Function at 0x42c610
Capabilities:
Check os version
Create process on windows
Manipulate boot configuration
Query environment variable
Read .ini file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x474
mov eax, dword [0x55800c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x434]
mov dword [ebp - 0x434], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x430], 6
jae 0x42c769
push 0x96
lea eax, [ebp - 0x9c]
push eax
push str.SYSTEMDRIVE
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea ecx, [ebp - 0x9c]
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x42c666
mov eax, dword [str._boot.ini]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [ecx], eax
mov eax, dword [0x540b18]
mov dword [ecx + 4], eax
mov ax, word [0x540b1c]
mov word [ecx + 8], ax
lea eax, [ebp - 0x9c]
push eax
push 0x96
lea eax, [ebp - 0x1a0]
push eax
push 0x518188
push str.default
push str.boot_loader
call esi
lea ecx, [ebp - 0x1a0]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x42c6c0
sub ecx, edx
je 0x42c997
lea eax, [ebp - 0x9c]
push eax
push 0x200
lea eax, [ebp - 0x3a0]
push eax
push 0x518188
lea eax, [ebp - 0x1a0]
push eax
push str.operating_systems
call esi
lea ecx, [ebp - 0x3a0]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x42c700
sub ecx, edx
je 0x42c997
lea eax, [ebp - 0x3a0]
push 0x2f
push eax
call fcn.004cd350
add esp, 8
test eax, eax
je 0x42c997
mov byte [eax], 0
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x3a0]
push eax
lea eax, [ebp - 0x1a0]
push eax
push str.operating_systems
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push 1
lea eax, [ebp - 0x9c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004cbf27
mov esp, ebp
pop ebp
ret
push ebx
push str.Wow64DisableWow64FsRedirection
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
push str.Wow64RevertWow64FsRedirection
push str.kernel32
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call esi
mov esi, eax
test ebx, ebx
je 0x42c8b5
test esi, esi
je 0x42c8b5
lea eax, [ebp - 0x438]
push eax
call ebx
push 0x96
cmp eax, 1
lea eax, [ebp - 0x1a0]
push eax
push str.SystemRoot
jne 0x42c8c6
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea eax, [ebp - 0x1a0]
push eax
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.004d0170
push str._system32_
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.004d01ca
push str.bcdedit.exe
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.004d01ca
push str._deletevalue_safeboot
lea eax, [ebp - 0x2a4]
push 0x104
push eax
call fcn.004d0170
add esp, 0x30
mov dword [ebp - 0x474], 0x3c
mov dword [ebp - 0x470], 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0x46c], eax
lea eax, [ebp - 0x108]
mov dword [ebp - 0x464], eax
lea eax, [ebp - 0x2a4]
mov dword [ebp - 0x460], eax
lea eax, [ebp - 0x474]
push eax
mov dword [ebp - 0x468], str.runas
mov dword [ebp - 0x45c], 0
mov dword [ebp - 0x458], 0
mov dword [ebp - 0x454], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
push dword [ebp - 0x438]
call esi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004cbf27
mov esp, ebp
pop ebp
ret
push 0x96
lea eax, [ebp - 0x1a0]
push eax
push str.SystemRoot
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea eax, [ebp - 0x1a0]
push eax
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.004d0170
push str._system32_
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.004d01ca
push str.bcdedit.exe
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.004d01ca
push str._deletevalue_safeboot
lea eax, [ebp - 0x2a4]
push 0x104
push eax
call fcn.004d0170
add esp, 0x30
mov dword [ebp - 0x474], 0x3c
mov dword [ebp - 0x470], 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0x46c], eax
lea eax, [ebp - 0x108]
mov dword [ebp - 0x464], eax
lea eax, [ebp - 0x2a4]
mov dword [ebp - 0x460], eax
lea eax, [ebp - 0x474]
push eax
mov dword [ebp - 0x468], str.runas
mov dword [ebp - 0x45c], 0
mov dword [ebp - 0x458], 0
mov dword [ebp - 0x454], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004cbf27
mov esp, ebp
pop ebp
ret