Function at 0x401000
Capabilities:
Allocate thread local storage

Disassembly:
push 0x1a0
push 0
push 0x44a308
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleW
mov dword [0x44a30c], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x44a308], eax
call section..text
call fcn.0042687d
call fcn.0043e9f0
call fcn.0043df0f
call fcn.0043db90
call fcn.0043be50
call fcn.00439f8c
call fcn.00439830
call fcn.0043908f
call fcn.004386e4
call fcn.004384b6
call fcn.004383dd
call fcn.00438158
call fcn.00437623
call fcn.00436f4b
call fcn.004368e0
call fcn.00435c18
call fcn.004344a3
call fcn.0042afa9
call fcn.0042aca7
call fcn.004296ca
call fcn.00428dea
call fcn.0042833a
call fcn.00427dd3
call fcn.00427633
call fcn.0042734d
call fcn.00426ced
push 0x44a410
mov eax, str.DC1C5A9C_E88A_4dde_A5A1_60F82A20AEF7
push eax
call sub.ole32.dll_CLSIDFromString
push 0x44a420
mov eax, str.d57c7288_d4ad_4768_be02_9d969532d960
push eax
call sub.ole32.dll_IIDFromString
push 0x44a470
mov eax, str.43826d1e_e718_42ee_bc55_a1e261c37bfe
push eax
call sub.ole32.dll_IIDFromString
push 0x44a440
mov eax, str.1CF2B120_547D_101B_8E65_08002B2BD119
push eax
call sub.ole32.dll_IIDFromString
push 0x44a430
mov eax, str.00000000_0000_0000_0000_000000000000
push eax
call sub.ole32.dll_CLSIDFromString
push 0x44a450
mov eax, 0x4449b0
push eax
call sub.ole32.dll_CLSIDFromString
push 0x44a460
mov eax, str.2933BF96_7B36_11d2_B20E_00C04F983E60
push eax
call sub.ole32.dll_IIDFromString
mov byte [0x44a404], 0
mov byte [0x44a405], 0
mov edx, str.WimgApi.dll
lea ecx, [0x44a3c4]
call fcn.00426068
push edx
call fcn.0043ea40
pop edx
push eax
push edx
call fcn.0043ea40
pop edx
push eax
push edx
call fcn.0043ea40
pop edx
push eax
push edx
call fcn.0043ea40
pop edx
push eax
call fcn.00428369
call fcn.004264e2
add dword [esp], edx
call fcn.00435da4
mov edx, 0x442c40
push edx
call fcn.0043ea80
push 0x44a32c
call fcn.0043eae0
mov dword [0x44a37c], 0
mov dword [0x44a33c], 0
mov byte [0x44a406], 0
push 8
push 0x447db0
lea eax, [0x44a490]
push eax
push 4
call fcn.00438703
push 8
push 0x447db0
lea eax, [0x44a498]
push eax
push 4
call fcn.00438703
push 8
push 0x447db0
lea eax, [0x44a4a0]
push eax
push 4
call fcn.00438703
mov edx, str.INDEX:R:
lea ecx, [0x44a3e4]
call fcn.00426068
mov eax, 0x442ce0
push eax
push dword [0x44a3e4]
call fcn.0043c100
mov ebx, eax
inc ebx
mov dword [0x44a390], ebx
mov edx, str.NAME:L:
lea ecx, [0x44a3a4]
call fcn.00426068
mov eax, 0x442ce0
push eax
push dword [0x44a3a4]
call fcn.0043c100
mov ebx, eax
inc ebx
mov dword [0x44a344], ebx
mov edx, 0x444dbc
lea ecx, [0x44a330]
call fcn.00426068
mov eax, 0x442ce0
push eax
push dword [0x44a330]
call fcn.0043c100
mov ebx, eax
inc ebx
mov dword [0x44a3dc], ebx
mov edx, str.HardwareDescription:L:
lea ecx, [0x44a3fc]
call fcn.00426068
mov eax, 0x442ce0
push eax
push dword [0x44a3fc]
call fcn.0043c100
mov ebx, eax
inc ebx
mov dword [0x44a3b0], ebx
push edx
call fcn.0043ea40
pop edx
push eax
push 0x24
call fcn.004123c3
push 0x44a3e8
call fcn.0043eae0
push edx
call fcn.0043ea40
pop edx
push eax
push 0x25
call fcn.004123c3
push 0x44a36c
call fcn.0043eae0
mov edx, dword [0x44a3e8]
push edx
call fcn.0043ea40
pop edx
push eax
push edx
call fcn.0043ea80
lea eax, [0x44a408]
push 3
push eax
call fcn.0043eb70
mov edx, dword [0x44a36c]
push edx
call fcn.0043ea40
pop edx
push eax
push edx
call fcn.0043ea80
mov edx, str.Shell32.dll
push edx
call fcn.0043ea80
push 0x44a334
call fcn.0043eae0
mov edx, dword [0x44a36c]
push edx
call fcn.0043ea40
pop edx
push eax
push edx
call fcn.0043ea80
mov edx, str.imageres.dll
push edx
call fcn.0043ea80
push 0x44a3a0
call fcn.0043eae0
mov edx, dword [0x44a36c]
push edx
call fcn.0043ea40
pop edx
push eax
push edx
call fcn.0043ea80
mov edx, str._setupapi.dll
push edx
call fcn.0043ea80
push 0x44a3b8
call fcn.0043eae0
push edx
call fcn.0043ea40
pop edx
push eax
push edx
call fcn.0043ea40
pop edx
push eax
push edx
call fcn.0043ea40
pop edx
push eax
push edx
call fcn.0043ea40
pop edx
push eax
call fcn.00428369
call fcn.004264e2
add dword [esp], edx
call fcn.00435da4
mov edx, str.Wiminfo.icl
push edx
call fcn.0043ea80
push 0x44a324
call fcn.0043eae0
push edx
call fcn.0043ea40
pop edx
push eax
push edx
call fcn.0043ea40
pop edx
push eax
push edx
call fcn.0043ea40
pop edx
push eax
push edx
call fcn.0043ea40
pop edx
push eax
call fcn.00428369
call fcn.004264e2
add dword [esp], edx
call fcn.00435da4
mov edx, str.Wiminfo.icl
push edx
call fcn.0043ea80
push 0x44a3e0
call fcn.0043eae0
push edx
call fcn.0043ea40
pop edx
push eax
push edx
call fcn.0043ea40
pop edx
push eax
push edx
call fcn.0043ea40
pop edx
push eax
push edx
call fcn.0043ea40
pop edx
push eax
call fcn.00428369
call fcn.004264e2
add dword [esp], edx
call fcn.00435da4
mov edx, str.Wiminfo.icl
push edx
call fcn.0043ea80
push 0x44a3a8
call fcn.0043eae0
push dword [0x44a324]
call fcn.00435e23
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xffffffff
jne 0x401475
cmp edi, 0xffffffff
je 0x401479
xor eax, eax
jmp 0x40147e
mov eax, 1
or eax, eax
je 0x4014a0
mov edx, dword [0x44a334]
push edx
call fcn.0043ea40
pop edx
push eax
push edx
call fcn.0043ea80
push 0x44a324
call fcn.0043eae0
push dword [0x44a3e0]
call fcn.00435e23
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xffffffff
jne 0x4014b9
cmp edi, 0xffffffff
je 0x4014bd
xor eax, eax
jmp 0x4014c2
mov eax, 1
or eax, eax
je 0x4014e4
mov edx, dword [0x44a3a0]
push edx
call fcn.0043ea40
pop edx
push eax
push edx
call fcn.0043ea80
push 0x44a3e0
call fcn.0043eae0
push dword [0x44a3a8]
call fcn.00435e23
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xffffffff
jne 0x4014fd
cmp edi, 0xffffffff
je 0x401501
xor eax, eax
jmp 0x401506
mov eax, 1
or eax, eax
je 0x401528
mov edx, dword [0x44a3b8]
push edx
call fcn.0043ea40
pop edx
push eax
push edx
call fcn.0043ea80
push 0x44a3a8
call fcn.0043eae0
mov dword [0x44a318], 0xffffffff
push 0xdc
push 0xe1
push 0xe1
call fcn.004383e9
mov dword [0x44a314], eax
mov dword [0x44a39c], 0xffffffff
push 0xe1
push 0xfe
push 0xfe
call fcn.004383e9
mov dword [0x44a398], eax
mov dword [0x44a3bc], 0xffffffff
push 0xe1
push 0xfe
push 0xfe
call fcn.004383e9
mov dword [0x44a3b4], eax
mov dword [0x44a360], 0xffffffff
push 0xe0
push 0xf5
push 0xfe
call fcn.004383e9
mov dword [0x44a358], eax
mov dword [0x44a340], 0xffffffff
push 0xf6
push 0xfa
push 0xfb
call fcn.004383e9
mov dword [0x44a338], eax
mov dword [0x44a388], 0
push 0x44a480
push 0
push 0xa
push 3
push 0x208
call fcn.00438181
push 0x44a488
push 0x447db0
push 8
push 3
push 4
call fcn.00438181
mov ebp, dword [0x44a480]
lea eax, [ebp]
mov edx, 0x442038
push edx
push 0x104
push eax
call fcn.0043ebb0
lea eax, [ebp + 0x208]
mov edx, 0x442038
push edx
push 0x104
push eax
call fcn.0043ebb0
mov ebp, dword [0x44a488]
mov edx, 0x442038
lea ecx, [ebp]
call fcn.00426068
mov edx, 0x442038
lea ecx, [ebp + 4]
call fcn.00426068
mov eax, str.76b85ef8_9c0a_402f_92c2_be6281a3e508
push eax
call fcn.004126b5
push 0x442080
call fcn.0040408a
push edx
call fcn.0043ea40
pop edx
push eax
push edx
call fcn.0043ea40
pop edx
push eax
mov eax, 0x4449aa
push eax
mov eax, str.SoftwareWimInfoREG
push eax
push SysReAllocString
call fcn.00419530
call fcn.004264e2
add dword [esp], edx
call fcn.0043c190
call fcn.00426500
push eax
push edx
call fcn.0043ea40
pop edx
push eax
push edx
call fcn.0043ea40
pop edx
push eax
mov eax, 0x444b1c
push eax
mov eax, str.SoftwareWimInfoREG
push eax
push SysReAllocString
call fcn.00419530
call fcn.004264e2
add dword [esp], edx
call fcn.0043c190
call fcn.00426500
push eax
push edx
call fcn.0043ea40
pop edx
push eax
push edx
call fcn.0043ea40
pop edx
push eax
mov eax, 0x444b28
push eax
mov eax, str.SoftwareWimInfoREG
push eax
push SysReAllocString
call fcn.00419530
call fcn.004264e2
add dword [esp], edx
call fcn.0043c190
call fcn.00426500
push eax
push edx
call fcn.0043ea40
pop edx
push eax
push edx
call fcn.0043ea40
pop edx
push eax
mov eax, 0x444b22
push eax
mov eax, str.SoftwareWimInfoREG
push eax
push SysReAllocString
call fcn.00419530
call fcn.004264e2
add dword [esp], edx
call fcn.0043c190
call fcn.00426500
push eax
call fcn.0041e179
call fcn.004250dc
call fcn.0040c381
mov eax, str.WimFiles
push eax
push 0xc
call fcn.00418784
push dword [0x44a3d4]
call sub.USER32.dll_DestroyIcon
push dword [0x44a31c]
call sub.USER32.dll_DestroyIcon
push dword [0x44a3cc]
call sub.USER32.dll_DestroyIcon
push dword [0x44a3d0]
call sub.USER32.dll_DestroyIcon
push dword [0x44a310]
call sub.USER32.dll_DestroyIcon
push dword [0x44a378]
call sub.USER32.dll_DestroyIcon
push dword [0x44a3ac]
call sub.USER32.dll_DestroyIcon
push dword [0x44a400]
call sub.USER32.dll_DestroyIcon
push dword [0x44a3c0]
call sub.USER32.dll_DestroyIcon
push dword [0x44a394]
call sub.USER32.dll_DestroyIcon
push dword [0x44a368]
call sub.USER32.dll_DestroyIcon
push dword [0x44a35c]
call sub.USER32.dll_DestroyIcon
push dword [0x44a320]
call sub.USER32.dll_DestroyIcon
push dword [0x44a38c]
call sub.USER32.dll_DestroyIcon
push dword [0x44a3f8]
call sub.USER32.dll_DestroyIcon
push dword [0x44a374]
call sub.USER32.dll_DestroyIcon
push dword [0x44a3ec]
push dword [0x44a364]
call sub.USER32.dll_ReleaseDC
push dword [0x44a3f0]
call sub.GDI32.dll_DeleteObject
push dword [0x44a370]
call sub.GDI32.dll_DeleteObject
mov ebx, dword [0x44a348]
and ebx, ebx
je 0x401872
push dword [0x44a348]
call sub.GDI32.dll_DeleteObject
push dword [0x44a490]
call fcn.00438795
push dword [0x44a498]
call fcn.00438795
push dword [0x44a4a0]
call fcn.00438795
push edx
call fcn.0043ea40
pop edx
push eax
mov eax, 2
push eax
mov ebp, dword [0x44a488]
push dword [ebp]
call fcn.0041397c
call fcn.00426500
push edx
call fcn.0043ea40
pop edx
push eax
mov eax, 2
push eax
mov ebp, dword [0x44a488]
push dword [ebp + 4]
call fcn.0041397c
call fcn.00426500
push dword [0x44a32c]
call fcn.004241e6
add esp, 4
push 0
call fcn.0043450e
mov ebx, eax
and ebx, ebx
jne 0x401a57
push edx
call fcn.0043ea40
pop edx
push eax
push 1
push edx
call fcn.0043ea40
pop edx
push eax
push edx
call fcn.0043ea40
pop edx
push eax
push 0
call fcn.004345d6
cdq
push edx
push eax
call fcn.0043c2d0
call fcn.0043ebe0
mov eax, 0x444b22
push eax
mov eax, str.SoftwareWimInfoREG
push eax
push SysReAllocString
call fcn.004264e2
add dword [esp + 0xc], edx
call fcn.0042057f
call fcn.00426500
push edx
call fcn.0043ea40
pop edx
push eax
push 1
push edx
call fcn.0043ea40
pop edx
push eax
push edx
call fcn.0043ea40
pop edx
push eax
push 0
call fcn.00434645
cdq
push edx
push eax
call fcn.0043c2d0
call fcn.0043ebe0
mov eax, 0x444b28
push eax
mov eax, str.SoftwareWimInfoREG
push eax
push SysReAllocString
call fcn.004264e2
add dword [esp + 0xc], edx
call fcn.0042057f
call fcn.00426500
push edx
call fcn.0043ea40
pop edx
push eax
push 1
push edx
call fcn.0043ea40
pop edx
push eax
push edx
call fcn.0043ea40
pop edx
push eax
push 0
call fcn.0043469a
cdq
push edx
push eax
call fcn.0043c2d0
call fcn.0043ebe0
mov eax, 0x444b1c
push eax
mov eax, str.SoftwareWimInfoREG
push eax
push SysReAllocString
call fcn.004264e2
add dword [esp + 0xc], edx
call fcn.0042057f
call fcn.00426500
push edx
call fcn.0043ea40
pop edx
push eax
push 1
push edx
call fcn.0043ea40
pop edx
push eax
push edx
call fcn.0043ea40
pop edx
push eax
push 0
call fcn.00434717
cdq
push edx
push eax
call fcn.0043c2d0
call fcn.0043ebe0
mov eax, 0x4449aa
push eax
mov eax, str.SoftwareWimInfoREG
push eax
push SysReAllocString
call fcn.004264e2
add dword [esp + 0xc], edx
call fcn.0042057f
call fcn.00426500
push 0
mov eax, str.SeRestorePrivilege
push eax
call fcn.00410218
push 0
mov eax, str.SeBackupPrivilege
push eax
call fcn.00410218
push 0
call fcn.00434406
movsx ebx, byte [0x44a406]
push ebx
mov ebx, 2
cmp ebx, dword [esp]
jne 0x401a9f
push 0
call fcn.00407c58
jmp 0x401ae4
mov ebx, 3
cmp ebx, dword [esp]
jne 0x401ab5
push 1
call fcn.00407c58
jmp 0x401ae4
mov ebx, 4
cmp ebx, dword [esp]
jne 0x401ad0
call fcn.00416d85
push 1
call fcn.00407c58
jmp 0x401ae4
mov ebx, 5
cmp ebx, dword [esp]
jne 0x401ae4
push 2
call fcn.00407c58
pop eax
push 0
jmp 0x401af1
call 0x401b0b
call fcn.0043ea20
push dword [0x44a308]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess
call fcn.0042730b
call fcn.00428dd8
call fcn.0042ac9b
call fcn.0042af53
call fcn.00434480
call fcn.00435c17
call fcn.00435f7a
call fcn.004368d0
call fcn.00436f2d
call fcn.004384aa
call fcn.0043908e
call fcn.0043be70
call fcn.0043df9d
call fcn.0043dfe7
call fcn.0043db80
ret