Function at 0x40aa2a
Capabilities:
Manipulate boot configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a0
mov eax, dword [0x4d8300]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push str.Windows_To_Go_mode_selected
mov dword [ebp - 0x19c], edx
xor esi, esi
mov dword [ebp - 0x198], ecx
call fcn.0042ed57
pop ecx
test ebx, ebx
je 0x40aa86
cmp dword [0x522938], 0xc
je 0x40aa86
cmp dword [0x4da384], 0x3a98
jge 0x40aa86
mov dword [0x4dc5d0], 0xc0030032
xor eax, eax
jmp 0x40ad78
mov al, byte [0x5228a7]
test al, al
jne 0x40aaf2
call fcn.00413e10
mov edi, eax
test edi, edi
jne 0x40aab1
push str.Could_not_mount_ISO_for_Windows_To_Go_installation
call fcn.0042ed57
pop ecx
mov dword [0x4dc5d0], 0xe0031208
jmp 0x40aa7f
mov eax, dword [0x50d060]
shl eax, 6
add eax, 0x522702
push eax
push edi
push 0x4b737c
lea eax, [ebp - 0x194]
push 0x80
push eax
call fcn.00403163
add esp, 0x14
mov byte [ebp - 0x115], 0
push edi
push str.Mounted_ISO_as__s
call fcn.0042ed57
mov al, byte [0x5228a7]
pop ecx
pop ecx
push dword [ebp - 0x19c]
test al, al
lea ecx, [ebp - 0x194]
cmovne ecx, dword [0x4dca18]
call fcn.0043e55a
pop ecx
test eax, eax
jne 0x40ab49
push str.Failed_to_apply_Windows_To_Go_image
call fcn.0042ed57
test dword [0x4dc5d0], 0x80000000
pop ecx
jne 0x40ab32
mov dword [0x4dc5d0], 0xe0031208
cmp byte [0x5228a7], 0
jne 0x40aa7f
call fcn.0041402d
jmp 0x40aa7f
cmp byte [0x5228a7], 0
jne 0x40ab57
call fcn.0041402d
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
test ebx, ebx
je 0x40abf7
push str.Setting_up_EFI_System_Partition
call fcn.0042ed57
mov eax, dword [0x522930]
mov edx, 0x400
pop ecx
cmp eax, edx
jbe 0x40ab8a
mov ecx, 0x1000
mov edx, eax
cmp eax, ecx
cmovbe edx, ecx
mov esi, dword [ebp - 0x198]
mov ecx, esi
push 0x30003
push 0x4b4dda
push 1
push dword [0x522acc]
push dword [0x522ac8]
call fcn.0040924a
add esp, 0x14
test eax, eax
jne 0x40abc6
push str.Could_not_format_EFI_System_Partition
call fcn.0042ed57
pop ecx
jmp 0x40aa7f
push 0xc8
call edi
push dword [0x522acc]
mov ecx, esi
push dword [0x522ac8]
call fcn.004067e3
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x40abf7
mov dword [0x4dc5d0], 0xe003120b
jmp 0x40aa7f
push str.Enabling_boot_using_command:
call fcn.0042ed57
mov edx, dword [ebp - 0x19c]
test ebx, ebx
pop ecx
mov eax, edx
mov ecx, 0x4b7624
cmovne eax, esi
cmp byte [0x5228b5], 0
push eax
mov dword [ebp - 0x198], eax
mov eax, str.BIOS
cmove ecx, eax
cmp byte [0x5228b4], 0
mov eax, str.UEFI
cmovne eax, ecx
push eax
push edx
push 0x522080
push str._s_bcdboot.exe__sWindows__v__f__s__s__s
lea eax, [ebp - 0x114]
push 0x104
push eax
call fcn.00403163
add esp, 0x1c
mov byte [ebp - 0x11], 0
lea eax, [ebp - 0x114]
push eax
call fcn.0042ed57
pop ecx
push dword [0x5223d8]
mov edx, 0x522080
lea ecx, [ebp - 0x114]
call fcn.0042e07a
pop ecx
test eax, eax
je 0x40ac9a
push str.Failed_to_enable_boot
call fcn.0042ed57
pop ecx
mov dword [0x4dc5d0], 0xe0031208
mov ecx, dword [0x52056c]
mov edx, 0xcc3
mov eax, dword [0x520568]
push 0
push dword [0x520570]
lea eax, [eax + ecx*2]
push 0
push eax
push 7
pop ecx
call fcn.0043c21c
push str.Disable_the_use_of_the_Windows_Recovery_Environment_using_command:
call fcn.0042ed57
add esp, 0x14
lea eax, [ebp - 0x114]
push dword [ebp - 0x198]
push 0x522080
push str._s_bcdedit.exe__store__sEFIMicrosoftBootBCD__set_default_recoveryenabled_no
push 0x104
push eax
call fcn.00403163
add esp, 0x14
mov byte [ebp - 0x11], 0
lea eax, [ebp - 0x114]
push eax
call fcn.0042ed57
pop ecx
push dword [0x5223d8]
mov edx, 0x522080
lea ecx, [ebp - 0x114]
call fcn.0042e07a
mov eax, dword [0x520570]
mov edx, 0xcc3
pop ecx
push 0
push eax
push 0
push eax
push 7
pop ecx
call fcn.0043c21c
add esp, 0x10
test ebx, ebx
je 0x40ad75
push 0xc8
call edi
test esi, esi
je 0x40ad75
push 0
push esi
push 0xa
call dword [sym.imp.KERNEL32.dll_DefineDosDeviceA]
test eax, eax
jne 0x40ad68
call fcn.0042fc51
push eax
push esi
push str.Could_not_unmount__s:__s
call fcn.0042ed57
add esp, 0xc
jmp 0x40ad75
push esi
push str.Successfully_unmounted__s
call fcn.0042ed57
pop ecx
pop ecx
xor eax, eax
inc eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00475c80
leave
ret