Function at 0x402c50
Capabilities:
Manipulate boot configuration

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ebdd
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x43d040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.c:_bcdedit.exe__create_ffffffff_8d96_11de_8e72_ffffffffffff__d__
call fcn.00416bb7
push str.c:_bcdedit.exe__create__ffffffff_8d96_11de_8e72_fffffffffffe__d__
call fcn.00416bb7
push str.c:_bcdedit.exe__set_ffffffff_8d96_11de_8e72_ffffffffffff_ramdisksdidevice_partitionc:
call fcn.00416bb7
push str.c:_bcdedit.exe__set_ffffffff_8d96_11de_8e72_ffffffffffff_ramdisksdipath__boot.sdi
call fcn.00416bb7
push str.c:_bcdedit.exe__set__ffffffff_8d96_11de_8e72_fffffffffffe_device__________________ramdisk_c:_pe.wim_ffffffff_8d96_11de_8e72_ffffffffffff
call fcn.00416bb7
push str.c:_bcdedit.exe__set__ffffffff_8d96_11de_8e72_fffffffffffe_description
call fcn.00416bb7
push str.c:_bcdedit.exe__set__ffffffff_8d96_11de_8e72_fffffffffffe_locale__________________zh_cn
call fcn.00416bb7
push str.c:_bcdedit.exe__set__ffffffff_8d96_11de_8e72_fffffffffffe_inherit_________________bootloadersettings
call fcn.00416bb7
push str.c:_bcdedit.exe__set__ffffffff_8d96_11de_8e72_fffffffffffe_osdevice________________ramdisk_c:_pe.wim_ffffffff_8d96_11de_8e72_ffffffffffff
call fcn.00416bb7
push str.c:_bcdedit.exe__set__ffffffff_8d96_11de_8e72_fffffffffffe_systemroot______________windows
call fcn.00416bb7
push str.c:_bcdedit.exe__set__ffffffff_8d96_11de_8e72_fffffffffffe_detecthal_______________Yes
call fcn.00416bb7
push str.c:_bcdedit.exe__set__ffffffff_8d96_11de_8e72_fffffffffffe_winpe___________________Yes
call fcn.00416bb7
push str.c:_bcdedit.exe__set__ffffffff_8d96_11de_8e72_fffffffffffe_ems_____________________no
call fcn.00416bb7
push str.c:_bcdedit.exe__displayorder_ffffffff_8d96_11de_8e72_fffffffffffe__addlast
call fcn.00416bb7
push str.c:_bcdedit.exe__default_ffffffff_8d96_11de_8e72_fffffffffffe
call fcn.00416bb7
push 0
push 0x438418
call fcn.00416d48
add esp, 0x44
cmp eax, 0xffffffff
je 0x402db7
push str.c:_bcdedit.exe__create_ffffffff_8d96_11de_8e74_ffffffffffff__d__
call fcn.00416bb7
push str.c:_bcdedit.exe__create__ffffffff_8d96_11de_8e74_fffffffffffe__d__
call fcn.00416bb7
push str.c:_bcdedit.exe__set_ffffffff_8d96_11de_8e74_ffffffffffff_ramdisksdidevice_partitiond:
call fcn.00416bb7
push str.c:_bcdedit.exe__set_ffffffff_8d96_11de_8e74_ffffffffffff_ramdisksdipath__boot.sdi
call fcn.00416bb7
push str.c:_bcdedit.exe__set__ffffffff_8d96_11de_8e74_fffffffffffe_device__________________ramdisk_d:_pe.wim_ffffffff_8d96_11de_8e74_ffffffffffff
call fcn.00416bb7
push str.c:_bcdedit.exe__set__ffffffff_8d96_11de_8e74_fffffffffffe_description
call fcn.00416bb7
push str.c:_bcdedit.exe__set__ffffffff_8d96_11de_8e74_fffffffffffe_locale__________________zh_cn
call fcn.00416bb7
push str.c:_bcdedit.exe__set__ffffffff_8d96_11de_8e74_fffffffffffe_inherit_________________bootloadersettings
call fcn.00416bb7
push str.c:_bcdedit.exe__set__ffffffff_8d96_11de_8e74_fffffffffffe_osdevice________________ramdisk_d:_pe.wim_ffffffff_8d96_11de_8e74_ffffffffffff
call fcn.00416bb7
push str.c:_bcdedit.exe__set__ffffffff_8d96_11de_8e74_fffffffffffe_systemroot______________windows
call fcn.00416bb7
push str.c:_bcdedit.exe__set__ffffffff_8d96_11de_8e74_fffffffffffe_detecthal_______________Yes
call fcn.00416bb7
push str.c:_bcdedit.exe__set__ffffffff_8d96_11de_8e74_fffffffffffe_winpe___________________Yes
call fcn.00416bb7
push str.c:_bcdedit.exe__set__ffffffff_8d96_11de_8e74_fffffffffffe_ems_____________________no
call fcn.00416bb7
push str.c:_bcdedit.exe__displayorder_ffffffff_8d96_11de_8e74_fffffffffffe__addlast
call fcn.00416bb7
add esp, 0x38
push str.c:_bcdedit.exe__timeout_10
call fcn.00416bb7
add esp, 4
lea ecx, [ebp - 0x28]
call fcn.00402a40
mov dword [ebp - 4], 0
lea edx, [ebp - 0x28]
cmp dword [ebp - 0x14], 0xf
mov ecx, dword [ebp - 0x18]
cmova edx, dword [ebp - 0x28]
cmp ecx, 3
jne 0x402e7a
mov edi, ecx
mov esi, 0x437e44
sub edi, 4
jb 0x402e07
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x402e0c
add edx, 4
add esi, 4
sub edi, 4
jae 0x402df6
cmp edi, 0xfffffffc
je 0x402e40
mov al, byte [edx]
cmp al, byte [esi]
jne 0x402e39
cmp edi, 0xfffffffd
je 0x402e40
mov al, byte [edx + 1]
cmp al, byte [esi + 1]
jne 0x402e39
cmp edi, 0xfffffffe
je 0x402e40
mov al, byte [edx + 2]
cmp al, byte [esi + 2]
jne 0x402e39
cmp edi, 0xffffffff
je 0x402e40
mov al, byte [edx + 3]
cmp al, byte [esi + 3]
je 0x402e40
sbb eax, eax
or eax, 1
jmp 0x402e42
xor eax, eax
test eax, eax
jne 0x402e7a
push str.c:_bcdedit.exe__set__ffffffff_8d96_11de_8e72_fffffffffffe_path____________________windows_system32_bootwinload.efi
call fcn.00416bb7
push 0
push 0x438418
call fcn.00416d48
add esp, 0xc
cmp eax, 0xffffffff
je 0x402f9f
push str.c:_bcdedit.exe__set__ffffffff_8d96_11de_8e74_fffffffffffe_path____________________windows_system32_bootwinload.efi
call fcn.00416bb7
add esp, 4
jmp 0x402f9f
cmp dword [ebp - 0x14], 0xf
lea edx, [ebp - 0x28]
cmova edx, dword [ebp - 0x28]
cmp ecx, 3
jne 0x402f21
mov edi, ecx
mov esi, 0x437e54
sub edi, 4
jb 0x402eb1
nop word [eax + eax]
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x402eb6
add edx, 4
add esi, 4
sub edi, 4
jae 0x402ea0
cmp edi, 0xfffffffc
je 0x402eea
mov al, byte [edx]
cmp al, byte [esi]
jne 0x402ee3
cmp edi, 0xfffffffd
je 0x402eea
mov al, byte [edx + 1]
cmp al, byte [esi + 1]
jne 0x402ee3
cmp edi, 0xfffffffe
je 0x402eea
mov al, byte [edx + 2]
cmp al, byte [esi + 2]
jne 0x402ee3
cmp edi, 0xffffffff
je 0x402eea
mov al, byte [edx + 3]
cmp al, byte [esi + 3]
je 0x402eea
sbb eax, eax
or eax, 1
jmp 0x402eec
xor eax, eax
test eax, eax
jne 0x402f21
push str.c:_bcdedit.exe__set__ffffffff_8d96_11de_8e72_fffffffffffe_path____________________windows_system32_bootwinload.exe
call fcn.00416bb7
push 0
push 0x438418
call fcn.00416d48
add esp, 0xc
cmp eax, 0xffffffff
je 0x402f9f
push str.c:_bcdedit.exe__set__ffffffff_8d96_11de_8e74_fffffffffffe_path____________________windows_system32_bootwinload.exe
call fcn.00416bb7
add esp, 4
jmp 0x402f9f
cmp dword [ebp - 0x14], 0xf
lea edx, [ebp - 0x28]
cmova edx, dword [ebp - 0x28]
cmp ecx, 4
jne 0x402fa2
mov edi, ecx
mov esi, str.fail
sub edi, ecx
jb 0x402f51
nop dword [eax]
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x402f56
add edx, 4
add esi, 4
sub edi, 4
jae 0x402f40
cmp edi, 0xfffffffc
je 0x402f8a
mov al, byte [edx]
cmp al, byte [esi]
jne 0x402f83
cmp edi, 0xfffffffd
je 0x402f8a
mov al, byte [edx + 1]
cmp al, byte [esi + 1]
jne 0x402f83
cmp edi, 0xfffffffe
je 0x402f8a
mov al, byte [edx + 2]
cmp al, byte [esi + 2]
jne 0x402f83
cmp edi, 0xffffffff
je 0x402f8a
mov al, byte [edx + 3]
cmp al, byte [esi + 3]
je 0x402f8a
sbb eax, eax
or eax, 1
jmp 0x402f8c
xor eax, eax
test eax, eax
jne 0x402fa2
mov edx, 0x438ba0
mov ecx, 0x43e078
call fcn.004044f0
mov ecx, dword [ebp - 0x18]
cmp dword [ebp - 0x14], 0xf
lea edx, [ebp - 0x28]
cmova edx, dword [ebp - 0x28]
cmp ecx, 4
jne 0x403010
mov esi, str.fail
sub ecx, ecx
jb 0x402fd1
nop dword [eax + eax]
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x402fd6
add edx, 4
add esi, 4
sub ecx, 4
jae 0x402fc0
cmp ecx, 0xfffffffc
je 0x40300a
mov al, byte [edx]
cmp al, byte [esi]
jne 0x403003
cmp ecx, 0xfffffffd
je 0x40300a
mov al, byte [edx + 1]
cmp al, byte [esi + 1]
jne 0x403003
cmp ecx, 0xfffffffe
je 0x40300a
mov al, byte [edx + 2]
cmp al, byte [esi + 2]
jne 0x403003
cmp ecx, 0xffffffff
je 0x40300a
mov al, byte [edx + 3]
cmp al, byte [esi + 3]
je 0x40300a
sbb eax, eax
or eax, 1
jmp 0x40300c
xor eax, eax
test eax, eax
je 0x403049
mov edx, 0x438bbc
mov ecx, 0x43e078
call fcn.004044f0
cmp dword [ebp - 0x14], 0xf
lea edx, [ebp - 0x28]
push dword [ebp - 0x18]
cmova edx, dword [ebp - 0x28]
mov ecx, eax
call fcn.00406e30
mov edx, 0x438bb4
mov ecx, eax
call fcn.004044f0
push eax
call fcn.00404790
add esp, 8
push str.del_c:_bcdedit.exe
call fcn.00416bb7
mov ecx, dword [ebp - 0x14]
add esp, 4
cmp ecx, 0xf
jbe 0x403086
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40307c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4030a1
push ecx
push edx
call fcn.0040c015
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040bfd2
mov esp, ebp
pop ebp
ret
call fcn.0041762b
int3