Function at 0x4029de
Capabilities:
Listen for remote procedure calls

Disassembly:
sub esp, 0xa4
lea eax, [esp + 0x4c]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
call fcn.00401937
xor edx, edx
mov ecx, 0x9e
div ecx
mov ax, word [edx*2 + 0x404458]
mov word [0x4099ec], ax
call fcn.00401937
and eax, 3
xor ebx, ebx
mov dword [0x4099e8], eax
cmp dword [0x4097c0], ebx
je 0x402a76
push 0x4037b7
push str.KMSEmulator
mov dword [0x4099f4], 0x30
mov dword [0x4099f8], 2
mov dword [0x4099fc], 5
mov dword [0x409a00], ebx
mov dword [0x409a04], ebx
mov dword [0x409a08], ebx
mov dword [0x409a0c], ebx
call dword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerA]
mov dword [0x4097d8], eax
test eax, eax
je 0x402e08
lea edx, [esp + 4]
mov ecx, str._Port
call fcn.00402723
test eax, eax
je 0x402aab
push dword [esp + 4]
lea eax, [esp + 0xc]
push 0x4067c4
push 6
push eax
call fcn.004017ec
lea eax, [esp + 0x18]
add esp, 0x10
mov dword [str.1688], eax
jmp 0x402ab0
mov eax, dword [str.1688]
push ebx
push eax
push 0xa
push str.ncacn_ip_tcp
call dword [sym.imp.RPCRT4.dll_RpcServerUseProtseqEpA]
mov ecx, 0x6aa
cmp eax, ecx
je 0x402e10
push esi
lea esi, [ecx + 0x22]
cmp eax, esi
je 0x402e15
test eax, eax
je 0x402ae3
mov ecx, eax
jmp 0x402e31
push ebx
push 0x4d2
push 0x11
push ebx
push ebx
push 0x4042f8
call dword [sym.imp.RPCRT4.dll_RpcServerRegisterIfEx]
test eax, eax
jne 0x402adc
push ebp
mov ebp, str._PWin
push edi
lea edx, [esp + 0x10]
mov ecx, ebp
call fcn.00402723
mov esi, dword [sym.imp.msvcrt.dll_void____cdecl_operator_new_unsigned_int_]
push 0x40
pop edi
test eax, eax
je 0x402b43
push edi
lea edx, [esp + 0x20]
mov ecx, ebp
call fcn.00402642
push edi
call esi
pop ecx
lea edx, [esp + 0x20]
pop ecx
mov ecx, edx
mov dword [str.05426_00206_471_234034_03_1031_9200.0000_1802021], eax
sub eax, ecx
mov cl, byte [edx]
mov byte [eax + edx], cl
inc edx
test cl, cl
jne 0x402b39
mov ebp, str._PO14
lea edx, [esp + 0x10]
mov ecx, ebp
call fcn.00402723
test eax, eax
je 0x402b7f
push edi
lea edx, [esp + 0x20]
mov ecx, ebp
call fcn.00402642
push edi
call esi
pop ecx
lea edx, [esp + 0x20]
pop ecx
mov ecx, edx
mov dword [str.03612_00096_199_655428_03_1042_9200.0000_2212016], eax
sub eax, ecx
mov cl, byte [edx]
mov byte [eax + edx], cl
inc edx
test cl, cl
jne 0x402b75
mov ebp, str._PO15
lea edx, [esp + 0x10]
mov ecx, ebp
call fcn.00402723
test eax, eax
je 0x402bbb
push edi
lea edx, [esp + 0x20]
mov ecx, ebp
call fcn.00402642
push edi
call esi
pop ecx
lea edx, [esp + 0x20]
pop ecx
mov ecx, edx
mov dword [str.03612_00206_234_449523_03_1042_9200.0000_2322016], eax
sub eax, ecx
mov cl, byte [edx]
mov byte [eax + edx], cl
inc edx
test cl, cl
jne 0x402bb1
mov ebp, str._PO16
lea edx, [esp + 0x10]
mov ecx, ebp
call fcn.00402723
test eax, eax
je 0x402bf7
push edi
lea edx, [esp + 0x20]
mov ecx, ebp
call fcn.00402642
push edi
call esi
pop ecx
lea edx, [esp + 0x20]
pop ecx
mov ecx, edx
mov dword [str.03612_00206_680_565890_03_1042_17134.0000_1772021], eax
sub eax, ecx
mov cl, byte [edx]
mov byte [eax + edx], cl
inc edx
test cl, cl
jne 0x402bed
mov ebp, str._Hwid
lea edx, [esp + 0x10]
mov ecx, ebp
call fcn.00402723
test eax, eax
je 0x402c33
push edi
lea edx, [esp + 0x20]
mov ecx, ebp
call fcn.00402642
push edi
call esi
pop ecx
lea edx, [esp + 0x20]
pop ecx
mov ecx, edx
mov dword [str.DF279A0090B8D83E], eax
sub eax, ecx
mov cl, byte [edx]
mov byte [eax + edx], cl
inc edx
test cl, cl
jne 0x402c29
lea edx, [esp + 0x10]
mov ecx, 0x406824
call fcn.00402723
mov ecx, dword [0x4097ac]
test eax, eax
cmovne ecx, dword [esp + 0x10]
mov dword [0x4097ac], ecx
lea edx, [esp + 0x10]
mov ecx, 0x406828
call fcn.00402723
mov ecx, dword [0x4097b8]
test eax, eax
cmovne ecx, dword [esp + 0x10]
mov dword [0x4097b8], ecx
lea edx, [esp + 0x10]
mov ecx, str._Log
call fcn.004026f8
mov ecx, dword [0x4097e4]
xor ebp, ebp
inc ebp
test eax, eax
cmovne ecx, ebp
mov dword [0x4097e4], ecx
lea edx, [esp + 0x10]
mov ecx, str._Debug
call fcn.004026f8
mov ecx, dword [0x4097e0]
test eax, eax
cmovne ecx, ebp
mov edi, 0x406794
push edi
mov dword [0x4097e0], ecx
call fcn.004037f9
mov dword [esp], str.______________________________________________n
call fcn.004037f9
mov dword [esp], 0x40686c
call fcn.004037f9
call fcn.00403889
mov dword [esp], str.____n
call fcn.004037f9
mov esi, str._n
push esi
call fcn.004037f9
push str.KMS_Server_Service_Emulator_v2.1.3__27_10_2024__Starting_..._n
call fcn.004037f9
push esi
call fcn.004037f9
push str.KMS_Server_Service_Emulator_Parameters:_n
call fcn.004037f9
push edi
call fcn.004037f9
push dword [0x4097c8]
push str.__________Windows_PID:__s__n
call fcn.004037f9
push dword [0x4097b0]
push str.______Office_2010_PID:__s__n
call fcn.004037f9
push dword [0x4097cc]
push str.______Office_2013_PID:__s__n
call fcn.004037f9
push dword [0x4097bc]
push str.______Office_2016_PID:__s__n
call fcn.004037f9
push dword [0x4097b4]
push str._________________Port:__s__n
call fcn.004037f9
add esp, 0x40
push dword [0x4097ac]
push str.__Activation_Interval:__d_minutes_n
call fcn.004037f9
push dword [0x4097b8]
push str._____Renewal_Interval:__d_minutes_n
call fcn.004037f9
add esp, 0x10
cmp dword [0x4097e0], ebx
je 0x402d9a
push str.________________Debug:_Enabled_n
jmp 0x402d9f
push str.________________Debug:_Disabled_n
call fcn.004037f9
pop ecx
push dword [0x4097c4]
push str._________________Hwid:__s__n_n
call fcn.004037f9
push str.KMS_Server_Service_Emulator_v2.1.3__27_10_2024__running_..._n
call fcn.004037f9
push str.______________________________________________n
call fcn.004037f9
add esp, 0x10
call dword [sym.imp.msvcrt.dll__flushall]
push 0x4099f4
push dword [0x4097d8]
mov dword [0x4099f8], 4
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
push ebx
push 0x4d2
push ebp
call dword [sym.imp.RPCRT4.dll_RpcServerListen]
pop edi
pop ebp
test eax, eax
jne 0x402adc
xor ecx, ecx
jmp 0x402e31
pop ebx
add esp, 0xa4
ret
call fcn.00402126
push dword [0x4097b4]
lea eax, [esp + 0x60]
push str.Another_program_is_using_port__s.
push 0x50
push eax
call fcn.004017ec
add esp, 0x10
mov ecx, esi
call fcn.00402126
int3