Function at 0x401000
Capabilities:
Allocate thread local storage
Identify system language via api
Query environment variable

Disassembly:
push 0x598
push 0
push 0x4c0108
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.DLL_GetModuleHandleW
mov dword [0x4c010c], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.DLL_HeapCreate
mov dword [0x4c0108], eax
mov eax, 0x46d848
mov dword [0x4c0138], eax
call fcn.00422530
call fcn.00421934
call fcn.00421430
call fcn.0041fbb0
call fcn.0041dae4
call fcn.0041d270
call fcn.0041c848
call fcn.0041b649
call fcn.0041a86d
call fcn.0041a43b
call fcn.0041a1b6
call fcn.00418d30
call fcn.0041875a
call fcn.0041819d
call fcn.00416f10
call fcn.0041517b
call fcn.0040e1d3
call fcn.0040d2bc
call fcn.0040c952
call fcn.0040bedd
call fcn.0040b3a5
call fcn.0040b191
call fcn.0040b099
mov edx, str.Microsoft_Defender_Tools_v1.11
lea ecx, [0x4c018c]
call fcn.0040a008
call fcn.00406fd2
mov edx, 0x46a024
lea ecx, [0x4c0168]
call fcn.0040a008
push edx
call fcn.00422580
pop edx
push eax
push edx
call fcn.00422580
pop edx
push eax
push 0x64
call fcn.0041fe60
push 0x4c0114
call fcn.004225c0
push edx
call fcn.00422580
pop edx
push eax
push edx
call fcn.00422580
pop edx
push eax
push 0xc8
call fcn.0041fe60
push 0x4c016c
call fcn.004225c0
push edx
call fcn.00422580
pop edx
push eax
push edx
call fcn.00422580
pop edx
push eax
push 0xc8
call fcn.0041fe60
push 0x4c0194
call fcn.004225c0
push 0xc8
mov eax, dword [0x4c016c]
push eax
mov eax, str.PROCESSOR_ARCHITECTURE
push eax
call sub.KERNEL32.DLL_GetEnvironmentVariableW
push 0xc8
mov eax, dword [0x4c0194]
push eax
mov eax, str.PROCESSOR_ARCHITEW6432
push eax
call sub.KERNEL32.DLL_GetEnvironmentVariableW
push 0x64
mov eax, dword [0x4c0114]
push eax
mov eax, str.SYSTEMDRIVE
push eax
call sub.KERNEL32.DLL_GetEnvironmentVariableW
push dword [0x4c016c]
mov edx, str.AMD64
pop ecx
call fcn.0040a710
jne 0x4011b7
push dword [0x4c0194]
mov edx, str.AMD64
pop ecx
call fcn.0040a710
jne 0x4011b7
jmp 0x4011be
mov eax, 1
jmp 0x4011c0
xor eax, eax
and eax, eax
je 0x4011d6
mov edx, 0x46bb0e
lea ecx, [0x4c0168]
call fcn.0040a008
jmp 0x4011e6
mov edx, 0x46c33a
lea ecx, [0x4c0168]
call fcn.0040a008
mov edx, dword [0x4c0184]
push edx
call fcn.00422580
pop edx
push eax
push edx
call fcn.00422650
mov edx, str.System32
push edx
call fcn.00422650
push 0x4c0120
call fcn.004225c0
push edx
call fcn.00422580
pop edx
push eax
mov edx, dword [0x4c0184]
push edx
call fcn.00422580
pop edx
push eax
push edx
call fcn.00422650
mov edx, str.Sysnativecmd.exe
push edx
call fcn.00422650
call fcn.0040a762
add dword [esp], edx
call fcn.004163cb
call fcn.0040a780
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x40125c
jl 0x401258
cmp ebx, 0
ja 0x40125c
xor eax, eax
jmp 0x401261
mov eax, 1
or eax, eax
je 0x401290
mov edx, dword [0x4c0184]
push edx
call fcn.00422580
pop edx
push eax
push edx
call fcn.00422650
mov edx, str.Sysnative
push edx
call fcn.00422650
push 0x4c0184
call fcn.004225c0
jmp 0x4012b9
mov edx, dword [0x4c0184]
push edx
call fcn.00422580
pop edx
push eax
push edx
call fcn.00422650
mov edx, str.System32
push edx
call fcn.00422650
push 0x4c0184
call fcn.004225c0
push edx
call fcn.00422580
pop edx
push eax
push edx
call fcn.00422580
pop edx
push eax
call sub.KERNEL32.DLL_GetUserDefaultLangID
cdq
push edx
push eax
call fcn.0041ff90
push 0x4c0110
call fcn.004225c0
push dword [0x4c0110]
call fcn.00420010
mov ebx, eax
cmp ebx, 3
jne 0x40131b
push edx
call fcn.00422580
pop edx
push eax
mov edx, 0x46a294
push edx
call fcn.00422650
mov edx, dword [0x4c0110]
push edx
call fcn.00422650
push 0x4c0110
call fcn.004225c0
push dword [0x4c0110]
mov edx, str.0419
pop ecx
call fcn.0040a710
je 0x401390
mov edx, 0x46a498
lea ecx, [0x4c0148]
call fcn.0040a008
mov edx, 0x46a6dc
lea ecx, [0x4c017c]
call fcn.0040a008
mov edx, 0x46a302
lea ecx, [0x4c01a0]
call fcn.0040a008
mov edx, 0x46d018
lea ecx, [0x4c0158]
call fcn.0040a008
mov edx, 0x46b0e2
lea ecx, [0x4c0118]
call fcn.0040a008
mov edx, 0x46cecc
lea ecx, [0x4c013c]
call fcn.0040a008
jmp 0x4013f0
mov edx, str.Microsoft_Defender_Exclusion_Path
lea ecx, [0x4c0148]
call fcn.0040a008
mov edx, str.Enable_Defender
lea ecx, [0x4c017c]
call fcn.0040a008
mov edx, 0x46a704
lea ecx, [0x4c01a0]
call fcn.0040a008
mov edx, str.Reload_Table
lea ecx, [0x4c0158]
call fcn.0040a008
mov edx, 0x46ad1c
lea ecx, [0x4c0118]
call fcn.0040a008
mov edx, str.Delete
lea ecx, [0x4c013c]
call fcn.0040a008
call fcn.0040d8b6
mov ebp, 0x46dbb2
push ebp
push 0xffffffff
call fcn.0041a9ec
mov dword [0x4c0128], eax
call fcn.0040d8b6
mov ebp, 0x4b4f03
push ebp
push 0xffffffff
call fcn.0041a9ec
mov dword [0x4c0140], eax
mov ebp, 0x4bc34f
push ebp
push 0xffffffff
call fcn.0041a9ec
mov dword [0x4c0188], eax
push dword [0x4c0128]
call fcn.0040264c
push dword [0x4c0188]
call fcn.0040264c
push 1
push dword [0x4c0140]
call fcn.0041aa03
push eax
call fcn.00418da1
push eax
push dword [0x4c0140]
call fcn.0041aa21
push eax
call fcn.00418dc5
push eax
push dword [0x4c0140]
call fcn.0041aa3f
call fcn.0040b539
mov ebx, eax
dec ebx
mov dword [0x4c012c], ebx
mov ebx, dword [0x4c012c]
and ebx, ebx
jl 0x401542
mov dword [0x4c015c], 0
jmp 0x4014ab
mov eax, dword [0x4c012c]
cmp eax, dword [0x4c015c]
jl 0x40153d
push edx
call fcn.00422580
pop edx
push eax
push edx
call fcn.00422580
pop edx
push eax
push edx
call fcn.00422580
pop edx
push eax
push edx
call fcn.00422580
pop edx
push eax
push dword [0x4c015c]
call fcn.0040b54d
call fcn.0040a762
add dword [esp], edx
call fcn.00420040
push 0x4c0170
call fcn.004225c0
push dword [0x4c0170]
call fcn.004163cb
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x40151d
jl 0x401519
cmp ebx, 0
ja 0x40151d
xor eax, eax
jmp 0x401522
mov eax, 1
or eax, eax
je 0x401531
push dword [0x4c0170]
call fcn.00401c0f
inc dword [0x4c015c]
jno 0x4014ab
jmp 0x40197c
push 0x100
push 0x12
mov eax, str.Microsoft_Sans_Serif
push eax
push 0
call fcn.00421981
and eax, eax
je 0x401564
xor eax, eax
jmp 0x401569
mov eax, 1
and eax, eax
je 0x401588
push 0
mov eax, str.Load_font__Microsoft_Sans_Serif__error_
push eax
mov eax, str.Error
push eax
call fcn.0040b1ca
jmp 0x40197c
push 0xa
mov eax, str.Microsoft_Sans_Serif
push eax
push 1
call fcn.00421a4a
and eax, eax
je 0x4015a5
xor eax, eax
jmp 0x4015aa
mov eax, 1
and eax, eax
je 0x4015c9
push 0
mov eax, str.Load_font__Microsoft_Sans_Serif__error_
push eax
mov eax, str.Error
push eax
call fcn.0040b1ca
jmp 0x40197c
push 1
call fcn.00421a60
push eax
push 0xffffffff
call fcn.0040e279
push dword [0x4c0140]
call fcn.0041aae8
push eax
call fcn.0041a46f
and eax, eax
je 0x4016af
push 1
call fcn.0041a4d4
push 0
call fcn.00421a60
push eax
call fcn.0041a4eb
mov edx, str.Defender_Tools
lea ecx, [0x4c0174]
call fcn.0040a008
push dword [0x4c0174]
call fcn.0041a502
mov dword [0x4c019c], eax
push dword [0x4c0174]
call fcn.0041a519
mov dword [0x4c0198], eax
push 0xff
push 0xff
mov eax, 0xff
call fcn.0040a6a0
mov dword [0x4c0154], eax
push 5
push 5
call fcn.0041a530
mov dword [0x4c011c], eax
push dword [0x4c011c]
push dword [0x4c0154]
push dword [0x4c0174]
push 0xa
push dword [0x4c0140]
call fcn.0041aa21
mov ebx, eax
sub ebx, dword [0x4c019c]
mov eax, ebx
mov ecx, 2
cdq
idiv ecx
mov ebx, eax
push ebx
call fcn.0041a559
call fcn.0041a5de
push 0x180
push 0x2ac
push 0
push 0
call fcn.004019f1
push 0
push dword [0x4c0148]
push 0xffffffff
push dword [0x4c0180]
call fcn.0040e2e8
push 0
lea eax, [fcn.00402fb6]
push eax
call fcn.0040b0f1
push 0x7d0
push 1
push dword [0x4c0178]
call fcn.004151e6
push 1
push dword [0x4c0140]
call fcn.0041acb3
push eax
push dword [0x4c0178]
call fcn.00415215
push eax
call fcn.0040a2a0
call fcn.00402153
push 0
call fcn.00402d8d
push 0
push dword [0x4c0178]
call fcn.004152e3
call fcn.004152f5
mov dword [0x4c0164], eax
cmp dword [0x4c0164], 0
je 0x4018a3
push dword [0x4c0164]
mov ebx, 0x201
cmp ebx, dword [esp]
jne 0x401796
push 0
push 2
push 0xa1
push dword [0x4c0178]
call fcn.00415215
push eax
call sub.USER32.DLL_SendMessageW
jmp 0x401883
mov ebx, 0x332c
cmp ebx, dword [esp]
jne 0x401852
call fcn.004182b7
push eax
mov ebx, dword [0x4c0180]
cmp ebx, dword [esp]
jne 0x4017f8
push edx
call fcn.00422580
pop edx
push eax
push edx
call fcn.00422580
pop edx
push eax
push edx
call fcn.00422580
pop edx
push eax
push dword [0x4c0180]
call fcn.0040e334
call fcn.004226b0
push dword [0x4c014c]
call fcn.0040a762
add dword [esp + 4], edx
call fcn.0040e39c
call fcn.0040a780
jmp 0x40184f
mov ebx, dword [0x4c0190]
cmp ebx, dword [esp]
jne 0x40184f
call fcn.004182c6
mov ebx, eax
and ebx, ebx
jne 0x40184f
push edx
call fcn.00422580
pop edx
push eax
push edx
call fcn.00422580
pop edx
push eax
push edx
call fcn.00422580
pop edx
push eax
push dword [0x4c0190]
call fcn.0040e334
call fcn.004226b0
push dword [0x4c014c]
call fcn.0040a762
add dword [esp + 4], edx
call fcn.0040e39c
call fcn.0040a780
pop eax
jmp 0x401883
mov ebx, 0x332d
cmp ebx, dword [esp]
jne 0x40185e
jmp 0x401883
mov ebx, 0x3336
cmp ebx, dword [esp]
jne 0x401883
call fcn.004182d5
push eax
mov ebx, 1
cmp ebx, dword [esp]
jne 0x401882
push 1
call fcn.00402fb6
pop eax
pop eax
call fcn.004182e4
push eax
mov ebx, dword [0x4c0178]
cmp ebx, dword [esp]
jne 0x4018a0
push dword [0x4c0164]
call fcn.00403071
pop eax
jmp 0x4018ad
push 5
call fcn.00414e70
mov ebx, dword [0x4c0164]
cmp ebx, 0x333c
jne 0x40174a
push edx
call fcn.00422580
pop edx
push eax
push 2
push edx
call fcn.00422580
pop edx
push eax
push edx
call fcn.00422580
pop edx
push eax
call fcn.00416522
mov edx, str.Disable.cmd
push edx
call fcn.00422650
call fcn.0040a762
add dword [esp], edx
call fcn.00416585
call fcn.0040a780
push edx
call fcn.00422580
pop edx
push eax
push 2
push edx
call fcn.00422580
pop edx
push eax
push edx
call fcn.00422580
pop edx
push eax
call fcn.00416522
mov edx, str.Enable.cmd
push edx
call fcn.00422650
call fcn.0040a762
add dword [esp], edx
call fcn.00416585
call fcn.0040a780
push edx
call fcn.00422580
pop edx
push eax
push 2
push edx
call fcn.00422580
pop edx
push eax
push edx
call fcn.00422580
pop edx
push eax
call fcn.00416522
mov edx, str.loader.exe
push edx
call fcn.00422650
call fcn.0040a762
add dword [esp], edx
call fcn.00416585
call fcn.0040a780
push 0
call 0x40199b
call fcn.00422560
push dword [0x4c0108]
call sub.KERNEL32.DLL_HeapDestroy
call sub.KERNEL32.DLL_ExitProcess
call fcn.0040a3a0
call fcn.0040b057
call fcn.0040becb
call fcn.0040c852
call fcn.0040d2b0
call fcn.0040e17d
call fcn.00415158
call fcn.004165c1
call fcn.00416f00
call fcn.0041817f
call fcn.00418d1f
call fcn.0041a861
call fcn.0041c83b
call fcn.0041fbd0
call fcn.00421abd
call fcn.00421b07
call fcn.00421420
ret