Function at 0x401000
Capabilities:
Allocate thread local storage
Identify system language via api
Query environment variable

Disassembly:
push 0x570
push 0
push 0x6a8604
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.DLL_GetModuleHandleW
mov dword [0x6a8608], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.DLL_HeapCreate
mov dword [0x6a8604], eax
mov eax, 0x467b24
mov dword [0x6a8630], eax
call fcn.0041cb20
call fcn.0041bfc4
call fcn.0041bac0
call fcn.0041a290
call fcn.004181cc
call fcn.00417a70
call fcn.00417050
call fcn.00415fb9
call fcn.004158db
call fcn.0041558b
call fcn.00415306
call fcn.00413a4b
call fcn.0041349d
call fcn.00412220
call fcn.0041154e
call fcn.00410363
call fcn.0040da33
call fcn.0040cefc
call fcn.0040c4d8
call fcn.0040bb33
call fcn.0040b04b
call fcn.0040ae37
call fcn.0040ac8d
mov edx, str.Office_uninstall_v1.8.7
lea ecx, [0x6a863c]
call fcn.0040a008
mov edx, 0x46534e
lea ecx, [0x6a8644]
call fcn.0040a008
mov dword [0x6a8678], 0
push edx
call fcn.0041cb70
pop edx
push eax
push edx
call fcn.0041cb70
pop edx
push eax
push 0x3e8
call fcn.0041a540
push 0x6a866c
call fcn.0041cbb0
mov dword [0x6a8634], 0
mov dword [0x6a8628], 0
mov dword [0x6a8680], 1
mov edx, 0x464028
lea ecx, [0x6a8654]
call fcn.0040a008
push edx
call fcn.0041cb70
pop edx
push eax
push edx
call fcn.0041cb70
pop edx
push eax
push 0xc8
call fcn.0041a540
push 0x6a8658
call fcn.0041cbb0
push edx
call fcn.0041cb70
pop edx
push eax
push edx
call fcn.0041cb70
pop edx
push eax
push 0xc8
call fcn.0041a540
push 0x6a867c
call fcn.0041cbb0
push 0xc8
mov eax, dword [0x6a8658]
push eax
mov eax, str.PROCESSOR_ARCHITECTURE
push eax
call sub.KERNEL32.DLL_GetEnvironmentVariableW
push 0xc8
mov eax, dword [0x6a867c]
push eax
mov eax, str.PROCESSOR_ARCHITEW6432
push eax
call sub.KERNEL32.DLL_GetEnvironmentVariableW
push 0x3e8
mov eax, dword [0x6a866c]
push eax
mov eax, str.TEMP
push eax
call sub.KERNEL32.DLL_GetEnvironmentVariableW
push edx
call fcn.0041cb70
pop edx
push eax
push edx
call fcn.0041cb70
pop edx
push eax
push 0x3e8
call fcn.0041a540
push 0x6a8674
call fcn.0041cbb0
push 0x3e8
mov eax, dword [0x6a8674]
push eax
mov eax, str.WINDIR
push eax
call sub.KERNEL32.DLL_GetEnvironmentVariableW
push edx
call fcn.0041cb70
pop edx
push eax
push edx
call fcn.0041cb70
pop edx
push eax
push 0x3e8
call fcn.0041a540
push 0x6a8618
call fcn.0041cbb0
push 0x3e8
mov eax, dword [0x6a8618]
push eax
mov eax, str.WINDIR
push eax
call sub.KERNEL32.DLL_GetEnvironmentVariableW
push edx
call fcn.0041cb70
pop edx
push eax
mov edx, dword [0x6a8674]
push edx
call fcn.0041cb70
pop edx
push eax
push edx
call fcn.0041cc40
mov edx, str.Temp
push edx
call fcn.0041cc40
call fcn.0040a592
add dword [esp], edx
call fcn.004116da
call fcn.0040a5b0
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x40127d
cmp edi, 0xffffffff
je 0x401281
xor eax, eax
jmp 0x401286
mov eax, 1
or eax, eax
je 0x4012b3
mov edx, dword [0x6a8674]
push edx
call fcn.0041cb70
pop edx
push eax
push edx
call fcn.0041cc40
mov edx, str.Temp
push edx
call fcn.0041cc40
push 0x6a866c
call fcn.0041cbb0
push edx
call fcn.0041cb70
pop edx
push eax
mov edx, dword [0x6a8674]
push edx
call fcn.0041cb70
pop edx
push eax
push edx
call fcn.0041cc40
mov edx, str.Sysnativecmd.exe
push edx
call fcn.0041cc40
call fcn.0040a592
add dword [esp], edx
call fcn.004116da
call fcn.0040a5b0
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x401300
jl 0x4012fc
cmp ebx, 0
ja 0x401300
xor eax, eax
jmp 0x401305
mov eax, 1
or eax, eax
je 0x401334
mov edx, dword [0x6a8674]
push edx
call fcn.0041cb70
pop edx
push eax
push edx
call fcn.0041cc40
mov edx, str.Sysnative
push edx
call fcn.0041cc40
push 0x6a8674
call fcn.0041cbb0
jmp 0x40135d
mov edx, dword [0x6a8674]
push edx
call fcn.0041cb70
pop edx
push eax
push edx
call fcn.0041cc40
mov edx, str.System32
push edx
call fcn.0041cc40
push 0x6a8674
call fcn.0041cbb0
mov dword [0x6a8684], 0
call fcn.0040b1df
mov ebx, eax
dec ebx
mov dword [0x6a8624], ebx
mov ebx, dword [0x6a8624]
and ebx, ebx
jl 0x401406
mov dword [0x6a8648], 0
jmp 0x40138f
mov eax, dword [0x6a8624]
cmp eax, dword [0x6a8648]
jl 0x401406
push edx
call fcn.0041cb70
pop edx
push eax
push edx
call fcn.0041cb70
pop edx
push eax
push edx
call fcn.0041cb70
pop edx
push eax
push edx
call fcn.0041cb70
pop edx
push eax
push dword [0x6a8648]
call fcn.0040b1f3
call fcn.0040a592
add dword [esp], edx
call fcn.0041a590
push 0x6a865c
call fcn.0041cbb0
push dword [0x6a865c]
mov edx, str._CMD
mov ecx, dword [esp]
call fcn.0040a5c0
je 0x4013fd
mov dword [0x6a8684], 1
pop eax
inc dword [0x6a8648]
jno 0x40138f
push 9
mov eax, str.Consolas
push eax
push 0
call fcn.0041c0da
push edx
call fcn.0041cb70
pop edx
push eax
push 1
push edx
call fcn.0041cb70
pop edx
push eax
push edx
call fcn.0041cb70
pop edx
push eax
call fcn.0040b241
call fcn.0040a592
add dword [esp], edx
call fcn.004028a1
call fcn.0040a5b0
call fcn.0040b1df
mov ebx, eax
dec ebx
mov dword [0x6a8624], ebx
mov ebx, dword [0x6a8624]
and ebx, ebx
jl 0x4015fb
mov dword [0x6a8680], 0
mov dword [0x6a8648], 0
jmp 0x401481
mov eax, dword [0x6a8624]
cmp eax, dword [0x6a8648]
jl 0x401551
push edx
call fcn.0041cb70
pop edx
push eax
push edx
call fcn.0041cb70
pop edx
push eax
push edx
call fcn.0041cb70
pop edx
push eax
push edx
call fcn.0041cb70
pop edx
push eax
push dword [0x6a8648]
call fcn.0040b1f3
call fcn.0040a592
add dword [esp], edx
call fcn.0041a590
push 0x6a865c
call fcn.0041cbb0
push dword [0x6a865c]
mov edx, str._LOG
mov ecx, dword [esp]
call fcn.0040a5c0
je 0x4014f5
mov dword [0x6a8678], 1
jmp 0x401544
mov edx, str._O2010
mov ecx, dword [esp]
call fcn.0040a5c0
je 0x401510
mov dword [0x6a8634], 1
jmp 0x401544
mov edx, str._O2013_16
mov ecx, dword [esp]
call fcn.0040a5c0
je 0x40152b
mov dword [0x6a8628], 1
jmp 0x401544
mov edx, str._O2013_21C2R
mov ecx, dword [esp]
call fcn.0040a5c0
je 0x401544
mov dword [0x6a8680], 1
pop eax
inc dword [0x6a8648]
jno 0x401481
mov dword [0x6a8648], 0
jmp 0x40155d
mov eax, dword [0x6a8624]
cmp eax, dword [0x6a8648]
jl 0x4015f6
push edx
call fcn.0041cb70
pop edx
push eax
push edx
call fcn.0041cb70
pop edx
push eax
push edx
call fcn.0041cb70
pop edx
push eax
push edx
call fcn.0041cb70
pop edx
push eax
push dword [0x6a8648]
call fcn.0040b1f3
call fcn.0040a592
add dword [esp], edx
call fcn.0041a590
push 0x6a865c
call fcn.0041cbb0
push dword [0x6a865c]
mov edx, str._UNINSTALL
mov ecx, dword [esp]
call fcn.0040a5c0
je 0x4015e9
push 0x3e8
call fcn.00402c95
push 0x7d0
call fcn.0041003a
push dword [0x6a8610]
call fcn.0040ad2d
jmp 0x4018e7
pop eax
inc dword [0x6a8648]
jno 0x40155d
jmp 0x4018e7
push edx
call fcn.0041cb70
pop edx
push eax
push edx
call fcn.0041cb70
pop edx
push eax
call sub.KERNEL32.DLL_GetUserDefaultLangID
cdq
push edx
push eax
call fcn.0041a6e0
push 0x6a860c
call fcn.0041cbb0
push dword [0x6a860c]
call fcn.0041a760
mov ebx, eax
cmp ebx, 3
jne 0x40165d
push edx
call fcn.0041cb70
pop edx
push eax
mov edx, 0x464346
push edx
call fcn.0041cc40
mov edx, dword [0x6a860c]
push edx
call fcn.0041cc40
push 0x6a860c
call fcn.0041cbb0
push dword [0x6a860c]
mov edx, str.0419
pop ecx
call fcn.0040a5c0
je 0x401682
mov edx, 0x46488a
lea ecx, [0x6a8644]
call fcn.0040a008
jmp 0x401692
mov edx, 0x46534e
lea ecx, [0x6a8644]
call fcn.0040a008
push 0xfa
push 0x1d2
push 0
push 0
call fcn.00401957
push 1
push dword [0x6a8638]
call fcn.0040dad9
push 0
push dword [0x6a8670]
call fcn.0040db17
push 0
push dword [0x6a8664]
call fcn.0040db17
push 1
push dword [0x6a862c]
call fcn.0040db17
mov eax, 0x464028
push eax
call fcn.004030f6
push dword [0x6a8644]
mov edx, 0x46488a
pop ecx
call fcn.0040a5c0
je 0x401738
mov eax, 0x46408e
push eax
call fcn.004030f6
mov eax, 0x464c58
push eax
push dword [0x6a861c]
call fcn.0040db4f
mov eax, 0x4658dc
push eax
push dword [0x6a864c]
call fcn.0040db4f
jmp 0x401743
mov eax, str.Use_of_the_program:
push eax
call fcn.004030f6
mov eax, str.OUninstall.exe__Uninstall___O2010____O2013_16____O2013_21C2R____Log____cmd_
push eax
call fcn.004030f6
mov eax, 0x464028
push eax
call fcn.004030f6
push dword [0x6a8644]
mov edx, 0x46488a
pop ecx
call fcn.0040a5c0
je 0x401779
mov eax, 0x46456e
push eax
call fcn.004030f6
jmp 0x401784
mov eax, str.Example:
push eax
call fcn.004030f6
mov eax, str.OUninstall.exe__Uninstall__O2010__O2013_16__O2013_21C2R__Log
push eax
call fcn.004030f6
mov eax, 0x464028
push eax
call fcn.004030f6
call fcn.004103ce
mov dword [0x6a8650], eax
cmp dword [0x6a8650], 0
je 0x40181a
push dword [0x6a8650]
mov ebx, 0x201
cmp ebx, dword [esp]
jne 0x4017df
push 0
push 2
push 0xa1
push dword [0x6a8660]
call fcn.004103d6
push eax
call sub.USER32.dll_SendMessageW
jmp 0x4017fa
mov ebx, 0x332c
cmp ebx, dword [esp]
jne 0x4017f0
call fcn.004135b7
jmp 0x4017fa
mov ebx, 0x332d
cmp ebx, dword [esp]
jne 0x4017fa
pop eax
call fcn.004135c6
push eax
mov ebx, dword [0x6a8660]
cmp ebx, dword [esp]
jne 0x401817
push dword [0x6a8650]
call fcn.00402bc7
pop eax
jmp 0x401824
push 5
call fcn.0041003a
push dword [0x6a8610]
call fcn.0040ac99
and eax, eax
je 0x40183d
mov dword [0x6a8650], 0
mov ebx, dword [0x6a8650]
cmp ebx, 0x333c
jne 0x40179a
push edx
call fcn.0041cb70
pop edx
push eax
mov edx, dword [0x6a866c]
push edx
call fcn.0041cb70
pop edx
push eax
push edx
call fcn.0041cc40
mov edx, str._files
push edx
call fcn.0041cc40
call fcn.0040a592
add dword [esp], edx
call fcn.004116da
call fcn.0040a5b0
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x401896
cmp edi, 0xffffffff
je 0x40189a
xor eax, eax
jmp 0x40189f
mov eax, 1
or eax, eax
je 0x4018e7
push edx
call fcn.0041cb70
pop edx
push eax
push 3
mov eax, 0x464028
push eax
mov edx, dword [0x6a866c]
push edx
call fcn.0041cb70
pop edx
push eax
push edx
call fcn.0041cc40
mov edx, str._files
push edx
call fcn.0041cc40
call fcn.0040a592
add dword [esp], edx
call fcn.00411831
call fcn.0040a5b0
push 0
call 0x401906
call fcn.0041cb50
push dword [0x6a8604]
call sub.KERNEL32.DLL_HeapDestroy
call sub.KERNEL32.DLL_ExitProcess
call fcn.0040ac4b
call fcn.0040bb21
call fcn.0040c4a8
call fcn.0040cef0
call fcn.0040d9dd
call fcn.00410340
call fcn.0041153d
call fcn.00411b06
call fcn.00412210
call fcn.0041347f
call fcn.004158cf
call fcn.00417043
call fcn.0041a2b0
call fcn.0041c131
call fcn.0041c197
call fcn.0041bab0
ret