Function at 0x401000
Capabilities:
Allocate thread local storage
Query environment variable

Disassembly:
push 0x5d8
push 0
push 0x846350
call fcn.0042cc40
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleW
mov dword [0x846354], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x846350], eax
mov eax, 0x50481c
mov dword [0x846378], eax
call fcn.00416961
call fcn.00452d30
call fcn.00452087
call fcn.00451b50
call fcn.0044ddf0
call fcn.0044bc02
call fcn.0044b430
call fcn.0044ad07
call fcn.0044a222
call fcn.00449909
call fcn.00448f3a
call fcn.004489e8
call fcn.004471c6
call fcn.00446a8e
call fcn.004463d2
call fcn.00445170
call fcn.0044444f
call reloc.KERNEL32.dll_UnhandledExceptionFilter
call fcn.00442d8c
call fcn.004429c5
call fcn.0043d5b9
call fcn.0043ca8c
call fcn.0043bfed
call fcn.0043b0e1
call fcn.0043a7d3
call fcn.0043a201
call fcn.0043952e
mov edx, 0x500980
lea ecx, [0x8463c8]
call fcn.00416008
mov dword [0x8463a8], 0
mov edx, 0x500028
lea ecx, [0x8463e8]
call fcn.00416008
mov dword [0x846368], 0
mov dword [0x8463a4], 0
mov edx, str.Office_2016_2024_C2R_Licenses
lea ecx, [0x8463ec]
call fcn.00416008
mov edx, str.Office_2013_C2R_Licenses
lea ecx, [0x84639c]
call fcn.00416008
mov edx, str.____Press__Refresh__button___
lea ecx, [0x84638c]
call fcn.00416008
mov edx, 0x50046c
lea ecx, [0x846380]
call fcn.00416008
mov edx, 0x500028
lea ecx, [0x8463b8]
call fcn.00416008
push edx
call fcn.00452d60
pop edx
push eax
push edx
call fcn.00452d60
pop edx
push eax
push 0x64
call fcn.004505e0
lea eax, [0x846358]
push eax
call fcn.00452d90
push edx
call fcn.00452d60
pop edx
push eax
push edx
call fcn.00452d60
pop edx
push eax
push 0x3e8
call fcn.004505e0
lea eax, [0x8463d8]
push eax
call fcn.00452d90
push edx
call fcn.00452d60
pop edx
push eax
push edx
call fcn.00452d60
pop edx
push eax
push 0x3e8
call fcn.004505e0
lea eax, [0x8463e0]
push eax
call fcn.00452d90
push edx
call fcn.00452d60
pop edx
push eax
push edx
call fcn.00452d60
pop edx
push eax
push 0x3e8
call fcn.004505e0
lea eax, [0x846364]
push eax
call fcn.00452d90
push edx
call fcn.00452d60
pop edx
push eax
push edx
call fcn.00452d60
pop edx
push eax
push 0x3e8
call fcn.004505e0
lea eax, [0x84637c]
push eax
call fcn.00452d90
push edx
call fcn.00452d60
pop edx
push eax
push edx
call fcn.00452d60
pop edx
push eax
push 0xc8
call fcn.004505e0
lea eax, [0x8463bc]
push eax
call fcn.00452d90
push edx
call fcn.00452d60
pop edx
push eax
push edx
call fcn.00452d60
pop edx
push eax
push 0xc8
call fcn.004505e0
lea eax, [0x8463e4]
push eax
call fcn.00452d90
push 0x64
mov eax, dword [0x846358]
push eax
mov eax, str.SYSTEMDRIVE
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0x3e8
mov eax, dword [0x8463d8]
push eax
mov eax, str.TEMP
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0x3e8
mov eax, dword [0x8463e0]
push eax
mov eax, str.WINDIR
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0x3e8
mov eax, dword [0x8463bc]
push eax
mov eax, str.PROCESSOR_ARCHITECTURE
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0x3e8
mov eax, dword [0x8463e4]
push eax
mov eax, str.PROCESSOR_ARCHITEW6432
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0x3e8
mov eax, dword [0x84637c]
push eax
mov eax, str.ALLUSERSPROFILE
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
push dword [0x8463bc]
mov edx, str.AMD64
pop ecx
call fcn.004165d0
jne 0x401314
push dword [0x8463e4]
mov edx, str.AMD64
pop ecx
call fcn.004165d0
jne 0x401314
jmp 0x40131b
mov eax, 1
jmp 0x40131d
xor eax, eax
and eax, eax
je 0x401333
mov edx, 0x502132
lea ecx, [0x8463b8]
call fcn.00416008
jmp 0x401343
mov edx, 0x502adc
lea ecx, [0x8463b8]
call fcn.00416008
mov edx, dword [0x8463e0]
push edx
call fcn.00452d60
pop edx
push eax
push edx
call fcn.00452e00
mov edx, str.System32
push edx
call fcn.00452e00
lea eax, [0x846364]
push eax
call fcn.00452d90
push edx
call fcn.00452d60
pop edx
push eax
mov edx, dword [0x8463e0]
push edx
call fcn.00452d60
pop edx
push eax
push edx
call fcn.00452e00
mov edx, str.Sysnativecmd.exe
push edx
call fcn.00452e00
call fcn.00416622
add dword [esp], edx
call fcn.0044453a
call fcn.00416640
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x4013bb
jl 0x4013b7
cmp ebx, 0
ja 0x4013bb
xor eax, eax
jmp 0x4013c0
mov eax, 1
or eax, eax
je 0x4013f1
mov edx, dword [0x8463e0]
push edx
call fcn.00452d60
pop edx
push eax
push edx
call fcn.00452e00
mov edx, str.Sysnative
push edx
call fcn.00452e00
lea eax, [0x8463e0]
push eax
call fcn.00452d90
jmp 0x40141c
mov edx, dword [0x8463e0]
push edx
call fcn.00452d60
pop edx
push eax
push edx
call fcn.00452e00
mov edx, str.System32
push edx
call fcn.00452e00
lea eax, [0x8463e0]
push eax
call fcn.00452d90
mov edx, str.Panic___
lea ecx, [0x846394]
call fcn.00416008
mov edx, 0x50353c
lea ecx, [0x8463c0]
call fcn.00416008
push edx
call fcn.00452d60
pop edx
push eax
push edx
call fcn.00452d60
pop edx
push eax
call fcn.0043a802
lea eax, [0x84635c]
push eax
call fcn.00452d90
mov dword [0x846388], 0
mov dword [0x846398], 0
lea eax, [0x846398]
push eax
lea eax, [0x846388]
push eax
mov eax, dword [0x84635c]
push eax
call sub.imagehlp.dll_MapFileAndCheckSumW
mov ebx, dword [0x846388]
cmp ebx, dword [0x846398]
je 0x4014b3
push 0x10
push dword [0x8463c0]
push dword [0x846394]
call fcn.0043a238
jmp 0x401b15
push 0xa
mov eax, str.Consolas
push eax
push 0
call fcn.00452184
push 0x100
push 1
call fcn.00415ddb
push edx
call fcn.00452d60
pop edx
push eax
mov eax, 0x5002ee
push eax
mov eax, 0x500418
push eax
mov eax, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftOfficeClickToRun
push eax
call fcn.004111e7
lea eax, [0x8463d4]
push eax
call fcn.00452d90
push edx
call fcn.00452d60
pop edx
push eax
mov edx, dword [0x8463d4]
push edx
call fcn.00452d60
pop edx
push eax
push edx
call fcn.00452e00
mov edx, str.Office16ospp.vbs
push edx
call fcn.00452e00
call fcn.00416622
add dword [esp], edx
call fcn.0044453a
call fcn.00416640
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x40154f
jl 0x40154b
cmp ebx, 0
ja 0x40154f
xor eax, eax
jmp 0x401554
mov eax, 1
or eax, eax
je 0x40156d
mov edx, 0x50046c
lea ecx, [0x846380]
call fcn.00416008
jmp 0x40160e
mov edx, 0x500028
lea ecx, [0x8463d4]
call fcn.00416008
push edx
call fcn.00452d60
pop edx
push eax
mov eax, 0x5002ee
push eax
mov eax, 0x500418
push eax
mov eax, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftOffice15.0ClickToRun
push eax
call fcn.004111e7
lea eax, [0x8463d4]
push eax
call fcn.00452d90
push edx
call fcn.00452d60
pop edx
push eax
mov edx, dword [0x8463d4]
push edx
call fcn.00452d60
pop edx
push eax
push edx
call fcn.00452e00
mov edx, str._rootLicensesc2rpridslicensefiles_auto.xml
push edx
call fcn.00452e00
call fcn.00416622
add dword [esp], edx
call fcn.0044453a
call fcn.00416640
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x4015f5
jl 0x4015f1
cmp ebx, 0
ja 0x4015f5
xor eax, eax
jmp 0x4015fa
mov eax, 1
or eax, eax
je 0x40160e
mov edx, 0x500466
lea ecx, [0x846380]
call fcn.00416008
mov dword [0x846360], 0
mov dword [0x846374], 0
push edx
call fcn.00452d60
pop edx
push eax
mov eax, 0x5002ee
push eax
mov eax, str.AppsUseLightTheme
push eax
mov eax, str.HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionThemesPersonalize
push eax
call fcn.004111e7
lea eax, [0x8463d0]
push eax
call fcn.00452d90
push dword [0x8463d0]
mov edx, 0x500328
pop ecx
call fcn.004165d0
je 0x401674
mov dword [0x846360], 1
mov dword [0x846374], 1
push 0
push 0
push 0
call fcn.00448f46
mov dword [0x8463dc], eax
push 0xff
push 0xff
push 0xff
call fcn.00448f46
mov dword [0x8463a0], eax
push 0x2a
push 0x2a
push 0x2a
call fcn.00448f46
mov dword [0x84636c], eax
mov dword [0x8463cc], 0
push 0x808080
push 1
push 0
call sub.GDI32.dll_CreatePen
mov dword [0x846390], eax
push 0xcc872c
push 1
push 0
call sub.GDI32.dll_CreatePen
mov dword [0x8463c4], eax
push 7
xor eax, eax
push eax
lea eax, [0x8468b0]
push eax
push 0x1f
call fcn.0044a241
mov eax, 0x200
push eax
lea eax, [0x846918]
push eax
xor eax, eax
push eax
push 7
push 0x2d
call fcn.00446aad
mov eax, 0x200
push eax
lea eax, [0x84691c]
push eax
xor eax, eax
push eax
push 0x15
push 4
call fcn.00446aad
mov eax, 0x200
push eax
lea eax, [0x846920]
push eax
xor eax, eax
push eax
push 0x15
push 4
call fcn.00446aad
mov eax, 0x200
push eax
lea eax, [0x846924]
push eax
xor eax, eax
push eax
push 0x15
push 4
call fcn.00446aad
mov dword [0x846898], 2
mov dword [0x84689c], 1
push 0x846894
push 0
push 0x15
push 4
push 2
call fcn.00448aad
push 0x15
xor eax, eax
push eax
lea eax, [0x8468b8]
push eax
push 4
call fcn.0044a241
push 0x1d6
push 0x318
push 0
push 0
call fcn.00401b8f
push 1
push 2
call fcn.0043d65d
push dword [0x846380]
mov edx, 0x50046c
pop ecx
call fcn.004165d0
je 0x40184a
push 0
push 1
push 7
call fcn.0043d688
push 0
push 8
call fcn.0043d6c4
push 1
push 0
call fcn.0043d6c4
jmp 0x40187c
push 0
push 1
push 6
call fcn.0043d688
push 1
push 8
call fcn.0043d6c4
push 0
push 0
call fcn.0043d6c4
push 0
push dword [0x84638c]
push 0xffffffff
push 8
call fcn.0043d703
push 0
push dword [0x84638c]
push 0xffffffff
push 0
call fcn.0043d703
push 1
call fcn.0043d74e
push 0
push dword [0x84639c]
push 0xffffffff
push 0
call fcn.0043d703
push 0
push dword [0x8463ec]
push 0xffffffff
push 8
call fcn.0043d703
call fcn.00442aba
mov ebx, eax
cmp ebx, 0x6e
jl 0x40190b
mov ebx, dword [0x846374]
and ebx, ebx
jle 0x40190b
mov eax, 1
jmp 0x40190d
xor eax, eax
and eax, eax
je 0x40197d
call fcn.0040b45a
mov eax, 0x503b70
push eax
push 0
call fcn.0043cb00
and eax, eax
je 0x40197d
mov eax, str.DwmSetWindowAttribute
push eax
push 0
call fcn.0043cb56
mov dword [0x846384], eax
push 4
lea eax, [0x846374]
push eax
push 0x14
push 0
call fcn.00442df7
push eax
call dword [0x846384]
add esp, 0x10
push 0
call fcn.0043ca3f
call fcn.00408a53
push 0
call fcn.0043ca3f
push 0
push 0
call fcn.00442ef4
call fcn.00442f06
and eax, eax
je 0x401997
jmp 0x40198c
call fcn.00442f06
and eax, eax
je 0x4019a2
jmp 0x401997
push 0
call fcn.0040d308
call fcn.00442f06
mov dword [0x8463b4], eax
cmp dword [0x8463b4], 0
je 0x401a2f
push dword [0x8463b4]
mov ebx, 0x332c
cmp ebx, dword [esp]
jne 0x4019fd
call fcn.004464f8
push eax
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x4019e8
push 0
call fcn.004045a5
jmp 0x4019fc
mov ebx, 8
cmp ebx, dword [esp]
jne 0x4019fc
push 8
call fcn.004045a5
pop eax
pop eax
call fcn.00446507
push eax
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x401a18
push dword [0x8463b4]
call fcn.0040f98e
jmp 0x401a2c
mov dword [0x8463b4], 0
push 5
call fcn.00442c2f
pop eax
jmp 0x401a39
push 5
call fcn.00442c2f
mov ebx, dword [0x8463b4]
cmp ebx, 0x333c
jne 0x4019ac
push edx
call fcn.00452d60
pop edx
push eax
push 3
mov eax, 0x500028
push eax
mov edx, dword [0x8463d8]
push edx
call fcn.00452d60
pop edx
push eax
push edx
call fcn.00452e00
mov edx, str.o16files
push edx
call fcn.00452e00
call fcn.00416622
add dword [esp], edx
call fcn.00444691
call fcn.00416640
push edx
call fcn.00452d60
pop edx
push eax
push 3
mov eax, 0x500028
push eax
mov edx, dword [0x8463d8]
push edx
call fcn.00452d60
pop edx
push eax
push edx
call fcn.00452e00
mov edx, str.o15files
push edx
call fcn.00452e00
call fcn.00416622
add dword [esp], edx
call fcn.00444691
call fcn.00416640
push edx
call fcn.00452d60
pop edx
push eax
push dword [0x8463d8]
push edx
call fcn.00452d60
pop edx
push eax
push edx
call fcn.00452d60
pop edx
push eax
call fcn.0043a802
call fcn.00416622
add dword [esp], edx
call fcn.004506b0
call fcn.00416640
mov ebx, eax
and ebx, ebx
jle 0x401b13
call fcn.0040fdde
jmp 0x401b15
push 0
call 0x401b34
call fcn.00452d10
push dword [0x846350]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess
call fcn.0043949e
call fcn.0043b0cf
call fcn.0043bfc1
call fcn.0043ca80
call fcn.0043d55d
call sub.ole32.dll_OleUninitialize
call fcn.00442d69
call fcn.00444443
call fcn.004449cf
call fcn.00445160
call fcn.004463b4
call fcn.004471b5
call fcn.004498fd
call fcn.0044acfa
call fcn.0044de10
call fcn.004521db
call fcn.00452241
call fcn.00451b40
ret