Function at 0x140001000
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
mov r8, 0x720
xor rdx, rdx
movabs rcx, 0x140149238
call sub.msvcrt.dll_memset
xor rcx, rcx
call sub.KERNEL32.dll_GetModuleHandleW
mov qword [0x140149240], rax
xor r8, r8
mov rdx, 0x1000
xor rcx, rcx
call sub.KERNEL32.dll_HeapCreate
mov qword [0x140149238], rax
movabs rax, 0x1400e6050
mov qword [0x140149298], rax
call fcn.140012750
call fcn.14002d6b0
call fcn.14002c6c8
call fcn.14002c0d0
call fcn.14002a390
call fcn.1400275c4
call fcn.140026a90
call fcn.140026300
call fcn.140025374
call fcn.140024b0c
call fcn.1400245ec
call fcn.140024280
call fcn.1400206d8
call fcn.14001fca4
call fcn.14001e520
call fcn.14001d40c
call fcn.14001bc94
call fcn.140018994
call fcn.14001665c
call fcn.140015588
call fcn.140015364
call fcn.140013b18
call fcn.140012b8c
call fcn.1400128c4
movabs rdx, str.v2.5
lea rcx, [0x140149310]
call fcn.14002d720
movabs rdx, 0x1400e1028
lea rcx, [0x1401492b8]
call fcn.14002d720
push rcx
sub rsp, 0x28
call fcn.14002d810
add rsp, 0x28
pop rcx
push rax
movabs rcx, str.KMS_Cleaner_x64
sub rsp, 0x28
call fcn.14002d860
add rsp, 0x28
mov rcx, qword [0x140149310]
sub rsp, 0x28
call fcn.14002d860
add rsp, 0x28
lea rcx, [0x1401492b8]
pop rdx
call fcn.14002d8d0
push rcx
sub rsp, 0x28
call fcn.14002d810
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.14002d810
add rsp, 0x20
pop rcx
push rax
sub rsp, 0x20
call fcn.140003cb2
add rsp, 0x28
lea rcx, [0x1401492a8]
pop rdx
call fcn.14002d8d0
push rcx
sub rsp, 0x28
call fcn.14002d810
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14002d810
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.14002d810
add rsp, 0x20
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x20
call fcn.14002d810
add rsp, 0x20
pop rcx
push rax
sub rsp, 0x20
call fcn.140003cb2
add rsp, 0x30
push rax
call fcn.14002d9e0
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14001d5f8
add rsp, 0x28
lea rcx, [0x140149288]
pop rdx
call fcn.14002d8d0
push rcx
sub rsp, 0x28
call fcn.14002d810
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
movabs rax, str.tool
push rax
push rcx
sub rsp, 0x20
call fcn.14002d810
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.14002d810
add rsp, 0x28
pop rcx
push rax
push qword [0x140149288]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14002a730
add rsp, 0x20
push rax
call fcn.14002d9e0
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14002a7c0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140011a64
add rsp, 0x28
pop rax
mov r15, rax
and r15, r15
jne 0x14000131a
push rcx
sub rsp, 0x28
call fcn.14002d810
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
movabs rax, str.kmscleaner
push rax
push rcx
sub rsp, 0x20
call fcn.14002d810
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.14002d810
add rsp, 0x28
pop rcx
push rax
push qword [0x140149288]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14002a730
add rsp, 0x20
push rax
call fcn.14002d9e0
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14002a7c0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140011a64
add rsp, 0x28
pop rax
mov r15, rax
and r15, r15
jne 0x14000131a
mov rax, 1
jmp 0x14000131d
xor rax, rax
and rax, rax
je 0x140001346
push qword [0x140149288]
movabs rcx, 0x1400e1028
pop rdx
call fcn.14002da10
or rax, rax
jne 0x140001346
mov rax, 1
jmp 0x140001349
xor rax, rax
and rax, rax
je 0x140001353
jmp 0x14000246b
push rcx
sub rsp, 0x28
call fcn.14002d810
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
movabs rax, str.tool
push rax
push rcx
sub rsp, 0x20
call fcn.14002d810
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.14002d810
add rsp, 0x28
pop rcx
push rax
push qword [0x140149288]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14002a730
add rsp, 0x20
push rax
call fcn.14002d9e0
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14002a7c0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140011a64
add rsp, 0x28
pop rax
mov r15, rax
and r15, r15
jle 0x1400013fd
push qword [0x1401492a8]
pop rcx
call fcn.14001d704
mov r15, rax
cmp r15, 0x1c9c380
jge 0x1400013fd
mov rax, 1
jmp 0x140001400
xor rax, rax
and rax, rax
je 0x14000140a
jmp 0x14000246b
push rcx
sub rsp, 0x28
call fcn.14002d810
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14002d810
add rsp, 0x28
pop rcx
push rax
push 0xc8
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14002a950
add rsp, 0x28
lea rcx, [0x140149458]
pop rdx
call fcn.14002d8d0
push rcx
sub rsp, 0x28
call fcn.14002d810
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14002d810
add rsp, 0x28
pop rcx
push rax
push 0xc8
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14002a950
add rsp, 0x28
lea rcx, [0x140149460]
pop rdx
call fcn.14002d8d0
push 0xc8
mov rax, qword [0x140149458]
mov rax, rax
push rax
movabs rax, str.PROCESSOR_ARCHITECTURE
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0xc8
mov rax, qword [0x140149460]
mov rax, rax
push rax
movabs rax, str.PROCESSOR_ARCHITEW6432
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0x64
mov rax, qword [0x140149428]
mov rax, rax
push rax
movabs rax, str.SYSTEMDRIVE
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_GetEnvironmentVariableW
push qword [0x140149458]
movabs rcx, str.AMD64
pop rdx
call fcn.14002da10
or rax, rax
jne 0x140001538
push qword [0x140149460]
movabs rcx, str.AMD64
pop rdx
call fcn.14002da10
or rax, rax
jne 0x140001538
jmp 0x140001541
mov rax, 1
jmp 0x140001544
xor rax, rax
and rax, rax
je 0x140001561
movabs rdx, 0x1400e3788
lea rcx, [0x140149440]
call fcn.14002d720
jmp 0x140001577
movabs rdx, 0x1400e4260
lea rcx, [0x140149440]
call fcn.14002d720
call fcn.140010948
and rax, rax
je 0x1400015c9
mov rcx, qword [0x1401492b8]
push rcx
sub rsp, 0x28
call fcn.14002d810
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14002d860
add rsp, 0x28
movabs rcx, str.__Run_As_SYSTEM_
sub rsp, 0x28
call fcn.14002d860
add rsp, 0x28
lea rcx, [0x1401492b8]
pop rdx
call fcn.14002d8d0
mov rcx, qword [0x1401492b8]
push rcx
sub rsp, 0x28
call fcn.14002d810
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14002d860
add rsp, 0x28
call fcn.14002da70
lea rcx, [0x140149280]
pop rdx
call fcn.14002d8d0
push 9
movabs rax, str.Microsoft_Sans_Serif
push rax
push 0
pop rcx
pop rdx
pop r8
call fcn.14002c73c
movabs rdx, 0x1400e5b62
lea rcx, [0x140149308]
call fcn.14002d720
movabs rdx, 0x1400e1028
lea rcx, [0x1401492d0]
call fcn.14002d720
movabs rdx, 0x1400e1028
lea rcx, [0x1401492b0]
call fcn.14002d720
movabs rdx, 0x1400e1028
lea rcx, [0x140149320]
call fcn.14002d720
push rcx
sub rsp, 0x28
call fcn.14002d810
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14002d810
add rsp, 0x28
pop rcx
push rax
push 0x3e8
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14002a950
add rsp, 0x28
lea rcx, [0x140149300]
pop rdx
call fcn.14002d8d0
push 0x3e8
mov rax, qword [0x140149300]
mov rax, rax
push rax
movabs rax, str.WINDIR
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_GetEnvironmentVariableW
push rcx
sub rsp, 0x28
call fcn.14002d810
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14002d810
add rsp, 0x28
pop rcx
push rax
push 0x3e8
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14002a950
add rsp, 0x28
lea rcx, [0x140149260]
pop rdx
call fcn.14002d8d0
push 0x3e8
mov rax, qword [0x140149260]
mov rax, rax
push rax
movabs rax, str.WINDIR
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_GetEnvironmentVariableW
push rcx
sub rsp, 0x28
call fcn.14002d810
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14002d810
add rsp, 0x28
pop rcx
push rax
push 0xc8
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14002a950
add rsp, 0x28
lea rcx, [0x1401492d8]
pop rdx
call fcn.14002d8d0
push rcx
sub rsp, 0x28
call fcn.14002d810
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14002d810
add rsp, 0x28
pop rcx
push rax
push 0xc8
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14002a950
add rsp, 0x28
lea rcx, [0x140149318]
pop rdx
call fcn.14002d8d0
push 0xc8
mov rax, qword [0x1401492d8]
mov rax, rax
push rax
movabs rax, str.PROCESSOR_ARCHITECTURE
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0xc8
mov rax, qword [0x140149318]
mov rax, rax
push rax
movabs rax, str.PROCESSOR_ARCHITEW6432
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_GetEnvironmentVariableW
push rcx
sub rsp, 0x28
call fcn.14002d810
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14002d810
add rsp, 0x28
pop rcx
push rax
push 0x3e8
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14002a950
add rsp, 0x28
lea rcx, [0x140149290]
pop rdx
call fcn.14002d8d0
push 0x3e8
mov rax, qword [0x140149290]
mov rax, rax
push rax
movabs rax, str.LOCALAPPDATA
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_GetEnvironmentVariableW
push rcx
sub rsp, 0x28
call fcn.14002d810
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14002d810
add rsp, 0x28
pop rcx
push rax
push 0x64
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14002a950
add rsp, 0x28
lea rcx, [0x140149250]
pop rdx
call fcn.14002d8d0
push 0x64
mov rax, qword [0x140149250]
mov rax, rax
push rax
movabs rax, str.SYSTEMDRIVE
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_GetEnvironmentVariableW
push rcx
sub rsp, 0x28
call fcn.14002d810
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
mov rcx, qword [0x140149300]
push rcx
sub rsp, 0x28
call fcn.14002d810
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14002d860
add rsp, 0x28
movabs rcx, str.Temp
sub rsp, 0x28
call fcn.14002d860
add rsp, 0x28
push rax
call fcn.14002d9e0
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
sub rsp, 0x20
call fcn.14001d704
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140011a64
add rsp, 0x28
pop rax
mov r15, rax
cmp r15, 0xfffffffffffffffe
jne 0x1400019b7
mov rcx, qword [0x140149300]
push rcx
sub rsp, 0x28
call fcn.14002d810
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14002d860
add rsp, 0x28
movabs rcx, str.Temp
sub rsp, 0x28
call fcn.14002d860
add rsp, 0x28
lea rcx, [0x1401492b0]
pop rdx
call fcn.14002d8d0
push rcx
sub rsp, 0x28
call fcn.14002d810
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
mov rcx, qword [0x140149300]
push rcx
sub rsp, 0x28
call fcn.14002d810
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14002d860
add rsp, 0x28
movabs rcx, str.Sysnativecmd.exe
sub rsp, 0x28
call fcn.14002d860
add rsp, 0x28
push rax
call fcn.14002d9e0
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
sub rsp, 0x20
call fcn.14001d704
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140011a64
add rsp, 0x28
pop rax
mov r15, rax
and r15, r15
jle 0x140001a84
mov rcx, qword [0x140149300]
push rcx
sub rsp, 0x28
call fcn.14002d810
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14002d860
add rsp, 0x28
movabs rcx, str.Sysnative
sub rsp, 0x28
call fcn.14002d860
add rsp, 0x28
lea rcx, [0x140149300]
pop rdx
call fcn.14002d8d0
jmp 0x140001acc
mov rcx, qword [0x140149300]
push rcx
sub rsp, 0x28
call fcn.14002d810
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14002d860
add rsp, 0x28
movabs rcx, str.System32
sub rsp, 0x28
call fcn.14002d860
add rsp, 0x28
lea rcx, [0x140149300]
pop rdx
call fcn.14002d8d0
push rcx
sub rsp, 0x28
call fcn.14002d810
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push qword [0x1401492b0]
push rcx
sub rsp, 0x20
call fcn.14002d810
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.14002d810
add rsp, 0x28
pop rcx
push rax
pop rcx
sub rsp, 0x20
call fcn.140012bd4
add rsp, 0x20
push rax
call fcn.14002d9e0
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14002a7c0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140011a64
add rsp, 0x28
pop rax
mov r15, rax
and r15, r15
jne 0x14000204c
push rcx
sub rsp, 0x28
call fcn.14002d810
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
mov rcx, qword [0x1401492b0]
push rcx
sub rsp, 0x28
call fcn.14002d810
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14002d860
add rsp, 0x28
movabs rcx, 0x1400e1734
sub rsp, 0x28
call fcn.14002d860
add rsp, 0x28
push rcx
sub rsp, 0x20
call fcn.14002d810
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.14002d810
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.14002d810
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.14002d810
add rsp, 0x28
pop rcx
push rax
pop rcx
sub rsp, 0x20
call fcn.140012bd4
add rsp, 0x20
push rax
call fcn.14002d9e0
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14001d5f8
add rsp, 0x20
pop rax
call fcn.14002da70
push rcx
sub rsp, 0x20
call fcn.14002d810
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.14002d810
add rsp, 0x28
pop rcx
push rax
pop rcx
sub rsp, 0x20
call fcn.140012bd4
add rsp, 0x20
push rax
call fcn.14002d9e0
mov rdx, rax
pop rax
add qword [rsp], rdx
push rax
call fcn.14002d9e0
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14001d880
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140011a64
add rsp, 0x28
pop rax
push rcx
sub rsp, 0x28
call fcn.14002d810
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
mov rcx, qword [0x1401492b0]
push rcx
sub rsp, 0x28
call fcn.14002d810
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14002d860
add rsp, 0x28
movabs rcx, 0x1400e1734
sub rsp, 0x28
call fcn.14002d860
add rsp, 0x28
push rcx
sub rsp, 0x20
call fcn.14002d810
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.14002d810
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.14002d810
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.14002d810
add rsp, 0x28
pop rcx
push rax
pop rcx
sub rsp, 0x20
call fcn.140012bd4
add rsp, 0x20
push rax
call fcn.14002d9e0
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14001d5f8
add rsp, 0x20
pop rax
push rax
call fcn.14002d9e0
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
sub rsp, 0x20
call fcn.140012cc4
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140011a64
add rsp, 0x28
pop rax
push 0x1f4
pop rcx
call fcn.14001b8a0
push rcx
sub rsp, 0x28
call fcn.14002d810
add rsp, 0x28
pop rcx
push rax
movabs rcx, 0x1400e12f8
sub rsp, 0x28
call fcn.14002d860
add rsp, 0x28
mov rcx, qword [0x1401492b0]
sub rsp, 0x28
call fcn.14002d860
add rsp, 0x28
movabs rcx, 0x1400e1734
sub rsp, 0x28
call fcn.14002d860
add rsp, 0x28
push rcx
sub rsp, 0x20
call fcn.14002d810
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.14002d810
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.14002d810
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.14002d810
add rsp, 0x28
pop rcx
push rax
pop rcx
sub rsp, 0x20
call fcn.140012bd4
add rsp, 0x20
push rax
call fcn.14002d9e0
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14001d5f8
add rsp, 0x20
pop rax
movabs rcx, 0x1400e12f8
sub rsp, 0x28
call fcn.14002d860
add rsp, 0x28
lea rcx, [0x1401492a0]
pop rdx
call fcn.14002d8d0
push rcx
sub rsp, 0x28
call fcn.14002d810
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14002d810
add rsp, 0x28
pop rcx
push rax
pop rcx
sub rsp, 0x20
call fcn.14001d8a4
add rsp, 0x28
movabs rcx, str.SelfDelete.bat
sub rsp, 0x28
call fcn.14002d860
add rsp, 0x28
lea rcx, [0x140149328]
pop rdx
call fcn.14002d8d0
push qword [0x140149328]
push 0xffffffffffffffff
pop rcx
pop rdx
call fcn.14001e7a0
mov qword [0x1401492f0], rax
movabs rax, str.:debut
push rax
push qword [0x1401492f0]
pop rcx
pop rdx
call fcn.14001ead0
movabs rax, str.timeout__t_3
push rax
push qword [0x1401492f0]
pop rcx
pop rdx
call fcn.14001ead0
push rcx
sub rsp, 0x28
call fcn.14002d810
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14002d810
add rsp, 0x28
pop rcx
push rax
movabs rcx, str.del
sub rsp, 0x28
call fcn.14002d860
add rsp, 0x28
mov rcx, qword [0x1401492a0]
sub rsp, 0x28
call fcn.14002d860
add rsp, 0x28
call fcn.14002da70
push qword [0x1401492f0]
push rax
call fcn.14002d9e0
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14001ead0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140011a64
add rsp, 0x28
pop rax
push rcx
sub rsp, 0x28
call fcn.14002d810
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14002d810
add rsp, 0x28
pop rcx
push rax
movabs rcx, str.If_exist
sub rsp, 0x28
call fcn.14002d860
add rsp, 0x28
mov rcx, qword [0x1401492a0]
sub rsp, 0x28
call fcn.14002d860
add rsp, 0x28
movabs rcx, str._Goto_debut
sub rsp, 0x28
call fcn.14002d860
add rsp, 0x28
call fcn.14002da70
push qword [0x1401492f0]
push rax
call fcn.14002d9e0
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14001ead0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140011a64
add rsp, 0x28
pop rax
movabs rax, str.del__0
push rax
push qword [0x1401492f0]
pop rcx
pop rdx
call fcn.14001ead0
push qword [0x1401492f0]
pop rcx
call fcn.14001e430
push 2
push qword [0x140149328]
pop rcx
pop rdx
call fcn.1400102b9
jmp 0x14000246b
push 0x100
push 0
pop rcx
pop rdx
call fcn.1400107e8
push rcx
sub rsp, 0x28
call fcn.14002d810
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.14002d810
add rsp, 0x20
pop rcx
push rax
movabs rax, 0x1400e1374
push rax
movabs rax, str.BuildLab
push rax
movabs rax, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_NTCurrentVersion
push rax
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.14000885a
add rsp, 0x28
lea rcx, [0x1401492c0]
pop rdx
call fcn.14002d8d0
movabs rax, 0x1400e1374
push rax
push qword [0x1401492c0]
pop rcx
pop rdx
call fcn.14002a7c0
mov qword [0x1401492e8], rax
mov r15, qword [0x1401492e8]
cmp r15, 1
jge 0x1400020ea
jmp 0x140002147
push rcx
sub rsp, 0x28
call fcn.14002d810
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14002d810
add rsp, 0x28
pop rcx
push rax
mov r15, qword [0x1401492e8]
dec r15
mov rax, r15
push rax
push 1
push qword [0x1401492c0]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14002a9f0
add rsp, 0x28
lea rcx, [0x1401492c0]
pop rdx
call fcn.14002d8d0
push qword [0x1401492c0]
pop rcx
call fcn.14002aab0
mov qword [0x140149258], rax
mov r15, qword [0x140149258]
cmp r15, 0x2580
jl 0x140002185
movabs rdx, 0x1400e5b62
lea rcx, [0x140149308]
call fcn.14002d720
jmp 0x1400022a0
mov r15, qword [0x140149258]
cmp r15, 0x23f0
jl 0x1400021ae
mov r15, qword [0x140149258]
cmp r15, 0x2454
jge 0x1400021ae
mov rax, 1
jmp 0x1400021b1
xor rax, rax
and rax, rax
je 0x1400021d1
movabs rdx, 0x1400e145c
lea rcx, [0x140149308]
call fcn.14002d720
jmp 0x1400022a0
mov r15, qword [0x140149258]
cmp r15, 0x1db0
jl 0x1400021fa
mov r15, qword [0x140149258]
cmp r15, 0x1e14
jge 0x1400021fa
mov rax, 1
jmp 0x1400021fd
xor rax, rax
and rax, rax
je 0x14000221d
movabs rdx, 0x1400e1458
lea rcx, [0x140149308]
call fcn.14002d720
jmp 0x1400022a0
mov r15, qword [0x140149258]
cmp r15, 0xa28
jl 0x140002246
mov r15, qword [0x140149258]
cmp r15, 0xbb8
jge 0x140002246
mov rax, 1
jmp 0x140002249
xor rax, rax
and rax, rax
je 0x14000228a
movabs rdx, 0x1400e3790
lea rcx, [0x140149308]
call fcn.14002d720
push 1
push qword [0x140149270]
pop rcx
pop rdx
call fcn.140018a68
push 1
push qword [0x140149278]
pop rcx
pop rdx
call fcn.140018a68
jmp 0x1400022a0
movabs rdx, 0x1400e5b62
lea rcx, [0x140149308]
call fcn.14002d720
push qword [0x1401492d8]
movabs rcx, str.AMD64
pop rdx
call fcn.14002da10
or rax, rax
jne 0x1400022d8
push qword [0x140149318]
movabs rcx, str.AMD64
pop rdx
call fcn.14002da10
or rax, rax
jne 0x1400022d8
jmp 0x1400022e1
mov rax, 1
jmp 0x1400022e4
xor rax, rax
and rax, rax
je 0x140002301
movabs rdx, str.x64WDV
lea rcx, [0x1401492d0]
call fcn.14002d720
jmp 0x140002317
movabs rdx, str.x86WDV
lea rcx, [0x1401492d0]
call fcn.14002d720
push 0xee
push 0x1b0
push 0
push 0
pop rcx
pop rdx
pop r8
pop r9
call fcn.1400024e6
call fcn.14000625e
push rcx
sub rsp, 0x28
call fcn.14002d810
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push 0
push rcx
sub rsp, 0x20
call fcn.14002d810
add rsp, 0x20
pop rcx
push rax
movabs rcx, 0x1400e42d0
sub rsp, 0x20
call fcn.14002d860
add rsp, 0x20
mov rcx, qword [0x1401492b8]
sub rsp, 0x20
call fcn.14002d860
add rsp, 0x20
movabs rcx, 0x1400e21e8
sub rsp, 0x20
call fcn.14002d860
add rsp, 0x20
push rax
call fcn.14002d9e0
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140006442
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140011a64
add rsp, 0x28
pop rax
call fcn.14001bd5c
and rax, rax
je 0x1400023df
jmp 0x1400023d3
call fcn.14001bd5c
mov qword [0x1401492c8], rax
cmp qword [0x1401492c8], 0
je 0x14000244a
call fcn.14001fe64
mov rax, rax
push rax
mov r15, qword [0x1401492e0]
cmp r15, qword [rsp]
jne 0x140002425
sub rsp, 8
push qword [0x1401492c8]
pop rcx
sub rsp, 0x20
call fcn.1400061a0
add rsp, 0x28
jmp 0x140002447
mov qword [0x1401492c8], 0
sub rsp, 8
push 5
pop rcx
sub rsp, 0x20
call fcn.14001b8a0
add rsp, 0x28
pop rax
jmp 0x140002455
push 5
pop rcx
call fcn.14001b8a0
mov r15, qword [0x1401492c8]
cmp r15, 0x333c
jne 0x1400023df
jmp 0x14000246b
call 0x14000248d
call fcn.14002d6f0
mov rcx, qword [0x140149238]
call sub.KERNEL32.dll_HeapDestroy
mov rcx, qword [0x140149248]
call sub.KERNEL32.dll_ExitProcess
sub rsp, 0x28
call fcn.140013afc
call fcn.140015358
call fcn.140015548
call fcn.140016650
call fcn.140018930
call fcn.14001bc64
call fcn.14001d408
call fcn.14001d900
call fcn.14001e510
call fcn.14001fc78
call fcn.140024b00
call fcn.1400262fc
call fcn.14002a3c0
call fcn.14002c8c8
call fcn.14002c948
call fcn.14002c0c0
add rsp, 0x28
ret