Function at 0x403070
Capabilities:
Check if file exists
Copy file
Create process on windows
Create process suspended
Manipulate boot configuration
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x463674
mov eax, dword fs:[0]
push eax
sub esp, 0x408
mov eax, dword [0x482308]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x19c]
mov dword [ebp - 4], 0
mov dword [ebp - 0x410], edi
mov dword [ebp - 0x3b4], edi
mov dword [ebp - 0x3c8], 0
call fcn.0041441e
mov ecx, edi
mov dword [ebp - 4], 1
call fcn.0041441e
push 1
push str.bootsect.exe
lea eax, [ebp - 0x3ac]
mov dword [ebp - 0x3c8], 1
push eax
mov ecx, esi
call fcn.00405f00
movzx eax, word [ebp + 0x10]
lea ecx, [ebp - 0x3ac]
push eax
mov byte [ebp - 4], 2
call fcn.00411afa
push eax
lea eax, [ebp - 0x19c]
push str._s__nt52__c:__mbr
push eax
call fcn.00414a20
add esp, 0x10
lea ecx, [ebp - 0x19c]
call fcn.00411afa
xor ecx, ecx
mov dword [ebp - 0x40c], 0x44
mov word [ebp - 0x3ca], cx
xorps xmm0, xmm0
mov word [ebp - 0x3dc], cx
lea ecx, [ebp - 0x3c4]
push ecx
lea ecx, [ebp - 0x40c]
movlpd qword [ebp - 0x408], xmm0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0
movups xmmword [ebp - 0x3c4], xmm0
mov dword [ebp - 0x3e0], 1
movlpd qword [ebp - 0x400], xmm0
movlpd qword [ebp - 0x3f8], xmm0
movlpd qword [ebp - 0x3f0], xmm0
movlpd qword [ebp - 0x3e8], xmm0
movlpd qword [ebp - 0x3da], xmm0
movlpd qword [ebp - 0x3d2], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4034ff
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xffffffffffffffff
push dword [ebp - 0x3c4]
call edi
lea eax, [ebp - 0x3b0]
push eax
push dword [ebp - 0x3c4]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x3c0]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x3c4]
call esi
cmp dword [ebp - 0x3b0], 0
jne 0x4034ff
lea ecx, [ebp - 0x328]
call fcn.0041441e
movzx eax, word [ebp + 0x10]
lea ecx, [ebp - 0x3ac]
push eax
mov byte [ebp - 4], 3
call fcn.00411afa
push eax
lea eax, [ebp - 0x328]
push str._s__nt52__c:
push eax
call fcn.00414a20
add esp, 0x10
lea ecx, [ebp - 0x328]
call fcn.00411afa
xor ecx, ecx
mov dword [ebp - 0x40c], 0x44
mov word [ebp - 0x3ca], cx
xorps xmm0, xmm0
mov word [ebp - 0x3dc], cx
lea ecx, [ebp - 0x3c4]
push ecx
lea ecx, [ebp - 0x40c]
movlpd qword [ebp - 0x408], xmm0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0
movups xmmword [ebp - 0x3c4], xmm0
mov dword [ebp - 0x3e0], 1
movlpd qword [ebp - 0x400], xmm0
movlpd qword [ebp - 0x3f8], xmm0
movlpd qword [ebp - 0x3f0], xmm0
movlpd qword [ebp - 0x3e8], xmm0
movlpd qword [ebp - 0x3da], xmm0
movlpd qword [ebp - 0x3d2], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x403304
push 0xffffffffffffffff
push dword [ebp - 0x3c4]
call edi
lea eax, [ebp - 0x3b0]
push eax
push dword [ebp - 0x3c4]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x3c0]
call esi
push dword [ebp - 0x3c4]
call esi
cmp dword [ebp - 0x3b0], 0
je 0x40332f
sub esp, 0x84
lea esi, [ebp - 0x19c]
mov edi, esp
mov ecx, 0x21
rep movsd dword es:[edi], dword [esi]
push 0x478dbc
push dword [ebp - 0x3b4]
call fcn.00414a20
add esp, 0x8c
lea ecx, [ebp - 0x94]
call fcn.0041441e
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 4
call fcn.0041441e
lea ecx, [ebp - 0x2a4]
mov byte [ebp - 4], 5
call fcn.0041441e
movzx eax, word [ebp + 0x10]
push eax
lea eax, [ebp - 0x94]
mov byte [ebp - 4], 6
push 0x478de0
push eax
call fcn.00414a20
add esp, 0xc
lea ecx, [ebp - 0x220]
call fcn.0041441e
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x3b0]
push eax
lea eax, [ebp - 0x414]
mov byte [ebp - 4], 7
push eax
push edi
call fcn.00404f20
push dword [ebp - 0x3b0]
lea eax, [ebp - 0x220]
push str.multi_0_disk_0_rdisk_0_partition__d_WINDOWS
push eax
call fcn.00414a20
add esp, 0xc
lea ecx, [ebp - 0x94]
push 0x80
call fcn.00411afa
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [ebp - 0x94]
call fcn.00411afa
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push eax
push 0x478e5c
push 0x478e60
push str.boot_loader
call esi
lea ecx, [ebp - 0x94]
call fcn.00411afa
push eax
lea ecx, [ebp - 0x220]
call fcn.00411afa
push eax
push str.default
push str.boot_loader
call esi
lea ecx, [ebp - 0x94]
call fcn.00411afa
push eax
push str._Microsoft_Windows_XP_Professional___noexecuteoptin__fastdetect
lea ecx, [ebp - 0x220]
call fcn.00411afa
push eax
push str.operating_systems
call esi
push 7
lea ecx, [ebp - 0x94]
call fcn.00411afa
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push eax
call esi
movzx eax, word [ebp + 0x10]
push eax
lea eax, [ebp - 0x118]
push str._c:_ntldr
push eax
call fcn.00414a20
movzx eax, di
push eax
lea eax, [ebp - 0x2a4]
push str._c:_ntldr
push eax
call fcn.00414a20
add esp, 0x18
cmp word [ebp + 0x10], di
je 0x4034b4
push 0x80
lea ecx, [ebp - 0x118]
call fcn.00411afa
push eax
call esi
push 0
lea ecx, [ebp - 0x118]
call fcn.00411afa
push eax
lea ecx, [ebp - 0x2a4]
call fcn.00411afa
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea ecx, [ebp - 0x118]
call fcn.00411afa
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea ecx, [ebp - 0x220]
call fcn.00414510
lea ecx, [ebp - 0x2a4]
call fcn.00414510
lea ecx, [ebp - 0x118]
call fcn.00414510
lea ecx, [ebp - 0x94]
call fcn.00414510
lea ecx, [ebp - 0x328]
call fcn.00414510
jmp 0x40352a
sub esp, 0x84
lea esi, [ebp - 0x19c]
mov edi, esp
mov ecx, 0x21
rep movsd dword es:[edi], dword [esi]
push 0x478d84
push dword [ebp - 0x3b4]
call fcn.00414a20
add esp, 0x8c
lea ecx, [ebp - 0x3ac]
call fcn.00414510
lea ecx, [ebp - 0x19c]
call fcn.00414510
mov eax, dword [ebp - 0x3b4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00445e0f
mov esp, ebp
pop ebp
ret 0xc