Function at 0x140001000
Capabilities:
Identify system language via api
Query environment variable

Disassembly:
sub rsp, 0x28
mov r8, 0x8e8
xor rdx, rdx
movabs rcx, 0x140503754
call sub.msvcrt.dll_memset
xor rcx, rcx
call sub.KERNEL32.dll_GetModuleHandleW
mov qword [0x14050375c], rax
xor r8, r8
mov rdx, 0x1000
xor rcx, rcx
call sub.KERNEL32.dll_HeapCreate
mov qword [0x140503754], rax
movabs rax, 0x1400ae608
mov qword [0x1405037e4], rax
call fcn.1400257c4
call fcn.140045130
call fcn.140043f88
call fcn.140043990
call fcn.140041c50
call fcn.14003ee84
call fcn.14003e350
call fcn.14003dbcc
call fcn.14003cc40
call fcn.14003b9e8
call fcn.140039178
call fcn.140038b58
call fcn.1400371d0
call fcn.140036858
call fcn.140035d34
call fcn.1400345b0
call fcn.140031aac
call fcn.14002c1d4
call fcn.140029a1c
call fcn.1400288f8
call fcn.140027c8c
call fcn.140026ddc
call fcn.140026b14
call fcn.140025988
movabs rdx, str.v1.5.5
lea rcx, [0x140503934]
call fcn.1400451a0
push rcx
sub rsp, 0x28
call fcn.140045290
add rsp, 0x28
pop rcx
push rax
movabs rcx, str.W10_Digital_Activation
sub rsp, 0x28
call fcn.1400452e0
add rsp, 0x28
mov rcx, qword [0x140503934]
sub rsp, 0x28
call fcn.1400452e0
add rsp, 0x28
lea rcx, [0x14050382c]
pop rdx
call main
push rcx
sub rsp, 0x28
call fcn.140045290
add rsp, 0x28
pop rcx
push rax
movabs rcx, str.W10_Digital_Activation_x64
sub rsp, 0x28
call fcn.1400452e0
add rsp, 0x28
mov rcx, qword [0x140503934]
sub rsp, 0x28
call fcn.1400452e0
add rsp, 0x28
lea rcx, [0x14050382c]
pop rdx
call main
push rcx
sub rsp, 0x28
call fcn.140045290
add rsp, 0x28
pop rcx
push rax
movabs rcx, str.___________________
sub rsp, 0x28
call fcn.1400452e0
add rsp, 0x28
mov rcx, qword [0x14050382c]
sub rsp, 0x28
call fcn.1400452e0
add rsp, 0x28
movabs rcx, str._____r_n
sub rsp, 0x28
call fcn.1400452e0
add rsp, 0x28
lea rcx, [0x140503954]
pop rdx
call main
call fcn.14002b6cc
movabs rbp, 0x1400ae972
mov rax, rbp
push rax
push 0xffffffffffffffff
pop rcx
pop rdx
call fcn.14003ba0c
mov qword [0x1405037bc], rax
push recv
movabs rax, 0x1400a85a8
push rax
push 0
pop rcx
pop rdx
pop r8
call fcn.140043ffc
push 9
movabs rax, str.Segoe_UI
push rax
push 1
pop rcx
pop rdx
pop r8
call fcn.140043ffc
push rcx
sub rsp, 0x28
call fcn.140045290
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140045290
add rsp, 0x28
pop rcx
push rax
push 0xc8
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140041ff0
add rsp, 0x28
lea rcx, [0x140503a94]
pop rdx
call main
push rcx
sub rsp, 0x28
call fcn.140045290
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140045290
add rsp, 0x28
pop rcx
push rax
push 0xc8
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140041ff0
add rsp, 0x28
lea rcx, [0x140503a9c]
pop rdx
call main
push 0xc8
mov rax, qword [0x140503a94]
mov rax, rax
push rax
movabs rax, str.PROCESSOR_ARCHITECTURE
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0xc8
mov rax, qword [0x140503a9c]
mov rax, rax
push rax
movabs rax, str.PROCESSOR_ARCHITEW6432
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0x64
mov rax, qword [0x140503a64]
mov rax, rax
push rax
movabs rax, str.SYSTEMDRIVE
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_GetEnvironmentVariableW
push qword [0x140503a94]
movabs rcx, str.AMD64
pop rdx
call fcn.140045430
or rax, rax
jne 0x140001363
push qword [0x140503a9c]
movabs rcx, str.AMD64
pop rdx
call fcn.140045430
or rax, rax
jne 0x140001363
jmp 0x14000136c
mov rax, 1
jmp 0x14000136f
xor rax, rax
and rax, rax
nop
nop
movabs rdx, 0x1400ab340
lea rcx, [0x140503a7c]
call fcn.1400451a0
jmp 0x1400013a2
movabs rdx, str.Panic___
lea rcx, [0x14050383c]
call fcn.1400451a0
movabs rdx, 0x1400acc50
lea rcx, [0x1405038bc]
call fcn.1400451a0
push rcx
sub rsp, 0x28
call fcn.140045290
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140045290
add rsp, 0x28
pop rcx
push rax
pop rcx
sub rsp, 0x20
call fcn.140026e24
add rsp, 0x28
lea rcx, [0x14050377c]
pop rdx
call main
mov dword [0x140503aa4], 0
mov dword [0x140503aa8], 0
lea rax, [0x140503aa8]
mov rax, rax
push rax
lea rax, [0x140503aa4]
mov rax, rax
push rax
mov rax, qword [0x14050377c]
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
call sub.imagehlp.dll_MapFileAndCheckSumW
movsxd r15, dword [0x140503aa4]
cmp r15d, dword [0x140503aa8]
jmp 0x14000147a
mov qword [0x140503794], 0
call fcn.14002b6cc
push rcx
sub rsp, 0x28
call fcn.140045290
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140045290
add rsp, 0x28
pop rcx
push rax
push 0x3e8
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140041ff0
add rsp, 0x28
lea rcx, [0x14050376c]
pop rdx
call main
movabs rdx, 0x1400a8028
lea rcx, [0x140503824]
call fcn.1400451a0
push rcx
sub rsp, 0x28
call fcn.140045290
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140045290
add rsp, 0x28
pop rcx
push rax
push 0x3e8
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140041ff0
add rsp, 0x28
lea rcx, [0x14050390c]
pop rdx
call main
push rcx
sub rsp, 0x28
call fcn.140045290
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140045290
add rsp, 0x28
pop rcx
push rax
push 0x3e8
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140041ff0
add rsp, 0x28
lea rcx, [0x1405038ac]
pop rdx
call main
push rcx
sub rsp, 0x28
call fcn.140045290
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140045290
add rsp, 0x28
pop rcx
push rax
push 0x3e8
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140041ff0
add rsp, 0x28
lea rcx, [0x14050393c]
pop rdx
call main
push rcx
sub rsp, 0x28
call fcn.140045290
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140045290
add rsp, 0x28
pop rcx
push rax
push 0x3e8
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140041ff0
add rsp, 0x28
lea rcx, [0x140503924]
pop rdx
call main
push rcx
sub rsp, 0x28
call fcn.140045290
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140045290
add rsp, 0x28
pop rcx
push rax
push 0x3e8
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140041ff0
add rsp, 0x28
lea rcx, [0x14050378c]
pop rdx
call main
movabs rdx, 0x1400a8028
lea rcx, [0x14050384c]
call fcn.1400451a0
movabs rdx, str.HWID
lea rcx, [0x140503944]
call fcn.1400451a0
movabs rdx, str.KMS38
lea rcx, [0x1405038f4]
call fcn.1400451a0
mov qword [0x140503874], 0
push 0x3e8
mov rax, qword [0x14050376c]
mov rax, rax
push rax
movabs rax, str.SYSTEMDRIVE
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0x3e8
mov rax, qword [0x14050390c]
mov rax, rax
push rax
movabs rax, str.TEMP
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0x3e8
mov rax, qword [0x140503924]
mov rax, rax
push rax
movabs rax, str.WINDIR
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0x3e8
mov rax, qword [0x1405038ac]
mov rax, rax
push rax
movabs rax, str.PROCESSOR_ARCHITECTURE
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0x3e8
mov rax, qword [0x14050393c]
mov rax, rax
push rax
movabs rax, str.PROCESSOR_ARCHITEW6432
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0x3e8
mov rax, qword [0x14050390c]
mov rax, rax
push rax
movabs rax, str.TEMP
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0x100
push 1
pop rcx
pop rdx
call fcn.140023651
push qword [0x1405038ac]
movabs rcx, str.AMD64
pop rdx
call fcn.140045430
or rax, rax
jne 0x1400017ac
push qword [0x14050393c]
movabs rcx, str.AMD64
pop rdx
call fcn.140045430
or rax, rax
jne 0x1400017ac
jmp 0x1400017b5
mov rax, 1
jmp 0x1400017b8
xor rax, rax
and rax, rax
je 0x1400017d5
movabs rdx, 0x1400ab340
lea rcx, [0x1405038a4]
call fcn.1400451a0
jmp 0x1400017eb
movabs rdx, 0x1400abf36
lea rcx, [0x1405038a4]
call fcn.1400451a0
push rcx
sub rsp, 0x28
call fcn.140045290
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
mov rcx, qword [0x140503924]
push rcx
sub rsp, 0x28
call fcn.140045290
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.1400452e0
add rsp, 0x28
movabs rcx, str.Temp
sub rsp, 0x28
call fcn.1400452e0
add rsp, 0x28
push rax
call fcn.1400454c0
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
sub rsp, 0x20
call fcn.1400336f8
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140024608
add rsp, 0x28
pop rax
mov r15, rax
cmp r15, 0xfffffffffffffffe
jne 0x1400018b7
mov rcx, qword [0x140503924]
push rcx
sub rsp, 0x28
call fcn.140045290
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.1400452e0
add rsp, 0x28
movabs rcx, str.Temp
sub rsp, 0x28
call fcn.1400452e0
add rsp, 0x28
lea rcx, [0x14050390c]
pop rdx
call main
mov rcx, qword [0x140503924]
push rcx
sub rsp, 0x28
call fcn.140045290
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.1400452e0
add rsp, 0x28
movabs rcx, str.System32
sub rsp, 0x28
call fcn.1400452e0
add rsp, 0x28
lea rcx, [0x14050378c]
pop rdx
call main
push rcx
sub rsp, 0x28
call fcn.140045290
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
mov rcx, qword [0x140503924]
push rcx
sub rsp, 0x28
call fcn.140045290
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.1400452e0
add rsp, 0x28
movabs rcx, str.Sysnativecmd.exe
sub rsp, 0x28
call fcn.1400452e0
add rsp, 0x28
push rax
call fcn.1400454c0
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
sub rsp, 0x20
call fcn.1400336f8
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140024608
add rsp, 0x28
pop rax
mov r15, rax
and r15, r15
jle 0x1400019cc
mov rcx, qword [0x140503924]
push rcx
sub rsp, 0x28
call fcn.140045290
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.1400452e0
add rsp, 0x28
movabs rcx, str.Sysnative
sub rsp, 0x28
call fcn.1400452e0
add rsp, 0x28
lea rcx, [0x140503924]
pop rdx
call main
jmp 0x140001a14
mov rcx, qword [0x140503924]
push rcx
sub rsp, 0x28
call fcn.140045290
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.1400452e0
add rsp, 0x28
movabs rcx, str.System32
sub rsp, 0x28
call fcn.1400452e0
add rsp, 0x28
lea rcx, [0x140503924]
pop rdx
call main
push rcx
sub rsp, 0x28
call fcn.140045290
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.140045290
add rsp, 0x20
pop rcx
push rax
movabs rax, 0x1400a83cc
push rax
movabs rax, str.BuildLab
push rax
movabs rax, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_NTCurrentVersion
push rax
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.14001b6c3
add rsp, 0x28
lea rcx, [0x14050387c]
pop rdx
call main
movabs rax, 0x1400a83cc
push rax
push qword [0x14050387c]
pop rcx
pop rdx
call fcn.140042050
mov qword [0x1405038e4], rax
mov r15, qword [0x1405038e4]
cmp r15, 1
jge 0x140001aa1
jmp 0x140001afe
push rcx
sub rsp, 0x28
call fcn.140045290
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140045290
add rsp, 0x28
pop rcx
push rax
mov r15, qword [0x1405038e4]
dec r15
mov rax, r15
push rax
push 1
push qword [0x14050387c]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.140042220
add rsp, 0x28
lea rcx, [0x14050387c]
pop rdx
call main
push qword [0x14050387c]
pop rcx
call fcn.1400422e0
mov qword [0x140503774], rax
mov r15, qword [0x140503774]
cmp r15, 0x2710
jle 0x140001b3c
movabs rdx, 0x1400a8540
lea rcx, [0x14050392c]
call fcn.1400451a0
jmp 0x140001c5b
mov r15, qword [0x140503774]
cmp r15, 0x2580
jl 0x140001b67
movabs rdx, 0x1400adee0
lea rcx, [0x14050392c]
call fcn.1400451a0
jmp 0x140001c5b
mov r15, qword [0x140503774]
cmp r15, 0x23f0
jl 0x140001b90
mov r15, qword [0x140503774]
cmp r15, 0x2454
jge 0x140001b90
mov rax, 1
jmp 0x140001b93
xor rax, rax
and rax, rax
je 0x140001bb3
movabs rdx, 0x1400a8518
lea rcx, [0x14050392c]
call fcn.1400451a0
jmp 0x140001c5b
mov r15, qword [0x140503774]
cmp r15, 0x1db0
jl 0x140001bdc
mov r15, qword [0x140503774]
cmp r15, 0x1e14
jge 0x140001bdc
mov rax, 1
jmp 0x140001bdf
xor rax, rax
and rax, rax
je 0x140001bfc
movabs rdx, 0x1400a8514
lea rcx, [0x14050392c]
call fcn.1400451a0
jmp 0x140001c5b
mov r15, qword [0x140503774]
cmp r15, 0xa28
jl 0x140001c25
mov r15, qword [0x140503774]
cmp r15, 0xfa0
jge 0x140001c25
mov rax, 1
jmp 0x140001c28
xor rax, rax
and rax, rax
je 0x140001c45
movabs rdx, 0x1400ab348
lea rcx, [0x14050392c]
call fcn.1400451a0
jmp 0x140001c5b
movabs rdx, 0x1400a8514
lea rcx, [0x14050392c]
call fcn.1400451a0
push rcx
sub rsp, 0x28
call fcn.140045290
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140045290
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
sub rsp, 0x20
call sub.KERNEL32.dll_GetUserDefaultLangID
add rsp, 0x28
mov rax, rax
push rax
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140042410
add rsp, 0x28
lea rcx, [0x14050388c]
pop rdx
call main
push qword [0x14050388c]
pop rcx
call fcn.1400425e0
mov r15, rax
cmp r15, 3
jne 0x140001d0d
push rcx
sub rsp, 0x28
call fcn.140045290
add rsp, 0x28
pop rcx
push rax
movabs rcx, 0x1400a840e
sub rsp, 0x28
call fcn.1400452e0
add rsp, 0x28
mov rcx, qword [0x14050388c]
sub rsp, 0x28
call fcn.1400452e0
add rsp, 0x28
lea rcx, [0x14050388c]
pop rdx
call main
push qword [0x14050388c]
movabs rcx, str.0419
pop rdx
call fcn.140045430
or rax, rax
je 0x140001d40
movabs rdx, 0x1400a904a
lea rcx, [0x14050388c]
call fcn.1400451a0
jmp 0x140001d56
movabs rdx, 0x1400aa4b8
lea rcx, [0x14050388c]
call fcn.1400451a0
mov qword [0x14050395c], 0
mov qword [0x140503964], 0
push rcx
sub rsp, 0x28
call fcn.140045290
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.140045290
add rsp, 0x20
pop rcx
push rax
movabs rax, 0x1400a83cc
push rax
movabs rax, 0x1400ad7be
push rax
movabs rax, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_NTCurrentVersion
push rax
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.14001b6c3
add rsp, 0x28
lea rcx, [0x14050380c]
pop rdx
call main
movabs rax, str.2015
push rax
push qword [0x14050380c]
pop rcx
pop rdx
call fcn.140042050
mov r15, rax
and r15, r15
jle 0x140001df8
mov qword [0x14050395c], 1
jmp 0x140001e23
movabs rax, str.LTSC
push rax
push qword [0x14050380c]
pop rcx
pop rdx
call fcn.140042050
mov r15, rax
and r15, r15
jle 0x140001e23
mov qword [0x140503964], 1
mov qword [0x140503904], 0
push rcx
sub rsp, 0x28
call fcn.140045290
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.140045290
add rsp, 0x20
pop rcx
push rax
movabs rax, 0x1400a83cc
push rax
movabs rax, str.EditionID
push rax
movabs rax, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_NTCurrentVersion
push rax
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.14001b6c3
add rsp, 0x28
lea rcx, [0x140503814]
pop rdx
call main
push rcx
sub rsp, 0x28
call fcn.140045290
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.140045290
add rsp, 0x20
pop rcx
push rax
movabs rax, 0x1400a83cc
push rax
movabs rax, str.CurrentBuild
push rax
movabs rax, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_NTCurrentVersion
push rax
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.14001b6c3
add rsp, 0x28
lea rcx, [0x14050385c]
pop rdx
call main
mov qword [0x1405037dc], 0
call fcn.14002701c
mov r15, rax
dec r15
mov qword [0x1405037c4], r15
mov r15, qword [0x1405037c4]
and r15, r15
jl 0x140002029
mov qword [0x140503894], 0
jmp 0x140001f26
mov rax, qword [0x1405037c4]
cmp rax, qword [0x140503894]
jl 0x140002029
push rcx
sub rsp, 0x28
call fcn.140045290
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140045290
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.140045290
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.140045290
add rsp, 0x28
pop rcx
push rax
push qword [0x140503894]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.1400270b0
add rsp, 0x20
push rax
call fcn.1400454c0
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140042600
add rsp, 0x28
lea rcx, [0x1405038b4]
pop rdx
call main
push qword [0x1405038b4]
movabs rdx, str._ACTIVATE
mov rcx, qword [rsp]
sub rsp, 0x28
call fcn.140045430
add rsp, 0x28
or rax, rax
je 0x140001ff0
mov qword [0x1405037dc], 1
jmp 0x14000201b
movabs rdx, str._KMS38
mov rcx, qword [rsp]
sub rsp, 0x28
call fcn.140045430
add rsp, 0x28
or rax, rax
je 0x14000201b
mov qword [0x140503874], 1
pop rax
inc qword [0x140503894]
jno 0x140001f26
push qword [0x140503814]
pop rcx
call fcn.14000a535
push qword [0x14050392c]
pop rcx
call fcn.1400422e0
mov r15, rax
cmp r15, 0xa
jl 0x140002058
mov r15, qword [0x140503904]
and r15, r15
je 0x140002058
jmp 0x140002061
mov rax, 1
jmp 0x140002064
xor rax, rax
and rax, rax
je 0x1400020aa
movabs rdx, str.The_program_supports_activation_of_the_following_editions:_r_n_r_nWindows_10_11_Core_r_nWindows_10_11_Core_N_r_nWindows_10_11_CoreSingleLanguage_r_nWindows_10_11_CoreSingleLanguage_N_r_nWindows_10_11_Professional_r_nWindows_10_11_Professional_N_r_nWindows_10_11_ProfessionalEducation_r_nWindows_10_11_ProfessionalEducation_N_r_nWindows_10_11_ProfessionalWorkstation_r_nWindows_10_11_ProfessionalWorkstation_N_r_nWindows_10_11_Education_r_nWindows_10_11_Education_N_r_nWindows_10_11_Enterprise_r_nWindows_10_11_Enterprise_N_r_nWindows_10_Enterprise_LTSB_r_nWindows_10_Enterprise_LTSB_N_r_nWindows_10_Enterprise_LTSC_r_nWindows_10_11_IoT_Enterprise_r_nWindows_11_IoT_EnterpriseK_r_nWindows_10_IoT_Enterprise_LTSC
lea rcx, [0x140503854]
call fcn.1400451a0
mov r15, qword [0x1405037dc]
and r15, r15
jne 0x1400020aa
push reloc.WS2_32.dll_recv
push qword [0x140503854]
movabs rax, 0x1400a8028
push rax
pop rcx
pop rdx
pop r8
call fcn.140026b58
mov qword [0x1405038d4], 0
mov qword [0x140503784], 0
mov qword [0x1405037d4], 0
push rcx
sub rsp, 0x28
call fcn.140045290
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.140045290
add rsp, 0x20
pop rcx
push rax
movabs rax, 0x1400a83cc
push rax
movabs rax, str.AppsUseLightTheme
push rax
movabs rax, str.HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionThemesPersonalize
push rax
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.14001b6c3
add rsp, 0x28
lea rcx, [0x1405038fc]
pop rdx
call main
push qword [0x1405038fc]
movabs rcx, 0x1400a840e
pop rdx
call fcn.140045430
or rax, rax
je 0x14000215b
mov qword [0x140503784], 1
mov qword [0x1405037d4], 1
push 0
push 0
push 0
pop rcx
pop rdx
pop r8
call fcn.140039190
mov qword [0x14050391c], rax
push 0xff
push 0xff
push 0xff
pop rcx
pop rdx
pop r8
call fcn.140039190
mov qword [0x140503864], rax
push 0x20
push 0x20
push 0x20
pop rcx
pop rdx
pop r8
call fcn.140039190
mov qword [0x1405037ac], rax
mov qword [0x1405038ec], 1
push 0x808080
push 1
push 0
pop rcx
pop rdx
pop r8
call sub.GDI32.dll_CreatePen
mov qword [0x140503834], rax
push 0xcc872c
push 1
push 0
pop rcx
pop rdx
pop r8
call sub.GDI32.dll_CreatePen
mov qword [0x1405038cc], rax
mov r9, 7
xor r8, r8
lea rdx, [0x140503f4c]
mov rcx, 0x3b
call fcn.14003cc6c
mov rcx, 0x200
sub rsp, 8
push rcx
lea r9, [0x14050401c]
xor r8, r8
mov rdx, 7
mov rcx, 0x59
sub rsp, 0x20
call fcn.140036884
add rsp, 0x28
add rsp, 8
mov rcx, 0x200
sub rsp, 8
push rcx
lea r9, [0x140504024]
xor r8, r8
mov rdx, SafeArrayPutElement
mov rcx, 8
sub rsp, 0x20
call fcn.140036884
add rsp, 0x28
add rsp, 8
mov rcx, 0x200
sub rsp, 8
push rcx
lea r9, [0x14050402c]
xor r8, r8
mov rdx, SafeArrayPutElement
mov rcx, 8
sub rsp, 0x20
call fcn.140036884
add rsp, 0x28
add rsp, 8
mov rcx, 0x200
sub rsp, 8
push rcx
lea r9, [0x140504034]
xor r8, r8
mov rdx, SafeArrayPutElement
mov rcx, 8
sub rsp, 0x20
call fcn.140036884
add rsp, 0x28
add rsp, 8
mov qword [0x140503f1c], 2
mov qword [0x140503f24], 1
sub rsp, 0x18
movabs rax, 0x140503f14
push rax
xor r9, r9
mov r8, SafeArrayPutElement
mov rdx, 8
mov rcx, 2
sub rsp, 0x20
call fcn.140038c70
add rsp, 0x40
mov qword [0x140503f14], rax
mov r9, SafeArrayPutElement
xor r8, r8
lea rdx, [0x140503f5c]
mov rcx, 8
call fcn.14003cc6c
movabs rbp, 0x1404f39e6
mov rax, rbp
push rax
push 0xffffffffffffffff
pop rcx
pop rdx
call fcn.14003ba0c
mov qword [0x140503794], rax
push qword [0x140503794]
pop rcx
call fcn.140009223
push qword [0x1405037bc]
pop rcx
call fcn.140009223
mov r15, qword [0x1405037dc]
and r15, r15
jle 0x1400023b5
push 0
pop rcx
call fcn.1400055d0
jmp 0x1400028aa
push rcx
sub rsp, 0x28
call fcn.140045290
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.140045290
add rsp, 0x20
pop rcx
push rax
sub rsp, 0x20
call fcn.140009413
add rsp, 0x28
lea rcx, [0x140503844]
pop rdx
call main
push rcx
sub rsp, 0x28
call fcn.140045290
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140045290
add rsp, 0x28
pop rcx
push rax
push qword [0x140503844]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140033874
add rsp, 0x28
lea rcx, [0x1405037cc]
pop rdx
call main
push rcx
sub rsp, 0x28
call fcn.140045290
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
movabs rax, str.tool
push rax
push rcx
sub rsp, 0x20
call fcn.140045290
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.140045290
add rsp, 0x28
pop rcx
push rax
push qword [0x1405037cc]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140042690
add rsp, 0x20
push rax
call fcn.1400454c0
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140042050
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140024608
add rsp, 0x28
pop rax
mov r15, rax
and r15, r15
jne 0x1400024e2
push qword [0x1405037cc]
movabs rcx, 0x1400a8028
pop rdx
call fcn.140045430
or rax, rax
jne 0x1400024e2
mov rax, 1
jmp 0x1400024e5
xor rax, rax
and rax, rax
jmp 0x1400024ef
push rcx
sub rsp, 0x28
call fcn.140045290
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
movabs rax, str.tool
push rax
push rcx
sub rsp, 0x20
call fcn.140045290
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.140045290
add rsp, 0x28
pop rcx
push rax
push qword [0x1405037cc]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140042690
add rsp, 0x20
push rax
call fcn.1400454c0
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140042050
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140024608
add rsp, 0x28
pop rax
mov r15, rax
and r15, r15
jle 0x140002599
push qword [0x140503844]
pop rcx
call fcn.1400336f8
mov r15, rax
cmp r15, 0x1c9c380
jge 0x140002599
mov rax, 1
jmp 0x14000259c
xor rax, rax
and rax, rax
je 0x1400025a6
jmp 0x1400028aa
push 0xa0
push 0x1e0
push 0
push 0
pop rcx
pop rdx
pop r8
pop r9
call fcn.14000292a
push qword [0x14050382c]
push qword [0x1405038dc]
pop rcx
pop rdx
call fcn.140031b74
push qword [0x14050388c]
movabs rcx, 0x1400a904a
pop rdx
call fcn.140045430
or rax, rax
je 0x140002625
movabs rax, reloc.WS2_32.dll_recv
push rax
push qword [0x14050381c]
pop rcx
pop rdx
call fcn.14002c2a8
movabs rax, 0x1400ac700
push rax
push qword [0x1405037f4]
pop rcx
pop rdx
call fcn.14002c2a8
jmp 0x14000263d
movabs rax, str.Go_to_the_program_support_forum
push rax
push qword [0x1405037f4]
pop rcx
pop rdx
call fcn.14002c2a8
push qword [0x1405038dc]
pop rcx
call fcn.140031ba8
mov rax, rax
push rax
pop rcx
call fcn.1400391dc
and rax, rax
je 0x140002700
push 1
pop rcx
call fcn.140044134
mov rax, rax
push rax
pop rcx
call fcn.140039260
push rcx
sub rsp, 0x28
call fcn.140045290
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140045290
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140045290
add rsp, 0x28
pop rcx
push rax
push qword [0x1405037f4]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14002c30c
add rsp, 0x28
push rax
call fcn.1400454c0
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
sub rsp, 0x20
call fcn.140039284
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140024608
add rsp, 0x28
pop rax
mov rax, rax
push rax
pop rcx
call fcn.140037258
mov qword [0x140503884], rax
call fcn.1400392e0
sub rsp, 8
push 0xffffffffffff0001
push qword [0x140503884]
push 0xffffffffffff0001
push qword [0x1405038dc]
pop rcx
sub rsp, 0x20
call fcn.140031c80
add rsp, 0x20
mov r15, rax
sub r15, qword [0x140503884]
mov rax, r15
mov rcx, 2
cqo
idiv rcx
mov r15, rax
mov rax, r15
push rax
push qword [0x1405037f4]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14002c53c
add rsp, 0x30
push qword [0x140503944]
push 0xffffffffffffffff
push qword [0x1405037ec]
pop rcx
pop rdx
pop r8
call fcn.14002c5b0
push qword [0x1405038f4]
push 0xffffffffffffffff
push qword [0x1405037ec]
pop rcx
pop rdx
pop r8
call fcn.14002c5b0
mov r15, qword [0x140503874]
and r15, r15
jle 0x1400027b5
push 1
push qword [0x1405037ec]
pop rcx
pop rdx
call fcn.14002c64c
jmp 0x1400027c7
push 0
push qword [0x1405037ec]
pop rcx
pop rdx
call fcn.14002c64c
call fcn.14000c2e5
call fcn.14003171c
mov r15, rax
cmp r15, 0x6e
jl 0x1400027ef
mov r15, qword [0x1405037d4]
and r15, r15
jle 0x1400027ef
mov rax, 1
jmp 0x1400027f2
xor rax, rax
and rax, rax
je 0x14000280e
call fcn.14001294e
push 1
push qword [0x1405038dc]
pop rcx
pop rdx
call fcn.140010820
push 0
push qword [0x1405038dc]
pop rcx
pop rdx
call fcn.140031cd8
call fcn.140031de0
mov qword [0x14050389c], rax
cmp qword [0x14050389c], 0
je 0x14000288b
call fcn.140035ef4
mov rax, rax
push rax
mov r15, qword [0x1405038dc]
cmp r15, qword [rsp]
jne 0x140002866
sub rsp, 8
push qword [0x14050389c]
pop rcx
sub rsp, 0x20
call fcn.14000c45d
add rsp, 0x28
jmp 0x140002888
mov qword [0x14050389c], 0
sub rsp, 8
push 5
pop rcx
sub rsp, 0x20
call fcn.140031918
add rsp, 0x28
pop rax
jmp 0x140002896
push 5
pop rcx
call fcn.140031918
mov r15, qword [0x14050389c]
cmp r15, 0x333c
jne 0x140002820
call 0x1400028cc
call fcn.140045170
mov rcx, qword [0x140503754]
call sub.KERNEL32.dll_HeapDestroy
mov rcx, qword [0x140503764]
call sub.KERNEL32.dll_ExitProcess
sub rsp, 0x28
call fcn.140025938
call fcn.140025ec0
call fcn.140027c70
call fcn.1400288b8
call fcn.140029a10
call fcn.14002c170
call fcn.140031a7c
call fcn.140033980
call fcn.1400345a0
call fcn.140035d08
call fcn.1400371cc
call fcn.14003b9dc
call fcn.14003dbc8
call fcn.140041c80
call fcn.1400441a8
call fcn.140044208
call fcn.140043980
add rsp, 0x28
ret