Function at 0x140001000
Capabilities:
Identify system language via api
Query environment variable

Disassembly:
sub rsp, 0x28
mov r8, 0x7a8
xor rdx, rdx
movabs rcx, 0x1403117dc
call sub.msvcrt.dll_memset
xor rcx, rcx
call sub.KERNEL32.dll_GetModuleHandleW
mov qword [0x1403117e4], rax
xor r8, r8
mov rdx, 0x1000
xor rcx, rcx
call sub.KERNEL32.dll_HeapCreate
mov qword [0x1403117dc], rax
movabs rax, 0x1400f5318
mov qword [0x140311854], rax
call fcn.1400207f0
call fcn.14003da40
call fcn.14003c898
call fcn.14003c2a0
call fcn.14003a560
call fcn.140037794
call fcn.140036c60
call fcn.1400364d0
call fcn.140035544
call fcn.140034c84
call fcn.140033ef8
call fcn.1400338d8
call fcn.140030330
call fcn.14002f9b8
call fcn.14002ee94
call fcn.14002d710
call fcn.14002ae30
call fcn.140026c34
call fcn.140024918
call fcn.140023800
call fcn.1400235dc
call fcn.140021d90
call fcn.140020ec8
call fcn.140020c00
call fcn.1400209b4
movabs rdx, str.Office_uninstall_v2.0.0
lea rcx, [0x140311874]
call fcn.14003dab0
mov rcx, qword [0x140311874]
push rcx
sub rsp, 0x28
call fcn.14003dba0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14003dbf0
add rsp, 0x28
movabs rcx, str._x64
sub rsp, 0x28
call fcn.14003dbf0
add rsp, 0x28
lea rcx, [0x140311874]
pop rdx
call fcn.14003dc60
movabs rdx, 0x1400f2572
lea rcx, [0x140311894]
call fcn.14003dab0
mov qword [0x14031190c], 0
push rcx
sub rsp, 0x28
call fcn.14003dba0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14003dba0
add rsp, 0x28
pop rcx
push rax
push 0x3e8
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14003a900
add rsp, 0x28
lea rcx, [0x1403118f4]
pop rdx
call fcn.14003dc60
mov qword [0x14031185c], 0
mov qword [0x14031183c], 0
mov qword [0x14031191c], 1
mov qword [0x1403118e4], 2
push 0x808080
push 1
push 0
pop rcx
pop rdx
pop r8
call sub.GDI32.dll_CreatePen
mov qword [0x14031187c], rax
push 0xcc872c
push 1
push 0
pop rcx
pop rdx
pop r8
call sub.GDI32.dll_CreatePen
mov qword [0x1403118cc], rax
mov r9, 7
xor r8, r8
lea rdx, [0x140311eac]
mov rcx, 0x3b
call fcn.140035570
mov rcx, 0x200
sub rsp, 8
push rcx
lea r9, [0x140311f6c]
xor r8, r8
mov rdx, 7
mov rcx, 0x59
sub rsp, 0x20
call fcn.14002f9e4
add rsp, 0x28
add rsp, 8
mov rcx, 0x200
sub rsp, 8
push rcx
lea r9, [0x140311f74]
xor r8, r8
mov rdx, SafeArrayPutElement
mov rcx, 8
sub rsp, 0x20
call fcn.14002f9e4
add rsp, 0x28
add rsp, 8
mov rcx, 0x200
sub rsp, 8
push rcx
lea r9, [0x140311f7c]
xor r8, r8
mov rdx, SafeArrayPutElement
mov rcx, 8
sub rsp, 0x20
call fcn.14002f9e4
add rsp, 0x28
add rsp, 8
mov qword [0x140311e7c], 2
mov qword [0x140311e84], 1
sub rsp, 0x18
movabs rax, 0x140311e74
push rax
xor r9, r9
mov r8, SafeArrayPutElement
mov rdx, 8
mov rcx, 2
sub rsp, 0x20
call fcn.1400339f0
add rsp, 0x40
mov qword [0x140311e74], rax
push rcx
sub rsp, 0x28
call fcn.14003dba0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14003dba0
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.14003dba0
add rsp, 0x20
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x20
call fcn.14003dba0
add rsp, 0x20
pop rcx
push rax
sub rsp, 0x20
call fcn.140007904
add rsp, 0x30
push rax
call fcn.14003dd70
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14002c8b8
add rsp, 0x28
lea rcx, [0x140311834]
pop rdx
call fcn.14003dc60
push rcx
sub rsp, 0x28
call fcn.14003dba0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
movabs rax, str.tool
push rax
push rcx
sub rsp, 0x20
call fcn.14003dba0
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.14003dba0
add rsp, 0x28
pop rcx
push rax
push qword [0x140311834]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14003a960
add rsp, 0x20
push rax
call fcn.14003dd70
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14003a9f0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14001f040
add rsp, 0x28
pop rax
mov r15, rax
and r15, r15
jne 0x14000143a
push qword [0x140311834]
movabs rcx, 0x1400f1028
pop rdx
call fcn.14003dda0
or rax, rax
jne 0x14000143a
mov rax, 1
jmp 0x14000143d
xor rax, rax
and rax, rax
jmp 0x140001447
movabs rdx, 0x1400f1028
lea rcx, [0x1403118b4]
call fcn.14003dab0
push rcx
sub rsp, 0x28
call fcn.14003dba0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14003dba0
add rsp, 0x28
pop rcx
push rax
push 0xc8
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14003a900
add rsp, 0x28
lea rcx, [0x1403118bc]
pop rdx
call fcn.14003dc60
push rcx
sub rsp, 0x28
call fcn.14003dba0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14003dba0
add rsp, 0x28
pop rcx
push rax
push 0xc8
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14003a900
add rsp, 0x28
lea rcx, [0x140311914]
pop rdx
call fcn.14003dc60
push 0xc8
mov rax, qword [0x1403118bc]
mov rax, rax
push rax
movabs rax, str.PROCESSOR_ARCHITECTURE
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0xc8
mov rax, qword [0x140311914]
mov rax, rax
push rax
movabs rax, str.PROCESSOR_ARCHITEW6432
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0x3e8
mov rax, qword [0x1403118f4]
mov rax, rax
push rax
movabs rax, str.TEMP
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_GetEnvironmentVariableW
push rcx
sub rsp, 0x28
call fcn.14003dba0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14003dba0
add rsp, 0x28
pop rcx
push rax
push 0x3e8
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14003a900
add rsp, 0x28
lea rcx, [0x140311904]
pop rdx
call fcn.14003dc60
push 0x3e8
mov rax, qword [0x140311904]
mov rax, rax
push rax
movabs rax, str.WINDIR
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_GetEnvironmentVariableW
push rcx
sub rsp, 0x28
call fcn.14003dba0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14003dba0
add rsp, 0x28
pop rcx
push rax
push 0x3e8
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14003a900
add rsp, 0x28
lea rcx, [0x14031180c]
pop rdx
call fcn.14003dc60
push 0x3e8
mov rax, qword [0x14031180c]
mov rax, rax
push rax
movabs rax, str.WINDIR
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_GetEnvironmentVariableW
push rcx
sub rsp, 0x28
call fcn.14003dba0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
mov rcx, qword [0x140311904]
push rcx
sub rsp, 0x28
call fcn.14003dba0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14003dbf0
add rsp, 0x28
movabs rcx, str.Sysnativecmd.exe
sub rsp, 0x28
call fcn.14003dbf0
add rsp, 0x28
push rax
call fcn.14003dd70
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
sub rsp, 0x20
call fcn.14002c9c4
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14001f040
add rsp, 0x28
pop rax
mov r15, rax
and r15, r15
jle 0x1400016f2
mov rcx, qword [0x140311904]
push rcx
sub rsp, 0x28
call fcn.14003dba0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14003dbf0
add rsp, 0x28
movabs rcx, str.Sysnative
sub rsp, 0x28
call fcn.14003dbf0
add rsp, 0x28
lea rcx, [0x140311904]
pop rdx
call fcn.14003dc60
jmp 0x14000173a
mov rcx, qword [0x140311904]
push rcx
sub rsp, 0x28
call fcn.14003dba0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14003dbf0
add rsp, 0x28
movabs rcx, str.System32
sub rsp, 0x28
call fcn.14003dbf0
add rsp, 0x28
lea rcx, [0x140311904]
pop rdx
call fcn.14003dc60
mov qword [0x14031192c], 0
call fcn.14002107c
mov r15, rax
dec r15
mov qword [0x14031182c], r15
mov r15, qword [0x14031182c]
and r15, r15
jl 0x14000184a
mov qword [0x14031189c], 0
jmp 0x140001774
mov rax, qword [0x14031182c]
cmp rax, qword [0x14031189c]
jl 0x14000184a
push rcx
sub rsp, 0x28
call fcn.14003dba0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14003dba0
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.14003dba0
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.14003dba0
add rsp, 0x28
pop rcx
push rax
push qword [0x14031189c]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140021110
add rsp, 0x20
push rax
call fcn.14003dd70
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14003ab80
add rsp, 0x28
lea rcx, [0x1403118c4]
pop rdx
call fcn.14003dc60
push qword [0x1403118c4]
movabs rdx, str._CMD
mov rcx, qword [rsp]
sub rsp, 0x28
call fcn.14003dda0
add rsp, 0x28
or rax, rax
je 0x14000183c
mov qword [0x14031192c], 1
pop rax
inc qword [0x14031189c]
jno 0x140001774
push 9
movabs rax, str.Consolas
push rax
push 0
pop rcx
pop rdx
pop r8
call fcn.14003c90c
push rcx
sub rsp, 0x28
call fcn.14003dba0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push 1
push rcx
sub rsp, 0x20
call fcn.14003dba0
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.14003dba0
add rsp, 0x28
pop rcx
push rax
pop rcx
sub rsp, 0x20
call fcn.14002119c
add rsp, 0x20
push rax
call fcn.14003dd70
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140007410
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14001f040
add rsp, 0x28
pop rax
call fcn.14002107c
mov r15, rax
dec r15
mov qword [0x14031182c], r15
mov r15, qword [0x14031182c]
and r15, r15
jl 0x140001ba2
mov qword [0x14031191c], 0
mov qword [0x14031189c], 0
jmp 0x140001916
mov rax, qword [0x14031182c]
cmp rax, qword [0x14031189c]
jl 0x140001a76
push rcx
sub rsp, 0x28
call fcn.14003dba0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14003dba0
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.14003dba0
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.14003dba0
add rsp, 0x28
pop rcx
push rax
push qword [0x14031189c]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140021110
add rsp, 0x20
push rax
call fcn.14003dd70
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14003ab80
add rsp, 0x28
lea rcx, [0x1403118c4]
pop rdx
call fcn.14003dc60
push qword [0x1403118c4]
movabs rdx, str._LOG
mov rcx, qword [rsp]
sub rsp, 0x28
call fcn.14003dda0
add rsp, 0x28
or rax, rax
je 0x1400019e3
mov qword [0x14031190c], 1
jmp 0x140001a68
movabs rdx, str._O2010
mov rcx, qword [rsp]
sub rsp, 0x28
call fcn.14003dda0
add rsp, 0x28
or rax, rax
je 0x140001a10
mov qword [0x14031185c], 1
jmp 0x140001a68
movabs rdx, str._O2013_16
mov rcx, qword [rsp]
sub rsp, 0x28
call fcn.14003dda0
add rsp, 0x28
or rax, rax
je 0x140001a3d
mov qword [0x14031183c], 1
jmp 0x140001a68
movabs rdx, str._O2013_21C2R
mov rcx, qword [rsp]
sub rsp, 0x28
call fcn.14003dda0
add rsp, 0x28
or rax, rax
je 0x140001a68
mov qword [0x14031191c], 1
pop rax
inc qword [0x14031189c]
jno 0x140001916
mov qword [0x14031189c], 0
jmp 0x140001a83
mov rax, qword [0x14031182c]
cmp rax, qword [0x14031189c]
jl 0x140001b9d
push rcx
sub rsp, 0x28
call fcn.14003dba0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14003dba0
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.14003dba0
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.14003dba0
add rsp, 0x28
pop rcx
push rax
push qword [0x14031189c]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140021110
add rsp, 0x20
push rax
call fcn.14003dd70
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14003ab80
add rsp, 0x28
lea rcx, [0x1403118c4]
pop rdx
call fcn.14003dc60
push qword [0x1403118c4]
movabs rdx, str._UNINSTALL
mov rcx, qword [rsp]
sub rsp, 0x28
call fcn.14003dda0
add rsp, 0x28
or rax, rax
je 0x140001b8f
sub rsp, 8
push 0x3e8
pop rcx
sub rsp, 0x20
call fcn.14000d307
add rsp, 0x28
sub rsp, 8
push 0x7d0
pop rcx
sub rsp, 0x20
call fcn.14002aa3c
add rsp, 0x28
sub rsp, 8
push qword [0x1403117fc]
pop rcx
sub rsp, 0x20
call fcn.140020a60
add rsp, 0x28
add rsp, 0xfffffffffffffff8
jmp 0x1400022aa
pop rax
inc qword [0x14031189c]
jno 0x140001a83
jmp 0x1400022aa
push rcx
sub rsp, 0x28
call fcn.14003dba0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14003dba0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
sub rsp, 0x20
call sub.KERNEL32.dll_GetUserDefaultLangID
add rsp, 0x28
mov rax, rax
push rax
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14003ac10
add rsp, 0x28
lea rcx, [0x1403117f4]
pop rdx
call fcn.14003dc60
push qword [0x1403117f4]
pop rcx
call fcn.14003ade0
mov r15, rax
cmp r15, 3
jne 0x140001c54
push rcx
sub rsp, 0x28
call fcn.14003dba0
add rsp, 0x28
pop rcx
push rax
movabs rcx, 0x1400f131c
sub rsp, 0x28
call fcn.14003dbf0
add rsp, 0x28
mov rcx, qword [0x1403117f4]
sub rsp, 0x28
call fcn.14003dbf0
add rsp, 0x28
lea rcx, [0x1403117f4]
pop rdx
call fcn.14003dc60
push qword [0x1403117f4]
movabs rcx, str.0419
pop rdx
call fcn.14003dda0
or rax, rax
je 0x140001c87
movabs rdx, 0x1400f18f4
lea rcx, [0x140311894]
call fcn.14003dab0
jmp 0x140001c9d
movabs rdx, 0x1400f2572
lea rcx, [0x140311894]
call fcn.14003dab0
movabs rax, str..._.._KMSTools.exe
push rax
pop rcx
call fcn.14002c9c4
mov r15, rax
cmp r15, 0xffffffffffffffff
jne 0x140001cda
movabs rax, str..._.._KMSTools_Lite.exe
push rax
pop rcx
call fcn.14002c9c4
mov r15, rax
cmp r15, 0xffffffffffffffff
jne 0x140001cda
mov rax, 1
jmp 0x140001cdd
xor rax, rax
and rax, rax
jmp 0x140001cfe
push 0xfa
push 0x1d2
push 0
push 0
pop rcx
pop rdx
pop r8
pop r9
call fcn.14000232a
push 1
push qword [0x14031186c]
pop rcx
pop rdx
call fcn.140026d08
push 0
push qword [0x1403118fc]
pop rcx
pop rdx
call fcn.140026d60
push 0
push qword [0x1403118dc]
pop rcx
pop rdx
call fcn.140026d60
push 1
push qword [0x140311844]
pop rcx
pop rdx
call fcn.140026d60
push 0xfffffffffffffffe
sub rsp, 8
push 0x28
push 0x28
push 0x28
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.140033f10
add rsp, 0x28
mov rax, rax
push rax
push 0xffffffffffffffff
push qword [0x1403118d4]
pop rcx
pop rdx
pop r8
pop r9
call fcn.140013e05
push 0
push 0
push 0
pop rcx
pop rdx
pop r8
call fcn.140033f10
mov rax, rax
push rax
push qword [0x140311814]
pop rcx
pop rdx
call fcn.14000e31a
push 0xff
push 0xff
push 0xff
pop rcx
pop rdx
pop r8
call fcn.140033f10
mov rax, rax
push rax
push qword [0x140311814]
pop rcx
pop rdx
call fcn.140013a33
call fcn.14002aad4
mov r15, rax
cmp r15, 0x6e
jl 0x140001efc
movabs rax, str.dwmapi
push rax
push 0
pop rcx
pop rdx
call fcn.1400249cc
and rax, rax
je 0x140001efc
mov qword [0x14031184c], 1
movabs rax, str.DwmSetWindowAttribute
push rax
push 0
pop rcx
pop rdx
call fcn.140024a54
mov qword [0x140311864], rax
push qword [0x140313940]
pop rcx
call fcn.14003cb48
lea rax, [0x14031188c]
mov rax, rax
push rax
push qword [0x140313940]
pop rcx
pop rdx
call fcn.14003cad0
and rax, rax
je 0x140001eda
push qword [0x14031188c]
pop rcx
call fcn.14002aef8
and rax, rax
je 0x140001ed8
mov rax, 8
mov rax, rax
push rax
lea rax, [0x14031184c]
mov rax, rax
push rax
mov rax, SafeArrayPutElement
mov rax, rax
push rax
sub rsp, 8
push qword [0x14031188c]
pop rcx
sub rsp, 0x20
call fcn.14002af08
add rsp, 0x28
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
pop r9
call qword [0x140311864]
jmp 0x140001e61
push qword [0x140313940]
pop rcx
call fcn.14003cac4
push 0
pop rcx
call fcn.1400248b8
push 1
pop rcx
call fcn.14000a8a3
movabs rax, 0x1400f1028
push rax
pop rcx
call fcn.140010fe5
push qword [0x140311894]
movabs rcx, 0x1400f18f4
pop rdx
call fcn.14003dda0
or rax, rax
je 0x140001f6b
movabs rax, 0x1400f1094
push rax
pop rcx
call fcn.140010fe5
movabs rax, 0x1400f1d42
push rax
push qword [0x140311814]
pop rcx
pop rdx
call fcn.140026db4
movabs rax, 0x1400f2b84
push rax
push qword [0x1403118a4]
pop rcx
pop rdx
call fcn.140026db4
jmp 0x140001f7c
movabs rax, 0x1400f1594
push rax
pop rcx
call fcn.140010fe5
movabs rax, str.OUninstall.exe__Uninstall___O2010____O2013_16____O2013_21C2R____Log____cmd_
push rax
pop rcx
call fcn.140010fe5
movabs rax, 0x1400f1028
push rax
pop rcx
call fcn.140010fe5
push qword [0x140311894]
movabs rcx, 0x1400f18f4
pop rdx
call fcn.14003dda0
or rax, rax
je 0x140001fcc
movabs rax, 0x1400f1584
push rax
pop rcx
call fcn.140010fe5
jmp 0x140001fdd
movabs rax, 0x1400f12d8
push rax
pop rcx
call fcn.140010fe5
movabs rax, str.OUninstall.exe__Uninstall__O2010__O2013_16__O2013_21C2R__Log
push rax
pop rcx
call fcn.140010fe5
movabs rax, 0x1400f1028
push rax
pop rcx
call fcn.140010fe5
call fcn.14002af28
mov qword [0x1403118ac], rax
cmp qword [0x1403118ac], 0
je 0x1400020d7
push qword [0x1403118ac]
mov r15, 0x201
cmp r15, qword [rsp]
jne 0x140002070
sub rsp, 8
push 0
push 2
push 0xa1
sub rsp, 8
push qword [0x1403118d4]
pop rcx
sub rsp, 0x20
call fcn.14002af08
add rsp, 0x28
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.USER32.dll_SendMessageW
add rsp, 0x28
jmp 0x1400020a2
mov r15, 0x332c
cmp r15, qword [rsp]
jne 0x140002095
sub rsp, 8
sub rsp, 0x20
call fcn.14002f054
add rsp, 0x28
mov rax, rax
push rax
pop rax
jmp 0x1400020a2
mov r15, 0x332d
cmp r15, qword [rsp]
jne 0x1400020a2
add rsp, 8
call fcn.14002f070
mov rax, rax
push rax
mov r15, qword [0x1403118d4]
cmp r15, qword [rsp]
jne 0x1400020d4
sub rsp, 8
push qword [0x1403118ac]
pop rcx
sub rsp, 0x20
call fcn.1400090c8
add rsp, 0x28
pop rax
jmp 0x1400020e2
push 5
pop rcx
call fcn.14002aa3c
push qword [0x1403117fc]
pop rcx
call fcn.1400209c4
and rax, rax
je 0x1400020fe
mov qword [0x1403118ac], 0
mov r15, qword [0x1403118ac]
cmp r15, 0x333c
jne 0x140001fff
push rcx
sub rsp, 0x28
call fcn.14003dba0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
mov rcx, qword [0x1403118f4]
push rcx
sub rsp, 0x28
call fcn.14003dba0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14003dbf0
add rsp, 0x28
movabs rcx, str._files
sub rsp, 0x28
call fcn.14003dbf0
add rsp, 0x28
push rax
call fcn.14003dd70
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
sub rsp, 0x20
call fcn.14002c9c4
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14001f040
add rsp, 0x28
pop rax
mov r15, rax
cmp r15, 0xfffffffffffffffe
jne 0x140002228
push rcx
sub rsp, 0x28
call fcn.14003dba0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push 3
movabs rax, 0x1400f1028
push rax
mov rcx, qword [0x1403118f4]
push rcx
sub rsp, 0x28
call fcn.14003dba0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14003dbf0
add rsp, 0x28
movabs rcx, str._files
sub rsp, 0x28
call fcn.14003dbf0
add rsp, 0x28
push rax
call fcn.14003dd70
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.14002cb40
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14001f040
add rsp, 0x28
pop rax
push rcx
sub rsp, 0x28
call fcn.14003dba0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push qword [0x1403118f4]
push rcx
sub rsp, 0x20
call fcn.14003dba0
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.14003dba0
add rsp, 0x28
pop rcx
push rax
pop rcx
sub rsp, 0x20
call fcn.14002119c
add rsp, 0x20
push rax
call fcn.14003dd70
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14003a9f0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14001f040
add rsp, 0x28
pop rax
mov r15, rax
and r15, r15
jle 0x1400022aa
call fcn.140014ded
call 0x1400022cc
call fcn.14003da80
mov rcx, qword [0x1403117dc]
call sub.KERNEL32.dll_HeapDestroy
mov rcx, qword [0x1403117ec]
call sub.KERNEL32.dll_ExitProcess
sub rsp, 0x28
call fcn.140020964
call fcn.140021d74
call fcn.1400235d0
call fcn.1400237c0
call fcn.14002490c
call fcn.140026bd0
call fcn.14002ae00
call fcn.14002ce7c
call fcn.14002d700
call fcn.14002ee68
call fcn.14003032c
call fcn.140034c78
call fcn.1400364cc
call fcn.14003a590
call fcn.14003ca98
call fcn.14003cbd8
call fcn.14003c290
add rsp, 0x28
ret