Function at 0x140001000
Capabilities:
Identify system language via api
Query environment variable

Disassembly:
sub rsp, 0x28
mov r8, 0x6f8
xor rdx, rdx
movabs rcx, 0x1402cf4e8
call sub.msvcrt.dll_memset
xor rcx, rcx
call sub.KERNEL32.DLL_GetModuleHandleW
mov qword [0x1402cf4f0], rax
xor r8, r8
mov rdx, 0x1000
xor rcx, rcx
call sub.KERNEL32.DLL_HeapCreate
mov qword [0x1402cf4e8], rax
movabs rax, 0x14008dbf8
mov qword [0x1402cf548], rax
call fcn.140028eb0
call fcn.140027ec8
call fcn.1400278d0
call fcn.140025bd0
call fcn.140022e04
call fcn.1400222d0
call fcn.1400218b0
call fcn.14001ff8c
call fcn.14001f724
call fcn.14001f204
call fcn.14001ee98
call fcn.14001cf20
call fcn.14001c4b4
call fcn.14001ad30
call fcn.140019cbc
call fcn.1400184e4
call fcn.140014af4
call fcn.1400127cc
call fcn.1400117c0
call fcn.140010b54
call fcn.14000fd4c
call fcn.14000fa84
call fcn.14000f838
movabs rdx, str.Office_uninstall_v1.8.8
lea rcx, [0x1402cf560]
call fcn.140028f20
mov rcx, qword [0x1402cf560]
push rcx
sub rsp, 0x28
call fcn.140029010
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140029060
add rsp, 0x28
movabs rcx, str._x64
sub rsp, 0x28
call fcn.140029060
add rsp, 0x28
lea rcx, [0x1402cf560]
pop rdx
call fcn.1400290d0
movabs rdx, 0x14008b34e
lea rcx, [0x1402cf570]
call fcn.140028f20
mov qword [0x1402cf5d8], 0
push rcx
sub rsp, 0x28
call fcn.140029010
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140029010
add rsp, 0x28
pop rcx
push rax
push 0x3e8
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140025f70
add rsp, 0x28
lea rcx, [0x1402cf5c0]
pop rdx
call fcn.1400290d0
mov qword [0x1402cf550], 0
mov qword [0x1402cf538], 0
mov qword [0x1402cf5e8], 1
movabs rdx, 0x14008a028
lea rcx, [0x1402cf590]
call fcn.140028f20
push rcx
sub rsp, 0x28
call fcn.140029010
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140029010
add rsp, 0x28
pop rcx
push rax
push 0xc8
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140025f70
add rsp, 0x28
lea rcx, [0x1402cf598]
pop rdx
call fcn.1400290d0
push rcx
sub rsp, 0x28
call fcn.140029010
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140029010
add rsp, 0x28
pop rcx
push rax
push 0xc8
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140025f70
add rsp, 0x28
lea rcx, [0x1402cf5e0]
pop rdx
call fcn.1400290d0
push 0xc8
mov rax, qword [0x1402cf598]
mov rax, rax
push rax
movabs rax, str.PROCESSOR_ARCHITECTURE
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.DLL_GetEnvironmentVariableW
push 0xc8
mov rax, qword [0x1402cf5e0]
mov rax, rax
push rax
movabs rax, str.PROCESSOR_ARCHITEW6432
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.DLL_GetEnvironmentVariableW
push 0x3e8
mov rax, qword [0x1402cf5c0]
mov rax, rax
push rax
movabs rax, str.TEMP
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.DLL_GetEnvironmentVariableW
push rcx
sub rsp, 0x28
call fcn.140029010
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140029010
add rsp, 0x28
pop rcx
push rax
push 0x3e8
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140025f70
add rsp, 0x28
lea rcx, [0x1402cf5d0]
pop rdx
call fcn.1400290d0
push 0x3e8
mov rax, qword [0x1402cf5d0]
mov rax, rax
push rax
movabs rax, str.WINDIR
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.DLL_GetEnvironmentVariableW
push rcx
sub rsp, 0x28
call fcn.140029010
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140029010
add rsp, 0x28
pop rcx
push rax
push 0x3e8
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140025f70
add rsp, 0x28
lea rcx, [0x1402cf518]
pop rdx
call fcn.1400290d0
push 0x3e8
mov rax, qword [0x1402cf518]
mov rax, rax
push rax
movabs rax, str.WINDIR
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.DLL_GetEnvironmentVariableW
push rcx
sub rsp, 0x28
call fcn.140029010
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
mov rcx, qword [0x1402cf5d0]
push rcx
sub rsp, 0x28
call fcn.140029010
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140029060
add rsp, 0x28
movabs rcx, str.Temp
sub rsp, 0x28
call fcn.140029060
add rsp, 0x28
push rax
call fcn.1400291e0
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
sub rsp, 0x20
call fcn.140019ea8
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14000eb50
add rsp, 0x28
pop rax
mov r15, rax
cmp r15, 0xfffffffffffffffe
jne 0x140001458
mov rcx, qword [0x1402cf5d0]
push rcx
sub rsp, 0x28
call fcn.140029010
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140029060
add rsp, 0x28
movabs rcx, str.Temp
sub rsp, 0x28
call fcn.140029060
add rsp, 0x28
lea rcx, [0x1402cf5c0]
pop rdx
call fcn.1400290d0
push rcx
sub rsp, 0x28
call fcn.140029010
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
mov rcx, qword [0x1402cf5d0]
push rcx
sub rsp, 0x28
call fcn.140029010
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140029060
add rsp, 0x28
movabs rcx, str.Sysnativecmd.exe
sub rsp, 0x28
call fcn.140029060
add rsp, 0x28
push rax
call fcn.1400291e0
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
sub rsp, 0x20
call fcn.140019ea8
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14000eb50
add rsp, 0x28
pop rax
mov r15, rax
and r15, r15
jle 0x140001525
mov rcx, qword [0x1402cf5d0]
push rcx
sub rsp, 0x28
call fcn.140029010
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140029060
add rsp, 0x28
movabs rcx, str.Sysnative
sub rsp, 0x28
call fcn.140029060
add rsp, 0x28
lea rcx, [0x1402cf5d0]
pop rdx
call fcn.1400290d0
jmp 0x14000156d
mov rcx, qword [0x1402cf5d0]
push rcx
sub rsp, 0x28
call fcn.140029010
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140029060
add rsp, 0x28
movabs rcx, str.System32
sub rsp, 0x28
call fcn.140029060
add rsp, 0x28
lea rcx, [0x1402cf5d0]
pop rdx
call fcn.1400290d0
mov qword [0x1402cf5f0], 0
call fcn.14000ff00
mov r15, rax
dec r15
mov qword [0x1402cf530], r15
mov r15, qword [0x1402cf530]
and r15, r15
jl 0x14000167d
mov qword [0x1402cf578], 0
jmp 0x1400015a7
mov rax, qword [0x1402cf530]
cmp rax, qword [0x1402cf578]
jl 0x14000167d
push rcx
sub rsp, 0x28
call fcn.140029010
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140029010
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.140029010
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.140029010
add rsp, 0x28
pop rcx
push rax
push qword [0x1402cf578]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14000ff94
add rsp, 0x20
push rax
call fcn.1400291e0
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140025fd0
add rsp, 0x28
lea rcx, [0x1402cf5a0]
pop rdx
call fcn.1400290d0
push qword [0x1402cf5a0]
movabs rdx, str._CMD
mov rcx, qword [rsp]
sub rsp, 0x28
call fcn.140029210
add rsp, 0x28
or rax, rax
je 0x14000166f
mov qword [0x1402cf5f0], 1
pop rax
inc qword [0x1402cf578]
jno 0x1400015a7
push 9
movabs rax, str.Consolas
push rax
push 0
pop rcx
pop rdx
pop r8
call fcn.140027f3c
push rcx
sub rsp, 0x28
call fcn.140029010
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push 1
push rcx
sub rsp, 0x20
call fcn.140029010
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.140029010
add rsp, 0x28
pop rcx
push rax
pop rcx
sub rsp, 0x20
call fcn.140010020
add rsp, 0x20
push rax
call fcn.1400291e0
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.1400038f5
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14000eb50
add rsp, 0x28
pop rax
call fcn.14000ff00
mov r15, rax
dec r15
mov qword [0x1402cf530], r15
mov r15, qword [0x1402cf530]
and r15, r15
jl 0x1400019d5
mov qword [0x1402cf5e8], 0
mov qword [0x1402cf578], 0
jmp 0x140001749
mov rax, qword [0x1402cf530]
cmp rax, qword [0x1402cf578]
jl 0x1400018a9
push rcx
sub rsp, 0x28
call fcn.140029010
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140029010
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.140029010
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.140029010
add rsp, 0x28
pop rcx
push rax
push qword [0x1402cf578]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14000ff94
add rsp, 0x20
push rax
call fcn.1400291e0
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140025fd0
add rsp, 0x28
lea rcx, [0x1402cf5a0]
pop rdx
call fcn.1400290d0
push qword [0x1402cf5a0]
movabs rdx, str._LOG
mov rcx, qword [rsp]
sub rsp, 0x28
call fcn.140029210
add rsp, 0x28
or rax, rax
je 0x140001816
mov qword [0x1402cf5d8], 1
jmp 0x14000189b
movabs rdx, str._O2010
mov rcx, qword [rsp]
sub rsp, 0x28
call fcn.140029210
add rsp, 0x28
or rax, rax
je 0x140001843
mov qword [0x1402cf550], 1
jmp 0x14000189b
movabs rdx, str._O2013_16
mov rcx, qword [rsp]
sub rsp, 0x28
call fcn.140029210
add rsp, 0x28
or rax, rax
je 0x140001870
mov qword [0x1402cf538], 1
jmp 0x14000189b
movabs rdx, str._O2013_21C2R
mov rcx, qword [rsp]
sub rsp, 0x28
call fcn.140029210
add rsp, 0x28
or rax, rax
je 0x14000189b
mov qword [0x1402cf5e8], 1
pop rax
inc qword [0x1402cf578]
jno 0x140001749
mov qword [0x1402cf578], 0
jmp 0x1400018b6
mov rax, qword [0x1402cf530]
cmp rax, qword [0x1402cf578]
jl 0x1400019d0
push rcx
sub rsp, 0x28
call fcn.140029010
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140029010
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.140029010
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.140029010
add rsp, 0x28
pop rcx
push rax
push qword [0x1402cf578]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14000ff94
add rsp, 0x20
push rax
call fcn.1400291e0
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140025fd0
add rsp, 0x28
lea rcx, [0x1402cf5a0]
pop rdx
call fcn.1400290d0
push qword [0x1402cf5a0]
movabs rdx, str._UNINSTALL
mov rcx, qword [rsp]
sub rsp, 0x28
call fcn.140029210
add rsp, 0x28
or rax, rax
je 0x1400019c2
sub rsp, 8
push 0x3e8
pop rcx
sub rsp, 0x20
call fcn.140004052
add rsp, 0x28
sub rsp, 8
push 0x7d0
pop rcx
sub rsp, 0x20
call fcn.1400180f0
add rsp, 0x28
sub rsp, 8
push qword [0x1402cf508]
pop rcx
sub rsp, 0x20
call fcn.14000f8e4
add rsp, 0x28
add rsp, 0xfffffffffffffff8
jmp 0x140001e63
pop rax
inc qword [0x1402cf578]
jno 0x1400018b6
jmp 0x140001e63
push rcx
sub rsp, 0x28
call fcn.140029010
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140029010
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
sub rsp, 0x20
call sub.KERNEL32.DLL_GetUserDefaultLangID
add rsp, 0x28
mov rax, rax
push rax
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140026060
add rsp, 0x28
lea rcx, [0x1402cf500]
pop rdx
call fcn.1400290d0
push qword [0x1402cf500]
pop rcx
call fcn.140026230
mov r15, rax
cmp r15, 3
jne 0x140001a87
push rcx
sub rsp, 0x28
call fcn.140029010
add rsp, 0x28
pop rcx
push rax
movabs rcx, 0x14008a316
sub rsp, 0x28
call fcn.140029060
add rsp, 0x28
mov rcx, qword [0x1402cf500]
sub rsp, 0x28
call fcn.140029060
add rsp, 0x28
lea rcx, [0x1402cf500]
pop rdx
call fcn.1400290d0
push qword [0x1402cf500]
movabs rcx, str.0419
pop rdx
call fcn.140029210
or rax, rax
je 0x140001aba
movabs rdx, 0x14008a88a
lea rcx, [0x1402cf570]
call fcn.140028f20
jmp 0x140001ad0
movabs rdx, 0x14008b34e
lea rcx, [0x1402cf570]
call fcn.140028f20
push 0xfa
push 0x1d2
push 0
push 0
pop rcx
pop rdx
pop r8
pop r9
call fcn.140001ede
push 1
push qword [0x1402cf558]
pop rcx
pop rdx
call fcn.140014bc8
push 0
push qword [0x1402cf5c8]
pop rcx
pop rdx
call fcn.140014c20
push 0
push qword [0x1402cf5b0]
pop rcx
pop rdx
call fcn.140014c20
push 1
push qword [0x1402cf540]
pop rcx
pop rdx
call fcn.140014c20
movabs rax, 0x14008a028
push rax
pop rcx
call fcn.1400046f0
push qword [0x1402cf570]
movabs rcx, 0x14008a88a
pop rdx
call fcn.140029210
or rax, rax
je 0x140001ba6
movabs rax, 0x14008a08e
push rax
pop rcx
call fcn.1400046f0
movabs rax, 0x14008ac58
push rax
push qword [0x1402cf520]
pop rcx
pop rdx
call fcn.140014c74
movabs rax, 0x14008b8dc
push rax
push qword [0x1402cf580]
pop rcx
pop rdx
call fcn.140014c74
jmp 0x140001bb7
movabs rax, str.Use_of_the_program:
push rax
pop rcx
call fcn.1400046f0
movabs rax, str.OUninstall.exe__Uninstall___O2010____O2013_16____O2013_21C2R____Log____cmd_
push rax
pop rcx
call fcn.1400046f0
movabs rax, 0x14008a028
push rax
pop rcx
call fcn.1400046f0
push qword [0x1402cf570]
movabs rcx, 0x14008a88a
pop rdx
call fcn.140029210
or rax, rax
je 0x140001c07
movabs rax, 0x14008a56e
push rax
pop rcx
call fcn.1400046f0
jmp 0x140001c18
movabs rax, str.Example:
push rax
pop rcx
call fcn.1400046f0
movabs rax, str.OUninstall.exe__Uninstall__O2010__O2013_16__O2013_21C2R__Log
push rax
pop rcx
call fcn.1400046f0
movabs rax, 0x14008a028
push rax
pop rcx
call fcn.1400046f0
call fcn.1400185ac
mov qword [0x1402cf588], rax
cmp qword [0x1402cf588], 0
je 0x140001d12
push qword [0x1402cf588]
mov r15, 0x201
cmp r15, qword [rsp]
jne 0x140001cab
sub rsp, 8
push 0
push 2
push 0xa1
sub rsp, 8
push qword [0x1402cf5a8]
pop rcx
sub rsp, 0x20
call fcn.1400185b4
add rsp, 0x28
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.USER32.dll_SendMessageW
add rsp, 0x28
jmp 0x140001cdd
mov r15, 0x332c
cmp r15, qword [rsp]
jne 0x140001cd0
sub rsp, 8
sub rsp, 0x20
call fcn.14001c674
add rsp, 0x28
mov rax, rax
push rax
pop rax
jmp 0x140001cdd
mov r15, 0x332d
cmp r15, qword [rsp]
jne 0x140001cdd
add rsp, 8
call fcn.14001c690
mov rax, rax
push rax
mov r15, qword [0x1402cf5a8]
cmp r15, qword [rsp]
jne 0x140001d0f
sub rsp, 8
push qword [0x1402cf588]
pop rcx
sub rsp, 0x20
call fcn.140003ecc
add rsp, 0x28
pop rax
jmp 0x140001d1d
push 5
pop rcx
call fcn.1400180f0
push qword [0x1402cf508]
pop rcx
call fcn.14000f848
and rax, rax
je 0x140001d39
mov qword [0x1402cf588], 0
mov r15, qword [0x1402cf588]
cmp r15, 0x333c
jne 0x140001c3a
push rcx
sub rsp, 0x28
call fcn.140029010
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
mov rcx, qword [0x1402cf5c0]
push rcx
sub rsp, 0x28
call fcn.140029010
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140029060
add rsp, 0x28
movabs rcx, str._files
sub rsp, 0x28
call fcn.140029060
add rsp, 0x28
push rax
call fcn.1400291e0
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
sub rsp, 0x20
call fcn.140019ea8
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14000eb50
add rsp, 0x28
pop rax
mov r15, rax
cmp r15, 0xfffffffffffffffe
jne 0x140001e63
push rcx
sub rsp, 0x28
call fcn.140029010
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push 3
movabs rax, 0x14008a028
push rax
mov rcx, qword [0x1402cf5c0]
push rcx
sub rsp, 0x28
call fcn.140029010
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140029060
add rsp, 0x28
movabs rcx, str._files
sub rsp, 0x28
call fcn.140029060
add rsp, 0x28
push rax
call fcn.1400291e0
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.14001a024
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14000eb50
add rsp, 0x28
pop rax
call 0x140001e85
call fcn.140028ef0
mov rcx, qword [0x1402cf4e8]
call sub.KERNEL32.DLL_HeapDestroy
mov rcx, qword [0x1402cf4f8]
call sub.KERNEL32.DLL_ExitProcess
sub rsp, 0x28
call fcn.14000f7e8
call fcn.140010b38
call fcn.140011780
call fcn.1400127c0
call fcn.140014a90
call fcn.1400184b4
call fcn.140019ca0
call fcn.14001a360
call fcn.14001ad20
call fcn.14001c488
call fcn.14001f718
call fcn.1400218a0
call fcn.140025c00
call fcn.1400280c8
call fcn.140028148
call fcn.1400278c0
add rsp, 0x28
ret