Function at 0x401000
Capabilities:
Allocate thread local storage
Query environment variable

Disassembly:
push 0x584
push 0
push 0x52c8b4
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleW
mov dword [0x52c8b8], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x52c8b4], eax
mov eax, 0x4b10a0
mov dword [0x52c8e0], eax
call fcn.0040bcdf
call fcn.0041f1f0
call fcn.0041e694
call fcn.0041e190
call fcn.0041c910
call fcn.0041a84c
call fcn.0041a0f0
call fcn.0041994a
call fcn.00418fe7
call fcn.00418909
call fcn.004185a4
call fcn.0041831f
call fcn.004153dd
call fcn.00414dad
call fcn.00413b40
call fcn.00412dfc
call fcn.00411b9d
call fcn.0040f6a3
call fcn.0040eb4c
call fcn.0040e06e
call fcn.0040deef
call fcn.0040cc3d
call fcn.0040c014
call fcn.0040be00
mov edx, str.v2.5
lea ecx, [0x52c91c]
call fcn.0040b008
mov edx, 0x4ac028
lea ecx, [0x52c8f0]
call fcn.0040b008
push edx
call fcn.0041f240
pop edx
push eax
mov edx, str.KMS_Cleaner
push edx
call fcn.0041f280
mov edx, dword [0x52c91c]
push edx
call fcn.0041f280
lea eax, [0x52c8f0]
push eax
call fcn.0041f2e0
push edx
call fcn.0041f240
pop edx
push eax
call fcn.00402b0a
lea eax, [0x52c8e8]
push eax
call fcn.0041f2e0
push edx
call fcn.0041f240
pop edx
push eax
push edx
call fcn.0041f240
pop edx
push eax
push edx
call fcn.0041f240
pop edx
push eax
call fcn.00402b0a
call fcn.0040b5b2
add dword [esp], edx
call fcn.00413045
lea eax, [0x52c8d8]
push eax
call fcn.0041f2e0
push edx
call fcn.0041f240
pop edx
push eax
mov eax, str.tool
push eax
push edx
call fcn.0041f240
pop edx
push eax
push edx
call fcn.0041f240
pop edx
push eax
push dword [0x52c8d8]
call fcn.0041cbc0
call fcn.0040b5b2
add dword [esp], edx
call fcn.0041ccf0
call fcn.0040b5d0
mov ebx, eax
and ebx, ebx
jne 0x4011e4
push edx
call fcn.0041f240
pop edx
push eax
mov eax, str.kmscleaner
push eax
push edx
call fcn.0041f240
pop edx
push eax
push edx
call fcn.0041f240
pop edx
push eax
push dword [0x52c8d8]
call fcn.0041cbc0
call fcn.0040b5b2
add dword [esp], edx
call fcn.0041ccf0
call fcn.0040b5d0
mov ebx, eax
and ebx, ebx
jne 0x4011e4
mov eax, 1
jmp 0x4011e6
xor eax, eax
and eax, eax
je 0x401204
push dword [0x52c8d8]
mov edx, 0x4ac028
pop ecx
call fcn.0040b5e0
jne 0x401204
mov eax, 1
jmp 0x401206
xor eax, eax
and eax, eax
je 0x40120f
jmp 0x401c94
push edx
call fcn.0041f240
pop edx
push eax
mov eax, str.tool
push eax
push edx
call fcn.0041f240
pop edx
push eax
push edx
call fcn.0041f240
pop edx
push eax
push dword [0x52c8d8]
call fcn.0041cbc0
call fcn.0040b5b2
add dword [esp], edx
call fcn.0041ccf0
call fcn.0040b5d0
mov ebx, eax
and ebx, ebx
jle 0x401282
push dword [0x52c8e8]
call fcn.00413057
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jl 0x401272
jg 0x40126e
cmp ebx, 0x1c9c380
jb 0x401272
xor eax, eax
jmp 0x401277
mov eax, 1
or eax, eax
je 0x401282
mov eax, 1
jmp 0x401284
xor eax, eax
and eax, eax
je 0x40128d
jmp 0x401c94
push edx
call fcn.0041f240
pop edx
push eax
push edx
call fcn.0041f240
pop edx
push eax
push 0xc8
call fcn.0041cd10
lea eax, [0x52c9e0]
push eax
call fcn.0041f2e0
push edx
call fcn.0041f240
pop edx
push eax
push edx
call fcn.0041f240
pop edx
push eax
push 0xc8
call fcn.0041cd10
lea eax, [0x52c9e4]
push eax
call fcn.0041f2e0
push 0xc8
mov eax, dword [0x52c9e0]
push eax
mov eax, str.PROCESSOR_ARCHITECTURE
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0xc8
mov eax, dword [0x52c9e4]
push eax
mov eax, str.PROCESSOR_ARCHITEW6432
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0x64
mov eax, dword [0x52c9c8]
push eax
mov eax, str.SYSTEMDRIVE
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
push dword [0x52c9e0]
mov edx, str.AMD64
pop ecx
call fcn.0040b5e0
jne 0x401343
push dword [0x52c9e4]
mov edx, str.AMD64
pop ecx
call fcn.0040b5e0
jne 0x401343
jmp 0x40134a
mov eax, 1
jmp 0x40134c
xor eax, eax
and eax, eax
je 0x401362
mov edx, 0x4ae7b8
lea ecx, [0x52c9d4]
call fcn.0040b008
jmp 0x401372
mov edx, 0x4af302
lea ecx, [0x52c9d4]
call fcn.0040b008
call fcn.0040a241
and eax, eax
je 0x4013a6
mov edx, dword [0x52c8f0]
push edx
call fcn.0041f240
pop edx
push eax
push edx
call fcn.0041f280
mov edx, str.__Run_As_SYSTEM_
push edx
call fcn.0041f280
lea eax, [0x52c8f0]
push eax
call fcn.0041f2e0
mov edx, dword [0x52c8f0]
push edx
call fcn.0041f240
pop edx
push eax
push edx
call fcn.0041f280
call fcn.0041f370
lea eax, [0x52c8d4]
push eax
call fcn.0041f2e0
push 9
mov eax, str.Microsoft_Sans_Serif
push eax
push 0
call fcn.0041e7aa
mov edx, 0x4b0be2
lea ecx, [0x52c918]
call fcn.0040b008
mov edx, 0x4ac028
lea ecx, [0x52c8fc]
call fcn.0040b008
mov edx, 0x4ac028
lea ecx, [0x52c8ec]
call fcn.0040b008
mov edx, 0x4ac028
lea ecx, [0x52c924]
call fcn.0040b008
push edx
call fcn.0041f240
pop edx
push eax
push edx
call fcn.0041f240
pop edx
push eax
push 0x3e8
call fcn.0041cd10
lea eax, [0x52c914]
push eax
call fcn.0041f2e0
push 0x3e8
mov eax, dword [0x52c914]
push eax
mov eax, str.WINDIR
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
push edx
call fcn.0041f240
pop edx
push eax
push edx
call fcn.0041f240
pop edx
push eax
push 0x3e8
call fcn.0041cd10
lea eax, [0x52c8c4]
push eax
call fcn.0041f2e0
push 0x3e8
mov eax, dword [0x52c8c4]
push eax
mov eax, str.WINDIR
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
push edx
call fcn.0041f240
pop edx
push eax
push edx
call fcn.0041f240
pop edx
push eax
push 0xc8
call fcn.0041cd10
lea eax, [0x52c900]
push eax
call fcn.0041f2e0
push edx
call fcn.0041f240
pop edx
push eax
push edx
call fcn.0041f240
pop edx
push eax
push 0xc8
call fcn.0041cd10
lea eax, [0x52c920]
push eax
call fcn.0041f2e0
push 0xc8
mov eax, dword [0x52c900]
push eax
mov eax, str.PROCESSOR_ARCHITECTURE
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0xc8
mov eax, dword [0x52c920]
push eax
mov eax, str.PROCESSOR_ARCHITEW6432
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
push edx
call fcn.0041f240
pop edx
push eax
push edx
call fcn.0041f240
pop edx
push eax
push 0x3e8
call fcn.0041cd10
lea eax, [0x52c8dc]
push eax
call fcn.0041f2e0
push 0x3e8
mov eax, dword [0x52c8dc]
push eax
mov eax, str.LOCALAPPDATA
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
push edx
call fcn.0041f240
pop edx
push eax
push edx
call fcn.0041f240
pop edx
push eax
push 0x64
call fcn.0041cd10
lea eax, [0x52c8bc]
push eax
call fcn.0041f2e0
push 0x64
mov eax, dword [0x52c8bc]
push eax
mov eax, str.SYSTEMDRIVE
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
push edx
call fcn.0041f240
pop edx
push eax
mov edx, dword [0x52c914]
push edx
call fcn.0041f240
pop edx
push eax
push edx
call fcn.0041f280
mov edx, str.Temp
push edx
call fcn.0041f280
call fcn.0040b5b2
add dword [esp], edx
call fcn.00413057
call fcn.0040b5d0
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x4015cf
cmp edi, 0xffffffff
je 0x4015d3
xor eax, eax
jmp 0x4015d8
mov eax, 1
or eax, eax
je 0x401607
mov edx, dword [0x52c914]
push edx
call fcn.0041f240
pop edx
push eax
push edx
call fcn.0041f280
mov edx, str.Temp
push edx
call fcn.0041f280
lea eax, [0x52c8ec]
push eax
call fcn.0041f2e0
push edx
call fcn.0041f240
pop edx
push eax
mov edx, dword [0x52c914]
push edx
call fcn.0041f240
pop edx
push eax
push edx
call fcn.0041f280
mov edx, str.Sysnativecmd.exe
push edx
call fcn.0041f280
call fcn.0040b5b2
add dword [esp], edx
call fcn.00413057
call fcn.0040b5d0
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x401654
jl 0x401650
cmp ebx, 0
ja 0x401654
xor eax, eax
jmp 0x401659
mov eax, 1
or eax, eax
je 0x40168a
mov edx, dword [0x52c914]
push edx
call fcn.0041f240
pop edx
push eax
push edx
call fcn.0041f280
mov edx, str.Sysnative
push edx
call fcn.0041f280
lea eax, [0x52c914]
push eax
call fcn.0041f2e0
jmp 0x4016b5
mov edx, dword [0x52c914]
push edx
call fcn.0041f240
pop edx
push eax
push edx
call fcn.0041f280
mov edx, str.System32
push edx
call fcn.0041f280
lea eax, [0x52c914]
push eax
call fcn.0041f2e0
push edx
call fcn.0041f240
pop edx
push eax
push dword [0x52c8ec]
push edx
call fcn.0041f240
pop edx
push eax
push edx
call fcn.0041f240
pop edx
push eax
call fcn.0040c043
call fcn.0040b5b2
add dword [esp], edx
call fcn.0041ccf0
call fcn.0040b5d0
mov ebx, eax
and ebx, ebx
jne 0x401996
push edx
call fcn.0041f240
pop edx
push eax
mov edx, dword [0x52c8ec]
push edx
call fcn.0041f240
pop edx
push eax
push edx
call fcn.0041f280
mov edx, 0x4ac734
push edx
call fcn.0041f280
push edx
call fcn.0041f240
pop edx
push eax
push edx
call fcn.0041f240
pop edx
push eax
push edx
call fcn.0041f240
pop edx
push eax
push edx
call fcn.0041f240
pop edx
push eax
call fcn.0040c043
call fcn.0040b5b2
add dword [esp], edx
call fcn.00413045
pop eax
call fcn.0041f370
push edx
call fcn.0041f240
pop edx
push eax
push edx
call fcn.0041f240
pop edx
push eax
call fcn.0040c043
call fcn.0040b5b2
add dword [esp], edx
call fcn.0040b5b2
add dword [esp + 4], edx
call fcn.004131ae
call fcn.0040b5d0
push edx
call fcn.0041f240
pop edx
push eax
mov edx, dword [0x52c8ec]
push edx
call fcn.0041f240
pop edx
push eax
push edx
call fcn.0041f280
mov edx, 0x4ac734
push edx
call fcn.0041f280
push edx
call fcn.0041f240
pop edx
push eax
push edx
call fcn.0041f240
pop edx
push eax
push edx
call fcn.0041f240
pop edx
push eax
push edx
call fcn.0041f240
pop edx
push eax
call fcn.0040c043
call fcn.0040b5b2
add dword [esp], edx
call fcn.00413045
pop eax
call fcn.0040b5b2
add dword [esp], edx
call fcn.0040c648
call fcn.0040b5d0
push 0x1f4
call fcn.00411874
push edx
call fcn.0041f240
pop edx
push eax
mov edx, 0x4ac2f8
push edx
call fcn.0041f280
mov edx, dword [0x52c8ec]
push edx
call fcn.0041f280
mov edx, 0x4ac734
push edx
call fcn.0041f280
push edx
call fcn.0041f240
pop edx
push eax
push edx
call fcn.0041f240
pop edx
push eax
push edx
call fcn.0041f240
pop edx
push eax
push edx
call fcn.0041f240
pop edx
push eax
call fcn.0040c043
call fcn.0040b5b2
add dword [esp], edx
call fcn.00413045
pop eax
mov edx, 0x4ac2f8
push edx
call fcn.0041f280
lea eax, [0x52c8e4]
push eax
call fcn.0041f2e0
push edx
call fcn.0041f240
pop edx
push eax
push edx
call fcn.0041f240
pop edx
push eax
call fcn.004131d3
mov edx, str.SelfDelete.bat
push edx
call fcn.0041f280
lea eax, [0x52c928]
push eax
call fcn.0041f2e0
push dword [0x52c928]
push 0xffffffff
call fcn.00413d60
mov dword [0x52c90c], eax
mov eax, str.:debut
push eax
push dword [0x52c90c]
call fcn.00413ff0
mov eax, str.timeout__t_3
push eax
push dword [0x52c90c]
call fcn.00413ff0
push edx
call fcn.0041f240
pop edx
push eax
push edx
call fcn.0041f240
pop edx
push eax
mov edx, str.del
push edx
call fcn.0041f280
mov edx, dword [0x52c8e4]
push edx
call fcn.0041f280
call fcn.0041f370
push dword [0x52c90c]
call fcn.0040b5b2
add dword [esp + 4], edx
call fcn.00413ff0
call fcn.0040b5d0
push edx
call fcn.0041f240
pop edx
push eax
push edx
call fcn.0041f240
pop edx
push eax
mov edx, str.If_exist
push edx
call fcn.0041f280
mov edx, dword [0x52c8e4]
push edx
call fcn.0041f280
mov edx, str._Goto_debut
push edx
call fcn.0041f280
call fcn.0041f370
push dword [0x52c90c]
call fcn.0040b5b2
add dword [esp + 4], edx
call fcn.00413ff0
call fcn.0040b5d0
mov eax, str.del__0
push eax
push dword [0x52c90c]
call fcn.00413ff0
push dword [0x52c90c]
call fcn.00413a70
push 2
push dword [0x52c928]
call fcn.00409e27
jmp 0x401c94
push 0x100
push 0
call fcn.0040a156
push edx
call fcn.0041f240
pop edx
push eax
mov eax, 0x4ac374
push eax
mov eax, str.BuildLab
push eax
mov eax, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_NTCurrentVersion
push eax
call fcn.0040555c
lea eax, [0x52c8f4]
push eax
call fcn.0041f2e0
mov eax, 0x4ac374
push eax
push dword [0x52c8f4]
call fcn.0041ccf0
mov dword [0x52c908], eax
mov ebx, dword [0x52c908]
cmp ebx, 1
jge 0x4019f3
jmp 0x401a27
push edx
call fcn.0041f240
pop edx
push eax
push edx
call fcn.0041f240
pop edx
push eax
mov ebx, dword [0x52c908]
dec ebx
push ebx
push 1
push dword [0x52c8f4]
call fcn.0041cd60
lea eax, [0x52c8f4]
push eax
call fcn.0041f2e0
push dword [0x52c8f4]
call fcn.0041ce40
mov dword [0x52c8c0], eax
mov ebx, dword [0x52c8c0]
cmp ebx, 0x2580
jl 0x401a5a
mov edx, 0x4b0be2
lea ecx, [0x52c918]
call fcn.0040b008
jmp 0x401b3e
mov ebx, dword [0x52c8c0]
cmp ebx, 0x23f0
jl 0x401a7d
mov ebx, dword [0x52c8c0]
cmp ebx, 0x2454
jge 0x401a7d
mov eax, 1
jmp 0x401a7f
xor eax, eax
and eax, eax
je 0x401a98
mov edx, 0x4ac45c
lea ecx, [0x52c918]
call fcn.0040b008
jmp 0x401b3e
mov ebx, dword [0x52c8c0]
cmp ebx, 0x1db0
jl 0x401abb
mov ebx, dword [0x52c8c0]
cmp ebx, 0x1e14
jge 0x401abb
mov eax, 1
jmp 0x401abd
xor eax, eax
and eax, eax
je 0x401ad3
mov edx, 0x4ac458
lea ecx, [0x52c918]
call fcn.0040b008
jmp 0x401b3e
mov ebx, dword [0x52c8c0]
cmp ebx, 0xa28
jl 0x401af6
mov ebx, dword [0x52c8c0]
cmp ebx, 0xbb8
jge 0x401af6
mov eax, 1
jmp 0x401af8
xor eax, eax
and eax, eax
je 0x401b2e
mov edx, 0x4ae7c0
lea ecx, [0x52c918]
call fcn.0040b008
push 1
push dword [0x52c8cc]
call fcn.0040f749
push 1
push dword [0x52c8d0]
call fcn.0040f749
jmp 0x401b3e
mov edx, 0x4b0be2
lea ecx, [0x52c918]
call fcn.0040b008
push dword [0x52c900]
mov edx, str.AMD64
pop ecx
call fcn.0040b5e0
jne 0x401b66
push dword [0x52c920]
mov edx, str.AMD64
pop ecx
call fcn.0040b5e0
jne 0x401b66
jmp 0x401b6d
mov eax, 1
jmp 0x401b6f
xor eax, eax
and eax, eax
je 0x401b85
mov edx, str.x64WDV
lea ecx, [0x52c8fc]
call fcn.0040b008
jmp 0x401b95
mov edx, str.x86WDV
lea ecx, [0x52c8fc]
call fcn.0040b008
push 0xee
push 0x1b0
push 0
push 0
call fcn.00401d04
call fcn.00403ead
push edx
call fcn.0041f240
pop edx
push eax
push 0
push edx
call fcn.0041f240
pop edx
push eax
mov edx, 0x4af372
push edx
call fcn.0041f280
mov edx, dword [0x52c8f0]
push edx
call fcn.0041f280
mov edx, 0x4ad202
push edx
call fcn.0041f280
call fcn.0040b5b2
add dword [esp], edx
call fcn.00403fc6
call fcn.0040b5d0
call fcn.00411c08
and eax, eax
je 0x401c07
jmp 0x401bfc
push dword [0x52c8fc]
mov edx, str.x64WDV
pop ecx
call fcn.0040b5e0
je 0x401c32
push 0x10
mov eax, str.Please_use_the_x64_version_of_the_program_
push eax
mov eax, str.Program_Error
push eax
call fcn.0040be39
jmp 0x401c94
call fcn.00411c08
mov dword [0x52c8f8], eax
cmp dword [0x52c8f8], 0
je 0x401c7a
call fcn.00414ec7
push eax
mov ebx, dword [0x52c904]
cmp ebx, dword [esp]
jne 0x401c63
push dword [0x52c8f8]
call fcn.00403e48
jmp 0x401c77
mov dword [0x52c8f8], 0
push 5
call fcn.00411874
pop eax
jmp 0x401c84
push 5
call fcn.00411874
mov ebx, dword [0x52c8f8]
cmp ebx, 0x333c
jne 0x401c32
jmp 0x401c94
push 0
call 0x401cb3
call fcn.0041f220
push dword [0x52c8b4]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess
call fcn.0040cc2b
call fcn.0040dee3
call fcn.0040e03e
call fcn.0040eb40
call fcn.0040f64d
call fcn.00411b7a
call fcn.00412dfb
call fcn.0041320e
call fcn.00413b30
call fcn.00414d8f
call fcn.004188fd
call fcn.00419949
call fcn.0041c930
call fcn.0041e801
call fcn.0041e867
call fcn.0041e180
ret