Function at 0x51bcf4
Capabilities:
Copy file
Create process on windows
Manipulate boot configuration

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x51bcfc
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x51c12a
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0051ace4
test al, al
je 0x51c10f
xor eax, eax
push ebp
push 0x51c105
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x417b98]
call fcn.0040337c
mov dword [ebp - 4], eax
mov dl, 1
mov eax, dword [0x417b98]
call fcn.0040337c
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x51be03
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x51c138
call sub.kernel32.dll_WinExec
push 0
push 0x51c154
call sub.kernel32.dll_WinExec
push 0
push 0x51c170
call sub.kernel32.dll_WinExec
push 0
push 0x51c18c
call sub.kernel32.dll_WinExec
push 0
push 0x51c1a8
call sub.kernel32.dll_WinExec
push 0
push 0x51c1c8
call sub.kernel32.dll_WinExec
push 0x3e8
call sub.kernel32.dll_Sleep_1
mov eax, 0x51c1f0
call fcn.00409270
test al, al
jne 0x51bde1
mov eax, 0x51c208
call fcn.00409270
test al, al
je 0x51bde1
mov eax, 0x51c21c
call fcn.00409270
test al, al
je 0x51bde1
mov eax, 0x51c208
call fcn.004093c0
mov eax, 0x51c21c
call fcn.00409270
test al, al
je 0x51bdf9
mov eax, 0x51c21c
call fcn.004093c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x51be0d
xor eax, eax
push ebp
push 0x51beff
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x51c230
call fcn.00409270
test al, al
je 0x51be3f
push 0
push 0x51c240
push 0x51c24c
call sub.kernel32.dll_CopyFileA
jmp 0x51bef5
mov eax, 0x51c264
call fcn.00409270
test al, al
je 0x51bef5
mov edx, 0x51c264
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x68]
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.00408624
mov eax, dword [ebp - 0xc]
push eax
lea edx, [ebp - 0x14]
mov eax, 0x51c278
call fcn.00408624
mov eax, dword [ebp - 0x14]
pop edx
call fcn.004047e4
test eax, eax
jle 0x51bee8
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x51bee8
inc esi
xor ebx, ebx
lea ecx, [ebp - 0x1c]
mov edx, ebx
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.00408624
mov eax, dword [ebp - 0x18]
push eax
lea edx, [ebp - 0x20]
mov eax, 0x51c278
call fcn.00408624
mov eax, dword [ebp - 0x20]
pop edx
call fcn.004047e4
test eax, eax
jle 0x51bee4
mov edx, ebx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x48]
inc ebx
dec esi
jne 0x51bea4
mov edx, 0x51c264
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x74]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x51bf09
xor eax, eax
push ebp
push 0x51c099
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x51c1f0
call fcn.00409270
test al, al
je 0x51bf3b
push 0
push 0x51c290
push 0x51c29c
call sub.kernel32.dll_CopyFileA
jmp 0x51c08f
mov eax, 0x51c208
call fcn.00409270
test al, al
je 0x51c08f
mov edx, 0x51c208
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x68]
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x24]
call fcn.00408624
mov eax, dword [ebp - 0x24]
push eax
lea edx, [ebp - 0x2c]
mov eax, 0x51c2b4
call fcn.00408624
mov eax, dword [ebp - 0x2c]
pop edx
call fcn.004047e4
test eax, eax
jle 0x51c08f
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x51c08f
inc esi
xor ebx, ebx
lea ecx, [ebp - 0x34]
mov edx, ebx
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x34]
lea edx, [ebp - 0x30]
call fcn.00408624
mov eax, dword [ebp - 0x30]
push eax
lea edx, [ebp - 0x38]
mov eax, 0x51c2b4
call fcn.00408624
mov eax, dword [ebp - 0x38]
pop edx
call fcn.004047e4
test eax, eax
jle 0x51c087
mov esi, ebx
sub esi, 2
test esi, esi
jle 0x51bff5
mov edx, esi
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov esi, ebx
dec esi
test esi, esi
jle 0x51c006
mov edx, esi
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov edx, ebx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
lea esi, [ebx + 1]
cmp eax, esi
jl 0x51c02a
mov edx, esi
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
lea esi, [ebx + 2]
cmp eax, esi
jl 0x51c044
mov edx, esi
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
lea esi, [ebx + 3]
cmp eax, esi
jl 0x51c05e
mov edx, esi
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
lea esi, [ebx + 4]
cmp eax, esi
jl 0x51c078
mov edx, esi
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov edx, 0x51c208
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x74]
jmp 0x51c08f
inc ebx
dec esi
jne 0x51bfa8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x51c0a3
mov eax, dword [ebp - 4]
call fcn.004033ac
mov eax, dword [ebp - 8]
call fcn.004033ac
push 0
push 0x51c2cc
call sub.kernel32.dll_WinExec
push 0
push 0x51c2e8
call sub.kernel32.dll_WinExec
push 0
push 0x51c304
call sub.kernel32.dll_WinExec
push 0
push 0x51c320
call sub.kernel32.dll_WinExec
push 0
push 0x51c33c
call sub.kernel32.dll_WinExec
push 0
push 0x51c35c
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x51c10f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51c131
lea eax, [ebp - 0x38]
mov edx, 0xc
call fcn.00404204
ret