Function at 0x401000
Capabilities:
Allocate thread local storage
Hide graphical window
Identify system language via api
Query environment variable

Disassembly:
push 0x5f0
push 0
push 0x5063e0
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleW
mov dword [0x5063e4], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x5063e0], eax
mov eax, 0x47622c
mov dword [0x506428], eax
call fcn.0040cf42
call fcn.00426160
call fcn.00425564
call fcn.00425060
call fcn.004237e0
call fcn.00421714
call fcn.00420ea0
call fcn.004206d3
call fcn.0041fbf1
call fcn.0041ecc2
call fcn.0041e87b
call fcn.0041e5f6
call fcn.0041d163
call fcn.0041cb8d
call fcn.0041c55d
call fcn.0041b250
call fcn.00419156
call fcn.00411c03
call fcn.00410cec
call fcn.0040f3f6
call fcn.0040eb37
call fcn.0040e192
call fcn.0040d635
call fcn.0040d421
call fcn.0040d1cf
call fcn.0040d0a5
mov dword [0x5064b4], 0
mov edx, 0x472e20
lea ecx, [0x5064b0]
call fcn.0040c008
call fcn.00408ef3
mov edx, 0x472028
lea ecx, [0x50647c]
call fcn.0040c008
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.004261b0
pop edx
push eax
push 0x64
call fcn.00423a90
push 0x5063f0
call fcn.004261f0
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.004261b0
pop edx
push eax
push 0xc8
call fcn.00423a90
push 0x506480
call fcn.004261f0
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.004261b0
pop edx
push eax
push 0xc8
call fcn.00423a90
push 0x5064bc
call fcn.004261f0
push 0xc8
mov eax, dword [0x506480]
push eax
mov eax, str.PROCESSOR_ARCHITECTURE
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0xc8
mov eax, dword [0x5064bc]
push eax
mov eax, str.PROCESSOR_ARCHITEW6432
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0x64
mov eax, dword [0x5063f0]
push eax
mov eax, str.SYSTEMDRIVE
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.004261b0
pop edx
push eax
push 0x1f4
call fcn.00423a90
push 0x5064a4
call fcn.004261f0
push 0x1f4
mov eax, dword [0x5064a4]
push eax
mov eax, str.TEMP
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
push dword [0x506480]
mov edx, str.AMD64
pop ecx
call fcn.0040c970
jne 0x40120a
push dword [0x5064bc]
mov edx, str.AMD64
pop ecx
call fcn.0040c970
jne 0x40120a
jmp 0x401211
mov eax, 1
jmp 0x401213
xor eax, eax
and eax, eax
je 0x401229
mov edx, 0x4740dc
lea ecx, [0x50647c]
call fcn.0040c008
jmp 0x401239
mov edx, 0x4749f6
lea ecx, [0x50647c]
call fcn.0040c008
mov edx, 0x472028
lea ecx, [0x5064a8]
call fcn.0040c008
mov edx, 0x472028
lea ecx, [0x506404]
call fcn.0040c008
mov edx, dword [0x5063f0]
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.00426280
mov edx, 0x472a7c
push edx
call fcn.00426280
push 0x506404
call fcn.004261f0
push edx
call fcn.004261b0
pop edx
push eax
mov edx, dword [0x5063f0]
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.00426280
mov edx, str.WindowsSysnativecmd.exe
push edx
call fcn.00426280
call fcn.0040c9c2
add dword [esp], edx
call fcn.0041a66e
call fcn.0040c9e0
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x4012cf
jl 0x4012cb
cmp ebx, 0
ja 0x4012cf
xor eax, eax
jmp 0x4012d4
mov eax, 1
or eax, eax
je 0x401303
mov edx, dword [0x5063f0]
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.00426280
mov edx, str.WindowsSysnative
push edx
call fcn.00426280
push 0x5064a8
call fcn.004261f0
jmp 0x40132c
mov edx, dword [0x5063f0]
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.00426280
mov edx, 0x472a7c
push edx
call fcn.00426280
push 0x5064a8
call fcn.004261f0
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.004261b0
pop edx
push eax
call sub.KERNEL32.dll_GetUserDefaultLangID
cdq
push edx
push eax
call fcn.00423bc0
push 0x5063e8
call fcn.004261f0
push dword [0x5063e8]
call fcn.00423c40
mov ebx, eax
cmp ebx, 3
jne 0x40138e
push edx
call fcn.004261b0
pop edx
push eax
mov edx, 0x4722c4
push edx
call fcn.00426280
mov edx, dword [0x5063e8]
push edx
call fcn.00426280
push 0x5063e8
call fcn.004261f0
push dword [0x5063e8]
mov edx, str.0419
pop ecx
call fcn.0040c970
je 0x40146a
mov edx, 0x4725f0
lea ecx, [0x506438]
call fcn.0040c008
mov edx, 0x4728f8
lea ecx, [0x506494]
call fcn.0040c008
mov edx, 0x472332
lea ecx, [0x5064cc]
call fcn.0040c008
mov edx, 0x47589a
lea ecx, [0x506468]
call fcn.0040c008
mov edx, 0x47354a
lea ecx, [0x5063fc]
call fcn.0040c008
mov edx, 0x47574e
lea ecx, [0x50642c]
call fcn.0040c008
mov edx, 0x473b30
lea ecx, [0x50649c]
call fcn.0040c008
mov edx, 0x474fda
lea ecx, [0x506444]
call fcn.0040c008
mov edx, 0x4738e2
lea ecx, [0x5063ec]
call fcn.0040c008
mov edx, 0x473896
lea ecx, [0x506458]
call fcn.0040c008
mov edx, 0x47482a
lea ecx, [0x506448]
call fcn.0040c008
mov edx, 0x4723e4
lea ecx, [0x5064d8]
call fcn.0040c008
jmp 0x40152a
mov edx, str.Microsoft_Defender_Exclusion_Path
lea ecx, [0x506438]
call fcn.0040c008
mov edx, str.Enable_Defender
lea ecx, [0x506494]
call fcn.0040c008
mov edx, 0x472920
lea ecx, [0x5064cc]
call fcn.0040c008
mov edx, str.Reload_Table
lea ecx, [0x506468]
call fcn.0040c008
mov edx, 0x473104
lea ecx, [0x5063fc]
call fcn.0040c008
mov edx, str.Delete
lea ecx, [0x50642c]
call fcn.0040c008
mov edx, 0x4741e2
lea ecx, [0x50649c]
call fcn.0040c008
mov edx, str.Enable_Windows_Defender
lea ecx, [0x506444]
call fcn.0040c008
mov edx, str.Disable_Windows_Defender
lea ecx, [0x5063ec]
call fcn.0040c008
mov edx, 0x4721e0
lea ecx, [0x506458]
call fcn.0040c008
mov edx, str.Program_Settings
lea ecx, [0x506448]
call fcn.0040c008
mov edx, str.Run_with_Windows
lea ecx, [0x5064d8]
call fcn.0040c008
mov dword [0x5063f4], 0
call fcn.004112e6
mov ebp, 0x4bda09
push ebp
push 0xffffffff
call fcn.0041ee41
mov dword [0x50640c], eax
mov ebp, 0x4bdb5a
push ebp
push 0xffffffff
call fcn.0041ee41
mov dword [0x506410], eax
mov ebp, 0x4bdfa8
push ebp
push 0xffffffff
call fcn.0041ee41
mov dword [0x506414], eax
mov ebp, 0x4be4ee
push ebp
push 0xffffffff
call fcn.0041ee41
mov dword [0x506418], eax
call fcn.004112e6
mov ebp, 0x4bfb50
push ebp
push 0xffffffff
call fcn.0041ee41
mov dword [0x506430], eax
mov ebp, 0x4c70d5
push ebp
push 0xffffffff
call fcn.0041ee41
mov dword [0x5064ac], eax
mov ebp, 0x500ba3
push ebp
push 0xffffffff
call fcn.0041ee41
mov dword [0x506498], eax
push dword [0x50640c]
call fcn.00403805
push dword [0x5064ac]
call fcn.00403805
push 1
push dword [0x506430]
call fcn.0041ee58
push eax
call fcn.0041d1d4
push eax
push dword [0x506430]
call fcn.0041ee76
push eax
call fcn.0041d1f8
push eax
push dword [0x506430]
call fcn.0041ee94
push dword [0x506410]
call fcn.00403805
push dword [0x506414]
call fcn.00403805
push dword [0x506418]
call fcn.00403805
push dword [0x506498]
call fcn.00403805
mov dword [0x5064c8], 0
call fcn.0040d7c9
mov ebx, eax
dec ebx
mov dword [0x50641c], ebx
mov ebx, dword [0x50641c]
and ebx, ebx
jl 0x40172d
mov dword [0x50646c], 0
jmp 0x401679
mov eax, dword [0x50641c]
cmp eax, dword [0x50646c]
jl 0x40172d
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.004261b0
pop edx
push eax
push dword [0x50646c]
call fcn.0040d7dd
call fcn.0040c9c2
add dword [esp], edx
call fcn.00423c70
push 0x506484
call fcn.004261f0
push dword [0x506484]
mov edx, str._MIN
pop ecx
call fcn.0040c970
je 0x4016e9
mov dword [0x5064c8], 1
push dword [0x506484]
call fcn.0041a66e
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x401708
jl 0x401704
cmp ebx, 0
ja 0x401708
xor eax, eax
jmp 0x40170d
mov eax, 1
or eax, eax
je 0x401721
push dword [0x506484]
call fcn.00402108
jmp 0x401d9b
inc dword [0x50646c]
jno 0x401679
push 0x100
push 0x12
mov eax, str.Microsoft_Sans_Serif
push eax
push 0
call fcn.004255b1
and eax, eax
je 0x40174f
xor eax, eax
jmp 0x401754
mov eax, 1
and eax, eax
je 0x401773
push 0
mov eax, str.Load_font__Microsoft_Sans_Serif__error_
push eax
mov eax, 0x475d7a
push eax
call fcn.0040d45a
jmp 0x401d9b
push 0xa
mov eax, str.Microsoft_Sans_Serif
push eax
push 1
call fcn.0042567a
and eax, eax
je 0x401790
xor eax, eax
jmp 0x401795
mov eax, 1
and eax, eax
je 0x4017b4
push 0
mov eax, str.Load_font__Microsoft_Sans_Serif__error_
push eax
mov eax, 0x475d7a
push eax
call fcn.0040d45a
jmp 0x401d9b
push 1
call fcn.00425690
push eax
push 0xffffffff
call fcn.00411ca9
push dword [0x506430]
call fcn.0041ef41
push eax
call fcn.0041e8af
and eax, eax
je 0x40189a
push 1
call fcn.0041e914
push 0
call fcn.00425690
push eax
call fcn.0041e92b
mov edx, str.Defender_Tools
lea ecx, [0x50648c]
call fcn.0040c008
push dword [0x50648c]
call fcn.0041e942
mov dword [0x5064c4], eax
push dword [0x50648c]
call fcn.0041e959
mov dword [0x5064c0], eax
push 0xff
push 0xff
push 0xff
call fcn.0041e970
mov dword [0x506460], eax
push 5
push 5
call fcn.0041e985
mov dword [0x506400], eax
push dword [0x506400]
push dword [0x506460]
push dword [0x50648c]
push 0xa
push dword [0x506430]
call fcn.0041ee76
mov ebx, eax
sub ebx, dword [0x5064c4]
mov eax, ebx
mov ecx, 2
cdq
idiv ecx
mov ebx, eax
push ebx
call fcn.0041e9ae
call fcn.0041ea33
push 0x180
push 0x2ac
push 0
push 0
call fcn.00401e15
push dword [0x5064b0]
push dword [0x506450]
call fcn.00411d18
push dword [0x506410]
call fcn.0041f10c
push eax
push dword [0x506440]
call fcn.00411d63
push dword [0x506414]
call fcn.0041f10c
push eax
push dword [0x5063f8]
call fcn.00411d63
push 0
push dword [0x506438]
push 0xffffffff
push dword [0x5064a0]
call fcn.00411d9b
mov ebp, 0x4c72e0
push ebp
push 4
call fcn.0041ee41
push eax
push dword [0x506490]
call fcn.004191c1
push eax
push 3
call fcn.0040d1e3
push 1
push dword [0x506430]
call fcn.0041f10c
push eax
push dword [0x506490]
call fcn.004191c1
push eax
call fcn.0040c520
mov ebp, 0x4c72e0
push ebp
push 4
call fcn.0041ee41
push eax
push 3
call fcn.0040d309
call fcn.00403252
push 0
call fcn.00403c1f
mov ebp, 0x5007a7
push ebp
push 0xffffffff
call fcn.0041ee41
push eax
call fcn.0041f10c
mov dword [0x506464], eax
push 2
call fcn.00410569
and eax, eax
je 0x401a1e
push dword [0x506448]
call fcn.004106c2
push dword [0x5064d8]
push 0x31
call fcn.00410779
call fcn.0041078b
call fcn.004107af
push dword [0x506444]
push 0x32
call fcn.00410779
push dword [0x5063ec]
push 0x33
call fcn.00410779
call fcn.004107af
push dword [0x506458]
push 2
call fcn.00410779
call fcn.004107af
push dword [0x506464]
mov eax, 0x473b30
push eax
push 3
call fcn.004106d0
call fcn.00403985
push 0
lea eax, [0x40409b]
push eax
call fcn.0040d0fd
mov dword [0x5063f4], eax
mov ebx, dword [0x5064c8]
and ebx, ebx
jne 0x401a53
push 0
push dword [0x506490]
call fcn.004192bc
push dword [0x5064a0]
call fcn.00411de7
call fcn.004192ce
mov dword [0x506478], eax
cmp dword [0x506478], 0
je 0x401d3f
mov ebx, dword [0x506478]
cmp ebx, 0x332e
jne 0x401aec
call fcn.0041c677
mov ebx, eax
cmp ebx, 1
jne 0x401aa5
push dword [0x506490]
call fcn.004191c1
push eax
push 2
call fcn.004107fb
call fcn.0041c677
mov ebx, eax
and ebx, ebx
jne 0x401aec
push 9
push dword [0x506490]
call fcn.004191c1
push eax
call sub.USER32.dll_ShowWindow
push dword [0x506490]
call fcn.004191c1
push eax
call sub.USER32.dll_SetForegroundWindow
mov dword [0x506478], 0
call fcn.004192ce
and eax, eax
je 0x401aec
jmp 0x401ae1
mov ebx, dword [0x506478]
cmp ebx, 0x332d
jne 0x401bcb
call fcn.0041c686
push eax
mov ebx, 0x31
cmp ebx, dword [esp]
jne 0x401b34
push 0x31
push 2
call fcn.00410825
mov ebx, eax
and ebx, ebx
jne 0x401b2a
call fcn.00404bd4
jmp 0x401b2f
call fcn.004049c5
jmp 0x401bca
mov ebx, 0x32
cmp ebx, dword [esp]
jne 0x401b56
push dword [0x506478]
call fcn.00403306
push dword [0x5063f4]
call fcn.0040d19d
jmp 0x401bca
mov ebx, 0x33
cmp ebx, dword [esp]
jne 0x401b78
push dword [0x506478]
call fcn.00403306
push dword [0x5063f4]
call fcn.0040d19d
jmp 0x401bca
mov ebx, 2
cmp ebx, dword [esp]
jne 0x401bab
push 9
push dword [0x506490]
call fcn.004191c1
push eax
call sub.USER32.dll_ShowWindow
push dword [0x506490]
call fcn.004191c1
push eax
call sub.USER32.dll_SetForegroundWindow
jmp 0x401bca
mov ebx, 3
cmp ebx, dword [esp]
jne 0x401bca
mov dword [0x506478], 0x333c
push dword [0x5063f4]
call fcn.0040d19d
pop eax
push dword [0x506478]
mov ebx, 0x3337
cmp ebx, dword [esp]
jne 0x401bf6
push dword [0x506490]
call fcn.004191c1
push eax
push 2
call fcn.004107fb
jmp 0x401d1f
mov ebx, 0x201
cmp ebx, dword [esp]
jne 0x401c25
push 0
push 2
push 0xa1
push dword [0x506490]
call fcn.004191c1
push eax
call sub.USER32.dll_SendMessageW
jmp 0x401d1f
mov ebx, 0x332c
cmp ebx, dword [esp]
jne 0x401d1f
call fcn.0041c695
push eax
mov ebx, dword [0x5063f8]
cmp ebx, dword [esp]
jne 0x401c5f
push 0
push dword [0x506490]
call fcn.004191c1
push eax
call sub.USER32.dll_ShowWindow
jmp 0x401d1e
mov ebx, dword [0x506440]
cmp ebx, dword [esp]
jne 0x401c79
mov dword [0x506478], 0x333c
jmp 0x401d1e
mov ebx, dword [0x5064a0]
cmp ebx, dword [esp]
jne 0x401cc7
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.004261b0
pop edx
push eax
push dword [0x5064a0]
call fcn.00411e22
call fcn.004262e0
push dword [0x50644c]
call fcn.0040c9c2
add dword [esp + 4], edx
call fcn.00411d18
call fcn.0040c9e0
jmp 0x401d1e
mov ebx, dword [0x5064b8]
cmp ebx, dword [esp]
jne 0x401d1e
call fcn.0041c677
mov ebx, eax
and ebx, ebx
jne 0x401d1e
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.004261b0
pop edx
push eax
push dword [0x5064b8]
call fcn.00411e22
call fcn.004262e0
push dword [0x50644c]
call fcn.0040c9c2
add dword [esp + 4], edx
call fcn.00411d18
call fcn.0040c9e0
pop eax
pop eax
call fcn.0041c6a4
push eax
mov ebx, dword [0x506490]
cmp ebx, dword [esp]
jne 0x401d3c
push dword [0x506478]
call fcn.004041da
pop eax
jmp 0x401d49
push 5
call fcn.00418e2d
mov ebx, dword [0x506478]
cmp ebx, 0x333c
jne 0x401a5e
push edx
call fcn.004261b0
pop edx
push eax
push dword [0x5064a4]
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.004261b0
pop edx
push eax
call fcn.0040d82b
call fcn.0040c9c2
add dword [esp], edx
call fcn.00423da0
call fcn.0040c9e0
mov ebx, eax
and ebx, ebx
jle 0x401d9b
call fcn.004053d4
push 0
call 0x401dba
call fcn.00426190
push dword [0x5063e0]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess
call fcn.0040c620
call fcn.0040d063
call fcn.0040d1c3
call fcn.0040e180
call fcn.0040eb07
call fcn.00410ce0
call fcn.00411bad
call fcn.00419133
call fcn.0041a7c5
call fcn.0041b240
call fcn.0041c53f
call fcn.0041d152
call fcn.0041ecb6
call fcn.004206c6
call fcn.00423800
call fcn.004256ed
call fcn.00425737
call fcn.00425050
ret