Function at 0x450844
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
xor eax, eax
mov ecx, 0x41
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x11c]
push ebx
sub esp, 0x1fc
mov dword [0x48fcc4], 0xffffffff
rep stosd dword es:[edi], eax
xor eax, eax
cmp dword [0x524a20], 0x61
mov dword [0x528584], eax
jbe 0x4509af
xor eax, eax
mov dword [esp], eax
call fcn.0044cb22
test al, 4
je 0x4509af
xor ebx, ebx
mov dword [esp + 4], 0x147
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
xor edi, edi
mov dword [esp + 0xc], ebx
mov dword [esp + 8], ebx
mov eax, dword [0x524170]
mov dword [esp], eax
call esi
sub esp, 0x10
mov dword [esp + 0xc], edi
mov dword [esp + 8], eax
mov dword [esp + 4], 0x150
mov eax, dword [0x524170]
mov dword [esp], eax
call esi
sub esp, 0x10
cmp eax, 2
jne 0x4509af
mov al, byte [0x510777]
lea ebx, [ebp - 0x11c]
cmp al, 1
jbe 0x450983
movzx esi, al
mov ecx, 0x5104a2
xor eax, eax
lea edx, [ebp - 0x1ac]
mov dword [edx + eax*4], ecx
inc eax
add ecx, 0x40
cmp esi, eax
jg 0x4508f9
mov dword [esp], 0xc3b
call fcn.00422df0
mov dword [esp], 0xc3a
mov edi, eax
call fcn.00422df0
lea edx, [ebp - 0x1ac]
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x14], 1
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov dword [esp], 9
call fcn.00443ea0
xor edx, edx
test eax, eax
jns 0x450970
mov dword [0x528584], 0xfffffffe
mov eax, 0xfffffffe
jmp 0x450e2a
sar eax, 1
je 0x450977
inc edx
jmp 0x450970
cmp edx, 3
cmovg edx, eax
mov dword [0x528584], edx
cmp byte [0x51076f], 0
jne 0x4509fc
xor ecx, ecx
mov dword [esp + 4], ecx
mov eax, dword [0x522ec8]
mov dword [esp], eax
call fcn.0044e201
test eax, eax
jne 0x4509b7
mov dword [esp], str.Could_not_mount_ISO_for_Windows_To_Go_selection
call fcn.0043d9e0
or eax, 0xffffffff
jmp 0x450e2a
mov edx, dword [0x528584]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x19c]
mov dword [esp + 0xc], 0x4b3574
shl edx, 6
mov dword [esp + 8], 0xffffffff
add edx, 0x5104a2
mov dword [esp + 4], pe_nt_image_headers32
mov dword [esp + 0x14], edx
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__snprintf_s]
mov byte [ebp - 0x11d], 0
mov eax, ebx
call fcn.0044f2a3
test eax, eax
je 0x450a10
cmp byte [ebp - 0x11c], 0
jne 0x450a38
mov dword [ebp - 0x118], 0x6d585666
mov dword [ebp - 0x11c], 0x75525c2e
mov dword [ebp - 0x116], 0x2e6c6d58
mov dword [ebp - 0x112], 0x706d74
mov eax, ebx
call fcn.0044f402
cmp byte [0x51076f], 0
lea eax, [ebp - 0x19c]
je 0x450a53
mov eax, dword [0x522ec8]
xor edi, edi
xor edx, edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], edi
mov dword [esp + 8], str._1_.xml
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0044d3df
test eax, eax
jne 0x450a88
mov dword [esp], str.Could_not_acquire_WIM_index
call fcn.0043d9e0
jmp 0x450e10
lea eax, [ebp - 0x1c4]
mov dword [esp + 4], 0x10
xor esi, esi
mov dword [esp], eax
call fcn.0043c01b
lea eax, [ebp - 0x1b8]
mov dword [esp + 4], 0x10
mov dword [esp], eax
call fcn.0043c01b
mov dword [ebp - 0x1dc], esi
xor esi, esi
lea edi, [esi + 1]
mov dword [esp + 4], ebx
mov dword [esp + 8], edi
mov dword [esp], str.IMAGE_INDEX
call fcn.00426ea9
xor ecx, ecx
mov dword [esp + 4], eax
lea eax, [ebp - 0x1b8]
mov dword [esp + 8], ecx
mov dword [esp], eax
call fcn.0043c061
test eax, eax
js 0x450b88
mov dword [esp + 8], edi
lea esi, [ebp - 0x1c4]
mov dword [esp + 4], ebx
mov dword [esp], str.DISPLAYNAME
call fcn.00426ea9
xor ecx, ecx
mov dword [esp], esi
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
call fcn.0043c061
test eax, eax
jns 0x450b81
mov dword [esp + 8], edi
mov dword [esp + 4], ebx
mov dword [esp], str.DESCRIPTION
call fcn.00426ea9
xor edx, edx
mov dword [esp], esi
mov dword [esp + 8], edx
mov dword [esp + 4], eax
call fcn.0043c061
test eax, eax
jns 0x450b77
mov dword [esp + 4], edi
mov dword [esp], str.Warning:_Could_not_find_a_description_for_image_index__d
call fcn.0043d9e0
mov dword [esp + 8], 1
mov dword [esp + 4], str.Unknown_Windows_Version
mov dword [esp], esi
call fcn.0043c061
mov dword [ebp - 0x1dc], 1
mov esi, edi
jmp 0x450abe
cmp dword [ebp - 0x1dc], 0
je 0x450b9d
mov dword [esp], str.Warning:_Nonstandard_Windows_image__missing__DISPLAYNAME__entries_
call fcn.0043d9e0
cmp esi, 1
jle 0x450c16
mov edx, dword [ebp - 0x1c4]
mov dword [ebp - 0x1dc], edx
mov dword [esp], 0xcdc
call fcn.00422df0
mov dword [esp], 0xcdb
mov edi, eax
call fcn.00422df0
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], esi
mov edx, dword [ebp - 0x1dc]
mov dword [esp + 8], edi
mov dword [esp + 0xc], edx
mov dword [esp + 4], eax
mov dword [esp], 9
call fcn.00443ea0
test eax, eax
js 0x450c07
xor esi, esi
inc esi
sar eax, 1
jne 0x450c00
jmp 0x450c2e
mov dword [0x48fcc4], 0xfffffffe
jmp 0x450df4
test esi, esi
jne 0x450c29
mov dword [0x48fcc4], 1
jmp 0x450df4
mov esi, 1
mov eax, dword [ebp - 0x1b8]
lea edi, [esi + 0x3fffffff]
mov eax, dword [eax + edi*4]
mov dword [esp], eax
call sub.msvcrt.dll_atoi
mov edx, esi
mov dword [0x48fcc4], eax
mov eax, ebx
call fcn.0044f010
cmp word [0x51078e], 0
je 0x450c67
cmp word [0x510792], 0
jne 0x450c73
mov dword [esp], str.Warning:_Could_not_obtain_version_information_from_XML_index__Nonstandard_Windows_image__
call fcn.0043d9e0
mov eax, dword [ebp - 0x1b8]
mov eax, dword [eax + edi*4]
mov dword [esp + 0xc], eax
movzx eax, word [0x510792]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x1c4]
mov eax, dword [eax + edi*4]
mov dword [esp], str.Will_use__s__Build:__d__Index__s__for_Windows_To_Go
mov dword [esp + 4], eax
call fcn.0043d9e0
cmp word [0x510792], 0x3a97
ja 0x450d94
cmp dword [0x4df238], 0xc
je 0x450df4
mov ax, word [0x48fbc0]
cmp dword [0x524134], 1
sbb edi, edi
mov word [ebp - 0x1dc], ax
and edi, 0xffe80000
mov dword [esp], 0xc76
add edi, 0x180034
call fcn.00422df0
mov dword [esp], 0xc1a
mov esi, eax
call fcn.00422df0
mov ecx, dword [0x5241b4]
mov dword [ebp - 0x1e4], ecx
call fcn.0044f175
mov dword [ebp - 0x1e0], eax
mov eax, esi
call fcn.0044f175
mov esi, eax
movzx eax, word [ebp - 0x1dc]
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 0x10], eax
mov edx, dword [ebp - 0x1e0]
mov dword [esp + 4], edx
mov ecx, dword [ebp - 0x1e4]
mov dword [esp], ecx
call dword [sym.imp.USER32.dll_MessageBoxExW]
mov dword [ebp - 0x1dc], eax
sub esp, 0x14
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, dword [ebp - 0x1e0]
mov edi, eax
test edx, edx
je 0x450d6b
mov dword [esp], edx
call sub.msvcrt.dll_free
test esi, esi
je 0x450d77
mov dword [esp], esi
call sub.msvcrt.dll_free
mov dword [esp], edi
call dword [sym.imp.KERNEL32.DLL_SetLastError]
push edx
cmp dword [ebp - 0x1dc], 6
je 0x450d94
mov dword [0x48fcc4], 0xfffffffe
cmp word [0x510792], 0x4563
jne 0x450df4
mov word [ebp - 0x1cc], 0xffff
mov dword [ebp - 0x1c8], str.https:__github.com_pbatard_rufus_wiki_FAQbsods_with_windows_to_go_drives_created_from_windows_10_1809_isos
mov dword [esp], 0xc3d
call fcn.00422df0
mov dword [esp + 4], str.Windows_To_Go
mov dword [esp], 0xc38
mov esi, eax
call fcn.00422df0
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x1cc]
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], eax
call fcn.00443d34
lea eax, [ebp - 0x1c4]
mov dword [esp], eax
call fcn.0043c17c
lea eax, [ebp - 0x1b8]
mov dword [esp], eax
call fcn.0043c17c
mov eax, ebx
call fcn.0044f402
cmp byte [0x51076f], 0
jne 0x450e25
call fcn.0044e156
mov eax, dword [0x48fcc4]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret