Function at 0x401000
Capabilities:
Allocate thread local storage
Identify system language via api
Query environment variable

Disassembly:
push 0x5e0
push 0
push 0x6d3490
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleW
mov dword [0x6d3494], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x6d3490], eax
mov eax, 0x4b831c
mov dword [0x6d34c8], eax
call fcn.00413d89
call fcn.00428eb0
call fcn.0042820f
call fcn.00427bd0
call fcn.004263a0
call fcn.004242dc
call fcn.00423b80
call fcn.004233d0
call fcn.00422a6d
call fcn.00422341
call fcn.00421811
call fcn.0042133f
call fcn.0041e834
call fcn.0041e13e
call fcn.0041da8d
call fcn.0041c820
call fcn.0041a852
call fcn.00417833
call fcn.00416cfc
call fcn.00416200
call fcn.00416081
call fcn.00414dcf
call fcn.004142aa
call fcn.00414096
call fcn.00413eec
mov edx, str.Office_uninstall_v2.0.2
lea ecx, [0x6d34e4]
call fcn.00413008
mov edx, 0x4b54cc
lea ecx, [0x6d34fc]
call fcn.00413008
mov dword [0x6d353c], 0
push edx
call fcn.00428f00
pop edx
push eax
push edx
call fcn.00428f00
pop edx
push eax
push 0x3e8
call fcn.00426650
lea eax, [0x6d3530]
push eax
call fcn.00428f40
mov dword [0x6d34cc], 0
mov dword [0x6d34bc], 0
mov dword [0x6d3544], 1
mov dword [0x6d3528], 2
push 0x808080
push 1
push 0
call sub.GDI32.dll_CreatePen
mov dword [0x6d34e8], eax
push 0xcc872c
push 1
push 0
call sub.GDI32.dll_CreatePen
mov dword [0x6d351c], eax
push 7
xor eax, eax
push eax
lea eax, [0x6d3a04]
push eax
push 0x1f
call fcn.00422a8c
mov eax, 0x200
push eax
lea eax, [0x6d3a64]
push eax
xor eax, eax
push eax
push 7
push 0x2d
call fcn.0041e15d
mov eax, 0x200
push eax
lea eax, [0x6d3a68]
push eax
xor eax, eax
push eax
push 0x15
push 4
call fcn.0041e15d
mov eax, 0x200
push eax
lea eax, [0x6d3a6c]
push eax
xor eax, eax
push eax
push 0x15
push 4
call fcn.0041e15d
mov dword [0x6d39ec], 2
mov dword [0x6d39f0], 1
push 0x6d39e8
push 0
push 0x15
push 4
push 2
call fcn.0042140f
mov edx, 0x4b4028
lea ecx, [0x6d350c]
call fcn.00413008
push edx
call fcn.00428f00
pop edx
push eax
push edx
call fcn.00428f00
pop edx
push eax
push 0xc8
call fcn.00426650
lea eax, [0x6d3510]
push eax
call fcn.00428f40
push edx
call fcn.00428f00
pop edx
push eax
push edx
call fcn.00428f00
pop edx
push eax
push 0xc8
call fcn.00426650
lea eax, [0x6d3540]
push eax
call fcn.00428f40
push 0xc8
mov eax, dword [0x6d3510]
push eax
mov eax, str.PROCESSOR_ARCHITECTURE
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0xc8
mov eax, dword [0x6d3540]
push eax
mov eax, str.PROCESSOR_ARCHITEW6432
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0x3e8
mov eax, dword [0x6d3530]
push eax
mov eax, str.TEMP
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
push edx
call fcn.00428f00
pop edx
push eax
push edx
call fcn.00428f00
pop edx
push eax
push 0x3e8
call fcn.00426650
lea eax, [0x6d3538]
push eax
call fcn.00428f40
push 0x3e8
mov eax, dword [0x6d3538]
push eax
mov eax, str.WINDIR
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
push edx
call fcn.00428f00
pop edx
push eax
push edx
call fcn.00428f00
pop edx
push eax
push 0x3e8
call fcn.00426650
lea eax, [0x6d34a8]
push eax
call fcn.00428f40
push 0x3e8
mov eax, dword [0x6d34a8]
push eax
mov eax, str.WINDIR
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
push edx
call fcn.00428f00
pop edx
push eax
mov edx, dword [0x6d3538]
push edx
call fcn.00428f00
pop edx
push eax
push edx
call fcn.00428fd0
mov edx, str.Sysnativecmd.exe
push edx
call fcn.00428fd0
call fcn.00413632
add dword [esp], edx
call fcn.0041bce6
call fcn.00413650
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x40137b
jl 0x401377
cmp ebx, 0
ja 0x40137b
xor eax, eax
jmp 0x401380
mov eax, 1
or eax, eax
je 0x4013b1
mov edx, dword [0x6d3538]
push edx
call fcn.00428f00
pop edx
push eax
push edx
call fcn.00428fd0
mov edx, str.Sysnative
push edx
call fcn.00428fd0
lea eax, [0x6d3538]
push eax
call fcn.00428f40
jmp 0x4013dc
mov edx, dword [0x6d3538]
push edx
call fcn.00428f00
pop edx
push eax
push edx
call fcn.00428fd0
mov edx, str.System32
push edx
call fcn.00428fd0
lea eax, [0x6d3538]
push eax
call fcn.00428f40
mov dword [0x6d354c], 0
call fcn.0041443e
mov ebx, eax
dec ebx
mov dword [0x6d34b8], ebx
mov ebx, dword [0x6d34b8]
and ebx, ebx
jl 0x401487
mov dword [0x6d3500], 0
jmp 0x40140e
mov eax, dword [0x6d34b8]
cmp eax, dword [0x6d3500]
jl 0x401487
push edx
call fcn.00428f00
pop edx
push eax
push edx
call fcn.00428f00
pop edx
push eax
push edx
call fcn.00428f00
pop edx
push eax
push edx
call fcn.00428f00
pop edx
push eax
push dword [0x6d3500]
call fcn.00414452
call fcn.00413632
add dword [esp], edx
call fcn.004266a0
lea eax, [0x6d3518]
push eax
call fcn.00428f40
push dword [0x6d3518]
mov edx, str._CMD
mov ecx, dword [esp]
call fcn.00413660
je 0x40147e
mov dword [0x6d354c], 1
pop eax
inc dword [0x6d3500]
jno 0x40140e
push 9
mov eax, str.Consolas
push eax
push 0
call fcn.00428325
push edx
call fcn.00428f00
pop edx
push eax
push 1
push edx
call fcn.00428f00
pop edx
push eax
push edx
call fcn.00428f00
pop edx
push eax
call fcn.004144a0
call fcn.00413632
add dword [esp], edx
call fcn.00404e7e
call fcn.00413650
call fcn.0041443e
mov ebx, eax
dec ebx
mov dword [0x6d34b8], ebx
mov ebx, dword [0x6d34b8]
and ebx, ebx
jl 0x401680
mov dword [0x6d3544], 0
mov dword [0x6d3500], 0
jmp 0x401502
mov eax, dword [0x6d34b8]
cmp eax, dword [0x6d3500]
jl 0x4015d4
push edx
call fcn.00428f00
pop edx
push eax
push edx
call fcn.00428f00
pop edx
push eax
push edx
call fcn.00428f00
pop edx
push eax
push edx
call fcn.00428f00
pop edx
push eax
push dword [0x6d3500]
call fcn.00414452
call fcn.00413632
add dword [esp], edx
call fcn.004266a0
lea eax, [0x6d3518]
push eax
call fcn.00428f40
push dword [0x6d3518]
mov edx, str._LOG
mov ecx, dword [esp]
call fcn.00413660
je 0x401578
mov dword [0x6d353c], 1
jmp 0x4015c7
mov edx, str._O2010
mov ecx, dword [esp]
call fcn.00413660
je 0x401593
mov dword [0x6d34cc], 1
jmp 0x4015c7
mov edx, str._O2013_16
mov ecx, dword [esp]
call fcn.00413660
je 0x4015ae
mov dword [0x6d34bc], 1
jmp 0x4015c7
mov edx, str._O2013_21C2R
mov ecx, dword [esp]
call fcn.00413660
je 0x4015c7
mov dword [0x6d3544], 1
pop eax
inc dword [0x6d3500]
jno 0x401502
mov dword [0x6d3500], 0
jmp 0x4015e0
mov eax, dword [0x6d34b8]
cmp eax, dword [0x6d3500]
jl 0x40167b
push edx
call fcn.00428f00
pop edx
push eax
push edx
call fcn.00428f00
pop edx
push eax
push edx
call fcn.00428f00
pop edx
push eax
push edx
call fcn.00428f00
pop edx
push eax
push dword [0x6d3500]
call fcn.00414452
call fcn.00413632
add dword [esp], edx
call fcn.004266a0
lea eax, [0x6d3518]
push eax
call fcn.00428f40
push dword [0x6d3518]
mov edx, str._UNINSTALL
mov ecx, dword [esp]
call fcn.00413660
je 0x40166e
push 0x3e8
call fcn.00407f4b
push 0x7d0
call fcn.0041a529
push dword [0x6d349c]
call fcn.00413f8c
jmp 0x401bca
pop eax
inc dword [0x6d3500]
jno 0x4015e0
jmp 0x401bca
push edx
call fcn.00428f00
pop edx
push eax
push edx
call fcn.00428f00
pop edx
push eax
call sub.KERNEL32.dll_GetUserDefaultLangID
cdq
push edx
push eax
call fcn.004267f0
lea eax, [0x6d3498]
push eax
call fcn.00428f40
push dword [0x6d3498]
call fcn.00426870
mov ebx, eax
cmp ebx, 3
jne 0x4016e6
push edx
call fcn.00428f00
pop edx
push eax
mov edx, 0x4b431c
push edx
call fcn.00428fd0
mov edx, dword [0x6d3498]
push edx
call fcn.00428fd0
lea eax, [0x6d3498]
push eax
call fcn.00428f40
push dword [0x6d3498]
mov edx, str.0419
pop ecx
call fcn.00413660
je 0x40170b
mov edx, 0x4b48f4
lea ecx, [0x6d34fc]
call fcn.00413008
jmp 0x40171b
mov edx, 0x4b54cc
lea ecx, [0x6d34fc]
call fcn.00413008
mov edx, str.Panic___
lea ecx, [0x6d34ec]
call fcn.00413008
mov edx, 0x4b71e6
lea ecx, [0x6d3514]
call fcn.00413008
push edx
call fcn.00428f00
pop edx
push eax
push edx
call fcn.00428f00
pop edx
push eax
call fcn.004144a0
lea eax, [0x6d34a4]
push eax
call fcn.00428f40
mov dword [0x6d34e0], 0
mov dword [0x6d34f4], 0
lea eax, [0x6d34f4]
push eax
lea eax, [0x6d34e0]
push eax
mov eax, dword [0x6d34a4]
push eax
call sub.imagehlp.dll_MapFileAndCheckSumW
push edx
call fcn.00428f00
pop edx
push eax
push edx
call fcn.00428f00
pop edx
push eax
mov eax, dword [0x6d34e0]
cdq
push edx
push eax
call fcn.004268a0
lea eax, [0x6d34d4]
push eax
call fcn.00428f40
push edx
call fcn.00428f00
pop edx
push eax
push edx
call fcn.00428f00
pop edx
push eax
mov eax, dword [0x6d34f4]
cdq
push edx
push eax
call fcn.004268a0
lea eax, [0x6d34d8]
push eax
call fcn.00428f40
mov eax, dword [0x6d34d8]
push eax
mov eax, dword [0x6d34d4]
push eax
call fcn.00427bf0
and eax, eax
je 0x40180b
push 0x10
push dword [0x6d3514]
push dword [0x6d34ec]
call fcn.004140cf
jmp 0x401bca
push 0xfa
push 0x1d2
push 0
push 0
call fcn.00401c3f
push 1
push dword [0x6d34dc]
call fcn.004178d9
push 0
push dword [0x6d3534]
call fcn.00417917
push 0
push dword [0x6d3524]
call fcn.00417917
push 1
push dword [0x6d34c0]
call fcn.00417917
push 0xfffffffe
push 0x28
push 0x28
push 0x28
call fcn.0042181d
push eax
push 0xffffffff
push dword [0x6d3520]
call fcn.0040c2ba
push 0
push 0
push 0
call fcn.0042181d
push eax
push dword [0x6d34ac]
call fcn.00408a33
push 0xff
push 0xff
push 0xff
call fcn.0042181d
push eax
push dword [0x6d34ac]
call fcn.0040bfdd
call fcn.0041a591
mov ebx, eax
cmp ebx, 0x6e
jl 0x40198c
mov eax, str.dwmapi
push eax
push 0
call fcn.00416d6f
and eax, eax
je 0x40198c
mov dword [0x6d34c4], 1
mov eax, str.DwmSetWindowAttribute
push eax
push 0
call fcn.00416dc9
mov dword [0x6d34d0], eax
push dword [0x6d49a8]
call fcn.00428415
lea eax, [0x6d34f8]
push eax
push dword [0x6d49a8]
call fcn.004283b5
and eax, eax
je 0x40196d
push dword [0x6d34f8]
call fcn.0041a8bd
and eax, eax
je 0x40196b
push 4
lea eax, [0x6d34c4]
push eax
push 0x14
push dword [0x6d34f8]
call fcn.0041a8cf
push eax
call dword [0x6d34d0]
add esp, 0x10
jmp 0x401920
push dword [0x6d49a8]
call fcn.004283a4
push 0
call fcn.00416caf
push 1
call fcn.00406477
mov eax, 0x4b4028
push eax
call fcn.0040a7f8
push dword [0x6d34fc]
mov edx, 0x4b48f4
pop ecx
call fcn.00413660
je 0x4019d9
mov eax, 0x4b4094
push eax
call fcn.0040a7f8
mov eax, 0x4b4d54
push eax
push dword [0x6d34ac]
call fcn.0041794f
mov eax, 0x4b5ac2
push eax
push dword [0x6d3504]
call fcn.0041794f
jmp 0x4019e4
mov eax, 0x4b4594
push eax
call fcn.0040a7f8
mov eax, str.OUninstall.exe__Uninstall___O2010____O2013_16____O2013_21C2R____Log____cmd_
push eax
call fcn.0040a7f8
mov eax, 0x4b4028
push eax
call fcn.0040a7f8
push dword [0x6d34fc]
mov edx, 0x4b48f4
pop ecx
call fcn.00413660
je 0x401a1a
mov eax, 0x4b4584
push eax
call fcn.0040a7f8
jmp 0x401a25
mov eax, 0x4b42d8
push eax
call fcn.0040a7f8
mov eax, str.OUninstall.exe__Uninstall__O2010__O2013_16__O2013_21C2R__Log
push eax
call fcn.0040a7f8
mov eax, 0x4b4028
push eax
call fcn.0040a7f8
call fcn.0041a8eb
mov dword [0x6d3508], eax
cmp dword [0x6d3508], 0
je 0x401abd
push dword [0x6d3508]
mov ebx, 0x201
cmp ebx, dword [esp]
jne 0x401a80
push 0
push 2
push 0xa1
push dword [0x6d3520]
call fcn.0041a8cf
push eax
call sub.USER32.dll_SendMessageW
jmp 0x401a9d
mov ebx, 0x332c
cmp ebx, dword [esp]
jne 0x401a93
call fcn.0041dba7
push eax
pop eax
jmp 0x401a9d
mov ebx, 0x332d
cmp ebx, dword [esp]
jne 0x401a9d
pop eax
call fcn.0041dbb6
push eax
mov ebx, dword [0x6d3520]
cmp ebx, dword [esp]
jne 0x401aba
push dword [0x6d3508]
call fcn.00405673
pop eax
jmp 0x401ac7
push 5
call fcn.0041a529
push dword [0x6d349c]
call fcn.00413ef8
and eax, eax
je 0x401ae0
mov dword [0x6d3508], 0
mov ebx, dword [0x6d3508]
cmp ebx, 0x333c
jne 0x401a3b
push edx
call fcn.00428f00
pop edx
push eax
mov edx, dword [0x6d3530]
push edx
call fcn.00428f00
pop edx
push eax
push edx
call fcn.00428fd0
mov edx, str._files
push edx
call fcn.00428fd0
call fcn.00413632
add dword [esp], edx
call fcn.0041bce6
call fcn.00413650
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x401b39
cmp edi, 0xffffffff
je 0x401b3d
xor eax, eax
jmp 0x401b42
mov eax, 1
or eax, eax
je 0x401b8a
push edx
call fcn.00428f00
pop edx
push eax
push 3
mov eax, 0x4b4028
push eax
mov edx, dword [0x6d3530]
push edx
call fcn.00428f00
pop edx
push eax
push edx
call fcn.00428fd0
mov edx, str._files
push edx
call fcn.00428fd0
call fcn.00413632
add dword [esp], edx
call fcn.0041be3d
call fcn.00413650
push edx
call fcn.00428f00
pop edx
push eax
push dword [0x6d3530]
push edx
call fcn.00428f00
pop edx
push eax
push edx
call fcn.00428f00
pop edx
push eax
call fcn.004144a0
call fcn.00413632
add dword [esp], edx
call fcn.00426ac0
call fcn.00413650
mov ebx, eax
and ebx, ebx
jle 0x401bca
call fcn.0040cca3
push 0
call 0x401be9
call fcn.00428ee0
push dword [0x6d3490]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess
call fcn.00413eaa
call fcn.00414dbd
call fcn.00416075
call fcn.004161d0
call fcn.00416cf0
call fcn.004177dd
call fcn.0041a82f
call fcn.0041c112
call fcn.0041c810
call fcn.0041da6f
call fcn.0041e833
call fcn.00422335
call fcn.004233cf
call fcn.004263c0
call fcn.0042837c
call fcn.00428480
call fcn.00427bc0
ret