Function at 0x424390
Capabilities:
Create thread
Get graphical window text
Hide graphical window
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x458
mov eax, dword [0x438004]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [0x43ac80]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, ecx
push 0
push 0
push 0x147
push 0x44e
push dword [0x439030]
mov dword [ebp - 0x424], esi
call edi
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x147
push 0x49a
push dword [0x439008]
mov dword [ebp - 0x434], eax
call edi
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x14a
push dword [0x439044]
mov eax, dword [eax*4 + 0x430880]
mov dword [ebp - 0x440], eax
call edi
mov edx, 0x4389b8
mov ecx, eax
call fcn.00428250
push 0
push 0
push 0xf0
push 0x49b
push dword [0x439008]
mov dword [ebp - 0x42c], eax
call edi
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
dec eax
neg eax
push 0x442
push dword [0x43901c]
sbb eax, eax
inc eax
mov dword [ebp - 0x43c], eax
call edi
push eax
call dword [sym.imp.USER32.dll_IsWindowEnabled]
neg eax
sbb eax, eax
inc eax
cmp dword [0x43acf8], 0
mov dword [ebp - 0x438], eax
je 0x424485
call dword [sym.imp.dcapi.dll_dc_efi_is_secureboot]
mov dword [ebp - 0x428], eax
jmp 0x42448f
mov dword [ebp - 0x428], 0
push 0x442
push dword [0x43901c]
call edi
mov edx, 0x438b90
mov ecx, eax
call fcn.00428250
push 0x146
push dword [0x43901c]
mov byte [ebp - 0x420], al
call edi
mov edx, 0x438914
mov ecx, eax
call fcn.00428250
mov ecx, dword [ebx + 0x1c9c]
mov byte [ebp - 0x41f], al
mov dword [ebx + 0x1ca0], 1
sub ecx, 2
je 0x424948
sub ecx, 2
je 0x424778
mov byte [ebx + 0x1675], al
mov dword [ebx + 0x1ca0], 0
cmp dword [0x439034], 0
je 0x4245c2
cmp dword [ebp - 0x434], 0
je 0x4245b2
cmp dword [0x43acf8], 0
je 0x424599
mov eax, dword [ebp - 0x428]
test eax, eax
je 0x424575
call dword [sym.imp.dcapi.dll_dc_efi_shim_available]
test eax, eax
jne 0x424550
push 0x10
push str.Error
push str.For_compatibility_with_secure_boot_a_shim_loader_must_be_installed_however_the_required_archive__shim_x64.zip_resp._shim_ia32.zip__is_missing_from_the_application_directory._nBootloader_installation_therefor_cannot_continue__please_reboot_and_disable_secure_boot_in_your_firmware_settings_to_resolve_this_issue._n
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 0x2a
jmp 0x4245ac
push 0x34
push str.Warning
push str.For_compatibility_with_secure_boot_the_shim_loader_will_be_installed._nUpon_first_boot_you_will_be_encounter_an_Access_denied_error_message__to_resolve_this__you_will_need_to_start_the_MOK_Manager_and_enroll_a_certificate_located_at_EFIBootPreLoader.cer_nAfter_one_more_reboot_the_DCS_loader_should_boot_and_show_you_a_password_prompt._nDo_you_want_to_continue_
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
je 0x42456f
mov eax, 0x2a
jmp 0x4245ac
mov eax, dword [ebp - 0x428]
push 1
push eax
push 0xffffffffffffffff
call dword [sym.imp.dcapi.dll_dc_set_efi_boot]
add esp, 0xc
test eax, eax
jne 0x4245ac
push 0xffffffffffffffff
push str.DiskCrypto__DCS__loader
call dword [sym.imp.dcapi.dll_dc_efi_set_bme]
add esp, 8
jmp 0x4245ac
push dword [ebp - 0x438]
or edx, 0xffffffff
mov ecx, esi
call fcn.00417cb0
add esp, 4
mov dword [ebx + 0x1ca0], eax
call dword [sym.imp.dcapi.dll_is_w10_reflect_supported]
test eax, eax
je 0x4245c2
call dword [sym.imp.dcapi.dll_update_w10_reflect_driver]
cmp dword [ebx + 0x1ca0], 0
jne 0x424693
push 0x45d
push dword [0x439044]
call edi
push eax
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x4245ff
mov edx, dword [ebp - 0x42c]
mov ecx, ebx
push 0
call fcn.00424a80
add esp, 4
mov dword [ebx + 0x1ca0], eax
cmp dword [ebx + 0x1ca0], 0
jne 0x424693
mov eax, dword [ebx + 0x1c9c]
test eax, eax
je 0x4246ce
cmp eax, 3
jne 0x424693
push 0
push 0
push 0
push 0xf0
push 0x40a
push dword [0x439044]
call edi
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x408
push dword [0x439044]
lea esi, [eax - 1]
neg esi
sbb esi, esi
call edi
lea edx, [esi + 1]
mov ecx, eax
call fcn.00419f60
mov esi, eax
add esp, 4
test esi, esi
je 0x42468d
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebx + 0x1244]
push esi
push ecx
call dword [sym.imp.dcapi.dll_dc_start_format]
add esp, 0xc
mov dword [ebx + 0x1ca0], eax
push esi
call dword [sym.imp.dcapi.dll_secure_free]
add esp, 4
mov esi, dword [ebp - 0x424]
cmp dword [ebx + 0x20c0], 0
mov eax, dword [ebp - 0x43c]
mov dword [ebx + 0x1c94], eax
mov eax, dword [ebp - 0x440]
mov dword [ebx + 0x1c98], eax
jne 0x4246bd
push 0
push esi
call dword [sym.imp.USER32.dll_EndDialog]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004010c7
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 0xf0
push 0x40a
push dword [0x439044]
call edi
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x408
push dword [0x439044]
lea esi, [eax - 1]
neg esi
sbb esi, esi
call edi
lea edx, [esi + 1]
mov ecx, eax
call fcn.00419f60
mov esi, eax
add esp, 4
test esi, esi
je 0x42468d
cmp dword [0x439070], 0
lea ecx, [ebp - 0x420]
push ecx
lea eax, [ebx + 0x1244]
push esi
push eax
je 0x42476d
call dword [sym.imp.dcapi.dll_dc_prep_encrypt]
add esp, 0xc
mov dword [ebx + 0x1ca0], eax
test eax, eax
jne 0x424683
push str.The_bootloader_has_been_configured__after_the_reboot_it_should_show_you_a_password_prompt._nYou_can_abort_by_pressing_escape_instead_of_entering_a_password._nDo_you_want_to_restart_your_computer_now_
push eax
call fcn.00426290
add esp, 8
test eax, eax
je 0x42475e
call fcn.00426210
mov dword [ebx + 0x1ca0], 0x2a
jmp 0x424683
call dword [sym.imp.dcapi.dll_dc_start_encrypt]
jmp 0x42467a
lea edi, [ebx + 0x22b0]
mov ecx, 0x76
mov dword [edi], 0xffffffff
lea eax, [ebp - 0x430]
mov dword [edi + 4], 0xffffffff
mov esi, edi
add edi, 8
rep movsd dword es:[edi], dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, dword [ebp - 0x42c]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0
push 0
push 0xf0
mov dword [ebx + 0x20cc], eax
mov eax, dword [ebp - 0x430]
push 0x40a
mov dword [ebx + 0x20c8], eax
push dword [0x439044]
call edi
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x408
push dword [0x439044]
lea esi, [eax - 1]
neg esi
sbb esi, esi
call edi
lea edx, [esi + 1]
mov ecx, eax
call fcn.00419f60
add esp, 4
mov dword [ebp - 0x42c], eax
test eax, eax
je 0x42468d
push 0x208
lea eax, [ebp - 0x214]
push 0
push eax
call fcn.004023d0
add esp, 0xc
lea eax, [ebp - 0x41c]
push 0x208
push 0
push eax
call fcn.004023d0
add esp, 0xc
lea eax, [ebp - 0x214]
push 0x104
push eax
push 0x45e
push dword [0x438ff4]
call edi
mov esi, dword [sym.imp.USER32.dll_GetWindowTextW]
push eax
call esi
push 0x104
lea eax, [ebp - 0x41c]
push eax
push 0x4b9
push dword [0x438ff4]
call edi
push eax
call esi
lea ecx, [ebp - 0x214]
mov eax, ebx
mov edx, ecx
sub eax, edx
lea edx, [eax + 0x1cb0]
nop dword [eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x424890
lea ecx, [ebp - 0x41c]
mov eax, ebx
mov edx, ecx
sub eax, edx
lea edx, [eax + 0x1eb8]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x4248b2
movzx eax, byte [ebp - 0x420]
mov edi, dword [ebp - 0x42c]
push 0
push 4
push ebx
push 0x41a7e0
push 0
push 0
mov dword [ebx + 0x1cac], eax
mov dword [ebx + 0x1ca8], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xfffffffffffffffe
push eax
mov dword [ebx + 0x20c0], eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push dword [ebx + 0x20c0]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp dword [ebx + 0x20c0], 0
je 0x42491c
cmp eax, 0xffffffff
jne 0x42468d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp - 0x424]
neg eax
push eax
push str.Error_create_thread
push esi
call fcn.00426320
add esp, 0xc
push edi
call dword [sym.imp.dcapi.dll_secure_free]
add esp, 4
jmp 0x424693
push 0x208
lea eax, [ebp - 0x214]
push 0
push eax
call fcn.004023d0
add esp, 0xc
mov dword [ebp - 0x454], ebx
lea eax, [ebp - 0x214]
mov dword [ebp - 0x450], 0
mov dword [ebp - 0x44c], 0
mov dword [ebp - 0x448], eax
push 0
push esi
mov dword [ebp - 0x444], 0
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [ebp - 0x454]
push eax
push 0x420790
push dword [0x43ad48]
push 0x6b
push 0
call dword [sym.imp.USER32.dll_DialogBoxParamW]
cmp eax, 1
jne 0x424a6d
mov al, byte [ebp - 0x41f]
mov byte [ebx + 0x1675], al
lea eax, [ebp - 0x420]
push eax
push dword [ebp - 0x450]
lea eax, [ebx + 0x1244]
push eax
call dword [sym.imp.dcapi.dll_dc_start_re_encrypt]
add esp, 0xc
mov dword [ebx + 0x1ca0], eax
push dword [ebp - 0x450]
call dword [sym.imp.dcapi.dll_secure_free]
add esp, 4
cmp word [ebp - 0x214], 0
je 0x424693
lea eax, [ebx + 0x144c]
push eax
push 0x431dd8
lea eax, [ebp - 0x41c]
push 0x104
push eax
call fcn.00401010
add esp, 0x10
lea ecx, [ebp - 0x214]
call fcn.004264b0
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointW]
test eax, eax
jne 0x424693
push dword [ebx + 0x1ca0]
push str.Error_when_adding_mount_point
push dword [0x43ad48]
call fcn.00426320
add esp, 0xc
jmp 0x424693
mov dword [ebx + 0x1ca0], 0x2a
jmp 0x424693