Function at 0x401000
Capabilities:
Allocate thread local storage

Disassembly:
push 0x1a0
push 0
push 0x49cc1c
call fcn.0043ca10
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleW
mov dword [0x49cc20], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x49cc1c], eax
call section..text
call fcn.0042659a
call fcn.00461f70
call fcn.0046147f
call fcn.004610b0
call fcn.0045f110
call fcn.0045d122
call fcn.0045c950
call fcn.0045c221
call fcn.0045b846
call fcn.0045b5e7
call fcn.0045b513
call fcn.0045b277
call fcn.0045a80e
call fcn.0045a12b
call fcn.00459ad0
call fcn.00458e26
call fcn.004577d2
call fcn.004575d5
call fcn.00455dad
call fcn.00455a7a
call fcn.0044c14c
call fcn.0044be49
call fcn.0044b483
call fcn.0044a968
call fcn.0044a3f7
call fcn.00449c27
call fcn.00449940
call fcn.004492e4
push 0x49cd24
mov eax, str.DC1C5A9C_E88A_4dde_A5A1_60F82A20AEF7
push eax
call sub.ole32.dll_CLSIDFromString
push 0x49cd34
mov eax, str.d57c7288_d4ad_4768_be02_9d969532d960
push eax
call sub.ole32.dll_IIDFromString
push 0x49cd84
mov eax, str.43826d1e_e718_42ee_bc55_a1e261c37bfe
push eax
call sub.ole32.dll_IIDFromString
push 0x49cd54
mov eax, str.1CF2B120_547D_101B_8E65_08002B2BD119
push eax
call sub.ole32.dll_IIDFromString
push 0x49cd44
mov eax, str.00000000_0000_0000_0000_000000000000
push eax
call sub.ole32.dll_CLSIDFromString
push 0x49cd64
mov eax, 0x4968e4
push eax
call sub.ole32.dll_CLSIDFromString
push 0x49cd74
mov eax, str.2933BF96_7B36_11d2_B20E_00C04F983E60
push eax
call sub.ole32.dll_IIDFromString
mov byte [0x49cd18], 0
mov byte [0x49cd19], 0
mov edx, 0x497c7c
lea ecx, [0x49ccd8]
call fcn.00426068
push edx
call fcn.00461fa0
pop edx
push eax
push edx
call fcn.00461fa0
pop edx
push eax
push edx
call fcn.00461fa0
pop edx
push eax
push edx
call fcn.00461fa0
pop edx
push eax
call fcn.0044a997
call fcn.00426482
add dword [esp], edx
call fcn.00458f11
mov edx, str.x86libwim_15.dll
push edx
call fcn.00461fd0
push 0x49cc40
call fcn.00462020
mov dword [0x49cc90], 0
mov dword [0x49cc50], 0
mov byte [0x49cd1a], 3
push 8
push 0x499ba0
lea eax, [0x49cda4]
push eax
push 4
call fcn.0045b865
push 8
push 0x499ba0
lea eax, [0x49cdac]
push eax
push 4
call fcn.0045b865
push 8
push 0x499ba0
lea eax, [0x49cdb4]
push eax
push 4
call fcn.0045b865
mov edx, str.INDEX:R:
lea ecx, [0x49ccf8]
call fcn.00426068
mov eax, 0x494c28
push eax
push dword [0x49ccf8]
call fcn.0045f400
mov ebx, eax
inc ebx
mov dword [0x49cca4], ebx
mov edx, str.NAME:L:
lea ecx, [0x49ccb8]
call fcn.00426068
mov eax, 0x494c28
push eax
push dword [0x49ccb8]
call fcn.0045f400
mov ebx, eax
inc ebx
mov dword [0x49cc58], ebx
mov edx, 0x496d24
lea ecx, [0x49cc44]
call fcn.00426068
mov eax, 0x494c28
push eax
push dword [0x49cc44]
call fcn.0045f400
mov ebx, eax
inc ebx
mov dword [0x49ccf0], ebx
mov edx, str.HardwareDescription:L:
lea ecx, [0x49cd10]
call fcn.00426068
mov eax, 0x494c28
push eax
push dword [0x49cd10]
call fcn.0045f400
mov ebx, eax
inc ebx
mov dword [0x49ccc4], ebx
push edx
call fcn.00461fa0
pop edx
push eax
push 0x24
call fcn.004123ac
push 0x49ccfc
call fcn.00462020
push edx
call fcn.00461fa0
pop edx
push eax
push 0x25
call fcn.004123ac
push 0x49cc80
call fcn.00462020
mov edx, dword [0x49ccfc]
push edx
call fcn.00461fa0
pop edx
push eax
push edx
call fcn.00461fd0
lea eax, [0x49cd1c]
push 3
push eax
call fcn.00462090
mov edx, dword [0x49cc80]
push edx
call fcn.00461fa0
pop edx
push eax
push edx
call fcn.00461fd0
mov edx, str.Shell32.dll
push edx
call fcn.00461fd0
push 0x49cc48
call fcn.00462020
mov edx, dword [0x49cc80]
push edx
call fcn.00461fa0
pop edx
push eax
push edx
call fcn.00461fd0
mov edx, str.imageres.dll
push edx
call fcn.00461fd0
push 0x49ccb4
call fcn.00462020
mov edx, dword [0x49cc80]
push edx
call fcn.00461fa0
pop edx
push eax
push edx
call fcn.00461fd0
mov edx, str._setupapi.dll
push edx
call fcn.00461fd0
push 0x49cccc
call fcn.00462020
push edx
call fcn.00461fa0
pop edx
push eax
push edx
call fcn.00461fa0
pop edx
push eax
push edx
call fcn.00461fa0
pop edx
push eax
push edx
call fcn.00461fa0
pop edx
push eax
call fcn.0044a997
call fcn.00426482
add dword [esp], edx
call fcn.00458f11
mov edx, str.Wiminfo.icl
push edx
call fcn.00461fd0
push 0x49cc38
call fcn.00462020
push edx
call fcn.00461fa0
pop edx
push eax
push edx
call fcn.00461fa0
pop edx
push eax
push edx
call fcn.00461fa0
pop edx
push eax
push edx
call fcn.00461fa0
pop edx
push eax
call fcn.0044a997
call fcn.00426482
add dword [esp], edx
call fcn.00458f11
mov edx, str.Wiminfo.icl
push edx
call fcn.00461fd0
push 0x49ccf4
call fcn.00462020
push edx
call fcn.00461fa0
pop edx
push eax
push edx
call fcn.00461fa0
pop edx
push eax
push edx
call fcn.00461fa0
pop edx
push eax
push edx
call fcn.00461fa0
pop edx
push eax
call fcn.0044a997
call fcn.00426482
add dword [esp], edx
call fcn.00458f11
mov edx, str.Wiminfo.icl
push edx
call fcn.00461fd0
push 0x49ccbc
call fcn.00462020
push dword [0x49cc38]
call fcn.00458f9a
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xffffffff
jne 0x40147f
cmp edi, 0xffffffff
je 0x401483
xor eax, eax
jmp 0x401488
mov eax, 1
or eax, eax
je 0x4014aa
mov edx, dword [0x49cc48]
push edx
call fcn.00461fa0
pop edx
push eax
push edx
call fcn.00461fd0
push 0x49cc38
call fcn.00462020
push dword [0x49ccf4]
call fcn.00458f9a
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xffffffff
jne 0x4014c3
cmp edi, 0xffffffff
je 0x4014c7
xor eax, eax
jmp 0x4014cc
mov eax, 1
or eax, eax
je 0x4014ee
mov edx, dword [0x49ccb4]
push edx
call fcn.00461fa0
pop edx
push eax
push edx
call fcn.00461fd0
push 0x49ccf4
call fcn.00462020
push dword [0x49ccbc]
call fcn.00458f9a
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xffffffff
jne 0x401507
cmp edi, 0xffffffff
je 0x40150b
xor eax, eax
jmp 0x401510
mov eax, 1
or eax, eax
je 0x401532
mov edx, dword [0x49cccc]
push edx
call fcn.00461fa0
pop edx
push eax
push edx
call fcn.00461fd0
push 0x49ccbc
call fcn.00462020
mov dword [0x49cc2c], 0xffffffff
push 0xdc
push 0xe1
push 0xe1
call fcn.0045b51f
mov dword [0x49cc28], eax
mov dword [0x49ccb0], 0xffffffff
push 0xe1
push 0xfe
push 0xfe
call fcn.0045b51f
mov dword [0x49ccac], eax
mov dword [0x49ccd0], 0xffffffff
push 0xe1
push 0xfe
push 0xfe
call fcn.0045b51f
mov dword [0x49ccc8], eax
mov dword [0x49cc74], 0xffffffff
push 0xe0
push 0xf5
push 0xfe
call fcn.0045b51f
mov dword [0x49cc6c], eax
mov dword [0x49cc54], 0xffffffff
push 0xf6
push 0xfa
push 0xfb
call fcn.0045b51f
mov dword [0x49cc4c], eax
mov dword [0x49cc9c], 0
push 0x49cd94
push 0
push 0xa
push 3
push 0x208
call fcn.0045b2a0
push 0x49cd9c
push 0x499ba0
push 8
push 3
push 4
call fcn.0045b2a0
mov ebp, dword [0x49cd94]
lea eax, [ebp]
mov edx, 0x494038
push edx
push 0x104
push eax
call fcn.004620d0
lea eax, [ebp + 0x208]
mov edx, 0x494038
push edx
push 0x104
push eax
call fcn.004620d0
mov ebp, dword [0x49cd9c]
mov edx, 0x494038
lea ecx, [ebp]
call fcn.00426068
mov edx, 0x494038
lea ecx, [ebp + 4]
call fcn.00426068
mov eax, str.76b85ef8_9c0a_402f_92c2_be6281a3e508
push eax
call fcn.0041269e
push str.libwim_15.dll
call fcn.0040405e
push edx
call fcn.00461fa0
pop edx
push eax
push edx
call fcn.00461fa0
pop edx
push eax
mov eax, 0x4968de
push eax
mov eax, str.SoftwareWimInfoREG
push eax
push SysReAllocString
call fcn.00419655
call fcn.00426482
add dword [esp], edx
call fcn.0045f4b0
call fcn.004264a0
push eax
push edx
call fcn.00461fa0
pop edx
push eax
push edx
call fcn.00461fa0
pop edx
push eax
mov eax, 0x496a84
push eax
mov eax, str.SoftwareWimInfoREG
push eax
push SysReAllocString
call fcn.00419655
call fcn.00426482
add dword [esp], edx
call fcn.0045f4b0
call fcn.004264a0
push eax
push edx
call fcn.00461fa0
pop edx
push eax
push edx
call fcn.00461fa0
pop edx
push eax
mov eax, 0x496a90
push eax
mov eax, str.SoftwareWimInfoREG
push eax
push SysReAllocString
call fcn.00419655
call fcn.00426482
add dword [esp], edx
call fcn.0045f4b0
call fcn.004264a0
push eax
push edx
call fcn.00461fa0
pop edx
push eax
push edx
call fcn.00461fa0
pop edx
push eax
mov eax, 0x496a8a
push eax
mov eax, str.SoftwareWimInfoREG
push eax
push SysReAllocString
call fcn.00419655
call fcn.00426482
add dword [esp], edx
call fcn.0045f4b0
call fcn.004264a0
push eax
call fcn.0041e284
call fcn.004251f2
call fcn.0040c28b
mov eax, str.WimFiles
push eax
push 0xc
call fcn.00418825
push dword [0x49cce8]
call sub.USER32.dll_DestroyIcon
push dword [0x49cc30]
call sub.USER32.dll_DestroyIcon
push dword [0x49cce0]
call sub.USER32.dll_DestroyIcon
push dword [0x49cce4]
call sub.USER32.dll_DestroyIcon
push dword [0x49cc24]
call sub.USER32.dll_DestroyIcon
push dword [0x49cc8c]
call sub.USER32.dll_DestroyIcon
push dword [0x49ccc0]
call sub.USER32.dll_DestroyIcon
push dword [0x49cd14]
call sub.USER32.dll_DestroyIcon
push dword [0x49ccd4]
call sub.USER32.dll_DestroyIcon
push dword [0x49cca8]
call sub.USER32.dll_DestroyIcon
push dword [0x49cc7c]
call sub.USER32.dll_DestroyIcon
push dword [0x49cc70]
call sub.USER32.dll_DestroyIcon
push dword [0x49cc34]
call sub.USER32.dll_DestroyIcon
push dword [0x49cca0]
call sub.USER32.dll_DestroyIcon
push dword [0x49cd0c]
call sub.USER32.dll_DestroyIcon
push dword [0x49cc88]
call sub.USER32.dll_DestroyIcon
push dword [0x49cd00]
push dword [0x49cc78]
call sub.USER32.dll_ReleaseDC
push dword [0x49cd04]
call sub.GDI32.dll_DeleteObject
push dword [0x49cc84]
call sub.GDI32.dll_DeleteObject
mov ebx, dword [0x49cc5c]
and ebx, ebx
je 0x40187c
push dword [0x49cc5c]
call sub.GDI32.dll_DeleteObject
push dword [0x49cda4]
call fcn.0045b8f7
push dword [0x49cdac]
call fcn.0045b8f7
push dword [0x49cdb4]
call fcn.0045b8f7
push edx
call fcn.00461fa0
pop edx
push eax
mov eax, 2
push eax
mov ebp, dword [0x49cd9c]
push dword [ebp]
call fcn.00413968
call fcn.004264a0
push edx
call fcn.00461fa0
pop edx
push eax
mov eax, 2
push eax
mov ebp, dword [0x49cd9c]
push dword [ebp + 4]
call fcn.00413968
call fcn.004264a0
push dword [0x49cc40]
call fcn.004242f3
add esp, 4
push 0
call fcn.00455e18
mov ebx, eax
and ebx, ebx
jne 0x401a61
push edx
call fcn.00461fa0
pop edx
push eax
push 1
push edx
call fcn.00461fa0
pop edx
push eax
push edx
call fcn.00461fa0
pop edx
push eax
push 0
call fcn.00455ec6
cdq
push edx
push eax
call fcn.0045f640
call fcn.00462100
mov eax, 0x496a8a
push eax
mov eax, str.SoftwareWimInfoREG
push eax
push SysReAllocString
call fcn.00426482
add dword [esp + 0xc], edx
call fcn.0042068a
call fcn.004264a0
push edx
call fcn.00461fa0
pop edx
push eax
push 1
push edx
call fcn.00461fa0
pop edx
push eax
push edx
call fcn.00461fa0
pop edx
push eax
push 0
call fcn.00455f33
cdq
push edx
push eax
call fcn.0045f640
call fcn.00462100
mov eax, 0x496a90
push eax
mov eax, str.SoftwareWimInfoREG
push eax
push SysReAllocString
call fcn.00426482
add dword [esp + 0xc], edx
call fcn.0042068a
call fcn.004264a0
push edx
call fcn.00461fa0
pop edx
push eax
push 1
push edx
call fcn.00461fa0
pop edx
push eax
push edx
call fcn.00461fa0
pop edx
push eax
push 0
call fcn.00455f88
cdq
push edx
push eax
call fcn.0045f640
call fcn.00462100
mov eax, 0x496a84
push eax
mov eax, str.SoftwareWimInfoREG
push eax
push SysReAllocString
call fcn.00426482
add dword [esp + 0xc], edx
call fcn.0042068a
call fcn.004264a0
push edx
call fcn.00461fa0
pop edx
push eax
push 1
push edx
call fcn.00461fa0
pop edx
push eax
push edx
call fcn.00461fa0
pop edx
push eax
push 0
call fcn.00456004
cdq
push edx
push eax
call fcn.0045f640
call fcn.00462100
mov eax, 0x4968de
push eax
mov eax, str.SoftwareWimInfoREG
push eax
push SysReAllocString
call fcn.00426482
add dword [esp + 0xc], edx
call fcn.0042068a
call fcn.004264a0
push 0
mov eax, str.SeRestorePrivilege
push eax
call fcn.0041021a
push 0
mov eax, str.SeBackupPrivilege
push eax
call fcn.0041021a
push 0
call fcn.00455d10
movsx ebx, byte [0x49cd1a]
cmp ebx, 2
jge 0x401aa4
movsx eax, byte [0x49cd1a]
push eax
call fcn.00407c29
push 0
jmp 0x401ab0
call 0x401aca
call fcn.00461f50
push dword [0x49cc1c]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess
call fcn.004498fe
call fcn.0044b471
call fcn.0044be3d
call fcn.0044c0f0
call sub.ole32.dll_OleUninitialize
call fcn.00455d8a
call fcn.004575c4
call fcn.00458e1a
call fcn.004590f1
call fcn.00459ac0
call fcn.0045a10d
call fcn.0045b5db
call fcn.0045c214
call fcn.0045f130
call fcn.0046150d
call fcn.00461557
call fcn.004610a0
ret