Function at 0x421e60
Capabilities:
Allocate thread local storage
Identify system language via api
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleHandleW
sub esp, 4
mov dword [0x8dfe48], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0x1000
mov dword [esp], 0
call sub.KERNEL32.dll_HeapCreate
sub esp, 0xc
mov dword [0x8dfe44], eax
mov dword [0x8dfe4c], 0x46d020
call fcn.0043ae00
call fcn.0043a860
call fcn.0043978d
call fcn.00437980
call fcn.00434104
call fcn.00433890
call fcn.00432e77
call fcn.00431de1
call fcn.00430e77
call fcn.0042f8fd
call fcn.0042ecc9
call fcn.0042e101
call fcn.0042dc6f
call fcn.0042d388
call fcn.0042c5e0
call fcn.0042a859
call fcn.00428e2f
call fcn.00426043
call fcn.00425e54
call fcn.00425aa7
call fcn.0042589f
call fcn.00424f5d
call fcn.004241f7
mov dword [esp + 4], str.v1.5.2
mov dword [esp], 0x8dff40
call fcn.0043ad10
sub esp, 8
call fcn.0043a9b0
mov dword [esp], str.Windows_10
call fcn.0043ac10
sub esp, 4
mov eax, dword [0x8dff40]
mov dword [esp], eax
call fcn.0043ac10
sub esp, 4
call fcn.0043aa00
mov dword [esp + 4], eax
mov dword [esp], 0x8dfeb8
call fcn.0043ab80
sub esp, 8
call fcn.0043a9b0
mov dword [esp], str.___________________
call fcn.0043ac10
sub esp, 4
mov eax, dword [0x8dfeb8]
mov dword [esp], eax
call fcn.0043ac10
sub esp, 4
mov dword [esp], str._____r_n
call fcn.0043ac10
sub esp, 4
call fcn.0043aa00
mov dword [esp + 4], eax
mov dword [esp], 0x8dff4c
call fcn.0043ab80
sub esp, 8
call fcn.004264c2
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], 0x46d38a
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov dword [esp], 0xffffffff
call fcn.00431660
sub esp, 8
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [0x8dfe88], eax
mov dword [esp + 8], 0xc
mov dword [esp + 4], str.Microsoft_Sans_Serif
mov dword [esp], 0
call fcn.004398a3
sub esp, 0xc
mov dword [ebp - 0x34], eax
mov dword [esp + 8], 9
mov dword [esp + 4], str.Segoe_UI
mov dword [esp], 1
call fcn.004398a3
sub esp, 0xc
mov dword [ebp - 0x38], eax
call fcn.0043a9b0
call fcn.0043a9b0
call fcn.0043aa00
mov dword [esp + 4], eax
mov dword [esp], 0xc8
call fcn.00438990
sub esp, 8
call fcn.0043aa00
mov dword [esp + 4], eax
mov dword [esp], 0x8e03f4
call fcn.0043ab80
sub esp, 8
call fcn.0043a9b0
call fcn.0043a9b0
call fcn.0043aa00
mov dword [esp + 4], eax
mov dword [esp], 0xc8
call fcn.00438990
sub esp, 8
call fcn.0043aa00
mov dword [esp + 4], eax
mov dword [esp], 0x8e03f8
call fcn.0043ab80
sub esp, 8
mov eax, dword [0x8e03f4]
mov dword [ebp - 0x3c], eax
mov edx, str.PROCESSOR_ARCHITECTURE
mov dword [esp + 8], 0xc8
mov eax, dword [ebp - 0x3c]
mov dword [esp + 4], eax
mov dword [esp], edx
call sub.KERNEL32.dll_GetEnvironmentVariableW
sub esp, 0xc
mov dword [ebp - 0x40], eax
mov eax, dword [0x8e03f8]
mov dword [ebp - 0x44], eax
mov edx, str.PROCESSOR_ARCHITEW6432
mov dword [esp + 8], 0xc8
mov eax, dword [ebp - 0x44]
mov dword [esp + 4], eax
mov dword [esp], edx
call sub.KERNEL32.dll_GetEnvironmentVariableW
sub esp, 0xc
mov dword [ebp - 0x48], eax
mov eax, dword [0x8e03dc]
mov dword [ebp - 0x4c], eax
mov edx, str.SYSTEMDRIVE
mov dword [esp + 8], 0x64
mov eax, dword [ebp - 0x4c]
mov dword [esp + 4], eax
mov dword [esp], edx
call sub.KERNEL32.dll_GetEnvironmentVariableW
sub esp, 0xc
mov dword [ebp - 0x50], eax
mov eax, dword [0x8e03f4]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x58], str.AMD64
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x54]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x58]
mov dword [esp], eax
call fcn.0043aca0
test eax, eax
jne 0x422175
mov eax, dword [0x8e03f8]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x60], str.AMD64
mov eax, dword [ebp - 0x5c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x60]
mov dword [esp], eax
call fcn.0043aca0
test eax, eax
je 0x42217f
jmp 0x422176
nop
mov dword [ebp - 0xc], 1
jmp 0x422180
nop
cmp dword [ebp - 0xc], 0
je 0x42219f
mov dword [esp + 4], 0x8d99c0
mov dword [esp], 0x8e03e8
call fcn.0043ad10
sub esp, 8
jmp 0x4221b7
nop
mov dword [esp + 4], 0x8da808
mov dword [esp], 0x8e03e8
call fcn.0043ad10
sub esp, 8
mov dword [0x8dfe78], 0
call fcn.004264c2
mov dword [ebp - 0x64], eax
mov dword [esp + 4], 0x8e0420
mov dword [esp], 0x8dfeb4
call fcn.0043ad10
sub esp, 8
call fcn.0043a9b0
call fcn.0043a9b0
call fcn.0043aa00
mov dword [esp + 4], eax
mov dword [esp], 0x3e8
call fcn.00438990
sub esp, 8
call fcn.0043aa00
mov dword [esp + 4], eax
mov dword [esp], 0x8dff1c
call fcn.0043ab80
sub esp, 8
call fcn.0043a9b0
call fcn.0043a9b0
call fcn.0043aa00
mov dword [esp + 4], eax
mov dword [esp], 0x3e8
call fcn.00438990
sub esp, 8
call fcn.0043aa00
mov dword [esp + 4], eax
mov dword [esp], 0x8dfef0
call fcn.0043ab80
sub esp, 8
call fcn.0043a9b0
call fcn.0043a9b0
call fcn.0043aa00
mov dword [esp + 4], eax
mov dword [esp], 0x3e8
call fcn.00438990
sub esp, 8
call fcn.0043aa00
mov dword [esp + 4], eax
mov dword [esp], 0x8dff44
call fcn.0043ab80
sub esp, 8
call fcn.0043a9b0
call fcn.0043a9b0
call fcn.0043aa00
mov dword [esp + 4], eax
mov dword [esp], 0x3e8
call fcn.00438990
sub esp, 8
call fcn.0043aa00
mov dword [esp + 4], eax
mov dword [esp], 0x8dff28
call fcn.0043ab80
sub esp, 8
call fcn.0043a9b0
call fcn.0043a9b0
call fcn.0043aa00
mov dword [esp + 4], eax
mov dword [esp], 0x3e8
call fcn.00438990
sub esp, 8
call fcn.0043aa00
mov dword [esp + 4], eax
mov dword [esp], 0x8dfe74
call fcn.0043ab80
sub esp, 8
mov dword [esp + 4], 0x8e0420
mov dword [esp], 0x8dfec0
call fcn.0043ad10
sub esp, 8
mov dword [esp + 4], str.HWID
mov dword [esp], 0x8dff48
call fcn.0043ad10
sub esp, 8
mov dword [esp + 4], str.KMS38
mov dword [esp], 0x8dff10
call fcn.0043ad10
sub esp, 8
mov dword [0x8dfed4], 0
mov eax, dword [0x8dff1c]
mov dword [ebp - 0x68], eax
mov edx, str.TEMP
mov dword [esp + 8], 0x3e8
mov eax, dword [ebp - 0x68]
mov dword [esp + 4], eax
mov dword [esp], edx
call sub.KERNEL32.dll_GetEnvironmentVariableW
sub esp, 0xc
mov dword [ebp - 0x6c], eax
mov eax, dword [0x8dff28]
mov dword [ebp - 0x70], eax
mov edx, str.WINDIR
mov dword [esp + 8], 0x3e8
mov eax, dword [ebp - 0x70]
mov dword [esp + 4], eax
mov dword [esp], edx
call sub.KERNEL32.dll_GetEnvironmentVariableW
sub esp, 0xc
mov dword [ebp - 0x74], eax
mov eax, dword [0x8dfef0]
mov dword [ebp - 0x78], eax
mov edx, str.PROCESSOR_ARCHITECTURE
mov dword [esp + 8], 0x3e8
mov eax, dword [ebp - 0x78]
mov dword [esp + 4], eax
mov dword [esp], edx
call sub.KERNEL32.dll_GetEnvironmentVariableW
sub esp, 0xc
mov dword [ebp - 0x7c], eax
mov eax, dword [0x8dff44]
mov dword [ebp - 0x80], eax
mov edx, str.PROCESSOR_ARCHITEW6432
mov dword [esp + 8], 0x3e8
mov eax, dword [ebp - 0x80]
mov dword [esp + 4], eax
mov dword [esp], edx
call sub.KERNEL32.dll_GetEnvironmentVariableW
sub esp, 0xc
mov dword [ebp - 0x84], eax
mov eax, dword [0x8dff1c]
mov dword [ebp - 0x88], eax
mov edx, str.TEMP
mov dword [esp + 8], 0x3e8
mov eax, dword [ebp - 0x88]
mov dword [esp + 4], eax
mov dword [esp], edx
call sub.KERNEL32.dll_GetEnvironmentVariableW
sub esp, 0xc
mov dword [ebp - 0x8c], eax
mov dword [esp + 4], 0x100
mov dword [esp], 1
call fcn.00420cb9
sub esp, 8
mov dword [ebp - 0x90], eax
mov eax, dword [0x8dfef0]
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x98], str.AMD64
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x94]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x98]
mov dword [esp], eax
call fcn.0043aca0
test eax, eax
jne 0x4224b7
mov eax, dword [0x8dff44]
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0xa0], str.AMD64
mov eax, dword [ebp - 0x9c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xa0]
mov dword [esp], eax
call fcn.0043aca0
test eax, eax
je 0x4224c1
jmp 0x4224b8
nop
mov dword [ebp - 0x10], 1
jmp 0x4224c2
nop
cmp dword [ebp - 0x10], 0
je 0x4224e1
mov dword [esp + 4], 0x8d99c0
mov dword [esp], 0x8dfeec
call fcn.0043ad10
sub esp, 8
jmp 0x4224f9
nop
mov dword [esp + 4], 0x8da808
mov dword [esp], 0x8dfeec
call fcn.0043ad10
sub esp, 8
call fcn.0043a9b0
call fcn.0043a9b0
mov eax, dword [0x8dff28]
mov dword [esp], eax
call fcn.0043ac10
sub esp, 4
mov dword [esp], str.Temp
call fcn.0043ac10
sub esp, 4
call fcn.0043ab00
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0xa4]
mov dword [esp], eax
call fcn.0042bc44
sub esp, 4
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xac], edx
call fcn.0043aa60
mov eax, dword [ebp - 0xb0]
mov edx, dword [ebp - 0xac]
xor eax, 0xfffffffe
not edx
or eax, edx
test eax, eax
jne 0x4225a4
call fcn.0043a9b0
mov eax, dword [0x8dff28]
mov dword [esp], eax
call fcn.0043ac10
sub esp, 4
mov dword [esp], str.Temp
call fcn.0043ac10
sub esp, 4
call fcn.0043aa00
mov dword [esp + 4], eax
mov dword [esp], 0x8dff1c
call fcn.0043ab80
sub esp, 8
jmp 0x4225a5
nop
call fcn.0043a9b0
mov eax, dword [0x8dff28]
mov dword [esp], eax
call fcn.0043ac10
sub esp, 4
mov dword [esp], str.System32
call fcn.0043ac10
sub esp, 4
call fcn.0043aa00
mov dword [esp + 4], eax
mov dword [esp], 0x8dfe74
call fcn.0043ab80
sub esp, 8
call fcn.0043a9b0
call fcn.0043a9b0
mov eax, dword [0x8dff28]
mov dword [esp], eax
call fcn.0043ac10
sub esp, 4
mov dword [esp], str.Sysnativecmd.exe
call fcn.0043ac10
sub esp, 4
call fcn.0043ab00
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0xb4]
mov dword [esp], eax
call fcn.0042bc44
sub esp, 4
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0xbc], edx
call fcn.0043aa60
mov edx, 0
mov eax, 0
cmp edx, dword [ebp - 0xc0]
sbb eax, dword [ebp - 0xbc]
jge 0x42268d
call fcn.0043a9b0
mov eax, dword [0x8dff28]
mov dword [esp], eax
call fcn.0043ac10
sub esp, 4
mov dword [esp], str.Sysnative
call fcn.0043ac10
sub esp, 4
call fcn.0043aa00
mov dword [esp + 4], eax
mov dword [esp], 0x8dff28
call fcn.0043ab80
sub esp, 8
jmp 0x4226ca
nop
call fcn.0043a9b0
mov eax, dword [0x8dff28]
mov dword [esp], eax
call fcn.0043ac10
sub esp, 4
mov dword [esp], str.System32
call fcn.0043ac10
sub esp, 4
call fcn.0043aa00
mov dword [esp + 4], eax
mov dword [esp], 0x8dff28
call fcn.0043ab80
sub esp, 8
call fcn.0043a9b0
call fcn.0043a9b0
call fcn.0043aa00
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x8d646c
mov dword [esp + 4], str.BuildLab
mov dword [esp], str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_NTCurrentVersion
call fcn.004189c2
sub esp, 0x10
mov dword [ebp - 0xc4], eax
call fcn.0043aa00
mov dword [esp + 4], eax
mov dword [esp], 0x8dfed8
call fcn.0043ab80
sub esp, 8
mov eax, dword [0x8dfed8]
mov dword [esp + 4], 0x8d646c
mov dword [esp], eax
call fcn.00438aa0
sub esp, 8
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0xc8]
mov dword [0x8dff08], eax
mov eax, dword [0x8dff08]
test eax, eax
jle 0x4227ab
nop
call fcn.0043a9b0
call fcn.0043a9b0
mov eax, dword [0x8dff08]
sub eax, 1
mov dword [ebp - 0xcc], eax
call fcn.0043aa00
mov edx, dword [0x8dfed8]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0xcc]
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], edx
call fcn.00438af0
sub esp, 0x10
call fcn.0043aa00
mov dword [esp + 4], eax
mov dword [esp], 0x8dfed8
call fcn.0043ab80
sub esp, 8
jmp 0x4227ac
nop
mov eax, dword [0x8dfed8]
mov dword [esp], eax
call fcn.00438850
sub esp, 4
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xd4], edx
mov eax, dword [ebp - 0xd8]
mov dword [0x8dfe6c], eax
mov eax, dword [0x8dfe6c]
cmp eax, 0x2710
jle 0x4227fb
mov dword [esp + 4], 0x8d6634
mov dword [esp], 0x8dff3c
call fcn.0043ad10
sub esp, 8
jmp 0x42292a
nop
mov eax, dword [0x8dfe6c]
cmp eax, 0x257f
jle 0x422825
nop
mov dword [esp + 4], 0x8dca0c
mov dword [esp], 0x8dff3c
call fcn.0043ad10
sub esp, 8
jmp 0x42292a
nop
mov dword [ebp - 0x14], 0
mov eax, dword [0x8dfe6c]
cmp eax, 0x23ef
jle 0x42284f
mov eax, dword [0x8dfe6c]
cmp eax, 0x2453
jg 0x422852
nop
mov dword [ebp - 0x14], 1
jmp 0x422853
nop
jmp 0x422853
nop
cmp dword [ebp - 0x14], 0
je 0x422876
nop
mov dword [esp + 4], 0x8d660c
mov dword [esp], 0x8dff3c
call fcn.0043ad10
sub esp, 8
jmp 0x42292a
nop
mov dword [ebp - 0x18], 0
mov eax, dword [0x8dfe6c]
cmp eax, 0x1daf
jle 0x4228a0
mov eax, dword [0x8dfe6c]
cmp eax, 0x1e13
jg 0x4228a3
nop
mov dword [ebp - 0x18], 1
jmp 0x4228a4
nop
jmp 0x4228a4
nop
cmp dword [ebp - 0x18], 0
je 0x4228c4
nop
mov dword [esp + 4], 0x8d6608
mov dword [esp], 0x8dff3c
call fcn.0043ad10
sub esp, 8
jmp 0x42292a
nop
mov dword [ebp - 0x1c], 0
mov eax, dword [0x8dfe6c]
cmp eax, 0xa27
jle 0x4228ee
mov eax, dword [0x8dfe6c]
cmp eax, 0xf9f
jg 0x4228f1
nop
mov dword [ebp - 0x1c], 1
jmp 0x4228f2
nop
jmp 0x4228f2
nop
cmp dword [ebp - 0x1c], 0
je 0x422912
nop
mov dword [esp + 4], 0x8d99c8
mov dword [esp], 0x8dff3c
call fcn.0043ad10
sub esp, 8
jmp 0x42292a
nop
mov dword [esp + 4], 0x8d6608
mov dword [esp], 0x8dff3c
call fcn.0043ad10
sub esp, 8
call fcn.0043a9b0
call fcn.0043a9b0
call sub.KERNEL32.dll_GetUserDefaultLangID
mov dword [ebp - 0xdc], eax
call fcn.0043aa00
mov ecx, eax
mov eax, dword [ebp - 0xdc]
cdq
mov dword [esp + 8], ecx
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.004392a0
sub esp, 0xc
call fcn.0043aa00
mov dword [esp + 4], eax
mov dword [esp], 0x8dfee0
call fcn.0043ab80
sub esp, 8
mov eax, dword [0x8dfee0]
mov dword [esp], eax
call fcn.00438ac0
sub esp, 4
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 3
jne 0x4229d5
call fcn.0043a9b0
mov dword [esp], 0x8d64b4
call fcn.0043ac10
sub esp, 4
mov eax, dword [0x8dfee0]
mov dword [esp], eax
call fcn.0043ac10
sub esp, 4
call fcn.0043aa00
mov dword [esp + 4], eax
mov dword [esp], 0x8dfee0
call fcn.0043ab80
sub esp, 8
jmp 0x4229d6
nop
mov eax, dword [0x8dfee0]
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0xe8], str.0419
mov eax, dword [ebp - 0xe4]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xe8]
mov dword [esp], eax
call fcn.0043aca0
test eax, eax
je 0x422a20
mov dword [esp + 4], 0x8d6d54
mov dword [esp], 0x8dfee0
call fcn.0043ad10
sub esp, 8
jmp 0x422a38
nop
mov dword [esp + 4], 0x8d843c
mov dword [esp], 0x8dfee0
call fcn.0043ad10
sub esp, 8
mov dword [0x8dff50], 0
mov dword [0x8dff54], 0
call fcn.0043a9b0
call fcn.0043a9b0
call fcn.0043aa00
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x8d646c
mov dword [esp + 4], str.ProductName
mov dword [esp], str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_NTCurrentVersion
call fcn.004189c2
sub esp, 0x10
mov dword [ebp - 0xec], eax
call fcn.0043aa00
mov dword [esp + 4], eax
mov dword [esp], 0x8dfea8
call fcn.0043ab80
sub esp, 8
mov eax, dword [0x8dfea8]
mov dword [esp + 4], str.2015
mov dword [esp], eax
call fcn.00438aa0
sub esp, 8
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0
jle 0x422acf
mov dword [0x8dff50], 1
jmp 0x422b05
nop
mov eax, dword [0x8dfea8]
mov dword [esp + 4], str.LTSC
mov dword [esp], eax
call fcn.00438aa0
sub esp, 8
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0
jle 0x422b04
nop
mov dword [0x8dff54], 1
jmp 0x422b05
nop
mov dword [0x8dff18], 0
call fcn.0043a9b0
call fcn.0043a9b0
call fcn.0043aa00
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x8d646c
mov dword [esp + 4], str.EditionID
mov dword [esp], str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_NTCurrentVersion
call fcn.004189c2
sub esp, 0x10
mov dword [ebp - 0xf8], eax
call fcn.0043aa00
mov dword [esp + 4], eax
mov dword [esp], 0x8dfeac
call fcn.0043ab80
sub esp, 8
call fcn.0043a9b0
call fcn.0043a9b0
call fcn.0043aa00
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x8d646c
mov dword [esp + 4], str.CurrentBuild
mov dword [esp], str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_NTCurrentVersion
call fcn.004189c2
sub esp, 0x10
mov dword [ebp - 0xfc], eax
call fcn.0043aa00
mov dword [esp + 4], eax
mov dword [esp], 0x8dfec8
call fcn.0043ab80
sub esp, 8
mov dword [0x8dfe94], 0
call fcn.00425a33
mov dword [ebp - 0x100], eax
mov eax, dword [ebp - 0x100]
sub eax, 1
mov dword [0x8dfe8c], eax
mov eax, dword [0x8dfe8c]
test eax, eax
js 0x422cfb
mov dword [0x8dfee4], 0
mov edx, dword [0x8dfe8c]
mov eax, dword [0x8dfee4]
cmp edx, eax
jl 0x422cfe
call fcn.0043a9b0
call fcn.0043a9b0
call fcn.0043a9b0
call fcn.0043a9b0
call fcn.0043aa00
mov edx, dword [0x8dfee4]
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.00425a47
sub esp, 8
call fcn.0043ab00
mov dword [ebp - 0x104], eax
call fcn.0043aa00
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x104]
mov dword [esp], eax
call fcn.004383d0
sub esp, 8
call fcn.0043aa00
mov dword [esp + 4], eax
mov dword [esp], 0x8dfef4
call fcn.0043ab80
sub esp, 8
mov dword [ebp - 0x1e4], 0
mov eax, dword [0x8dfef4]
mov dword [esp + 4], eax
lea eax, [ebp - 0x1e4]
mov dword [esp], eax
call fcn.0043a960
sub esp, 8
mov eax, dword [ebp - 0x1e4]
mov dword [esp + 4], str._ACTIVATE
mov dword [esp], eax
call fcn.0043aca0
test eax, eax
je 0x422cb1
mov dword [0x8dfe94], 1
jmp 0x422cd8
mov eax, dword [ebp - 0x1e4]
mov dword [esp + 4], str._KMS38
mov dword [esp], eax
call fcn.0043aca0
test eax, eax
je 0x422cd7
mov dword [0x8dfed4], 1
jmp 0x422cd8
nop
mov eax, dword [ebp - 0x1e4]
mov dword [esp], eax
call fcn.0043ac70
sub esp, 4
mov eax, dword [0x8dfee4]
add eax, 1
mov dword [0x8dfee4], eax
jmp 0x422be9
nop
jmp 0x422cff
nop
mov eax, dword [0x8dfeac]
mov dword [esp], eax
call fcn.0040827d
sub esp, 4
mov dword [ebp - 0x108], eax
mov eax, dword [0x8dff3c]
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x110], 0x8d6634
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x10c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x110]
mov dword [esp], eax
call fcn.0043aca0
test eax, eax
je 0x422d58
mov eax, dword [0x8dff18]
test eax, eax
jne 0x422d62
jmp 0x422d59
nop
mov dword [ebp - 0x20], 1
jmp 0x422d63
nop
cmp dword [ebp - 0x20], 0
je 0x422db9
mov dword [esp + 4], str.gb0R
mov dword [esp], 0x8dfec4
call fcn.0043ad10
sub esp, 8
mov eax, dword [0x8dfe94]
test eax, eax
jne 0x422db1
mov eax, dword [0x8dfec4]
mov dword [esp + 8], 0x10
mov dword [esp + 4], eax
mov dword [esp], 0x8da810
call fcn.00424f1a
sub esp, 0xc
mov dword [ebp - 0x114], eax
jmp 0x422db2
nop
call fcn.004235e3
jmp 0x422dba
nop
mov dword [0x8dff00], 0
mov dword [0x8dfe70], 0
mov dword [0x8dfe90], 0
call fcn.0043a9b0
call fcn.0043a9b0
call fcn.0043aa00
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x8d646c
mov dword [esp + 4], str.AppsUseLightTheme
mov dword [esp], str.HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionThemesPersonalize
call fcn.004189c2
sub esp, 0x10
mov dword [ebp - 0x118], eax
call fcn.0043aa00
mov dword [esp + 4], eax
mov dword [esp], 0x8dff14
call fcn.0043ab80
sub esp, 8
mov eax, dword [0x8dff14]
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x120], 0x8d64b4
mov eax, dword [ebp - 0x11c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x120]
mov dword [esp], eax
call fcn.0043aca0
test eax, eax
je 0x422e6f
mov dword [0x8dfe70], 1
mov dword [0x8dfe90], 1
jmp 0x422e70
nop
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.0042efa8
sub esp, 0xc
mov dword [ebp - 0x124], eax
mov eax, dword [ebp - 0x124]
mov dword [0x8dff24], eax
mov dword [esp + 8], 0xff
mov dword [esp + 4], 0xff
mov dword [esp], 0xff
call fcn.0042efa8
sub esp, 0xc
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0x128]
mov dword [0x8dfecc], eax
mov dword [esp + 8], 0x20
mov dword [esp + 4], 0x20
mov dword [esp], 0x20
call fcn.0042efa8
sub esp, 0xc
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x12c]
mov dword [0x8dfe84], eax
mov dword [0x8dff0c], 1
mov dword [esp + 8], 0x808080
mov dword [esp + 4], 1
mov dword [esp], 0
call sub.GDI32.dll_CreatePen
sub esp, 0xc
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x130]
mov dword [0x8dfebc], eax
mov dword [esp + 8], 0xcc872c
mov dword [esp + 4], 1
mov dword [esp], 0
call sub.GDI32.dll_CreatePen
sub esp, 0xc
mov dword [ebp - 0x134], eax
mov eax, dword [ebp - 0x134]
mov dword [0x8dfefc], eax
mov dword [esp + 0xc], 7
mov dword [esp + 8], 0
mov dword [esp + 4], 0x8e0424
mov dword [esp], 0x1f
call fcn.00431e00
sub esp, 0x10
mov dword [esp + 0x10], 0x200
mov dword [esp + 0xc], 0x8e048c
mov dword [esp + 8], 0
mov dword [esp + 4], 7
mov dword [esp], 0x2d
call fcn.0042dc8e
sub esp, 0x14
mov dword [esp + 0x10], 0x200
mov dword [esp + 0xc], 0x8e0490
mov dword [esp + 8], 0
mov dword [esp + 4], 0x15
mov dword [esp], 4
call fcn.0042dc8e
sub esp, 0x14
mov dword [esp + 0x10], 0x200
mov dword [esp + 0xc], 0x8e0494
mov dword [esp + 8], 0
mov dword [esp + 4], 0x15
mov dword [esp], 4
call fcn.0042dc8e
sub esp, 0x14
mov dword [esp + 0x10], 0x200
mov dword [esp + 0xc], 0x8e0498
mov dword [esp + 8], 0
mov dword [esp + 4], 0x15
mov dword [esp], 4
call fcn.0042dc8e
sub esp, 0x14
mov dword [0x8dfe5c], 2
mov dword [0x8dfe60], 1
mov dword [esp + 0x10], 0x8dfe58
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x15
mov dword [esp + 4], 4
mov dword [esp], 2
call fcn.0042ed99
sub esp, 0x14
mov dword [esp + 0xc], 0x15
mov dword [esp + 8], 0
mov dword [esp + 4], 0x8e042c
mov dword [esp], 4
call fcn.00431e00
sub esp, 0x10
mov dword [ebp - 0x138], 0x8ca6b2
mov eax, dword [ebp - 0x138]
mov dword [esp + 4], eax
mov dword [esp], 0xffffffff
call fcn.00431660
sub esp, 8
mov dword [ebp - 0x13c], eax
mov eax, dword [ebp - 0x13c]
mov dword [0x8dfe78], eax
mov eax, dword [0x8dfe78]
mov dword [esp], eax
call fcn.00407ad2
sub esp, 4
mov dword [ebp - 0x140], eax
mov eax, dword [0x8dfe88]
mov dword [esp], eax
call fcn.00407ad2
sub esp, 4
mov dword [ebp - 0x144], eax
mov eax, dword [0x8dfe94]
test eax, eax
jle 0x42313f
mov dword [esp], 0
call fcn.00403e13
sub esp, 4
mov dword [ebp - 0x148], eax
call fcn.004235e3
jmp 0x423406
nop
mov dword [esp + 0xc], 0xa0
mov dword [esp + 8], 0x1e0
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.00401020
sub esp, 0x10
mov dword [ebp - 0x14c], eax
mov edx, dword [0x8dfeb8]
mov eax, dword [0x8dff04]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0042a8c4
sub esp, 8
mov dword [ebp - 0x150], eax
mov eax, dword [0x8dfee0]
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x158], 0x8d6d54
mov eax, dword [ebp - 0x154]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x158]
mov dword [esp], eax
call fcn.0043aca0
test eax, eax
je 0x4231fc
mov eax, dword [0x8dfeb0]
mov dword [esp + 4], 0x8dcf80
mov dword [esp], eax
call fcn.00428ed5
sub esp, 8
mov dword [ebp - 0x15c], eax
mov eax, dword [0x8dfe9c]
mov dword [esp + 4], 0x8db180
mov dword [esp], eax
call fcn.00428ed5
sub esp, 8
mov dword [ebp - 0x160], eax
jmp 0x42321b
nop
mov eax, dword [0x8dfe9c]
mov dword [esp + 4], str.dk_vz
mov dword [esp], eax
call fcn.00428ed5
sub esp, 8
mov dword [ebp - 0x164], eax
mov eax, dword [0x8dff04]
mov dword [esp], eax
call fcn.0042a8ed
sub esp, 4
mov dword [ebp - 0x168], eax
mov eax, dword [ebp - 0x168]
mov dword [esp], eax
call fcn.0042f029
sub esp, 4
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 0
je 0x423300
mov dword [esp], 1
call fcn.00439724
sub esp, 4
mov dword [ebp - 0x170], eax
mov eax, dword [ebp - 0x170]
mov dword [esp], eax
call fcn.0042f909
sub esp, 4
mov dword [ebp - 0x174], eax
call fcn.0043a9b0
call fcn.0043a9b0
call fcn.0043a9b0
call fcn.0043aa00
mov edx, dword [0x8dfe9c]
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.00429092
sub esp, 8
call fcn.0043ab00
mov dword [ebp - 0x178], eax
mov eax, dword [ebp - 0x178]
mov dword [esp], eax
call fcn.0042f920
sub esp, 4
mov dword [ebp - 0x17c], eax
call fcn.0043aa60
mov eax, dword [ebp - 0x17c]
mov dword [esp], eax
call fcn.0042e172
sub esp, 4
mov dword [ebp - 0x180], eax
mov eax, dword [ebp - 0x180]
mov dword [0x8dfedc], eax
call fcn.0042f7b1
mov dword [ebp - 0x184], eax
jmp 0x423301
nop
mov eax, dword [0x8dff04]
mov dword [esp], eax
call fcn.0042a9e6
sub esp, 4
mov dword [ebp - 0x188], eax
mov edx, dword [0x8dfedc]
mov eax, dword [ebp - 0x188]
sub eax, edx
mov edx, eax
shr edx, 0x1f
add eax, edx
sar eax, 1
mov dword [ebp - 0x18c], eax
mov edx, dword [0x8dfedc]
mov eax, dword [0x8dfe9c]
mov dword [esp + 0x10], 0xffff0001
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0xffff0001
mov edx, dword [ebp - 0x18c]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004295d3
sub esp, 0x14
mov dword [ebp - 0x190], eax
mov edx, dword [0x8dff48]
mov eax, dword [0x8dfe98]
mov dword [esp + 8], edx
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call fcn.004292be
sub esp, 0xc
mov dword [ebp - 0x194], eax
mov edx, dword [0x8dff10]
mov eax, dword [0x8dfe98]
mov dword [esp + 8], edx
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call fcn.004292be
sub esp, 0xc
mov dword [ebp - 0x198], eax
mov eax, dword [0x8dfed4]
test eax, eax
jle 0x4233e7
mov eax, dword [0x8dfe98]
mov dword [esp + 4], 1
mov dword [esp], eax
call fcn.00428f76
sub esp, 8
mov dword [ebp - 0x19c], eax
jmp 0x423406
nop
mov eax, dword [0x8dfe98]
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00428f76
sub esp, 8
mov dword [ebp - 0x1a0], eax
call fcn.0042a05b
mov dword [ebp - 0x1a4], eax
mov dword [ebp - 0x24], 0
cmp dword [ebp - 0x1a4], 0x6d
jle 0x423434
mov eax, dword [0x8dfe90]
test eax, eax
jle 0x423437
nop
mov dword [ebp - 0x24], 1
jmp 0x423438
nop
jmp 0x423438
nop
cmp dword [ebp - 0x24], 0
je 0x423511
call fcn.00410776
mov dword [ebp - 0x1a8], eax
mov dword [esp + 4], str.dwmapi
mov dword [esp], 0
call fcn.00425f40
sub esp, 8
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 0
je 0x423514
mov dword [esp + 4], str.DwmSetWindowAttribute
mov dword [esp], 0
call fcn.00425f9a
sub esp, 8
mov dword [ebp - 0x1b0], eax
mov eax, dword [ebp - 0x1b0]
mov dword [0x8dfea0], eax
mov eax, dword [0x8dff04]
mov dword [esp], eax
call fcn.0042a612
sub esp, 4
mov dword [ebp - 0x1b4], eax
mov dword [ebp - 0x1b8], 0x8dfe90
mov eax, dword [0x8dfea0]
mov dword [esp + 0xc], 4
mov edx, dword [ebp - 0x1b8]
mov dword [esp + 8], edx
mov dword [esp + 4], 0x14
mov edx, dword [ebp - 0x1b4]
mov dword [esp], edx
call eax
mov dword [ebp - 0x1bc], eax
mov dword [esp], 0
call fcn.00425ff6
sub esp, 4
mov dword [ebp - 0x1c0], eax
call fcn.0040e2d0
mov dword [ebp - 0x1c4], eax
jmp 0x423515
nop
jmp 0x423515
nop
mov eax, dword [0x8dff04]
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.0042aad3
sub esp, 8
mov dword [ebp - 0x1c8], eax
call fcn.0042a62e
mov dword [ebp - 0x1cc], eax
mov eax, dword [ebp - 0x1cc]
mov dword [0x8dfee8], eax
mov eax, dword [0x8dfee8]
test eax, eax
je 0x4235b0
call fcn.0042d2b1
mov dword [ebp - 0x1d0], eax
mov eax, dword [ebp - 0x1d0]
mov dword [ebp - 0x1d4], eax
mov eax, dword [0x8dff04]
cmp dword [ebp - 0x1d4], eax
jne 0x42358f
mov eax, dword [0x8dfee8]
mov dword [esp], eax
call fcn.0040a2af
sub esp, 4
mov dword [ebp - 0x1dc], eax
nop
jmp 0x4235c6
mov dword [0x8dfee8], 0
mov dword [esp], 5
call fcn.0042a1de
sub esp, 4
mov dword [ebp - 0x1d8], eax
jmp 0x4235c6
nop
mov dword [esp], 5
call fcn.0042a1de
sub esp, 4
mov dword [ebp - 0x1e0], eax
mov eax, dword [0x8dfee8]
cmp eax, 0x333c
je 0x4235d8
nop
jmp 0x423533
nop
call fcn.004235e3
nop
leave
ret 0x10