Function at 0x4157f0
Capabilities:
Accept command line arguments
Delete file
Get common file path
Link many functions at runtime
Query environment variable
Set current directory
Set global application hook

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa4c
mov eax, dword [0x4920c0]
xor eax, esp
mov dword [esp + 0xa48], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 2
mov dword [0x4959f8], eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_MonitorFromWindow]
mov dword [0x494634], eax
push 0x208
lea eax, [esp + 0x234]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
lea ecx, [esp + 0x230]
lea edx, [ecx + 2]
jmp 0x415850
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x415850
sub ecx, edx
sar ecx, 1
lea eax, [ecx - 1]
test eax, eax
jle 0x415880
jmp 0x415870
cmp word [esp + eax*2 + 0x230], 0x5c
je 0x415880
dec eax
test eax, eax
jg 0x415870
add eax, eax
cmp eax, 0x410
jae 0x4169eb
xor ecx, ecx
mov word [esp + eax + 0x230], cx
cmp word [esp + 0x230], cx
je 0x4158bf
lea ecx, [esp + 0x230]
lea edx, [ecx + 2]
jmp 0x4158b0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4158b0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [esp + 0x234]
push eax
mov ecx, 0x495cbc
call fcn.004023a0
lea eax, [esp + 0x230]
push eax
push str._sTBWinPE.ini
push 0x495458
call fcn.00409780
add esp, 0xc
lea eax, [esp + 0x640]
push eax
push 0x208
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
cmp word [esp + 0x640], 0
jne 0x41590e
xor ecx, ecx
jmp 0x41592f
lea ecx, [esp + 0x640]
lea edx, [ecx + 2]
jmp 0x415920
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x415920
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [esp + 0x644]
push eax
mov ecx, 0x495ca4
call fcn.004023a0
lea eax, [esp + 0x230]
push eax
lea eax, [esp + 0x644]
push 0x46b878
push eax
call fcn.00409780
add esp, 0xc
lea eax, [esp + 0x640]
push eax
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryW]
push str.config
mov edx, 0x495cbc
lea ecx, [esp + 0x14]
call fcn.004097c0
mov esi, eax
add esp, 4
cmp esi, 0x495cd4
je 0x4159cb
cmp dword [0x495ce8], 8
jb 0x4159a4
push dword [0x495cd4]
call fcn.00450920
add esp, 4
xor eax, eax
push esi
mov ecx, 0x495cd4
mov dword [0x495ce8], 7
mov dword [0x495ce4], 0
mov word [0x495cd4], ax
call fcn.004091d0
cmp dword [esp + 0x24], 8
jb 0x4159de
push dword [esp + 0x10]
call fcn.00450920
add esp, 4
call fcn.00412b60
push str.DISM.log
mov edx, 0x495cbc
lea ecx, [esp + 0x14]
call fcn.004097c0
mov edi, eax
mov esi, 0x495d94
add esp, 4
cmp edi, esi
je 0x415a3f
cmp dword [0x495da8], 8
jb 0x415a1b
push dword [0x495d94]
call fcn.00450920
add esp, 4
xor eax, eax
push edi
mov ecx, esi
mov dword [0x495da8], 7
mov dword [0x495da4], 0
mov word [0x495d94], ax
call fcn.004091d0
cmp dword [esp + 0x24], 8
jb 0x415a52
push dword [esp + 0x10]
call fcn.00450920
add esp, 4
cmp byte [0x493129], 0
mov edi, dword [sym.imp.KERNEL32.DLL_DeleteFileW]
je 0x415a72
cmp dword [0x495da8], 8
cmovae esi, dword [0x495d94]
push esi
call edi
lea eax, [esp + 0x230]
push eax
push str._sTBWinPE.log
push 0x495048
call fcn.00409780
add esp, 0xc
cmp byte [0x4930d9], 0
je 0x415a9c
push 0x495048
call edi
mov ebx, 1
mov edx, ebx
mov ecx, str.___________________________________________________________________________
call fcn.0040da30
push 0x46c514
push 0x46c4ec
push str._s_v_s
push 0x494648
call fcn.00409980
add esp, 0x10
mov edx, ebx
mov ecx, 0x494648
call fcn.0040da30
mov edx, ebx
mov ecx, str.Initializing
call fcn.0040da30
push str.Use_default
push 0
push 0
call fcn.0040cc30
push str.96__100__
push 0x60
push ebx
call fcn.0040cc30
push str.120__125__
push 0x78
push 2
call fcn.0040cc30
push str.144__150__
push 0x90
push 3
call fcn.0040cc30
push str.168__175__
push 0xa8
push 4
call fcn.0040cc30
push str.192__200__
push 0xc0
push 5
call fcn.0040cc30
push str.240__250__
push 0xf0
push 6
call fcn.0040cc30
push str.288__300__
push 0x120
push 7
call fcn.0040cc30
mov eax, dword [0x495b38]
cmp eax, 5
jl 0x4169af
jne 0x415b7b
cmp dword [0x495b3c], ebx
jl 0x4169af
push 1
lea eax, [esp + 0x14]
push eax
mov ecx, 0x495b38
call fcn.0040d3b0
mov ecx, eax
cmp dword [ecx + 0x14], 8
jb 0x415b96
mov ecx, dword [ecx]
cmp dword [0x495ba4], 8
push ecx
mov eax, 0x495b90
cmovae eax, dword [0x495b90]
push eax
push str.Windows_version:__s___s
push 0x494648
call fcn.00409980
add esp, 0x10
cmp dword [esp + 0x24], 8
jb 0x415bd0
push dword [esp + 0x10]
call fcn.00450920
add esp, 4
cmp byte [0x495bc0], 0
jne 0x415be7
cmp byte [0x495bc1], 0
mov eax, str.__x86_
je 0x415bec
mov eax, str.__x64_
push eax
push 0x500
push 0x494648
call fcn.00451274
add esp, 0xc
mov edx, ebx
mov ecx, 0x494648
call fcn.0040da30
mov edi, dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
push str.kernel32.dll
mov dword [0x494624], 0
mov dword [0x49460c], 0
mov dword [0x494608], 0
call edi
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [0x494624], eax
test eax, eax
je 0x415c6e
push str.Wow64DisableWow64FsRedirection
push eax
call esi
push str.Wow64RevertWow64FsRedirection
push dword [0x494624]
mov dword [0x49460c], eax
call esi
mov ecx, eax
mov eax, dword [0x494624]
mov dword [0x494608], ecx
jmp 0x415c74
mov ecx, dword [0x494608]
cmp byte [0x495bc1], 0
je 0x415ccd
cmp dword [0x49460c], 0
je 0x415c8a
test ecx, ecx
jne 0x415ccd
push eax
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
mov edx, ebx
mov ecx, str.Error:_TBWinPE_RE_Builder_was_unable_to_link_to_required_functions__kernel32.dll_
call fcn.0040da30
push 0x10
push str.Error
push str.TBWinPE_RE_Builder_was_unable_to_link_to_required_functions__kernel32.dll_.
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 4
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xa48]
xor ecx, esp
call fcn.0044fdac
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [0x495b38]
mov dword [0x494618], 0
mov dword [0x494600], 0
mov dword [0x4945fc], 0
cmp eax, 6
jg 0x415cff
jne 0x415d58
cmp dword [0x495b3c], ebx
jl 0x415d58
push str.Advapi32.dll
call edi
mov dword [0x494618], eax
test eax, eax
je 0x415d38
push str.RegGetValueW
push eax
call esi
push str.RegLoadAppKeyW
push dword [0x494618]
mov dword [0x494600], eax
call esi
mov ecx, eax
mov eax, dword [0x494618]
mov dword [0x4945fc], ecx
jmp 0x415d3e
mov ecx, dword [0x4945fc]
cmp dword [0x494600], 0
je 0x416979
test ecx, ecx
je 0x416979
mov eax, dword [0x495b38]
mov dword [0x494628], 0
mov dword [0x494610], 0
cmp eax, 6
jl 0x415daa
push str.Comctl32.dll
call edi
mov dword [0x494628], eax
test eax, eax
je 0x415d90
push str.LoadIconWithScaleDown
push eax
call esi
mov dword [0x494610], eax
jmp 0x415d95
mov eax, dword [0x494610]
test eax, eax
jne 0x415da5
mov edx, ebx
mov ecx, str.Warning:_TBWinPE_RE_Builder_was_unable_to_link_to_functions__ComCtrl32.dll_
call fcn.0040da30
mov eax, dword [0x495b38]
mov dword [0x494620], 0
mov dword [0x494604], 0
cmp eax, 6
jg 0x415dcd
jne 0x415e01
cmp dword [0x495b3c], ebx
jl 0x415e01
push str.user32.dll
call edi
mov dword [0x494620], eax
test eax, eax
je 0x415dec
push str.ChangeWindowMessageFilterEx
push eax
call esi
mov dword [0x494604], eax
jmp 0x415df1
mov eax, dword [0x494604]
test eax, eax
jne 0x415e01
mov edx, ebx
mov ecx, str.Warning:_TBWinPE_RE_Builder_was_unable_to_link_to_functions__user32.dll_
call fcn.0040da30
push str.wlanapi.dll
mov dword [0x494614], 0
mov dword [0x4945f8], 0
mov dword [0x4945f4], 0
mov dword [0x4945f0], 0
mov dword [0x4945ec], 0
mov dword [0x4945e8], 0
mov dword [0x4945e4], 0
mov dword [0x4945e0], 0
call edi
mov ebx, dword [sym.imp.KERNEL32.DLL_FreeLibrary]
mov dword [0x494614], eax
test eax, eax
je 0x415f79
push str.WlanCloseHandle
push eax
call esi
push str.WlanEnumInterfaces
push dword [0x494614]
mov dword [0x4945f8], eax
call esi
push str.WlanFreeMemory
push dword [0x494614]
mov dword [0x4945f4], eax
call esi
push str.WlanGetProfile
push dword [0x494614]
mov dword [0x4945f0], eax
call esi
push str.WlanGetProfileList
push dword [0x494614]
mov dword [0x4945ec], eax
call esi
push str.WlanOpenHandle
push dword [0x494614]
mov dword [0x4945e8], eax
call esi
push str.WlanQueryInterface
push dword [0x494614]
mov dword [0x4945e4], eax
call esi
mov edx, eax
mov al, 1
movzx ecx, al
xor eax, eax
cmp dword [0x4945f8], eax
mov dword [0x4945e0], edx
cmove ecx, eax
cmp dword [0x4945f4], eax
movzx ecx, cl
cmove ecx, eax
movzx eax, cl
xor ecx, ecx
cmp dword [0x4945f0], ecx
cmove eax, ecx
cmp dword [0x4945ec], ecx
movzx eax, al
cmove eax, ecx
cmp dword [0x4945e8], ecx
movzx eax, al
cmove eax, ecx
cmp dword [0x4945e4], ecx
movzx eax, al
cmove eax, ecx
test edx, edx
je 0x415f3d
test al, al
jne 0x415f79
push dword [0x494614]
mov dword [0x4945f8], ecx
mov dword [0x4945f4], ecx
mov dword [0x4945f0], ecx
mov dword [0x4945ec], ecx
mov dword [0x4945e8], ecx
mov dword [0x4945e4], ecx
mov dword [0x4945e0], ecx
call ebx
mov dword [0x494614], 0
push str.riched20.dll
mov dword [0x49461c], 0
call edi
push 0
mov dword [0x49461c], eax
call dword [sym.imp.USER32.dll_GetDC]
mov esi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov edi, eax
push 0x58
push edi
call esi
movd xmm0, eax
cvtdq2pd xmm0, xmm0
push 0x5a
divsd xmm0, qword [0x48c710]
push edi
movsd qword [0x493048], xmm0
call esi
movd xmm0, eax
cvtdq2pd xmm0, xmm0
push edi
divsd xmm0, qword [0x48c710]
push 0
movsd qword [0x493040], xmm0
call dword [sym.imp.USER32.dll_ReleaseDC]
cmp dword [0x495b38], 6
mov ecx, 0x1f4
mov eax, 0x1f8
cmovl eax, ecx
push 0
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x3c]
push eax
push 0x1f8
push 0x29
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov edi, dword [sym.imp.GDI32.dll_CreateFontIndirectW]
lea eax, [esp + 0x1d0]
push eax
mov dword [esp + 0x1e4], 0x2bc
call edi
movsd xmm0, qword [0x493048]
mulsd xmm0, qword [0x48c6c8]
mov esi, dword [sym.imp.KERNEL32.DLL_MulDiv]
mov dword [0x4945d4], eax
push 0x48
cvttsd2si eax, xmm0
push 0x60
push eax
call esi
neg eax
mov dword [esp + 0x1d0], eax
lea eax, [esp + 0x1d0]
push eax
call edi
movsd xmm0, qword [0x493048]
mulsd xmm0, qword [0x48c6d8]
mov dword [0x4945d8], eax
push 0x48
push 0x60
cvttsd2si eax, xmm0
push eax
call esi
neg eax
mov dword [esp + 0x1d0], eax
lea eax, [esp + 0x1d0]
push eax
call edi
mov dword [0x4945dc], eax
push 0x208
lea eax, [esp + 0x234]
push eax
push str._SystemRoot_
call dword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsW]
lea eax, [esp + 0x230]
push eax
mov ecx, 0x495cec
call fcn.00401f70
call fcn.00411900
mov eax, dword [0x495b38]
cmp eax, 6
jg 0x4160e6
jne 0x41623b
cmp dword [0x495b3c], 1
jl 0x41623b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
mov dword [esp + 0x10], eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
mov dword [esp + 0x34], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x47
mov ebx, eax
call esi
mov edi, eax
push 0x48
mov dword [esp + 0x30], edi
call esi
push 0
push 1
push 1
push eax
push edi
mov dword [esp + 0x3c], eax
call dword [sym.imp.GDI32.dll_CreateBitmap]
mov esi, dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, eax
mov dword [0x4945d0], ecx
test ecx, ecx
je 0x4161b9
push ecx
push ebx
call esi
mov ecx, dword [esp + 0x28]
push 0xff0062
push ecx
push dword [esp + 0x34]
mov edi, eax
push 0
push 0
push ebx
call dword [sym.imp.GDI32.dll_PatBlt]
push 5
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
push ebx
call esi
push dword [esp + 0x28]
mov esi, eax
push dword [esp + 0x30]
push 0
push 0
push ebx
call dword [sym.imp.GDI32.dll_Rectangle]
push 4
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [esp + 0x28]
add eax, 0xfffffffc
push eax
mov eax, dword [esp + 0x30]
add eax, 0xfffffffc
push eax
push 4
push 4
push ebx
call dword [sym.imp.GDI32.dll_Rectangle]
push esi
mov esi, dword [sym.imp.GDI32.dll_SelectObject]
push ebx
call esi
push edi
push ebx
call esi
mov edi, dword [esp + 0x2c]
push 0
push 1
push 1
push dword [esp + 0x34]
push edi
call dword [sym.imp.GDI32.dll_CreateBitmap]
mov dword [0x4945cc], eax
test eax, eax
je 0x416220
push eax
push ebx
call esi
push 0xff0062
push dword [esp + 0x2c]
mov edi, eax
push dword [esp + 0x34]
push 0
push 0
push ebx
call dword [sym.imp.GDI32.dll_PatBlt]
push 5
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
push ebx
call esi
push dword [esp + 0x28]
mov esi, eax
push dword [esp + 0x30]
push 0
push 0
push ebx
call dword [sym.imp.GDI32.dll_Rectangle]
push esi
mov esi, dword [sym.imp.GDI32.dll_SelectObject]
push ebx
call esi
push edi
push ebx
call esi
push ebx
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [esp + 0x30]
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ebx, dword [sym.imp.KERNEL32.DLL_FreeLibrary]
push 6
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
push eax
push 0
push 0x416a00
push 3
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov edi, dword [sym.imp.KERNEL32.DLL_GetCommandLineW]
mov dword [0x494630], eax
lea eax, [esp + 0x34]
push eax
call edi
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
test esi, esi
je 0x416810
cmp dword [esp + 0x34], 1
jle 0x416810
mov edx, 1
mov ecx, str.Initialization_complete
call fcn.0040da30
call edi
push eax
push str.Processing_command_line:__s
push 0x494648
call fcn.00409980
mov edi, 1
add esp, 0xc
mov edx, edi
mov ecx, 0x494648
call fcn.0040da30
push ecx
push esi
push dword [esp + 0x3c]
call fcn.004012a0
push esi
call dword [sym.imp.KERNEL32.DLL_LocalFree]
push edi
sub esp, 0x18
mov ecx, esp
push str.bootwim
call fcn.00401ec0
call fcn.004016d0
push edi
sub esp, 0x18
mov ecx, esp
push str.build
call fcn.00401ec0
call fcn.004016d0
push edi
sub esp, 0x18
mov ecx, esp
push str.create
call fcn.00401ec0
call fcn.004016d0
push edi
sub esp, 0x18
mov ecx, esp
push 0x472afc
call fcn.00401ec0
call fcn.004016d0
sub esp, 0x18
mov ecx, esp
push str.bootwim
xor esi, esi
call fcn.00401ec0
call fcn.00401910
test al, al
cmovne esi, edi
sub esp, 0x18
mov ecx, esp
push str.build
call fcn.00401ec0
call fcn.00401910
test al, al
je 0x416358
inc esi
sub esp, 0x18
mov ecx, esp
push str.create
call fcn.00401ec0
call fcn.00401910
test al, al
je 0x416371
inc esi
cmp esi, 1
jne 0x4165f5
sub esp, 0x18
mov ecx, esp
push str.bootwim
call fcn.00401ec0
call fcn.00401910
test al, al
je 0x4164be
call fcn.00401620
push esi
sub esp, 0x18
mov ecx, esp
push str.bootwim
call fcn.00401ec0
call fcn.004016d0
push 0
sub esp, 0x18
mov ecx, esp
push 0x472b00
call fcn.00401ec0
call fcn.004016d0
push 0
sub esp, 0x18
mov ecx, esp
push str.noboot
call fcn.00401ec0
call fcn.004016d0
push esi
sub esp, 0x18
mov ecx, esp
push str.status
call fcn.00401ec0
call fcn.004016d0
push 0
sub esp, 0x18
mov ecx, esp
push str.reset
call fcn.00401ec0
call fcn.004016d0
push 0
sub esp, 0x18
mov ecx, esp
push str.quiet
call fcn.00401ec0
call fcn.004016d0
push esi
sub esp, 0x18
mov ecx, esp
push str.force
call fcn.00401ec0
call fcn.004016d0
push esi
sub esp, 0x18
mov ecx, esp
push 0x472b54
call fcn.00401ec0
call fcn.004016d0
push 0
sub esp, 0x18
mov ecx, esp
push 0x472b5c
call fcn.00401ec0
call fcn.004016d0
push 0
sub esp, 0x18
mov ecx, esp
push 0x472b64
call fcn.00401ec0
call fcn.004016d0
push esi
sub esp, 0x18
mov ecx, esp
push 0x472b6c
call fcn.00401ec0
call fcn.004016d0
push 0
sub esp, 0x18
mov ecx, esp
push str.rebuild
call fcn.00401ec0
call fcn.004016d0
push 0
sub esp, 0x18
mov ecx, esp
push 0x472afc
call fcn.00401ec0
call fcn.004016d0
call fcn.00444230
jmp 0x416871
sub esp, 0x18
mov ecx, esp
push str.build
call fcn.00401ec0
call fcn.00401910
test al, al
jne 0x4164f2
sub esp, 0x18
mov ecx, esp
push str.create
call fcn.00401ec0
call fcn.00401910
test al, al
je 0x4165f5
call fcn.00401620
push 0
sub esp, 0x18
mov ecx, esp
push str.build
call fcn.00401ec0
call fcn.004016d0
push 0
sub esp, 0x18
mov ecx, esp
push str.create
call fcn.00401ec0
call fcn.004016d0
push 0
sub esp, 0x18
mov ecx, esp
push str.tbwinre
call fcn.00401ec0
call fcn.004016d0
push 0
sub esp, 0x18
mov ecx, esp
push str.tbwinpe
call fcn.00401ec0
call fcn.004016d0
push 0
sub esp, 0x18
mov ecx, esp
push 0x472ba4
call fcn.00401ec0
call fcn.004016d0
push 0
sub esp, 0x18
mov ecx, esp
push 0x472bac
call fcn.00401ec0
call fcn.004016d0
push 0
sub esp, 0x18
mov ecx, esp
push 0x472bb4
call fcn.00401ec0
call fcn.004016d0
push 1
sub esp, 0x18
mov ecx, esp
push 0x472b6c
call fcn.00401ec0
call fcn.004016d0
push 0
sub esp, 0x18
mov ecx, esp
push str.rebuild
call fcn.00401ec0
call fcn.004016d0
push 0
sub esp, 0x18
mov ecx, esp
push 0x472bbc
call fcn.00401ec0
call fcn.004016d0
push 0
sub esp, 0x18
mov ecx, esp
push 0x472afc
call fcn.00401ec0
call fcn.004016d0
xor ecx, ecx
call fcn.0041f7b0
jmp 0x416871
sub esp, 0x18
mov ecx, esp
push 0x472afc
call fcn.00401ec0
call fcn.00401910
test al, al
je 0x416728
call fcn.0044da10
push str._rtf1_ansipard_n
lea ecx, [esp + 0x14]
call fcn.00401de0
lea eax, [esp + 0x10]
push eax
call fcn.0044d890
lea ecx, [esp + 0x10]
call fcn.00401e40
push str.qc__b_TBWinPE_RE_Builder_Command_Line_Usageparparpar_n
lea ecx, [esp + 0x14]
call fcn.00401de0
lea eax, [esp + 0x10]
push eax
call fcn.0044d890
lea ecx, [esp + 0x10]
call fcn.00401e40
push str._fi_1200li1200_tx1200_n
lea ecx, [esp + 0x14]
call fcn.00401de0
lea eax, [esp + 0x10]
push eax
call fcn.0044d890
lea ecx, [esp + 0x10]
call fcn.00401e40
push str.ql__b__bootwim_tab_Boots_a_WIM_file__requires_Windows_7_or_later_par_n
lea ecx, [esp + 0x14]
call fcn.00401de0
lea eax, [esp + 0x10]
push eax
call fcn.0044d890
lea ecx, [esp + 0x10]
call fcn.00401e40
push str.ql__b__build_tab_Creates_unattended_TBWinPE_RE_buildparpar_n
lea ecx, [esp + 0x14]
call fcn.00401de0
lea eax, [esp + 0x10]
push eax
call fcn.0044d890
lea ecx, [esp + 0x10]
call fcn.00401e40
push str.For_detailed_help_on_an_option_specify__b____along_with_the_option.par_n
lea ecx, [esp + 0x14]
call fcn.00401de0
lea eax, [esp + 0x10]
push eax
call fcn.0044d890
lea ecx, [esp + 0x10]
call fcn.00401e40
push str.For_example:_tbwinpe.exe__bootwim___par_n
lea ecx, [esp + 0x14]
call fcn.00401de0
lea eax, [esp + 0x10]
push eax
call fcn.0044d890
lea ecx, [esp + 0x10]
call fcn.00401e40
push 0x472d68
lea ecx, [esp + 0x14]
call fcn.00401de0
lea eax, [esp + 0x10]
push eax
call fcn.0044d890
lea ecx, [esp + 0x10]
call fcn.00401e40
call fcn.00445a30
jmp 0x416871
mov edx, edi
mov ecx, str.Error:_Invalid_or_unsupported_command_line_option_s__specified
mov dword [0x494640], 9
call fcn.0040da30
call fcn.0044da10
push str._rtf1_ansipard_n
lea ecx, [esp + 0x14]
call fcn.00401de0
lea eax, [esp + 0x10]
push eax
call fcn.0044d890
lea ecx, [esp + 0x10]
call fcn.00401e40
push str.qc__b_TBWinPE_RE_Builder_Command_Line_Usageparparpar_n
lea ecx, [esp + 0x14]
call fcn.00401de0
lea eax, [esp + 0x10]
push eax
call fcn.0044d890
lea ecx, [esp + 0x10]
call fcn.00401e40
push str._fi_1200li1200_tx1200_n
lea ecx, [esp + 0x14]
call fcn.00401de0
lea eax, [esp + 0x10]
push eax
call fcn.0044d890
lea ecx, [esp + 0x10]
call fcn.00401e40
push str.ql_Invalid_or_unsupported_command_line_option_s__specified.parpar_n
lea ecx, [esp + 0x14]
call fcn.00401de0
lea eax, [esp + 0x10]
push eax
call fcn.0044d890
lea ecx, [esp + 0x10]
call fcn.00401e40
push str.For_program_usage__run:_tbwinpe.exe___par_n
lea ecx, [esp + 0x14]
call fcn.00401de0
lea eax, [esp + 0x10]
push eax
call fcn.0044d890
lea ecx, [esp + 0x10]
call fcn.00401e40
push 0x472d68
lea ecx, [esp + 0x14]
call fcn.00401de0
lea eax, [esp + 0x10]
push eax
call fcn.0044d890
lea ecx, [esp + 0x10]
call fcn.00401e40
call fcn.00445a30
jmp 0x416871
call fcn.00445ea0
test al, al
je 0x416836
call fcn.004136a0
mov edi, 1
mov edx, edi
mov ecx, str.Initialization_complete
call fcn.0040da30
call fcn.0041f530
jmp 0x416871
mov edi, 1
mov edx, edi
mov ecx, str.Initialization_complete
mov dword [0x494640], 2
call fcn.0040da30
mov edx, edi
mov ecx, str.Error:_Required_files_were_not_found
call fcn.0040da30
push 0x10
push 0x472eb4
push str.Error:_Required_files_were_not_found._Program_will_exit.
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, 0x496cf0
call fcn.0044fbd0
test al, al
je 0x416889
mov ecx, 0x496cf0
call fcn.0044fb80
push dword [0x494640]
push str.Program_exiting_with_code__d
push 0x494648
call fcn.00409980
add esp, 0xc
mov edx, edi
mov ecx, 0x494648
call fcn.0040da30
mov ecx, dword [0x49462c]
test ecx, ecx
je 0x4168bd
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [0x4945d0]
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
test eax, eax
je 0x4168cf
push eax
call esi
mov eax, dword [0x4945cc]
test eax, eax
je 0x4168db
push eax
call esi
mov eax, dword [0x49461c]
test eax, eax
je 0x4168e7
push eax
call ebx
mov eax, dword [0x494624]
test eax, eax
je 0x4168f3
push eax
call ebx
mov eax, dword [0x494628]
test eax, eax
je 0x4168ff
push eax
call ebx
mov eax, dword [0x494620]
test eax, eax
je 0x41690b
push eax
call ebx
mov eax, dword [0x494618]
test eax, eax
je 0x416917
push eax
call ebx
mov eax, dword [0x494614]
test eax, eax
je 0x416923
push eax
call ebx
mov eax, dword [0x4945dc]
test eax, eax
je 0x41692f
push eax
call esi
mov eax, dword [0x4945d8]
test eax, eax
je 0x41693b
push eax
call esi
mov eax, dword [0x4945d4]
test eax, eax
je 0x416947
push eax
call esi
mov eax, dword [0x494630]
test eax, eax
je 0x416957
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [0x494640]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xa48]
xor ecx, esp
call fcn.0044fdac
mov esp, ebp
pop ebp
ret 0x10
mov esi, dword [sym.imp.KERNEL32.DLL_FreeLibrary]
test eax, eax
je 0x416986
push eax
call esi
mov eax, dword [0x494624]
test eax, eax
je 0x416992
push eax
call esi
mov edx, ebx
mov ecx, str.Error:_TBWinPE_RE_Builder_was_unable_to_link_to_required_functions__Advapi32.dll_
call fcn.0040da30
push 0x10
push str.Error
push str.TBWinPE_RE_Builder_was_unable_to_link_to_required_functions__Advapi32.dll_.
jmp 0x415ca9
mov edx, ebx
mov ecx, str.Error:_TBWinPE_RE_Builder_requires_Windows_XP_or_later
call fcn.0040da30
push 0x10
push str.Error
push str.TBWinPE_RE_Builder_requires_Windows_XP_or_later.
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [esp + 0xa54]
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 3
call fcn.0044fdac
mov esp, ebp
pop ebp
ret 0x10
call fcn.0045119a
int3