Function at 0x423ba0
Capabilities:
Check os version
Create process on windows
Manipulate boot configuration
Query environment variable
Read .ini file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x474
mov eax, dword [0x4f5568]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x434]
mov dword [ebp - 0x434], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x430], 6
jae 0x423cf9
push 0x96
lea eax, [ebp - 0x9c]
push eax
push str.SYSTEMDRIVE
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea ecx, [ebp - 0x9c]
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x423bf6
mov eax, dword [str._boot.ini]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [ecx], eax
mov eax, dword [0x4e1980]
mov dword [ecx + 4], eax
mov ax, word [0x4e1984]
mov word [ecx + 8], ax
lea eax, [ebp - 0x9c]
push eax
push 0x96
lea eax, [ebp - 0x1a0]
push eax
push 0x4d9f42
push str.default
push str.boot_loader
call esi
lea ecx, [ebp - 0x1a0]
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x423c50
sub ecx, edx
je 0x424019
lea eax, [ebp - 0x9c]
push eax
push 0x200
lea eax, [ebp - 0x3a0]
push eax
push 0x4d9f42
lea eax, [ebp - 0x1a0]
push eax
push str.operating_systems
call esi
lea ecx, [ebp - 0x3a0]
lea edx, [ecx + 1]
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x423c90
sub ecx, edx
je 0x424019
lea eax, [ebp - 0x3a0]
push 0x2f
push eax
call fcn.004ad400
add esp, 8
test eax, eax
je 0x424019
mov byte [eax], 0
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x3a0]
push eax
lea eax, [ebp - 0x1a0]
push eax
push str.operating_systems
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push 1
lea eax, [ebp - 0x9c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aca59
mov esp, ebp
pop ebp
ret
push ebx
push str.Wow64DisableWow64FsRedirection
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
push str.Wow64RevertWow64FsRedirection
push str.kernel32
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call esi
mov esi, eax
test ebx, ebx
je 0x423eee
test esi, esi
je 0x423eee
lea eax, [ebp - 0x438]
push eax
call ebx
push 0x96
cmp eax, 1
lea eax, [ebp - 0x1a0]
push eax
push str.SystemRoot
jne 0x423e81
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
xor ecx, ecx
mov al, byte [ebp + ecx - 0x1a0]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x109], al
test al, al
jne 0x423d65
lea ecx, [ebp - 0x108]
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x423d81
mov eax, dword [str._system32_]
mov dword [ecx], eax
mov eax, dword [0x4e1a14]
mov dword [ecx + 4], eax
mov ax, word [0x4e1a18]
mov word [ecx + 8], ax
mov al, byte [0x4e1a1a]
mov byte [ecx + 0xa], al
lea ecx, [ebp - 0x108]
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x423db3
mov eax, dword [str.bcdedit.exe]
movdqu xmm0, xmmword [str._deletevalue_safeboot]
mov dword [ecx], eax
mov eax, dword [0x4e1a20]
mov dword [ecx + 4], eax
mov eax, dword [0x4e1a24]
mov dword [ecx + 8], eax
mov eax, dword [0x4e1a84]
mov dword [ebp - 0x294], eax
mov ax, word [0x4e1a88]
movdqu xmmword [ebp - 0x2a4], xmm0
mov word [ebp - 0x290], ax
mov dword [ebp - 0x474], 0x3c
mov dword [ebp - 0x470], 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0x46c], eax
lea eax, [ebp - 0x108]
mov dword [ebp - 0x464], eax
lea eax, [ebp - 0x2a4]
mov dword [ebp - 0x460], eax
lea eax, [ebp - 0x474]
push eax
mov dword [ebp - 0x468], str.runas
mov dword [ebp - 0x45c], 0
mov dword [ebp - 0x458], 0
mov dword [ebp - 0x454], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
push dword [ebp - 0x438]
call esi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aca59
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
xor ecx, ecx
lea esp, [esp]
mov al, byte [ebp + ecx - 0x1a0]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x2a5], al
test al, al
jne 0x423e90
lea ecx, [ebp - 0x2a4]
dec ecx
lea esp, [esp]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x423eb0
mov eax, dword [str._system32_]
mov dword [ecx], eax
mov eax, dword [0x4e1a14]
mov dword [ecx + 4], eax
mov ax, word [0x4e1a18]
mov word [ecx + 8], ax
mov al, byte [0x4e1a1a]
mov byte [ecx + 0xa], al
lea ecx, [ebp - 0x2a4]
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x423ee2
jmp 0x423f6c
push 0x96
lea eax, [ebp - 0x1a0]
push eax
push str.SystemRoot
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
xor ecx, ecx
jmp 0x423f10
mov al, byte [ebp + ecx - 0x1a0]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x2a5], al
test al, al
jne 0x423f10
lea ecx, [ebp - 0x2a4]
dec ecx
lea esp, [esp]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x423f30
mov eax, dword [str._system32_]
mov dword [ecx], eax
mov eax, dword [0x4e1a14]
mov dword [ecx + 4], eax
mov ax, word [0x4e1a18]
mov word [ecx + 8], ax
mov al, byte [0x4e1a1a]
mov byte [ecx + 0xa], al
lea ecx, [ebp - 0x2a4]
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x423f62
mov eax, dword [str.bcdedit.exe]
movdqu xmm0, xmmword [str._deletevalue_safeboot]
mov dword [ecx], eax
mov eax, dword [0x4e1a20]
mov dword [ecx + 4], eax
mov eax, dword [0x4e1a24]
mov dword [ecx + 8], eax
mov eax, dword [0x4e1a84]
mov dword [ebp - 0xf8], eax
mov ax, word [0x4e1a88]
movdqu xmmword [ebp - 0x108], xmm0
mov word [ebp - 0xf4], ax
mov dword [ebp - 0x474], 0x3c
mov dword [ebp - 0x470], 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0x46c], eax
lea eax, [ebp - 0x2a4]
mov dword [ebp - 0x464], eax
lea eax, [ebp - 0x108]
mov dword [ebp - 0x460], eax
lea eax, [ebp - 0x474]
push eax
mov dword [ebp - 0x468], str.runas
mov dword [ebp - 0x45c], 0
mov dword [ebp - 0x458], 0
mov dword [ebp - 0x454], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004aca59
mov esp, ebp
pop ebp
ret