA
add esp, 0xc
push 0x80
push 0x8302
lea edx, [ebp - 0x368]
push edx
call fcn.004e3f4c
add esp, 0xc
mov edi, eax
cmp edi, 0xffffffff
jne 0x40a9a1
mov dword [ebp - 0x38], 0x26
jmp 0x40a9cb
mov eax, dword [ebp - 0x5c]
mov edx, dword [eax]
push edx
mov ecx, dword [esi]
push ecx
push edi
call fcn.004e4e40
add esp, 0xc
push edi
call fcn.004e2d24
pop ecx
add dword [ebp - 0x5c], 4
inc ebx
add esi, 4
cmp ebx, 8
jl 0x40a935
call fcn.004087d4
test eax, eax
je 0x40a9d6
jmp 0x40a9cb
cmp dword [ebp - 0x34], 0
je 0x40a9e6
mov eax, dword [ebp - 0x34]
push eax
call fcn.004e0060
pop ecx
cmp dword [ebp - 0x2c], 0
je 0x40a9f6
mov edx, dword [ebp - 0x2c]
push edx
call fcn.004e0060
pop ecx
cmp dword [ebp - 0x30], 0
je 0x40aa06
mov ecx, dword [ebp - 0x30]
push ecx
call fcn.004e0060
pop ecx
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret