Function at 0x465dc0
Capabilities:
Create thread
Manipulate boot configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b0
mov eax, dword [0x5512ec]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x19c], edx
push str.Windows_To_Go_mode_selected
mov dword [ebp - 0x198], edi
xor esi, esi
call fcn.0044b0b0
add esp, 4
test ebx, ebx
je 0x465e2c
cmp dword [0x5a3198], 0xc
je 0x465e2c
cmp dword [0x58b26c], 0x3a98
jae 0x465e2c
mov dword [0x55a318], 0xc0030032
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004a8b60
mov esp, ebp
pop ebp
ret
mov cl, byte [0x5a3057]
test cl, cl
jne 0x465ebe
mov ecx, dword [0x55a75c]
call fcn.004627b0
mov edi, eax
test edi, edi
jne 0x465e75
push str.Could_not_mount_ISO_for_Windows_To_Go_installation
call fcn.0044b0b0
add esp, 4
mov dword [0x55a318], 0xe0031208
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004a8b60
mov esp, ebp
pop ebp
ret
mov eax, dword [0x55b238]
shl eax, 6
add eax, 0x5a2d82
push eax
push edi
push 0x537198
lea eax, [ebp - 0x194]
push 0x80
push eax
call fcn.004050d0
add esp, 0x14
mov byte [ebp - 0x115], 0
push edi
push str.Mounted_ISO_as__s
call fcn.0044b0b0
mov cl, byte [0x5a3057]
add esp, 8
mov edi, dword [ebp - 0x198]
test cl, cl
mov dword [ebp - 0x198], esi
lea eax, [ebp - 0x194]
mov dword [ebp - 0x1a8], esi
cmovne eax, dword [0x55a75c]
mov dword [ebp - 0x1a4], eax
mov eax, dword [0x553350]
push 0
mov dword [ebp - 0x1ac], eax
mov eax, dword [ebp - 0x19c]
push 0
mov dword [ebp - 0x1a0], eax
lea eax, [ebp - 0x1ac]
push eax
push 0x4621b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x55b228], eax
test eax, eax
jne 0x465f28
push str.Unable_to_start_apply_image_thread
call fcn.0044b0b0
add esp, 4
jmp 0x465f6a
push dword [0x553320]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 0xffffffffffffffff
push dword [0x55b228]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x198]
push eax
push dword [0x55b228]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x465f60
mov eax, dword [ebp - 0x198]
mov dword [0x55b228], esi
test eax, eax
jne 0x465fae
push str.Failed_to_apply_Windows_To_Go_image
call fcn.0044b0b0
add esp, 4
test dword [0x55a318], 0x80000000
jne 0x465f8d
mov dword [0x55a318], 0xe0031208
cmp byte [0x5a3057], 0
jne 0x465f9b
call fcn.00462b10
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004a8b60
mov esp, ebp
pop ebp
ret
cmp byte [0x5a3057], 0
jne 0x465fbc
call fcn.00462b10
test ebx, ebx
je 0x46609f
push str.Setting_up_EFI_System_Partition
call fcn.0044b0b0
mov edx, dword [0x5a3190]
add esp, 4
cmp edx, 0x400
ja 0x465fe6
mov edx, 0x400
jmp 0x465ff0
mov eax, 0x1000
cmp edx, eax
cmovbe edx, eax
lea eax, [edi - 0x80]
cmp eax, 0x80
ja 0x46607f
test edx, edx
je 0x466009
lea eax, [edx - 1]
test edx, eax
jne 0x46607f
push 0x30003
push 0x52ad5a
push dword [0x52626c]
mov ecx, edi
mov dword [0x58b864], 1
push dword [0x5a332c]
push dword [0x5a3328]
call fcn.00414e30
add esp, 0x14
test eax, eax
je 0x46607f
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [0x5a332c]
mov ecx, edi
push dword [0x5a3328]
call fcn.0040a300
mov esi, eax
add esp, 8
test esi, esi
jne 0x46609f
mov dword [0x55a318], 0xe003120b
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004a8b60
mov esp, ebp
pop ebp
ret
push str.Could_not_format_EFI_System_Partition
call fcn.0044b0b0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004a8b60
mov esp, ebp
pop ebp
ret
push str.Enabling_boot_using_command:
call fcn.0044b0b0
add esp, 4
cmp byte [0x5a3064], 0
je 0x4660cb
cmp byte [0x5a3065], 0
mov eax, 0x5470cc
mov ecx, str.BIOS
cmove eax, ecx
jmp 0x4660d0
mov eax, str.UEFI
mov ecx, dword [ebp - 0x19c]
test ebx, ebx
mov edi, ecx
cmovne edi, esi
push edi
push eax
push ecx
push 0x5a2780
push str._s_bcdboot.exe__sWindows__v__f__s__s__s
lea eax, [ebp - 0x114]
push 0x104
push eax
call fcn.004050d0
add esp, 0x1c
mov byte [ebp - 0x11], 0
lea eax, [ebp - 0x114]
push 0x25
push eax
call fcn.004aa320
add esp, 8
test eax, eax
je 0x46612e
push 0x2cd
push str.D:_a_rufus_rufus_srcwue.c
push str.strchr_cmd______NULL
call fcn.004dfbbc
add esp, 0xc
lea eax, [ebp - 0x114]
push eax
call fcn.0044b0b0
add esp, 4
lea ecx, [ebp - 0x114]
mov edx, 0x5a2780
push 0
push dword [0x5a29d4]
call fcn.004498f0
add esp, 8
test eax, eax
je 0x466173
push str.Failed_to_enable_boot
call fcn.0044b0b0
add esp, 4
mov dword [0x55a318], 0xe0031208
mov ecx, edi
call fcn.004652d0
mov ecx, dword [0x5a0940]
mov edx, 0xcc3
mov eax, dword [0x5a0944]
push 0
push 0
push dword [0x5a0948]
lea eax, [ecx + eax*2]
mov ecx, 7
push 0
push eax
call fcn.0045e120
add esp, 0x14
test byte [0x55b230], 0x10
je 0x46620e
push str.Setting_the_targets_internal_drives_offline_using_command:
call fcn.0044b0b0
mov eax, dword [ebp - 0x19c]
add esp, 4
push dword [0x55b22c]
push eax
push str.dism__Image:_s__Apply_Unattend:_s
lea eax, [ebp - 0x114]
push 0x104
push eax
call fcn.004050d0
add esp, 0x14
mov byte [ebp - 0x11], 0
lea eax, [ebp - 0x114]
push eax
call fcn.0044b0b0
add esp, 4
lea ecx, [ebp - 0x114]
xor edx, edx
push 0
push dword [0x5a29d4]
call fcn.004498f0
add esp, 8
push str.Disabling_use_of_the_Windows_Recovery_Environment_using_command:
call fcn.0044b0b0
add esp, 4
lea eax, [ebp - 0x114]
push edi
push 0x5a2780
push str._s_bcdedit.exe__store__sEFIMicrosoftBootBCD__set_default_recoveryenabled_no
push 0x104
push eax
call fcn.004050d0
add esp, 0x14
mov byte [ebp - 0x11], 0
lea eax, [ebp - 0x114]
push 0x25
push eax
call fcn.004aa320
add esp, 8
test eax, eax
je 0x46626a
push 0x2e9
push str.D:_a_rufus_rufus_srcwue.c
push str.strchr_cmd______NULL
call fcn.004dfbbc
add esp, 0xc
lea eax, [ebp - 0x114]
push eax
call fcn.0044b0b0
add esp, 4
lea ecx, [ebp - 0x114]
mov edx, 0x5a2780
push 0
push dword [0x5a29d4]
call fcn.004498f0
mov eax, dword [0x5a0948]
mov edx, 0xcc3
push 0
push 0
push eax
push 0
push eax
mov ecx, 7
call fcn.0045e120
add esp, 0x1c
test ebx, ebx
je 0x4662f6
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
test esi, esi
je 0x4662f6
push 0
push esi
push 0xa
call dword [sym.imp.KERNEL32.dll_DefineDosDeviceA]
test eax, eax
jne 0x4662e8
call fcn.0044b6b0
push eax
push esi
push str.Could_not_unmount__s:__s
call fcn.0044b0b0
add esp, 0xc
jmp 0x4662f6
push esi
push str.Successfully_unmounted__s
call fcn.0044b0b0
add esp, 8
mov ecx, dword [ebp - 8]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a8b60
mov esp, ebp
pop ebp
ret