Function at 0x41e5a2
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x14cc
call fcn.00485be0
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [esi + 2]
cmp eax, 6
ja 0x41ee04
cmp esi, 2
je 0x41ee04
call fcn.0043d5bb
push eax
lea ecx, [esp + 0x20]
call fcn.0043bbe8
call fcn.0043d5bb
push eax
lea ecx, [esp + 0x30]
call fcn.0043bbe8
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x1c]
call fcn.0041ceb2
mov ebx, eax
test ebx, ebx
jne 0x41e638
push eax
cmp esi, 0xfffffffe
jne 0x41e641
lea ecx, [esp + 0x30]
call fcn.0043c971
mov eax, dword [esp + 0x2c]
mov edx, str.BCD00000000Objects9dea862c_5cdd_4e70_acc1_f32b344d4795Elements24000002
mov ecx, dword [eax - 0xc]
lea ecx, [ecx*2 + 2]
push ecx
push eax
push 7
push str.Element
mov ecx, 0x80000002
call fcn.0044de71
add esp, 0x10
mov ebx, eax
mov edi, dword [esp + 0x1c]
jmp 0x41edec
mov edi, dword [esp + 0x20]
lea edx, [esp + 0x10]
and dword [esp + 0x10], 0
mov ecx, edi
call fcn.0041d085
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x41edec
cmp dword [esp + 0xc], eax
jne 0x41e898
call dword [sym.imp.CBSHost.dll_DismGetScratchDir]
push eax
lea ecx, [esp + 0x1c]
call fcn.0043c2b8
mov edx, str.WinREMountDir_
lea ecx, [esp + 0x18]
call fcn.0044c3a9
mov esi, dword [esp + 0x18]
mov ecx, esi
call fcn.0044d9e7
test eax, eax
je 0x41e6e9
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryEmptyW]
test eax, eax
jne 0x41e6e9
push eax
push eax
push esi
call sym.Dismx86.exe_DismUnmountImage
test eax, eax
je 0x41e6e9
xor edx, edx
mov ecx, esi
inc edx
call fcn.0044d00c
mov ebx, eax
test ebx, ebx
je 0x41e6e9
push ebx
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
push ebx
test eax, eax
jg 0x41e6d5
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
jmp 0x41e862
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
movzx ebx, ax
or ebx, 0x80070000
jmp 0x41ede4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push esi
push 0
push 0
push edi
call sym.Dismx86.exe_DismMountImage
mov ebx, eax
test ebx, ebx
jne 0x41ede4
push 0x146c
lea eax, [esp + 0x6e]
mov word [esp + 0x6c], 0x4b50
push 0x48a4b0
push eax
call dword [sym.imp.msvcrt.dll_memcpy]
add esp, 0xc
lea edx, [esp + 0x18]
lea ecx, [esp + 0x14]
push str.WindowsSystem32NativeDism.exe
call fcn.0043baed
lea edx, [esp + 0x6c]
mov ecx, dword [eax]
call fcn.0044c48c
pop ecx
mov ecx, dword [esp + 0x14]
mov ebx, eax
lea ecx, [ecx - 0x10]
call fcn.0043d912
test ebx, ebx
je 0x41e773
push 0x496068
push str.NativeDism
push 4
call dword [sym.imp.CBSHost.dll_DismWriteLog]
jmp 0x41e847
push str.WindowsSystem32configSYSTEM
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x18]
call fcn.0043baed
pop ecx
push dword [eax]
push str.WinRE_SYSTEM
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
mov ecx, dword [esp + 0x14]
mov ebx, eax
lea ecx, [ecx - 0x10]
call fcn.0043d912
test ebx, ebx
je 0x41e7b1
push 0x4960bc
jmp 0x41e761
and dword [esp + 0xc], 0
lea eax, [esp + 0xc]
push eax
push 0x20006
push dword [0x4ad198]
push str.WinRE_SYSTEM
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test ebx, ebx
jne 0x41e837
push 0xc
pop ecx
mov esi, str.NativeDism_NativeDism_
lea edi, [esp + 0x34]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x34]
push 0x32
push eax
push 7
push str.BootExecute
mov edx, str.ControlSet001ControlSession_Manager
movsw word es:[edi], word [esi]
call fcn.0044de71
mov esi, dword [esp + 0x28]
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x41e829
mov edx, dword [esp + 0xc]
mov ecx, esi
call fcn.004161a8
lea ebx, [eax - 0x50]
neg ebx
sbb ebx, ebx
and ebx, eax
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [esp + 0x1c]
push str.WinRE_SYSTEM
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
xor eax, eax
test ebx, ebx
sete al
push eax
push 1
push edi
push esi
call dword [sym.imp.WIMGAPI.DLL_WIMUnmountImage]
test eax, eax
jne 0x41e869
call fcn.0044cc8a
mov ebx, eax
jmp 0x41ede4
test ebx, ebx
jne 0x41ede4
and dword [esp + 0x14], ebx
lea edx, [esp + 0x14]
push 1
mov ecx, edi
call fcn.0041d085
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x41ede4
lea ecx, [esi - 0x10]
call fcn.0043d912
mov esi, dword [ebp + 8]
call fcn.0043d5bb
push eax
lea ecx, [esp + 0x14]
call fcn.0043bbe8
call fcn.0043d5bb
push eax
lea ecx, [esp + 0x1c]
call fcn.0043bbe8
cmp esi, 0xffffffff
je 0x41edd2
test esi, esi
je 0x41e992
cmp esi, 1
je 0x41e8dd
cmp esi, 3
je 0x41e992
push 0x57
pop ebx
jmp 0x41edd4
push 0x105
push 0x104
lea ecx, [esp + 0x20]
mov dword [ebp + 0xc], 0x4652daff
call fcn.0043d810
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov esi, dword [esp + 0x18]
push esi
call dword [sym.imp.SHLWAPI.dll_PathSkipRootW]
sub eax, esi
lea ecx, [esp + 0x18]
sar eax, 1
dec eax
push eax
call fcn.0043d882
mov eax, 0x248
lea ecx, [esp + 0x10]
push eax
mov dword [esp + 0x18], eax
call fcn.0043b9dd
xor ecx, ecx
mov dword [esp + 0xc], eax
push ecx
mov ebx, esp
mov word [eax + 0x24], cx
lea ecx, [esi - 0x10]
mov dword [eax], 4
call fcn.0043cad2
mov ecx, dword [esp + 0x10]
add eax, 0x10
mov dword [ebx], eax
call fcn.0041e426
mov ebx, eax
pop ecx
test ebx, ebx
je 0x41ea96
push ebx
lea eax, [esp + 0x20]
push 0x49616c
push eax
call fcn.0044af44
add esp, 0xc
push dword [eax]
push str.NativeDism
push 1
call dword [sym.imp.CBSHost.dll_DismWriteLog]
mov ecx, dword [esp + 0x1c]
lea ecx, [ecx - 0x10]
call fcn.0043d912
jmp 0x41edd4
mov ebx, dword [ebp + 0xc]
mov eax, 0x4652daff
cmp ebx, eax
je 0x41e9ab
test ebx, ebx
je 0x41e9ab
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x41e9b8
jmp 0x41e9e2
cmp dword [ebp + 0x10], 0
jne 0x41e8d5
mov dword [ebp + 0xc], eax
push 0x105
push 0x104
lea ecx, [esp + 0x20]
call fcn.0043d810
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push eax
lea ecx, [esp + 0x1c]
call fcn.0043d882
mov esi, dword [esp + 0x18]
push esi
call dword [sym.imp.SHLWAPI.dll_PathSkipRootW]
mov ebx, eax
mov ecx, esi
sub ebx, esi
sar ebx, 1
dec ebx
mov dword [esp + 0x24], ebx
call fcn.0044ccce
sub eax, ebx
lea ecx, [esp + 0x10]
add eax, eax
mov dword [esp + 0x20], eax
add eax, 0x248
push eax
mov dword [esp + 0x18], eax
call fcn.0043b9dd
push ecx
mov ecx, esp
mov dword [esp + 0x10], eax
push ebx
push esi
mov dword [eax], 3
call fcn.0043b8e8
mov ecx, dword [esp + 0x10]
call fcn.0041e426
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x41e95f
mov eax, dword [esp + 0xc]
mov edx, 0x8003
add eax, 0x14
mov ecx, esi
push 0x10
push eax
call fcn.0044c1d1
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x41ea75
push ebx
push esi
lea eax, [esp + 0x24]
push 0x49619c
push eax
call fcn.0044af44
add esp, 0x10
jmp 0x41e972
mov eax, dword [esp + 0x20]
add eax, 2
push eax
mov eax, dword [esp + 0x28]
lea eax, [esi + eax*2]
push eax
mov eax, dword [esp + 0x14]
add eax, 0x24
push eax
call dword [sym.imp.msvcrt.dll_memcpy]
add esp, 0xc
mov esi, dword [esp + 0x10]
cmp dword [esi - 4], 1
jle 0x41eab0
push dword [esi - 0xc]
lea ecx, [esp + 0x14]
call fcn.0043bb69
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
mov ebx, esi
and edi, 0xfffffff8
je 0x41eacf
mov edx, str.______8_13JMQ__79E__0xu_
mov ecx, ebx
call fcn.0041d27e
add ebx, 8
sub edi, 8
jne 0x41eabb
push dword [ebp + 0xc]
lea eax, [esp + 0x24]
push str._.8x_77a1_4391_9157_aba3f31b3629
push eax
call fcn.0044af44
add esp, 0xc
lea eax, [esp + 0x2c]
xor edi, edi
lea ecx, [esp + 0x24]
mov edx, str.BCD00000000Objects_
mov dword [esp + 0x30], edi
mov dword [esp + 0x28], edi
push eax
call fcn.00431d43
pop ecx
lea ecx, [esp + 0x30]
push ecx
push 0x20019
push dword [0x4ad198]
push dword [eax]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [esp + 0x24]
mov ebx, eax
lea ecx, [ecx - 0x10]
call fcn.0043d912
test ebx, ebx
jne 0x41edae
lea eax, [esp + 0x20]
mov edx, str.BCD00000000Objects_
push eax
lea ecx, [esp + 0x28]
call fcn.00431d43
pop ecx
push edi
lea ecx, [esp + 0x2c]
push ecx
push edi
push 0x2001f
push dword [0x4ad198]
push edi
push edi
push dword [eax]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push 0x80000002
call edi
mov ecx, dword [esp + 0x24]
mov ebx, eax
lea ecx, [ecx - 0x10]
call fcn.0043d912
test ebx, ebx
jne 0x41edae
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x30]
call fcn.0044e14c
mov ebx, eax
test ebx, ebx
jne 0x41edae
cmp dword [esi - 4], 1
jle 0x41ebaf
push dword [esi - 0xc]
lea ecx, [esp + 0x14]
call fcn.0043bb69
mov esi, dword [esp + 0x10]
push dword [esp + 0x14]
push esi
push 3
push 0
push str.Custom
push dword [esp + 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test ebx, ebx
jne 0x41edae
call fcn.0043d5bb
push eax
lea ecx, [esp + 0x10]
call fcn.0043bbe8
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0xc]
push eax
push ebx
push str.Element
mov edx, str.Elements11000001
call fcn.0044dfdf
mov eax, dword [esp + 0x18]
add esp, 0xc
cmp dword [eax - 4], 1
jle 0x41ec16
push dword [eax - 0xc]
lea ecx, [esp + 0x10]
call fcn.0043bb69
mov eax, dword [esp + 0xc]
push 0x496270
mov edx, eax
lea ecx, [esp + 0x14]
call fcn.0044b63b
push eax
mov edx, str.BCD00000000Objects_
lea ecx, [esp + 0x1c]
call fcn.00431d43
pop ecx
mov edx, eax
lea ecx, [esp + 0x28]
call fcn.0043baed
pop ecx
mov ecx, 0x80000002
mov edx, dword [eax]
call fcn.0044e022
mov ecx, dword [esp + 0x24]
lea ecx, [ecx - 0x10]
call fcn.0043d912
mov ecx, dword [esp + 0x14]
lea ecx, [ecx - 0x10]
call fcn.0043d912
mov ecx, dword [esp + 0x10]
lea ecx, [ecx - 0x10]
call fcn.0043d912
mov ecx, dword [esp + 0x28]
mov edx, str.Elements12000004
push 0x488134
push str.Element
call fcn.0044df3d
cmp dword [ebp + 8], 3
pop ecx
pop ecx
push ebx
je 0x41ecc3
lea ecx, [esp + 0x24]
call fcn.0043c971
mov edi, dword [esp + 0x20]
mov edx, str.BCD00000000Objects9dea862c_5cdd_4e70_acc1_f32b344d4795Elements24000002
push 0x50
push edi
push 7
push str.Element
mov ecx, 0x80000002
call fcn.0044de71
add esp, 0x10
mov ebx, eax
jmp 0x41ed9d
lea eax, [esp + 0x18]
mov dword [esp + 0x18], ebx
push eax
push ebx
push 0x2001f
push dword [0x4ad198]
push ebx
push ebx
push str.BCD00000000Objects9dea862c_5cdd_4e70_acc1_f32b344d4795Elements24000001
push 0x80000002
call edi
mov ebx, eax
test ebx, ebx
jne 0x41ed21
call fcn.0043d5bb
push eax
lea ecx, [esp + 0x14]
call fcn.0043bbe8
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push eax
mov edx, str.Element
call fcn.0044dd53
mov ebx, eax
pop ecx
mov ecx, dword [esp + 0x10]
test ebx, ebx
je 0x41ed3c
lea ecx, [ecx - 0x10]
call fcn.0043d912
lea ecx, [esp + 0x14]
call fcn.0043b8cb
mov edi, dword [esp + 0x20]
mov ecx, dword [esp + 0xc]
lea ecx, [ecx - 0x10]
call fcn.0043d912
jmp 0x41edb2
mov edi, dword [esp + 0x20]
mov edx, edi
call fcn.0044af09
test eax, eax
jne 0x41ed88
push dword [edi - 0xc]
lea ecx, [esp + 0x14]
push edi
call fcn.0043c99e
push 0
lea ecx, [esp + 0x14]
call fcn.0043c971
mov eax, dword [esp + 0x10]
mov ecx, dword [eax - 0xc]
lea ecx, [ecx*2 + 2]
push ecx
push eax
push 7
push 0
push str.Element
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov ecx, dword [esp + 0x10]
lea ecx, [ecx - 0x10]
call fcn.0043d912
lea ecx, [esp + 0x14]
call fcn.0043b8cb
test ebx, ebx
jne 0x41ed2e
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
jmp 0x41ed2e
mov edi, dword [esp + 0x20]
lea ecx, [esp + 0x28]
call fcn.0043b8cb
lea ecx, [esp + 0x30]
call fcn.0043b8cb
lea ecx, [edi - 0x10]
call fcn.0043d912
mov edi, dword [esp + 0x1c]
jmp 0x41edd8
xor ebx, ebx
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
lea ecx, [ecx - 0x10]
call fcn.0043d912
lea ecx, [esi - 0x10]
call fcn.0043d912
mov ecx, dword [esp + 0x2c]
add ecx, 0xfffffff0
call fcn.0043d912
lea ecx, [edi - 0x10]
call fcn.0043d912
mov eax, ebx
jmp 0x41ee09
mov eax, 0x80004002
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14