Function at 0x405d40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x4c4
mov eax, dword [0x4372c0]
xor eax, esp
mov dword [esp + 0x4bc], eax
push ebx
push ebp
push esi
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0xc2]
xor bl, bl
push ecx
mov byte [esp + 0x23], bl
mov word [esp + 0xc4], ax
call fcn.00419bf0
mov esi, dword [0x427034]
add esp, 0xc
lea edx, [esp + 0x18]
push edx
push 0x20019
push 0
push 0x42a2b0
push 0x80000002
call esi
test eax, eax
jne 0x405e44
mov edi, dword [0x427030]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x3c]
push edx
push 0
push str.UseAlternateShell
push eax
mov dword [esp + 0x38], 4
call edi
mov ecx, dword [esp + 0x18]
mov ebx, dword [0x42702c]
push ecx
call ebx
cmp dword [esp + 0x28], 0
je 0x405e40
lea edx, [esp + 0x18]
push edx
push 0x20019
push 0
push str.systemcurrentcontrolsetcontrol_safeboot
push 0x80000002
call esi
test eax, eax
jne 0x405e40
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0xbc]
push ecx
lea edx, [esp + 0x3c]
push edx
push 0
push str.AlternateShell
push eax
mov dword [esp + 0x38], 0x208
call edi
test eax, eax
je 0x405e39
xor ecx, ecx
mov word [esp + 0xb8], cx
mov edx, dword [esp + 0x18]
push edx
call ebx
mov bl, byte [esp + 0x17]
xor eax, eax
cmp ax, word [esp + 0xb8]
jne 0x405e8c
push str.system.ini
push 0x104
lea ecx, [esp + 0xc0]
push ecx
push str.explorer
push str.Shell
push str.boot
call dword [0x4270b8]
test eax, eax
je 0x405e82
cmp eax, 0x103
jb 0x405e8c
xor edx, edx
mov word [esp + 0xb8], dx
mov esi, dword [0x4270bc]
push str.explorer
lea eax, [esp + 0xbc]
push eax
call esi
test eax, eax
je 0x405ebc
push 0x42a090
lea ecx, [esp + 0xbc]
push ecx
call esi
test eax, eax
jne 0x4064d2
push 0
push str.Progman
call dword [0x427268]
push eax
call dword [0x427284]
test eax, eax
jne 0x4064d2
push 0x104
lea edx, [esp + 0x2c4]
push edx
push str._SystemRoot_Explorer.EXE
call dword [0x4270c0]
dec eax
cmp eax, 0x103
ja 0x4064d2
call dword [0x4270c4]
and eax, 0xff
cmp eax, 6
jae 0x405f2f
push 5
push 0
push 0
lea eax, [esp + 0x2cc]
push eax
push 0
push 0
call dword [0x427254]
cmp eax, 0x20
setg al
jmp 0x4064d4
push 0
call dword [0x42733c]
test eax, eax
jl 0x4064d2
lea ecx, [esp + 0x20]
push ecx
push 0x42741c
push 1
push 0
push 0x42762c
call dword [0x42732c]
test eax, eax
jl 0x4064cc
lea edx, [esp + 0x40]
push edx
call dword [0x42723c]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x44]
mov esi, dword [esp + 0x48]
mov edi, dword [esp + 0x4c]
mov ebp, dword [esp + 0x20]
mov ebx, dword [ebp]
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], edx
mov dword [eax + 8], esi
mov dword [eax + 0xc], edi
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], edx
mov dword [eax + 8], esi
mov dword [eax + 0xc], edi
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], edx
mov dword [eax + 8], esi
mov dword [eax + 0xc], edi
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], edx
mov dword [eax + 8], esi
mov dword [eax + 0xc], edi
mov eax, dword [ebx + 0x28]
push ebp
call eax
test eax, eax
jl 0x4064bc
mov edi, dword [0x427240]
push 0x42a2ac
call edi
mov ebx, eax
mov dword [esp + 0x88], ebx
test ebx, ebx
je 0x4064bc
mov eax, dword [esp + 0x20]
mov ecx, dword [eax]
lea edx, [esp + 0x30]
push edx
push ebx
push eax
mov eax, dword [ecx + 0x1c]
call eax
mov ebp, dword [0x427244]
test eax, eax
jl 0x4064b9
push str.DD552472_A185_4a0c_AC58_90AA40E9E26A
call edi
mov esi, eax
mov dword [esp + 0x28], esi
test esi, esi
je 0x4064ad
mov eax, dword [esp + 0x30]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x3c]
push 0
push esi
push eax
call edx
mov eax, dword [esp + 0x20]
mov ecx, dword [eax]
lea edx, [esp + 0x18]
push edx
push 0
push eax
mov eax, dword [ecx + 0x24]
call eax
test eax, eax
jl 0x4064aa
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
lea edx, [esp + 0x6c]
push edx
xor bl, bl
push eax
mov eax, dword [ecx + 0x1c]
mov byte [esp + 0x25], bl
mov byte [esp + 0x26], bl
mov byte [esp + 0x27], bl
call eax
test eax, eax
jl 0x406099
push str.TuneUp_Setup___Force_Shell_Restart
call edi
mov esi, eax
test esi, esi
je 0x40608d
mov eax, dword [esp + 0x6c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x20]
push esi
push eax
call edx
push esi
call ebp
mov eax, dword [esp + 0x6c]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
lea edx, [esp + 0x54]
push edx
push eax
mov eax, dword [ecx + 0x24]
call eax
test eax, eax
jl 0x40619b
mov eax, dword [esp + 0x54]
mov ecx, dword [eax]
lea edx, [esp + 0x24]
push edx
push 7
push eax
mov eax, dword [ecx + 0x28]
call eax
test eax, eax
jl 0x40618f
lea ecx, [esp + 0x58]
mov bl, 1
push ecx
mov byte [esp + 0x21], bl
call dword [0x4270c8]
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x5c]
push eax
call dword [0x4270cc]
test eax, eax
je 0x406183
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
add eax, 0x23c34600
adc ecx, 0
mov dword [esp + 0x3c], ecx
lea ecx, [esp + 0x58]
push ecx
lea edx, [esp + 0x3c]
push edx
mov dword [esp + 0x40], eax
call dword [0x4270d0]
test eax, eax
je 0x406183
movzx eax, word [esp + 0x64]
movzx ecx, word [esp + 0x62]
movzx edx, word [esp + 0x60]
push eax
movzx eax, word [esp + 0x62]
push ecx
movzx ecx, word [esp + 0x62]
push edx
movzx edx, word [esp + 0x64]
push eax
push ecx
push edx
lea eax, [esp + 0xa4]
push str._04d__02d__02dT_02d:_02d:_02dZ
push eax
call dword [0x427264]
add esp, 0x20
lea ecx, [esp + 0x8c]
push ecx
call edi
mov esi, eax
test esi, esi
je 0x406183
mov eax, dword [esp + 0x24]
mov edx, dword [eax]
push esi
push eax
mov eax, dword [edx + 0x44]
call eax
test eax, eax
push esi
setge byte [esp + 0x22]
call ebp
mov eax, dword [esp + 0x24]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x54]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
lea edx, [esp + 0x2c]
push edx
push eax
mov eax, dword [ecx + 0x2c]
call eax
test eax, eax
jl 0x40622a
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax]
xor edx, edx
test bl, bl
setne dl
dec edx
push edx
push eax
mov eax, dword [ecx + 0x20]
call eax
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x48]
push 0
push eax
call edx
push str.PT0S
call edi
mov esi, eax
test esi, esi
je 0x4061f0
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x70]
push esi
push eax
call edx
push esi
call ebp
cmp byte [esp + 0x1e], 0
je 0x40621e
push str.PT0S
call edi
mov esi, eax
test esi, esi
je 0x40621e
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x80]
push esi
push eax
call edx
test eax, eax
push esi
setge byte [esp + 0x23]
call ebp
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
lea edx, [esp + 0x34]
push edx
push eax
mov eax, dword [ecx + 0x44]
call eax
test eax, eax
jl 0x406493
mov eax, dword [esp + 0x34]
mov ecx, dword [eax]
lea edx, [esp + 0x38]
push edx
push 0
push eax
mov eax, dword [ecx + 0x30]
call eax
test eax, eax
jl 0x406487
mov eax, dword [esp + 0x38]
mov ecx, dword [eax]
lea edx, [esp + 0x74]
push edx
push str.MbLk
push eax
mov eax, dword [ecx]
call eax
test eax, eax
jl 0x40647b
lea ecx, [esp + 0x2c0]
push ecx
call edi
mov esi, eax
mov dword [esp + 0x70], esi
test esi, esi
je 0x40646f
mov eax, dword [esp + 0x74]
mov edx, dword [eax]
push esi
push eax
mov eax, dword [edx + 0x2c]
call eax
test eax, eax
jl 0x40646c
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
lea edx, [esp + 0x68]
push edx
push eax
mov eax, dword [ecx + 0x3c]
call eax
test eax, eax
jl 0x40646c
mov eax, dword [esp + 0x68]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x48]
push 0
push eax
call edx
test eax, eax
jl 0x406460
lea eax, [esp + 0x78]
push eax
call dword [0x42723c]
call fcn.00405c50
mov dword [esp + 0x80], eax
test eax, eax
je 0x4062fc
mov ecx, 8
mov word [esp + 0x78], cx
mov esi, dword [esp + 0x40]
mov edi, dword [esp + 0x44]
mov ebp, dword [esp + 0x48]
mov edx, dword [esp + 0x30]
lea eax, [esp + 0x24]
push eax
mov eax, dword [esp + 0x50]
sub esp, 0x10
mov ecx, esp
mov dword [ecx], esi
mov dword [ecx + 4], edi
mov dword [ecx + 8], ebp
mov dword [ecx + 0xc], eax
mov ebx, dword [edx]
push 3
sub esp, 0x10
mov ecx, esp
mov dword [ecx], esi
mov dword [ecx + 4], edi
mov dword [ecx + 8], ebp
mov dword [ecx + 0xc], eax
mov eax, dword [esp + 0xa0]
sub esp, 0x10
mov ecx, esp
mov dword [ecx], eax
mov eax, dword [esp + 0xb4]
mov dword [ecx + 4], eax
mov eax, dword [esp + 0xb8]
mov dword [ecx + 8], eax
mov eax, dword [esp + 0xbc]
mov dword [ecx + 0xc], eax
mov ecx, dword [esp + 0x50]
mov eax, dword [esp + 0x60]
push 6
push ecx
mov ecx, dword [ebx + 0x44]
push eax
push edx
call ecx
test eax, eax
jl 0x406448
cmp byte [esp + 0x1d], 0
jne 0x4063bd
mov esi, dword [esp + 0x40]
mov ecx, dword [esp + 0x24]
mov edx, dword [ecx]
push 0
sub esp, 0x10
mov eax, esp
mov dword [eax], esi
mov esi, dword [esp + 0x58]
mov dword [eax + 4], esi
mov esi, dword [esp + 0x5c]
mov dword [eax + 8], esi
mov esi, dword [esp + 0x60]
mov dword [eax + 0xc], esi
mov eax, dword [edx + 0x30]
push ecx
call eax
mov byte [esp + 0x17], 0
test eax, eax
jl 0x4063c2
mov byte [esp + 0x17], 1
cmp byte [esp + 0x1f], 0
jne 0x40643c
mov edi, dword [0x427198]
call edi
mov esi, eax
mov eax, dword [esp + 0x24]
mov ecx, dword [eax]
lea edx, [esp + 0x58]
push edx
push eax
mov eax, dword [ecx + 0x3c]
call eax
test eax, eax
jl 0x406429
mov ebx, dword [0x427194]
fld qword [esp + 0x58]
fcomp qword [0x432690]
fnstsw ax
test ah, 0x44
jp 0x406429
call edi
cmp esi, eax
jbe 0x406407
mov esi, eax
sub eax, esi
cmp eax, 0x1388
jae 0x406429
push 0x64
call ebx
mov eax, dword [esp + 0x24]
mov ecx, dword [eax]
lea edx, [esp + 0x58]
push edx
push eax
mov eax, dword [ecx + 0x3c]
call eax
test eax, eax
jge 0x4063ee
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x28]
mov ecx, dword [eax]
push 0
push edx
push eax
mov eax, dword [ecx + 0x3c]
call eax
mov eax, dword [esp + 0x24]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x80]
mov ebp, dword [0x427244]
test eax, eax
je 0x40645c
push eax
call ebp
mov esi, dword [esp + 0x70]
mov eax, dword [esp + 0x68]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
push esi
call ebp
mov eax, dword [esp + 0x74]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x38]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x34]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov esi, dword [esp + 0x28]
mov ebx, dword [esp + 0x88]
push esi
call ebp
mov eax, dword [esp + 0x30]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
push ebx
call ebp
mov eax, dword [esp + 0x20]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov bl, byte [esp + 0x17]
call dword [0x427338]
mov al, bl
mov ecx, dword [esp + 0x4cc]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00412b1e
add esp, 0x4c4
ret