Function at 0x14008cc00
Capabilities:
Create directory
Create process on windows
Delete registry value
Get hostname
Persist via app paths registry key
Self delete
Set registry value
Terminate process

Disassembly:
mov r11, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, reloc.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel
mov qword [r11 - 0x500], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x20], rsi
mov rax, qword [0x1401b5148]
xor rax, rsp
mov qword [rsp + CMFCRibbonInfo::XElementButtonLinkCtrl::~XElementButtonLinkCtrl], rax
movzx edi, r9b
mov r13, r8
mov r14, rdx
mov qword [rsp + 0xe8], rdx
mov qword [rsp + 0x70], rdx
mov qword [rsp + 0x38], r8
mov rsi, qword [rsp + 0x630]
mov qword [r11 - 0x588], rsi
mov qword [r11 - 0x510], rsi
mov r15, qword [rsp + 0x638]
mov qword [rsp + 0x78], r15
mov qword [r11 - 0x508], r15
xor r12d, r12d
mov dword [rsp + 0x60], r12d
mov dword [r11 - 0x548], r12d
test r8, r8
je 0x14008ccfc
lea rdx, [r8 + 0x220]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
nop
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, [0x1401312ec]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x14008cd16
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
mov rcx, rsi
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
xor eax, eax
jmp 0x14008d5e1
xor r15b, r15b
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.found
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x14008cd6d
movzx r15d, dil
jmp 0x140093ab1
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, [0x140141628]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x14008cdc5
movzx r15d, dil
xor r15b, 1
jmp 0x140093ab1
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.foundandpushed
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x14008cef0
test dil, dil
jne 0x14008ced2
lea rdx, [r13 + 0x230]
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, [0x1401312ec]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
je 0x14008ce9b
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
xor r9d, r9d
mov r8, rax
xor edx, edx
mov rcx, r14
call fcn.140059a70
mov rcx, r14
call fcn.14006fc70
mov rbx, rax
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
mov rcx, rsi
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
mov rcx, qword [rsp + 0x78]
jmp 0x14008d5d8
xor r8d, r8d
lea rdx, str.pressed
mov rcx, rsi
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
setns r15b
jmp 0x140093ab1
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.foundanddisabled
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x14008d01b
test dil, dil
jne 0x14008cffd
lea rdx, [r13 + 0x230]
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, [0x1401312ec]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
je 0x14008cfc6
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
xor r9d, r9d
mov r8, rax
xor edx, edx
mov rcx, r14
call fcn.140059a70
mov rcx, r14
call fcn.14006fc70
mov rbx, rax
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
mov rcx, rsi
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
mov rcx, qword [rsp + 0x78]
jmp 0x14008d5d8
xor r8d, r8d
lea rdx, str.visible_unavailable
mov rcx, rsi
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
setns r15b
jmp 0x140093ab1
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.checked
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
xor r8d, r8d
test ebx, ebx
jne 0x14008d084
lea rdx, [0x14013bc20]
mov rcx, rsi
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
setns r15b
jmp 0x140093ab1
lea rdx, str.checkdesc
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
lea rcx, [rsp + 0x30]
test eax, eax
js 0x14008d14f
xor r8d, r8d
lea rdx, [0x140147dac]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov ebx, eax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
sub eax, ebx
lea r8d, [rax - 1]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_12600]
nop
xor r8d, r8d
lea rdx, [0x14013ddb8]
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov r8d, eax
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CStringList::InsertBefore]
nop
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
xor r8d, r8d
mov rsi, qword [rsp + 0x78]
mov rcx, rsi
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
setns r15b
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x140093ab6
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.iswin10
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x14008d1a3
call fcn.1400e1780
movzx r15d, al
jmp 0x140093ab1
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.iswin64
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x14008d1fc
call fcn.1400e16c0
movzx r15d, al
jmp 0x140093ab1
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.iswin10or81
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x14008d273
call fcn.1400e1780
test al, al
jne 0x140093dee
call fcn.1400e1830
mov rdi, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x78]
test al, al
je 0x14008d522
jmp 0x140093dfb
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.iswin81
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x14008d2cc
call fcn.1400e1830
movzx r15d, al
jmp 0x140093ab1
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.isjavainstalledjavatesting
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x14008d34b
lea rdx, [0x1401312ec]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rsp + 0x48]
call fcn.1400de9b0
cmp eax, 1
sete r15b
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x140093ab1
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.readfnmsanddetectifneedsminorupdate
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x14008d3fd
lea rcx, [rsp + 0x40]
call fcn.1400d71a0
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.minor
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
test eax, eax
sete r15b
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x140093ab1
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.detectifgroupavailable
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x14008d456
call fcn.1400d6f30
movzx r15d, al
jmp 0x140093ab1
xor r8d, r8d
lea rdx, str.isprinterinstalled
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
xor r8d, r8d
lea rcx, [rsp + 0x30]
test eax, eax
js 0x14008d60e
lea rdx, [0x140147dac]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov ebx, eax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
sub eax, ebx
lea r8d, [rax - 1]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_12600]
nop
xor r8d, r8d
lea rdx, [0x14013ddb8]
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov r8d, eax
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CStringList::InsertBefore]
nop
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
xor edx, edx
mov rcx, rax
call fcn.1400e1a00
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov rdi, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x78]
lea rdx, [r13 + reloc.mfc140u.dll_CHandleMap::CHandleMap]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, [0x1401312ec]
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
je 0x14008d5a1
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
xor r9d, r9d
mov r8, rax
xor edx, edx
mov rcx, r14
call fcn.140059a70
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov rbx, qword [rsp + 0xe8]
mov rcx, rbx
call fcn.14006fc70
mov rbx, rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
mov rcx, rdi
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
mov rcx, rsi
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov rax, rbx
mov rcx, qword [rsp + 0x5d0]
xor rcx, rsp
call fcn.1400f76d0
lea r11, [rsp + reloc.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea rdx, str.isprinterdefault
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
xor r8d, r8d
lea rcx, [rsp + 0x30]
test eax, eax
js 0x14008d6e7
lea rdx, [0x140147dac]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov ebx, eax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
sub eax, ebx
lea r8d, [rax - 1]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_12600]
nop
xor r8d, r8d
lea rdx, [0x14013ddb8]
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov r8d, eax
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CStringList::InsertBefore]
nop
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rsp + 0x48]
call fcn.1400de160
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
xor r8d, r8d
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
sete r15b
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x140093ab1
lea rdx, str.makeprinterdefault
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
xor r8d, r8d
lea rcx, [rsp + 0x30]
test eax, eax
js 0x14008d798
lea rdx, [0x140147dac]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov ebx, eax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
sub eax, ebx
lea r8d, [rax - 1]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_12600]
nop
xor r8d, r8d
lea rdx, [0x14013ddb8]
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov r8d, eax
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CStringList::InsertBefore]
nop
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov dl, 1
mov rcx, rax
call fcn.1400e1a00
nop
jmp 0x14008d50a
lea rdx, str.isApplicationInstalled
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
xor r8d, r8d
lea rcx, [rsp + 0x30]
test eax, eax
js 0x14008d857
lea rdx, [0x140147dac]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov ebx, eax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
sub eax, ebx
lea r8d, [rax - 1]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_12600]
nop
xor r8d, r8d
lea rdx, [0x14013ddb8]
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov r8d, eax
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CStringList::InsertBefore]
nop
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rcx, rax
call fcn.1400e4ff0
cmp al, 1
sete r15b
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x140093ab1
lea rdx, [0x140147ee8]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
xor r8d, r8d
lea rcx, [rsp + 0x30]
test eax, eax
js 0x14008daa4
lea rdx, [0x140147dac]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov ebx, eax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
sub eax, ebx
lea r8d, [rax - 1]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_12600]
nop
xor r8d, r8d
lea rdx, [0x14013ddb8]
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov r8d, eax
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CStringList::InsertBefore]
nop
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, str.AnakageFilesVBScripts_
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rsp + 0x38]
call fcn.1400e7c60
mov r15, rax
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rsp + 0x60], 9
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
lea r8, [rsp + 0x50]
mov rdx, r14
lea rcx, [rsp + 0x88]
call fcn.14000ce20
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, [0x140147f18]
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0xa0]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rsp + 0x60], 0x21
lea rcx, [rsp + 0x88]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x88]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0xa0]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov rcx, r14
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r9, rax
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
lea r8, str.cmd.exe
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rsp + 0xa0]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rcx, [rsp + 0x88]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x50]
jmp 0x140093de8
lea rdx, str.createRestorePoint
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
xor r8d, r8d
lea rcx, [rsp + 0x30]
test eax, eax
js 0x14008dcf1
lea rdx, [0x140147dac]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov ebx, eax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
sub eax, ebx
lea r8d, [rax - 1]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_12600]
nop
xor r8d, r8d
lea rdx, [0x14013ddb8]
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov r8d, eax
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CStringList::InsertBefore]
nop
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, str.AnakageFilesVBScripts_
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rsp + 0x38]
call fcn.1400e7c60
mov r15, rax
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rsp + 0x60], 0x41
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
lea r8, [rsp + 0x50]
mov rdx, r14
lea rcx, [rsp + 0x88]
call fcn.14000ce20
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, [0x140147f18]
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0xa0]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rsp + 0x60], 0x101
lea rcx, [rsp + 0x88]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x88]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0xa0]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov rcx, r14
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r9, rax
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
lea r8, str.cmd.exe
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rsp + 0xa0]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov ecx, 0x2ee0
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rcx, [rsp + 0x88]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x50]
jmp 0x140093de8
lea rdx, str.IsRegistryKeyExists
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x14008deb2
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
xor r8d, r8d
lea rdx, [0x140147dac]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov ebx, eax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
sub eax, ebx
lea r8d, [rax - 1]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_12600]
nop
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
xor r8d, r8d
lea rdx, [0x14013ddb8]
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov r8d, eax
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CStringList::InsertBefore]
nop
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
xor r8d, r8d
lea rdx, [0x140147f70]
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov ebx, eax
mov r8d, eax
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CStringList::InsertBefore]
nop
mov rdx, rax
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x98]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
sub eax, ebx
lea r8d, [rax - 1]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_12600]
nop
mov rdx, rax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0xb8]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rbx, rax
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
nop
mov rdx, rbx
mov rcx, rax
call fcn.1400e54d0
movzx r15d, al
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x140093ab1
xor r8d, r8d
lea rdx, str.DeleteRegistryKey
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
xor r8d, r8d
lea rcx, [rsp + 0x30]
test eax, eax
js 0x14008df6e
lea rdx, [0x140147dac]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov ebx, eax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
sub eax, ebx
lea r8d, [rax - 1]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_12600]
nop
xor r8d, r8d
lea rdx, [0x14013ddb8]
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov r8d, eax
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CStringList::InsertBefore]
nop
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rcx, rax
call fcn.1400d61e0
nop
lea rcx, [rsp + 0x50]
jmp 0x140093de8
lea rdx, str.DeletecacheFiles
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x14008e118
lea rcx, [rsp + 0x88]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rsp + 0xd0]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea r8, [rsp + 0xd0]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x88]
call fcn.1400e0840
lea rdx, str.AppDataLocalMicrosoftWindowsINetCache
lea rcx, [rsp + 0xa0]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rdx, str.C:Users_
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rsp + 0x60], 0x201
lea rcx, [rsp + 0x88]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x88]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
lea r8, [rsp + 0xa0]
mov rdx, r14
lea rcx, [rsp + 0x90]
call fcn.14000ce20
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0xa0]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rsp + 0x90]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rcx, rax
call fcn.1400d5f80
nop
lea rcx, [rsp + 0x90]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0xd0]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x88]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov r14, qword [rsp + 0xe8]
jmp 0x14008d515
xor r8d, r8d
lea rdx, str.ipPing
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x14008e2f8
mov r15b, 1
lea rdx, str.10.5.140.198
lea rcx, [rsp + 0xd0]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rdx, str.10.5.140.199
lea rcx, [rsp + 0x90]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rdx, str.ping__n_2
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea r8, [rsp + 0xd0]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x38]
call fcn.14000ce20
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.1400e6110
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CPngImage::LoadFromBuffer]
xor r8d, r8d
lea rdx, str.could_not_find_host
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
jns 0x14008e201
xor r8d, r8d
lea rdx, str.general_failure
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
jns 0x14008e201
xor r8d, r8d
lea rdx, str.destination_host_unreachable
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x14008e2ca
lea rdx, str.ping__n_2
lea rcx, [rsp + 0xa0]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea r8, [rsp + 0x90]
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x70]
call fcn.14000ce20
mov rdx, rax
lea rcx, [rsp + 0x98]
call fcn.1400e6110
nop
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x98]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0xa0]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CPngImage::LoadFromBuffer]
xor r15b, r15b
xor r8d, r8d
lea rdx, str.could_not_find_host
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
jns 0x14008e2c7
xor r8d, r8d
lea rdx, str.general_failure
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
jns 0x14008e2c7
xor r8d, r8d
lea rdx, str.destination_host_unreachable
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x14008e2ca
xor r15b, r15b
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x90]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0xd0]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x140093ab1
xor r8d, r8d
lea rdx, str.createRestorePoint
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
xor r8d, r8d
lea rcx, [rsp + 0x30]
test eax, eax
js 0x14008e54d
lea rdx, [0x140147dac]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov ebx, eax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
sub eax, ebx
lea r8d, [rax - 1]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_12600]
nop
xor r8d, r8d
lea rdx, [0x14013ddb8]
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov r8d, eax
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CStringList::InsertBefore]
nop
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, str.AnakageFilesVBScripts_
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rsp + 0x38]
call fcn.1400e7c60
mov r15, rax
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rsp + 0x60], 0x2001
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
lea r8, [rsp + 0x50]
mov rdx, r14
lea rcx, [rsp + 0x88]
call fcn.14000ce20
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, [0x140147f18]
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0xa0]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rsp + 0x60], 0x8001
lea rcx, [rsp + 0x88]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x88]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0xa0]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov rcx, r14
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r9, rax
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
lea r8, str.cmd.exe
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rsp + 0xa0]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov ecx, 0x2ee0
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rcx, [rsp + 0x88]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x50]
jmp 0x140093de8
lea rdx, str.isFirefoxinstalled
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x14008e5d2
lea rdx, str.C:Program_FilesMozilla_Firefox_firefox.exe
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rcx, rax
call fcn.1400e5df0
test al, al
jne 0x14008e5bf
lea rdx, str.C:Program_Files__x86_Mozilla_Firefox_firefox.exe
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rcx, rax
call fcn.1400e5df0
test al, al
setne r15b
jmp 0x14008e5c2
mov r15b, 1
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x140093ab1
xor r8d, r8d
lea rdx, str.isGooglechromeinstalled
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x14008e65f
lea rdx, str.C:Program_Files__x86_GoogleChromeApplicationchrome.exe
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rcx, rax
call fcn.1400e5df0
test al, al
jne 0x14008e64c
lea rdx, str.C:Program_FilesGoogleChromeApplicationchrome.exe
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rcx, rax
call fcn.1400e5df0
test al, al
setne r15b
jmp 0x14008e64f
mov r15b, 1
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x140093ab1
xor r8d, r8d
lea rdx, str.isOfficeInstalled
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x14008e789
xor r15b, r15b
lea rdx, [r13 + 0x248]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
nop
lea rcx, [rsp + 0x88]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.skype
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rsp + 0x88]
test ebx, ebx
lea rdx, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionApp_PathsLync.EXEPath
je 0x14008e702
lea rdx, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionApp_PathsOUTLOOK.EXEPath
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
lea rdx, [rsp + 0x58]
mov rcx, rax
call fcn.1400e01e0
test eax, eax
jne 0x14008e75e
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CFileDialog::SetTemplate]
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::HitTest]
movzx r15d, r15b
mov r9d, 1
test al, al
cmove r15d, r9d
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x88]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x140093ab1
xor r8d, r8d
lea rdx, str.isMSIInstaller
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x14008e8b3
mov r15b, 1
lea rdx, [r13 + 0x248]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.skype
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rsp + 0x58]
test ebx, ebx
lea rdx, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionApp_PathsLync.EXEPath
je 0x14008e826
lea rdx, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionApp_PathsOUTLOOK.EXEPath
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.1400e01e0
test eax, eax
jne 0x14008e888
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CPngImage::LoadFromBuffer]
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CFileDialog::SetTemplate]
xor r8d, r8d
lea rdx, str.root
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x14008e88b
xor r15b, r15b
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x140093ab1
xor r8d, r8d
lea rdx, str.isWePresentInstalled
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
xor r8d, r8d
lea rcx, [rsp + 0x30]
test eax, eax
js 0x14008ea0e
lea rdx, [0x140147dac]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov ebx, eax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
sub eax, ebx
lea r8d, [rax - 1]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_12600]
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov edx, 0x29
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_COleControl::ReleaseCaches]
mov r8d, eax
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CStringList::InsertBefore]
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CFileDialog::SetTemplate]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
cmp eax, 1
jne 0x14008e99a
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator__]
cmp ax, 1
jne 0x14008e99a
mov ecx, 0x7530
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.C:Program_Files__x86_MirrorOpMirrorOp.exe
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rcx, rax
call fcn.1400e5df0
test al, al
jne 0x14008e9fa
lea r8, str.Program_Files
lea rdx, str.Program_Files__x86_
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCToolBar::RebuildAccelerationKeys]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rcx, rax
call fcn.1400e5df0
movzx r15d, al
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x140093ab1
lea rdx, str.isFileExists
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
xor r8d, r8d
lea rcx, [rsp + 0x30]
test eax, eax
js 0x14008eb0d
lea rdx, [0x140147dac]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov ebx, eax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
sub eax, ebx
lea r8d, [rax - 1]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_12600]
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov edx, 0x29
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_COleControl::ReleaseCaches]
mov r8d, eax
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CStringList::InsertBefore]
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x98]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rcx, rax
call fcn.1400e5df0
test al, al
jne 0x14008eb04
lea r8, str.Program_Files
lea rdx, str.Program_Files__x86_
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCToolBar::RebuildAccelerationKeys]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rcx, rax
call fcn.1400e5df0
movzx r15d, al
jmp 0x140093ab1
lea rdx, str.isDriveExists
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
xor r8d, r8d
lea rcx, [rsp + 0x30]
test eax, eax
js 0x14008ed0e
xor dil, dil
lea rdx, [0x140147dac]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov ebx, eax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
sub eax, ebx
lea r8d, [rax - 1]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_12600]
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov edx, 0x29
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_COleControl::ReleaseCaches]
mov r8d, eax
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CStringList::InsertBefore]
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rax, [rsp + 0x98]
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x98]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rbx, rax
lea rdx, str.drive_to_find_if_exist_or_not
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
mov r8d, 0xffffffff
mov rdx, rbx
mov rcx, rax
call fcn.1400ee8c0
lea rdx, str.wmic_logicaldisk_where_drivetype3_get_deviceid
lea rcx, [rsp + 0xb8]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1400e6110
nop
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0xa8]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rbx, rax
lea rdx, str.Number_of_logical_drives_in_machine
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
mov r8d, 0xffffffff
mov rdx, rbx
mov rcx, rax
call fcn.1400ee8c0
lea r8, [0x14013e050]
lea rdx, str.DeviceID
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCToolBar::RebuildAccelerationKeys]
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CFileDialog::SetTemplate]
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0xd8]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rbx, rax
lea rdx, str.drive_id_after_removing_deviceId_string
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
mov r8d, 0xffffffff
mov rdx, rbx
mov rcx, rax
call fcn.1400ee8c0
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
xor r8d, r8d
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
movzx r15d, dil
mov r9d, 1
test eax, eax
cmovns r15d, r9d
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x140093ab1
lea rdx, str.softwareinstall
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x14008efca
lea rcx, [rsp + 0x88]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
call sub.mfc140u.dll_AfxFieldText
mov rdx, qword [rax + 8]
add rdx, 0x190
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
nop
xor r8d, r8d
lea rdx, [0x14013e050]
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x14008ed9a
mov r8d, eax
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CStringList::InsertBefore]
nop
mov rdx, rax
lea rcx, [rsp + 0x88]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x14008edad
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x88]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
lea rdx, [r13 + 0x248]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CFileDialog::SetTemplate]
mov rcx, rax
lea rdx, str.showProgressDlg
call fcn.14000e250
movzx ebx, al
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test bl, bl
je 0x14008ee22
lea rax, [rsp + 0x38]
mov qword [rsp + 0x68], rax
lea rdx, str.showProgressDlg
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
mov rbx, rax
call sub.mfc140u.dll_AfxFieldText
nop
mov rdx, rbx
mov rcx, qword [rax + 8]
call fcn.140096b00
call fcn.1400ee850
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rsp + 0xa0]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rdx, str.iAssistStatus.ll
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rsp + 0x70]
call fcn.1400e70a0
nop
lea r8, [rsp + 0x48]
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.14000ce20
lea r9, [rsp + 0x50]
lea r8, [rsp + 0xa0]
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.1400edbc0
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CFileDialog::SetTemplate]
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CPngImage::LoadFromBuffer]
mov rcx, rax
lea rdx, str.success
call fcn.14000e250
test al, al
setne bl
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x98]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rcx, rax
call fcn.1400e5df0
test al, al
jne 0x14008ef47
cmp bl, 1
jne 0x14008ef80
xor r8d, r8d
lea rdx, str.Program_Files__x86_
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x14008ef2d
lea r8, str.Program_Files
lea rdx, str.Program_Files__x86_
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCToolBar::RebuildAccelerationKeys]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rcx, rax
call fcn.1400e5df0
jmp 0x14008ef4c
cmp bl, 1
jne 0x14008ef80
cmp al, 1
jne 0x14008ef80
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r8, rax
mov r9d, 1
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
movzx r15d, bl
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0xa0]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x88]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x140093ab1
xor r8d, r8d
lea rdx, str.addAutoConfigScriptAddress
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
xor r8d, r8d
lea rcx, [rsp + 0x30]
test eax, eax
js 0x14008f15a
lea rdx, [0x140147dac]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov ebx, eax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
sub eax, ebx
lea r8d, [rax - 1]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_12600]
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov edx, 0x29
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_COleControl::ReleaseCaches]
mov r8d, eax
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CStringList::InsertBefore]
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x88]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
nop
lea rcx, [rsp + 0x88]
call qword [sym.imp.mfc140u.dll_CFileDialog::SetTemplate]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14008f141
cmp qword [rsp + 0x58], 0
je 0x14008f141
lea rcx, [rsp + 0x88]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
lea rcx, [rsp + 0x88]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.AutoConfigURL
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x60], r12d
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.AutoDetect
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rsp + 0x88]
jmp 0x140093de8
lea rdx, str.isWiFiConnected
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x14008f1b5
lea rdx, str.netsh_wlan_show_interface_name_airtelhive_
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.1400e6110
xor r8d, r8d
lea rdx, str.State_:_connected
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
sete r15b
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x140093ab1
xor r8d, r8d
lea rdx, str.RegisterAppForStartup
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x14008f39d
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
xor r8d, r8d
lea rdx, [0x140147dac]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov ebx, eax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
sub eax, ebx
lea r8d, [rax - 1]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_12600]
nop
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
xor r8d, r8d
lea rdx, [0x14013ddb8]
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov r8d, eax
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CStringList::InsertBefore]
nop
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
xor r8d, r8d
lea rdx, [0x140147f70]
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov ebx, eax
mov r8d, eax
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CStringList::InsertBefore]
nop
mov rdx, rax
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x98]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
sub eax, ebx
lea r8d, [rax - 1]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_12600]
nop
mov rdx, rax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0xa0]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
nop
lea rcx, [rsp + 0xa0]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rbx, rax
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov rcx, rbx
call fcn.1400e2ea0
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0xa0]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x60]
jmp 0x140093de8
xor r8d, r8d
lea rdx, str.RestartUserMachine
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
xor r8d, r8d
lea rcx, [rsp + 0x30]
test eax, eax
js 0x14008f462
lea rdx, [0x140147dac]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov ebx, eax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
sub eax, ebx
lea r8d, [rax - 1]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_12600]
nop
xor r8d, r8d
lea rdx, [0x14013ddb8]
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov r8d, eax
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CStringList::InsertBefore]
nop
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoi]
mov ecx, eax
call fcn.1400ee600
mov ecx, 0x15f90
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
jmp 0x14008d50a
lea rdx, str.WriteDownloadURL
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
xor r8d, r8d
lea rcx, [rsp + 0x30]
test eax, eax
js 0x14008f63c
lea rdx, [0x140147dac]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov ebx, eax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
sub eax, ebx
lea r8d, [rax - 1]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_12600]
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov edx, 0x29
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_COleControl::ReleaseCaches]
mov r8d, eax
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CStringList::InsertBefore]
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CFileDialog::SetTemplate]
lea rdx, str.AnakageCoursesSoftwares
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rsp + 0x38]
call fcn.1400e91b0
nop
lea r8, [rsp + 0x48]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.14000ce20
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, str.AnakageCoursesSoftwares_softwareURL.ll
lea rcx, [rsp + 0xa0]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rsp + 0x70]
call fcn.1400e91b0
nop
lea r8, [rsp + 0xa0]
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.14000ce20
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0xa0]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rcx, rax
call fcn.1400d5f80
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, 1
jne 0x14008f623
lea rcx, [rsp + 0x90]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rcx, rax
lea rdx, [0x140139944]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
mov rbx, rax
test rax, rax
je 0x14008f623
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov rcx, rbx
call fcn.14003ce20
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
nop
lea rcx, [rsp + 0x90]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
jmp 0x140093de8
lea rdx, str.isExeAlreadyRunning
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
xor r8d, r8d
lea rcx, [rsp + 0x30]
test eax, eax
js 0x14008f70d
lea rdx, [0x140147dac]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov ebx, eax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
sub eax, ebx
lea r8d, [rax - 1]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_12600]
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov edx, 0x29
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_COleControl::ReleaseCaches]
mov r8d, eax
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CStringList::InsertBefore]
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x98]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov edx, 0xffffffff
mov rcx, rax
call fcn.1400e1d30
cmp al, 1
sete r15b
jmp 0x140093ab1
lea rdx, str.SilentSolutionExecution
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x14008fb0a
mov r15b, 1
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rsp + 0xd0]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rsp + 0x90]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
xor r8d, r8d
lea rdx, [0x140147dac]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov ebx, eax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
sub eax, ebx
lea r8d, [rax - 1]
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_12600]
nop
xor r8d, r8d
lea rdx, [0x14013ddb8]
lea rcx, [rsp + 0xc0]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov r8d, eax
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0xc0]
call qword [sym.imp.mfc140u.dll_CStringList::InsertBefore]
nop
mov rdx, rax
lea rcx, [rsp + 0xc0]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rsp + 0xc0]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov ebx, eax
lea rdx, str.c:WindowsIAssist
lea rcx, [rsp + 0xa0]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rsp + 0x98]
call fcn.1400e91b0
nop
mov r8d, 0x80
lea rdx, [rsp + 0x190]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x190]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rdx, [rsp + 0x190]
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__9]
nop
call qword [sym.imp.WINMM.dll_timeGetTime]
lea eax, [rbx - 0x80]
cmp eax, 0x80
ja 0x14008f8c0
call sub.mfc140u.dll_AfxFieldText
mov rcx, qword [rax + 8]
mov byte [rcx + 0x221], 0
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
lea rcx, [rsp + 0x60]
call fcn.1400ead50
test eax, eax
je 0x14008f899
mov ecx, ebx
call fcn.1400e4e60
jmp 0x14008f99b
xor r8d, r8d
xor edx, edx
cmp dword [rsp + 0x60], edx
lea rcx, str.Error_occurred_because_HealITService_is_not_running__Please_restart_your_system._If_it_does_not_resolve__Please_contact_to_your_Local_IT_Support.
jne 0x14008f8b2
lea rcx, str.Error_occurred_because_HealIT_application_is_not_installed._Please_contact_to_your_Local_IT_Support.
call sub.mfc140u.dll_AfxInitNetworkAddressControl
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, str.IAssistHelperN.exe
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rsp + 0x60], 0x400001
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
lea rcx, [rsp + 0xc0]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rbx, rax
mov rcx, r14
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r8, rax
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9, rbx
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov r14, qword [rsp + 0xe8]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [r13 + 0x248]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CFileDialog::SetTemplate]
mov rcx, rax
lea rdx, str.showProgressDlg
call fcn.14000e250
movzx ebx, al
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test bl, bl
je 0x14008fa4c
lea rax, [rsp + 0x38]
mov qword [rsp + 0x68], rax
lea rdx, str.showProgressDlg
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
mov rbx, rax
call sub.mfc140u.dll_AfxFieldText
nop
mov rdx, rbx
mov rcx, qword [rax + 8]
call fcn.140096b00
call fcn.1400ee850
test eax, eax
jne 0x14008fa4c
xor r15b, r15b
lea rdx, str.Taskkill__IM_IAssistHelperN.exe__F
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.1400e6110
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
call qword [sym.imp.WINMM.dll_timeGetTime]
lea rdx, [0x140146ea8]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x38]
call fcn.14000ce20
lea r9, [rsp + 0x90]
lea r8, [rsp + 0xd0]
lea rdx, [rsp + 0x58]
mov rcx, rax
call fcn.1400edbc0
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x98]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0xa0]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0xc0]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x90]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0xd0]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x140093ab1
xor r8d, r8d
lea rdx, str.isbitlockerenabled
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x14008fce4
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rsp + 0x90]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rdx, str.c:WindowsIAssist
lea rcx, [rsp + 0xa0]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rsp + 0x70]
call fcn.1400e91b0
nop
mov r8d, 0x80
lea rdx, [rsp + 0x190]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x190]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rdx, [rsp + 0x190]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__9]
nop
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
lea rdx, [0x140146ea8]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x38]
call fcn.14000ce20
lea r9, [0x1401b7988]
lea r8, [rsp + 0x90]
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.1400edbc0
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.DLocked
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
test eax, eax
sete bl
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test bl, bl
jne 0x14008fc9b
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, [0x140144970]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
je 0x14008fc9b
xor r15b, r15b
jmp 0x14008fc9e
mov r15b, 1
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0xa0]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x90]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x140093ab1
xor r8d, r8d
lea rdx, str.isDriveLocked
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x14008ff36
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rdx, str.c:WindowsIAssist
lea rcx, [rsp + 0xa0]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rsp + 0x70]
call fcn.1400e91b0
nop
mov r8d, 0x80
lea rdx, [rsp + 0x190]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x190]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rdx, [rsp + 0x190]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__9]
nop
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
lea rdx, [0x140146ea8]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x38]
call fcn.14000ce20
lea r9, [0x1401b7988]
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.1400edbc0
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.DLocked
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
test eax, eax
sete bl
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test bl, bl
je 0x14008fe66
lea rdx, [rsp + 0x58]
lea rcx, [0x1401b79e8]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
mov r9d, 1
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], r12
lea r9, [0x14012c468]
lea r8, [0x140148770]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov r15b, 1
jmp 0x14008fef3
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, [0x140144970]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x14008fef3
lea rdx, [rsp + 0x58]
lea rcx, [0x1401b79e8]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
mov r9d, 1
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], r12
lea r9, str.C:WinBDERecoveryKey
lea r8, [0x140148770]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
xor r15b, r15b
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0xa0]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x140093ab1
xor r8d, r8d
lea rdx, str.isDriveEncryptedLocked
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x140090107
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rsp + 0x88]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rdx, str.c:WindowsIAssist
lea rcx, [rsp + 0xa0]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rsp + 0x70]
call fcn.1400e91b0
nop
mov r8d, 0x80
lea rdx, [rsp + 0x190]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x190]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rdx, [rsp + 0x190]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__9]
nop
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
lea rdx, [0x140146ea8]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x38]
call fcn.14000ce20
lea r9, [0x1401b7988]
lea r8, [rsp + 0x88]
lea rdx, [rsp + 0x58]
mov rcx, rax
call fcn.1400edbc0
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.DLocked
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
test eax, eax
sete bl
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test bl, bl
je 0x1400900be
lea rdx, [rsp + 0x88]
lea rcx, [0x1401b79e8]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
mov r9d, 1
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], r12
lea r9, [0x14012c468]
lea r8, [0x140148770]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov r15b, 1
jmp 0x1400900c1
xor r15b, r15b
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0xa0]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x88]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x140093ab1
xor r8d, r8d
lea rdx, str.pstfilecreated
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x14009056e
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
xor r8d, r8d
lea rdx, [0x140147dac]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov ebx, eax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
sub eax, ebx
lea r8d, [rax - 1]
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_12600]
nop
xor r8d, r8d
lea rdx, [0x14013ddb8]
lea rcx, [rsp + 0x88]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov r8d, eax
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x88]
call qword [sym.imp.mfc140u.dll_CStringList::InsertBefore]
nop
mov rdx, rax
lea rcx, [rsp + 0x88]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
call sub.mfc140u.dll_AfxFieldText
mov rdx, qword [rax + 8]
add rdx, 0x1f8
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
nop
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, [0x1401312ec]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
test eax, eax
setne bl
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test bl, bl
je 0x14009054c
lea rdx, str.AnakageFilesVBScripts_
lea rcx, [rsp + 0xc0]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rsp + 0x38]
call fcn.1400e7c60
mov r15, rax
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rsp + 0x60], 0x30000001
lea rcx, [rsp + 0xc0]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0xc0]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
lea r8, [rsp + 0x88]
mov rdx, r14
lea rcx, [rsp + 0x90]
call fcn.14000ce20
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0xc0]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, [0x140132be8]
lea rcx, [rsp + 0xd0]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rdx, str.CScript
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0xb0]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r15, rax
mov dword [rsp + 0x60], 0x90000001
lea rcx, [rsp + 0x90]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x90]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0xb0]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
nop
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0xa0]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov r9d, 1
mov dword [rsp + 0xc0], r9d
lea rcx, [rsp + 0xd0]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0xd0]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0xa0]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
lea r8, [rsp + 0x58]
mov rdx, r14
lea rcx, [rsp + 0x70]
call fcn.14000ce20
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1400e6110
nop
lea rcx, [rsp + 0xa0]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0xb0]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0xd0]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
xor r8d, r8d
lea rdx, str.All_rights_reserved.
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
sub ebx, eax
lea r8d, [rbx - 0x14]
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_12600]
nop
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x98]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CFileDialog::SetTemplate]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0xb8]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rcx, rax
call fcn.1400e5df0
movzx r15d, al
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x90]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov r14, qword [rsp + 0xe8]
jmp 0x14009054f
xor r15b, r15b
lea rcx, [rsp + 0x88]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x140093ab1
xor r8d, r8d
lea rdx, str.doesfileexists
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
xor r8d, r8d
lea rcx, [rsp + 0x30]
test eax, eax
js 0x140090698
lea rdx, [0x140147dac]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov ebx, eax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
sub eax, ebx
lea r8d, [rax - 1]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_12600]
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov edx, 0x29
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_COleControl::ReleaseCaches]
mov r8d, eax
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CStringList::InsertBefore]
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x98]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rcx, rax
call fcn.1400e5df0
movzx ebx, al
test al, al
jne 0x140093aad
xor r8d, r8d
lea rdx, str.Program_Files__x86_
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x140093aad
lea r8, str.Program_Files
lea rdx, str.Program_Files__x86_
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCToolBar::RebuildAccelerationKeys]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rcx, rax
call fcn.1400e5df0
movzx ebx, al
jmp 0x140093aad
lea rdx, str.antivirusCheckAndDelete
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x14009092f
xor r15b, r15b
lea rdx, [0x1401312ec]
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rdx, str.WMIC__Node:localhost__Namespace:_rootSecurityCenter2_Path_AntiVirusProduct_Get_displayName
lea rcx, [rsp + 0xb0]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.1400e6110
nop
xor r8d, r8d
lea rdx, str.Avast_Antivirus
lea rcx, [rsp + 0x90]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x140090803
lea rdx, str.C:Program_Files__x86_AVAST_SoftwareAvastAvastUI.exe
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rcx, rax
call fcn.1400e5df0
cmp al, 1
jne 0x140090780
lea rdx, str.del_C:_Program_Files__x86___AVAST_Software_AvastAvastUI.exe__s__q
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
mov rdx, rax
lea rcx, [rsp + 0x98]
call fcn.1400e6110
nop
mov rdx, rax
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
jmp 0x1400907e7
lea r8, str.Program_Files
lea rdx, str.Program_Files__x86_
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCToolBar::RebuildAccelerationKeys]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rcx, rax
call fcn.1400e5df0
cmp al, 1
jne 0x1400907f8
lea rdx, str.del_C:_Program_Files__AVAST_Software_AvastAvastUI.exe__s__q
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
mov rdx, rax
lea rcx, [rsp + 0x98]
call fcn.1400e6110
nop
mov rdx, rax
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x98]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov r15b, 1
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
xor r8d, r8d
lea rdx, str.AVG_Antivirus
lea rcx, [rsp + 0x90]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x140090901
lea rdx, str.C:Program_Files__x86_AVGAntivirusAVGUI.exe
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rcx, rax
call fcn.1400e5df0
cmp al, 1
jne 0x140090883
lea rdx, str.del_C:_Program_Files__x86___AVG_AntivirusAVGUI.exe__s__q
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.1400e6110
nop
mov rdx, rax
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
jmp 0x1400908e7
lea r8, str.Program_Files
lea rdx, str.Program_Files__x86_
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCToolBar::RebuildAccelerationKeys]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rcx, rax
call fcn.1400e5df0
cmp al, 1
jne 0x1400908f5
lea rdx, str.del_C:_Program_Files__AVG_AntivirusAVGUI.exe__s__q
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.1400e6110
nop
mov rdx, rax
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov r15b, 1
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x90]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0xb0]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x140093ab1
xor r8d, r8d
lea rdx, str.CheckWiFiSignalStrength
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x140090b09
lea rdx, str.netsh_interface_show_interface_findstr_WiFi
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.1400e6110
nop
xor r8d, r8d
lea rdx, str.Connected
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
jle 0x140090aea
lea rdx, str.netsh_wlan_show_interface_findstr_Signal
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rdx, rax
lea rcx, [rsp + 0x98]
call fcn.1400e6110
nop
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x98]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CFileDialog::SetTemplate]
xor r8d, r8d
lea rdx, [0x140148b5c]
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov r8d, eax
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CStringList::InsertBefore]
nop
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0xb8]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
xor r8d, r8d
lea rdx, [0x140147f70]
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov ebx, eax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
sub eax, ebx
lea r8d, [rax - 1]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_12600]
nop
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CFileDialog::SetTemplate]
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
cmp eax, 0x32
jl 0x140090aea
mov r15b, 1
lea rdx, str.IPCONFIG__FLUSHDNS
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
mov rdx, rax
lea rcx, [rsp + 0x98]
call fcn.1400e6110
lea rcx, [rsp + 0x98]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x140090aed
xor r15b, r15b
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x140093ab1
xor r8d, r8d
lea rdx, str.avgcheck
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x140090c3e
xor r15b, r15b
lea rdx, [0x1401312ec]
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rdx, str.WMIC__Node:localhost__Namespace:_rootSecurityCenter2_Path_AntiVirusProduct_Get_displayName
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rdx, rax
lea rcx, [rsp + 0xb0]
call fcn.1400e6110
nop
xor r8d, r8d
lea rdx, str.AVG_Antivirus
lea rcx, [rsp + 0xb0]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x140090c13
lea rdx, str.C:Program_Files__x86_AVGAntivirusAVGUI.exe
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rcx, rax
call fcn.1400e5df0
cmp al, 1
jne 0x140090bc5
movzx r15d, al
jmp 0x140090c07
lea r8, str.Program_Files
lea rdx, str.Program_Files__x86_
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCToolBar::RebuildAccelerationKeys]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rcx, rax
call fcn.1400e5df0
movzx r15d, r15b
mov r9d, 1
cmp al, r9b
cmove r15d, r9d
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0xb0]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x140093ab1
xor r8d, r8d
lea rdx, str.antivirusCheck
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x140090edd
xor r15b, r15b
lea rdx, [0x1401312ec]
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rdx, str.WMIC__Node:localhost__Namespace:_rootSecurityCenter2_Path_AntiVirusProduct_Get_displayName
lea rcx, [rsp + 0xb0]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.1400e6110
nop
xor r8d, r8d
lea rdx, str.Avast_Antivirus
lea rcx, [rsp + 0x90]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x140090db1
lea rdx, str.C:Program_Files__x86_AVAST_SoftwareAvastAvastUI.exe
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rcx, rax
call fcn.1400e5df0
cmp al, 1
jne 0x140090d2e
lea rdx, str.C:_Program_Files__x86___AVAST_Software_AvastAvastUI.exe
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
mov rdx, rax
lea rcx, [rsp + 0x98]
call fcn.1400e6110
nop
mov rdx, rax
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
jmp 0x140090d95
lea r8, str.Program_Files
lea rdx, str.Program_Files__x86_
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCToolBar::RebuildAccelerationKeys]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rcx, rax
call fcn.1400e5df0
cmp al, 1
jne 0x140090da6
lea rdx, str.C:_Program_Files__AVAST_Software_AvastAvastUI.exe
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
mov rdx, rax
lea rcx, [rsp + 0x98]
call fcn.1400e6110
nop
mov rdx, rax
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x98]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov r15b, 1
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
xor r8d, r8d
lea rdx, str.AVG_Antivirus
lea rcx, [rsp + 0x90]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x140090eaf
lea rdx, str.C:Program_Files__x86_AVGAntivirusAVGUI.exe
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rcx, rax
call fcn.1400e5df0
cmp al, 1
jne 0x140090e31
lea rdx, str.C:_Program_Files__x86___AVG_AntivirusAVGUI.exe
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.1400e6110
nop
mov rdx, rax
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
jmp 0x140090e95
lea r8, str.Program_Files
lea rdx, str.Program_Files__x86_
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCToolBar::RebuildAccelerationKeys]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rcx, rax
call fcn.1400e5df0
cmp al, 1
jne 0x140090ea3
lea rdx, str.C:_Program_Files__AVG_AntivirusAVGUI.exe
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.1400e6110
nop
mov rdx, rax
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov r15b, 1
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x90]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0xb0]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x140093ab1
xor r8d, r8d
lea rdx, str.IsAdminRequiredForSolution
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x1400914b4
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
xor r8d, r8d
lea rdx, [0x140147dac]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov ebx, eax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
sub eax, ebx
lea r8d, [rax - 1]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_12600]
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov edx, 0x29
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_COleControl::ReleaseCaches]
mov r8d, eax
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CStringList::InsertBefore]
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.InstallService.bat
lea rcx, [rsp + 0xb0]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0xb0]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0xb0]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x140091233
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
lea rcx, [rsp + 0x60]
call fcn.1400ead50
lea rdx, str.AnakageFilesVBScripts_
lea rcx, [rsp + 0x90]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rsp + 0x38]
call fcn.1400e7c60
mov r14, rax
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0xb0]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r15, rax
mov dword [rsp + 0xc0], 2
lea rcx, [rsp + 0x90]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x90]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r14
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r14
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0xb0]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
nop
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov dword [rsp + 0xc0], 6
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov dword [rsp + 0xc0], 4
lea rcx, [rsp + 0xb0]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x90]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, str.cmd.exe__k
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rsp + reloc.OLEAUT32.dll_VariantTimeToDosDateTime0], 0xc
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov rcx, r14
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r9, rax
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [rsp + 0xc0], 4
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x60]
call fcn.1400ead50
test eax, eax
je 0x140091215
jmp 0x14009149e
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.DeleteService.bat
lea rcx, [rsp + 0xb0]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0xb0]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0xb0]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400914aa
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
lea rdx, str.AnakageFilesVBScripts_
lea rcx, [rsp + 0x90]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rsp + 0x38]
call fcn.1400e7c60
mov r14, rax
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0xb0]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r15, rax
mov dword [rsp + 0xc0], 0x10
lea rcx, [rsp + 0x90]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x90]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r14
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r14
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0xb0]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
nop
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov dword [rsp + 0xc0], gethostbyname
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov dword [rsp + 0xc0], 0x20
lea rcx, [rsp + 0xb0]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x90]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, str.cmd.exe__k
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rsp + 0xc0], 0x60
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov rcx, r14
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r9, rax
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x50]
jmp 0x140093de8
xor r8d, r8d
lea rdx, str.RunBatchFileInAdminMode
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
xor r8d, r8d
lea rcx, [rsp + 0x30]
test eax, eax
js 0x1400916d2
lea rdx, [0x140147dac]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov ebx, eax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
sub eax, ebx
lea r8d, [rax - 1]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_12600]
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov edx, 0x29
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_COleControl::ReleaseCaches]
mov r8d, eax
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CStringList::InsertBefore]
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, str.AnakageFilesVBScripts_
lea rcx, [rsp + 0x90]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rsp + 0x38]
call fcn.1400e7c60
mov r14, rax
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0xb0]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r15, rax
mov dword [rsp + 0xc0], 0x80
lea rcx, [rsp + 0x90]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x90]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r14
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r14
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0xb0]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
nop
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0xd0]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov dword [rsp + 0xc0], 0x180
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0xd0]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
nop
lea rcx, [rsp + 0xb0]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x90]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rsp + 0xd0]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r8, rax
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rsp + 0xd0]
jmp 0x140093de8
lea rdx, str.lyncVersionDetection
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
xor r8d, r8d
lea rcx, [rsp + 0x30]
test eax, eax
js 0x1400918b9
xor r15b, r15b
lea rdx, [0x140147dac]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov ebx, eax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
sub eax, ebx
lea r8d, [rax - 1]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_12600]
nop
xor r8d, r8d
lea rdx, [0x14013ddb8]
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov r8d, eax
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CStringList::InsertBefore]
nop
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rsp + 0x40]
call fcn.1400e8d60
nop
xor r8d, r8d
lea rdx, str.16.0
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x1400917d1
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.lync2016
lea rcx, [rsp + 0xb0]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0xb0]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
jmp 0x140091889
xor r8d, r8d
lea rdx, str.15.0
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x14009182e
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.lync2013
lea rcx, [rsp + 0xb0]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0xb0]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
jmp 0x140091889
xor r8d, r8d
lea rdx, str.14.0
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x14009189d
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.lync2010
lea rcx, [rsp + 0xb0]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0xb0]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0xb0]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
sete r15b
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x140093ab1
lea rdx, str.GetIPAndhostname
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x140091d34
lea rcx, [rsp + 0xa8]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rsp + 0xd8]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rsp + 0x88]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea r8, [rsp + 0x88]
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0xa8]
call fcn.1400e0840
call fcn.1400de8c0
mov rdx, rax
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
mov dword [rsp + 0x60], 0x208
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x190]
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_GetComputerNameExA]
lea rdx, [rsp + 0x190]
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__9]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, [0x1401312ec]
lea rcx, [rsp + 0xb0]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0xb0]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0xb0]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400919d1
lea rdx, str.WORK_GROUP
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
lea rdx, [0x1401354c4]
lea rcx, [rsp + 0xd0]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rdx, [0x1401354c4]
lea rcx, [rsp + 0x90]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rdx, str.Your_Host_Name___Ip_Address___Domain_Name_respectively_is
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0xe0]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rsp + 0xc0], 0x200
lea rcx, [rsp + 0x88]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x88]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0xe0]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
nop
mov rcx, r14
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0xf0]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r15, rax
mov dword [rsp + 0xc0], 0x600
lea rcx, [rsp + 0x90]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x90]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r14
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r14
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0xf0]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
nop
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0xa0]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rsp + 0xc0], 0xe00
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0xa0]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
nop
mov rcx, r14
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r15, rax
mov dword [rsp + 0xc0], 0x1e00
lea rcx, [rsp + 0xd0]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0xd0]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r14
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r14
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
nop
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0xb0]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rsp + 0xc0], 0x3e00
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0xb0]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov rdx, r14
lea rcx, [0x1401b79e8]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0xb0]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0xa0]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0xf0]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0xe0]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x90]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0xd0]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x88]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0xd8]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0xa8]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov r14, qword [rsp + 0xe8]
jmp 0x14008d515
xor r8d, r8d
lea rdx, str.officeVersionDetection
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
xor r8d, r8d
lea rcx, [rsp + 0x30]
test eax, eax
js 0x140091f23
xor r15b, r15b
lea rdx, [0x140147dac]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov ebx, eax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
sub eax, ebx
lea r8d, [rax - 1]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_12600]
nop
xor r8d, r8d
lea rdx, [0x14013ddb8]
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov r8d, eax
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CStringList::InsertBefore]
nop
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rsp + 0x40]
call fcn.1400e93c0
nop
xor r8d, r8d
lea rdx, str.16.0
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x140091e3b
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.2016
lea rcx, [rsp + 0xa8]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0xa8]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
jmp 0x140091ef3
xor r8d, r8d
lea rdx, str.15.0
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x140091e98
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.2013
lea rcx, [rsp + 0xa8]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0xa8]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
jmp 0x140091ef3
xor r8d, r8d
lea rdx, str.14.0
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x140091f07
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.2010
lea rcx, [rsp + 0xa8]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0xa8]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0xa8]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
sete r15b
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x140093ab1
lea rdx, str.verifyFromPrinterList
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x140091fe3
xor bl, bl
call sub.mfc140u.dll_AfxFieldText
mov rdx, qword [rax + 8]
add rdx, 0x1f8
lea rcx, [rsp + 0x90]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
nop
lea rdx, str.wmic_printer_get_name
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
mov rdx, rax
lea rcx, [rsp + 0xa8]
call fcn.1400e6110
nop
mov edx, 0x22
lea rcx, [rsp + 0x90]
call qword [sym.imp.mfc140u.dll_COleSafeArray::PutElement]
lea rcx, [rsp + 0x90]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
xor r8d, r8d
lea rcx, [rsp + 0xa8]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
movzx r15d, bl
mov r9d, 1
test eax, eax
cmovns r15d, r9d
lea rcx, [rsp + 0xa8]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x90]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x140093ab1
xor r8d, r8d
lea rdx, str.matchreg
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
xor r8d, r8d
lea rcx, [rsp + 0x30]
test eax, eax
js 0x14009230a
lea rdx, [0x140147dac]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov ebx, eax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
sub eax, ebx
lea r8d, [rax - 1]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_12600]
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
xor r8d, r8d
lea rdx, [0x14013ddb8]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov r8d, eax
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CStringList::InsertBefore]
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
xor r8d, r8d
lea rdx, [0x140147f70]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov ebx, eax
mov r8d, eax
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CStringList::InsertBefore]
nop
mov rdx, rax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x98]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
sub eax, ebx
lea r8d, [rax - 1]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_12600]
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
xor r8d, r8d
lea rdx, [0x140147f70]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov ebx, eax
mov r8d, eax
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CStringList::InsertBefore]
nop
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0xb8]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
sub eax, ebx
lea r8d, [rax - 1]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_12600]
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rsp + 0xd8]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, [0x1401312ec]
lea rcx, [rsp + 0xa8]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0xa8]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
test eax, eax
sete bl
lea rcx, [rsp + 0xa8]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test bl, bl
jne 0x140092230
call fcn.1400e16c0
test al, al
lea rdx, [rsp + 0x50]
je 0x140092235
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0xd8]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
lea rdx, [rsp + 0x58]
mov rcx, rax
call fcn.1400e01e0
test eax, eax
jne 0x1400922d3
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
test eax, eax
sete r15b
test eax, eax
je 0x1400922d3
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
lea rdx, [rsp + 0x58]
mov rcx, rax
call fcn.1400e01e0
test eax, eax
jne 0x1400922d3
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
test eax, eax
sete r15b
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0xd8]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x140093ab1
lea rdx, str.RunScriptForMozilla
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x140092612
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rdx, str.HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternet_SettingsProxyServer
lea rcx, [rsp + 0xd8]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.1400e01e0
lea r8, [0x14012c468]
lea rdx, str.:4145
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCToolBar::RebuildAccelerationKeys]
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CFileDialog::SetTemplate]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rbx, rax
lea rdx, str.Proxy_address_read_from_registry_to_be_set_in_Mozilla_Proxy
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
mov r8d, 0xffffffff
mov rdx, rbx
mov rcx, rax
call fcn.1400ee8c0
xor r8d, r8d
lea rdx, [0x140147dac]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov ebx, eax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
sub eax, ebx
lea r8d, [rax - 1]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_12600]
nop
xor r8d, r8d
lea rdx, [0x14013ddb8]
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov r8d, eax
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CStringList::InsertBefore]
nop
mov rdx, rax
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x98]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, str.AnakageFilesVBScripts_
lea rcx, [rsp + 0x90]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rsp + 0x38]
call fcn.1400e7c60
mov r15, rax
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0xa8]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rsp + 0xc0], 0x8000
lea rcx, [rsp + 0x90]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x90]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0xa8]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
lea r8, [rsp + 0x58]
mov rdx, r14
lea rcx, [rsp + 0xd0]
call fcn.14000ce20
nop
lea rcx, [rsp + 0xa8]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x90]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
xor edx, edx
lea r8d, [rdx + 0x58]
lea rcx, [rsp + 0x138]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x120], WSAStartup
mov dword [rsp + 0x124], 0x40
mov qword [rsp + 0x128], r12
mov qword [rsp + 0x130], r12
lea rcx, [rsp + 0xd0]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov qword [rsp + 0x138], rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x148], r12
mov dword [rsp + 0x150], r12d
mov qword [rsp + 0x158], r12
lea rcx, [rsp + 0x120]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x188]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0xb8]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov dl, 1
mov rcx, rax
call fcn.1400e3520
nop
lea rcx, [rsp + 0xd0]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0xd8]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x50]
jmp 0x140093de8
xor r8d, r8d
lea rdx, str.symantecUpdatePolicy
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
xor r8d, r8d
lea rcx, [rsp + 0x30]
test eax, eax
js 0x140092946
mov r15b, 1
lea rdx, [0x140147dac]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov ebx, eax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
sub eax, ebx
lea r8d, [rax - 1]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_12600]
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
xor r8d, r8d
lea rdx, [0x14013ddb8]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov r8d, eax
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CStringList::InsertBefore]
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, str.HKEY_LOCAL_MACHINESOFTWARESymantecSymantec_Endpoint_ProtectionCurrentVersionpublic_opstateLatestVirusDefsDate
lea rcx, [rsp + 0xd8]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0x98]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.1400e01e0
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CFileDialog::SetTemplate]
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0xb8]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rbx, rax
lea rdx, str.last_updated_date_read_from_registry
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
mov r8d, 0xffffffff
mov rdx, rbx
mov rcx, rax
call fcn.1400ee8c0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x68], rax
lea rdx, str.Symantec_is_up_to_date.Current_Virus_Definition_is
lea rcx, [rsp + 0xa8]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0x38]
call fcn.14000ce20
mov rbx, rax
call sub.mfc140u.dll_AfxFieldText
nop
mov rdx, rbx
mov rcx, qword [rax + 8]
call fcn.140096ac0
nop
lea rcx, [rsp + 0xa8]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov edx, 0x2d
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_COleControl::ReleaseCaches]
mov ebx, eax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
sub eax, ebx
lea r8d, [rax - 1]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_12600]
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov esi, eax
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov r8d, ebx
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CStringList::InsertBefore]
nop
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0xe0]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov edx, 0x2d
xor r8d, r8d
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CPaneFrameWnd::EnterDragMode]
mov ebx, eax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
sub eax, ebx
lea r8d, [rax - 1]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_12600]
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov edi, eax
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov r8d, ebx
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CStringList::InsertBefore]
nop
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0xf0]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov ebx, eax
lea rcx, [rsp + 0xb0]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
lea rcx, [rsp + 0xb0]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__localtime64]
mov r8d, dword [rax + 0xc]
mov edx, dword [rax + 0x10]
inc edx
mov ecx, dword [rax + 0x14]
add ecx, 0x76c
cmp ebx, ecx
jne 0x140092927
sub edx, edi
cmp edx, 1
jg 0x140092927
sub r8d, esi
movzx r15d, r15b
cmp r8d, 7
cmovg r15d, r12d
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0xd8]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x140093ab1
lea rdx, [0x1401490c8]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x14009315d
xor r15b, r15b
mov byte [rsp + 0xc8], r15b
lea rdx, str.AnakageFilesVBScriptsSymantecManualUpdate.bat
lea rcx, [rsp + 0xa8]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rsp + 0xb8]
call fcn.1400e7c60
nop
lea r8, [rsp + 0xa8]
mov rdx, rax
lea rcx, [rsp + 0x98]
call fcn.14000ce20
nop
lea rcx, [rsp + 0xb8]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0xa8]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rax, [rsp + 0xd8]
mov qword [rsp + 0xf0], rax
lea rdx, [0x1401312ec]
lea rcx, [rsp + 0xd8]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
mov rbx, rax
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0xe0]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
nop
xor r8d, r8d
mov rdx, rbx
mov rcx, rax
call fcn.1400ee720
mov ecx, 0x7530
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x68]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
lea rcx, [rsp + 0x68]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__localtime64]
mov r9, rax
lea r8, str._m_d_Y
mov edx, 0x50
lea rcx, [rsp + 0x120]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_strftime]
lea rdx, [rsp + 0x120]
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rdx, str..Log
lea rcx, [rsp + 0x58]
call qword [0x14012a1a8]
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CFileDialog::SetTemplate]
lea rcx, [rsp + 0xa0]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rdx, str.HKEY_LOCAL_MACHINESOFTWARESymantecSymantec_Endpoint_ProtectionCurrentVersionPRODUCTVERSION
lea rcx, [rsp + 0xa0]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0xb8]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.1400e01e0
lea rdx, str..105
lea rcx, [rsp + 0x50]
call qword [0x14012a1a8]
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CFileDialog::SetTemplate]
lea rax, [rsp + 0xb8]
mov qword [rsp + 0xd8], rax
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0xb8]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rbx, rax
lea rdx, str.Symantec_Version_from_registry
lea rcx, [rsp + 0xa8]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
mov r8d, 0xffffffff
mov rdx, rbx
mov rcx, rax
call fcn.1400ee8c0
lea rdx, [0x140134cd0]
lea rcx, [rsp + 0xb8]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rdx, str.DataLogsAV_
lea rcx, [rsp + 0x90]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rdx, str._C:ProgramDataSymantecSymantec_Endpoint_Protection_
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0xb0]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov qword [rsp + 0xa8], rax
mov dword [rsp + 0xc0], 0x80000
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0xb0]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
nop
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0xf0]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov qword [rsp + 0xd8], rax
mov dword [rsp + 0xc0], 0x180000
lea rcx, [rsp + 0x90]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x90]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0xf0]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
nop
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0xe0]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov qword [rsp + 0xa8], rax
mov dword [rsp + 0xc0], 0x380000
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0xe0]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
lea r8, [rsp + 0xb8]
mov rdx, qword [rsp + 0xa8]
lea rcx, [rsp + 0x88]
call fcn.14000ce20
nop
lea rcx, [rsp + 0xe0]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0xf0]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0xb0]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x90]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0xb8]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rax, [rsp + 0xa8]
mov qword [rsp + 0xc0], rax
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0xa8]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rbx, rax
lea rdx, str.Symantec_log_file_name
lea rcx, [rsp + 0xd8]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
mov r8d, 0xffffffff
mov rdx, rbx
mov rcx, rax
call fcn.1400ee8c0
lea rdx, [0x14012c468]
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__9]
nop
lea rdx, str.more
lea rcx, [rsp + 0xb8]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea r8, [rsp + 0x88]
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0xa8]
call fcn.14000ce20
mov rdx, rax
lea rcx, [rsp + 0xd8]
call fcn.1400e6110
nop
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0xd8]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0xb8]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rax, [rsp + 0xe0]
mov qword [rsp + 0xa8], rax
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0xe0]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rbx, rax
lea rdx, str.Symantec_log_content
lea rcx, [rsp + 0xb8]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
mov r8d, 0xffffffff
mov rdx, rbx
mov rcx, rax
call fcn.1400ee8c0
lea rdx, str.Risks:_0
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rsp + 0xd0]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
xor r8d, r8d
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov edi, eax
cmp eax, 0xffffffff
jne 0x1400930d5
test r12d, r12d
jle 0x140093064
mov r15b, 1
mov byte [rsp + 0xc8], r15b
xor r8d, r8d
lea rdx, str.Files
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov r8d, eax
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CStringList::InsertBefore]
nop
mov rdx, rax
lea rcx, [rsp + 0xd0]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0xb8]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rax, [rsp + 0xd8]
mov qword [rsp + 0xe0], rax
lea rdx, str._files_etc...
lea rcx, [rsp + 0xa8]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rdx, str.Symantec_scan_completed__Risks:_0_and
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rsp + 0xd0]
call qword [sym.imp.mfc140u.dll_CFileDialog::SetTemplate]
mov rbx, rax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0xb8]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rsp + 0xc0], 0x1000000
mov rcx, rbx
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
mov rcx, rbx
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0xb8]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
lea r8, [rsp + 0xa8]
mov rdx, r14
lea rcx, [rsp + 0xd8]
call fcn.14000ce20
mov rbx, rax
call sub.mfc140u.dll_AfxFieldText
nop
mov rdx, rbx
mov rcx, qword [rax + 8]
call fcn.140096ac0
nop
lea rcx, [rsp + 0xb8]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0xa8]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov r14, qword [rsp + 0xe8]
lea rcx, [rsp + 0xd0]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x88]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0xa0]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x98]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
jmp 0x140093ab1
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
sub ebx, edi
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
sub ebx, eax
mov r8d, ebx
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_12600]
nop
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0xb8]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
inc r12d
jmp 0x140092ec0
xor r8d, r8d
lea rdx, str.showProxyDialog
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
xor r8d, r8d
lea rcx, [rsp + 0x30]
test eax, eax
js 0x1400932bf
lea rdx, [0x140147dac]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov ebx, eax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
sub eax, ebx
lea r8d, [rax - 1]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_12600]
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
xor r8d, r8d
lea rdx, [0x14013ddb8]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov r8d, eax
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CStringList::InsertBefore]
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, [0x1401312ec]
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
je 0x14009328a
lea rax, [rsp + 0x68]
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rbx, rax
call sub.mfc140u.dll_AfxFieldText
nop
mov rdx, rbx
mov rcx, qword [rax + 8]
call fcn.140096b00
xor edx, edx
lea rcx, [rsp + 0x190]
call fcn.1400331b0
nop
lea rcx, [rsp + 0x190]
call sub.mfc140u.dll_CD2DPathGeometry::Detach
test eax, eax
sete r15b
lea rcx, [rsp + 0x190]
call fcn.1400332a0
jmp 0x140093ab1
lea rdx, str.switchoffproxy
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
xor r8d, r8d
test eax, eax
js 0x140093396
mov r9d, 1
mov dword [rsp + 0xc0], r9d
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x58]
test eax, eax
jne 0x14009338b
test rcx, rcx
je 0x14009338b
mov dword [rsp + 0x60], r12d
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.ProxyEnable
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rdx, str.AutoConfigURL
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.AutoDetect
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14008d515
lea rdx, str.showAdAccountDialog
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
xor r8d, r8d
lea rcx, [rsp + 0x30]
test eax, eax
js 0x1400934aa
lea rdx, [0x140147dac]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov ebx, eax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
sub eax, ebx
lea r8d, [rax - 1]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_12600]
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
xor r8d, r8d
lea rdx, [0x14013ddb8]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov r8d, eax
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CStringList::InsertBefore]
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rbx, rax
call sub.mfc140u.dll_AfxFieldText
nop
mov rdx, rbx
mov rcx, qword [rax + 8]
call fcn.140096b00
xor edx, edx
lea rcx, [rsp + 0x190]
call fcn.14000cc80
nop
lea rcx, [rsp + 0x190]
call sub.mfc140u.dll_CD2DPathGeometry::Detach
test eax, eax
sete r15b
lea rcx, [rsp + 0x190]
call fcn.14000cd60
jmp 0x140093ab1
lea rdx, str.showPrinterdialogbox
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
xor r8d, r8d
lea rcx, [rsp + 0x30]
test eax, eax
js 0x140093604
lea rdx, [0x140147dac]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov ebx, eax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
sub eax, ebx
lea r8d, [rax - 1]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_12600]
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
xor r8d, r8d
lea rdx, [0x14013ddb8]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov r8d, eax
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CStringList::InsertBefore]
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, [0x1401312ec]
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
je 0x1400935cf
lea rax, [rsp + 0x68]
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rbx, rax
call sub.mfc140u.dll_AfxFieldText
nop
mov rdx, rbx
mov rcx, qword [rax + 8]
call fcn.140096b00
xor edx, edx
lea rcx, [rsp + 0x190]
call fcn.14009d680
nop
lea rcx, [rsp + 0x190]
call sub.mfc140u.dll_CD2DPathGeometry::Detach
test eax, eax
sete r15b
lea rcx, [rsp + 0x190]
call fcn.14009d770
jmp 0x140093ab1
lea rdx, str.isCitrixInstalled
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x140093690
lea rdx, str.C:Program_Files__x86_CitrixICA_ClientSelfServicePluginSelfService.exe
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rcx, rax
call fcn.1400e5df0
test al, al
jne 0x14009367d
lea r8, str.Program_Files
lea rdx, str.Program_Files__x86_
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCToolBar::RebuildAccelerationKeys]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rcx, rax
call fcn.1400e5df0
test al, al
setne r15b
jmp 0x140093680
mov r15b, 1
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x140093ab1
xor r8d, r8d
lea rdx, str.deleteofficecachefolder
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x140093a1f
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rsp + 0xa8]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rsp + 0xb8]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rsp + 0x98]
call fcn.1400e93c0
nop
lea r8, [rsp + 0xb8]
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0x50]
call fcn.1400e0840
xor r8d, r8d
lea rdx, str.16.0
lea rcx, [rsp + 0x98]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x140093868
lea rdx, str.AppDataLocalMicrosoftOffice16.0OfficeFileCache
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rdx, str.C:Users_
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r15, rax
mov dword [rsp + 0xc0], 0x2000000
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
nop
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rsp + 0xc0], 0x6000000
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov rdx, r14
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
jmp 0x1400939bd
xor r8d, r8d
lea rdx, str.15.0
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x1400939c8
lea rdx, str.AppDataLocalMicrosoftOffice15.0OfficeFileCache
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rdx, str.C:Users_
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r15, rax
mov dword [rsp + 0xc0], 0x8000000
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
nop
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rsp + 0xc0], 0x18000000
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov rdx, r14
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rcx, rax
call fcn.1400d5f80
nop
lea rcx, [rsp + 0x98]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0xb8]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0xa8]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x50]
jmp 0x140093de8
xor r8d, r8d
lea rdx, str.IsCiscoJabberInstalled
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x140093acc
lea rdx, str.C:Program_Files__x86_Cisco_SystemsCisco_JabberCiscoJabber.exe
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rcx, rax
call fcn.1400e5df0
movzx ebx, al
test al, al
jne 0x140093aa2
lea r8, str.Program_Files
lea rdx, str.Program_Files__x86_
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCToolBar::RebuildAccelerationKeys]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rcx, rax
call fcn.1400e5df0
movzx ebx, al
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
movzx r15d, bl
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
test r15b, r15b
je 0x14008d522
jmp 0x140093dfb
xor r8d, r8d
lea rdx, str.changeIESettings
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x140093cca
lea rcx, [rsp + 0x88]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
xor edx, edx
lea ecx, [rdx + 1]
call fcn.1400d6b30
lea rdx, str.HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternet_SettingsSecureProtocols
lea rcx, [rsp + 0x88]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x98], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0xb8], rax
lea rdx, str.DWORD
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
mov rdi, rax
lea rdx, str.2688
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
mov rbx, rax
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
nop
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call fcn.1400d2f80
mov edi, eax
test eax, eax
je 0x140093bdf
lea rdx, str.Failed_to_update_the_registry_SecureProtocols
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rbx, rax
lea rdx, str.setInternetExplorerAsRecommanded_KB_11517
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
mov r8d, edi
mov rdx, rbx
mov rcx, rax
call fcn.1400ee8c0
lea rdx, str.HKEY_CURRENT_USERSoftwareMicrosoftInternet_ExplorerNew_WindowsPopupMgr
lea rcx, [rsp + 0x88]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x98], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0xb8], rax
lea rdx, str.DWORD
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
mov rdi, rax
lea rdx, [0x1401398e0]
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
mov rbx, rax
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
nop
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call fcn.1400d2f80
mov edi, eax
test eax, eax
je 0x140093cb1
lea rdx, str._Failed_to_update_the_registry_PopupMgr
lea rcx, [rsp + 0x58]
call qword [0x14012a1a8]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rbx, rax
lea rdx, str.setInternetExplorerAsRecommanded_KB_11517
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
mov r8d, edi
mov rdx, rbx
mov rcx, rax
call fcn.1400ee8c0
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x88]
jmp 0x140093de8
xor r8d, r8d
lea rdx, str.changeTLSSetting
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x14008d515
lea rcx, [rsp + 0xa0]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rdx, str.HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternet_SettingsSecureProtocols
lea rcx, [rsp + 0xa0]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x98], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0xb8], rax
lea rdx, str.DWORD
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
mov rdi, rax
lea rdx, str.2688
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
mov rbx, rax
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
nop
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call fcn.1400d2f80
mov edi, eax
test eax, eax
je 0x140093dd4
lea rdx, str.Failed_to_update_the_registry_SecureProtocols
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rbx, rax
lea rdx, str.setInternetExplorerAsRecommanded_KB_11517
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
mov r8d, edi
mov rdx, rbx
mov rcx, rax
call fcn.1400ee8c0
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0xa0]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
lea rdx, [r13 + 0x218]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, [0x1401312ec]
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
je 0x140093e83
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
xor r9d, r9d
mov r8, rax
xor edx, edx
mov rbx, qword [rsp + 0xe8]
mov rcx, rbx
call fcn.140059a70
jmp 0x140093e8b
mov rbx, qword [rsp + 0xe8]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x14008d5b4