Function at 0x401000
Capabilities:
Allocate thread local storage
Query environment variable

Disassembly:
push 0x950
push 0
push 0xa34144
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleW
mov dword [0xa34148], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0xa34144], eax
mov eax, 0x4963db
mov dword [0xa3428c], eax
call fcn.00435900
call fcn.00434de6
call fcn.00434b40
call fcn.00433cd0
call fcn.00432581
call fcn.00431d30
call fcn.00431314
call fcn.0042fa4e
call fcn.0042f750
call fcn.0042f436
call fcn.0042daf6
call fcn.0042d55f
call fcn.0042c2e0
call fcn.0042a586
call fcn.00422d38
call fcn.00421df7
call fcn.0042192f
call fcn.0041ffda
call fcn.0041f556
call fcn.0041f344
mov edx, 0x47f046
lea ecx, [0xa34320]
call fcn.0041d008
mov edx, 0x486bd8
lea ecx, [0xa34428]
call fcn.0041d008
mov edx, 0x484e0e
lea ecx, [0xa342e8]
call fcn.0041d008
mov edx, 0x485b88
lea ecx, [0xa34528]
call fcn.0041d008
mov edx, str.Interface_UA
lea ecx, [0xa341a0]
call fcn.0041d008
mov edx, str.Interface_CN
lea ecx, [0xa34470]
call fcn.0041d008
mov edx, 0x484e0e
lea ecx, [0xa3453c]
call fcn.0041d008
mov edx, 0x489bde
lea ecx, [0xa34198]
call fcn.0041d008
mov edx, 0x4855be
lea ecx, [0xa34480]
call fcn.0041d008
mov edx, str.Giao_di
lea ecx, [0xa344d8]
call fcn.0041d008
mov edx, 0x48880a
lea ecx, [0xa3427c]
call fcn.0041d008
mov edx, str.Interface__CN__by_YanJun_Sun
lea ecx, [0xa343b4]
call fcn.0041d008
mov edx, 0x489bde
lea ecx, [0xa34414]
call fcn.0041d008
mov edx, 0x4869ae
lea ecx, [0xa34580]
call fcn.0041d008
mov edx, 0x48931a
lea ecx, [0xa34190]
call fcn.0041d008
mov edx, 0x487540
lea ecx, [0xa34218]
call fcn.0041d008
mov edx, 0x489e20
lea ecx, [0xa3425c]
call fcn.0041d008
mov edx, 0x48066a
lea ecx, [0xa3423c]
call fcn.0041d008
mov edx, 0x485c0c
lea ecx, [0xa342e4]
call fcn.0041d008
mov edx, 0x4802b4
lea ecx, [0xa343c4]
call fcn.0041d008
mov edx, 0x489ef2
lea ecx, [0xa34274]
call fcn.0041d008
mov edx, 0x480f78
lea ecx, [0xa34564]
call fcn.0041d008
mov edx, 0x4848fe
lea ecx, [0xa34364]
call fcn.0041d008
mov edx, 0x480f2c
lea ecx, [0xa34460]
call fcn.0041d008
mov edx, 0x4803de
lea ecx, [0xa343d4]
call fcn.0041d008
mov edx, 0x4803de
lea ecx, [0xa34188]
call fcn.0041d008
mov edx, 0x482eee
lea ecx, [0xa34348]
call fcn.0041d008
mov edx, 0x47f740
lea ecx, [0xa342c4]
call fcn.0041d008
mov edx, 0x488e1e
lea ecx, [0xa34438]
call fcn.0041d008
mov edx, 0x4801de
lea ecx, [0xa344fc]
call fcn.0041d008
mov edx, 0x4819a2
lea ecx, [0xa34180]
call fcn.0041d008
mov edx, 0x4870f8
lea ecx, [0xa34298]
call fcn.0041d008
mov edx, 0x481c24
lea ecx, [0xa34338]
call fcn.0041d008
mov edx, 0x482ab0
lea ecx, [0xa34314]
call fcn.0041d008
mov edx, 0x4802b4
lea ecx, [0xa343d8]
call fcn.0041d008
mov edx, 0x487e36
lea ecx, [0xa3447c]
call fcn.0041d008
mov edx, 0x486f2a
lea ecx, [0xa34554]
call fcn.0041d008
mov edx, 0x48830e
lea ecx, [0xa3457c]
call fcn.0041d008
mov edx, 0x4888e4
lea ecx, [0xa34378]
call fcn.0041d008
mov edx, 0x47f632
lea ecx, [0xa34420]
call fcn.0041d008
mov edx, 0x482dac
lea ecx, [0xa344d0]
call fcn.0041d008
mov edx, 0x4802b4
lea ecx, [0xa34160]
call fcn.0041d008
mov edx, 0x4888fc
lea ecx, [0xa34430]
call fcn.0041d008
mov edx, 0x481a48
lea ecx, [0xa344dc]
call fcn.0041d008
mov edx, 0x47f72a
lea ecx, [0xa343cc]
call fcn.0041d008
mov edx, 0x489f8a
lea ecx, [0xa3437c]
call fcn.0041d008
mov edx, 0x48578e
lea ecx, [0xa34474]
call fcn.0041d008
mov edx, 0x4864be
lea ecx, [0xa341f4]
call fcn.0041d008
mov edx, 0x480fc4
lea ecx, [0xa34258]
call fcn.0041d008
mov edx, 0x4804ce
lea ecx, [0xa343f4]
call fcn.0041d008
mov edx, 0x480502
lea ecx, [0xa343c8]
call fcn.0041d008
mov edx, 0x484c88
lea ecx, [0xa34540]
call fcn.0041d008
mov edx, str.___:
lea ecx, [0xa34334]
call fcn.0041d008
mov edx, str._______Windows_
lea ecx, [0xa34360]
call fcn.0041d008
mov edx, str._______Office_
lea ecx, [0xa34410]
call fcn.0041d008
mov edx, 0x4870a8
lea ecx, [0xa34518]
call fcn.0041d008
mov edx, 0x48839e
lea ecx, [0xa3418c]
call fcn.0041d008
mov edx, 0x489a4e
lea ecx, [0xa34510]
call fcn.0041d008
mov edx, 0x481b6c
lea ecx, [0xa34578]
call fcn.0041d008
mov edx, 0x4816fa
lea ecx, [0xa342a8]
call fcn.0041d008
mov edx, 0x4862f0
lea ecx, [0xa343f0]
call fcn.0041d008
mov edx, 0x489ea6
lea ecx, [0xa34340]
call fcn.0041d008
mov edx, 0x489816
lea ecx, [0xa34354]
call fcn.0041d008
mov edx, 0x47f1de
lea ecx, [0xa3452c]
call fcn.0041d008
mov edx, 0x481454
lea ecx, [0xa343b8]
call fcn.0041d008
mov edx, str.Microsoft_Office_2010_2013_2016
lea ecx, [0xa34254]
call fcn.0041d008
mov edx, 0x485970
lea ecx, [0xa342ac]
call fcn.0041d008
mov edx, 0x485fb4
lea ecx, [0xa3416c]
call fcn.0041d008
mov edx, 0x4897e0
lea ecx, [0xa3432c]
call fcn.0041d008
mov edx, 0x4862c6
lea ecx, [0xa34278]
call fcn.0041d008
mov edx, 0x481dc4
lea ecx, [0xa34174]
call fcn.0041d008
mov edx, 0x484f20
lea ecx, [0xa3435c]
call fcn.0041d008
mov edx, 0x4896f0
lea ecx, [0xa3448c]
call fcn.0041d008
mov edx, 0x480f00
lea ecx, [0xa34154]
call fcn.0041d008
mov edx, str.Microsoft_Windows_Office
lea ecx, [0xa342b0]
call fcn.0041d008
mov edx, 0x486ae8
lea ecx, [0xa344c8]
call fcn.0041d008
mov edx, 0x483aaa
lea ecx, [0xa34400]
call fcn.0041d008
mov edx, 0x47f046
lea ecx, [0xa343ec]
call fcn.0041d008
mov edx, 0x488bd4
lea ecx, [0xa34390]
call fcn.0041d008
mov edx, 0x486c96
lea ecx, [0xa3454c]
call fcn.0041d008
mov edx, 0x4822da
lea ecx, [0xa343dc]
call fcn.0041d008
mov edx, 0x484784
lea ecx, [0xa342d4]
call fcn.0041d008
mov edx, 0x4897ba
lea ecx, [0xa34384]
call fcn.0041d008
mov edx, str.KMSAuto_Lite_v1.3.1
lea ecx, [0xa3417c]
call fcn.0041d008
mov edx, dword [0xa3417c]
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435990
mov edx, 0x47f3be
push edx
call fcn.00435990
push 0xa342d0
call fcn.004359f0
push edx
call fcn.00435950
pop edx
push eax
mov edx, 0x48626c
push edx
call fcn.00435990
mov edx, dword [0xa3417c]
push edx
call fcn.00435990
mov edx, 0x480ef6
push edx
call fcn.00435990
push 0xa34490
call fcn.004359f0
mov edx, 0x489274
lea ecx, [0xa34370]
call fcn.0041d008
call fcn.00422410
mov ebp, 0x48a010
push ebp
push 0xffffffff
call fcn.0042fb5b
mov dword [0xa341f8], eax
mov ebp, 0x48a36b
push ebp
push 0xffffffff
call fcn.0042fb5b
mov dword [0xa341fc], eax
mov ebp, 0x4916ee
push ebp
push 0xffffffff
call fcn.0042fb5b
mov dword [0xa34200], eax
mov ebp, 0x4918c4
push ebp
push 0xffffffff
call fcn.0042fb5b
mov dword [0xa34204], eax
mov ebp, 0x491aaa
push ebp
push 0xffffffff
call fcn.0042fb5b
mov dword [0xa34208], eax
mov ebp, 0x491e59
push ebp
push 0xffffffff
call fcn.0042fb5b
mov dword [0xa3420c], eax
mov ebp, 0x49218a
push ebp
push 0xffffffff
call fcn.0042fb5b
mov dword [0xa34214], eax
mov ebp, 0x495536
push ebp
push 0xffffffff
call fcn.0042fb5b
mov dword [0xa3421c], eax
mov ebp, 0x495913
push ebp
push 0xffffffff
call fcn.0042fb5b
mov dword [0xa34224], eax
mov ebp, 0x495e29
push ebp
push 0xffffffff
call fcn.0042fb5b
mov dword [0xa3422c], eax
push 8
mov eax, str.Microsoft_Sans_Serif
push eax
push 0
call fcn.00434ee0
push 8
mov eax, str.Lucida_Console
push eax
push 1
call fcn.00434ee0
mov edx, str.KMS_Service_v1.1.9XP
lea ecx, [0xa343d0]
call fcn.0041d008
mov edx, 0x47f046
lea ecx, [0xa341f0]
call fcn.0041d008
mov edx, 0x47f046
lea ecx, [0xa341d8]
call fcn.0041d008
mov edx, 0x47f046
lea ecx, [0xa34374]
call fcn.0041d008
mov edx, 0x47f046
lea ecx, [0xa34388]
call fcn.0041d008
mov edx, 0x47f046
lea ecx, [0xa34284]
call fcn.0041d008
mov edx, 0x47f046
lea ecx, [0xa34574]
call fcn.0041d008
mov edx, 0x47f046
lea ecx, [0xa34380]
call fcn.0041d008
mov edx, 0x47f046
lea ecx, [0xa341c8]
call fcn.0041d008
mov edx, 0x47f046
lea ecx, [0xa34570]
call fcn.0041d008
mov edx, 0x47f046
lea ecx, [0xa341bc]
call fcn.0041d008
mov dword [0xa34238], 0xffffffff
mov dword [0xa34280], 0xffffffff
mov dword [0xa34478], 0xffffffff
mov edx, 0x47f046
lea ecx, [0xa34538]
call fcn.0041d008
mov dword [0xa343e0], 0
mov edx, 0x47f046
lea ecx, [0xa34330]
call fcn.0041d008
mov dword [0xa34288], 0
mov dword [0xa34530], 0
mov dword [0xa34544], 0x64
mov dword [0xa34548], 0x64
mov edx, dword [0xa341f4]
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435990
push 0xa343fc
call fcn.004359f0
mov edx, 0x47f046
lea ecx, [0xa34444]
call fcn.0041d008
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435950
pop edx
push eax
push 0x64
call fcn.0041dcb0
push 0xa3415c
call fcn.004359f0
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435950
pop edx
push eax
push 0x3e8
call fcn.0041dcb0
push 0xa344b8
call fcn.004359f0
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435950
pop edx
push eax
push 0x3e8
call fcn.0041dcb0
push 0xa34514
call fcn.004359f0
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435950
pop edx
push eax
push 0x3e8
call fcn.0041dcb0
push 0xa34294
call fcn.004359f0
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435950
pop edx
push eax
push 0xc8
call fcn.0041dcb0
push 0xa34448
call fcn.004359f0
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435950
pop edx
push eax
push 0xc8
call fcn.0041dcb0
push 0xa34534
call fcn.004359f0
mov edx, 0x47f046
lea ecx, [0xa3451c]
call fcn.0041d008
mov edx, str._Integrated_KMS_Service_
lea ecx, [0xa34240]
call fcn.0041d008
mov edx, str.127.0.0.2
lea ecx, [0xa34250]
call fcn.0041d008
mov edx, dword [0xa34240]
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435990
push 0xa343c0
call fcn.004359f0
mov edx, str.100.100.0.10
lea ecx, [0xa3431c]
call fcn.0041d008
mov edx, 0x47f046
lea ecx, [0xa34408]
call fcn.0041d008
mov edx, 0x47f046
lea ecx, [0xa34440]
call fcn.0041d008
mov edx, dword [0xa3431c]
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435990
push 0xa3430c
call fcn.004359f0
mov edx, 0x4898a0
lea ecx, [0xa342c0]
call fcn.0041d008
mov dword [0xa34484], 0
mov byte [0xa3461c], 0
mov dword [0xa34524], 0
mov edx, 0x47f046
lea ecx, [0xa34248]
call fcn.0041d008
mov edx, 0x47f046
lea ecx, [0xa34194]
call fcn.0041d008
mov edx, dword [0xa342c0]
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435990
push 0xa3433c
call fcn.004359f0
mov edx, str.KMSAutoLite.ini
lea ecx, [0xa34350]
call fcn.0041d008
mov dword [0xa34150], 0
mov dword [0xa342d8], 0
mov edx, str.__by_Default_
lea ecx, [0xa344b0]
call fcn.0041d008
mov edx, str.RandomKMSPID
lea ecx, [0xa34264]
call fcn.0041d008
mov dword [0xa34a18], 5
mov dword [0xa34a1c], 2
push 0xa34a14
push 0x489fe0
push 8
push 4
push 2
call fcn.0042f500
mov dword [0xa34a24], 0xc
mov dword [0xa34a28], 2
push 0xa34a20
push 0x489fe0
push 8
push 4
push 2
call fcn.0042f500
mov edx, 0x47f046
lea ecx, [0xa343ec]
call fcn.0041d008
mov edx, 0x47f046
lea ecx, [0xa34520]
call fcn.0041d008
mov edx, 0x47f046
lea ecx, [0xa34550]
call fcn.0041d008
mov edx, 0x47f046
lea ecx, [0xa34358]
call fcn.0041d008
mov edx, 0x47f046
lea ecx, [0xa34260]
call fcn.0041d008
mov edx, 0x47f046
lea ecx, [0xa34560]
call fcn.0041d008
mov edx, 0x47f046
lea ecx, [0xa3434c]
call fcn.0041d008
mov edx, 0x47f046
lea ecx, [0xa344ac]
call fcn.0041d008
mov edx, 0x47f046
lea ecx, [0xa34450]
call fcn.0041d008
mov byte [0xa3461d], 0
mov byte [0xa3461e], 0
mov edx, str.30d_00h_00m
lea ecx, [0xa3436c]
call fcn.0041d008
push 0x64
mov eax, dword [0xa3415c]
push eax
mov eax, 0x481d2e
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0x3e8
mov eax, dword [0xa344b8]
push eax
mov eax, str.TEMP
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0x3e8
mov eax, dword [0xa34514]
push eax
mov eax, 0x485f72
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0x3e8
mov eax, dword [0xa34448]
push eax
mov eax, str.PROCESSOR_ARCHITECTURE
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0x3e8
mov eax, dword [0xa34534]
push eax
mov eax, str.PROCESSOR_ARCHITEW6432
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0x3e8
mov eax, dword [0xa34294]
push eax
mov eax, str.ALLUSERSPROFILE
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
mov edx, dword [0xa34514]
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435990
push 0xa34194
call fcn.004359f0
mov edx, dword [0xa34194]
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435990
mov edx, str.KMS
push edx
call fcn.00435990
push 0xa341ec
call fcn.004359f0
mov edx, 0x47f046
lea ecx, [0xa3424c]
call fcn.0041d008
push dword [0xa34448]
mov edx, str.AMD64
pop ecx
call fcn.0041d320
jne 0x401cdf
push dword [0xa34534]
mov edx, str.AMD64
pop ecx
call fcn.0041d320
jne 0x401cdf
jmp 0x401ce6
mov eax, 1
jmp 0x401ce8
xor eax, eax
and eax, eax
je 0x401cfe
mov edx, str.x64WDV
lea ecx, [0xa34444]
call fcn.0041d008
jmp 0x401d0e
mov edx, str.x86WDV
lea ecx, [0xa34444]
call fcn.0041d008
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435950
pop edx
push eax
push dword [0xa34194]
call fcn.0041dd00
call fcn.00435a80
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435950
pop edx
push eax
call fcn.0041f585
call fcn.0041d372
add dword [esp], edx
call fcn.0042b750
call fcn.0041d372
add dword [esp], edx
call fcn.0041dd00
call fcn.0041d372
add dword [esp], edx
call fcn.0041d372
add dword [esp + 4], edx
call fcn.0041dde0
call fcn.0041d390
mov ebx, eax
and ebx, ebx
jle 0x401dd4
mov edx, dword [0xa34194]
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435990
mov edx, str.KMSAutoS
push edx
call fcn.00435990
push 0xa3424c
call fcn.004359f0
jmp 0x401e7c
push edx
call fcn.00435950
pop edx
push eax
mov edx, dword [0xa34194]
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435990
mov edx, str.Temp
push edx
call fcn.00435990
call fcn.0041d372
add dword [esp], edx
call fcn.0042b7cf
call fcn.0041d390
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x401e1b
cmp edi, 0xffffffff
je 0x401e1f
xor eax, eax
jmp 0x401e24
mov eax, 1
or eax, eax
je 0x401e53
mov edx, dword [0xa34194]
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435990
mov edx, str.TempKMSAuto
push edx
call fcn.00435990
push 0xa3424c
call fcn.004359f0
jmp 0x401e7c
mov edx, dword [0xa344b8]
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435990
mov edx, str.KMSAuto
push edx
call fcn.00435990
push 0xa3424c
call fcn.004359f0
push edx
call fcn.00435950
pop edx
push eax
mov edx, dword [0xa34514]
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435990
mov edx, 0x488dec
push edx
call fcn.00435990
call fcn.0041d372
add dword [esp], edx
call fcn.0042b7cf
call fcn.0041d390
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x401ec9
jl 0x401ec5
cmp ebx, 0
ja 0x401ec9
xor eax, eax
jmp 0x401ece
mov eax, 1
or eax, eax
je 0x401efd
mov edx, dword [0xa34514]
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435990
mov edx, 0x480982
push edx
call fcn.00435990
push 0xa34514
call fcn.004359f0
jmp 0x401f26
mov edx, dword [0xa34514]
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435990
mov edx, 0x4841b4
push edx
call fcn.00435990
push 0xa34514
call fcn.004359f0
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435950
pop edx
push eax
call fcn.0041f585
call fcn.0041d372
add dword [esp], edx
call fcn.0042b750
mov edx, str.KMSAutoLite.ini
push edx
call fcn.00435990
call fcn.0041d372
add dword [esp], edx
call fcn.004203d7
call fcn.0041d390
and eax, eax
je 0x401fbc
mov eax, 0x47fee6
push eax
call fcn.00420415
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435950
pop edx
push eax
mov eax, 0x47f046
push eax
mov eax, 0x489e38
push eax
call fcn.00420509
push 0xa34320
call fcn.004359f0
call fcn.004205fd
push dword [0xa34320]
mov edx, 0x4803d8
pop ecx
call fcn.0041d320
je 0x401fe4
mov edx, 0x485950
lea ecx, [0xa34320]
call fcn.0041d008
jmp 0x402076
push dword [0xa34320]
mov edx, 0x482010
pop ecx
call fcn.0041d320
je 0x402009
mov edx, 0x484818
lea ecx, [0xa34320]
call fcn.0041d008
jmp 0x402076
push dword [0xa34320]
mov edx, 0x482d32
pop ecx
call fcn.0041d320
je 0x40202e
mov edx, 0x486ac2
lea ecx, [0xa34320]
call fcn.0041d008
jmp 0x402076
push dword [0xa34320]
mov edx, 0x4819ee
pop ecx
call fcn.0041d320
je 0x402053
mov edx, str.0422
lea ecx, [0xa34320]
call fcn.0041d008
jmp 0x402076
push dword [0xa34320]
mov edx, 0x480ce6
pop ecx
call fcn.0041d320
je 0x402076
mov edx, str.0804
lea ecx, [0xa34320]
call fcn.0041d008
push dword [0xa34320]
mov edx, 0x47f046
pop ecx
call fcn.0041d320
je 0x4020cf
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435950
pop edx
push eax
mov eax, 0x47f77a
push eax
mov eax, 0x47f056
push eax
mov eax, 0x48119a
push eax
call fcn.0041820c
call fcn.0041d372
add dword [esp], edx
call fcn.0041dd00
push 0xa34320
call fcn.004359f0
push dword [0xa34320]
mov edx, 0x484818
pop ecx
call fcn.0041d320
je 0x4020f2
mov eax, 0x482010
push eax
call fcn.00411fdd
jmp 0x40217d
push dword [0xa34320]
mov edx, 0x485950
pop ecx
call fcn.0041d320
je 0x402112
mov eax, 0x4803d8
push eax
call fcn.00411fdd
jmp 0x40217d
push dword [0xa34320]
mov edx, 0x486ac2
pop ecx
call fcn.0041d320
je 0x402132
mov eax, 0x482d32
push eax
call fcn.00411fdd
jmp 0x40217d
push dword [0xa34320]
mov edx, str.0422
pop ecx
call fcn.0041d320
je 0x402152
mov eax, 0x4819ee
push eax
call fcn.00411fdd
jmp 0x40217d
push dword [0xa34320]
mov edx, str.0804
pop ecx
call fcn.0041d320
je 0x402172
mov eax, 0x480ce6
push eax
call fcn.00411fdd
jmp 0x40217d
mov eax, 0x482010
push eax
call fcn.00411fdd
push 0x100
push 0
call fcn.0041ce96
push edx
call fcn.00435950
pop edx
push eax
mov eax, 0x47f77a
push eax
mov eax, 0x488a82
push eax
mov eax, 0x48082c
push eax
call fcn.0041820c
mov edx, str._________
push edx
call fcn.00435990
push 0xa343ec
call fcn.004359f0
push edx
call fcn.00435950
pop edx
push eax
mov eax, 0x47f77a
push eax
mov eax, str.EditionID
push eax
mov eax, 0x48082c
push eax
call fcn.0041820c
push 0xa34520
call fcn.004359f0
push edx
call fcn.00435950
pop edx
push eax
mov eax, 0x47f77a
push eax
mov eax, 0x4806f6
push eax
mov eax, 0x48082c
push eax
call fcn.0041820c
push 0xa3440c
call fcn.004359f0
mov eax, 0x47f77a
push eax
push dword [0xa3440c]
call fcn.0041dde0
mov dword [0xa34488], eax
mov ebx, dword [0xa34488]
cmp ebx, 1
jge 0x402235
jmp 0x402267
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435950
pop edx
push eax
mov ebx, dword [0xa34488]
dec ebx
push ebx
push 1
push dword [0xa3440c]
call fcn.0041de40
push 0xa3440c
call fcn.004359f0
push dword [0xa3440c]
call fcn.0041df20
mov dword [0xa34168], eax
mov ebx, dword [0xa34168]
cmp ebx, 0x2580
jl 0x40229a
mov edx, 0x489668
lea ecx, [0xa3451c]
call fcn.0041d008
jmp 0x40237e
mov ebx, dword [0xa34168]
cmp ebx, 0x23f0
jl 0x4022bd
mov ebx, dword [0xa34168]
cmp ebx, 0x2454
jge 0x4022bd
mov eax, 1
jmp 0x4022bf
xor eax, eax
and eax, eax
je 0x4022d8
mov edx, 0x47f968
lea ecx, [0xa3451c]
call fcn.0041d008
jmp 0x40237e
mov ebx, dword [0xa34168]
cmp ebx, 0x1db0
jl 0x4022fb
mov ebx, dword [0xa34168]
cmp ebx, 0x1e14
jge 0x4022fb
mov eax, 1
jmp 0x4022fd
xor eax, eax
and eax, eax
je 0x402313
mov edx, 0x47f936
lea ecx, [0xa3451c]
call fcn.0041d008
jmp 0x40237e
mov ebx, dword [0xa34168]
cmp ebx, 0xa28
jl 0x402336
mov ebx, dword [0xa34168]
cmp ebx, 0xfa0
jge 0x402336
mov eax, 1
jmp 0x402338
xor eax, eax
and eax, eax
je 0x40236e
mov edx, 0x4846ae
lea ecx, [0xa3451c]
call fcn.0041d008
push 1
push dword [0xa341a4]
call fcn.00422daa
push 1
push dword [0xa341b8]
call fcn.00422daa
jmp 0x40237e
mov edx, 0x489668
lea ecx, [0xa3451c]
call fcn.0041d008
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435950
pop edx
push eax
call fcn.0041f585
call fcn.0041d372
add dword [esp], edx
call fcn.0042b9d6
call fcn.00435a80
push 1
push 0
push dword [0xa34508]
call fcn.0041d372
add dword [esp + 0xc], edx
call sub.KERNEL32.dll_CreateSemaphoreW
call fcn.0041d390
mov dword [0xa34184], eax
mov ebx, dword [0xa34184]
and ebx, ebx
je 0x402405
call sub.KERNEL32.dll_GetLastError
mov ebx, eax
cmp ebx, 0xb7
jne 0x402405
mov eax, 1
jmp 0x402407
xor eax, eax
and eax, eax
je 0x402431
push 0
push dword [0xa34390]
mov eax, str.KMSAuto_Lite
push eax
call fcn.0041f37d
push dword [0xa34184]
call sub.KERNEL32.dll_CloseHandle
jmp 0x402eaf
push 3
mov eax, 0x47f046
push eax
push dword [0xa3424c]
call fcn.0042b9e8
call fcn.0040d36f
push edx
call fcn.00435950
pop edx
push eax
call fcn.00411999
push 0xa34440
call fcn.004359f0
call fcn.0040c13d
call fcn.0041f5e6
mov ebx, eax
dec ebx
mov dword [0xa34234], ebx
mov ebx, dword [0xa34234]
and ebx, ebx
jl 0x402677
mov dword [0xa34424], 0
jmp 0x402490
mov eax, dword [0xa34234]
cmp eax, dword [0xa34424]
jl 0x402578
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435950
pop edx
push eax
push dword [0xa34424]
call fcn.0041f5f9
call fcn.0041d372
add dword [esp], edx
call fcn.0041dd00
push 0xa3444c
call fcn.004359f0
push dword [0xa3444c]
mov edx, str._OFSCONV15
mov ecx, dword [esp]
call fcn.0041d320
je 0x4024ff
call fcn.00415923
jmp 0x40256b
mov edx, str._OFSCONV16
mov ecx, dword [esp]
call fcn.0041d320
je 0x402515
call fcn.004159db
jmp 0x40256b
mov edx, str._WINGVLKINST
mov ecx, dword [esp]
call fcn.0041d320
je 0x40252b
call fcn.0040ec2a
jmp 0x40256b
mov edx, str._OFSGVLKINST
mov ecx, dword [esp]
call fcn.0041d320
je 0x402541
call fcn.004052e0
jmp 0x40256b
mov edx, str._SCHEDWIN
mov ecx, dword [esp]
call fcn.0041d320
je 0x402557
call fcn.0040fe2f
jmp 0x40256b
mov edx, str._SCHEDOFS
mov ecx, dword [esp]
call fcn.0041d320
je 0x40256b
call fcn.0040db49
pop eax
inc dword [0xa34424]
jno 0x402490
mov dword [0xa34424], 0
jmp 0x402584
mov eax, dword [0xa34234]
cmp eax, dword [0xa34424]
jl 0x402610
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435950
pop edx
push eax
push dword [0xa34424]
call fcn.0041f5f9
call fcn.0041d372
add dword [esp], edx
call fcn.0041dd00
push 0xa3444c
call fcn.004359f0
push dword [0xa3444c]
mov edx, str._WINACT
mov ecx, dword [esp]
call fcn.0041d320
je 0x4025ef
call fcn.0040c78a
jmp 0x402603
mov edx, str._OFSACT
mov ecx, dword [esp]
call fcn.0041d320
je 0x402603
call fcn.00406edf
pop eax
inc dword [0xa34424]
jno 0x402584
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435950
pop edx
push eax
call fcn.0041f585
call fcn.0041d372
add dword [esp], edx
call fcn.0042b750
call fcn.0041d372
add dword [esp], edx
call fcn.0042bcbd
call fcn.0041d390
push 3
mov eax, 0x47f046
push eax
push dword [0xa3424c]
call fcn.0042b9e8
jmp 0x402eaf
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435950
pop edx
push eax
call fcn.0041f585
call fcn.0041d372
add dword [esp], edx
call fcn.0042b750
mov edx, str.KMSAutoLite.ini
push edx
call fcn.00435990
call fcn.0041d372
add dword [esp], edx
call fcn.004203d7
call fcn.0041d390
and eax, eax
je 0x40270c
mov eax, 0x47fee6
push eax
call fcn.00420415
push 0x64
mov eax, str.PosX
push eax
call fcn.0042060f
mov dword [0xa34544], eax
push 0x64
mov eax, str.PosY
push eax
call fcn.0042060f
mov dword [0xa34548], eax
call fcn.004205fd
push 0x206
push 0x1d0
push dword [0xa34548]
push dword [0xa34544]
call fcn.00403047
push dword [0xa3451c]
call fcn.0040e1cc
mov eax, str.43200
push eax
push dword [0xa34210]
call fcn.00422dd5
mov eax, str.43200
push eax
push dword [0xa34244]
call fcn.00422dd5
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435950
pop edx
push eax
mov edx, 0x480b7c
push edx
call fcn.00435990
mov edx, dword [0xa34258]
push edx
call fcn.00435990
mov edx, 0x47f020
push edx
call fcn.00435990
mov edx, dword [0xa343f4]
push edx
call fcn.00435990
mov edx, 0x47f020
push edx
call fcn.00435990
mov edx, dword [0xa343c8]
push edx
call fcn.00435990
call fcn.00435a80
push dword [0xa34210]
call fcn.0041d372
add dword [esp + 4], edx
call fcn.00422e20
call fcn.0041d390
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435950
pop edx
push eax
mov edx, 0x480b7c
push edx
call fcn.00435990
mov edx, dword [0xa34258]
push edx
call fcn.00435990
mov edx, 0x47f020
push edx
call fcn.00435990
mov edx, dword [0xa343f4]
push edx
call fcn.00435990
mov edx, 0x47f020
push edx
call fcn.00435990
mov edx, dword [0xa343c8]
push edx
call fcn.00435990
call fcn.00435a80
push dword [0xa34244]
call fcn.0041d372
add dword [esp + 4], edx
call fcn.00422e20
call fcn.0041d390
push 1
push dword [0xa341e4]
call fcn.00422fce
push 1
push dword [0xa341b8]
call fcn.00422fce
push 1
push dword [0xa341c0]
call fcn.00422fce
push 1
push dword [0xa34220]
call fcn.00422fce
push 1
push dword [0xa341e8]
call fcn.00422fce
push 1
push dword [0xa341c4]
call fcn.00422fce
push 1
push dword [0xa341cc]
call fcn.00422fce
push 1
push dword [0xa341d0]
call fcn.00422fce
push 1
push dword [0xa34464]
call fcn.00422fce
push 1
push dword [0xa34418]
call fcn.00422fce
push 1
push dword [0xa341d4]
call fcn.00422fce
push 1
push dword [0xa344c0]
call fcn.00422fce
push 1
push dword [0xa34158]
call fcn.00422fce
push 1
push dword [0xa341dc]
call fcn.00422fce
push 1
push dword [0xa342ec]
call fcn.0042300c
push dword [0xa342ec]
call fcn.00423044
mov byte [0xa3461f], al
push dword [0xa342f0]
call fcn.00423044
mov byte [0xa34620], al
push dword [0xa342f4]
call fcn.00423044
mov byte [0xa34621], al
call fcn.00414764
push dword [0xa3451c]
mov edx, 0x4846ae
pop ecx
call fcn.0041d320
jne 0x402a62
push dword [0xa343c0]
mov edx, dword [0xa34240]
pop ecx
call fcn.0041d320
je 0x402a40
push 0
push dword [0xa342b8]
call fcn.00422fce
push dword [0xa342b8]
call fcn.00423044
mov ebx, eax
and ebx, ebx
jle 0x402a1d
push edx
call fcn.00435950
pop edx
push eax
mov edx, dword [0xa34384]
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435990
mov edx, 0x484938
push edx
call fcn.00435990
mov edx, dword [0xa34440]
push edx
call fcn.00435990
mov edx, 0x47f19a
push edx
call fcn.00435990
call fcn.00435a80
push dword [0xa342b8]
call fcn.0041d372
add dword [esp + 4], edx
call fcn.00422dd5
call fcn.0041d390
push 0
push dword [0xa342a4]
call fcn.00422fce
jmp 0x402a3e
push 1
push dword [0xa342a4]
call fcn.00422fce
push dword [0xa34384]
push dword [0xa342b8]
call fcn.00422dd5
jmp 0x402a60
push 1
push dword [0xa342b8]
call fcn.00422fce
push 1
push dword [0xa342a4]
call fcn.00422fce
jmp 0x402a8c
mov dword [0xa34484], 0
push 1
push dword [0xa342b8]
call fcn.00422fce
push 1
push dword [0xa342a4]
call fcn.00422fce
push dword [0xa34220]
call fcn.00423044
mov ebx, eax
cmp ebx, 1
jne 0x402ab0
mov edx, str.__FORC
lea ecx, [0xa34248]
call fcn.0041d008
jmp 0x402ac0
mov edx, 0x47f046
lea ecx, [0xa34248]
call fcn.0041d008
push dword [0xa3451c]
mov edx, 0x4846ae
pop ecx
call fcn.0041d320
je 0x402af3
push 1
push dword [0xa341a4]
call fcn.00422daa
push 1
push dword [0xa34228]
call fcn.00422daa
push dword [0xa34490]
call fcn.00415a93
mov eax, 0x47f046
push eax
call fcn.00415a93
push dword [0xa3451c]
mov edx, 0x4846ae
pop ecx
call fcn.0041d320
jne 0x402be5
movsx ebx, byte [0xa3461d]
cmp ebx, 1
jne 0x402b3e
movsx ebx, byte [0xa3461e]
and ebx, ebx
jne 0x402b3e
mov eax, 1
jmp 0x402b40
xor eax, eax
and eax, eax
je 0x402b54
push dword [0xa34360]
call fcn.00415a93
jmp 0x402be5
movsx ebx, byte [0xa3461d]
cmp ebx, 1
jne 0x402b73
movsx ebx, byte [0xa3461e]
cmp ebx, 1
jne 0x402b73
mov eax, 1
jmp 0x402b75
xor eax, eax
and eax, eax
je 0x402b91
push dword [0xa34360]
call fcn.00415a93
push dword [0xa34410]
call fcn.00415a93
jmp 0x402be5
movsx ebx, byte [0xa3461d]
and ebx, ebx
jne 0x402baf
movsx ebx, byte [0xa3461e]
cmp ebx, 1
jne 0x402baf
mov eax, 1
jmp 0x402bb1
xor eax, eax
and eax, eax
je 0x402bc2
push dword [0xa34410]
call fcn.00415a93
jmp 0x402be5
movsx ebx, byte [0xa3461d]
and ebx, ebx
jne 0x402bdf
movsx ebx, byte [0xa3461e]
and ebx, ebx
jne 0x402bdf
mov eax, 1
jmp 0x402be1
xor eax, eax
and eax, eax
je 0x402be5
mov ebx, dword [0xa34530]
and ebx, ebx
jle 0x402c16
call fcn.004063e8
push 1
push dword [0xa3455c]
call fcn.00422daa
push 0
push dword [0xa344cc]
call fcn.00422daa
jmp 0x402c36
push 0
push dword [0xa3455c]
call fcn.00422daa
push 1
push dword [0xa344cc]
call fcn.00422daa
push 1
push dword [0xa342dc]
call fcn.00422daa
push 0xffffffff
push 0
push 0
push 1
push 1
push dword [0xa3424c]
call fcn.00408b2a
push dword [0xa3451c]
mov edx, 0x4846ae
pop ecx
call fcn.0041d320
jne 0x402c88
push dword [0xa3424c]
call fcn.0041076c
call fcn.0042a5de
mov dword [0xa3443c], eax
cmp dword [0xa3443c], 0
je 0x402cd0
call fcn.0042d67c
push eax
mov ebx, dword [0xa34468]
cmp ebx, dword [esp]
jne 0x402cb9
push dword [0xa3443c]
call fcn.0040ef6d
jmp 0x402ccd
mov dword [0xa3443c], 0
push 5
call fcn.0042a203
pop eax
jmp 0x402cda
push 5
call fcn.0042a203
mov ebx, dword [0xa3443c]
cmp ebx, 0x333c
jne 0x402c88
call fcn.00405595
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435950
pop edx
push eax
call fcn.0041f585
call fcn.0041d372
add dword [esp], edx
call fcn.0042b750
call fcn.0041d372
add dword [esp], edx
call fcn.0042bcbd
call fcn.0041d390
push edx
call fcn.00435950
pop edx
push eax
push 2
mov edx, dword [0xa344b8]
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435990
mov edx, str._test.dat
push edx
call fcn.00435990
call fcn.0041d372
add dword [esp], edx
call fcn.0042bccf
call fcn.0041d390
push 3
mov eax, 0x47f046
push eax
push dword [0xa3424c]
call fcn.0042b9e8
mov dword [0xa3456c], 0
push edx
call fcn.00435950
pop edx
push eax
call fcn.0041c478
push 0xa34170
call fcn.004359f0
push 1
mov eax, str.MSActBackup
push eax
push dword [0xa34170]
call fcn.0041dd70
mov ebx, eax
and ebx, ebx
jle 0x402dd4
mov dword [0xa3456c], 1
push dword [0xa34170]
mov edx, 0x47f046
pop ecx
call fcn.0041d320
je 0x402d97
mov ebx, dword [0xa3456c]
and ebx, ebx
jne 0x402eaf
push edx
call fcn.00435950
pop edx
push eax
push 2
mov edx, dword [0xa344b8]
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435990
mov edx, str.MSActBackup.exe
push edx
call fcn.00435990
call fcn.0041d372
add dword [esp], edx
call fcn.0042bccf
call fcn.0041d390
push edx
call fcn.00435950
pop edx
push eax
push 2
mov edx, dword [0xa344b8]
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435990
mov edx, 0x489910
push edx
call fcn.00435990
call fcn.0041d372
add dword [esp], edx
call fcn.0042bccf
call fcn.0041d390
push edx
call fcn.00435950
pop edx
push eax
push 2
mov edx, dword [0xa344b8]
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435990
mov edx, str.MSActBackUpPath.ini
push edx
call fcn.00435990
call fcn.0041d372
add dword [esp], edx
call fcn.0042bccf
call fcn.0041d390
push 0
call 0x402ece
call fcn.00435930
push dword [0xa34144]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess
call fcn.0041ffc8
call fcn.00420e2f
call fcn.00421deb
call fcn.00422d1d
call fcn.0042a56f
call fcn.0042bd0b
call fcn.0042c2d0
call fcn.0042d896
call fcn.0042fa42
call fcn.00431307
call fcn.00434b60
call fcn.00434f37
call fcn.00433cc0
ret