Function at 0x411ba0
Capabilities:
Check os version
Create process on windows
Manipulate boot configuration
Query environment variable
Read .ini file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x474
mov eax, dword [0x4ea5e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0x434]
push eax
mov dword [ebp - 0x434], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x430], 6
jae 0x411cfe
push 0x96
lea ecx, [ebp - 0x9c]
push ecx
push str.SYSTEMDRIVE
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea eax, [ebp - 0x9c]
dec eax
xor ebx, ebx
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x411c00
mov edx, dword [str._boot.ini]
mov ecx, dword [0x4d6b68]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [eax], edx
mov dx, word [0x4d6b6c]
mov dword [eax + 4], ecx
mov word [eax + 8], dx
lea eax, [ebp - 0x9c]
push eax
push 0x96
lea ecx, [ebp - 0x1a0]
push ecx
push 0x4ce44c
push str.default
push str.boot_loader
call esi
lea eax, [ebp - 0x1a0]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x411c57
sub eax, edx
je 0x41205c
lea edx, [ebp - 0x9c]
push edx
push 0x200
lea eax, [ebp - 0x3a0]
push eax
push 0x4ce44c
lea ecx, [ebp - 0x1a0]
push ecx
push str.operating_systems
call esi
lea eax, [ebp - 0x3a0]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x411c95
sub eax, edx
je 0x41205c
lea edx, [ebp - 0x3a0]
push 0x2f
push edx
call fcn.004a9130
add esp, 8
cmp eax, ebx
je 0x41205c
mov byte [eax], bl
lea eax, [ebp - 0x9c]
push eax
lea ecx, [ebp - 0x3a0]
push ecx
lea edx, [ebp - 0x1a0]
push edx
push str.operating_systems
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push 1
lea eax, [ebp - 0x9c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a8a2f
mov esp, ebp
pop ebp
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.Wow64DisableWow64FsRedirection
push str.kernel32
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.Wow64RevertWow64FsRedirection
push str.kernel32
mov esi, eax
call edi
push eax
call ebx
xor ebx, ebx
mov edi, eax
cmp esi, ebx
je 0x411f1e
cmp edi, ebx
je 0x411f1e
lea ecx, [ebp - 0x438]
push ecx
call esi
push 0x96
cmp eax, 1
jne 0x411ea5
lea edx, [ebp - 0x1a0]
push edx
push str.SystemRoot
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
xor eax, eax
lea ebx, [ebx]
mov cl, byte [ebp + eax - 0x1a0]
mov byte [ebp + eax - 0x2a4], cl
inc eax
cmp cl, bl
jne 0x411d70
lea eax, [ebp - 0x2a4]
dec eax
lea ebx, [ebx]
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x411d90
mov ecx, dword [str._system32_]
mov edx, dword [0x4d6bfc]
mov dword [eax], ecx
mov cx, word [0x4d6c00]
mov dword [eax + 4], edx
mov dl, byte [0x4d6c02]
mov word [eax + 8], cx
mov byte [eax + 0xa], dl
lea eax, [ebp - 0x2a4]
dec eax
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x411dc4
mov ecx, dword [str.bcdedit.exe]
mov edx, dword [0x4d6c08]
mov dword [eax], ecx
mov ecx, dword [0x4d6c0c]
mov dword [eax + 4], edx
mov edx, dword [str._deletevalue_safeboot]
mov dword [eax + 8], ecx
mov eax, dword [0x4d6c60]
mov ecx, dword [0x4d6c64]
mov dword [ebp - 0x108], edx
mov edx, dword [0x4d6c68]
mov dword [ebp - 0x104], eax
mov eax, dword [0x4d6c6c]
mov dword [ebp - 0x100], ecx
mov cx, word [0x4d6c70]
mov dword [ebp - 0xfc], edx
mov dword [ebp - 0xf8], eax
mov word [ebp - 0xf4], cx
mov dword [ebp - 0x474], 0x3c
mov dword [ebp - 0x470], ebx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0x46c], eax
lea ecx, [ebp - 0x474]
lea edx, [ebp - 0x2a4]
lea eax, [ebp - 0x108]
push ecx
mov dword [ebp - 0x468], str.runas
mov dword [ebp - 0x464], edx
mov dword [ebp - 0x460], eax
mov dword [ebp - 0x45c], ebx
mov dword [ebp - 0x458], ebx
mov dword [ebp - 0x454], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov edx, dword [ebp - 0x438]
push edx
call edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a8a2f
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1a0]
push eax
push str.SystemRoot
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
xor eax, eax
lea esp, [esp]
mov cl, byte [ebp + eax - 0x1a0]
mov byte [ebp + eax - 0x2a4], cl
inc eax
cmp cl, bl
jne 0x411ec0
lea eax, [ebp - 0x2a4]
dec eax
lea ebx, [ebx]
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x411ee0
mov ecx, dword [str._system32_]
mov edx, dword [0x4d6bfc]
mov dword [eax], ecx
mov cx, word [0x4d6c00]
mov dword [eax + 4], edx
mov dl, byte [0x4d6c02]
mov word [eax + 8], cx
mov byte [eax + 0xa], dl
lea eax, [ebp - 0x2a4]
dec eax
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x411f14
jmp 0x411f9c
push 0x96
lea edx, [ebp - 0x1a0]
push edx
push str.SystemRoot
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
xor eax, eax
jmp 0x411f40
mov cl, byte [ebp + eax - 0x1a0]
mov byte [ebp + eax - 0x2a4], cl
inc eax
cmp cl, bl
jne 0x411f40
lea eax, [ebp - 0x2a4]
dec eax
lea ebx, [ebx]
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x411f60
mov ecx, dword [str._system32_]
mov edx, dword [0x4d6bfc]
mov dword [eax], ecx
mov cx, word [0x4d6c00]
mov dword [eax + 4], edx
mov dl, byte [0x4d6c02]
mov word [eax + 8], cx
mov byte [eax + 0xa], dl
lea eax, [ebp - 0x2a4]
dec eax
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x411f94
mov ecx, dword [str.bcdedit.exe]
mov edx, dword [0x4d6c08]
mov dword [eax], ecx
mov ecx, dword [0x4d6c0c]
mov dword [eax + 4], edx
mov edx, dword [str._deletevalue_safeboot]
mov dword [eax + 8], ecx
mov eax, dword [0x4d6c60]
mov ecx, dword [0x4d6c64]
mov dword [ebp - 0x108], edx
mov edx, dword [0x4d6c68]
mov dword [ebp - 0x104], eax
mov eax, dword [0x4d6c6c]
mov dword [ebp - 0x100], ecx
mov cx, word [0x4d6c70]
mov dword [ebp - 0xfc], edx
mov dword [ebp - 0xf8], eax
mov word [ebp - 0xf4], cx
mov dword [ebp - 0x474], 0x3c
mov dword [ebp - 0x470], ebx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0x46c], eax
lea ecx, [ebp - 0x474]
lea edx, [ebp - 0x2a4]
lea eax, [ebp - 0x108]
push ecx
mov dword [ebp - 0x468], str.runas
mov dword [ebp - 0x464], edx
mov dword [ebp - 0x460], eax
mov dword [ebp - 0x45c], ebx
mov dword [ebp - 0x458], ebx
mov dword [ebp - 0x454], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004a8a2f
mov esp, ebp
pop ebp
ret