Function at 0x401000
Capabilities:
Allocate thread local storage
Query environment variable

Disassembly:
push 0x634
push 0
push 0x577ce4
call fcn.00425a40
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleW
mov dword [0x577ce8], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x577ce4], eax
mov eax, 0x4e8b88
mov dword [0x577d38], eax
call fcn.0040f75d
call fcn.00449980
call fcn.00448db7
call fcn.00448880
call fcn.00446f30
call fcn.00444d3a
call fcn.00444450
call fcn.00443d21
call fcn.0044323c
call fcn.00442439
call fcn.004420d4
call fcn.00441e38
call fcn.00440611
call fcn.0044001d
call fcn.0043f9e2
call fcn.0043e630
call fcn.0043d61b
call fcn.0043d46a
call fcn.0043bf8c
call fcn.0043bbc7
call fcn.00435909
call fcn.00434a0c
call fcn.00433f74
call fcn.004331fb
call fcn.004326ad
call fcn.0043229e
push 7
push 0x4e6fe0
lea eax, [0x5782b8]
push eax
push 8
call fcn.0044325b
mov edx, 0x4dd028
lea ecx, [0x577d68]
call fcn.0040f008
mov edx, 0x4e3c22
lea ecx, [0x577dac]
call fcn.0040f008
mov edx, str.Interface_EN
lea ecx, [0x577d60]
call fcn.0040f008
mov edx, 0x4e30a6
lea ecx, [0x577e0c]
call fcn.0040f008
mov edx, str.Interface_EN
lea ecx, [0x577e14]
call fcn.0040f008
mov edx, 0x4e6d04
lea ecx, [0x577d04]
call fcn.0040f008
mov edx, 0x4e2dae
lea ecx, [0x577dd4]
call fcn.0040f008
mov edx, str.Interface__VI__by_ptk911
lea ecx, [0x577df0]
call fcn.0040f008
mov edx, 0x4e6d04
lea ecx, [0x577da0]
call fcn.0040f008
mov edx, 0x4e0f58
lea ecx, [0x577d28]
call fcn.0040f008
mov edx, 0x4e110a
lea ecx, [0x577d40]
call fcn.0040f008
mov edx, 0x4dd04e
lea ecx, [0x577d44]
call fcn.0040f008
mov edx, 0x4e6e22
lea ecx, [0x577d48]
call fcn.0040f008
mov edx, 0x4e671c
lea ecx, [0x577dd8]
call fcn.0040f008
mov edx, 0x4e5660
lea ecx, [0x577cec]
call fcn.0040f008
mov edx, 0x4e0868
lea ecx, [0x577dcc]
call fcn.0040f008
mov edx, 0x4e6ce4
lea ecx, [0x577d5c]
call fcn.0040f008
mov edx, 0x4e4f66
lea ecx, [0x577d80]
call fcn.0040f008
mov edx, str._____
lea ecx, [0x577d6c]
call fcn.0040f008
mov edx, 0x4e1716
lea ecx, [0x577e18]
call fcn.0040f008
mov edx, 0x4e57dc
lea ecx, [0x577d94]
call fcn.0040f008
mov edx, 0x4e5320
lea ecx, [0x577dc0]
call fcn.0040f008
mov edx, 0x4e55f6
lea ecx, [0x577d30]
call fcn.0040f008
mov edx, 0x4e3c9e
lea ecx, [0x577d4c]
call fcn.0040f008
mov edx, 0x4e2bbe
lea ecx, [0x577dfc]
call fcn.0040f008
mov edx, 0x4dedcc
lea ecx, [0x577d98]
call fcn.0040f008
mov edx, 0x4dea1a
lea ecx, [0x577d8c]
call fcn.0040f008
mov edx, 0x4e6f96
lea ecx, [0x577d3c]
call fcn.0040f008
mov edx, 0x4e668e
lea ecx, [0x577dd0]
call fcn.0040f008
mov edx, 0x4e3514
lea ecx, [0x577d90]
call fcn.0040f008
mov edx, 0x4e68b4
lea ecx, [0x577cf8]
call fcn.0040f008
mov edx, 0x4e027e
lea ecx, [0x577da4]
call fcn.0040f008
mov edx, 0x4e4fe0
lea ecx, [0x577ddc]
call fcn.0040f008
mov edx, 0x4e2c5e
lea ecx, [0x577e1c]
call fcn.0040f008
mov edx, 0x4e4306
lea ecx, [0x577da8]
call fcn.0040f008
mov edx, 0x4e11cc
lea ecx, [0x577d84]
call fcn.0040f008
mov edx, str.MSActBackup_v1.2.8
lea ecx, [0x577db0]
call fcn.0040f008
mov edx, dword [0x577db0]
push edx
call fcn.004499b0
pop edx
push eax
push edx
call fcn.004499e0
mov edx, 0x4dd42a
push edx
call fcn.004499e0
lea eax, [0x577dbc]
push eax
call fcn.00449a30
push edx
call fcn.004499b0
pop edx
push eax
mov edx, str._______________
push edx
call fcn.004499e0
mov edx, dword [0x577db0]
push edx
call fcn.004499e0
mov edx, 0x4df588
push edx
call fcn.004499e0
lea eax, [0x577de4]
push eax
call fcn.00449a30
mov edx, 0x4e636a
lea ecx, [0x577d78]
call fcn.0040f008
call fcn.00434ffc
mov ebp, 0x4e700c
push ebp
push 0xffffffff
call fcn.004425b7
mov dword [0x577d1c], eax
push 0xb
mov eax, str.Lucida_Sans_Unicode
push eax
push 0
call fcn.00448eb4
mov dword [0x577d64], 0
mov dword [0x577d58], 0
mov edx, 0x4dd028
lea ecx, [0x577d9c]
call fcn.0040f008
mov edx, 0x4dd028
lea ecx, [0x577e08]
call fcn.0040f008
push edx
call fcn.004499b0
pop edx
push eax
push edx
call fcn.004499b0
pop edx
push eax
push 0x64
call fcn.00447220
lea eax, [0x577cf0]
push eax
call fcn.00449a30
push 0x64
mov eax, dword [0x577cf0]
push eax
mov eax, str.SYSTEMDRIVE
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
push edx
call fcn.004499b0
pop edx
push eax
push edx
call fcn.004499b0
pop edx
push eax
push 0x3e8
call fcn.00447220
lea eax, [0x577e04]
push eax
call fcn.00449a30
push 0x3e8
mov eax, dword [0x577e04]
push eax
mov eax, str.WINDIR
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
mov edx, dword [0x577e04]
push edx
call fcn.004499b0
pop edx
push eax
push edx
call fcn.004499e0
lea eax, [0x577d00]
push eax
call fcn.00449a30
push edx
call fcn.004499b0
pop edx
push eax
push edx
call fcn.004499b0
pop edx
push eax
push 0x3e8
call fcn.00447220
lea eax, [0x577d88]
push eax
call fcn.00449a30
push 0x3e8
mov eax, dword [0x577d88]
push eax
mov eax, str.PROGRAMDATA
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
push edx
call fcn.004499b0
pop edx
push eax
push 0
mov eax, str.Select__FROM_Win32_ComputerSystemProduct_UUID
push eax
call fcn.004091c0
lea eax, [0x577d50]
push eax
call fcn.00449a30
mov edx, 0x4dd028
lea ecx, [0x577e10]
call fcn.0040f008
push edx
call fcn.004499b0
pop edx
push eax
push edx
call fcn.004499b0
pop edx
push eax
push edx
call fcn.004499b0
pop edx
push eax
push edx
call fcn.004499b0
pop edx
push eax
call fcn.004326dc
call fcn.0040f522
add dword [esp], edx
call fcn.0043d706
lea eax, [0x577cfc]
push eax
call fcn.00449a30
push edx
call fcn.004499b0
pop edx
push eax
push edx
call fcn.004499b0
pop edx
push eax
call fcn.0043d78f
lea eax, [0x577de8]
push eax
call fcn.00449a30
mov dword [0x577d34], 0xff
mov edx, 0x4dd028
lea ecx, [0x577de0]
call fcn.0040f008
push edx
call fcn.004499b0
pop edx
push eax
mov edx, dword [0x577e04]
push edx
call fcn.004499b0
pop edx
push eax
push edx
call fcn.004499e0
mov edx, str.Sysnativecmd.exe
push edx
call fcn.004499e0
call fcn.0040f522
add dword [esp], edx
call fcn.0043d7f2
call fcn.0040f540
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x4015d8
jl 0x4015d4
cmp ebx, 0
ja 0x4015d8
xor eax, eax
jmp 0x4015dd
mov eax, 1
or eax, eax
je 0x40160e
mov edx, dword [0x577e04]
push edx
call fcn.004499b0
pop edx
push eax
push edx
call fcn.004499e0
mov edx, str.Sysnative
push edx
call fcn.004499e0
lea eax, [0x577e04]
push eax
call fcn.00449a30
jmp 0x401639
mov edx, dword [0x577e04]
push edx
call fcn.004499b0
pop edx
push eax
push edx
call fcn.004499e0
mov edx, str.System32
push edx
call fcn.004499e0
lea eax, [0x577e04]
push eax
call fcn.00449a30
push 0x100
push 1
call fcn.0040ef37
push edx
call fcn.004499b0
pop edx
push eax
mov eax, 0x4dda24
push eax
mov eax, 0x4e5caa
push eax
mov eax, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_NTCurrentVersion
push eax
call fcn.0040a343
lea eax, [0x577d9c]
push eax
call fcn.00449a30
push edx
call fcn.004499b0
pop edx
push eax
push edx
call fcn.004499b0
pop edx
push eax
push edx
call fcn.004499b0
pop edx
push eax
push 4
push 0
push edx
call fcn.004499b0
pop edx
push eax
mov eax, 0x4dda24
push eax
mov eax, str.BuildLab
push eax
mov eax, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_NTCurrentVersion
push eax
call fcn.0040a343
call fcn.0040f522
add dword [esp], edx
call fcn.00447270
call fcn.0040f522
add dword [esp], edx
call fcn.004473c0
call fcn.0040f540
mov dword [0x577cf4], eax
mov ebx, dword [0x577cf4]
cmp ebx, 0x2580
jl 0x4016fb
mov edx, 0x4e66fa
lea ecx, [0x577e08]
call fcn.0040f008
jmp 0x401781
mov ebx, dword [0x577cf4]
cmp ebx, 0x23f0
jl 0x40171e
mov ebx, dword [0x577cf4]
cmp ebx, 0x2454
jge 0x40171e
mov eax, 1
jmp 0x401720
xor eax, eax
and eax, eax
je 0x401736
mov edx, 0x4ddbe0
lea ecx, [0x577e08]
call fcn.0040f008
jmp 0x401781
mov ebx, dword [0x577cf4]
cmp ebx, 0x1db0
jl 0x401759
mov ebx, dword [0x577cf4]
cmp ebx, 0x1e14
jge 0x401759
mov eax, 1
jmp 0x40175b
xor eax, eax
and eax, eax
je 0x401771
mov edx, 0x4ddba0
lea ecx, [0x577e08]
call fcn.0040f008
jmp 0x401781
mov edx, 0x4e66fa
lea ecx, [0x577e08]
call fcn.0040f008
push edx
call fcn.004499b0
pop edx
push eax
push edx
call fcn.004499b0
pop edx
push eax
push edx
call fcn.004499b0
pop edx
push eax
push edx
call fcn.004499b0
pop edx
push eax
push edx
call fcn.004499b0
pop edx
push eax
call fcn.004326dc
call fcn.0040f522
add dword [esp], edx
call fcn.0043d706
mov edx, str.MSActBackUp.ini
push edx
call fcn.004499e0
call fcn.0040f522
add dword [esp], edx
call fcn.0043362c
call fcn.0040f540
and eax, eax
je 0x401819
mov eax, str.Configurations
push eax
call fcn.0043366c
push edx
call fcn.004499b0
pop edx
push eax
push edx
call fcn.004499b0
pop edx
push eax
mov eax, 0x4dd028
push eax
mov eax, str.Lang
push eax
call fcn.00433760
lea eax, [0x577d68]
push eax
call fcn.00449a30
call fcn.00433856
push edx
call fcn.004499b0
pop edx
push eax
push edx
call fcn.004499b0
pop edx
push eax
push edx
call fcn.004499b0
pop edx
push eax
push edx
call fcn.004499b0
pop edx
push eax
push edx
call fcn.004499b0
pop edx
push eax
call fcn.004326dc
call fcn.0040f522
add dword [esp], edx
call fcn.0043d706
mov edx, 0x4de888
push edx
call fcn.004499e0
call fcn.0040f522
add dword [esp], edx
call fcn.0043d7f2
call fcn.0040f540
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x401884
jl 0x401880
cmp ebx, 0
ja 0x401884
xor eax, eax
jmp 0x401889
mov eax, 1
or eax, eax
je 0x40195f
push edx
call fcn.004499b0
pop edx
push eax
push edx
call fcn.004499b0
pop edx
push eax
push edx
call fcn.004499b0
pop edx
push eax
push edx
call fcn.004499b0
pop edx
push eax
push edx
call fcn.004499b0
pop edx
push eax
call fcn.004326dc
call fcn.0040f522
add dword [esp], edx
call fcn.0043d706
mov edx, 0x4de888
push edx
call fcn.004499e0
call fcn.00449aa0
push 0
call fcn.0040f522
add dword [esp + 4], edx
call fcn.0043e910
call fcn.0040f540
and eax, eax
je 0x40195f
push edx
call fcn.004499b0
pop edx
push eax
push edx
call fcn.004499b0
pop edx
push eax
push 0x18
push 0
call fcn.0043ea90
lea eax, [0x577d70]
push eax
call fcn.00449a30
push dword [0x577d70]
mov edx, 0x4dd028
pop ecx
call fcn.0040f550
jne 0x401955
mov edx, dword [0x577d70]
push edx
call fcn.004499b0
pop edx
push eax
push edx
call fcn.004499e0
lea eax, [0x577cfc]
push eax
call fcn.00449a30
push 0
call fcn.0043e540
push dword [0x577d68]
mov edx, 0x4de7a0
pop ecx
call fcn.0040f550
je 0x401984
mov edx, str.0419
lea ecx, [0x577d68]
call fcn.0040f008
jmp 0x4019cc
push dword [0x577d68]
mov edx, 0x4e0480
pop ecx
call fcn.0040f550
je 0x4019a9
mov edx, str.0409
lea ecx, [0x577d68]
call fcn.0040f008
jmp 0x4019cc
push dword [0x577d68]
mov edx, 0x4e0988
pop ecx
call fcn.0040f550
je 0x4019cc
mov edx, str.042A
lea ecx, [0x577d68]
call fcn.0040f008
push dword [0x577d68]
mov edx, 0x4dd028
pop ecx
call fcn.0040f550
je 0x401a27
push edx
call fcn.004499b0
pop edx
push eax
push edx
call fcn.004499b0
pop edx
push eax
push edx
call fcn.004499b0
pop edx
push eax
mov eax, 0x4dda24
push eax
mov eax, str.Default
push eax
mov eax, str.HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlNlsLanguage
push eax
call fcn.0040a343
call fcn.0040f522
add dword [esp], edx
call fcn.00447550
lea eax, [0x577d68]
push eax
call fcn.00449a30
push dword [0x577d68]
mov edx, str.0409
pop ecx
call fcn.0040f550
je 0x401a47
mov eax, 0x4e0480
push eax
call fcn.00407b22
jmp 0x401a92
push dword [0x577d68]
mov edx, str.0419
pop ecx
call fcn.0040f550
je 0x401a67
mov eax, 0x4de7a0
push eax
call fcn.00407b22
jmp 0x401a92
push dword [0x577d68]
mov edx, str.042A
pop ecx
call fcn.0040f550
je 0x401a87
mov eax, 0x4e0988
push eax
call fcn.00407b22
jmp 0x401a92
mov eax, 0x4e0480
push eax
call fcn.00407b22
push dword [0x577d1c]
call fcn.00402f55
push 0x11a
push 0x240
push 0xc8
push 0xc8
call fcn.00401f51
push dword [0x577d40]
push 0
push dword [0x577e00]
call fcn.004359f8
push dword [0x577d44]
push 1
push dword [0x577e00]
call fcn.004359f8
push dword [0x577d48]
push 2
push dword [0x577e00]
call fcn.004359f8
push 0
push dword [0x577d5c]
push 0xffffffff
push dword [0x577e20]
call fcn.004359ad
push 1
push dword [0x577d80]
push 0xffffffff
push dword [0x577e20]
call fcn.004359ad
call fcn.004048fe
call fcn.004328e2
mov ebx, eax
dec ebx
mov dword [0x577d2c], ebx
mov ebx, dword [0x577d2c]
and ebx, ebx
jl 0x401cc3
push edx
call fcn.004499b0
pop edx
push eax
push edx
call fcn.004499b0
pop edx
push eax
push edx
call fcn.004499b0
pop edx
push eax
push edx
call fcn.004499b0
pop edx
push eax
push 0
call fcn.004328f6
call fcn.0040f522
add dword [esp], edx
call fcn.00447550
lea eax, [0x577dc4]
push eax
call fcn.00449a30
push dword [0x577dc4]
mov edx, str._RUN
pop ecx
call fcn.0040f550
je 0x401c92
push edx
call fcn.004499b0
pop edx
push eax
mov edx, dword [0x577cfc]
push edx
call fcn.004499b0
pop edx
push eax
push edx
call fcn.004499e0
mov edx, str.tmp.dat
push edx
call fcn.004499e0
call fcn.00449aa0
push 0
call fcn.0040f522
add dword [esp + 4], edx
call fcn.0043e910
call fcn.0040f540
and eax, eax
je 0x401c54
push edx
call fcn.004499b0
pop edx
push eax
push edx
call fcn.004499b0
pop edx
push eax
push 0
call fcn.0043eb70
lea eax, [0x577dc4]
push eax
call fcn.00449a30
push 0
call fcn.0043e540
push dword [0x577dc4]
mov edx, 0x4dd028
pop ecx
call fcn.0040f550
jne 0x401c54
push 0
push 1
push dword [0x577e00]
call fcn.00435a0e
push dword [0x577dc4]
call fcn.004068ad
push edx
call fcn.004499b0
pop edx
push eax
push 2
mov edx, dword [0x577cfc]
push edx
call fcn.004499b0
pop edx
push eax
push edx
call fcn.004499e0
mov edx, str.tmp.dat
push edx
call fcn.004499e0
call fcn.0040f522
add dword [esp], edx
call fcn.0043d949
call fcn.0040f540
push 0
push dword [0x577d00]
mov eax, str._delete__TN_MSBackup__F
push eax
mov eax, str.schtasks.exe
push eax
call fcn.00402643
push 0
push 0
push dword [0x577e00]
call fcn.00435a0e
push 0
call fcn.0043d491
and eax, eax
je 0x401ce1
push dword [0x577d28]
push 1
call fcn.0043d583
call fcn.00402f83
call fcn.0043bff7
mov dword [0x577db4], eax
cmp dword [0x577db4], 0
je 0x401ec0
push dword [0x577db4]
mov ebx, 0x332c
cmp ebx, dword [esp]
jne 0x401e1c
call fcn.0043fb08
push eax
mov ebx, dword [0x577e20]
cmp ebx, dword [esp]
jne 0x401e19
call fcn.0043fb17
mov ebx, eax
cmp ebx, 1
jne 0x401e19
mov dword [0x577d54], 0
jmp 0x401d42
push dword [0x577e20]
call fcn.00435a4a
mov ebx, eax
dec ebx
cmp ebx, dword [0x577d54]
jl 0x401e19
push dword [0x577d54]
push dword [0x577e20]
call fcn.00435a77
mov ebx, eax
and ebx, 1
and ebx, ebx
je 0x401e0d
push dword [0x577d54]
push dword [0x577e20]
call fcn.00435a77
mov ebx, eax
and ebx, 2
and ebx, ebx
je 0x401d98
xor eax, eax
jmp 0x401d9d
mov eax, 1
and eax, eax
je 0x401e0d
push edx
call fcn.004499b0
pop edx
push eax
push edx
call fcn.004499b0
pop edx
push eax
push 5
push edx
call fcn.004499b0
pop edx
push eax
push edx
call fcn.004499b0
pop edx
push eax
push 1
push dword [0x577d54]
push dword [0x577e20]
call fcn.00435aa8
call fcn.0040f522
add dword [esp], edx
call fcn.004475c0
lea eax, [0x577d74]
push eax
call fcn.00449a30
push dword [0x577dc8]
call fcn.0043bfff
push eax
push 0
call fcn.0043d595
jmp 0x401e19
inc dword [0x577d54]
jno 0x401d42
pop eax
jmp 0x401e8a
mov ebx, 0x332d
cmp ebx, dword [esp]
jne 0x401e8a
call fcn.0043fb26
push eax
mov ebx, 1
cmp ebx, dword [esp]
jne 0x401e89
push dword [0x577d74]
mov edx, 0x4dd028
pop ecx
call fcn.0040f550
jne 0x401e89
push 1
push dword [0x577d08]
call fcn.00435af4
push 1
push dword [0x577e20]
call fcn.00435af4
push dword [0x577d74]
call fcn.00402d81
call fcn.00402f83
mov edx, 0x4dd028
lea ecx, [0x577d74]
call fcn.0040f008
pop eax
pop eax
call fcn.0043fb35
push eax
mov ebx, dword [0x577dc8]
cmp ebx, dword [esp]
jne 0x401ea9
push dword [0x577db4]
call fcn.0040659c
jmp 0x401ebd
mov dword [0x577db4], 0
push 5
call fcn.0043bc73
pop eax
jmp 0x401eca
push 5
call fcn.0043bc73
mov ebx, dword [0x577db4]
cmp ebx, 0x333c
jne 0x401ce6
push 0
call 0x401efb
call fcn.00449960
push dword [0x577ce4]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess
call fcn.004331e9
call fcn.00433f48
call fcn.00434a00
call fcn.004358ad
call sub.ole32.dll_OleUninitialize
call fcn.0043bf69
call fcn.0043d60f
call fcn.0043d985
call fcn.0043e620
call fcn.0043f9c4
call fcn.00440600
call fcn.0044242d
call fcn.00443d14
call fcn.00446f50
call fcn.00448f0b
call fcn.00448f71
call fcn.00448870
ret