Function at 0x401000
Capabilities:
Allocate thread local storage
Query environment variable

Disassembly:
push 0x928
push 0
push 0x9e55a0
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleW
mov dword [0x9e55a4], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x9e55a0], eax
mov eax, 0x485b7b
mov dword [0x9e56e8], eax
call fcn.00430c40
call fcn.0042fd30
call fcn.0042e2aa
call fcn.0042d527
call fcn.0042c870
call fcn.0042c561
call fcn.0042c354
call fcn.0042ab22
call fcn.0042a616
call fcn.00429530
call fcn.004288b8
call fcn.00427864
call fcn.0042035f
call fcn.0041f45f
call fcn.0041efdd
call fcn.0041d93e
call fcn.0041cd4c
call fcn.0041cb4e
mov edx, 0x46f046
lea ecx, [0x9e5778]
call fcn.0041b008
mov edx, 0x476550
lea ecx, [0x9e5870]
call fcn.0041b008
mov edx, 0x4747f8
lea ecx, [0x9e5744]
call fcn.0041b008
mov edx, 0x47555a
lea ecx, [0x9e5964]
call fcn.0041b008
mov edx, str.Interface_UA
lea ecx, [0x9e55fc]
call fcn.0041b008
mov edx, 0x4747f8
lea ecx, [0x9e5978]
call fcn.0041b008
mov edx, 0x479390
lea ecx, [0x9e55f4]
call fcn.0041b008
mov edx, 0x47500a
lea ecx, [0x9e58c0]
call fcn.0041b008
mov edx, str.Giao_di
lea ecx, [0x9e5914]
call fcn.0041b008
mov edx, 0x477fee
lea ecx, [0x9e56d8]
call fcn.0041b008
mov edx, 0x479390
lea ecx, [0x9e585c]
call fcn.0041b008
mov edx, 0x476326
lea ecx, [0x9e59b4]
call fcn.0041b008
mov edx, 0x478a8a
lea ecx, [0x9e55ec]
call fcn.0041b008
mov edx, 0x476e0a
lea ecx, [0x9e5674]
call fcn.0041b008
mov edx, 0x4795d2
lea ecx, [0x9e56b8]
call fcn.0041b008
mov edx, 0x470458
lea ecx, [0x9e5698]
call fcn.0041b008
mov edx, 0x4755de
lea ecx, [0x9e5740]
call fcn.0041b008
mov edx, 0x4700c0
lea ecx, [0x9e5814]
call fcn.0041b008
mov edx, 0x479692
lea ecx, [0x9e56d0]
call fcn.0041b008
mov edx, 0x470d32
lea ecx, [0x9e599c]
call fcn.0041b008
mov edx, 0x4743cc
lea ecx, [0x9e57bc]
call fcn.0041b008
mov edx, 0x470ce6
lea ecx, [0x9e58a4]
call fcn.0041b008
mov edx, 0x4701ea
lea ecx, [0x9e5824]
call fcn.0041b008
mov edx, 0x4701ea
lea ecx, [0x9e55e4]
call fcn.0041b008
mov edx, 0x472b3e
lea ecx, [0x9e57a0]
call fcn.0041b008
mov edx, 0x46f632
lea ecx, [0x9e5720]
call fcn.0041b008
mov edx, 0x4785e8
lea ecx, [0x9e587c]
call fcn.0041b008
mov edx, 0x46fff8
lea ecx, [0x9e5938]
call fcn.0041b008
mov edx, 0x4716c4
lea ecx, [0x9e55dc]
call fcn.0041b008
mov edx, 0x476aa8
lea ecx, [0x9e56f4]
call fcn.0041b008
mov edx, 0x47192c
lea ecx, [0x9e5790]
call fcn.0041b008
mov edx, 0x4726e2
lea ecx, [0x9e5770]
call fcn.0041b008
mov edx, 0x4700c0
lea ecx, [0x9e5828]
call fcn.0041b008
mov edx, 0x477670
lea ecx, [0x9e58bc]
call fcn.0041b008
mov edx, 0x47688a
lea ecx, [0x9e5990]
call fcn.0041b008
mov edx, 0x477b28
lea ecx, [0x9e59b0]
call fcn.0041b008
mov edx, 0x4780b0
lea ecx, [0x9e57d0]
call fcn.0041b008
mov edx, 0x46f53a
lea ecx, [0x9e5868]
call fcn.0041b008
mov edx, 0x4729d8
lea ecx, [0x9e590c]
call fcn.0041b008
mov edx, 0x4700c0
lea ecx, [0x9e55bc]
call fcn.0041b008
mov edx, 0x4780c8
lea ecx, [0x9e5878]
call fcn.0041b008
mov edx, 0x47176a
lea ecx, [0x9e5918]
call fcn.0041b008
mov edx, 0x46f61c
lea ecx, [0x9e581c]
call fcn.0041b008
mov edx, 0x47972a
lea ecx, [0x9e57d4]
call fcn.0041b008
mov edx, 0x4751da
lea ecx, [0x9e58b4]
call fcn.0041b008
mov edx, 0x475e00
lea ecx, [0x9e5650]
call fcn.0041b008
mov edx, 0x470d7e
lea ecx, [0x9e56b4]
call fcn.0041b008
mov edx, 0x4702da
lea ecx, [0x9e5844]
call fcn.0041b008
mov edx, 0x47030e
lea ecx, [0x9e5818]
call fcn.0041b008
mov edx, 0x474730
lea ecx, [0x9e597c]
call fcn.0041b008
mov edx, str.___:
lea ecx, [0x9e578c]
call fcn.0041b008
mov edx, str._______Windows_
lea ecx, [0x9e57b8]
call fcn.0041b008
mov edx, str._______Office_
lea ecx, [0x9e5858]
call fcn.0041b008
mov edx, 0x476a30
lea ecx, [0x9e5954]
call fcn.0041b008
mov edx, 0x477bb8
lea ecx, [0x9e55e8]
call fcn.0041b008
mov edx, 0x479220
lea ecx, [0x9e594c]
call fcn.0041b008
mov edx, 0x471874
lea ecx, [0x9e59ac]
call fcn.0041b008
mov edx, 0x4714a0
lea ecx, [0x9e5704]
call fcn.0041b008
mov edx, str.IP____
lea ecx, [0x9e5840]
call fcn.0041b008
mov edx, 0x47964c
lea ecx, [0x9e5798]
call fcn.0041b008
mov edx, 0x478f94
lea ecx, [0x9e57ac]
call fcn.0041b008
mov edx, 0x46f1c0
lea ecx, [0x9e5968]
call fcn.0041b008
mov edx, 0x47120e
lea ecx, [0x9e5808]
call fcn.0041b008
mov edx, str.Microsoft_Office_2010_2013_2016
lea ecx, [0x9e56b0]
call fcn.0041b008
mov edx, 0x475e82
lea ecx, [0x9e5708]
call fcn.0041b008
mov edx, 0x47595a
lea ecx, [0x9e55c8]
call fcn.0041b008
mov edx, 0x478f5e
lea ecx, [0x9e5784]
call fcn.0041b008
mov edx, 0x475c08
lea ecx, [0x9e56d4]
call fcn.0041b008
mov edx, 0x471acc
lea ecx, [0x9e55d0]
call fcn.0041b008
mov edx, 0x4748f4
lea ecx, [0x9e57b4]
call fcn.0041b008
mov edx, 0x478e6e
lea ecx, [0x9e58c8]
call fcn.0041b008
mov edx, 0x470cba
lea ecx, [0x9e55b0]
call fcn.0041b008
mov edx, str.Microsoft_Windows_Office
lea ecx, [0x9e570c]
call fcn.0041b008
mov edx, 0x476460
lea ecx, [0x9e5904]
call fcn.0041b008
mov edx, 0x4735ee
lea ecx, [0x9e584c]
call fcn.0041b008
mov edx, 0x46f046
lea ecx, [0x9e583c]
call fcn.0041b008
mov edx, 0x47839e
lea ecx, [0x9e57e8]
call fcn.0041b008
mov edx, 0x476618
lea ecx, [0x9e5988]
call fcn.0041b008
mov edx, 0x471f12
lea ecx, [0x9e582c]
call fcn.0041b008
mov edx, 0x47425e
lea ecx, [0x9e5730]
call fcn.0041b008
mov edx, 0x478f38
lea ecx, [0x9e57dc]
call fcn.0041b008
mov edx, str.KMSAuto_Lite_v1.2.1
lea ecx, [0x9e55d8]
call fcn.0041b008
mov edx, dword [0x9e55d8]
call fcn.00430c90
push eax
call fcn.00430cd0
mov edx, 0x46f326
call fcn.00430cd0
push 0x9e572c
call fcn.00430d30
call fcn.00430c90
push eax
mov edx, 0x475bae
call fcn.00430cd0
mov edx, dword [0x9e55d8]
call fcn.00430cd0
mov edx, 0x470cb0
call fcn.00430cd0
push 0x9e58cc
call fcn.00430d30
mov edx, 0x4789f8
lea ecx, [0x9e57c8]
call fcn.0041b008
call fcn.0041fa90
mov ebp, 0x4797b0
push ebp
push 0xffffffff
call fcn.0042caad
mov dword [0x9e5654], eax
mov ebp, 0x479b0b
push ebp
push 0xffffffff
call fcn.0042caad
mov dword [0x9e5658], eax
mov ebp, 0x480e8e
push ebp
push 0xffffffff
call fcn.0042caad
mov dword [0x9e565c], eax
mov ebp, 0x481064
push ebp
push 0xffffffff
call fcn.0042caad
mov dword [0x9e5660], eax
mov ebp, 0x48124a
push ebp
push 0xffffffff
call fcn.0042caad
mov dword [0x9e5664], eax
mov ebp, 0x4815f9
push ebp
push 0xffffffff
call fcn.0042caad
mov dword [0x9e5668], eax
mov ebp, 0x48192a
push ebp
push 0xffffffff
call fcn.0042caad
mov dword [0x9e5670], eax
mov ebp, 0x484cd6
push ebp
push 0xffffffff
call fcn.0042caad
mov dword [0x9e5678], eax
mov ebp, 0x4850b3
push ebp
push 0xffffffff
call fcn.0042caad
mov dword [0x9e5680], eax
mov ebp, 0x4855c9
push ebp
push 0xffffffff
call fcn.0042caad
mov dword [0x9e5688], eax
push 8
push str.Microsoft_Sans_Serif
push 0
call fcn.004289b0
push 0xa
push str.Lucida_Console
push 1
call fcn.004289b0
mov edx, str.KMS_Service_v1.1.9XP
lea ecx, [0x9e5820]
call fcn.0041b008
mov edx, 0x46f046
lea ecx, [0x9e564c]
call fcn.0041b008
mov edx, 0x46f046
lea ecx, [0x9e5634]
call fcn.0041b008
mov edx, 0x46f046
lea ecx, [0x9e57cc]
call fcn.0041b008
mov edx, 0x46f046
lea ecx, [0x9e57e0]
call fcn.0041b008
mov edx, 0x46f046
lea ecx, [0x9e56e0]
call fcn.0041b008
mov edx, 0x46f046
lea ecx, [0x9e57d8]
call fcn.0041b008
mov edx, 0x46f046
lea ecx, [0x9e5624]
call fcn.0041b008
mov edx, 0x46f046
lea ecx, [0x9e59a8]
call fcn.0041b008
mov edx, 0x46f046
lea ecx, [0x9e5618]
call fcn.0041b008
mov dword [0x9e5694], 0xffffffff
mov dword [0x9e56dc], 0xffffffff
mov dword [0x9e58b8], 0xffffffff
mov edx, 0x46f046
lea ecx, [0x9e5974]
call fcn.0041b008
mov dword [0x9e5830], 0
mov edx, 0x46f046
lea ecx, [0x9e5788]
call fcn.0041b008
mov dword [0x9e56e4], 0
mov dword [0x9e596c], 0
mov dword [0x9e5980], 0x64
mov dword [0x9e5984], 0x64
mov edx, dword [0x9e5650]
call fcn.00430c90
push eax
call fcn.00430cd0
push 0x9e5848
call fcn.00430d30
mov edx, 0x46f046
lea ecx, [0x9e5888]
call fcn.0041b008
call fcn.00430c90
push eax
push eax
push 0x64
call fcn.0041b390
push 0x9e55b8
call fcn.00430d30
call fcn.00430c90
push eax
push eax
push 0x3e8
call fcn.0041b390
push 0x9e58f4
call fcn.00430d30
call fcn.00430c90
push eax
push eax
push 0x3e8
call fcn.0041b390
push 0x9e5950
call fcn.00430d30
call fcn.00430c90
push eax
push eax
push 0x3e8
call fcn.0041b390
push 0x9e56f0
call fcn.00430d30
call fcn.00430c90
push eax
push eax
push 0xc8
call fcn.0041b390
push 0x9e588c
call fcn.00430d30
call fcn.00430c90
push eax
push eax
push 0xc8
call fcn.0041b390
push 0x9e5970
call fcn.00430d30
mov edx, 0x46f046
lea ecx, [0x9e5958]
call fcn.0041b008
mov edx, str._Integrated_KMS_Service_
lea ecx, [0x9e569c]
call fcn.0041b008
mov edx, str.127.0.0.2
lea ecx, [0x9e56ac]
call fcn.0041b008
mov edx, dword [0x9e569c]
call fcn.00430c90
push eax
call fcn.00430cd0
push 0x9e5810
call fcn.00430d30
mov edx, str.100.100.0.10
lea ecx, [0x9e5774]
call fcn.0041b008
mov edx, 0x46f046
lea ecx, [0x9e5854]
call fcn.0041b008
mov edx, 0x46f046
lea ecx, [0x9e5884]
call fcn.0041b008
mov edx, dword [0x9e5774]
call fcn.00430c90
push eax
call fcn.00430cd0
push 0x9e5768
call fcn.00430d30
mov edx, 0x47902a
lea ecx, [0x9e571c]
call fcn.0041b008
mov dword [0x9e58c4], 0
mov byte [0x9e5a50], 0
mov dword [0x9e5960], 0
mov edx, 0x46f046
lea ecx, [0x9e56a4]
call fcn.0041b008
mov edx, 0x46f046
lea ecx, [0x9e55f0]
call fcn.0041b008
mov edx, dword [0x9e571c]
call fcn.00430c90
push eax
call fcn.00430cd0
push 0x9e5794
call fcn.00430d30
mov edx, str.KMSAutoLite.ini
lea ecx, [0x9e57a8]
call fcn.0041b008
mov dword [0x9e55ac], 0
mov dword [0x9e5734], 0
mov edx, str.__by_Default_
lea ecx, [0x9e58ec]
call fcn.0041b008
mov edx, str.RandomKMSPID
lea ecx, [0x9e56c0]
call fcn.0041b008
mov dword [0x9e5e4c], 5
mov dword [0x9e5e50], 2
push 0x9e5e48
push 0x479780
push 8
push 4
push 2
call fcn.0042c2e6
mov dword [0x9e5e58], 0xc
mov dword [0x9e5e5c], 2
push 0x9e5e54
push 0x479780
push 8
push 4
push 2
call fcn.0042c2e6
mov edx, 0x46f046
lea ecx, [0x9e583c]
call fcn.0041b008
mov edx, 0x46f046
lea ecx, [0x9e595c]
call fcn.0041b008
mov edx, 0x46f046
lea ecx, [0x9e598c]
call fcn.0041b008
mov edx, 0x46f046
lea ecx, [0x9e57b0]
call fcn.0041b008
mov edx, 0x46f046
lea ecx, [0x9e56bc]
call fcn.0041b008
mov edx, 0x46f046
lea ecx, [0x9e57a4]
call fcn.0041b008
mov edx, 0x46f046
lea ecx, [0x9e58e8]
call fcn.0041b008
mov edx, 0x46f046
lea ecx, [0x9e5894]
call fcn.0041b008
mov byte [0x9e5a51], 0
mov byte [0x9e5a52], 0
mov edx, str.30d_00h_00m
lea ecx, [0x9e57c4]
call fcn.0041b008
push 0x64
mov eax, dword [0x9e55b8]
push eax
push 0x471a36
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0x3e8
mov eax, dword [0x9e58f4]
push eax
push str.TEMP
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0x3e8
mov eax, dword [0x9e5950]
push eax
push 0x475918
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0x3e8
mov eax, dword [0x9e588c]
push eax
push str.PROCESSOR_ARCHITECTURE
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0x3e8
mov eax, dword [0x9e5970]
push eax
push str.PROCESSOR_ARCHITEW6432
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0x3e8
mov eax, dword [0x9e56f0]
push eax
push str.ALLUSERSPROFILE
call sub.KERNEL32.dll_GetEnvironmentVariableW
mov edx, dword [0x9e5950]
call fcn.00430c90
push eax
call fcn.00430cd0
push 0x9e55f0
call fcn.00430d30
mov edx, dword [0x9e55f0]
call fcn.00430c90
push eax
call fcn.00430cd0
mov edx, str.KMS
call fcn.00430cd0
push 0x9e5648
call fcn.00430d30
mov edx, 0x46f046
lea ecx, [0x9e56a8]
call fcn.0041b008
push dword [0x9e588c]
mov edx, str.AMD64
pop ecx
call fcn.00430dc0
jne 0x401c3b
push dword [0x9e5970]
mov edx, str.AMD64
pop ecx
call fcn.00430dc0
jne 0x401c3b
jmp 0x401c42
mov eax, 1
jmp 0x401c44
xor eax, eax
and eax, eax
je 0x401c5a
mov edx, str.x64WDV
lea ecx, [0x9e5888]
call fcn.0041b008
jmp 0x401c6a
mov edx, str.x86WDV
lea ecx, [0x9e5888]
call fcn.0041b008
call fcn.00430c90
push eax
push eax
call fcn.00430c90
push eax
push dword [0x9e55f0]
call fcn.0041b3e0
call fcn.00430e00
call fcn.00430c90
push eax
push eax
call fcn.00430c90
push eax
push eax
call fcn.00430c90
push eax
push eax
call fcn.0041cd7b
call fcn.00430e42
add dword [esp], edx
call fcn.004289e2
call fcn.00430e42
add dword [esp], edx
call fcn.0041b3e0
call fcn.00430e42
add dword [esp], edx
call fcn.00430e42
add dword [esp + 4], edx
call fcn.0041b4c0
call fcn.00430e60
mov ebx, eax
and ebx, ebx
jle 0x401d06
mov edx, dword [0x9e55f0]
call fcn.00430c90
push eax
call fcn.00430cd0
mov edx, str.KMSAutoS
call fcn.00430cd0
push 0x9e56a8
call fcn.00430d30
jmp 0x401da0
call fcn.00430c90
push eax
mov edx, dword [0x9e55f0]
call fcn.00430c90
push eax
call fcn.00430cd0
mov edx, str.Temp
call fcn.00430cd0
call fcn.00430e42
add dword [esp], edx
call fcn.00428a66
call fcn.00430e60
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x401d47
cmp edi, 0xffffffff
je 0x401d4b
xor eax, eax
jmp 0x401d50
mov eax, 1
or eax, eax
je 0x401d7b
mov edx, dword [0x9e55f0]
call fcn.00430c90
push eax
call fcn.00430cd0
mov edx, str.TempKMSAuto
call fcn.00430cd0
push 0x9e56a8
call fcn.00430d30
jmp 0x401da0
mov edx, dword [0x9e58f4]
call fcn.00430c90
push eax
call fcn.00430cd0
mov edx, str.KMSAuto
call fcn.00430cd0
push 0x9e56a8
call fcn.00430d30
call fcn.00430c90
push eax
mov edx, dword [0x9e5950]
call fcn.00430c90
push eax
call fcn.00430cd0
mov edx, 0x4785b6
call fcn.00430cd0
call fcn.00430e42
add dword [esp], edx
call fcn.00428a66
call fcn.00430e60
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x401de7
jl 0x401de3
cmp ebx, 0
ja 0x401de7
xor eax, eax
jmp 0x401dec
mov eax, 1
or eax, eax
je 0x401e17
mov edx, dword [0x9e5950]
call fcn.00430c90
push eax
call fcn.00430cd0
mov edx, 0x470728
call fcn.00430cd0
push 0x9e5950
call fcn.00430d30
jmp 0x401e3c
mov edx, dword [0x9e5950]
call fcn.00430c90
push eax
call fcn.00430cd0
mov edx, 0x473cec
call fcn.00430cd0
push 0x9e5950
call fcn.00430d30
call fcn.00430c90
push eax
push eax
call fcn.00430c90
push eax
push eax
call fcn.00430c90
push eax
call fcn.0041cd7b
call fcn.00430e42
add dword [esp], edx
call fcn.004289e2
mov edx, str.KMSAutoLite.ini
call fcn.00430cd0
call fcn.00430e42
add dword [esp], edx
call fcn.0041dcbf
call fcn.00430e60
and eax, eax
je 0x401eb1
push 0x46fd18
call fcn.0041dccd
call fcn.00430c90
push eax
push eax
push 0x46f046
push 0x4795ea
call fcn.0041ddde
push 0x9e5778
call fcn.00430d30
call fcn.0041decd
push dword [0x9e5778]
mov edx, 0x4701e4
pop ecx
call fcn.00430dc0
je 0x401ed6
mov edx, 0x47539c
lea ecx, [0x9e5778]
call fcn.0041b008
jmp 0x401f43
push dword [0x9e5778]
mov edx, 0x471c72
pop ecx
call fcn.00430dc0
je 0x401efb
mov edx, 0x4742e6
lea ecx, [0x9e5778]
call fcn.0041b008
jmp 0x401f43
push dword [0x9e5778]
mov edx, 0x47295e
pop ecx
call fcn.00430dc0
je 0x401f20
mov edx, 0x47643a
lea ecx, [0x9e5778]
call fcn.0041b008
jmp 0x401f43
push dword [0x9e5778]
mov edx, 0x471710
pop ecx
call fcn.00430dc0
je 0x401f43
mov edx, str.0422
lea ecx, [0x9e5778]
call fcn.0041b008
push dword [0x9e5778]
mov edx, 0x46f046
pop ecx
call fcn.00430dc0
je 0x401f8e
call fcn.00430c90
push eax
push eax
call fcn.00430c90
push eax
push 0x46f66c
push 0x46f056
push 0x470f54
call fcn.0041641b
call fcn.00430e42
add dword [esp], edx
call fcn.0041b3e0
push 0x9e5778
call fcn.00430d30
push dword [0x9e5778]
mov edx, 0x4742e6
pop ecx
call fcn.00430dc0
je 0x401fad
push 0x471c72
call fcn.00410b7d
jmp 0x402014
push dword [0x9e5778]
mov edx, 0x47539c
pop ecx
call fcn.00430dc0
je 0x401fcc
push 0x4701e4
call fcn.00410b7d
jmp 0x402014
push dword [0x9e5778]
mov edx, 0x47643a
pop ecx
call fcn.00430dc0
je 0x401feb
push 0x47295e
call fcn.00410b7d
jmp 0x402014
push dword [0x9e5778]
mov edx, str.0422
pop ecx
call fcn.00430dc0
je 0x40200a
push 0x471710
call fcn.00410b7d
jmp 0x402014
push 0x471c72
call fcn.00410b7d
push 0x100
push 1
call fcn.0041ad7f
call fcn.00430c90
push eax
push 0x46f66c
push 0x47823e
push 0x4705d2
call fcn.0041641b
mov edx, str._________
call fcn.00430cd0
push 0x9e583c
call fcn.00430d30
call fcn.00430c90
push eax
push 0x46f66c
push str.EditionID
push 0x4705d2
call fcn.0041641b
push 0x9e595c
call fcn.00430d30
call fcn.00430c90
push eax
push eax
call fcn.00430c90
push eax
push 4
push 0
call fcn.00430c90
push eax
push 0x46f66c
push 0x4704e4
push 0x4705d2
call fcn.0041641b
call fcn.00430e42
add dword [esp], edx
call fcn.0041b520
call fcn.00430e42
add dword [esp], edx
call fcn.0041b600
call fcn.00430e60
mov dword [0x9e55c4], eax
mov ebx, dword [0x9e55c4]
cmp ebx, 0x2580
jl 0x4020ed
mov edx, 0x478de6
lea ecx, [0x9e5958]
call fcn.0041b008
jmp 0x4021d1
mov ebx, dword [0x9e55c4]
cmp ebx, 0x23f0
jl 0x402110
mov ebx, dword [0x9e55c4]
cmp ebx, 0x2454
jge 0x402110
mov eax, 1
jmp 0x402112
xor eax, eax
and eax, eax
je 0x40212b
mov edx, 0x46f7ae
lea ecx, [0x9e5958]
call fcn.0041b008
jmp 0x4021d1
mov ebx, dword [0x9e55c4]
cmp ebx, 0x1db0
jl 0x40214e
mov ebx, dword [0x9e55c4]
cmp ebx, 0x1e14
jge 0x40214e
mov eax, 1
jmp 0x402150
xor eax, eax
and eax, eax
je 0x402166
mov edx, 0x46f7aa
lea ecx, [0x9e5958]
call fcn.0041b008
jmp 0x4021d1
mov ebx, dword [0x9e55c4]
cmp ebx, 0xa28
jl 0x402189
mov ebx, dword [0x9e55c4]
cmp ebx, 0xbb8
jge 0x402189
mov eax, 1
jmp 0x40218b
xor eax, eax
and eax, eax
je 0x4021c1
mov edx, 0x4741a2
lea ecx, [0x9e5958]
call fcn.0041b008
push 1
push dword [0x9e5600]
call fcn.004203e9
push 1
push dword [0x9e5614]
call fcn.004203e9
jmp 0x4021d1
mov edx, 0x478de6
lea ecx, [0x9e5958]
call fcn.0041b008
call fcn.00430c90
push eax
push eax
call fcn.00430c90
push eax
push eax
call fcn.00430c90
push eax
call fcn.0041cd7b
call fcn.00430e42
add dword [esp], edx
call fcn.00428c61
call fcn.00430e00
push 1
push 0
push dword [0x9e5944]
call fcn.00430e42
add dword [esp + 0xc], edx
call sub.KERNEL32.dll_CreateSemaphoreW
call fcn.00430e60
mov dword [0x9e55e0], eax
mov ebx, dword [0x9e55e0]
and ebx, ebx
je 0x402244
call sub.KERNEL32.dll_GetLastError
mov ebx, eax
cmp ebx, 0xb7
jne 0x402244
mov eax, 1
jmp 0x402246
xor eax, eax
and eax, eax
je 0x40226f
push 0
push dword [0x9e57e8]
push str.KMSAuto_Lite
call fcn.0041cb85
push dword [0x9e55e0]
call sub.KERNEL32.dll_CloseHandle
jmp 0x402c1a
push 3
push 0x46f046
push dword [0x9e56a8]
call fcn.00428c73
call fcn.0040c55b
call fcn.00430c90
push eax
call fcn.00410589
push 0x9e5884
call fcn.00430d30
call fcn.0040b4a0
call fcn.0041cf16
mov ebx, eax
dec ebx
mov dword [0x9e5690], ebx
mov ebx, dword [0x9e5690]
and ebx, ebx
jl 0x402471
mov dword [0x9e586c], 0
mov eax, dword [0x9e5690]
cmp eax, dword [0x9e586c]
jl 0x40239f
call fcn.00430c90
push eax
push eax
call fcn.00430c90
push eax
push eax
push dword [0x9e586c]
call fcn.0041cec6
call fcn.00430e42
add dword [esp], edx
call fcn.0041b3e0
push 0x9e5890
call fcn.00430d30
push dword [0x9e5890]
mov edx, str._OFSCONV15
mov ecx, dword [esp]
call fcn.00430dc0
je 0x402326
call fcn.00413cd8
jmp 0x402392
mov edx, str._OFSCONV16
mov ecx, dword [esp]
call fcn.00430dc0
je 0x40233c
call fcn.00413d85
jmp 0x402392
mov edx, str._WINGVLKINST
mov ecx, dword [esp]
call fcn.00430dc0
je 0x402352
call fcn.0040dbc5
jmp 0x402392
mov edx, str._OFSGVLKINST
mov ecx, dword [esp]
call fcn.00430dc0
je 0x402368
call fcn.004050e7
jmp 0x402392
mov edx, str._SCHEDWIN
mov ecx, dword [esp]
call fcn.00430dc0
je 0x40237e
call fcn.0040ecf7
jmp 0x402392
mov edx, str._SCHEDOFS
mov ecx, dword [esp]
call fcn.00430dc0
je 0x402392
call fcn.0040cc7a
pop eax
inc dword [0x9e586c]
jno 0x4022c9
mov dword [0x9e586c], 0
mov eax, dword [0x9e5690]
cmp eax, dword [0x9e586c]
jl 0x40241f
call fcn.00430c90
push eax
push eax
call fcn.00430c90
push eax
push eax
push dword [0x9e586c]
call fcn.0041cec6
call fcn.00430e42
add dword [esp], edx
call fcn.0041b3e0
push 0x9e5890
call fcn.00430d30
push dword [0x9e5890]
mov edx, str._WINACT
mov ecx, dword [esp]
call fcn.00430dc0
je 0x402402
call fcn.0040baaf
jmp 0x402416
mov edx, str._OFSACT
mov ecx, dword [esp]
call fcn.00430dc0
je 0x402416
call fcn.00406a0c
pop eax
inc dword [0x9e586c]
jno 0x4023a9
call fcn.00430c90
push eax
push eax
call fcn.00430c90
push eax
push eax
call fcn.00430c90
push eax
call fcn.0041cd7b
call fcn.00430e42
add dword [esp], edx
call fcn.004289e2
call fcn.00430e42
add dword [esp], edx
call fcn.00428f38
call fcn.00430e60
push 3
push 0x46f046
push dword [0x9e56a8]
call fcn.00428c73
jmp 0x402c1a
call fcn.00430c90
push eax
push eax
call fcn.00430c90
push eax
push eax
call fcn.00430c90
push eax
call fcn.0041cd7b
call fcn.00430e42
add dword [esp], edx
call fcn.004289e2
mov edx, str.KMSAutoLite.ini
call fcn.00430cd0
call fcn.00430e42
add dword [esp], edx
call fcn.0041dcbf
call fcn.00430e60
and eax, eax
je 0x4024ee
push 0x46fd18
call fcn.0041dccd
push 0x64
push str.PosX
call fcn.0041dedf
mov dword [0x9e5980], eax
push 0x64
push str.PosY
call fcn.0041dedf
mov dword [0x9e5984], eax
call fcn.0041decd
push 0x206
push 0x1d0
push dword [0x9e5984]
push dword [0x9e5980]
call fcn.00403129
push dword [0x9e5958]
call fcn.0040d2b1
push str.43200
push dword [0x9e566c]
call fcn.00420414
push str.43200
push dword [0x9e56a0]
call fcn.00420414
call fcn.00430c90
push eax
push eax
mov edx, 0x470908
call fcn.00430cd0
mov edx, dword [0x9e56b4]
call fcn.00430cd0
mov edx, 0x46f020
call fcn.00430cd0
mov edx, dword [0x9e5844]
call fcn.00430cd0
mov edx, 0x46f020
call fcn.00430cd0
mov edx, dword [0x9e5818]
call fcn.00430cd0
call fcn.00430e00
push dword [0x9e566c]
call fcn.00430e42
add dword [esp + 4], edx
call fcn.00420555
call fcn.00430e60
call fcn.00430c90
push eax
push eax
mov edx, 0x470908
call fcn.00430cd0
mov edx, dword [0x9e56b4]
call fcn.00430cd0
mov edx, 0x46f020
call fcn.00430cd0
mov edx, dword [0x9e5844]
call fcn.00430cd0
mov edx, 0x46f020
call fcn.00430cd0
mov edx, dword [0x9e5818]
call fcn.00430cd0
call fcn.00430e00
push dword [0x9e56a0]
call fcn.00430e42
add dword [esp + 4], edx
call fcn.00420555
call fcn.00430e60
push 1
push dword [0x9e5640]
call fcn.004205a7
push 1
push dword [0x9e5614]
call fcn.004205a7
push 1
push dword [0x9e561c]
call fcn.004205a7
push 1
push dword [0x9e567c]
call fcn.004205a7
push 1
push dword [0x9e5644]
call fcn.004205a7
push 1
push dword [0x9e5620]
call fcn.004205a7
push 1
push dword [0x9e5628]
call fcn.004205a7
push 1
push dword [0x9e562c]
call fcn.004205a7
push 1
push dword [0x9e58a8]
call fcn.004205a7
push 1
push dword [0x9e5860]
call fcn.004205a7
push 1
push dword [0x9e5630]
call fcn.004205a7
push 1
push dword [0x9e58fc]
call fcn.004205a7
push 1
push dword [0x9e55b4]
call fcn.004205a7
push 1
push dword [0x9e5638]
call fcn.004205a7
push 1
push dword [0x9e5748]
call fcn.004205e5
push dword [0x9e5748]
call fcn.0042061d
mov byte [0x9e5a53], al
push dword [0x9e574c]
call fcn.0042061d
mov byte [0x9e5a54], al
push dword [0x9e5750]
call fcn.0042061d
mov byte [0x9e5a55], al
call fcn.00412dc9
push dword [0x9e5958]
mov edx, 0x4741a2
pop ecx
call fcn.00430dc0
jne 0x40281c
push dword [0x9e5810]
mov edx, dword [0x9e569c]
pop ecx
call fcn.00430dc0
je 0x4027fa
push 0
push dword [0x9e5714]
call fcn.004205a7
push dword [0x9e5714]
call fcn.0042061d
mov ebx, eax
and ebx, ebx
jle 0x4027d7
call fcn.00430c90
push eax
mov edx, dword [0x9e57dc]
call fcn.00430c90
push eax
call fcn.00430cd0
mov edx, 0x474406
call fcn.00430cd0
mov edx, dword [0x9e5884]
call fcn.00430cd0
mov edx, 0x46f17c
call fcn.00430cd0
call fcn.00430e00
push dword [0x9e5714]
call fcn.00430e42
add dword [esp + 4], edx
call fcn.00420414
call fcn.00430e60
push 0
push dword [0x9e5700]
call fcn.004205a7
jmp 0x4027f8
push 1
push dword [0x9e5700]
call fcn.004205a7
push dword [0x9e57dc]
push dword [0x9e5714]
call fcn.00420414
jmp 0x40281a
push 1
push dword [0x9e5714]
call fcn.004205a7
push 1
push dword [0x9e5700]
call fcn.004205a7
jmp 0x402846
mov dword [0x9e58c4], 0
push 1
push dword [0x9e5714]
call fcn.004205a7
push 1
push dword [0x9e5700]
call fcn.004205a7
push dword [0x9e567c]
call fcn.0042061d
mov ebx, eax
cmp ebx, 1
jne 0x40286a
mov edx, str.__FORC
lea ecx, [0x9e56a4]
call fcn.0041b008
jmp 0x40287a
mov edx, 0x46f046
lea ecx, [0x9e56a4]
call fcn.0041b008
push dword [0x9e5958]
mov edx, 0x4741a2
pop ecx
call fcn.00430dc0
je 0x4028ad
push 1
push dword [0x9e5600]
call fcn.004203e9
push 1
push dword [0x9e5684]
call fcn.004203e9
push dword [0x9e58cc]
call fcn.00413e32
push 0x46f046
call fcn.00413e32
push dword [0x9e5958]
mov edx, 0x4741a2
pop ecx
call fcn.00430dc0
jne 0x40299e
movsx ebx, byte [0x9e5a51]
cmp ebx, 1
jne 0x4028f7
movsx ebx, byte [0x9e5a52]
and ebx, ebx
jne 0x4028f7
mov eax, 1
jmp 0x4028f9
xor eax, eax
and eax, eax
je 0x40290d
push dword [0x9e57b8]
call fcn.00413e32
jmp 0x40299e
movsx ebx, byte [0x9e5a51]
cmp ebx, 1
jne 0x40292c
movsx ebx, byte [0x9e5a52]
cmp ebx, 1
jne 0x40292c
mov eax, 1
jmp 0x40292e
xor eax, eax
and eax, eax
je 0x40294a
push dword [0x9e57b8]
call fcn.00413e32
push dword [0x9e5858]
call fcn.00413e32
jmp 0x40299e
movsx ebx, byte [0x9e5a51]
and ebx, ebx
jne 0x402968
movsx ebx, byte [0x9e5a52]
cmp ebx, 1
jne 0x402968
mov eax, 1
jmp 0x40296a
xor eax, eax
and eax, eax
je 0x40297b
push dword [0x9e5858]
call fcn.00413e32
jmp 0x40299e
movsx ebx, byte [0x9e5a51]
and ebx, ebx
jne 0x402998
movsx ebx, byte [0x9e5a52]
and ebx, ebx
jne 0x402998
mov eax, 1
jmp 0x40299a
xor eax, eax
and eax, eax
je 0x40299e
mov ebx, dword [0x9e596c]
and ebx, ebx
jle 0x4029cf
call fcn.00405ffd
push 1
push dword [0x9e5998]
call fcn.004203e9
push 0
push dword [0x9e5908]
call fcn.004203e9
jmp 0x4029ef
push 0
push dword [0x9e5998]
call fcn.004203e9
push 1
push dword [0x9e5908]
call fcn.004203e9
push 1
push dword [0x9e5738]
call fcn.004203e9
push 0xffffffff
push 0
push 0
push 1
push 1
push dword [0x9e56a8]
call fcn.00408463
call fcn.004278bc
mov dword [0x9e5880], eax
cmp dword [0x9e5880], 0
je 0x402a6b
call fcn.0042a6df
push eax
mov ebx, dword [0x9e58ac]
cmp ebx, dword [esp]
jne 0x402a54
push dword [0x9e5880]
call fcn.0040dee9
jmp 0x402a68
mov dword [0x9e5880], 0
push 5
call fcn.0042759d
pop eax
jmp 0x402a75
push 5
call fcn.0042759d
mov ebx, dword [0x9e5880]
cmp ebx, 0x333c
jne 0x402a23
call fcn.0040537c
call fcn.00430c90
push eax
push eax
call fcn.00430c90
push eax
push eax
call fcn.00430c90
push eax
call fcn.0041cd7b
call fcn.00430e42
add dword [esp], edx
call fcn.004289e2
call fcn.00430e42
add dword [esp], edx
call fcn.00428f38
call fcn.00430e60
call fcn.00430c90
push eax
push 2
mov edx, dword [0x9e58f4]
call fcn.00430c90
push eax
call fcn.00430cd0
mov edx, str._test.dat
call fcn.00430cd0
call fcn.00430e42
add dword [esp], edx
call fcn.00428f4a
call fcn.00430e60
push 3
push 0x46f046
push dword [0x9e56a8]
call fcn.00428c73
mov dword [0x9e59a4], 0
call fcn.00430c90
push eax
call fcn.0041a397
push 0x9e55cc
call fcn.00430d30
push 1
push str.MSActBackup
push dword [0x9e55cc]
call fcn.0041b450
mov ebx, eax
and ebx, ebx
jle 0x402b51
mov dword [0x9e59a4], 1
push dword [0x9e55cc]
mov edx, 0x46f046
pop ecx
call fcn.00430dc0
je 0x402b17
mov ebx, dword [0x9e59a4]
and ebx, ebx
jne 0x402c1a
call fcn.00430c90
push eax
push 2
mov edx, dword [0x9e58f4]
call fcn.00430c90
push eax
call fcn.00430cd0
mov edx, str.MSActBackup.exe
call fcn.00430cd0
call fcn.00430e42
add dword [esp], edx
call fcn.00428f4a
call fcn.00430e60
call fcn.00430c90
push eax
push 2
mov edx, dword [0x9e58f4]
call fcn.00430c90
push eax
call fcn.00430cd0
mov edx, 0x4790ea
call fcn.00430cd0
call fcn.00430e42
add dword [esp], edx
call fcn.00428f4a
call fcn.00430e60
call fcn.00430c90
push eax
push 2
mov edx, dword [0x9e58f4]
call fcn.00430c90
push eax
call fcn.00430cd0
mov edx, 0x4717c6
call fcn.00430cd0
call fcn.00430e42
add dword [esp], edx
call fcn.00428f4a
call fcn.00430e60
push 0
call 0x402c39
call fcn.00430c70
push dword [0x9e55a0]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess
call fcn.0041d922
call fcn.0041e550
call fcn.0041f407
call fcn.004203cf
call fcn.0042784d
call fcn.004288ac
call fcn.00428f86
call fcn.00429520
call fcn.0042a9d2
call fcn.0042c864
call fcn.0042d5c2
call fcn.0042fd50
ret