Function at 0x40e9db
Capabilities:
Manipulate boot configuration

Disassembly:
push ebp
push ebx
xor eax, eax
push eax
call fcn.0045e790
push edx
call fcn.0045e620
pop edx
push eax
mov ebp, dword [0x47356c]
mov edx, dword [ebp + 0xc]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
mov edx, str.wimgapi.dll
push edx
call fcn.0045e6f0
call fcn.0044e2d2
add dword [esp], edx
call fcn.00417bc9
call fcn.0044e2f0
and eax, eax
je 0x40eaf4
push edx
call fcn.0045e620
pop edx
push eax
mov ebp, dword [0x47356c]
mov edx, dword [ebp + 0xc]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
mov edx, str._bcdboot.exe
push edx
call fcn.0045e6f0
call fcn.0044e2d2
add dword [esp], edx
call fcn.00417bc9
call fcn.0044e2f0
and eax, eax
je 0x40eaf4
push edx
call fcn.0045e620
pop edx
push eax
mov ebp, dword [0x47356c]
mov edx, dword [ebp + 0xc]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
mov edx, str._bcdedit.exe
push edx
call fcn.0045e6f0
call fcn.0044e2d2
add dword [esp], edx
call fcn.00417bc9
call fcn.0044e2f0
and eax, eax
je 0x40eaf4
push edx
call fcn.0045e620
pop edx
push eax
mov ebp, dword [0x47356c]
mov edx, dword [ebp + 0xc]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
mov edx, str._bootsect.exe
push edx
call fcn.0045e6f0
call fcn.0044e2d2
add dword [esp], edx
call fcn.00417bc9
call fcn.0044e2f0
and eax, eax
je 0x40eaf4
mov eax, 1
jmp 0x40eaf6
xor eax, eax
and eax, eax
je 0x40ecca
mov dword [esp], 1
push edx
call fcn.0045e620
pop edx
push eax
mov ebp, dword [0x47356c]
mov edx, dword [ebp + 8]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
mov edx, str.Toolsx86DISMwofadk.sys
push edx
call fcn.0045e6f0
call fcn.0044e2d2
add dword [esp], edx
call fcn.00417bc9
call fcn.0044e2f0
and eax, eax
je 0x40eb9c
push edx
call fcn.0045e620
pop edx
push eax
push 0
push 0x2000
mov ebp, dword [0x47356c]
mov edx, dword [ebp + 8]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
mov edx, str.Toolsx86DISMwofadk.sys
push edx
call fcn.0045e6f0
call fcn.0044e2d2
add dword [esp], edx
call fcn.00401db8
call fcn.0044e2f0
mov ebx, eax
cmp ebx, 0x3410662c
je 0x40eb9c
mov eax, 1
jmp 0x40eb9e
xor eax, eax
and eax, eax
je 0x40ebe5
push edx
call fcn.0045e620
pop edx
push eax
mov ebp, dword [0x47356c]
mov edx, dword [ebp + 8]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
mov edx, str.Toolsx86DISMwofadk.sys
push edx
call fcn.0045e6f0
call fcn.0044e2d2
add dword [esp], edx
call fcn.0045b4d7
call fcn.0044e2f0
mov dword [esp], 0
push edx
call fcn.0045e620
pop edx
push eax
mov ebp, dword [0x47356c]
mov edx, dword [ebp + 8]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
mov edx, str.Toolsx64DISMwofadk.sys
push edx
call fcn.0045e6f0
call fcn.0044e2d2
add dword [esp], edx
call fcn.00417bc9
call fcn.0044e2f0
and eax, eax
je 0x40ec7c
push edx
call fcn.0045e620
pop edx
push eax
push 0
push 0x2000
mov ebp, dword [0x47356c]
mov edx, dword [ebp + 8]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
mov edx, str.Toolsx64DISMwofadk.sys
push edx
call fcn.0045e6f0
call fcn.0044e2d2
add dword [esp], edx
call fcn.00401db8
call fcn.0044e2f0
mov ebx, eax
cmp ebx, 0x56379a7e
je 0x40ec7c
mov eax, 1
jmp 0x40ec7e
xor eax, eax
and eax, eax
je 0x40ecc5
push edx
call fcn.0045e620
pop edx
push eax
mov ebp, dword [0x47356c]
mov edx, dword [ebp + 8]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
mov edx, str.Toolsx64DISMwofadk.sys
push edx
call fcn.0045e6f0
call fcn.0044e2d2
add dword [esp], edx
call fcn.0045b4d7
call fcn.0044e2f0
mov dword [esp], 0
mov eax, dword [esp]
jmp 0x40ecd0
xor eax, eax
jmp 0x40ecd0
add esp, 4
pop ebx
pop ebp
ret