Function at 0x401000
Capabilities:
Allocate thread local storage

Disassembly:
push 0x234
push 0
push 0x4357a8
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleW
mov dword [0x4357ac], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x4357a8], eax
call section..text
mov eax, 0x433398
mov dword [0x435838], eax
call fcn.004167c9
call fcn.0042bba0
call fcn.0042afc1
call fcn.0042acd0
call fcn.004290e0
call fcn.0042721c
call fcn.00426ac0
call fcn.0042631f
call fcn.00425974
call fcn.00425746
call fcn.0042566d
call fcn.004253e8
call fcn.00424b8b
call fcn.004244bb
call fcn.00423fa0
call fcn.004232ce
call fcn.004216f1
call fcn.004199fc
call fcn.00419749
call fcn.004193a9
call fcn.00418576
call fcn.00417ae7
call fcn.0041754f
call fcn.00416c12
call fcn.0041692c
push 0x435994
mov eax, str.DC1C5A9C_E88A_4dde_A5A1_60F82A20AEF7
push eax
call sub.ole32.dll_CLSIDFromString
push 0x4359a4
mov eax, str.d57c7288_d4ad_4768_be02_9d969532d960
push eax
call sub.ole32.dll_CLSIDFromString
push 0x4359b4
mov eax, str.43826d1e_e718_42ee_bc55_a1e261c37bfe
push eax
call sub.ole32.dll_CLSIDFromString
mov dword [0x435958], 0x302
mov dword [0x435864], 0x208
mov dword [0x435978], 0
push edx
call fcn.0042bbf0
pop edx
push eax
push 0x25
call fcn.00409bd3
push 0x43586c
call fcn.0042bc30
push edx
call fcn.0042bbf0
pop edx
push eax
push 0x24
call fcn.00409bd3
push 0x43592c
call fcn.0042bc30
mov edx, dword [0x43586c]
push edx
call fcn.0042bbf0
pop edx
push eax
push edx
call fcn.0042bcc0
lea eax, [0x435808]
push 2
push eax
call fcn.0042bd20
push edx
call fcn.0042bbf0
pop edx
push eax
push edx
call fcn.0042bbf0
pop edx
push eax
call fcn.0042345a
mov edx, str.EasyWinSetupWimGAPI.log
push edx
call fcn.0042bcc0
push 0x43597c
call fcn.0042bc30
push edx
call fcn.0042bbf0
pop edx
push eax
push edx
call fcn.0042bbf0
pop edx
push eax
push edx
call fcn.0042bbf0
pop edx
push eax
push edx
call fcn.0042bbf0
pop edx
push eax
call fcn.00417b16
call fcn.004163f2
add dword [esp], edx
call fcn.00423495
mov edx, str.EWS_xSET.ini
push edx
call fcn.0042bcc0
push 0x43582c
call fcn.0042bc30
mov byte [0x43598c], 0
mov byte [0x43598f], 0
mov byte [0x435988], 0
mov byte [0x43598a], 0
mov byte [0x435990], 0
mov byte [0x43598b], 0
mov dword [0x4357d0], 0
mov byte [0x43598e], 3
mov byte [0x435989], 0
mov byte [0x43598d], 0
mov word [0x435984], 0xffff
mov dword [0x435858], 0
mov edx, str.Consolas
lea ecx, [0x4358d8]
call fcn.00416068
mov word [0x435986], 0xfff5
mov dword [0x435868], 0
mov dword [0x4357b8], 0
mov dword [0x4358f8], 0
mov dword [0x4357e4], 0
mov dword [0x435954], 0
mov dword [0x435814], 0
push 0x4359c4
push 0
push 0xa
push 3
push 0x208
call fcn.00425411
push 0x4359cc
push 0x43333c
push 8
push 3
push 4
call fcn.00425411
mov ebp, dword [0x4359c4]
lea eax, [ebp]
mov edx, 0x42f02e
push edx
push 0x104
push eax
call fcn.0042bd60
lea eax, [ebp + 0x208]
mov edx, 0x42f02e
push edx
push 0x104
push eax
call fcn.0042bd60
mov ebp, dword [0x4359cc]
mov edx, 0x42f02e
lea ecx, [ebp]
call fcn.00416068
mov edx, 0x42f02e
lea ecx, [ebp + 4]
call fcn.00416068
push 8
push 0x43333c
lea eax, [0x4359d4]
push eax
push 4
call fcn.00425993
mov dword [0x43588c], 0xffffffff
push 0x73
push 0xd7
push 0x96
call fcn.00425679
mov dword [0x435888], eax
push 0xb4
push 0x5a
push 0x73
call fcn.00425679
mov dword [0x435928], eax
mov dword [0x435920], 0xffffffff
mov dword [0x4358a0], 0xffffffff
push 0xdf
push 0xe8
push 0xe1
call fcn.00425679
mov dword [0x43589c], eax
mov dword [0x4358d4], 0xffffffff
mov dword [0x4358d0], 0xc0fecb
mov dword [0x4357c8], 0xffffffff
push 0xdc
push 0xe1
push 0xe1
call fcn.00425679
mov dword [0x4357c0], eax
mov dword [0x4358ac], 0xffffffff
push 0xe1
push 0xfe
push 0xfe
call fcn.00425679
mov dword [0x4358a4], eax
mov dword [0x4358c8], 0xffffffff
push 0xe1
push 0xfe
push 0xfe
call fcn.00425679
mov dword [0x4358c4], eax
mov dword [0x43584c], 0xffffffff
push 0xe0
push 0xf5
push 0xfe
call fcn.00425679
mov dword [0x435848], eax
mov dword [0x4357f8], 0xffffffff
push 0xf6
push 0xfa
push 0xfb
call fcn.00425679
mov dword [0x4357f0], eax
mov edx, 0x42f02e
lea ecx, [0x435940]
call fcn.00416068
mov edx, dword [0x435940]
push edx
call fcn.0042bbf0
pop edx
push eax
push edx
call fcn.0042bcc0
mov edx, str.EasyWinSetup___20H1_ADK___WimGAPI_v
push edx
call fcn.0042bcc0
push edx
call fcn.0042bbf0
pop edx
push eax
push 0
push 0x40
mov edx, dword [0x43586c]
push edx
call fcn.0042bbf0
pop edx
push eax
push edx
call fcn.0042bcc0
mov edx, str.wimgapi.dll
push edx
call fcn.0042bcc0
call fcn.004163f2
add dword [esp], edx
call fcn.0040f063
pop eax
push 0x435940
call fcn.0042bc30
call fcn.004115bb
push dword [0x435940]
mov eax, str.EasyWinSetupA222BF37_F016_4763_9C46_A95167A9BBBA
push eax
call fcn.0040aa27
call fcn.0040a0fe
push dword [0x435864]
push dword [0x435958]
push 0
push 0
call fcn.0040cfbc
mov dword [0x435814], eax
mov ebx, dword [0x435814]
and ebx, ebx
jne 0x40152e
call fcn.004070ac
call fcn.0040f5e2
call fcn.004050bb
movsx ebx, byte [0x43598e]
cmp ebx, 2
jge 0x401551
movsx eax, byte [0x43598e]
push eax
call fcn.00404df6
push dword [0x435814]
jmp 0x40155e
call 0x401578
call fcn.0042bbd0
push dword [0x4357a8]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess
call fcn.004168ea
call fcn.00418564
call fcn.0041973d
call fcn.004199a6
call fcn.004216ce
call fcn.004232cd
call fcn.00423514
call fcn.00423f90
call fcn.0042449d
call fcn.0042573a
call fcn.0042631e
call fcn.00429100
call fcn.0042b04f
call fcn.0042b194
call fcn.0042acc0
ret