Function at 0x140001000
Capabilities:
Identify system language via api
Query environment variable

Disassembly:
sub rsp, 0x28
mov r8, 0x8f8
xor rdx, rdx
movabs rcx, 0x140189354
call sub.msvcrt.dll_memset
xor rcx, rcx
call sub.KERNEL32.dll_GetModuleHandleW
mov qword [0x14018935c], rax
xor r8, r8
mov rdx, 0x1000
xor rcx, rcx
call sub.KERNEL32.dll_HeapCreate
mov qword [0x140189354], rax
movabs rax, 0x1400ad530
mov qword [0x1401893e4], rax
call fcn.1400247d0
call fcn.1400443d0
call fcn.140043230
call fcn.1400429a0
call fcn.140040c60
call fcn.14003de94
call fcn.14003d360
call fcn.14003cbdc
call fcn.14003bc50
call fcn.14003a9f8
call fcn.140038188
call fcn.140037b68
call fcn.1400361e0
call fcn.140035868
call fcn.140034d44
call fcn.1400335c0
call fcn.140030abc
call fcn.14002b1e4
call fcn.140028a2c
call fcn.140027904
call fcn.140026c98
call fcn.140025de8
call fcn.140025b20
call fcn.140024994
movabs rdx, str.v1.5.5.1
lea rcx, [0x140189544]
call fcn.140044440
push rcx
sub rsp, 0x28
call fcn.140044530
add rsp, 0x28
pop rcx
push rax
movabs rcx, str.W10_Digital_Activation
sub rsp, 0x28
call fcn.140044580
add rsp, 0x28
mov rcx, qword [0x140189544]
sub rsp, 0x28
call fcn.140044580
add rsp, 0x28
lea rcx, [0x14018943c]
pop rdx
call main
push rcx
sub rsp, 0x28
call fcn.140044530
add rsp, 0x28
pop rcx
push rax
movabs rcx, str.W10_Digital_Activation_x64
sub rsp, 0x28
call fcn.140044580
add rsp, 0x28
mov rcx, qword [0x140189544]
sub rsp, 0x28
call fcn.140044580
add rsp, 0x28
lea rcx, [0x14018943c]
pop rdx
call main
push rcx
sub rsp, 0x28
call fcn.140044530
add rsp, 0x28
pop rcx
push rax
movabs rcx, str.___________________
sub rsp, 0x28
call fcn.140044580
add rsp, 0x28
mov rcx, qword [0x14018943c]
sub rsp, 0x28
call fcn.140044580
add rsp, 0x28
movabs rcx, str._____r_n
sub rsp, 0x28
call fcn.140044580
add rsp, 0x28
lea rcx, [0x140189564]
pop rdx
call main
call fcn.14002a6dc
movabs rbp, 0x1400ad89a
mov rax, rbp
push rax
push 0xffffffffffffffff
pop rcx
pop rdx
call fcn.14003aa1c
mov qword [0x1401893c4], rax
push recv
movabs rax, 0x1400a75a8
push rax
push 0
pop rcx
pop rdx
pop r8
call fcn.1400432a4
push 9
movabs rax, str.Segoe_UI
push rax
push 1
pop rcx
pop rdx
pop r8
call fcn.1400432a4
push rcx
sub rsp, 0x28
call fcn.140044530
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140044530
add rsp, 0x28
pop rcx
push rax
push 0xc8
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140041000
add rsp, 0x28
lea rcx, [0x1401896a4]
pop rdx
call main
push rcx
sub rsp, 0x28
call fcn.140044530
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140044530
add rsp, 0x28
pop rcx
push rax
push 0xc8
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140041000
add rsp, 0x28
lea rcx, [0x1401896ac]
pop rdx
call main
push 0xc8
mov rax, qword [0x1401896a4]
mov rax, rax
push rax
movabs rax, str.PROCESSOR_ARCHITECTURE
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0xc8
mov rax, qword [0x1401896ac]
mov rax, rax
push rax
movabs rax, str.PROCESSOR_ARCHITEW6432
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0x64
mov rax, qword [0x140189674]
mov rax, rax
push rax
movabs rax, str.SYSTEMDRIVE
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_GetEnvironmentVariableW
push qword [0x1401896a4]
movabs rcx, str.AMD64
pop rdx
call fcn.1400446d0
or rax, rax
jne 0x140001363
push qword [0x1401896ac]
movabs rcx, str.AMD64
pop rdx
call fcn.1400446d0
or rax, rax
jne 0x140001363
jmp 0x14000136c
mov rax, 1
jmp 0x14000136f
xor rax, rax
and rax, rax
je 0x14000138c
movabs rdx, 0x1400aa2ec
lea rcx, [0x14018968c]
call fcn.140044440
jmp 0x1400013a2
movabs rdx, 0x1400aaee2
lea rcx, [0x14018968c]
call fcn.140044440
movabs rdx, str.Panic___
lea rcx, [0x14018944c]
call fcn.140044440
movabs rdx, 0x1400abbfc
lea rcx, [0x1401894cc]
call fcn.140044440
push rcx
sub rsp, 0x28
call fcn.140044530
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140044530
add rsp, 0x28
pop rcx
push rax
pop rcx
sub rsp, 0x20
call fcn.140025e30
add rsp, 0x28
lea rcx, [0x14018937c]
pop rdx
call main
mov dword [0x1401896b4], 0
mov dword [0x1401896b8], 0
lea rax, [0x1401896b8]
mov rax, rax
push rax
lea rax, [0x1401896b4]
mov rax, rax
push rax
mov rax, qword [0x14018937c]
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
call sub.imagehlp.dll_MapFileAndCheckSumW
push rcx
sub rsp, 0x28
call fcn.140044530
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140044530
add rsp, 0x28
pop rcx
push rax
movsxd rax, dword [0x1401896b4]
push rax
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140041060
add rsp, 0x28
lea rcx, [0x140189404]
pop rdx
call main
push rcx
sub rsp, 0x28
call fcn.140044530
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140044530
add rsp, 0x28
pop rcx
push rax
movsxd rax, dword [0x1401896b8]
push rax
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140041060
add rsp, 0x28
lea rcx, [0x14018940c]
pop rdx
call main
mov rax, qword [0x14018940c]
mov rax, rax
push rax
mov rax, qword [0x140189404]
mov rax, rax
push rax
pop rcx
pop rdx
call fcn.1400429c0
and rax, rax
je 0x14000151c
push reloc.WS2_32.dll_recv
push qword [0x1401894cc]
push qword [0x14018944c]
pop rcx
pop rdx
pop r8
call fcn.140025b64
jmp 0x1400027a9
movabs rdx, 0x1400a7028
lea rcx, [0x140189454]
call fcn.140044440
mov qword [0x14018939c], 0
call fcn.14002a6dc
push rcx
sub rsp, 0x28
call fcn.140044530
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140044530
add rsp, 0x28
pop rcx
push rax
push 0x3e8
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140041000
add rsp, 0x28
lea rcx, [0x14018936c]
pop rdx
call main
movabs rdx, 0x1400a7028
lea rcx, [0x140189434]
call fcn.140044440
push rcx
sub rsp, 0x28
call fcn.140044530
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140044530
add rsp, 0x28
pop rcx
push rax
push 0x3e8
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140041000
add rsp, 0x28
lea rcx, [0x14018951c]
pop rdx
call main
push rcx
sub rsp, 0x28
call fcn.140044530
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140044530
add rsp, 0x28
pop rcx
push rax
push 0x3e8
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140041000
add rsp, 0x28
lea rcx, [0x1401894bc]
pop rdx
call main
push rcx
sub rsp, 0x28
call fcn.140044530
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140044530
add rsp, 0x28
pop rcx
push rax
push 0x3e8
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140041000
add rsp, 0x28
lea rcx, [0x14018954c]
pop rdx
call main
push rcx
sub rsp, 0x28
call fcn.140044530
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140044530
add rsp, 0x28
pop rcx
push rax
push 0x3e8
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140041000
add rsp, 0x28
lea rcx, [0x140189534]
pop rdx
call main
push rcx
sub rsp, 0x28
call fcn.140044530
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140044530
add rsp, 0x28
pop rcx
push rax
push 0x3e8
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140041000
add rsp, 0x28
lea rcx, [0x140189394]
pop rdx
call main
movabs rdx, 0x1400a7028
lea rcx, [0x14018945c]
call fcn.140044440
movabs rdx, str.HWID
lea rcx, [0x140189554]
call fcn.140044440
movabs rdx, str.KMS38
lea rcx, [0x140189504]
call fcn.140044440
mov qword [0x140189484], 0
push 0x3e8
mov rax, qword [0x14018936c]
mov rax, rax
push rax
movabs rax, str.SYSTEMDRIVE
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0x3e8
mov rax, qword [0x14018951c]
mov rax, rax
push rax
movabs rax, str.TEMP
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0x3e8
mov rax, qword [0x140189534]
mov rax, rax
push rax
movabs rax, str.WINDIR
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0x3e8
mov rax, qword [0x1401894bc]
mov rax, rax
push rax
movabs rax, str.PROCESSOR_ARCHITECTURE
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0x3e8
mov rax, qword [0x14018954c]
mov rax, rax
push rax
movabs rax, str.PROCESSOR_ARCHITEW6432
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0x3e8
mov rax, qword [0x14018951c]
mov rax, rax
push rax
movabs rax, str.TEMP
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0x100
push 1
pop rcx
pop rdx
call fcn.140022e11
push qword [0x1401894bc]
movabs rcx, str.AMD64
pop rdx
call fcn.1400446d0
or rax, rax
jne 0x140001864
push qword [0x14018954c]
movabs rcx, str.AMD64
pop rdx
call fcn.1400446d0
or rax, rax
jne 0x140001864
jmp 0x14000186d
mov rax, 1
jmp 0x140001870
xor rax, rax
and rax, rax
je 0x14000188d
movabs rdx, 0x1400aa2ec
lea rcx, [0x1401894b4]
call fcn.140044440
jmp 0x1400018a3
movabs rdx, 0x1400aaee2
lea rcx, [0x1401894b4]
call fcn.140044440
push rcx
sub rsp, 0x28
call fcn.140044530
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
mov rcx, qword [0x140189534]
push rcx
sub rsp, 0x28
call fcn.140044530
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140044580
add rsp, 0x28
movabs rcx, str.Temp
sub rsp, 0x28
call fcn.140044580
add rsp, 0x28
push rax
call fcn.140044760
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
sub rsp, 0x20
call fcn.140032708
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140023dc8
add rsp, 0x28
pop rax
mov r15, rax
cmp r15, 0xfffffffffffffffe
jne 0x14000196f
mov rcx, qword [0x140189534]
push rcx
sub rsp, 0x28
call fcn.140044530
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140044580
add rsp, 0x28
movabs rcx, str.Temp
sub rsp, 0x28
call fcn.140044580
add rsp, 0x28
lea rcx, [0x14018951c]
pop rdx
call main
mov rcx, qword [0x140189534]
push rcx
sub rsp, 0x28
call fcn.140044530
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140044580
add rsp, 0x28
movabs rcx, str.System32
sub rsp, 0x28
call fcn.140044580
add rsp, 0x28
lea rcx, [0x140189394]
pop rdx
call main
push rcx
sub rsp, 0x28
call fcn.140044530
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
mov rcx, qword [0x140189534]
push rcx
sub rsp, 0x28
call fcn.140044530
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140044580
add rsp, 0x28
movabs rcx, str.Sysnativecmd.exe
sub rsp, 0x28
call fcn.140044580
add rsp, 0x28
push rax
call fcn.140044760
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
sub rsp, 0x20
call fcn.140032708
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140023dc8
add rsp, 0x28
pop rax
mov r15, rax
and r15, r15
jle 0x140001a84
mov rcx, qword [0x140189534]
push rcx
sub rsp, 0x28
call fcn.140044530
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140044580
add rsp, 0x28
movabs rcx, str.Sysnative
sub rsp, 0x28
call fcn.140044580
add rsp, 0x28
lea rcx, [0x140189534]
pop rdx
call main
jmp 0x140001acc
mov rcx, qword [0x140189534]
push rcx
sub rsp, 0x28
call fcn.140044530
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140044580
add rsp, 0x28
movabs rcx, str.System32
sub rsp, 0x28
call fcn.140044580
add rsp, 0x28
lea rcx, [0x140189534]
pop rdx
call main
push rcx
sub rsp, 0x28
call fcn.140044530
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.140044530
add rsp, 0x20
pop rcx
push rax
movabs rax, 0x1400a73cc
push rax
movabs rax, str.BuildLab
push rax
movabs rax, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_NTCurrentVersion
push rax
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.14001ae83
add rsp, 0x28
lea rcx, [0x14018948c]
pop rdx
call main
movabs rax, 0x1400a73cc
push rax
push qword [0x14018948c]
pop rcx
pop rdx
call fcn.1400410c0
mov qword [0x1401894f4], rax
mov r15, qword [0x1401894f4]
cmp r15, 1
jge 0x140001b59
jmp 0x140001bb6
push rcx
sub rsp, 0x28
call fcn.140044530
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140044530
add rsp, 0x28
pop rcx
push rax
mov r15, qword [0x1401894f4]
dec r15
mov rax, r15
push rax
push 1
push qword [0x14018948c]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.140041290
add rsp, 0x28
lea rcx, [0x14018948c]
pop rdx
call main
push qword [0x14018948c]
pop rcx
call fcn.140041350
mov qword [0x140189374], rax
mov r15, qword [0x140189374]
cmp r15, 0x2710
jle 0x140001bf4
movabs rdx, 0x1400a7540
lea rcx, [0x14018953c]
call fcn.140044440
jmp 0x140001d13
mov r15, qword [0x140189374]
cmp r15, 0x2580
jl 0x140001c1f
movabs rdx, 0x1400ace2c
lea rcx, [0x14018953c]
call fcn.140044440
jmp 0x140001d13
mov r15, qword [0x140189374]
cmp r15, 0x23f0
jl 0x140001c48
mov r15, qword [0x140189374]
cmp r15, 0x2454
jge 0x140001c48
mov rax, 1
jmp 0x140001c4b
xor rax, rax
and rax, rax
je 0x140001c6b
movabs rdx, 0x1400a7518
lea rcx, [0x14018953c]
call fcn.140044440
jmp 0x140001d13
mov r15, qword [0x140189374]
cmp r15, 0x1db0
jl 0x140001c94
mov r15, qword [0x140189374]
cmp r15, 0x1e14
jge 0x140001c94
mov rax, 1
jmp 0x140001c97
xor rax, rax
and rax, rax
je 0x140001cb4
movabs rdx, 0x1400a7514
lea rcx, [0x14018953c]
call fcn.140044440
jmp 0x140001d13
mov r15, qword [0x140189374]
cmp r15, 0xa28
jl 0x140001cdd
mov r15, qword [0x140189374]
cmp r15, 0xfa0
jge 0x140001cdd
mov rax, 1
jmp 0x140001ce0
xor rax, rax
and rax, rax
je 0x140001cfd
movabs rdx, 0x1400aa2f4
lea rcx, [0x14018953c]
call fcn.140044440
jmp 0x140001d13
movabs rdx, 0x1400a7514
lea rcx, [0x14018953c]
call fcn.140044440
push rcx
sub rsp, 0x28
call fcn.140044530
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140044530
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
sub rsp, 0x20
call sub.KERNEL32.dll_GetUserDefaultLangID
add rsp, 0x28
mov rax, rax
push rax
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140041480
add rsp, 0x28
lea rcx, [0x14018949c]
pop rdx
call main
push qword [0x14018949c]
pop rcx
call fcn.140041650
mov r15, rax
cmp r15, 3
jne 0x140001dc5
push rcx
sub rsp, 0x28
call fcn.140044530
add rsp, 0x28
pop rcx
push rax
movabs rcx, 0x1400a740e
sub rsp, 0x28
call fcn.140044580
add rsp, 0x28
mov rcx, qword [0x14018949c]
sub rsp, 0x28
call fcn.140044580
add rsp, 0x28
lea rcx, [0x14018949c]
pop rdx
call main
push qword [0x14018949c]
movabs rcx, str.0419
pop rdx
call fcn.1400446d0
or rax, rax
je 0x140001df8
movabs rdx, 0x1400a805e
lea rcx, [0x14018949c]
call fcn.140044440
jmp 0x140001e0e
movabs rdx, 0x1400a9472
lea rcx, [0x14018949c]
call fcn.140044440
mov qword [0x14018956c], 0
mov qword [0x140189574], 0
mov qword [0x140189384], 0
push rcx
sub rsp, 0x28
call fcn.140044530
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.140044530
add rsp, 0x20
pop rcx
push rax
movabs rax, 0x1400a73cc
push rax
movabs rax, 0x1400ac74e
push rax
movabs rax, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_NTCurrentVersion
push rax
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.14001ae83
add rsp, 0x28
lea rcx, [0x14018941c]
pop rdx
call main
movabs rax, str.2015
push rax
push qword [0x14018941c]
pop rcx
pop rdx
call fcn.1400410c0
mov r15, rax
and r15, r15
jle 0x140001ebb
mov qword [0x14018956c], 1
jmp 0x140001f13
movabs rax, str.LTSC_2021
push rax
push qword [0x14018941c]
pop rcx
pop rdx
call fcn.1400410c0
mov r15, rax
and r15, r15
jle 0x140001ee8
mov qword [0x140189384], 1
jmp 0x140001f13
movabs rax, str.LTSC
push rax
push qword [0x14018941c]
pop rcx
pop rdx
call fcn.1400410c0
mov r15, rax
and r15, r15
jle 0x140001f13
mov qword [0x140189574], 1
mov qword [0x140189514], 0
push rcx
sub rsp, 0x28
call fcn.140044530
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.140044530
add rsp, 0x20
pop rcx
push rax
movabs rax, 0x1400a73cc
push rax
movabs rax, str.EditionID
push rax
movabs rax, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_NTCurrentVersion
push rax
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.14001ae83
add rsp, 0x28
lea rcx, [0x140189424]
pop rdx
call main
push rcx
sub rsp, 0x28
call fcn.140044530
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.140044530
add rsp, 0x20
pop rcx
push rax
movabs rax, 0x1400a73cc
push rax
movabs rax, str.CurrentBuild
push rax
movabs rax, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_NTCurrentVersion
push rax
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.14001ae83
add rsp, 0x28
lea rcx, [0x14018946c]
pop rdx
call main
mov qword [0x1401893dc], 0
call fcn.140026028
mov r15, rax
dec r15
mov qword [0x1401893cc], r15
mov r15, qword [0x1401893cc]
and r15, r15
jl 0x140002119
mov qword [0x1401894a4], 0
jmp 0x140002016
mov rax, qword [0x1401893cc]
cmp rax, qword [0x1401894a4]
jl 0x140002119
push rcx
sub rsp, 0x28
call fcn.140044530
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140044530
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.140044530
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.140044530
add rsp, 0x28
pop rcx
push rax
push qword [0x1401894a4]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.1400260bc
add rsp, 0x20
push rax
call fcn.140044760
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140041670
add rsp, 0x28
lea rcx, [0x1401894c4]
pop rdx
call main
push qword [0x1401894c4]
movabs rdx, str._ACTIVATE
mov rcx, qword [rsp]
sub rsp, 0x28
call fcn.1400446d0
add rsp, 0x28
or rax, rax
je 0x1400020e0
mov qword [0x1401893dc], 1
jmp 0x14000210b
movabs rdx, str._KMS38
mov rcx, qword [rsp]
sub rsp, 0x28
call fcn.1400446d0
add rsp, 0x28
or rax, rax
je 0x14000210b
mov qword [0x140189484], 1
pop rax
inc qword [0x1401894a4]
jno 0x140002016
push qword [0x140189424]
pop rcx
call fcn.140009a9d
push qword [0x14018953c]
pop rcx
call fcn.140041350
mov r15, rax
cmp r15, 0xa
jl 0x140002148
mov r15, qword [0x140189514]
and r15, r15
je 0x140002148
jmp 0x140002151
mov rax, 1
jmp 0x140002154
xor rax, rax
and rax, rax
je 0x14000219a
movabs rdx, str.The_program_supports_activation_of_the_following_editions:_r_n_r_nWindows_10_11_Core_r_nWindows_10_11_Core_N_r_nWindows_10_11_CoreSingleLanguage_r_nWindows_10_11_CoreSingleLanguage_N_r_nWindows_10_11_Professional_r_nWindows_10_11_Professional_N_r_nWindows_10_11_ProfessionalEducation_r_nWindows_10_11_ProfessionalEducation_N_r_nWindows_10_11_ProfessionalWorkstation_r_nWindows_10_11_ProfessionalWorkstation_N_r_nWindows_10_11_Education_r_nWindows_10_11_Education_N_r_nWindows_10_11_Enterprise_r_nWindows_10_11_Enterprise_N_r_nWindows_10_Enterprise_LTSB_r_nWindows_10_Enterprise_LTSB_N_r_nWindows_10_Enterprise_LTSC_r_nWindows_10_11_IoT_Enterprise_r_nWindows_11_IoT_EnterpriseK_r_nWindows_10_IoT_Enterprise_LTSC
lea rcx, [0x140189464]
call fcn.140044440
mov r15, qword [0x1401893dc]
and r15, r15
jne 0x14000219a
push reloc.WS2_32.dll_recv
push qword [0x140189464]
movabs rax, 0x1400a7028
push rax
pop rcx
pop rdx
pop r8
call fcn.140025b64
mov qword [0x1401894e4], 0
mov qword [0x14018938c], 0
mov qword [0x1401893d4], 0
push rcx
sub rsp, 0x28
call fcn.140044530
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.140044530
add rsp, 0x20
pop rcx
push rax
movabs rax, 0x1400a73cc
push rax
movabs rax, str.AppsUseLightTheme
push rax
movabs rax, str.HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionThemesPersonalize
push rax
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.14001ae83
add rsp, 0x28
lea rcx, [0x14018950c]
pop rdx
call main
push qword [0x14018950c]
movabs rcx, 0x1400a740e
pop rdx
call fcn.1400446d0
or rax, rax
je 0x14000224b
mov qword [0x14018938c], 1
mov qword [0x1401893d4], 1
push 0
push 0
push 0
pop rcx
pop rdx
pop r8
call fcn.1400381a0
mov qword [0x14018952c], rax
push 0xff
push 0xff
push 0xff
pop rcx
pop rdx
pop r8
call fcn.1400381a0
mov qword [0x140189474], rax
push 0x20
push 0x20
push 0x20
pop rcx
pop rdx
pop r8
call fcn.1400381a0
mov qword [0x1401893b4], rax
mov qword [0x1401894fc], 1
push 0x808080
push 1
push 0
pop rcx
pop rdx
pop r8
call sub.GDI32.dll_CreatePen
mov qword [0x140189444], rax
push 0xcc872c
push 1
push 0
pop rcx
pop rdx
pop r8
call sub.GDI32.dll_CreatePen
mov qword [0x1401894dc], rax
mov r9, 7
xor r8, r8
lea rdx, [0x140189b5c]
mov rcx, 0x3b
call fcn.14003bc7c
mov rcx, 0x200
sub rsp, 8
push rcx
lea r9, [0x140189c2c]
xor r8, r8
mov rdx, 7
mov rcx, 0x59
sub rsp, 0x20
call fcn.140035894
add rsp, 0x28
add rsp, 8
mov rcx, 0x200
sub rsp, 8
push rcx
lea r9, [0x140189c34]
xor r8, r8
mov rdx, SafeArrayPutElement
mov rcx, 8
sub rsp, 0x20
call fcn.140035894
add rsp, 0x28
add rsp, 8
mov rcx, 0x200
sub rsp, 8
push rcx
lea r9, [0x140189c3c]
xor r8, r8
mov rdx, SafeArrayPutElement
mov rcx, 8
sub rsp, 0x20
call fcn.140035894
add rsp, 0x28
add rsp, 8
mov rcx, 0x200
sub rsp, 8
push rcx
lea r9, [0x140189c44]
xor r8, r8
mov rdx, SafeArrayPutElement
mov rcx, 8
sub rsp, 0x20
call fcn.140035894
add rsp, 0x28
add rsp, 8
mov qword [0x140189b2c], 2
mov qword [0x140189b34], 1
sub rsp, 0x18
movabs rax, 0x140189b24
push rax
xor r9, r9
mov r8, SafeArrayPutElement
mov rdx, 8
mov rcx, 2
sub rsp, 0x20
call fcn.140037c80
add rsp, 0x40
mov qword [0x140189b24], rax
mov r9, SafeArrayPutElement
xor r8, r8
lea rdx, [0x140189b6c]
mov rcx, 8
call fcn.14003bc7c
movabs rbp, 0x140179573
mov rax, rbp
push rax
push 0xffffffffffffffff
pop rcx
pop rdx
call fcn.14003aa1c
mov qword [0x14018939c], rax
push qword [0x14018939c]
pop rcx
call fcn.1400092be
push qword [0x1401893c4]
pop rcx
call fcn.1400092be
mov r15, qword [0x1401893dc]
and r15, r15
jle 0x1400024a5
push 0
pop rcx
call fcn.1400054cf
jmp 0x1400027a9
push 0xa0
push 0x1e0
push 0
push 0
pop rcx
pop rdx
pop r8
pop r9
call fcn.140002829
push qword [0x14018943c]
push qword [0x1401894ec]
pop rcx
pop rdx
call fcn.140030b84
push qword [0x14018949c]
movabs rcx, 0x1400a805e
pop rdx
call fcn.1400446d0
or rax, rax
je 0x140002524
movabs rax, reloc.WS2_32.dll_recv
push rax
push qword [0x14018942c]
pop rcx
pop rdx
call fcn.14002b2b8
movabs rax, 0x1400ab6ac
push rax
push qword [0x1401893f4]
pop rcx
pop rdx
call fcn.14002b2b8
jmp 0x14000253c
movabs rax, str.Go_to_the_program_support_forum
push rax
push qword [0x1401893f4]
pop rcx
pop rdx
call fcn.14002b2b8
push qword [0x1401894ec]
pop rcx
call fcn.140030bb8
mov rax, rax
push rax
pop rcx
call fcn.1400381ec
and rax, rax
je 0x1400025ff
push 1
pop rcx
call fcn.1400433dc
mov rax, rax
push rax
pop rcx
call fcn.140038270
push rcx
sub rsp, 0x28
call fcn.140044530
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140044530
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140044530
add rsp, 0x28
pop rcx
push rax
push qword [0x1401893f4]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14002b31c
add rsp, 0x28
push rax
call fcn.140044760
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
sub rsp, 0x20
call fcn.140038294
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140023dc8
add rsp, 0x28
pop rax
mov rax, rax
push rax
pop rcx
call fcn.140036268
mov qword [0x140189494], rax
call fcn.1400382f0
sub rsp, 8
push 0xffffffffffff0001
push qword [0x140189494]
push 0xffffffffffff0001
push qword [0x1401894ec]
pop rcx
sub rsp, 0x20
call fcn.140030c90
add rsp, 0x20
mov r15, rax
sub r15, qword [0x140189494]
mov rax, r15
mov rcx, 2
cqo
idiv rcx
mov r15, rax
mov rax, r15
push rax
push qword [0x1401893f4]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14002b54c
add rsp, 0x30
push qword [0x140189554]
push 0xffffffffffffffff
push qword [0x1401893ec]
pop rcx
pop rdx
pop r8
call fcn.14002b5c0
push qword [0x140189504]
push 0xffffffffffffffff
push qword [0x1401893ec]
pop rcx
pop rdx
pop r8
call fcn.14002b5c0
mov r15, qword [0x140189484]
and r15, r15
jle 0x1400026b4
push 1
push qword [0x1401893ec]
pop rcx
pop rdx
call fcn.14002b65c
jmp 0x1400026c6
push 0
push qword [0x1401893ec]
pop rcx
pop rdx
call fcn.14002b65c
call fcn.14000b920
call fcn.14003072c
mov r15, rax
cmp r15, 0x6e
jl 0x1400026ee
mov r15, qword [0x1401893d4]
and r15, r15
jle 0x1400026ee
mov rax, 1
jmp 0x1400026f1
xor rax, rax
and rax, rax
je 0x14000270d
call fcn.14001210e
push 1
push qword [0x1401894ec]
pop rcx
pop rdx
call fcn.14000ffe0
push 0
push qword [0x1401894ec]
pop rcx
pop rdx
call fcn.140030ce8
call fcn.140030df0
mov qword [0x1401894ac], rax
cmp qword [0x1401894ac], 0
je 0x14000278a
call fcn.140034f04
mov rax, rax
push rax
mov r15, qword [0x1401894ec]
cmp r15, qword [rsp]
jne 0x140002765
sub rsp, 8
push qword [0x1401894ac]
pop rcx
sub rsp, 0x20
call fcn.14000ba98
add rsp, 0x28
jmp 0x140002787
mov qword [0x1401894ac], 0
sub rsp, 8
push 5
pop rcx
sub rsp, 0x20
call fcn.140030928
add rsp, 0x28
pop rax
jmp 0x140002795
push 5
pop rcx
call fcn.140030928
mov r15, qword [0x1401894ac]
cmp r15, 0x333c
jne 0x14000271f
call 0x1400027cb
call fcn.140044410
mov rcx, qword [0x140189354]
call sub.KERNEL32.dll_HeapDestroy
mov rcx, qword [0x140189364]
call sub.KERNEL32.dll_ExitProcess
sub rsp, 0x28
call fcn.140024944
call fcn.140024ecc
call fcn.140026c7c
call fcn.1400278c4
call fcn.140028a20
call fcn.14002b180
call fcn.140030a8c
call fcn.140032884
call fcn.1400335b0
call fcn.140034d18
call fcn.1400361dc
call fcn.14003a9ec
call fcn.14003cbd8
call fcn.140040c90
call fcn.140043450
call fcn.1400434b0
call fcn.140042990
add rsp, 0x28
ret