Function at 0x140001000
Capabilities:
Identify system language via api
Query environment variable

Disassembly:
sub rsp, 0x28
mov r8, 0x918
xor rdx, rdx
movabs rcx, 0x140137b24
call sub.msvcrt.dll_memset
xor rcx, rcx
call sub.KERNEL32.dll_GetModuleHandleW
mov qword [0x140137b2c], rax
xor r8, r8
mov rdx, 0x1000
xor rcx, rcx
call sub.KERNEL32.dll_HeapCreate
mov qword [0x140137b24], rax
movabs rax, 0x1400ae508
mov qword [0x140137bb4], rax
call fcn.1400257d0
call fcn.1400453e0
call fcn.140044240
call fcn.1400439b0
call fcn.140041c70
call fcn.14003eea4
call fcn.14003e370
call fcn.14003dbec
call fcn.14003cc60
call fcn.14003ba08
call fcn.140039198
call fcn.140038b78
call fcn.1400371f0
call fcn.140036878
call fcn.140035d54
call fcn.1400345c0
call fcn.140031abc
call fcn.14002c1e4
call fcn.140029a2c
call fcn.140028904
call fcn.140027c98
call fcn.140026de8
call fcn.140026b20
call fcn.140025994
movabs rdx, str.v1.5.5.1
lea rcx, [0x140137d34]
call fcn.140045450
push rcx
sub rsp, 0x28
call fcn.140045540
add rsp, 0x28
pop rcx
push rax
movabs rcx, 0x1400ab2cc
sub rsp, 0x28
call fcn.140045590
add rsp, 0x28
mov rcx, qword [0x140137d34]
sub rsp, 0x28
call fcn.140045590
add rsp, 0x28
lea rcx, [0x140137c14]
pop rdx
call main
push rcx
sub rsp, 0x28
call fcn.140045540
add rsp, 0x28
pop rcx
push rax
movabs rcx, str.W10_Digital_Activation_x64
sub rsp, 0x28
call fcn.140045590
add rsp, 0x28
mov rcx, qword [0x140137d34]
sub rsp, 0x28
call fcn.140045590
add rsp, 0x28
lea rcx, [0x140137c14]
pop rdx
call main
push rcx
sub rsp, 0x28
call fcn.140045540
add rsp, 0x28
pop rcx
push rax
movabs rcx, str.___________________
sub rsp, 0x28
call fcn.140045590
add rsp, 0x28
mov rcx, qword [0x140137c14]
sub rsp, 0x28
call fcn.140045590
add rsp, 0x28
movabs rcx, str._____r_n
sub rsp, 0x28
call fcn.140045590
add rsp, 0x28
lea rcx, [0x140137d54]
pop rdx
call main
call fcn.14002b6dc
movabs rbp, 0x1400ae872
mov rax, rbp
push rax
push 0xffffffffffffffff
pop rcx
pop rdx
call fcn.14003ba2c
mov qword [0x140137b94], rax
push recv
movabs rax, 0x1400a85a8
push rax
push 0
pop rcx
pop rdx
pop r8
call fcn.1400442b4
push 9
movabs rax, str.Segoe_UI
push rax
push 1
pop rcx
pop rdx
pop r8
call fcn.1400442b4
push rcx
sub rsp, 0x28
call fcn.140045540
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140045540
add rsp, 0x28
pop rcx
push rax
push 0xc8
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140042010
add rsp, 0x28
lea rcx, [0x140137e94]
pop rdx
call main
push rcx
sub rsp, 0x28
call fcn.140045540
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140045540
add rsp, 0x28
pop rcx
push rax
push 0xc8
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140042010
add rsp, 0x28
lea rcx, [0x140137e9c]
pop rdx
call main
push 0xc8
mov rax, qword [0x140137e94]
mov rax, rax
push rax
movabs rax, str.PROCESSOR_ARCHITECTURE
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0xc8
mov rax, qword [0x140137e9c]
mov rax, rax
push rax
movabs rax, str.PROCESSOR_ARCHITEW6432
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0x64
mov rax, qword [0x140137e64]
mov rax, rax
push rax
movabs rax, str.SYSTEMDRIVE
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_GetEnvironmentVariableW
push qword [0x140137e94]
movabs rcx, str.AMD64
pop rdx
call fcn.1400456e0
or rax, rax
jne 0x140001363
push qword [0x140137e9c]
movabs rcx, str.AMD64
pop rdx
call fcn.1400456e0
or rax, rax
jne 0x140001363
jmp 0x14000136c
mov rax, 1
jmp 0x14000136f
xor rax, rax
and rax, rax
je 0x14000138c
movabs rdx, 0x1400ab2be
lea rcx, [0x140137e7c]
call fcn.140045450
jmp 0x1400013a2
movabs rdx, 0x1400abeb4
lea rcx, [0x140137e7c]
call fcn.140045450
movabs rdx, str.Panic___
lea rcx, [0x140137c24]
call fcn.140045450
movabs rdx, 0x1400acbce
lea rcx, [0x140137cbc]
call fcn.140045450
push rcx
sub rsp, 0x28
call fcn.140045540
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140045540
add rsp, 0x28
pop rcx
push rax
pop rcx
sub rsp, 0x20
call fcn.140026e30
add rsp, 0x28
lea rcx, [0x140137b4c]
pop rdx
call main
mov dword [0x140137ea4], 0
mov dword [0x140137ea8], 0
lea rax, [0x140137ea8]
mov rax, rax
push rax
lea rax, [0x140137ea4]
mov rax, rax
push rax
mov rax, qword [0x140137b4c]
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
call sub.imagehlp.dll_MapFileAndCheckSumW
push rcx
sub rsp, 0x28
call fcn.140045540
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140045540
add rsp, 0x28
pop rcx
push rax
movsxd rax, dword [0x140137ea4]
push rax
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140042070
add rsp, 0x28
lea rcx, [0x140137bd4]
pop rdx
call main
push rcx
sub rsp, 0x28
call fcn.140045540
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140045540
add rsp, 0x28
pop rcx
push rax
movsxd rax, dword [0x140137ea8]
push rax
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140042070
add rsp, 0x28
lea rcx, [0x140137bdc]
pop rdx
call main
mov rax, qword [0x140137bdc]
mov rax, rax
push rax
mov rax, qword [0x140137bd4]
mov rax, rax
push rax
pop rcx
pop rdx
call fcn.1400439d0
and rax, rax
je 0x14000151c
push reloc.WS2_32.dll_recv
push qword [0x140137cbc]
push qword [0x140137c24]
pop rcx
pop rdx
pop r8
call fcn.140026b64
jmp 0x140002ac6
push rcx
sub rsp, 0x28
call fcn.140045540
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140045540
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140045540
add rsp, 0x28
pop rcx
push rax
pop rcx
sub rsp, 0x20
call fcn.140026e30
add rsp, 0x28
push rax
call fcn.140045770
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
sub rsp, 0x20
call fcn.140010cae
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140024710
add rsp, 0x28
pop rax
and rax, rax
je 0x140001598
jmp 0x140002ac6
movabs rdx, 0x1400a8028
lea rcx, [0x140137c34]
call fcn.140045450
mov qword [0x140137b6c], 0
call fcn.14002b6dc
push rcx
sub rsp, 0x28
call fcn.140045540
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140045540
add rsp, 0x28
pop rcx
push rax
push 0x3e8
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140042010
add rsp, 0x28
lea rcx, [0x140137b3c]
pop rdx
call main
movabs rdx, 0x1400a8028
lea rcx, [0x140137c0c]
call fcn.140045450
push rcx
sub rsp, 0x28
call fcn.140045540
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140045540
add rsp, 0x28
pop rcx
push rax
push 0x3e8
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140042010
add rsp, 0x28
lea rcx, [0x140137d0c]
pop rdx
call main
push rcx
sub rsp, 0x28
call fcn.140045540
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140045540
add rsp, 0x28
pop rcx
push rax
push 0x3e8
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140042010
add rsp, 0x28
lea rcx, [0x140137cac]
pop rdx
call main
push rcx
sub rsp, 0x28
call fcn.140045540
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140045540
add rsp, 0x28
pop rcx
push rax
push 0x3e8
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140042010
add rsp, 0x28
lea rcx, [0x140137d3c]
pop rdx
call main
push rcx
sub rsp, 0x28
call fcn.140045540
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140045540
add rsp, 0x28
pop rcx
push rax
push 0x3e8
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140042010
add rsp, 0x28
lea rcx, [0x140137d24]
pop rdx
call main
push rcx
sub rsp, 0x28
call fcn.140045540
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140045540
add rsp, 0x28
pop rcx
push rax
push 0x3e8
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140042010
add rsp, 0x28
lea rcx, [0x140137b64]
pop rdx
call main
movabs rdx, 0x1400a8028
lea rcx, [0x140137c3c]
call fcn.140045450
movabs rdx, str.HWID
lea rcx, [0x140137d44]
call fcn.140045450
movabs rdx, str.KMS38
lea rcx, [0x140137cf4]
call fcn.140045450
mov qword [0x140137c64], 0
push 0x3e8
mov rax, qword [0x140137b3c]
mov rax, rax
push rax
movabs rax, str.SYSTEMDRIVE
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0x3e8
mov rax, qword [0x140137d0c]
mov rax, rax
push rax
movabs rax, str.TEMP
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0x3e8
mov rax, qword [0x140137d24]
mov rax, rax
push rax
movabs rax, str.WINDIR
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0x3e8
mov rax, qword [0x140137cac]
mov rax, rax
push rax
movabs rax, str.PROCESSOR_ARCHITECTURE
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0x3e8
mov rax, qword [0x140137d3c]
mov rax, rax
push rax
movabs rax, str.PROCESSOR_ARCHITEW6432
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0x3e8
mov rax, qword [0x140137d0c]
mov rax, rax
push rax
movabs rax, str.TEMP
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0x100
push 1
pop rcx
pop rdx
call fcn.140023759
push qword [0x140137cac]
movabs rcx, str.AMD64
pop rdx
call fcn.1400456e0
or rax, rax
jne 0x1400018e0
push qword [0x140137d3c]
movabs rcx, str.AMD64
pop rdx
call fcn.1400456e0
or rax, rax
jne 0x1400018e0
jmp 0x1400018e9
mov rax, 1
jmp 0x1400018ec
xor rax, rax
and rax, rax
je 0x140001909
movabs rdx, 0x1400ab2be
lea rcx, [0x140137ca4]
call fcn.140045450
jmp 0x14000191f
movabs rdx, 0x1400abeb4
lea rcx, [0x140137ca4]
call fcn.140045450
push rcx
sub rsp, 0x28
call fcn.140045540
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
mov rcx, qword [0x140137d24]
push rcx
sub rsp, 0x28
call fcn.140045540
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140045590
add rsp, 0x28
movabs rcx, str.Temp
sub rsp, 0x28
call fcn.140045590
add rsp, 0x28
push rax
call fcn.140045770
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
sub rsp, 0x20
call fcn.140033708
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140024710
add rsp, 0x28
pop rax
mov r15, rax
cmp r15, 0xfffffffffffffffe
jne 0x1400019eb
mov rcx, qword [0x140137d24]
push rcx
sub rsp, 0x28
call fcn.140045540
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140045590
add rsp, 0x28
movabs rcx, str.Temp
sub rsp, 0x28
call fcn.140045590
add rsp, 0x28
lea rcx, [0x140137d0c]
pop rdx
call main
mov rcx, qword [0x140137d24]
push rcx
sub rsp, 0x28
call fcn.140045540
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140045590
add rsp, 0x28
movabs rcx, str.System32
sub rsp, 0x28
call fcn.140045590
add rsp, 0x28
lea rcx, [0x140137b64]
pop rdx
call main
push rcx
sub rsp, 0x28
call fcn.140045540
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
mov rcx, qword [0x140137d24]
push rcx
sub rsp, 0x28
call fcn.140045540
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140045590
add rsp, 0x28
movabs rcx, str.Sysnativecmd.exe
sub rsp, 0x28
call fcn.140045590
add rsp, 0x28
push rax
call fcn.140045770
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
sub rsp, 0x20
call fcn.140033708
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140024710
add rsp, 0x28
pop rax
mov r15, rax
and r15, r15
jle 0x140001b00
mov rcx, qword [0x140137d24]
push rcx
sub rsp, 0x28
call fcn.140045540
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140045590
add rsp, 0x28
movabs rcx, str.Sysnative
sub rsp, 0x28
call fcn.140045590
add rsp, 0x28
lea rcx, [0x140137d24]
pop rdx
call main
jmp 0x140001b48
mov rcx, qword [0x140137d24]
push rcx
sub rsp, 0x28
call fcn.140045540
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140045590
add rsp, 0x28
movabs rcx, str.System32
sub rsp, 0x28
call fcn.140045590
add rsp, 0x28
lea rcx, [0x140137d24]
pop rdx
call main
push rcx
sub rsp, 0x28
call fcn.140045540
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.140045540
add rsp, 0x20
pop rcx
push rax
movabs rax, 0x1400a83cc
push rax
movabs rax, str.BuildLab
push rax
movabs rax, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_NTCurrentVersion
push rax
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.14001b7cb
add rsp, 0x28
lea rcx, [0x140137c7c]
pop rdx
call main
movabs rax, 0x1400a83cc
push rax
push qword [0x140137c7c]
pop rcx
pop rdx
call fcn.1400420d0
mov qword [0x140137ce4], rax
mov r15, qword [0x140137ce4]
cmp r15, 1
jge 0x140001bd5
jmp 0x140001c32
push rcx
sub rsp, 0x28
call fcn.140045540
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140045540
add rsp, 0x28
pop rcx
push rax
mov r15, qword [0x140137ce4]
dec r15
mov rax, r15
push rax
push 1
push qword [0x140137c7c]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400422a0
add rsp, 0x28
lea rcx, [0x140137c7c]
pop rdx
call main
push qword [0x140137c7c]
pop rcx
call fcn.140042360
mov qword [0x140137b44], rax
mov r15, qword [0x140137b44]
cmp r15, 0x2710
jle 0x140001c70
movabs rdx, 0x1400a8540
lea rcx, [0x140137d2c]
call fcn.140045450
jmp 0x140001d8f
mov r15, qword [0x140137b44]
cmp r15, 0x2580
jl 0x140001c9b
movabs rdx, 0x1400addfe
lea rcx, [0x140137d2c]
call fcn.140045450
jmp 0x140001d8f
mov r15, qword [0x140137b44]
cmp r15, 0x23f0
jl 0x140001cc4
mov r15, qword [0x140137b44]
cmp r15, 0x2454
jge 0x140001cc4
mov rax, 1
jmp 0x140001cc7
xor rax, rax
and rax, rax
je 0x140001ce7
movabs rdx, 0x1400a8518
lea rcx, [0x140137d2c]
call fcn.140045450
jmp 0x140001d8f
mov r15, qword [0x140137b44]
cmp r15, 0x1db0
jl 0x140001d10
mov r15, qword [0x140137b44]
cmp r15, 0x1e14
jge 0x140001d10
mov rax, 1
jmp 0x140001d13
xor rax, rax
and rax, rax
je 0x140001d30
movabs rdx, 0x1400a8514
lea rcx, [0x140137d2c]
call fcn.140045450
jmp 0x140001d8f
mov r15, qword [0x140137b44]
cmp r15, 0xa28
jl 0x140001d59
mov r15, qword [0x140137b44]
cmp r15, 0xfa0
jge 0x140001d59
mov rax, 1
jmp 0x140001d5c
xor rax, rax
and rax, rax
je 0x140001d79
movabs rdx, 0x1400ab2c6
lea rcx, [0x140137d2c]
call fcn.140045450
jmp 0x140001d8f
movabs rdx, 0x1400a8514
lea rcx, [0x140137d2c]
call fcn.140045450
push rcx
sub rsp, 0x28
call fcn.140045540
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140045540
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
sub rsp, 0x20
call sub.KERNEL32.dll_GetUserDefaultLangID
add rsp, 0x28
mov rax, rax
push rax
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140042490
add rsp, 0x28
lea rcx, [0x140137c8c]
pop rdx
call main
push qword [0x140137c8c]
pop rcx
call fcn.140042660
mov r15, rax
cmp r15, 3
jne 0x140001e41
push rcx
sub rsp, 0x28
call fcn.140045540
add rsp, 0x28
pop rcx
push rax
movabs rcx, 0x1400a840e
sub rsp, 0x28
call fcn.140045590
add rsp, 0x28
mov rcx, qword [0x140137c8c]
sub rsp, 0x28
call fcn.140045590
add rsp, 0x28
lea rcx, [0x140137c8c]
pop rdx
call main
push qword [0x140137c8c]
movabs rcx, str.0419
pop rdx
call fcn.1400456e0
or rax, rax
je 0x140001e74
movabs rdx, 0x1400a905e
lea rcx, [0x140137c8c]
call fcn.140045450
jmp 0x140001e8a
movabs rdx, 0x1400aa444
lea rcx, [0x140137c8c]
call fcn.140045450
mov qword [0x140137d5c], 0
mov qword [0x140137d64], 0
mov qword [0x140137b54], 0
push rcx
sub rsp, 0x28
call fcn.140045540
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.140045540
add rsp, 0x20
pop rcx
push rax
movabs rax, 0x1400a83cc
push rax
movabs rax, 0x1400ad720
push rax
movabs rax, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_NTCurrentVersion
push rax
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.14001b7cb
add rsp, 0x28
lea rcx, [0x140137bf4]
pop rdx
call main
movabs rax, str.2015
push rax
push qword [0x140137bf4]
pop rcx
pop rdx
call fcn.1400420d0
mov r15, rax
and r15, r15
jle 0x140001f37
mov qword [0x140137d5c], 1
jmp 0x140001f8f
movabs rax, str.LTSC_2021
push rax
push qword [0x140137bf4]
pop rcx
pop rdx
call fcn.1400420d0
mov r15, rax
and r15, r15
jle 0x140001f64
mov qword [0x140137b54], 1
jmp 0x140001f8f
movabs rax, str.LTSC
push rax
push qword [0x140137bf4]
pop rcx
pop rdx
call fcn.1400420d0
mov r15, rax
and r15, r15
jle 0x140001f8f
mov qword [0x140137d64], 1
mov qword [0x140137d04], 0
push rcx
sub rsp, 0x28
call fcn.140045540
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.140045540
add rsp, 0x20
pop rcx
push rax
movabs rax, 0x1400a83cc
push rax
movabs rax, str.EditionID
push rax
movabs rax, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_NTCurrentVersion
push rax
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.14001b7cb
add rsp, 0x28
lea rcx, [0x140137bfc]
pop rdx
call main
push rcx
sub rsp, 0x28
call fcn.140045540
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.140045540
add rsp, 0x20
pop rcx
push rax
movabs rax, 0x1400a83cc
push rax
movabs rax, str.CurrentBuild
push rax
movabs rax, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_NTCurrentVersion
push rax
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.14001b7cb
add rsp, 0x28
lea rcx, [0x140137c4c]
pop rdx
call main
mov qword [0x140137bac], 0
call fcn.140027028
mov r15, rax
dec r15
mov qword [0x140137b9c], r15
mov r15, qword [0x140137b9c]
and r15, r15
jl 0x140002195
mov qword [0x140137c94], 0
jmp 0x140002092
mov rax, qword [0x140137b9c]
cmp rax, qword [0x140137c94]
jl 0x140002195
push rcx
sub rsp, 0x28
call fcn.140045540
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140045540
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.140045540
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.140045540
add rsp, 0x28
pop rcx
push rax
push qword [0x140137c94]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.1400270bc
add rsp, 0x20
push rax
call fcn.140045770
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140042680
add rsp, 0x28
lea rcx, [0x140137cb4]
pop rdx
call main
push qword [0x140137cb4]
movabs rdx, str._ACTIVATE
mov rcx, qword [rsp]
sub rsp, 0x28
call fcn.1400456e0
add rsp, 0x28
or rax, rax
je 0x14000215c
mov qword [0x140137bac], 1
jmp 0x140002187
movabs rdx, str._KMS38
mov rcx, qword [rsp]
sub rsp, 0x28
call fcn.1400456e0
add rsp, 0x28
or rax, rax
je 0x140002187
mov qword [0x140137c64], 1
pop rax
inc qword [0x140137c94]
jno 0x140002092
push qword [0x140137bfc]
pop rcx
call fcn.140009f9b
push qword [0x140137d2c]
pop rcx
call fcn.140042360
mov r15, rax
cmp r15, 0xa
jl 0x1400021c4
mov r15, qword [0x140137d04]
and r15, r15
je 0x1400021c4
jmp 0x1400021cd
mov rax, 1
jmp 0x1400021d0
xor rax, rax
and rax, rax
je 0x140002216
movabs rdx, str.The_program_supports_activation_of_the_following_editions:_r_n_r_nWindows_10_11_Core_r_nWindows_10_11_Core_N_r_nWindows_10_11_CoreSingleLanguage_r_nWindows_10_11_CoreSingleLanguage_N_r_nWindows_10_11_Professional_r_nWindows_10_11_Professional_N_r_nWindows_10_11_ProfessionalEducation_r_nWindows_10_11_ProfessionalEducation_N_r_nWindows_10_11_ProfessionalWorkstation_r_nWindows_10_11_ProfessionalWorkstation_N_r_nWindows_10_11_Education_r_nWindows_10_11_Education_N_r_nWindows_10_11_Enterprise_r_nWindows_10_11_Enterprise_N_r_nWindows_10_Enterprise_LTSB_r_nWindows_10_Enterprise_LTSB_N_r_nWindows_10_Enterprise_LTSC_r_nWindows_10_11_IoT_Enterprise_r_nWindows_11_IoT_EnterpriseK_r_nWindows_10_IoT_Enterprise_LTSC
lea rcx, [0x140137c44]
call fcn.140045450
mov r15, qword [0x140137bac]
and r15, r15
jne 0x140002216
push reloc.WS2_32.dll_recv
push qword [0x140137c44]
movabs rax, 0x1400a8028
push rax
pop rcx
pop rdx
pop r8
call fcn.140026b64
mov qword [0x140137cd4], 0
mov qword [0x140137b5c], 0
mov qword [0x140137ba4], 0
push rcx
sub rsp, 0x28
call fcn.140045540
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.140045540
add rsp, 0x20
pop rcx
push rax
movabs rax, 0x1400a83cc
push rax
movabs rax, str.AppsUseLightTheme
push rax
movabs rax, str.HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionThemesPersonalize
push rax
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.14001b7cb
add rsp, 0x28
lea rcx, [0x140137cfc]
pop rdx
call main
push qword [0x140137cfc]
movabs rcx, 0x1400a840e
pop rdx
call fcn.1400456e0
or rax, rax
je 0x1400022c7
mov qword [0x140137b5c], 1
mov qword [0x140137ba4], 1
push 0
push 0
push 0
pop rcx
pop rdx
pop r8
call fcn.1400391b0
mov qword [0x140137d1c], rax
push 0xff
push 0xff
push 0xff
pop rcx
pop rdx
pop r8
call fcn.1400391b0
mov qword [0x140137c54], rax
push 0x20
push 0x20
push 0x20
pop rcx
pop rdx
pop r8
call fcn.1400391b0
mov qword [0x140137b84], rax
mov qword [0x140137cec], 1
push 0x808080
push 1
push 0
pop rcx
pop rdx
pop r8
call sub.GDI32.dll_CreatePen
mov qword [0x140137c1c], rax
push 0xcc872c
push 1
push 0
pop rcx
pop rdx
pop r8
call sub.GDI32.dll_CreatePen
mov qword [0x140137ccc], rax
mov r9, 7
xor r8, r8
lea rdx, [0x14013834c]
mov rcx, 0x3b
call fcn.14003cc8c
mov rcx, 0x200
sub rsp, 8
push rcx
lea r9, [0x14013841c]
xor r8, r8
mov rdx, 7
mov rcx, 0x59
sub rsp, 0x20
call fcn.1400368a4
add rsp, 0x28
add rsp, 8
mov rcx, 0x200
sub rsp, 8
push rcx
lea r9, [0x140138424]
xor r8, r8
mov rdx, SafeArrayPutElement
mov rcx, 8
sub rsp, 0x20
call fcn.1400368a4
add rsp, 0x28
add rsp, 8
mov rcx, 0x200
sub rsp, 8
push rcx
lea r9, [0x14013842c]
xor r8, r8
mov rdx, SafeArrayPutElement
mov rcx, 8
sub rsp, 0x20
call fcn.1400368a4
add rsp, 0x28
add rsp, 8
mov rcx, 0x200
sub rsp, 8
push rcx
lea r9, [0x140138434]
xor r8, r8
mov rdx, SafeArrayPutElement
mov rcx, 8
sub rsp, 0x20
call fcn.1400368a4
add rsp, 0x28
add rsp, 8
mov qword [0x14013831c], 2
mov qword [0x140138324], 1
sub rsp, 0x18
movabs rax, 0x140138314
push rax
xor r9, r9
mov r8, SafeArrayPutElement
mov rdx, 8
mov rcx, 2
sub rsp, 0x20
call fcn.140038c90
add rsp, 0x40
mov qword [0x140138314], rax
mov r9, SafeArrayPutElement
xor r8, r8
lea rdx, [0x14013835c]
mov rcx, 8
call fcn.14003cc8c
movabs rbp, 0x140127d4b
mov rax, rbp
push rax
push 0xffffffffffffffff
pop rcx
pop rdx
call fcn.14003ba2c
mov qword [0x140137b6c], rax
push qword [0x140137b6c]
pop rcx
call fcn.1400097bc
push qword [0x140137b94]
pop rcx
call fcn.1400097bc
mov r15, qword [0x140137bac]
and r15, r15
jle 0x140002521
push 0
pop rcx
call fcn.1400057ec
jmp 0x140002ac6
push rcx
sub rsp, 0x28
call fcn.140045540
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push SafeArrayPutElement
push rcx
sub rsp, 0x20
call fcn.140045540
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.140045540
add rsp, 0x28
pop rcx
push rax
pop rcx
sub rsp, 0x20
call fcn.140026e30
add rsp, 0x20
call fcn.1400457a0
push 0
push rax
call fcn.140045770
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.140034b70
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140024710
add rsp, 0x28
pop rax
and rax, rax
je 0x140002746
push 0
pop rcx
call fcn.140034b80
mov qword [0x140137c74], rax
mov r15, qword [0x140137c74]
inc r15
mov rax, r15
push rax
pop rcx
call fcn.140043b70
mov qword [0x140137c6c], rax
push qword [0x140137c74]
push qword [0x140137c6c]
push 0
pop rcx
pop rdx
pop r8
call fcn.140034be0
push 0
pop rcx
call fcn.1400344d0
mov qword [0x140137c2c], 0
mov qword [0x140137bec], 0
jmp 0x140002615
mov r15, qword [0x140137c74]
add r15, 0xfffffffffffffff0
cmp r15, qword [0x140137bec]
jl 0x140002728
mov r15, qword [0x140137c6c]
add r15, qword [0x140137bec]
mov rax, r15
push rax
pop rcx
call fcn.140043bc0
mov r15, rax
cmp r15, 0x5c
jne 0x14000267e
mov r15, qword [0x140137c6c]
add r15, qword [0x140137bec]
inc r15
mov rax, r15
push rax
pop rcx
call fcn.140043bc0
mov r15, rax
cmp r15, 0x84
jne 0x14000267e
mov rax, 1
jmp 0x140002681
xor rax, rax
and rax, rax
je 0x1400026b7
mov r15, qword [0x140137c6c]
add r15, qword [0x140137bec]
add r15, 9
mov rax, r15
push rax
pop rcx
call fcn.140043bc0
mov r15, rax
cmp r15, 0xcb
jne 0x1400026b7
mov rax, 1
jmp 0x1400026ba
xor rax, rax
and rax, rax
je 0x1400026f0
mov r15, qword [0x140137c6c]
add r15, qword [0x140137bec]
add r15, 0xf
mov rax, r15
push rax
pop rcx
call fcn.140043bc0
mov r15, rax
cmp r15, 0xfc
jne 0x1400026f0
mov rax, 1
jmp 0x1400026f3
xor rax, rax
and rax, rax
je 0x14000271b
mov r15, qword [0x140137bec]
add r15, 0x10
mov qword [0x140137bec], r15
mov r15, qword [0x140137c2c]
inc r15
mov qword [0x140137c2c], r15
inc qword [0x140137bec]
jno 0x140002615
push qword [0x140137c6c]
pop rcx
call fcn.140043bd0
mov r15, qword [0x140137c2c]
cmp r15, 3
jge 0x140002746
jmp 0x140002ac6
push rcx
sub rsp, 0x28
call fcn.140045540
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140045540
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140045540
add rsp, 0x28
pop rcx
push rax
pop rcx
sub rsp, 0x20
call fcn.140026e30
add rsp, 0x28
push rax
call fcn.140045770
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
sub rsp, 0x20
call fcn.140010cae
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140024710
add rsp, 0x28
pop rax
and rax, rax
je 0x1400027c2
jmp 0x140002ac6
push 0xa0
push 0x1e0
push 0
push 0
pop rcx
pop rdx
pop r8
pop r9
call fcn.140002b46
push qword [0x140137c14]
push qword [0x140137cdc]
pop rcx
pop rdx
call fcn.140031b84
push qword [0x140137c8c]
movabs rcx, 0x1400a905e
pop rdx
call fcn.1400456e0
or rax, rax
je 0x140002841
movabs rax, reloc.WS2_32.dll_recv
push rax
push qword [0x140137c04]
pop rcx
pop rdx
call fcn.14002c2b8
movabs rax, 0x1400ac67e
push rax
push qword [0x140137bc4]
pop rcx
pop rdx
call fcn.14002c2b8
jmp 0x140002859
movabs rax, str.Go_to_the_program_support_forum
push rax
push qword [0x140137bc4]
pop rcx
pop rdx
call fcn.14002c2b8
push qword [0x140137cdc]
pop rcx
call fcn.140031bb8
mov rax, rax
push rax
pop rcx
call fcn.1400391fc
and rax, rax
je 0x14000291c
push 1
pop rcx
call fcn.1400443ec
mov rax, rax
push rax
pop rcx
call fcn.140039280
push rcx
sub rsp, 0x28
call fcn.140045540
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140045540
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140045540
add rsp, 0x28
pop rcx
push rax
push qword [0x140137bc4]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14002c31c
add rsp, 0x28
push rax
call fcn.140045770
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
sub rsp, 0x20
call fcn.1400392a4
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140024710
add rsp, 0x28
pop rax
mov rax, rax
push rax
pop rcx
call fcn.140037278
mov qword [0x140137c84], rax
call fcn.140039300
sub rsp, 8
push 0xffffffffffff0001
push qword [0x140137c84]
push 0xffffffffffff0001
push qword [0x140137cdc]
pop rcx
sub rsp, 0x20
call fcn.140031c90
add rsp, 0x20
mov r15, rax
sub r15, qword [0x140137c84]
mov rax, r15
mov rcx, 2
cqo
idiv rcx
mov r15, rax
mov rax, r15
push rax
push qword [0x140137bc4]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14002c54c
add rsp, 0x30
push qword [0x140137d44]
push 0xffffffffffffffff
push qword [0x140137bbc]
pop rcx
pop rdx
pop r8
call fcn.14002c5c0
push qword [0x140137cf4]
push 0xffffffffffffffff
push qword [0x140137bbc]
pop rcx
pop rdx
pop r8
call fcn.14002c5c0
mov r15, qword [0x140137c64]
and r15, r15
jle 0x1400029d1
push 1
push qword [0x140137bbc]
pop rcx
pop rdx
call fcn.14002c65c
jmp 0x1400029e3
push 0
push qword [0x140137bbc]
pop rcx
pop rdx
call fcn.14002c65c
call fcn.14000be1e
call fcn.14003172c
mov r15, rax
cmp r15, 0x6e
jl 0x140002a0b
mov r15, qword [0x140137ba4]
and r15, r15
jle 0x140002a0b
mov rax, 1
jmp 0x140002a0e
xor rax, rax
and rax, rax
je 0x140002a2a
call fcn.140012a56
push 1
push qword [0x140137cdc]
pop rcx
pop rdx
call fcn.140010752
push 0
push qword [0x140137cdc]
pop rcx
pop rdx
call fcn.140031ce8
call fcn.140031df0
mov qword [0x140137c9c], rax
cmp qword [0x140137c9c], 0
je 0x140002aa7
call fcn.140035f14
mov rax, rax
push rax
mov r15, qword [0x140137cdc]
cmp r15, qword [rsp]
jne 0x140002a82
sub rsp, 8
push qword [0x140137c9c]
pop rcx
sub rsp, 0x20
call fcn.14000bf96
add rsp, 0x28
jmp 0x140002aa4
mov qword [0x140137c9c], 0
sub rsp, 8
push 5
pop rcx
sub rsp, 0x20
call fcn.140031928
add rsp, 0x28
pop rax
jmp 0x140002ab2
push 5
pop rcx
call fcn.140031928
mov r15, qword [0x140137c9c]
cmp r15, 0x333c
jne 0x140002a3c
call 0x140002ae8
call fcn.140045420
mov rcx, qword [0x140137b24]
call sub.KERNEL32.dll_HeapDestroy
mov rcx, qword [0x140137b34]
call sub.KERNEL32.dll_ExitProcess
sub rsp, 0x28
call fcn.140025944
call fcn.140025ecc
call fcn.140027c7c
call fcn.1400288c4
call fcn.140029a20
call fcn.14002c180
call fcn.140031a8c
call fcn.140033884
call fcn.1400345b0
call fcn.140035d28
call fcn.1400371ec
call fcn.14003b9fc
call fcn.14003dbe8
call fcn.140041ca0
call fcn.140044460
call fcn.1400444c0
call fcn.1400439a0
add rsp, 0x28
ret