Function at 0x401000
Capabilities:
Allocate thread local storage

Disassembly:
push 0x1f8
push 0
push 0x43214c
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleW
mov dword [0x432150], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x43214c], eax
call section..text
mov eax, 0x430164
mov dword [0x4321d4], eax
call fcn.00415713
call fcn.00428660
call fcn.00427a91
call fcn.004277a0
call fcn.00425dd0
call fcn.00423f0c
call fcn.004237b0
call fcn.00422fe5
call fcn.004225fc
call fcn.004223ce
call fcn.004222cd
call fcn.00422048
call fcn.004217eb
call fcn.0042111b
call fcn.00420c00
call fcn.0041fefa
call fcn.0041e326
call fcn.00418ad4
call fcn.00418829
call fcn.004184f0
call fcn.004176bd
call fcn.00416bf1
call fcn.00416499
call fcn.00415b5c
call fcn.00415876
mov dword [0x4322e0], 0x302
mov dword [0x4321f8], 0x1fe
mov dword [0x4321c0], 0
lea ebp, [0x432310]
mov dword [ebp], 0x1c
mov dword [ebp + 4], 0x17
push edx
call fcn.004286b0
pop edx
push eax
push edx
call fcn.004286b0
pop edx
push eax
mov eax, str.SYSTEMROOT
push eax
call fcn.00416c20
push 0x43221c
call fcn.004286f0
push edx
call fcn.004286b0
pop edx
push eax
push edx
call fcn.004286b0
pop edx
push eax
mov eax, str.SYSTEMDRIVE
push eax
call fcn.00416c20
lea eax, [0x4321a4]
push 2
push eax
call fcn.00428780
push edx
call fcn.004286b0
pop edx
push eax
push edx
call fcn.004286b0
pop edx
push eax
call fcn.00420086
mov edx, str.EasyWinSetupWimGAPI.log
push edx
call fcn.004287f0
push 0x4322f8
call fcn.004286f0
push edx
call fcn.004286b0
pop edx
push eax
push edx
call fcn.004286b0
pop edx
push eax
push edx
call fcn.004286b0
pop edx
push eax
push edx
call fcn.004286b0
pop edx
push eax
call fcn.00416c5d
call fcn.00415372
add dword [esp], edx
call fcn.004200e9
mov edx, str.EWS_xSET.ini
push edx
call fcn.004287f0
push 0x4321cc
call fcn.004286f0
mov byte [0x432308], 0
mov byte [0x43230b], 0
mov byte [0x432304], 0
mov byte [0x432306], 0
mov byte [0x43230c], 0
mov byte [0x432307], 0
mov dword [0x432174], 0
mov byte [0x43230a], 3
mov byte [0x432305], 0
mov byte [0x432309], 0
mov word [0x432300], 0xffff
mov dword [0x4321ec], 0
mov edx, str.Consolas
lea ecx, [0x432264]
call fcn.00415068
mov word [0x432302], 0xfff5
mov dword [0x4321fc], 0
mov dword [0x43215c], 0
mov dword [0x432284], 0
mov dword [0x432180], 0
mov dword [0x4322dc], 0
mov dword [0x4321b0], 0
push 0x43232c
push 0
push 0xa
push 3
push 0x208
call fcn.00422071
push 0x432334
push 0x430108
push 8
push 3
push 4
call fcn.00422071
mov ebp, dword [0x43232c]
lea eax, [ebp]
mov edx, 0x42c02e
push edx
push 0x104
push eax
call fcn.004287c0
lea eax, [ebp + 0x208]
mov edx, 0x42c02e
push edx
push 0x104
push eax
call fcn.004287c0
mov ebp, dword [0x432334]
mov edx, 0x42c02e
lea ecx, [ebp]
call fcn.00415068
mov edx, 0x42c02e
lea ecx, [ebp + 4]
call fcn.00415068
push 8
push 0x430108
lea eax, [0x43233c]
push eax
push 4
call fcn.0042261b
mov dword [0x432214], 0xffffffff
push 0x73
push 0xd7
push 0x96
call fcn.004222d9
mov dword [0x432210], eax
push 0xb4
push 0x5a
push 0x73
call fcn.004222d9
mov dword [0x4322b4], eax
mov dword [0x4322ac], 0xffffffff
mov dword [0x43222c], 0xffffffff
push 0xdf
push 0xe8
push 0xe1
call fcn.004222d9
mov dword [0x432228], eax
mov dword [0x432260], 0xffffffff
mov dword [0x43225c], 0xc0fecb
mov dword [0x43216c], 0xffffffff
push 0xdc
push 0xe1
push 0xe1
call fcn.004222d9
mov dword [0x432164], eax
mov dword [0x432238], 0xffffffff
push 0xe1
push 0xfe
push 0xfe
call fcn.004222d9
mov dword [0x432230], eax
mov dword [0x432254], 0xffffffff
push 0xe1
push 0xfe
push 0xfe
call fcn.004222d9
mov dword [0x432250], eax
mov dword [0x4321e0], 0xffffffff
push 0xe0
push 0xf5
push 0xfe
call fcn.004222d9
mov dword [0x4321dc], eax
mov dword [0x432194], 0xffffffff
push 0xf6
push 0xfa
push 0xfb
call fcn.004222d9
mov dword [0x43218c], eax
mov edx, 0x42c02e
lea ecx, [0x4322c8]
call fcn.00415068
mov edx, dword [0x4322c8]
push edx
call fcn.004286b0
pop edx
push eax
push edx
call fcn.004287f0
mov edx, str.EasyWinSetup___20H1_ADK___WimGAPI_v
push edx
call fcn.004287f0
push edx
call fcn.004286b0
pop edx
push eax
push 0
push 1
mov edx, dword [0x43221c]
push edx
call fcn.004286b0
pop edx
push eax
push edx
call fcn.004287f0
mov edx, str.System32wimgapi.dll
push edx
call fcn.004287f0
call fcn.00415372
add dword [esp], edx
call fcn.0040f1a6
pop eax
push 0x4322c8
call fcn.004286f0
call fcn.004113db
push dword [0x4322c8]
mov eax, str.EasyWinSetupA222BF37_F016_4763_9C46_A95167A9BBBA
push eax
call fcn.00409a7b
call fcn.00409152
push dword [0x4321f8]
push dword [0x4322e0]
push 0
push 0
call fcn.0040d20c
mov dword [0x4321b0], eax
mov ebx, dword [0x4321b0]
and ebx, ebx
jne 0x401506
call fcn.004065df
call fcn.0040f7cd
call fcn.00404b36
movsx ebx, byte [0x43230a]
cmp ebx, 2
jge 0x401529
movsx eax, byte [0x43230a]
push eax
call fcn.00404871
push dword [0x4321b0]
jmp 0x401536
call 0x401550
call fcn.00428690
push dword [0x43214c]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess
call fcn.00415834
call fcn.004176ab
call fcn.0041881d
call fcn.00418a7e
call fcn.0041e303
call fcn.0041fee9
call fcn.00420168
call fcn.00420bf0
call fcn.004210fd
call fcn.004223c2
call fcn.00422fd8
call fcn.00425df0
call fcn.00427b1f
call fcn.00427c64
call fcn.00427790
ret