Function at 0x401000
Capabilities:
Allocate thread local storage
Query environment variable

Disassembly:
push 0x550
push 0
push 0x79e8ec
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleW
mov dword [0x79e8f0], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x79e8ec], eax
mov eax, 0x486fd4
mov dword [0x79e900], eax
call fcn.00423320
call fcn.004227b4
call fcn.004222b0
call fcn.00420a80
call fcn.0041e9bc
call fcn.0041e260
call fcn.0041d838
call fcn.0041c639
call fcn.0041bf5b
call fcn.0041bc0b
call fcn.0041b986
call fcn.0041a0cb
call fcn.00419b1d
call fcn.004188a0
call fcn.00417b4e
call fcn.004169d6
call fcn.00411bb3
call fcn.0041107c
call fcn.00410651
call fcn.0040f821
call fcn.0040ef41
call fcn.0040e997
call fcn.0040dcfb
mov edx, str.Office_2013_2021_License_Setup_v1.30
lea ecx, [0x79e92c]
call fcn.0040d008
mov dword [0x79e918], 0
mov edx, 0x483028
lea ecx, [0x79e940]
call fcn.0040d008
mov dword [0x79e8fc], 0
mov dword [0x79e914], 0
mov edx, str.Office_2016_2021_C2R_Licenses
lea ecx, [0x79e944]
call fcn.0040d008
mov edx, str.Office_2013_C2R_Licenses
lea ecx, [0x79e910]
call fcn.0040d008
mov edx, str.____Press__Refresh__button___
lea ecx, [0x79e90c]
call fcn.0040d008
mov edx, 0x48341a
lea ecx, [0x79e908]
call fcn.0040d008
mov edx, 0x483028
lea ecx, [0x79e924]
call fcn.0040d008
push edx
call main
pop edx
push eax
push edx
call main
pop edx
push eax
push 0x64
call fcn.00420d30
push 0x79e8f4
call fcn.004233b0
push edx
call main
pop edx
push eax
push edx
call main
pop edx
push eax
push 0x3e8
call fcn.00420d30
push 0x79e934
call fcn.004233b0
push edx
call main
pop edx
push eax
push edx
call main
pop edx
push eax
push 0x3e8
call fcn.00420d30
push 0x79e938
call fcn.004233b0
push edx
call main
pop edx
push eax
push edx
call main
pop edx
push eax
push 0x3e8
call fcn.00420d30
push 0x79e8f8
call fcn.004233b0
push edx
call main
pop edx
push eax
push edx
call main
pop edx
push eax
push 0x3e8
call fcn.00420d30
push 0x79e904
call fcn.004233b0
push edx
call main
pop edx
push eax
push edx
call main
pop edx
push eax
push 0xc8
call fcn.00420d30
push 0x79e928
call fcn.004233b0
push edx
call main
pop edx
push eax
push edx
call main
pop edx
push eax
push 0xc8
call fcn.00420d30
push 0x79e93c
call fcn.004233b0
push 0x64
mov eax, dword [0x79e8f4]
push eax
mov eax, str.SYSTEMDRIVE
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0x3e8
mov eax, dword [0x79e934]
push eax
mov eax, str.TEMP
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0x3e8
mov eax, dword [0x79e938]
push eax
mov eax, str.WINDIR
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0x3e8
mov eax, dword [0x79e928]
push eax
mov eax, str.PROCESSOR_ARCHITECTURE
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0x3e8
mov eax, dword [0x79e93c]
push eax
mov eax, str.PROCESSOR_ARCHITEW6432
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0x3e8
mov eax, dword [0x79e904]
push eax
mov eax, str.ALLUSERSPROFILE
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
push dword [0x79e928]
mov edx, str.AMD64
pop ecx
call fcn.0040d580
jne 0x4012f2
push dword [0x79e93c]
mov edx, str.AMD64
pop ecx
call fcn.0040d580
jne 0x4012f2
jmp 0x4012f9
mov eax, 1
jmp 0x4012fb
xor eax, eax
and eax, eax
je 0x401311
mov edx, 0x484dcc
lea ecx, [0x79e924]
call fcn.0040d008
jmp 0x401321
mov edx, 0x48572e
lea ecx, [0x79e924]
call fcn.0040d008
mov edx, dword [0x79e938]
push edx
call main
pop edx
push eax
push edx
call fcn.00423440
mov edx, str.System32
push edx
call fcn.00423440
push 0x79e8f8
call fcn.004233b0
push edx
call main
pop edx
push eax
mov edx, dword [0x79e938]
push edx
call main
pop edx
push eax
push edx
call fcn.00423440
mov edx, str.Sysnativecmd.exe
push edx
call fcn.00423440
call fcn.0040d5d2
add dword [esp], edx
call fcn.00417cda
call fcn.0040d5f0
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x401397
jl 0x401393
cmp ebx, 0
ja 0x401397
xor eax, eax
jmp 0x40139c
mov eax, 1
or eax, eax
je 0x4013cb
mov edx, dword [0x79e938]
push edx
call main
pop edx
push eax
push edx
call fcn.00423440
mov edx, str.Sysnative
push edx
call fcn.00423440
push 0x79e938
call fcn.004233b0
jmp 0x4013f4
mov edx, dword [0x79e938]
push edx
call main
pop edx
push eax
push edx
call fcn.00423440
mov edx, str.System32
push edx
call fcn.00423440
push 0x79e938
call fcn.004233b0
push 0xa
mov eax, str.Consolas
push eax
push 0
call fcn.004228ca
push 0x100
push 1
call fcn.0040c07d
push edx
call main
pop edx
push eax
mov eax, 0x4832dc
push eax
mov eax, str.InstallPath
push eax
mov eax, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftOfficeClickToRun
push eax
call fcn.00407492
push 0x79e930
call fcn.004233b0
push edx
call main
pop edx
push eax
mov edx, dword [0x79e930]
push edx
call main
pop edx
push eax
push edx
call fcn.00423440
mov edx, str.Office16ospp.vbs
push edx
call fcn.00423440
call fcn.0040d5d2
add dword [esp], edx
call fcn.00417cda
call fcn.0040d5f0
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x40148e
jl 0x40148a
cmp ebx, 0
ja 0x40148e
xor eax, eax
jmp 0x401493
mov eax, 1
or eax, eax
je 0x4014ac
mov edx, 0x48341a
lea ecx, [0x79e908]
call fcn.0040d008
jmp 0x40154b
mov edx, 0x483028
lea ecx, [0x79e930]
call fcn.0040d008
push edx
call main
pop edx
push eax
mov eax, 0x4832dc
push eax
mov eax, str.InstallPath
push eax
mov eax, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftOffice15.0ClickToRun
push eax
call fcn.00407492
push 0x79e930
call fcn.004233b0
push edx
call main
pop edx
push eax
mov edx, dword [0x79e930]
push edx
call main
pop edx
push eax
push edx
call fcn.00423440
mov edx, str._rootLicensesc2rpridslicensefiles_auto.xml
push edx
call fcn.00423440
call fcn.0040d5d2
add dword [esp], edx
call fcn.00417cda
call fcn.0040d5f0
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x401532
jl 0x40152e
cmp ebx, 0
ja 0x401532
xor eax, eax
jmp 0x401537
mov eax, 1
or eax, eax
je 0x40154b
mov edx, 0x483414
lea ecx, [0x79e908]
call fcn.0040d008
push 0x1d6
push 0x318
push 0
push 0
call fcn.0040180d
push 1
push 2
call fcn.00411c59
push dword [0x79e908]
mov edx, 0x48341a
pop ecx
call fcn.0040d580
je 0x4015b5
push 1
push 7
call fcn.00411c84
push 0
push 8
call fcn.00411cbc
push 1
push 0
call fcn.00411cbc
jmp 0x4015e2
push 1
push 6
call fcn.00411c84
push 1
push 8
call fcn.00411cbc
push 0
push 0
call fcn.00411cbc
push 0
push dword [0x79e90c]
push 0xffffffff
push 8
call fcn.00411cfa
push 0
push dword [0x79e90c]
push 0xffffffff
push 0
call fcn.00411cfa
push 1
call fcn.00411d46
push 0
push dword [0x79e910]
push 0xffffffff
push 0
call fcn.00411cfa
push 0
push dword [0x79e944]
push 0xffffffff
push 8
call fcn.00411cfa
call fcn.00416a41
and eax, eax
je 0x40165f
jmp 0x401654
call fcn.00416a41
and eax, eax
je 0x40166a
jmp 0x40165f
push 0
call fcn.0040586d
call fcn.00416a41
mov dword [0x79e920], eax
cmp dword [0x79e920], 0
je 0x4016f7
push dword [0x79e920]
mov ebx, 0x332c
cmp ebx, dword [esp]
jne 0x4016c5
call fcn.00419c37
push eax
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x4016b0
push 0
call fcn.0040329b
jmp 0x4016c4
mov ebx, 8
cmp ebx, dword [esp]
jne 0x4016c4
push 8
call fcn.0040329b
pop eax
pop eax
call fcn.00419c46
push eax
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x4016e0
push dword [0x79e920]
call fcn.00405dd2
jmp 0x4016f4
mov dword [0x79e920], 0
push 5
call fcn.004166ad
pop eax
jmp 0x401701
push 5
call fcn.004166ad
mov ebx, dword [0x79e920]
cmp ebx, 0x333c
jne 0x401674
push edx
call main
pop edx
push eax
push 3
mov eax, 0x483028
push eax
mov edx, dword [0x79e934]
push edx
call main
pop edx
push eax
push edx
call fcn.00423440
mov edx, str.o16files
push edx
call fcn.00423440
call fcn.0040d5d2
add dword [esp], edx
call fcn.00417e31
call fcn.0040d5f0
push edx
call main
pop edx
push eax
push 3
mov eax, 0x483028
push eax
mov edx, dword [0x79e934]
push edx
call main
pop edx
push eax
push edx
call fcn.00423440
mov edx, str.o15files
push edx
call fcn.00423440
call fcn.0040d5d2
add dword [esp], edx
call fcn.00417e31
call fcn.0040d5f0
jmp 0x40179d
push 0
call 0x4017bc
call fcn.00423350
push dword [0x79e8ec]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess
call fcn.0040dc6b
call fcn.0040f80f
call fcn.00410621
call fcn.00411070
call fcn.00411b5d
call fcn.004169b3
call fcn.00417b3d
call fcn.00418106
call fcn.00418890
call fcn.00419aff
call fcn.0041bf4f
call fcn.0041d82b
call fcn.00420aa0
call fcn.00422921
call fcn.00422987
call fcn.004222a0
ret