Function at 0x497345
Capabilities:
Check if file exists
Create process on windows
Get common file path
Manipulate boot configuration

Disassembly:
push 0x240
mov eax, 0x4e6c89
call fcn.004b5417
xor ebx, ebx
mov dword [ebp - 0x220], ebx
call fcn.0046affe
test eax, eax
je 0x4975ff
lea ecx, [ebp - 0x224]
call fcn.0040c7d0
mov dword [ebp - 4], ebx
push str.F8DB7E1C16F1FFD4AAAD4AAD8DFF0F2445184AEB
lea eax, [ebp - 0x224]
push str.SOFTWAREMicrosoftSystemCertificatesFlightRootCertificates_s
push eax
call fcn.0040e3f0
add esp, 0xc
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x228], esp
mov edi, 0x50ea8c
push edi
call fcn.0044bc85
mov byte [ebp - 4], 1
push ecx
lea eax, [ebp - 0x224]
mov ecx, esp
mov dword [ebp - 0x22c], esp
push eax
call fcn.004420c1
mov byte [ebp - 4], 2
mov esi, 0x80000002
push esi
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x24c]
call fcn.00443769
mov byte [ebp - 4], 3
push eax
mov dword [ebp - 0x220], 1
call fcn.0043e8c0
pop ecx
test eax, eax
jne 0x497452
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x22c], esp
push edi
call fcn.0044bc85
mov dword [ebp - 4], 4
push ecx
lea eax, [ebp - 0x224]
mov ecx, esp
mov dword [ebp - 0x228], esp
push eax
call fcn.004420c1
mov byte [ebp - 4], 5
push esi
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x23c]
call fcn.00443769
mov dword [ebp - 4], 6
push eax
mov dword [ebp - 0x220], 3
call fcn.0043e8c0
pop ecx
mov byte [ebp - 0x219], bl
test eax, eax
je 0x497459
mov byte [ebp - 0x219], 1
mov dword [ebp - 4], 3
test byte [ebp - 0x220], 2
je 0x49747b
and dword [ebp - 0x220], 0xfffffffd
lea ecx, [ebp - 0x23c]
call fcn.00443c39
mov dword [ebp - 4], ebx
test byte [ebp - 0x220], 1
je 0x497499
and dword [ebp - 0x220], 0xfffffffe
lea ecx, [ebp - 0x24c]
call fcn.00443c39
cmp byte [ebp - 0x219], bl
je 0x4975f0
push 1
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x22c], esp
push str.ManualFlightSigning
call fcn.0044bc85
mov byte [ebp - 4], 7
push ecx
mov ecx, esp
mov dword [ebp - 0x228], esp
push str.SOFTWARE360TotalSecurityUserProfile
call fcn.0044bc85
mov byte [ebp - 4], 8
push esi
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x24c]
call fcn.00443769
mov byte [ebp - 4], 9
push eax
call fcn.0043ea52
pop ecx
pop ecx
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x24c]
call fcn.00443c39
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.004b47e0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x4975f0
push str.bcdedit.exe
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x4975f0
call fcn.0043b72a
test al, al
je 0x4975b0
lea ecx, [ebp - 0x238]
call fcn.0043ba2b
mov byte [ebp - 4], 0xa
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4975a0
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
push ebx
push ebx
push str._set_bootmgr_flightsigning_on
lea eax, [ebp - 0x218]
push eax
mov esi, str.open
push esi
push ebx
call edi
push ebx
push ebx
push 0x50550c
lea eax, [ebp - 0x218]
push eax
push esi
push ebx
call edi
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x238]
call fcn.0043baae
jmp 0x4975f0
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4975f0
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
push ebx
push ebx
push str._set_bootmgr_flightsigning_on
lea eax, [ebp - 0x218]
push eax
mov esi, str.open
push esi
push ebx
call edi
push ebx
push ebx
push 0x50550c
lea eax, [ebp - 0x218]
push eax
push esi
push ebx
call edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x224]
call fcn.0040d610
call fcn.004b549a
ret