Function at 0x14003c359
Capabilities:
Get graphical window text
Parse pe header

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbp
push r15
xor rax, rax
push rax
push rax
push rax
push rax
sub rsp, 0x28
call fcn.1400efdb0
push 0
push 0x10ca0001
movabs rax, 0x1401db0cc
push rax
push qword [rsp + 0x90]
push qword [rsp + 0x90]
push qword [rsp + 0x90]
push qword [rsp + 0x90]
push 0x5c
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.140055550
add rsp, 0x40
sub rsp, 8
push 0
movabs rax, str.Office_Installer
push rax
push socket
push 0x6e
push reloc.WS2_32.dll_recv
push socket
push MsiGetPropertyW
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14005e1a5
add rsp, 0x40
push 3
pop rcx
call fcn.1400eea0c
mov rax, rax
push rax
push MsiGetPropertyW
pop rcx
pop rdx
call fcn.1400b76b0
sub rsp, 8
push 0
push qword [0x14088c9e0]
push reloc.WS2_32.dll_select
push 0x3c
push reloc.OLEAUT32.dll_SafeArrayGetElemsize
push MsiGetPropertyW
pop rcx
sub rsp, 0x20
call fcn.1400b64b4
add rsp, 0x20
mov r15, rax
add r15, 0x14
mov rax, r15
push rax
push MsiGetPropertyW
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14005e1a5
add rsp, 0x40
sub rsp, 8
push 0
push qword [0x14088c928]
push 0x1e
push 0x1f4
push recv
push 0xf2
push MsiGetPropertyW
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14005e1a5
add rsp, 0x40
push 4
pop rcx
call fcn.1400eea0c
mov rax, rax
push rax
push MsiGetPropertyW
pop rcx
pop rdx
call fcn.1400b76b0
sub rsp, 8
push 3
push 0x258
push 0x2e
push 0xf2
push 0x5d
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400b5e5c
add rsp, 0x30
push 1
push 0x5d
pop rcx
pop rdx
call fcn.1400b4d98
push reloc.WS2_32.dll_ioctlsocket
push 0
push qword [0x14088c928]
push 0x23
push 0xe1
push 0x3c
push reloc.WS2_32.dll_ioctlsocket
push 0x26
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14002dcda
add rsp, 0x40
push 5
push 0
push qword [0x14088c890]
push 0x23
push 0xe1
push 0x64
push reloc.WS2_32.dll_ioctlsocket
push 0x27
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14002dcda
add rsp, 0x40
push reloc.WS2_32.dll_inet_addr
push 0
push qword [0x14088c938]
push 0x23
push 0xe1
push 0x8c
push reloc.WS2_32.dll_ioctlsocket
push reloc.WS2_32.dll_gethostname
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14002dcda
add rsp, 0x40
push 7
push 0
push qword [0x14088c860]
push 0x23
push 0xe1
push 0xb4
push reloc.WS2_32.dll_ioctlsocket
push 0x28
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14002dcda
add rsp, 0x40
push 8
push 0
push qword [0x14088c758]
push 0x23
push 0xe1
push 0x186
push reloc.WS2_32.dll_ioctlsocket
push IsNetDrive
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14002dcda
add rsp, 0x40
push SafeArrayGetLBound
push 0
push qword [0x14088c998]
push 0x23
push 0xe1
push 0x1ae
push reloc.WS2_32.dll_ioctlsocket
push IsNetDrive
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14002dcda
add rsp, 0x40
push 6
push 0
push qword [0x14088c6e8]
push 0x23
push 0xe1
push 0x1d6
push reloc.WS2_32.dll_ioctlsocket
push reloc.msi.dll_MsiGetActiveDatabase
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14002dcda
add rsp, 0x40
push recvfrom
push 0
push qword [0x14088c710]
push 0x23
push 0xe1
push 0x1fe
push reloc.WS2_32.dll_ioctlsocket
push 0x2e
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14002dcda
add rsp, 0x40
push 0
push 0x1f4
push 0x266
push 0x3c
push 0xf2
push reloc.OLEAUT32.dll_SafeArrayGetLBound
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14006519d
add rsp, 0x30
push reloc.WS2_32.dll_select
pop rcx
call fcn.1400e6020
mov rax, rax
push rax
push 0x23
push 0x23
push 0
push 0
push 0x5a
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400b6f5c
add rsp, 0x30
push rcx
sub rsp, 0x28
call fcn.1400efa80
add rsp, 0x28
pop rcx
push rax
push 0
push rcx
sub rsp, 0x28
call fcn.1400efa80
add rsp, 0x28
pop rcx
push rax
movabs rcx, 0x1401dc16c
sub rsp, 0x28
call fcn.1400efad0
add rsp, 0x28
mov rcx, qword [0x14088c898]
sub rsp, 0x28
call fcn.1400efad0
add rsp, 0x28
movabs rcx, str.__build
sub rsp, 0x28
call fcn.1400efad0
add rsp, 0x28
mov rcx, qword [0x14088c8b0]
sub rsp, 0x28
call fcn.1400efad0
add rsp, 0x28
call fcn.1400efce0
push reloc.WS2_32.dll_select
push 0x1d6
push 6
push gethostbyaddr
push 0x5b
push rax
call fcn.1400efcb0
mov rdx, rax
pop rax
add qword [rsp + 0x28], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14005e1a5
add rsp, 0x38
pop rcx
push rax
sub rsp, 0x28
call fcn.14006af80
add rsp, 0x28
pop rax
push 3
pop rcx
call fcn.1400eea0c
mov rax, rax
push rax
push 0x5b
pop rcx
pop rdx
call fcn.1400b76b0
push 0
movabs rax, 0x1401db0cc
push rax
movabs rax, 0x1401de64e
push rax
push 0x23
push 0x82
push 0x28
push 0
push gethostbyaddr
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400308a4
add rsp, 0x40
push 0
movabs rax, 0x1401db0cc
push rax
movabs rax, 0x1401e57c2
push rax
push 0x23
push 0x82
push 0x28
push 0x8c
push reloc.WS2_32.dll_gethostbyaddr
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400308a4
add rsp, 0x40
push 0
movabs rax, 0x1401db0cc
push rax
push qword [0x14088c878]
push 0x23
push 0x82
push 0x1ae
push 0x1c7
push gethostbyaddr
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400308a4
add rsp, 0x40
push 0x800
push 0x145
push 0x258
push 0x5a
push 0
push 0x5e
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.140063d32
add rsp, 0x30
call fcn.1400b7680
push 1
push reloc.OLEAUT32.dll_SafeArrayGetLBound
pop rcx
pop rdx
call fcn.1400b4d98
push 0
push 0x1f4
push 0x28e
push 0x3c
push 0xf2
push socket
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14006519d
add rsp, 0x30
push 0
push 0x23
push 0xe6
push 0
push 0
push reloc.msi.dll_MsiGetPropertyW
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14006a7e0
add rsp, 0x30
push 1
pop rcx
call fcn.1400eea0c
mov rax, rax
push rax
push reloc.msi.dll_MsiGetPropertyW
pop rcx
pop rdx
call fcn.1400b76b0
push 0x1e
pop rcx
call fcn.1400d2cf0
mov rax, rax
push rax
push 0
push 0x153
sub rsp, 8
push reloc.msi.dll_MsiGetPropertyW
pop rcx
sub rsp, 0x20
call fcn.1400b6570
add rsp, 0x28
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
pop r9
call sub.USER32.dll_SendMessageW
mov rcx, qword [0x14088d050]
call fcn.1400e72f8
mov rcx, qword [0x14088d050]
call fcn.1400e730c
or rax, rax
je 0x14003ca50
mov rbp, qword [0x14088d058]
push qword [rbp + 0x10]
push 0xffffffffffffffff
push reloc.msi.dll_MsiGetPropertyW
pop rcx
pop rdx
pop r8
call fcn.1400b6838
jmp 0x14003ca20
push 1
push reloc.msi.dll_MsiGetPropertyW
pop rcx
pop rdx
call fcn.1400b68d4
push 0
push 0x23
push 0x5a
push 0
push 0xf0
push 0x4c
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14006a7e0
add rsp, 0x30
push 1
pop rcx
call fcn.1400eea0c
mov rax, rax
push rax
push 0x4c
pop rcx
pop rdx
call fcn.1400b76b0
push 0x1e
pop rcx
call fcn.1400d2cf0
mov rax, rax
push rax
push 0
push 0x153
sub rsp, 8
push 0x4c
pop rcx
sub rsp, 0x20
call fcn.1400b6570
add rsp, 0x28
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
pop r9
call sub.USER32.dll_SendMessageW
movabs rax, 0x1401ed15e
push rax
push 0xffffffffffffffff
push 0x4c
pop rcx
pop rdx
pop r8
call fcn.1400b6838
movabs rax, 0x1401e9606
push rax
push 0xffffffffffffffff
push 0x4c
pop rcx
pop rdx
pop r8
call fcn.1400b6838
push 1
push 0x4c
pop rcx
pop rdx
call fcn.1400b68d4
mov qword [rsp + 0x68], MsiGetActiveDatabase
mov qword [rsp + 0x28], SafeArrayPutElement
push 1
movabs rax, 0x1401db0cc
push rax
movabs rax, str.Word
push rax
push 0x64
push 0x76
push qword [rsp + 0x90]
push 0
push 0x64
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14003fa18
add rsp, 0x40
mov r15, qword [rsp + 0x68]
add r15, qword [rsp + 0x28]
mov qword [rsp + 0x68], r15
push 1
movabs rax, 0x1401db0cc
push rax
movabs rax, str.Excel
push rax
push 0x64
push 0x77
push qword [rsp + 0x90]
push 0
push 0x65
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14003fa18
add rsp, 0x40
mov r15, qword [rsp + 0x68]
add r15, qword [rsp + 0x28]
mov qword [rsp + 0x68], r15
push 1
movabs rax, 0x1401db0cc
push rax
movabs rax, str.Access
push rax
push 0x64
push 0x78
push qword [rsp + 0x90]
push 0
push 0x66
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14003fa18
add rsp, 0x40
mov r15, qword [rsp + 0x68]
add r15, qword [rsp + 0x28]
mov qword [rsp + 0x68], r15
push 1
movabs rax, 0x1401db0cc
push rax
movabs rax, str.Publisher
push rax
push 0x64
push 0x79
push qword [rsp + 0x90]
push 0
push 0x67
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14003fa18
add rsp, 0x40
mov r15, qword [rsp + 0x68]
add r15, qword [rsp + 0x28]
mov qword [rsp + 0x68], r15
push 1
movabs rax, 0x1401db0cc
push rax
movabs rax, str.Teams
push rax
push 0x78
push 0x7a
push qword [rsp + 0x90]
push 0
push 0x68
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14003fa18
add rsp, 0x40
mov r15, qword [rsp + 0x68]
add r15, qword [rsp + 0x28]
mov qword [rsp + 0x68], r15
push 1
movabs rax, 0x1401db0cc
push rax
movabs rax, str.OneDrive_for_business
push rax
push 0x9a
push 0x7b
push qword [rsp + 0x90]
push 0
push 0x69
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14003fa18
add rsp, 0x40
mov r15, qword [rsp + 0x68]
add r15, qword [rsp + 0x28]
mov qword [rsp + 0x68], r15
push 1
movabs rax, 0x1401db0cc
push rax
movabs rax, str.Skype_for_business
push rax
push 0x98
push 0x7c
push qword [rsp + 0x90]
push 0
push 0x6a
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14003fa18
add rsp, 0x40
mov r15, qword [rsp + 0x68]
add r15, qword [rsp + 0x28]
mov qword [rsp + 0x68], r15
push 1
movabs rax, 0x1401db0cc
push rax
movabs rax, str.OneNote
push rax
push 0x64
push 0x7d
push qword [rsp + 0x90]
push 0
push 0x6b
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14003fa18
add rsp, 0x40
mov r15, qword [rsp + 0x68]
add r15, qword [rsp + 0x28]
mov qword [rsp + 0x68], r15
push 1
movabs rax, 0x1401db0cc
push rax
movabs rax, str.Outlook
push rax
push 0x64
push 0x7e
push qword [rsp + 0x90]
push 0
push 0x6c
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14003fa18
add rsp, 0x40
mov r15, qword [rsp + 0x68]
add r15, qword [rsp + 0x28]
mov qword [rsp + 0x68], r15
push 1
movabs rax, 0x1401db0cc
push rax
movabs rax, str.PowerPoint
push rax
push 0x64
push 0x7f
push qword [rsp + 0x90]
push 0
push 0x6d
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14003fa18
add rsp, 0x40
mov r15, qword [rsp + 0x68]
add r15, qword [rsp + 0x28]
mov qword [rsp + 0x68], r15
push 1
movabs rax, 0x1401db0cc
push rax
movabs rax, str.OneDrive
push rax
push 0x64
push pe_nt_image_headers64
push qword [rsp + 0x90]
push 0
push 0x6e
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14003fa18
add rsp, 0x40
mov r15, qword [rsp + 0x68]
add r15, qword [rsp + 0x28]
mov qword [rsp + 0x68], r15
push 1
movabs rax, 0x1401db0cc
push rax
movabs rax, str.Project
push rax
push 0x56
push 0x81
push qword [rsp + 0x90]
push 0
push WSAStartup
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14003fa18
add rsp, 0x40
mov r15, qword [rsp + 0x68]
add r15, qword [rsp + 0x28]
mov qword [rsp + 0x68], r15
push 1
movabs rax, 0x1401db0cc
push rax
movabs rax, str.ProjectPro
push rax
push 0x56
push 0x82
push qword [rsp + 0x90]
push 0
push WSACleanup
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14003fa18
add rsp, 0x40
mov r15, qword [rsp + 0x68]
add r15, qword [rsp + 0x28]
mov qword [rsp + 0x68], r15
push 1
movabs rax, 0x1401db0cc
push rax
movabs rax, str.ProjectMondo
push rax
push 0x64
push 0x83
push qword [rsp + 0x90]
push 0
push WSACleanup
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14003fa18
add rsp, 0x40
mov r15, qword [rsp + 0x68]
add r15, qword [rsp + 0x28]
mov qword [rsp + 0x68], r15
push 1
movabs rax, 0x1401db0cc
push rax
movabs rax, str.Visio
push rax
push 0x58
push 0x84
push qword [rsp + 0x90]
push 0
push WSACleanup
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14003fa18
add rsp, 0x40
mov r15, qword [rsp + 0x68]
add r15, qword [rsp + 0x28]
mov qword [rsp + 0x68], r15
push 1
movabs rax, 0x1401db0cc
push rax
movabs rax, str.VisioPro
push rax
push 0x58
push 0x85
push qword [rsp + 0x90]
push 0
push reloc.WS2_32.dll_WSAStartup
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14003fa18
add rsp, 0x40
mov r15, qword [rsp + 0x68]
add r15, qword [rsp + 0x28]
mov qword [rsp + 0x68], r15
push 1
movabs rax, 0x1401db0cc
push rax
movabs rax, str.VisioMondo
push rax
push 0x58
push 0x86
push qword [rsp + 0x90]
push 0
push reloc.WS2_32.dll_WSACleanup
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14003fa18
add rsp, 0x40
mov r15, qword [rsp + 0x68]
add r15, qword [rsp + 0x28]
mov qword [rsp + 0x68], r15
push 1
movabs rax, 0x1401db0cc
push rax
push qword [0x14088c960]
push 0xa4
push 0x87
push qword [rsp + 0x90]
push 0
push 0x75
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14003fa18
add rsp, 0x40
mov r15, qword [rsp + 0x68]
add r15, qword [rsp + 0x28]
mov qword [rsp + 0x68], r15
sub rsp, 8
push 1
movabs rax, 0x1401db0cc
push rax
push SafeArrayPutElement
push 0x14a
push 0x181
push 0
push 0x61
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14005e1a5
add rsp, 0x40
push 0
push 0x23
push 0x14a
push 0x19a
push 0
push 0x47
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14006a7e0
add rsp, 0x30
push 1
pop rcx
call fcn.1400eea0c
mov rax, rax
push rax
push 0x47
pop rcx
pop rdx
call fcn.1400b76b0
push reloc.OLEAUT32.dll_SafeArrayPutElement
pop rcx
call fcn.1400d2cf0
mov rax, rax
push rax
push 0
push 0x153
sub rsp, 8
push 0x47
pop rcx
sub rsp, 0x20
call fcn.1400b6570
add rsp, 0x28
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
pop r9
call sub.USER32.dll_SendMessageW
push 0
movabs rax, 0x1401db0cc
push rax
push qword [0x14088c7e0]
push 0x23
push 0x82
push 0x19a
push 0x154
push reloc.WS2_32.dll_gethostbyname
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400308a4
add rsp, 0x40
push 0x47
pop rcx
call fcn.14003fc56
push 0
push 0x47
pop rcx
pop rdx
call fcn.1400b68d4
push 1
push 0x64
movabs rax, str.Langs
push rax
push 0x145
push 0x64
push 0
push 0x1f4
push 0x60
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14005dab8
add rsp, 0x40
mov qword [rsp + 0x30], 0
jmp 0x14003d2eb
push qword [0x14088d000]
pop rcx
call fcn.1400da530
cmp rax, qword [rsp + 0x30]
jl 0x14003d342
mov rdx, qword [0x14088d008]
imul rdx, qword [rsp + 0x30]
mov rbp, rdx
push rbp
mov rax, 1
pop rbp
add rbp, rax
shl rbp, 3
add rbp, qword [0x14088d000]
push qword [rbp]
push 0xffffffffffffffff
push 0x60
pop rcx
pop rdx
pop r8
call fcn.1400b6838
inc qword [rsp + 0x30]
jno 0x14003d2eb
sub rsp, 8
push 0
movabs rax, 0x1401db0cc
push rax
push 0x140
push 0xfa
push reloc.msi.dll_MsiGetActiveDatabase
push 0xf0
push 0x48
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14005e1a5
add rsp, 0x40
mov r15, qword [0x14088c6c8]
and r15, r15
jle 0x14003d3a8
push 0x292521
push 2
push 0x5e
pop rcx
pop rdx
pop r8
call fcn.14006a3c3
jmp 0x14003d3c1
push qword [0x14088c818]
push 2
push 0x5e
pop rcx
pop rdx
pop r8
call fcn.14006a3c3
call fcn.1400b7680
push 1
push socket
pop rcx
pop rdx
call fcn.1400b4d98
push 0
push 0x1f4
push 0x28e
push 0x3c
push 0xf2
push reloc.WS2_32.dll_socket
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14006519d
add rsp, 0x30
push 0
movabs rax, 0x1401db0cc
push rax
push qword [0x14088c708]
push 0x23
push 0x104
push 0
push 0
push 0x3a
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400308a4
add rsp, 0x40
push 0
movabs rax, 0x1401db0cc
push rax
push qword [0x14088c730]
push 0x23
push 0x82
push 0
push 0x10e
push 0x3b
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400308a4
add rsp, 0x40
push 0
push 0x23
push 0x14a
push 0x50
push 0
push 0x4b
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14006a7e0
add rsp, 0x30
push 1
pop rcx
call fcn.1400eea0c
mov rax, rax
push rax
push 0x4b
pop rcx
pop rdx
call fcn.1400b76b0
push reloc.OLEAUT32.dll_SafeArrayPutElement
pop rcx
call fcn.1400d2cf0
mov rax, rax
push rax
push 0
push 0x153
sub rsp, 8
push 0x4b
pop rcx
sub rsp, 0x20
call fcn.1400b6570
add rsp, 0x28
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
pop r9
call sub.USER32.dll_SendMessageW
push 0x4b
pop rcx
call fcn.14003fc56
push qword [0x14088c6a0]
push 0xffffffffffffffff
push 0x4b
pop rcx
pop rdx
pop r8
call fcn.1400b6838
push 0
push 0x4b
pop rcx
pop rdx
call fcn.1400b68d4
sub rsp, 8
push 1
movabs rax, 0x1401db0cc
push rax
push SafeArrayPutElement
push 0x14a
push gethostname
push 0
push 0x63
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14005e1a5
add rsp, 0x40
sub rsp, 8
push 0
movabs rax, 0x1401db0cc
push rax
push 0xb4
push 0x1f4
push __WSAFDIsSet
push 0
push 0x49
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14005e1a5
add rsp, 0x40
call fcn.1400b7680
push 1
push reloc.WS2_32.dll_socket
pop rcx
pop rdx
call fcn.1400b4d98
push 0
push 0x1f4
push 0x28e
push 0x3c
push 0xf2
push SafeArrayPutElement
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14006519d
add rsp, 0x30
push 0x40000001
push 0x258
movabs rax, str.Office_C2R_Product:
push rax
push 0xf0
push 0x258
push 0
push 0
push reloc.SHELL32.dll_IsNetDrive
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14005dab8
add rsp, 0x40
sub rsp, 8
push 0
push 0
push 0xfe
push reloc.OLEAUT32.dll_SafeArrayPutElement
push 1
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.COMCTL32.dll_ImageList_Create
add rsp, 0x30
mov rax, rax
push rax
push 1
push 0x1003
sub rsp, 8
push reloc.SHELL32.dll_IsNetDrive
pop rcx
sub rsp, 0x20
call fcn.1400b6570
add rsp, 0x28
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
pop r9
call sub.USER32.dll_SendMessageW
push 1
pop rcx
call fcn.1400eea0c
mov rax, rax
push rax
push reloc.SHELL32.dll_IsNetDrive
pop rcx
pop rdx
call fcn.1400b76b0
push 0x800
push 0xf0
push 0x258
push 0
push 0
push 0x5f
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.140063d32
add rsp, 0x30
mov r15, qword [0x14088c6c8]
and r15, r15
jle 0x14003d72a
push 0x292521
push 2
push 0x5f
pop rcx
pop rdx
pop r8
call fcn.14006a3c3
jmp 0x14003d743
push qword [0x14088c818]
push 2
push 0x5f
pop rcx
pop rdx
pop r8
call fcn.14006a3c3
push 1
push 0x5f
pop rcx
pop rdx
call fcn.1400b4d98
push 0
movabs rax, 0x1401db0cc
push rax
push qword [0x14088c850]
push 0x23
push 0x82
push 0x104
push 0
push gethostname
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400308a4
add rsp, 0x40
push 0
movabs rax, 0x1401db0cc
push rax
push qword [0x14088c800]
push 0x23
push 0x82
push 0x104
push 0x8c
push gethostname
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400308a4
add rsp, 0x40
push 0
movabs rax, 0x1401db0cc
push rax
push qword [0x14088c748]
push 0x23
push 0xdc
push 0x104
push 0x17c
push gethostname
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400308a4
add rsp, 0x40
push 0
movabs rax, 0x1401db0cc
push rax
push qword [0x14088c9b8]
push 0x23
push 0xdc
push 0x131
push 0x17c
push gethostname
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400308a4
add rsp, 0x40
push 0
movabs rax, 0x1401db0cc
push rax
movabs rax, str.Word
push rax
push reloc.OLEAUT32.dll_SafeArrayPutElement
push 0x82
push 0x172
push 0
push 0x88
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400308a4
add rsp, 0x40
push 0
movabs rax, 0x1401db0cc
push rax
movabs rax, str.Excel
push rax
push reloc.OLEAUT32.dll_SafeArrayPutElement
push 0x82
push 0x190
push 0
push 0x89
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400308a4
add rsp, 0x40
push 0
movabs rax, 0x1401db0cc
push rax
movabs rax, str.Access
push rax
push reloc.OLEAUT32.dll_SafeArrayPutElement
push 0x82
push 0x1ae
push 0
push 0x8a
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400308a4
add rsp, 0x40
push 0
movabs rax, 0x1401db0cc
push rax
movabs rax, str.Outlook
push rax
push reloc.OLEAUT32.dll_SafeArrayPutElement
push 0x82
push 0x1cc
push 0
push 0x8b
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400308a4
add rsp, 0x40
push 0
movabs rax, 0x1401db0cc
push rax
movabs rax, str.OneNote
push rax
push reloc.OLEAUT32.dll_SafeArrayPutElement
push 0x82
push 0x172
push 0x8c
push 0x8c
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400308a4
add rsp, 0x40
push 0
movabs rax, 0x1401db0cc
push rax
movabs rax, str.PowerPoint
push rax
push reloc.OLEAUT32.dll_SafeArrayPutElement
push 0x82
push 0x190
push 0x8c
push 0x8d
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400308a4
add rsp, 0x40
push 0
movabs rax, 0x1401db0cc
push rax
movabs rax, str.Publisher
push rax
push reloc.OLEAUT32.dll_SafeArrayPutElement
push 0x82
push 0x1ae
push 0x8c
push 0x8e
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400308a4
add rsp, 0x40
push 0
movabs rax, 0x1401db0cc
push rax
movabs rax, str.Skype
push rax
push reloc.OLEAUT32.dll_SafeArrayPutElement
push 0x82
push 0x1cc
push 0x8c
push 0x8f
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400308a4
add rsp, 0x40
push 0
movabs rax, 0x1401db0cc
push rax
movabs rax, str.Project
push rax
push reloc.OLEAUT32.dll_SafeArrayPutElement
push 0x82
push 0x172
push 0x118
push 0x90
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400308a4
add rsp, 0x40
push 0
movabs rax, 0x1401db0cc
push rax
movabs rax, str.Visio
push rax
push reloc.OLEAUT32.dll_SafeArrayPutElement
push 0x82
push 0x190
push 0x118
push 0x91
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400308a4
add rsp, 0x40
call fcn.1400b7680
push 1
push SafeArrayPutElement
pop rcx
pop rdx
call fcn.1400b4d98
push 0
push 0x1f4
push 0x28e
push 0x3c
push 0xf2
push SafeArrayPutElement
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14006519d
add rsp, 0x30
call fcn.1400b7680
push 1
push SafeArrayPutElement
pop rcx
pop rdx
call fcn.1400b4d98
push 0
push 0x1f4
push 0x28e
push 0x3c
push 0xf2
push reloc.OLEAUT32.dll_SafeArrayPutElement
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14006519d
add rsp, 0x30
push 0
push 0x23
push 0x14a
push 0
push 0
push 0x1e
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14006a7e0
add rsp, 0x30
push 1
pop rcx
call fcn.1400eea0c
mov rax, rax
push rax
push 0x1e
pop rcx
pop rdx
call fcn.1400b76b0
push reloc.OLEAUT32.dll_SafeArrayPutElement
pop rcx
call fcn.1400d2cf0
mov rax, rax
push rax
push 0
push 0x153
sub rsp, 8
push 0x1e
pop rcx
sub rsp, 0x20
call fcn.1400b6570
add rsp, 0x28
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
pop r9
call sub.USER32.dll_SendMessageW
push 0x1e
pop rcx
call fcn.14003fc56
push 0
push 0x1e
pop rcx
pop rdx
call fcn.1400b68d4
push 0
push 0x23
push 0x5a
push 0
push 0x154
push 0x1f
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14006a7e0
add rsp, 0x30
push 1
pop rcx
call fcn.1400eea0c
mov rax, rax
push rax
push 0x1f
pop rcx
pop rdx
call fcn.1400b76b0
push reloc.OLEAUT32.dll_SafeArrayPutElement
pop rcx
call fcn.1400d2cf0
mov rax, rax
push rax
push 0
push 0x153
sub rsp, 8
push 0x1f
pop rcx
sub rsp, 0x20
call fcn.1400b6570
add rsp, 0x28
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
pop r9
call sub.USER32.dll_SendMessageW
movabs rax, 0x1401ed15e
push rax
push 0xffffffffffffffff
push 0x1f
pop rcx
pop rdx
pop r8
call fcn.1400b6838
movabs rax, 0x1401e9606
push rax
push 0xffffffffffffffff
push 0x1f
pop rcx
pop rdx
pop r8
call fcn.1400b6838
movabs rax, 0x1401ef58c
push rax
push 0xffffffffffffffff
push 0x1f
pop rcx
pop rdx
pop r8
call fcn.1400b6838
push 1
push 0x1f
pop rcx
pop rdx
call fcn.1400b68d4
push 1
push 0x64
movabs rax, str.Langs
push rax
push 0x145
push 0x64
push 0
push 0x1b8
push 0x20
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14005dab8
add rsp, 0x40
mov qword [rsp + 0x30], 0
jmp 0x14003dd99
push qword [0x14088d000]
pop rcx
call fcn.1400da530
cmp rax, qword [rsp + 0x30]
jl 0x14003ddf0
mov rdx, qword [0x14088d008]
imul rdx, qword [rsp + 0x30]
mov rbp, rdx
push rbp
mov rax, 1
pop rbp
add rbp, rax
shl rbp, 3
add rbp, qword [0x14088d000]
push qword [rbp]
push 0xffffffffffffffff
push 0x20
pop rcx
pop rdx
pop r8
call fcn.1400b6838
inc qword [rsp + 0x30]
jno 0x14003dd99
sub rsp, 8
push 1
movabs rax, 0x1401db0cc
push rax
push SafeArrayPutElement
push 0x14d
push gethostname
push 0
push 0x62
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14005e1a5
add rsp, 0x40
push 0
movabs rax, 0x1401db0cc
push rax
push qword [0x14088c758]
push 0x23
push 0x14d
push 0x50
push 0
push 0x22
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400308a4
add rsp, 0x40
push 0
movabs rax, 0x1401db0cc
push rax
push qword [0x14088c6b8]
push 0x23
push 0x5a
push 0x50
push 0x156
push 0x23
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400308a4
add rsp, 0x40
push 0
movabs rax, 0x1401db0cc
push rax
push qword [0x14088c8d0]
push 0x23
push 0x1b0
push __WSAFDIsSet
push 0
push 0x24
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400308a4
add rsp, 0x40
push 1
push 0x24
pop rcx
pop rdx
call fcn.14003a2f2
sub rsp, 8
push 1
movabs rax, 0x1401db0cc
push rax
push 0x1e
push 0x19a
push 0xd2
push 0
push IsNetDrive
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14005e1a5
add rsp, 0x40
sub rsp, 8
push 1
movabs rax, 0x1401db0cc
push rax
push 0x1e
push 0x1a4
push 0xe1
push 0
push IsNetDrive
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14005e1a5
add rsp, 0x40
sub rsp, 8
push 0
movabs rax, 0x1401db0cc
push rax
push 0x12c
push 0x1ae
push 0x10e
push 0
push 0x4a
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14005e1a5
add rsp, 0x40
call fcn.1400b7680
push 1
push reloc.OLEAUT32.dll_SafeArrayPutElement
pop rcx
pop rdx
call fcn.1400b4d98
push 0
push 0x1f4
push 0x28e
push 0x3c
push 0xf2
push 0x1a
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14006519d
add rsp, 0x30
push 0x4000000d
push 0x28a
movabs rax, str.Licenses
push rax
push 0x1a4
push 0x258
push 0
push 0
push 0x21
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14005dab8
add rsp, 0x40
push 0
pop rcx
call fcn.1400eea0c
mov rax, rax
push rax
push 0x21
pop rcx
pop rdx
call fcn.1400b76b0
push 0
push qword [0x14088c7f0]
push 0xffffffffffffffff
push 0x21
pop rcx
pop rdx
pop r8
pop r9
call fcn.1400b69a8
push 0
movabs rax, 0x1401db0cc
push rax
push qword [0x14088c800]
push 0x23
push 0x82
push 0x1ae
push 0
push MsiGetActiveDatabase
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400308a4
add rsp, 0x40
push 0
movabs rax, 0x1401db0cc
push rax
push qword [0x14088c990]
push 0x23
push 0x82
push 0x1ae
push 0x8c
push MsiGetActiveDatabase
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400308a4
add rsp, 0x40
push 0
movabs rax, 0x1401db0cc
push rax
push qword [0x14088c810]
push 0xaa
push MsiGetActiveDatabase
push 0x1b3
push 0x12c
push MsiGetActiveDatabase
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14003fa18
add rsp, 0x40
call fcn.1400b7680
push 1
push 0x1a
pop rcx
pop rdx
call fcn.1400b4d98
push 0
push 0x1f4
push 0x28e
push 0x3c
push 0xf2
push 0x1b
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14006519d
add rsp, 0x30
push 0
movabs rax, 0x1401db0cc
push rax
push qword [0x14088c980]
push 0x12c
push 0x53
push 0
push 0
push 0x4d
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14003fa18
add rsp, 0x40
push 0
movabs rax, 0x1401db0cc
push rax
push qword [0x14088c8a8]
push 0x12c
push 0x4f
push 0x23
push 0
push 0x4e
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14003fa18
add rsp, 0x40
push 0
movabs rax, 0x1401db0cc
push rax
push qword [0x14088c968]
push 0x15e
push 0x54
push reloc.msi.dll_MsiGetPropertyW
push 0
push 0x50
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14003fa18
add rsp, 0x40
push 0
movabs rax, 0x1401db0cc
push rax
push qword [0x14088c930]
push 0xfa
push 0x56
push 0x69
push 0
push 0x52
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14003fa18
add rsp, 0x40
push 0
movabs rax, 0x1401db0cc
push rax
push qword [0x14088c700]
push 0x15e
push 0x55
push 0x8c
push 0
push 0x51
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14003fa18
add rsp, 0x40
sub rsp, 8
push 0
movabs rax, 0x1401db0cc
push rax
push SafeArrayPutElement
push __WSAFDIsSet
push 0x69
push 0x12c
push 0x58
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14005eb47
add rsp, 0x40
sub rsp, 8
push 0
movabs rax, 0x1401db0cc
push rax
push SafeArrayPutElement
push gethostbyaddr
push 0x69
push 0x1cc
push 0x59
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14005eb47
add rsp, 0x40
sub rsp, 8
push 0
push qword [0x14088c740]
push SafeArrayPutElement
push 0x190
push 0xc8
push 0
push 0x57
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14005e1a5
add rsp, 0x40
push 1
push 0x57
pop rcx
pop rdx
call fcn.1400b4d98
push socket
pop rcx
call fcn.1400ee150
mov qword [rsp + 0x38], rax
push reloc.OLEAUT32.dll_SafeArrayPutElement
push 0xffffffffffffffff
movabs rax, str.127.0.0.1
push rax
push qword [rsp + 0x50]
pop rcx
pop rdx
pop r8
pop r9
call fcn.1400ee2f0
push qword [rsp + 0x38]
push 0
push 0x1501
sub rsp, 8
push 0x58
pop rcx
sub rsp, 0x20
call fcn.1400b6570
add rsp, 0x28
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
pop r9
call sub.USER32.dll_SendMessageW
push reloc.WS2_32.dll_ioctlsocket
pop rcx
call fcn.1400ee150
mov qword [rsp + 0x40], rax
push reloc.OLEAUT32.dll_SafeArrayPutElement
push 0xffffffffffffffff
movabs rax, str.2080
push rax
push qword [rsp + 0x58]
pop rcx
pop rdx
pop r8
pop r9
call fcn.1400ee2f0
push qword [rsp + 0x40]
push 0
push 0x1501
sub rsp, 8
push 0x59
pop rcx
sub rsp, 0x20
call fcn.1400b6570
add rsp, 0x28
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
pop r9
call sub.USER32.dll_SendMessageW
call fcn.1400b7680
push 1
push 0x1b
pop rcx
pop rdx
call fcn.1400b4d98
push 0
push 0x1f4
push 0x28e
push 0x3c
push 0xf2
push SafeArrayPutElement
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14006519d
add rsp, 0x30
push 0
movabs rax, 0x1401e675c
push rax
movabs rax, str.Go_msfree.su
push rax
push 0x23
push 0x82
push 0
push 0
push 0x3c
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400308a4
add rsp, 0x40
push 0
movabs rax, 0x1401db0cc
push rax
movabs rax, str.Donate
push rax
push 0x23
push 0x82
push 0
push 0x8c
push 0x3d
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400308a4
add rsp, 0x40
push recv
pop rcx
call fcn.1400e6020
mov rax, rax
push rax
push 0x1c2
push 0x1c2
push 0x28
push 0x50
push recvfrom
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400b6f5c
add rsp, 0x30
call fcn.1400b7680
push 1
push SafeArrayPutElement
pop rcx
pop rdx
call fcn.1400b4d98
xor rax, rax
add rsp, 0x48
pop r15
pop rbp
ret