Function at 0x401000
Capabilities:
Allocate thread local storage
Query environment variable

Disassembly:
push 0x584
push 0
push 0x52b934
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleW
mov dword [0x52b938], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x52b934], eax
mov eax, 0x4b0100
mov dword [0x52b960], eax
call fcn.0040bcdf
call fcn.0041f0e0
call fcn.0041e5a4
call fcn.0041e0a0
call fcn.0041c870
call fcn.0041a7ac
call fcn.0041a050
call fcn.004198aa
call fcn.00418f47
call fcn.00418869
call fcn.00418504
call fcn.0041827f
call fcn.0041533d
call fcn.00414d0d
call fcn.00413aa0
call fcn.00412d5c
call fcn.00411afd
call fcn.0040f603
call fcn.0040eaac
call fcn.0040dfc6
call fcn.0040de47
call fcn.0040cb95
call fcn.0040c014
call fcn.0040be00
mov edx, str.v2.5.1
lea ecx, [0x52b9a0]
call fcn.0040b008
mov edx, 0x4ab028
lea ecx, [0x52b974]
call fcn.0040b008
push edx
call fcn.0041f130
pop edx
push eax
mov edx, str.KMS_Cleaner
push edx
call fcn.0041f170
mov edx, dword [0x52b9a0]
push edx
call fcn.0041f170
lea eax, [0x52b974]
push eax
call fcn.0041f1d0
mov edx, str.Panic___
lea ecx, [0x52b968]
call fcn.0040b008
mov edx, 0x4aecf6
lea ecx, [0x52b988]
call fcn.0040b008
push edx
call fcn.0041f130
pop edx
push eax
push edx
call fcn.0041f130
pop edx
push eax
call fcn.0040c043
lea eax, [0x52b944]
push eax
call fcn.0041f1d0
mov dword [0x52b964], 0
mov dword [0x52b96c], 0
lea eax, [0x52b96c]
push eax
lea eax, [0x52b964]
push eax
mov eax, dword [0x52b944]
push eax
call sub.imagehlp.dll_MapFileAndCheckSumW
mov ebx, dword [0x52b964]
cmp ebx, dword [0x52b96c]
je 0x4011a3
push 0x10
push dword [0x52b988]
push dword [0x52b968]
call fcn.0040be39
jmp 0x4018c9
push edx
call fcn.0041f130
pop edx
push eax
push edx
call fcn.0041f130
pop edx
push eax
push 0xc8
call fcn.0041cb20
lea eax, [0x52ba60]
push eax
call fcn.0041f1d0
push edx
call fcn.0041f130
pop edx
push eax
push edx
call fcn.0041f130
pop edx
push eax
push 0xc8
call fcn.0041cb20
lea eax, [0x52ba64]
push eax
call fcn.0041f1d0
push 0xc8
mov eax, dword [0x52ba60]
push eax
mov eax, str.PROCESSOR_ARCHITECTURE
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0xc8
mov eax, dword [0x52ba64]
push eax
mov eax, str.PROCESSOR_ARCHITEW6432
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0x64
mov eax, dword [0x52ba48]
push eax
mov eax, str.SYSTEMDRIVE
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
push dword [0x52ba60]
mov edx, str.AMD64
pop ecx
call fcn.0040b5a0
jne 0x401259
push dword [0x52ba64]
mov edx, str.AMD64
pop ecx
call fcn.0040b5a0
jne 0x401259
jmp 0x401260
mov eax, 1
jmp 0x401262
xor eax, eax
and eax, eax
je 0x401278
mov edx, 0x4ad6f2
lea ecx, [0x52ba54]
call fcn.0040b008
jmp 0x401288
mov edx, 0x4ae23c
lea ecx, [0x52ba54]
call fcn.0040b008
call fcn.004097c9
and eax, eax
je 0x4012bc
mov edx, dword [0x52b974]
push edx
call fcn.0041f130
pop edx
push eax
push edx
call fcn.0041f170
mov edx, str.__Run_As_SYSTEM_
push edx
call fcn.0041f170
lea eax, [0x52b974]
push eax
call fcn.0041f1d0
mov edx, dword [0x52b974]
push edx
call fcn.0041f130
pop edx
push eax
push edx
call fcn.0041f170
call fcn.0041f260
lea eax, [0x52b958]
push eax
call fcn.0041f1d0
push 9
mov eax, str.Microsoft_Sans_Serif
push eax
push 0
call fcn.0041e6ba
mov edx, 0x4afc66
lea ecx, [0x52b99c]
call fcn.0040b008
mov edx, 0x4ab028
lea ecx, [0x52b980]
call fcn.0040b008
mov edx, 0x4ab028
lea ecx, [0x52b970]
call fcn.0040b008
mov edx, 0x4ab028
lea ecx, [0x52b9a8]
call fcn.0040b008
push edx
call fcn.0041f130
pop edx
push eax
push edx
call fcn.0041f130
pop edx
push eax
push 0x3e8
call fcn.0041cb20
lea eax, [0x52b998]
push eax
call fcn.0041f1d0
push 0x3e8
mov eax, dword [0x52b998]
push eax
mov eax, str.WINDIR
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
push edx
call fcn.0041f130
pop edx
push eax
push edx
call fcn.0041f130
pop edx
push eax
push 0x3e8
call fcn.0041cb20
lea eax, [0x52b948]
push eax
call fcn.0041f1d0
push 0x3e8
mov eax, dword [0x52b948]
push eax
mov eax, str.WINDIR
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
push edx
call fcn.0041f130
pop edx
push eax
push edx
call fcn.0041f130
pop edx
push eax
push 0xc8
call fcn.0041cb20
lea eax, [0x52b984]
push eax
call fcn.0041f1d0
push edx
call fcn.0041f130
pop edx
push eax
push edx
call fcn.0041f130
pop edx
push eax
push 0xc8
call fcn.0041cb20
lea eax, [0x52b9a4]
push eax
call fcn.0041f1d0
push 0xc8
mov eax, dword [0x52b984]
push eax
mov eax, str.PROCESSOR_ARCHITECTURE
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0xc8
mov eax, dword [0x52b9a4]
push eax
mov eax, str.PROCESSOR_ARCHITEW6432
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
push edx
call fcn.0041f130
pop edx
push eax
push edx
call fcn.0041f130
pop edx
push eax
push 0x3e8
call fcn.0041cb20
lea eax, [0x52b95c]
push eax
call fcn.0041f1d0
push 0x3e8
mov eax, dword [0x52b95c]
push eax
mov eax, str.LOCALAPPDATA
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
push edx
call fcn.0041f130
pop edx
push eax
push edx
call fcn.0041f130
pop edx
push eax
push 0x64
call fcn.0041cb20
lea eax, [0x52b93c]
push eax
call fcn.0041f1d0
push 0x64
mov eax, dword [0x52b93c]
push eax
mov eax, str.SYSTEMDRIVE
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
push edx
call fcn.0041f130
pop edx
push eax
mov edx, dword [0x52b998]
push edx
call fcn.0041f130
pop edx
push eax
push edx
call fcn.0041f170
mov edx, str.Temp
push edx
call fcn.0041f170
call fcn.0040b5f2
add dword [esp], edx
call fcn.00412ee8
call fcn.0040b610
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x4014e5
cmp edi, 0xffffffff
je 0x4014e9
xor eax, eax
jmp 0x4014ee
mov eax, 1
or eax, eax
je 0x40151d
mov edx, dword [0x52b998]
push edx
call fcn.0041f130
pop edx
push eax
push edx
call fcn.0041f170
mov edx, str.Temp
push edx
call fcn.0041f170
lea eax, [0x52b970]
push eax
call fcn.0041f1d0
push edx
call fcn.0041f130
pop edx
push eax
mov edx, dword [0x52b998]
push edx
call fcn.0041f130
pop edx
push eax
push edx
call fcn.0041f170
mov edx, str.Sysnativecmd.exe
push edx
call fcn.0041f170
call fcn.0040b5f2
add dword [esp], edx
call fcn.00412ee8
call fcn.0040b610
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x40156a
jl 0x401566
cmp ebx, 0
ja 0x40156a
xor eax, eax
jmp 0x40156f
mov eax, 1
or eax, eax
je 0x4015a0
mov edx, dword [0x52b998]
push edx
call fcn.0041f130
pop edx
push eax
push edx
call fcn.0041f170
mov edx, str.Sysnative
push edx
call fcn.0041f170
lea eax, [0x52b998]
push eax
call fcn.0041f1d0
jmp 0x4015cb
mov edx, dword [0x52b998]
push edx
call fcn.0041f130
pop edx
push eax
push edx
call fcn.0041f170
mov edx, str.System32
push edx
call fcn.0041f170
lea eax, [0x52b998]
push eax
call fcn.0041f1d0
push 0x100
push 0
call fcn.004096de
push edx
call fcn.0041f130
pop edx
push eax
mov eax, 0x4ab374
push eax
mov eax, str.BuildLab
push eax
mov eax, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_NTCurrentVersion
push eax
call fcn.00404ae4
lea eax, [0x52b978]
push eax
call fcn.0041f1d0
mov eax, 0x4ab374
push eax
push dword [0x52b978]
call fcn.0041cc30
mov dword [0x52b990], eax
mov ebx, dword [0x52b990]
cmp ebx, 1
jge 0x401628
jmp 0x40165c
push edx
call fcn.0041f130
pop edx
push eax
push edx
call fcn.0041f130
pop edx
push eax
mov ebx, dword [0x52b990]
dec ebx
push ebx
push 1
push dword [0x52b978]
call fcn.0041cc50
lea eax, [0x52b978]
push eax
call fcn.0041f1d0
push dword [0x52b978]
call fcn.0041cce0
mov dword [0x52b940], eax
mov ebx, dword [0x52b940]
cmp ebx, 0x2580
jl 0x40168f
mov edx, 0x4afc66
lea ecx, [0x52b99c]
call fcn.0040b008
jmp 0x401773
mov ebx, dword [0x52b940]
cmp ebx, 0x23f0
jl 0x4016b2
mov ebx, dword [0x52b940]
cmp ebx, 0x2454
jge 0x4016b2
mov eax, 1
jmp 0x4016b4
xor eax, eax
and eax, eax
je 0x4016cd
mov edx, 0x4ab45c
lea ecx, [0x52b99c]
call fcn.0040b008
jmp 0x401773
mov ebx, dword [0x52b940]
cmp ebx, 0x1db0
jl 0x4016f0
mov ebx, dword [0x52b940]
cmp ebx, 0x1e14
jge 0x4016f0
mov eax, 1
jmp 0x4016f2
xor eax, eax
and eax, eax
je 0x401708
mov edx, 0x4ab458
lea ecx, [0x52b99c]
call fcn.0040b008
jmp 0x401773
mov ebx, dword [0x52b940]
cmp ebx, 0xa28
jl 0x40172b
mov ebx, dword [0x52b940]
cmp ebx, 0xbb8
jge 0x40172b
mov eax, 1
jmp 0x40172d
xor eax, eax
and eax, eax
je 0x401763
mov edx, 0x4ad6fa
lea ecx, [0x52b99c]
call fcn.0040b008
push 1
push dword [0x52b950]
call fcn.0040f6a9
push 1
push dword [0x52b954]
call fcn.0040f6a9
jmp 0x401773
mov edx, 0x4afc66
lea ecx, [0x52b99c]
call fcn.0040b008
push dword [0x52b984]
mov edx, str.AMD64
pop ecx
call fcn.0040b5a0
jne 0x40179b
push dword [0x52b9a4]
mov edx, str.AMD64
pop ecx
call fcn.0040b5a0
jne 0x40179b
jmp 0x4017a2
mov eax, 1
jmp 0x4017a4
xor eax, eax
and eax, eax
je 0x4017ba
mov edx, str.x64WDV
lea ecx, [0x52b980]
call fcn.0040b008
jmp 0x4017ca
mov edx, str.x86WDV
lea ecx, [0x52b980]
call fcn.0040b008
push 0xee
push 0x1b0
push 0
push 0
call fcn.00401939
call fcn.00403435
push edx
call fcn.0041f130
pop edx
push eax
push 0
push edx
call fcn.0041f130
pop edx
push eax
mov edx, 0x4ae2a6
push edx
call fcn.0041f170
mov edx, dword [0x52b974]
push edx
call fcn.0041f170
mov edx, 0x4ac1be
push edx
call fcn.0041f170
call fcn.0040b5f2
add dword [esp], edx
call fcn.0040354e
call fcn.0040b610
call fcn.00411b68
and eax, eax
je 0x40183c
jmp 0x401831
push dword [0x52b980]
mov edx, str.x64WDV
pop ecx
call fcn.0040b5a0
je 0x401867
push 0x10
mov eax, str.Please_use_the_x64_version_of_the_program_
push eax
mov eax, str.Program_Error
push eax
call fcn.0040be39
jmp 0x4018c9
call fcn.00411b68
mov dword [0x52b97c], eax
cmp dword [0x52b97c], 0
je 0x4018af
call fcn.00414e27
push eax
mov ebx, dword [0x52b98c]
cmp ebx, dword [esp]
jne 0x401898
push dword [0x52b97c]
call fcn.004033d0
jmp 0x4018ac
mov dword [0x52b97c], 0
push 5
call fcn.004117d4
pop eax
jmp 0x4018b9
push 5
call fcn.004117d4
mov ebx, dword [0x52b97c]
cmp ebx, 0x333c
jne 0x401867
jmp 0x4018c9
push 0
call 0x4018e8
call fcn.0041f110
push dword [0x52b934]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess
call fcn.0040cb83
call fcn.0040de3b
call fcn.0040df96
call fcn.0040eaa0
call fcn.0040f5ad
call fcn.00411ada
call fcn.00412d5b
call fcn.0041303f
call fcn.00413a90
call fcn.00414cef
call fcn.0041885d
call fcn.004198a9
call fcn.0041c890
call fcn.0041e711
call fcn.0041e777
call fcn.0041e090
ret