Function at 0x51ace4
Capabilities:
Copy file
Create process on windows
Manipulate boot configuration

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x51acec
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x51af43
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x51af1c
push dword fs:[edx]
mov dword fs:[edx], esp
xor ebx, ebx
lea edx, [ebp - 0xc]
mov eax, dword [0x55e810]
mov eax, dword [eax]
call fcn.0049062c
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.004094b0
mov dl, 1
mov eax, dword [0x417b98]
call fcn.0040337c
mov esi, eax
mov dl, 1
mov eax, dword [0x417b98]
call fcn.0040337c
mov edi, eax
mov byte [ebp - 1], 0
push 0
push 0x51af54
call sub.kernel32.dll_WinExec
push 0
push 0x51af70
call sub.kernel32.dll_WinExec
push 0
push 0x51af8c
call sub.kernel32.dll_WinExec
push 0
push 0x51afa8
call sub.kernel32.dll_WinExec
push 0x12c
call sub.kernel32.dll_Sleep_1
mov eax, 0x51afcc
call fcn.00409270
test al, al
je 0x51add3
mov edx, 0x51afcc
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x68]
lea edx, [ebp - 0x14]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.00408624
mov eax, dword [ebp - 0x10]
push eax
lea edx, [ebp - 0x18]
mov eax, 0x51afe0
call fcn.00408624
mov eax, dword [ebp - 0x18]
pop edx
call fcn.004047e4
test eax, eax
mov eax, 0x51b000
call fcn.00409270
test al, al
jne 0x51adf0
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x51af28
mov edx, 0x51b000
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x68]
lea edx, [ebp - 0x20]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.00408624
mov eax, dword [ebp - 0x1c]
push eax
lea edx, [ebp - 0x24]
mov eax, 0x51b014
call fcn.00408624
mov eax, dword [ebp - 0x24]
pop edx
call fcn.004047e4
test eax, eax
jle 0x51ae68
lea edx, [ebp - 0x2c]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
call fcn.00408624
mov eax, dword [ebp - 0x28]
push eax
lea edx, [ebp - 0x30]
mov eax, 0x51b034
call fcn.00408624
mov eax, dword [ebp - 0x30]
pop edx
call fcn.004047e4
test eax, eax
jle 0x51ae68
mov bl, 1
mov byte [ebp - 1], 1
cmp byte [ebp - 1], 0
je 0x51aed4
mov eax, 0x51b04c
call fcn.00409270
test al, al
jne 0x51aea1
push 0
push 0x51b058
lea eax, [ebp - 0x34]
mov ecx, 0x51b06c
mov edx, dword [ebp - 8]
call main
mov eax, dword [ebp - 0x34]
call fcn.004046a0
push eax
call sub.kernel32.dll_CopyFileA
mov eax, 0x51b07c
call fcn.00409270
test al, al
jne 0x51aed4
push 0
push 0x51b088
lea eax, [ebp - 0x38]
mov ecx, 0x51b09c
mov edx, dword [ebp - 8]
call main
mov eax, dword [ebp - 0x38]
call fcn.004046a0
push eax
call sub.kernel32.dll_CopyFileA
push 0
push 0x51b0a8
call sub.kernel32.dll_WinExec
push 0
push 0x51b0c4
call sub.kernel32.dll_WinExec
push 0
push 0x51b0e0
call sub.kernel32.dll_WinExec
push 0
push 0x51b0fc
call sub.kernel32.dll_WinExec
mov eax, esi
call fcn.004033ac
mov eax, edi
call fcn.004033ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x51af28
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51af4a
lea eax, [ebp - 0x38]
mov edx, 0xd
call fcn.00404204
ret