Function at 0x51350c
Capabilities:
Copy file
Create process on windows
Manipulate boot configuration

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x513514
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x51376b
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x513744
push dword fs:[edx]
mov dword fs:[edx], esp
xor ebx, ebx
lea edx, [ebp - 0xc]
mov eax, dword [0x559800]
mov eax, dword [eax]
call fcn.004917a8
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.004094c8
mov dl, 1
mov eax, dword [0x417bc0]
call fcn.0040337c
mov esi, eax
mov dl, 1
mov eax, dword [0x417bc0]
call fcn.0040337c
mov edi, eax
mov byte [ebp - 1], 0
push 0
push 0x51377c
call sub.kernel32.dll_WinExec
push 0
push 0x513798
call sub.kernel32.dll_WinExec
push 0
push 0x5137b4
call sub.kernel32.dll_WinExec
push 0
push 0x5137d0
call sub.kernel32.dll_WinExec
push 0x12c
call sub.kernel32.dll_Sleep_1
mov eax, 0x5137f4
call fcn.00409288
test al, al
je 0x5135fb
mov edx, 0x5137f4
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x68]
lea edx, [ebp - 0x14]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.0040863c
mov eax, dword [ebp - 0x10]
push eax
lea edx, [ebp - 0x18]
mov eax, 0x513808
call fcn.0040863c
mov eax, dword [ebp - 0x18]
pop edx
call fcn.004047e4
test eax, eax
mov eax, 0x513828
call fcn.00409288
test al, al
jne 0x513618
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x513750
mov edx, 0x513828
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x68]
lea edx, [ebp - 0x20]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.0040863c
mov eax, dword [ebp - 0x1c]
push eax
lea edx, [ebp - 0x24]
mov eax, 0x51383c
call fcn.0040863c
mov eax, dword [ebp - 0x24]
pop edx
call fcn.004047e4
test eax, eax
jle 0x513690
lea edx, [ebp - 0x2c]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
call fcn.0040863c
mov eax, dword [ebp - 0x28]
push eax
lea edx, [ebp - 0x30]
mov eax, 0x51385c
call fcn.0040863c
mov eax, dword [ebp - 0x30]
pop edx
call fcn.004047e4
test eax, eax
jle 0x513690
mov bl, 1
mov byte [ebp - 1], 1
cmp byte [ebp - 1], 0
je 0x5136fc
mov eax, 0x513874
call fcn.00409288
test al, al
jne 0x5136c9
push 0
push 0x513880
lea eax, [ebp - 0x34]
mov ecx, 0x513894
mov edx, dword [ebp - 8]
call fcn.004044ec
mov eax, dword [ebp - 0x34]
call fcn.004046a0
push eax
call sub.kernel32.dll_CopyFileA
mov eax, 0x5138a4
call fcn.00409288
test al, al
jne 0x5136fc
push 0
push 0x5138b0
lea eax, [ebp - 0x38]
mov ecx, 0x5138c4
mov edx, dword [ebp - 8]
call fcn.004044ec
mov eax, dword [ebp - 0x38]
call fcn.004046a0
push eax
call sub.kernel32.dll_CopyFileA
push 0
push 0x5138d0
call sub.kernel32.dll_WinExec
push 0
push 0x5138ec
call sub.kernel32.dll_WinExec
push 0
push 0x513908
call sub.kernel32.dll_WinExec
push 0
push 0x513924
call sub.kernel32.dll_WinExec
mov eax, esi
call fcn.004033ac
mov eax, edi
call fcn.004033ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x513750
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x513772
lea eax, [ebp - 0x38]
mov edx, 0xd
call fcn.00404204
ret