Thanks guys to all of you! This has been of great help. I finally got the bootloader disassembly by 3 different ways:
1 - Thanks Clive1 for your attachment. That is all what I needed. 2 - Keil's RealView debugger with Keil's Ulink. STmicro's STlink doesn't show the bootloader. 3 - Keil's simulator doesn't show the bootloader, but I could load its intel HEX file in the disassembly window! (I generated the HEX file from the binary download). So far I didn't succed to achieve what I wanted: finding an entry point bypassing the ports setup. Clive1 I tend to accept your suggestion that it would be much easier to re-write a new bootloader from scratch.
I agree with clive. Rewrite the bootloader. The code isn't very clever and you cannot know, where to jump. The addresses of all functions aren't constant. The bootloader has only one advantage. It cannot be destroyed by dumb code, bugs, ...
Meanwhile, I found a very stupid hardware turnaround: a pullup resistor solved the problem... So I'm dropping the whole idea, but the discussion here was very interesting.