Function at 0x140001000
Capabilities:
Identify system language via api
Query environment variable

Disassembly:
sub rsp, 0x28
mov r8, 0x7d0
xor rdx, rdx
movabs rcx, 0x140310970
call sub.msvcrt.dll_memset
xor rcx, rcx
call sub.KERNEL32.dll_GetModuleHandleW
mov qword [0x140310978], rax
xor r8, r8
mov rdx, 0x1000
xor rcx, rcx
call sub.KERNEL32.dll_HeapCreate
mov qword [0x140310970], rax
movabs rax, 0x1400f4488
mov qword [0x1403109f0], rax
call fcn.14001f7f0
call fcn.14003ca50
call fcn.14003b8a8
call fcn.14003b2b0
call fcn.140039570
call fcn.1400367a4
call fcn.140035c70
call fcn.1400354e8
call fcn.14003455c
call fcn.140033c9c
call fcn.140032f10
call fcn.1400328f0
call fcn.14002f340
call fcn.14002e9c8
call fcn.14002dea4
call fcn.14002c720
call fcn.140029e40
call fcn.140025c44
call fcn.14002391c
call fcn.140022800
call fcn.1400225dc
call fcn.140020d90
call fcn.14001fec8
call fcn.14001fc00
call fcn.14001f9b4
movabs rdx, str.Office_uninstall_v2.0.0
lea rcx, [0x140310a10]
call fcn.14003cac0
mov rcx, qword [0x140310a10]
push rcx
sub rsp, 0x28
call fcn.14003cbb0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14003cc00
add rsp, 0x28
movabs rcx, str._x64
sub rsp, 0x28
call fcn.14003cc00
add rsp, 0x28
lea rcx, [0x140310a10]
pop rdx
call fcn.14003cc70
movabs rdx, 0x1400f1584
lea rcx, [0x140310a40]
call fcn.14003cac0
mov qword [0x140310ac0], 0
push rcx
sub rsp, 0x28
call fcn.14003cbb0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14003cbb0
add rsp, 0x28
pop rcx
push rax
push 0x3e8
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140039910
add rsp, 0x28
lea rcx, [0x140310aa8]
pop rdx
call fcn.14003cc70
mov qword [0x1403109f8], 0
mov qword [0x1403109d8], 0
mov qword [0x140310ad0], 1
mov qword [0x140310a98], 2
push 0x808080
push 1
push 0
pop rcx
pop rdx
pop r8
call sub.GDI32.dll_CreatePen
mov qword [0x140310a18], rax
push 0xcc872c
push 1
push 0
pop rcx
pop rdx
pop r8
call sub.GDI32.dll_CreatePen
mov qword [0x140310a80], rax
mov r9, 7
xor r8, r8
lea rdx, [0x140311068]
mov rcx, 0x3b
call fcn.140034588
mov rcx, 0x200
sub rsp, 8
push rcx
lea r9, [0x140311128]
xor r8, r8
mov rdx, 7
mov rcx, 0x59
sub rsp, 0x20
call fcn.14002e9f4
add rsp, 0x28
add rsp, 8
mov rcx, 0x200
sub rsp, 8
push rcx
lea r9, [0x140311130]
xor r8, r8
mov rdx, SafeArrayPutElement
mov rcx, 8
sub rsp, 0x20
call fcn.14002e9f4
add rsp, 0x28
add rsp, 8
mov rcx, 0x200
sub rsp, 8
push rcx
lea r9, [0x140311138]
xor r8, r8
mov rdx, SafeArrayPutElement
mov rcx, 8
sub rsp, 0x20
call fcn.14002e9f4
add rsp, 0x28
add rsp, 8
mov qword [0x140311038], 2
mov qword [0x140311040], 1
sub rsp, 0x18
movabs rax, 0x140311030
push rax
xor r9, r9
mov r8, SafeArrayPutElement
mov rdx, 8
mov rcx, 2
sub rsp, 0x20
call fcn.140032a08
add rsp, 0x40
mov qword [0x140311030], rax
movabs rdx, 0x1400f0028
lea rcx, [0x140310a60]
call fcn.14003cac0
push rcx
sub rsp, 0x28
call fcn.14003cbb0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14003cbb0
add rsp, 0x28
pop rcx
push rax
push 0xc8
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140039910
add rsp, 0x28
lea rcx, [0x140310a68]
pop rdx
call fcn.14003cc70
push rcx
sub rsp, 0x28
call fcn.14003cbb0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14003cbb0
add rsp, 0x28
pop rcx
push rax
push 0xc8
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140039910
add rsp, 0x28
lea rcx, [0x140310ac8]
pop rdx
call fcn.14003cc70
push 0xc8
mov rax, qword [0x140310a68]
mov rax, rax
push rax
movabs rax, str.PROCESSOR_ARCHITECTURE
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0xc8
mov rax, qword [0x140310ac8]
mov rax, rax
push rax
movabs rax, str.PROCESSOR_ARCHITEW6432
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0x3e8
mov rax, qword [0x140310aa8]
mov rax, rax
push rax
movabs rax, str.TEMP
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_GetEnvironmentVariableW
push rcx
sub rsp, 0x28
call fcn.14003cbb0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14003cbb0
add rsp, 0x28
pop rcx
push rax
push 0x3e8
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140039910
add rsp, 0x28
lea rcx, [0x140310ab8]
pop rdx
call fcn.14003cc70
push 0x3e8
mov rax, qword [0x140310ab8]
mov rax, rax
push rax
movabs rax, str.WINDIR
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_GetEnvironmentVariableW
push rcx
sub rsp, 0x28
call fcn.14003cbb0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14003cbb0
add rsp, 0x28
pop rcx
push rax
push 0x3e8
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140039910
add rsp, 0x28
lea rcx, [0x1403109a8]
pop rdx
call fcn.14003cc70
push 0x3e8
mov rax, qword [0x1403109a8]
mov rax, rax
push rax
movabs rax, str.WINDIR
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_GetEnvironmentVariableW
push rcx
sub rsp, 0x28
call fcn.14003cbb0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
mov rcx, qword [0x140310ab8]
push rcx
sub rsp, 0x28
call fcn.14003cbb0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14003cc00
add rsp, 0x28
movabs rcx, str.Sysnativecmd.exe
sub rsp, 0x28
call fcn.14003cc00
add rsp, 0x28
push rax
call fcn.14003cd80
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
sub rsp, 0x20
call fcn.14002b8c8
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14001ed4c
add rsp, 0x28
pop rax
mov r15, rax
and r15, r15
jle 0x1400015b9
mov rcx, qword [0x140310ab8]
push rcx
sub rsp, 0x28
call fcn.14003cbb0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14003cc00
add rsp, 0x28
movabs rcx, str.Sysnative
sub rsp, 0x28
call fcn.14003cc00
add rsp, 0x28
lea rcx, [0x140310ab8]
pop rdx
call fcn.14003cc70
jmp 0x140001601
mov rcx, qword [0x140310ab8]
push rcx
sub rsp, 0x28
call fcn.14003cbb0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14003cc00
add rsp, 0x28
movabs rcx, str.System32
sub rsp, 0x28
call fcn.14003cc00
add rsp, 0x28
lea rcx, [0x140310ab8]
pop rdx
call fcn.14003cc70
mov qword [0x140310ae0], 0
call fcn.14002007c
mov r15, rax
dec r15
mov qword [0x1403109c8], r15
mov r15, qword [0x1403109c8]
and r15, r15
jl 0x140001711
mov qword [0x140310a48], 0
jmp 0x14000163b
mov rax, qword [0x1403109c8]
cmp rax, qword [0x140310a48]
jl 0x140001711
push rcx
sub rsp, 0x28
call fcn.14003cbb0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14003cbb0
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.14003cbb0
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.14003cbb0
add rsp, 0x28
pop rcx
push rax
push qword [0x140310a48]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140020110
add rsp, 0x20
push rax
call fcn.14003cd80
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140039970
add rsp, 0x28
lea rcx, [0x140310a78]
pop rdx
call fcn.14003cc70
push qword [0x140310a78]
movabs rdx, str._CMD
mov rcx, qword [rsp]
sub rsp, 0x28
call fcn.14003cdb0
add rsp, 0x28
or rax, rax
je 0x140001703
mov qword [0x140310ae0], 1
pop rax
inc qword [0x140310a48]
jno 0x14000163b
push 9
movabs rax, str.Consolas
push rax
push 0
pop rcx
pop rdx
pop r8
call fcn.14003b91c
push rcx
sub rsp, 0x28
call fcn.14003cbb0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push 1
push rcx
sub rsp, 0x20
call fcn.14003cbb0
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.14003cbb0
add rsp, 0x28
pop rcx
push rax
pop rcx
sub rsp, 0x20
call fcn.14002019c
add rsp, 0x20
push rax
call fcn.14003cd80
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140007767
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14001ed4c
add rsp, 0x28
pop rax
call fcn.14002007c
mov r15, rax
dec r15
mov qword [0x1403109c8], r15
mov r15, qword [0x1403109c8]
and r15, r15
jl 0x140001a69
mov qword [0x140310ad0], 0
mov qword [0x140310a48], 0
jmp 0x1400017dd
mov rax, qword [0x1403109c8]
cmp rax, qword [0x140310a48]
jl 0x14000193d
push rcx
sub rsp, 0x28
call fcn.14003cbb0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14003cbb0
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.14003cbb0
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.14003cbb0
add rsp, 0x28
pop rcx
push rax
push qword [0x140310a48]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140020110
add rsp, 0x20
push rax
call fcn.14003cd80
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140039970
add rsp, 0x28
lea rcx, [0x140310a78]
pop rdx
call fcn.14003cc70
push qword [0x140310a78]
movabs rdx, str._LOG
mov rcx, qword [rsp]
sub rsp, 0x28
call fcn.14003cdb0
add rsp, 0x28
or rax, rax
je 0x1400018aa
mov qword [0x140310ac0], 1
jmp 0x14000192f
movabs rdx, str._O2010
mov rcx, qword [rsp]
sub rsp, 0x28
call fcn.14003cdb0
add rsp, 0x28
or rax, rax
je 0x1400018d7
mov qword [0x1403109f8], 1
jmp 0x14000192f
movabs rdx, str._O2013_16
mov rcx, qword [rsp]
sub rsp, 0x28
call fcn.14003cdb0
add rsp, 0x28
or rax, rax
je 0x140001904
mov qword [0x1403109d8], 1
jmp 0x14000192f
movabs rdx, str._O2013_21C2R
mov rcx, qword [rsp]
sub rsp, 0x28
call fcn.14003cdb0
add rsp, 0x28
or rax, rax
je 0x14000192f
mov qword [0x140310ad0], 1
pop rax
inc qword [0x140310a48]
jno 0x1400017dd
mov qword [0x140310a48], 0
jmp 0x14000194a
mov rax, qword [0x1403109c8]
cmp rax, qword [0x140310a48]
jl 0x140001a64
push rcx
sub rsp, 0x28
call fcn.14003cbb0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14003cbb0
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.14003cbb0
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.14003cbb0
add rsp, 0x28
pop rcx
push rax
push qword [0x140310a48]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140020110
add rsp, 0x20
push rax
call fcn.14003cd80
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140039970
add rsp, 0x28
lea rcx, [0x140310a78]
pop rdx
call fcn.14003cc70
push qword [0x140310a78]
movabs rdx, str._UNINSTALL
mov rcx, qword [rsp]
sub rsp, 0x28
call fcn.14003cdb0
add rsp, 0x28
or rax, rax
je 0x140001a56
sub rsp, 8
push 0x3e8
pop rcx
sub rsp, 0x20
call fcn.14000d014
add rsp, 0x28
sub rsp, 8
push 0x7d0
pop rcx
sub rsp, 0x20
call fcn.140029a4c
add rsp, 0x28
sub rsp, 8
push qword [0x140310990]
pop rcx
sub rsp, 0x20
call fcn.14001fa60
add rsp, 0x28
add rsp, 0xfffffffffffffff8
jmp 0x1400023d9
pop rax
inc qword [0x140310a48]
jno 0x14000194a
jmp 0x1400023d9
push rcx
sub rsp, 0x28
call fcn.14003cbb0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14003cbb0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
sub rsp, 0x20
call sub.KERNEL32.dll_GetUserDefaultLangID
add rsp, 0x28
mov rax, rax
push rax
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140039a00
add rsp, 0x28
lea rcx, [0x140310988]
pop rdx
call fcn.14003cc70
push qword [0x140310988]
pop rcx
call fcn.140039bd0
mov r15, rax
cmp r15, 3
jne 0x140001b1b
push rcx
sub rsp, 0x28
call fcn.14003cbb0
add rsp, 0x28
pop rcx
push rax
movabs rcx, 0x1400f031c
sub rsp, 0x28
call fcn.14003cc00
add rsp, 0x28
mov rcx, qword [0x140310988]
sub rsp, 0x28
call fcn.14003cc00
add rsp, 0x28
lea rcx, [0x140310988]
pop rdx
call fcn.14003cc70
push qword [0x140310988]
movabs rcx, str.0419
pop rdx
call fcn.14003cdb0
or rax, rax
je 0x140001b4e
movabs rdx, 0x1400f08f4
lea rcx, [0x140310a40]
call fcn.14003cac0
jmp 0x140001b64
movabs rdx, 0x1400f1584
lea rcx, [0x140310a40]
call fcn.14003cac0
movabs rdx, str.Panic___
lea rcx, [0x140310a20]
call fcn.14003cac0
movabs rdx, 0x1400f3296
lea rcx, [0x140310a70]
call fcn.14003cac0
push rcx
sub rsp, 0x28
call fcn.14003cbb0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14003cbb0
add rsp, 0x28
pop rcx
push rax
pop rcx
sub rsp, 0x20
call fcn.14002019c
add rsp, 0x28
lea rcx, [0x1403109a0]
pop rdx
call fcn.14003cc70
mov dword [0x140310be0], 0
mov dword [0x140310be4], 0
lea rax, [0x140310be4]
mov rax, rax
push rax
lea rax, [0x140310be0]
mov rax, rax
push rax
mov rax, qword [0x1403109a0]
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
call sub.imagehlp.dll_MapFileAndCheckSumW
movsxd r15, dword [0x140310be0]
cmp r15d, dword [0x140310be4]
je 0x140001c3c
push reloc.WS2_32.dll_recv
push qword [0x140310a70]
push qword [0x140310a20]
pop rcx
pop rdx
pop r8
call fcn.14001fc44
jmp 0x1400023d9
push rcx
sub rsp, 0x28
call fcn.14003cbb0
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.14003cbb0
add rsp, 0x20
pop rcx
push rax
sub rsp, 0x20
call fcn.14000753f
add rsp, 0x28
lea rcx, [0x140310a30]
pop rdx
call fcn.14003cc70
push rcx
sub rsp, 0x28
call fcn.14003cbb0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14003cbb0
add rsp, 0x28
pop rcx
push rax
push qword [0x140310a30]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14002ba44
add rsp, 0x28
lea rcx, [0x1403109d0]
pop rdx
call fcn.14003cc70
push rcx
sub rsp, 0x28
call fcn.14003cbb0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
movabs rax, str.tool
push rax
push rcx
sub rsp, 0x20
call fcn.14003cbb0
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.14003cbb0
add rsp, 0x28
pop rcx
push rax
push qword [0x1403109d0]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140039bf0
add rsp, 0x20
push rax
call fcn.14003cd80
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140039c80
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14001ed4c
add rsp, 0x28
pop rax
mov r15, rax
and r15, r15
jne 0x140001d69
push qword [0x1403109d0]
movabs rcx, 0x1400f0028
pop rdx
call fcn.14003cdb0
or rax, rax
jne 0x140001d69
mov rax, 1
jmp 0x140001d6c
xor rax, rax
and rax, rax
je 0x140001d76
jmp 0x1400023d9
push rcx
sub rsp, 0x28
call fcn.14003cbb0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
movabs rax, str.tool
push rax
push rcx
sub rsp, 0x20
call fcn.14003cbb0
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.14003cbb0
add rsp, 0x28
pop rcx
push rax
push qword [0x1403109d0]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140039bf0
add rsp, 0x20
push rax
call fcn.14003cd80
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140039c80
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14001ed4c
add rsp, 0x28
pop rax
mov r15, rax
and r15, r15
jle 0x140001e20
push qword [0x140310a30]
pop rcx
call fcn.14002b8c8
mov r15, rax
cmp r15, 0x1c9c380
jge 0x140001e20
mov rax, 1
jmp 0x140001e23
xor rax, rax
and rax, rax
je 0x140001e2d
jmp 0x1400023d9
push 0xfa
push 0x1d2
push 0
push 0
pop rcx
pop rdx
pop r8
pop r9
call fcn.140002459
push 1
push qword [0x140310a08]
pop rcx
pop rdx
call fcn.140025d18
push 0
push qword [0x140310ab0]
pop rcx
pop rdx
call fcn.140025d70
push 0
push qword [0x140310a90]
pop rcx
pop rdx
call fcn.140025d70
push 1
push qword [0x1403109e0]
pop rcx
pop rdx
call fcn.140025d70
push 0xfffffffffffffffe
sub rsp, 8
push 0x28
push 0x28
push 0x28
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.140032f28
add rsp, 0x28
mov rax, rax
push rax
push 0xffffffffffffffff
push qword [0x140310a88]
pop rcx
pop rdx
pop r8
pop r9
call fcn.140013b12
push 0
push 0
push 0
pop rcx
pop rdx
pop r8
call fcn.140032f28
mov rax, rax
push rax
push qword [0x1403109b0]
pop rcx
pop rdx
call fcn.14000e027
push 0xff
push 0xff
push 0xff
pop rcx
pop rdx
pop r8
call fcn.140032f28
mov rax, rax
push rax
push qword [0x1403109b0]
pop rcx
pop rdx
call fcn.140013740
call fcn.140029ae4
mov r15, rax
cmp r15, 0x6e
jl 0x14000202b
movabs rax, str.dwmapi
push rax
push 0
pop rcx
pop rdx
call fcn.1400239d0
and rax, rax
je 0x14000202b
mov qword [0x1403109e8], 1
movabs rax, str.DwmSetWindowAttribute
push rax
push 0
pop rcx
pop rdx
call fcn.140023a58
mov qword [0x140310a00], rax
push qword [0x140312ae0]
pop rcx
call fcn.14003bb58
lea rax, [0x140310a38]
mov rax, rax
push rax
push qword [0x140312ae0]
pop rcx
pop rdx
call fcn.14003bae0
and rax, rax
je 0x140002009
push qword [0x140310a38]
pop rcx
call fcn.140029f08
and rax, rax
je 0x140002007
mov rax, 8
mov rax, rax
push rax
lea rax, [0x1403109e8]
mov rax, rax
push rax
mov rax, SafeArrayPutElement
mov rax, rax
push rax
sub rsp, 8
push qword [0x140310a38]
pop rcx
sub rsp, 0x20
call fcn.140029f18
add rsp, 0x28
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
pop r9
call qword [0x140310a00]
jmp 0x140001f90
push qword [0x140312ae0]
pop rcx
call fcn.14003bad4
push 0
pop rcx
call fcn.1400238bc
push 1
pop rcx
call fcn.14000a5b0
movabs rax, 0x1400f0028
push rax
pop rcx
call fcn.140010cf2
push qword [0x140310a40]
movabs rcx, 0x1400f08f4
pop rdx
call fcn.14003cdb0
or rax, rax
je 0x14000209a
movabs rax, 0x1400f0094
push rax
pop rcx
call fcn.140010cf2
movabs rax, 0x1400f0d54
push rax
push qword [0x1403109b0]
pop rcx
pop rdx
call fcn.140025dc4
movabs rax, 0x1400f1b96
push rax
push qword [0x140310a50]
pop rcx
pop rdx
call fcn.140025dc4
jmp 0x1400020ab
movabs rax, 0x1400f0594
push rax
pop rcx
call fcn.140010cf2
movabs rax, str.OUninstall.exe__Uninstall___O2010____O2013_16____O2013_21C2R____Log____cmd_
push rax
pop rcx
call fcn.140010cf2
movabs rax, 0x1400f0028
push rax
pop rcx
call fcn.140010cf2
push qword [0x140310a40]
movabs rcx, 0x1400f08f4
pop rdx
call fcn.14003cdb0
or rax, rax
je 0x1400020fb
movabs rax, 0x1400f0584
push rax
pop rcx
call fcn.140010cf2
jmp 0x14000210c
movabs rax, 0x1400f02d8
push rax
pop rcx
call fcn.140010cf2
movabs rax, str.OUninstall.exe__Uninstall__O2010__O2013_16__O2013_21C2R__Log
push rax
pop rcx
call fcn.140010cf2
movabs rax, 0x1400f0028
push rax
pop rcx
call fcn.140010cf2
call fcn.140029f38
mov qword [0x140310a58], rax
cmp qword [0x140310a58], 0
je 0x140002206
push qword [0x140310a58]
mov r15, 0x201
cmp r15, qword [rsp]
jne 0x14000219f
sub rsp, 8
push 0
push 2
push 0xa1
sub rsp, 8
push qword [0x140310a88]
pop rcx
sub rsp, 0x20
call fcn.140029f18
add rsp, 0x28
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.USER32.dll_SendMessageW
add rsp, 0x28
jmp 0x1400021d1
mov r15, 0x332c
cmp r15, qword [rsp]
jne 0x1400021c4
sub rsp, 8
sub rsp, 0x20
call fcn.14002e064
add rsp, 0x28
mov rax, rax
push rax
pop rax
jmp 0x1400021d1
mov r15, 0x332d
cmp r15, qword [rsp]
jne 0x1400021d1
add rsp, 8
call fcn.14002e080
mov rax, rax
push rax
mov r15, qword [0x140310a88]
cmp r15, qword [rsp]
jne 0x140002203
sub rsp, 8
push qword [0x140310a58]
pop rcx
sub rsp, 0x20
call fcn.140008dd5
add rsp, 0x28
pop rax
jmp 0x140002211
push 5
pop rcx
call fcn.140029a4c
push qword [0x140310990]
pop rcx
call fcn.14001f9c4
and rax, rax
je 0x14000222d
mov qword [0x140310a58], 0
mov r15, qword [0x140310a58]
cmp r15, 0x333c
jne 0x14000212e
push rcx
sub rsp, 0x28
call fcn.14003cbb0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
mov rcx, qword [0x140310aa8]
push rcx
sub rsp, 0x28
call fcn.14003cbb0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14003cc00
add rsp, 0x28
movabs rcx, str._files
sub rsp, 0x28
call fcn.14003cc00
add rsp, 0x28
push rax
call fcn.14003cd80
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
sub rsp, 0x20
call fcn.14002b8c8
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14001ed4c
add rsp, 0x28
pop rax
mov r15, rax
cmp r15, 0xfffffffffffffffe
jne 0x140002357
push rcx
sub rsp, 0x28
call fcn.14003cbb0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push 3
movabs rax, 0x1400f0028
push rax
mov rcx, qword [0x140310aa8]
push rcx
sub rsp, 0x28
call fcn.14003cbb0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14003cc00
add rsp, 0x28
movabs rcx, str._files
sub rsp, 0x28
call fcn.14003cc00
add rsp, 0x28
push rax
call fcn.14003cd80
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.14002bb50
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14001ed4c
add rsp, 0x28
pop rax
push rcx
sub rsp, 0x28
call fcn.14003cbb0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push qword [0x140310aa8]
push rcx
sub rsp, 0x20
call fcn.14003cbb0
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.14003cbb0
add rsp, 0x28
pop rcx
push rax
pop rcx
sub rsp, 0x20
call fcn.14002019c
add rsp, 0x20
push rax
call fcn.14003cd80
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140039c80
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14001ed4c
add rsp, 0x28
pop rax
mov r15, rax
and r15, r15
jle 0x1400023d9
call fcn.140014afa
call 0x1400023fb
call fcn.14003ca90
mov rcx, qword [0x140310970]
call sub.KERNEL32.dll_HeapDestroy
mov rcx, qword [0x140310980]
call sub.KERNEL32.dll_ExitProcess
sub rsp, 0x28
call fcn.14001f964
call fcn.140020d74
call fcn.1400225d0
call fcn.1400227c0
call fcn.140023910
call fcn.140025be0
call fcn.140029e10
call fcn.14002be8c
call fcn.14002c710
call fcn.14002de78
call fcn.14002f33c
call fcn.140033c90
call fcn.1400354e4
call fcn.1400395a0
call fcn.14003baa8
call fcn.14003bbe8
call fcn.14003b2a0
add rsp, 0x28
ret