Function at 0x401000
Capabilities:
Allocate thread local storage

Disassembly:
push 0x54
push 0
push 0x41347c
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleW
mov dword [0x413480], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x41347c], eax
call fcn.00403225
call fcn.0040ddc0
call fcn.0040ddbd
call fcn.0040dc19
call fcn.0040d365
call fcn.0040d2f0
call fcn.0040cb00
call fcn.0040ac3c
call fcn.0040a4e0
call fcn.004099ef
call fcn.004099db
call fcn.00409797
call fcn.004091d1
call fcn.00408b81
call fcn.00407947
call fcn.00405c24
call fcn.00404db7
call fcn.00404b62
call fcn.004040c8
call fcn.00403b40
call fcn.0040340c
mov edx, 0x411c80
lea ecx, [0x4134bc]
call fcn.00403008
mov byte [0x4134cc], 0
call fcn.0040425c
and eax, eax
je 0x401261
push dword [0x413a50]
push dword [0x413a50]
call fcn.00404270
lea eax, [0x4134ac]
push eax
call fcn.0040de40
push dword [0x4134ac]
call fcn.00407590
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jl 0x401108
jg 0x401104
cmp ebx, 0
jb 0x401108
xor eax, eax
jmp 0x40110d
mov eax, 1
or eax, eax
jne 0x40118e
push dword [0x413a50]
push dword [0x413a50]
push dword [0x4134ac]
call fcn.004076e7
lea eax, [0x4134a0]
push eax
call fcn.0040de40
push 1
push 1
push dword [0x4134a0]
mov eax, str.wim_vhd_vhdx
push eax
call fcn.0040cdb0
and eax, eax
je 0x40117e
mov edx, dword [0x4134ac]
push dword [0x413a50]
push edx
call fcn.0040dec0
lea eax, [0x4134b4]
push eax
call fcn.0040de40
push dword [0x4134b0]
call fcn.004015b2
jmp 0x401189
push dword [0x4134b0]
call fcn.0040254b
jmp 0x40125c
push dword [0x413a50]
push dword [0x413a50]
push dword [0x413a50]
push dword [0x413a50]
push 2
push dword [0x4134ac]
call fcn.0040ce70
mov edx, dword [0x411efc]
add dword [esp], edx
call fcn.0040cee0
lea eax, [0x4134ac]
push eax
call fcn.0040de40
push dword [0x4134ac]
mov edx, 0x411ed4
mov ecx, dword [esp]
call fcn.00403080
je 0x4011f2
push dword [0x4134b0]
call fcn.0040158c
jmp 0x40125b
mov edx, 0x411eda
mov ecx, dword [esp]
call fcn.00403080
je 0x40120e
push dword [0x4134b0]
call fcn.00401f3e
jmp 0x40125b
mov edx, 0x411ee0
mov ecx, dword [esp]
call fcn.00403080
je 0x401224
call fcn.004028f2
jmp 0x40125b
mov edx, 0x411ee6
mov ecx, dword [esp]
call fcn.00403080
je 0x40123a
call fcn.0040156e
jmp 0x40125b
mov edx, 0x411eec
mov ecx, dword [esp]
call fcn.00403080
je 0x401250
call fcn.0040200c
jmp 0x40125b
push dword [0x4134b0]
call fcn.0040254b
pop eax
jmp 0x401303
push 0xa0
push 0x1c2
push 0
push 0
call fcn.00401373
push 1
push 0xf
push dword [0x4134c0]
call fcn.0040568b
push 0
call fcn.00404b89
and eax, eax
je 0x4012e7
mov eax, str.Parameters_:_only_first_one
push eax
push 0
call fcn.00404c75
call fcn.00404c87
mov eax, str.WindowsSystem32Winload.efi
push eax
push 1
call fcn.00404c75
mov eax, str.WindowsSystem32Winload.exe
push eax
push 2
call fcn.00404c75
call fcn.00404c87
mov eax, str.Cancel_and_Reverse_BCD
push eax
push 3
call fcn.00404c75
call fcn.00407add
push eax
call fcn.00402271
mov dword [0x4134a4], eax
mov ebx, dword [0x4134a4]
and ebx, ebx
jne 0x4012e7
jmp 0x401303
push 0
call 0x401322
call fcn.0040de10
push dword [0x41347c]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess
call sub.ole32.dll_OleUninitialize
call fcn.00405bce
call fcn.0040775a
call fcn.00407924
call fcn.00408b63
call fcn.00409796
call fcn.004099cf
call fcn.0040cb20
call fcn.0040d3f3
call fcn.0040d3ff
call fcn.0040ddbc
call fcn.0040d2e0
ret