Function at 0x1400e0ca0
Capabilities:
Check if file exists
Create process on windows
Execute command
Get common file path
Get file attributes
Get hostname
Get proxy
Move file
Persist via app paths registry key
Persist via windows accessibility tools
Query or enumerate registry value
Schedule task via at
Self delete
Set registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xcd0]
sub rsp, 0xdd0
mov qword [rbp + 0x10], 0xfffffffffffffffe
mov qword [rsp + 0xe20], rbx
mov rax, qword [0x1401d61d8]
xor rax, rsp
mov qword [rbp + 0xcc0], rax
mov r13, rdx
mov r12, rcx
mov qword [rbp + 8], rcx
mov qword [rsp + 0x48], rcx
xor eax, eax
mov dword [rbp - 0x50], eax
mov dword [rbp - 0x4c], eax
add rdx, 0x240
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
nop
lea rdx, [r13 + 0x248]
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
nop
lea rcx, [rbp - 0x20]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
xor r8d, r8d
lea rdx, str.Microsoft_Office
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x1400e0eda
xor r8d, r8d
lea rdx, str.Program_Files__x86_
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
lea rdx, [rsp + 0x60]
test eax, eax
jns 0x1400e0daf
lea rcx, [rbp - 0x20]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
lea r8, str.Program_Files__x86_
lea rdx, str.Program_Files
lea rcx, [rbp - 0x20]
call qword [sym.imp.mfc140u.dll_CMFCToolBar::RebuildAccelerationKeys]
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
mov rcx, rax
call fcn.1400f5220
cmp al, 1
jne 0x1400e0dff
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
jmp 0x1400e0eda
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
mov rcx, rax
call fcn.1400f5220
test al, al
jne 0x1400e0dff
lea r8, str.Program_Files
lea rdx, str.Program_Files__x86_
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCToolBar::RebuildAccelerationKeys]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
mov rcx, rax
call fcn.1400f5220
cmp al, 1
je 0x1400e0eda
mov edx, 0x5c
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_COleControl::ReleaseCaches]
mov ebx, eax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
sub eax, ebx
lea r8d, [rax - 1]
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_12600]
nop
lea rcx, [rsp + 0x40]
call fcn.1400e9c10
mov r15, rax
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rbp - 0x50], 0xe
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov rdx, r14
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rbp]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
xor r8d, r8d
lea rdx, str.Microsoft_Office
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x1400e10a3
xor r8d, r8d
lea rdx, [0x140176530]
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x1400e1058
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
mov rcx, rax
call fcn.1400f5220
test al, al
jne 0x1400e1048
xor r8d, r8d
lea rdx, str.Program_Files__x86_
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x1400e1048
lea r8, str.Program_Files
lea rdx, str.Program_Files__x86_
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CMFCToolBar::RebuildAccelerationKeys]
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
mov rcx, rax
call fcn.1400f5220
test al, al
jne 0x1400e1048
lea rdx, [0x140176548]
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x40]
call fcn.1400e9c10
mov r15, rax
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rbp - 0x50], 0x16
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov rdx, r14
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea r8, [0x140145960]
lea rdx, str.OUTLOOK.EXE
jmp 0x1400e1099
xor r8d, r8d
lea rdx, str.Program_Files__x86_
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x1400e10a3
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
mov rcx, rax
call fcn.1400f5220
test al, al
jne 0x1400e10a3
lea r8, str.Program_Files
lea rdx, str.Program_Files__x86_
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CMFCToolBar::RebuildAccelerationKeys]
xor r8d, r8d
lea rdx, str.SysWOW64
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x1400e1129
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
mov rcx, rax
call fcn.1400f5220
test al, al
jne 0x1400e1129
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x20]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
lea r8, str.System32
lea rdx, str.SysWOW64
lea rcx, [rbp - 0x20]
call qword [sym.imp.mfc140u.dll_CMFCToolBar::RebuildAccelerationKeys]
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
mov rcx, rax
call fcn.1400f5220
cmp al, 1
jne 0x1400e1129
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
xor r8d, r8d
lea rdx, str.mlcfg32.cpl
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
jle 0x1400e119f
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
mov rcx, rax
call fcn.1400ef470
lea rdx, str.success
mov rcx, r12
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rbp]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x20]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov rax, r12
jmp 0x1400e7779
lea rdx, str.OpenLogFile
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
test eax, eax
jne 0x1400e12ca
lea rcx, [rsp + 0x40]
call fcn.1400f8f70
mov rbx, rax
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov rsi, rax
mov dword [rbp - 0x50], 0x26
mov rcx, rbx
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov edi, eax
mov rcx, rbx
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rbx, rax
lea rcx, str.C:Users_
call qword [sym.imp.mfc140u.dll_CCheckListBox::SetSelectionCheck]
mov r8d, eax
mov dword [rsp + 0x20], edi
mov r9, rbx
lea rdx, str.C:Users_
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
lea r8, [0x1401765d8]
mov rdx, rsi
lea rcx, [rbp - 0x68]
call fcn.1400997c0
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, [rbp - 0x68]
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.1400f5c80
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, str.success
mov rcx, r12
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x20]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov rax, r12
jmp 0x1400e7779
lea rdx, str.OpenContentInInternetProperties
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
test eax, eax
jne 0x1400e1373
lea rdx, str.C:WindowsSystem32control.exe_Inetcpl.cpl_Content_3
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t_]
nop
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.1400f5c80
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, str.success
mov rcx, r12
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x20]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov rax, r12
jmp 0x1400e7779
lea rdx, str.rundirectmailcfg
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
test eax, eax
jne 0x1400e14d3
lea rdx, str.MLCFG32.CPL
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x40]
call fcn.1400e9c10
nop
lea r8, [rsp + 0x50]
mov rdx, rax
lea rcx, [rbp - 0x60]
call fcn.140006190
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov rdi, rax
mov dword [rbp - 0x50], operator
mov esi, 0x22
mov word [rbp - 0x4c], si
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r9, rax
mov dword [rsp + 0x20], ebx
mov r12d, 1
mov r8d, r12d
lea rdx, [rbp - 0x4c]
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
movzx r8d, sil
mov rdx, rdi
lea rcx, [rsp + 0x78]
call fcn.140099720
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, [0x140176708]
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rbx, rax
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r8, rax
mov dword [rsp + 0x28], r12d
xor ecx, ecx
mov qword [rsp + 0x20], rcx
mov r9, rbx
lea rdx, str.open
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rdx, str.success
mov rcx, qword [rbp + 8]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x1400e7749
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.displayswitch
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov esi, 0x22
lea r12d, [rsi - 0x21]
test ebx, ebx
jne 0x1400e16bd
lea rdx, str.C:WindowsSystem32DisplaySwitch.exe
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t_]
nop
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.1400f5c80
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
xor r14d, r14d
xor r8d, r8d
lea rdx, str..cpl
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x1400e1635
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov rdi, rax
mov dword [rbp - 0x50], 0x806
mov word [rbp - 0x4c], si
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r9, rax
mov dword [rsp + 0x20], ebx
mov r8d, r12d
lea rdx, [rbp - 0x4c]
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov r8b, 0x22
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.140099720
nop
mov rdx, rax
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, str.control.exe
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCControlRendererInfo::CMFCControlRendererInfo]
lea rdx, str.regdelete
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
test eax, eax
jne 0x1400e1662
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
mov rcx, rax
call fcn.1400de3e0
lea rdx, [0x140176a08]
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
test eax, eax
jne 0x1400e1acc
lea rax, [rsp + 0x40]
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
mov rbx, rax
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.1400eb900
jmp 0x1400e772d
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.openPrinterdialog
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e17a1
lea rcx, [rbp - 0x60]
call fcn.1400fa2b0
nop
lea rdx, str.printerdialog.txt
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_COleCurrency::operator]
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rcx, rax
lea rdx, [0x1401457ec]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
mov rbx, rax
test rax, rax
je 0x1400e1759
mov rdx, rax
lea rcx, str.RUNDLL32.EXE_PRINTUI.DLL_PrintUIEntry__ip
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputws]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r8, rax
mov dword [rsp + 0x28], 5
xor r14d, r14d
mov qword [rsp + 0x20], r14
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x1400e1578
lea rdx, str.runmailcfg
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
test eax, eax
jne 0x1400e1575
lea rcx, [rsp + 0x70]
call fcn.1400e9c90
nop
call fcn.1400f0eb0
call fcn.1400ec9a0
test al, al
je 0x1400e17f4
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
mov rcx, rax
call fcn.1400f5220
test al, al
jne 0x1400e19e6
lea rdx, str.C:Program_Files__x86_Microsoft_OfficeOffice15MLCFG32.CPL
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
mov rcx, rax
call fcn.1400f5220
test al, al
jne 0x1400e19e6
lea rdx, str.C:Program_Files__x86_Microsoft_OfficeOffice14MLCFG32.CPL
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
mov rcx, rax
call fcn.1400f5220
test al, al
jne 0x1400e19e6
lea rdx, str.C:Program_Files__x86_Microsoft_OfficeOffice16MLCFG32.CPL
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
mov rcx, rax
call fcn.1400f5220
test al, al
jne 0x1400e19e6
lea rdx, str.C:Program_FilesMicrosoft_Office_rootOffice16MLCFG32.CPL
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
call fcn.1400ec9a0
test al, al
je 0x1400e18c5
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
mov rcx, rax
call fcn.1400f5220
test al, al
jne 0x1400e19e6
lea rdx, str.C:Program_FilesMicrosoft_OfficeOffice15MLCFG32.CPL
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
mov rcx, rax
call fcn.1400f5220
test al, al
jne 0x1400e19e6
lea rdx, str.C:Program_FilesMicrosoft_OfficeOffice14MLCFG32.CPL
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
mov rcx, rax
call fcn.1400f5220
test al, al
jne 0x1400e19e6
lea rdx, str.C:Program_FilesMicrosoft_OfficeOffice16MLCFG32.CPL
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
mov rcx, rax
call fcn.1400f5220
test al, al
jne 0x1400e19e6
lea rdx, str.MLCFG32.CPL
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x40]
call fcn.1400e9c10
nop
lea r8, [rsp + 0x50]
mov rdx, rax
lea rcx, [rbp - 0x68]
call fcn.140006190
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, [rbp - 0x68]
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
mov rcx, rax
call fcn.1400ef470
lea rdx, [0x14015a8c0]
mov rcx, qword [rbp + 8]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t_]
nop
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x1400e7749
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov rdi, rax
mov dword [rbp - 0x50], 0x206
mov word [rbp - 0x4c], si
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r9, rax
mov dword [rsp + 0x20], ebx
mov r8d, r12d
lea rdx, [rbp - 0x4c]
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov r8b, 0x22
mov rdx, rdi
lea rcx, [rsp + 0x78]
call fcn.140099720
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, str.control.exe
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t_]
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rbx, rax
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r8, rax
mov dword [rsp + 0x28], r12d
xor r14d, r14d
mov qword [rsp + 0x20], r14
mov r9, rbx
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x1400e1578
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.ChangeProxySetting
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e1d31
lea rdx, str._8.8.8.8:8080
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400e1d1d
cmp qword [rbp - 0x40], 0
je 0x1400e1d1d
mov dword [rbp - 0x4c], r12d
lea rdx, str.ProxyOverride
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t_]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
mov dword [rbp - 0x28], 0x400
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rbp + 0x60]
call fcn.1400d8320
lea rcx, [rbp - 0x28]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x4f0]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rax]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
lea rax, [rbp + 0x68]
mov rcx, qword [rbp + 0x60]
cmp rcx, rax
je 0x1400e1be4
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test ebx, ebx
jne 0x1400e1bfa
lea rdx, [rbp + 0x4f0]
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCControlRendererInfo::CMFCControlRendererInfo]
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CFileDialog::SetTemplate]
xor r8d, r8d
lea rdx, [0x1401488e0]
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
jns 0x1400e1c30
lea rdx, str._local_
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_COleCurrency::operator]
mov dword [rsp + 0x28], 4
lea rax, [rbp - 0x4c]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.ProxyEnable
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, r12d
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_4946]
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov r9d, r12d
xor r8d, r8d
lea rdx, str.ProxyServer
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov r9d, r12d
xor r8d, r8d
lea rdx, str.ProxyOverride
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rbp - 0x4c], r12d
mov dword [rsp + 0x28], 4
lea rax, [rbp - 0x4c]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.AutoDetect
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rbp - 0x60]
jmp 0x1400e7731
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.proxydialog
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e1df9
xor dil, dil
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, [0x140176a6c]
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
movzx edi, dil
test ebx, ebx
cmove edi, r12d
xor edx, edx
lea rcx, [rbp + 0x60]
call fcn.14000e2f0
nop
mov byte [rbp + 0x2d0], dil
lea rcx, [rbp + 0x60]
call sub.mfc140u.dll_CD2DPathGeometry::Detach
nop
lea rcx, [rbp + 0x60]
call fcn.14000e620
jmp 0x1400e7737
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.AntiVirus
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e1f73
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.HDBFS
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e7737
lea rdx, [0x140176a88]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov edx, 0xffffffff
mov rcx, rax
call fcn.1400fb460
test al, al
jne 0x1400e7737
lea rdx, str.c:WindowsIAssist
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov rsi, rax
mov dword [rbp - 0x50], 0x1006
lea rcx, str.AnakageProactive.exe
call qword [sym.imp.mfc140u.dll_CCheckListBox::SetSelectionCheck]
mov edi, eax
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], edi
lea r9, str.AnakageProactive.exe
mov r8d, ebx
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov rcx, rsi
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r8, rax
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
lea r9, str.action
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x60]
jmp 0x1400e7731
lea rdx, str.PrinterDriver
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
test eax, eax
jne 0x1400e2595
lea rdx, str.C:Program_Files__x86_
lea rcx, [rbp - 0x38]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rbp - 0x38]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne dil
lea rcx, [rbp - 0x40]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rdx, [0x14014b5a4]
lea rcx, str.C:WindowsiassistPrinterDriver.txt
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
mov r15, rax
test rax, rax
je 0x1400e2384
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.PassBook
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e21c5
call fcn.1400ec9a0
lea rcx, str.Win10_
lea rdx, str.Win7_
test al, al
cmovne rdx, rcx
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
lea rax, str.64bit
lea rdx, str.32bit
test dil, dil
cmovne rdx, rax
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_COleCurrency::operator]
lea rdx, str.Compuprint_SP40Plus_P2
lea rcx, [rbp - 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
lea rdx, str.Sp40Plus.INF___r__USB001___m__Compuprint_SP40Plus_
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rdx, str._SystemRoot_System32_rundll32.exe_printui.dll_PrintUIEntry__if__b__Compuprint_SP40Plus_P2___f__C:Follow_me_printingSpeed_40_Plus__Windows_driverCompuprint_Drivers_InstallationdriversCompuprint_SP40_SP40Plus_SP40PlusT_
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rbp - 0x50], 0x2006
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
nop
mov rcx, r14
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov dword [rbp - 0x50], 0x6006
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r14
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r14
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rcx, rax
mov rdx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputws]
nop
jmp 0x1400e2371
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, [0x140176cd0]
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e237b
lea rax, str.WINX64
lea rdx, str.WINX86
test dil, dil
cmovne rdx, rax
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
lea rdx, str.EPSON_LQ_310_ESC_P2
lea rcx, [rbp - 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
lea rdx, str.EBSD053M.INF___r__USB002___m__EPSON_LQ_310_ESC_P2_
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rdx, str._SystemRoot_System32_rundll32.exe_printui.dll_PrintUIEntry__if__b__EPSON_LQ_310_ESC_P2___f__C:Follow_me_printingDriversEpson_LQ_310_DD_PrinterDriverPrinter_
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rbp - 0x50], 0x8006
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
nop
mov rcx, r14
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov dword [rbp - 0x50], 0x18006
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r14
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r14
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rcx, rax
mov rdx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputws]
nop
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x48], rax
lea rdx, [0x140144758]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rbx, rax
lea rdx, [0x140176de4]
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
mov r8, rbx
mov dl, 1
mov rcx, rax
call fcn.140100b90
lea rax, [rbp - 0x80]
mov qword [rsp + 0x48], rax
lea rdx, [0x140144758]
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rbx, rax
lea rdx, [0x140176de8]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
mov r8, rbx
mov dl, 1
mov rcx, rax
call fcn.140100b90
lea rdx, [0x1401456c0]
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rbp - 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov rsi, rax
mov dword [rbp - 0x50], 0x20006
lea rcx, [rbp - 0x40]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov edi, eax
lea rcx, [rbp - 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rbx, rax
lea rcx, str._SystemRoot_System32RUNDLL32_PRINTUI.DLL_PrintUIEntry__y__n__
call qword [sym.imp.mfc140u.dll_CCheckListBox::SetSelectionCheck]
mov r8d, eax
mov dword [rsp + 0x20], edi
mov r9, rbx
lea rdx, str._SystemRoot_System32RUNDLL32_PRINTUI.DLL_PrintUIEntry__y__n__
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
lea r8, [rbp - 0x68]
mov rdx, rsi
lea rcx, [rsp + 0x40]
call fcn.140006190
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.1400f5c80
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rax, [rbp - 0x70]
mov qword [rsp + 0x48], rax
lea rdx, [0x1401486fc]
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rbx, rax
lea rdx, str.installed_printer_is_making_to_default_failed
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
mov r8d, 0xffffffff
mov rdx, rbx
mov rcx, rax
call fcn.1401028d0
lea rcx, [rbp - 0x48]
call fcn.1400e82d0
nop
lea rcx, [rbp - 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
xor r8d, r8d
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x1400e255f
call fcn.1401016b0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x48], rax
lea rdx, [0x1401486fc]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rbx, rax
lea rdx, str.installed_printer_is_now_default
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
mov r8d, 0xffffffff
mov rdx, rbx
mov rcx, rax
call fcn.1401028d0
nop
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x28]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x38]
jmp 0x1400e7731
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.deletebrowsinghistory
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e2669
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.sitel
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e2641
xor edx, edx
mov ecx, r12d
call fcn.1400deae0
xor edx, edx
mov ecx, r12d
call fcn.1400deda0
call fcn.1400dea00
xor edx, edx
mov ecx, r12d
call fcn.1400df080
xor edx, edx
mov ecx, r12d
call fcn.1400deae0
xor edx, edx
mov ecx, r12d
call fcn.1400deda0
jmp 0x1400e7737
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.ChangeProxyinMozilla
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e2947
lea rdx, str.type__Appdata_MozillaFirefoxprofiles.ini
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t_]
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.1400f5c80
nop
xor r8d, r8d
lea rdx, [0x14014abc2]
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov ebx, eax
xor r8d, r8d
lea rdx, str.Default1
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
sub eax, ebx
mov r8d, eax
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_Ordinal_12600]
nop
mov rdx, rax
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
lea r8d, [rax - 0xd]
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CStringList::InsertBefore]
nop
mov rdx, rax
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, str.AnakageFilesVBScriptsEnableMozillaProxy.bat
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x58]
call fcn.1400f7b40
nop
lea r8, [rsp + 0x50]
mov rdx, rax
lea rcx, [rbp - 0x60]
call fcn.140006190
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov rsi, rax
mov dword [rbp - 0x50], 0x80006
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov edi, eax
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rbx, rax
lea rcx, [0x140148698]
call qword [sym.imp.mfc140u.dll_CCheckListBox::SetSelectionCheck]
mov r8d, eax
mov dword [rsp + 0x20], edi
mov r9, rbx
lea rdx, [0x140148698]
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
lea r8, [0x140152fc4]
mov rdx, rsi
lea rcx, [rbp - 0x80]
call fcn.1400997c0
nop
lea r8, [0x140152fc4]
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.1400997c0
nop
lea r8, [0x140152fc4]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1400997c0
mov r15, rax
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rbp - 0x50], 0x180006
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov rcx, r14
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r9, rax
xor ecx, ecx
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rcx
lea r8, str.cmd.exe
lea rdx, str.open
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov ecx, 0xfa0
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x70]
jmp 0x1400e7731
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.SelectFolder
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e2a7e
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x60]
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x20], xmm0
lea rax, [rbp + 0x60]
mov qword [rbp + 0x30], rax
lea rax, str.Please__select_a_folder
mov qword [rbp + 0x38], rax
mov dword [rbp + 0x40], r14d
mov qword [rbp + 0x48], r14
mov qword [rbp + 0x50], r14
mov dword [rbp + 0x58], 0xffffffff
lea rcx, [rbp + 0x20]
call qword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
test rax, rax
je 0x1400e2a6d
lea rdx, [rbp + 0x60]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t_]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CFileDialog::SetTemplate]
mov rdx, rax
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x48], rax
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t_]
mov rbx, rax
mov qword [rsp + 0x68], rax
call sub.mfc140u.dll_AfxFieldText
mov rcx, qword [rax + 8]
add rcx, 0x2b8
mov rdx, rbx
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
mov rcx, rbx
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x78]
jmp 0x1400e7731
lea rdx, str.You_have_cancelled_the_process__Please_exit_the_solution_by_clicking_on_the_cross_Button
lea rcx, [rsp + 0x40]
jmp 0x1400e569f
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.CreateRegKey
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e2eba
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftOffice16.0ExcelSecurity
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + 0x70], r14d
test eax, eax
jne 0x1400e7737
mov dword [rbp - 0x4c], r14d
mov dword [rbp - 0x40], 4
mov dword [rbp - 0x28], 0x3ff
lea rax, [rbp - 0x28]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x4c]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x40]
xor r8d, r8d
lea rdx, str.ExtensionHardening
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r15d, eax
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
mov rdx, rax
lea rcx, [rbp - 0x60]
call fcn.1400f6d10
nop
lea rdx, str.Temp
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rbp - 0x50], 0x200006
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov rdx, r14
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, str.BackupValue.txt
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rbp - 0x50], 0x400006
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov rdx, r14
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rbx, rax
lea rax, [0x140149418]
mov qword [rbp + 0x60], rax
lea rcx, [rbp + 0x108]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
mov dword [rbp - 0x50], 0x800006
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x68]
lea rcx, [rbp + 0x60]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
nop
mov rax, qword [rbp + 0x60]
movsxd rcx, dword [rax + 4]
lea rdi, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x60], rdi
mov rax, qword [rbp + 0x60]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x5c], edx
lea rax, [rbp + 0x68]
mov qword [rsp + 0x48], rax
lea rcx, [rbp + 0x68]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
lea rax, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rbp + 0x68], rax
mov byte [rbp + 0xe4], 0
mov byte [rbp + 0xd9], 0
lea rcx, [rbp + 0x68]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
xor ecx, ecx
mov qword [rbp + 0xe8], rcx
mov rax, qword [0x1401d7ba8]
mov qword [rbp + 0xdc], rax
mov qword [rbp + 0xd0], rcx
lea r9d, [rcx + 0x40]
lea r8d, [rcx + 2]
mov rdx, rbx
lea rcx, [rbp + 0x68]
call fcn.1400fd1d0
test rax, rax
jne 0x1400e2db1
mov rax, qword [rbp + 0x60]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x60]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
mov rax, qword [rbp + 0x60]
movsxd rcx, dword [rax + 4]
test byte [rbp + rcx + 0x70], 6
jne 0x1400e2def
lea rcx, [rbp + 0x60]
test r15d, r15d
jne 0x1400e2de3
lea rdx, str.The_Original_value_of_ExtensionHardening_is_:
call fcn.140099350
mov rcx, rax
mov edx, dword [rbp - 0x4c]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
jmp 0x1400e2def
lea rdx, str.The_key_ExtensionHardening_is_not_present
call fcn.140099350
lea rcx, [rbp + 0x68]
call fcn.1400107d0
test rax, rax
jne 0x1400e2e19
mov rax, qword [rbp + 0x60]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x60]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.ExtensionHardening
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rax, qword [rbp + 0x60]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x60], rdi
mov rax, qword [rbp + 0x60]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x5c], edx
lea rcx, [rbp + 0x68]
call fcn.14000e450
lea rcx, [rbp + 0x70]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x108]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x70]
jmp 0x1400e7731
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.updateSymantec
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e3006
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rdx, str.AnakageFilesVBScriptsSymantecLiveUpdate.bat
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x40]
call fcn.1400f7b40
nop
lea r8, [rbp - 0x70]
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140006190
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x48], rax
lea rdx, [0x140144758]
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rbx, rax
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
nop
xor r8d, r8d
mov rdx, rbx
mov rcx, rax
call fcn.140101190
call sub.mfc140u.dll_AfxFieldText
mov rcx, qword [rax + 8]
cmp dword [rcx + 0x2d0], 0
jne 0x1400e2fda
lea rdx, str.You_have_cancelled_the_process__so_problem_might_not_be_resolved._Please_contact_IT_Support_team.
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rdx, rax
mov rcx, r13
call fcn.14006cef0
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x30]
jmp 0x1400e7731
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.CheckDefaultEmailAppIsOutlook
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e313f
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rdx, str.HKEY_CURRENT_USERSoftwareMicrosoftWindowsShellAssociationsUrlAssociationsmailtoUserChoice
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rdx, [rbp - 0x68]
lea rcx, [rsp + 0x78]
call fcn.1400f66f0
mov qword [rbp - 0x60], rax
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400e3113
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x2f0]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x2f0]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0xffff
lea r8, str.ProgId
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
jmp 0x1400e7731
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.LaunchMirrorOP
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e31ea
call fcn.1400ec8e0
movzx ebx, al
lea rdx, str.C:Program_FilesMirrorOpMirrorOp.exe
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
cmp bl, 1
jne 0x1400e31b7
lea rdx, str.C:Program_Files__x86_MirrorOpMirrorOp.exe
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r8, rax
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r14
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rbp - 0x68]
jmp 0x1400e7731
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.CloseChrome
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e32c5
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rdx, str.taskkill__F__IM_chrome.exe__T
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.1400f5c80
nop
mov rdx, rax
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x48], rax
lea rdx, [rbp - 0x68]
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
mov rbx, rax
lea rdx, str.closing_chrome_browser_forcefully
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
mov r8d, 0xffffffff
mov rdx, rbx
mov rcx, rax
call fcn.1401028d0
nop
lea rcx, [rbp - 0x68]
jmp 0x1400e7731
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.CloseZoom
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e33a0
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rdx, str.taskkill__F__IM_Zoom.exe__T
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.1400f5c80
nop
mov rdx, rax
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x48], rax
lea rdx, [rbp - 0x68]
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
mov rbx, rax
lea rdx, str.closing_Zoom_meetings_forcefully
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
mov r8d, 0xffffffff
mov rdx, rbx
mov rcx, rax
call fcn.1401028d0
nop
lea rcx, [rbp - 0x68]
jmp 0x1400e7731
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.Closeoutlook
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e347b
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rdx, str.taskkill__F__IM_outlook.exe__T
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.1400f5c80
nop
mov rdx, rax
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x48], rax
lea rdx, [rbp - 0x68]
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
mov rbx, rax
lea rdx, str.closing_outlook_meetings_forcefully
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
mov r8d, 0xffffffff
mov rdx, rbx
mov rcx, rax
call fcn.1401028d0
nop
lea rcx, [rbp - 0x68]
jmp 0x1400e7731
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.Zoom
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e36f7
lea rdx, [0x140145960]
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t_]
nop
lea rdx, str.Zoom_binzoom.exe
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rdx, [0x140144758]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.1400f6d10
nop
lea r8, [rbp - 0x70]
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.140006190
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea r8, str.Roaming
lea rdx, str.Local
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCToolBar::RebuildAccelerationKeys]
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
mov rcx, rax
call fcn.1400f5220
test al, al
jne 0x1400e366a
lea rdx, str.C:Program_Files__x86_Zoom_binzoom.exe
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
mov rcx, rax
call fcn.1400f5220
cmp al, 1
jne 0x1400e35cd
lea rdx, str.C:_Program_Files__x86__Zoom_binzoom.exe
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t_]
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1400f5c80
nop
mov rdx, rax
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
jmp 0x1400e3698
xor r8d, r8d
lea rdx, str.Program_Files__x86_
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x1400e36a3
lea r8, str.Program_Files
lea rdx, str.Program_Files__x86_
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCToolBar::RebuildAccelerationKeys]
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
mov rcx, rax
call fcn.1400f5220
lea rcx, [rbp - 0x80]
cmp al, 1
jne 0x1400e3650
lea rdx, str.C:_Program_Files_Zoom_binzoom.exe
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t_]
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1400f5c80
nop
mov rdx, rax
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
jmp 0x1400e3698
lea rdx, str.We_are_not_able_to_find_zoom_application_in_your_system._Please_close_the_solution_and_contact_HelpDesk.
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t_]
mov rdx, rax
mov rcx, r13
call fcn.14006cef0
jmp 0x1400e36a3
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1400f5c80
nop
mov rdx, rax
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x48], rax
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
mov rbx, rax
lea rdx, str.Checking_zoom_meeting_opening_request:
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
mov r8d, 0xffffffff
mov rdx, rbx
mov rcx, rax
call fcn.1401028d0
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x48]
jmp 0x1400e7731
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.CloseIE
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e37d2
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rdx, str.taskkill__F__IM_iexplore.exe__T
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.1400f5c80
nop
mov rdx, rax
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x48], rax
lea rdx, [rbp - 0x68]
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
mov rbx, rax
lea rdx, str.closing_Internet_explorer_forcefully
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
mov r8d, 0xffffffff
mov rdx, rbx
mov rcx, rax
call fcn.1401028d0
nop
lea rcx, [rbp - 0x68]
jmp 0x1400e7731
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.systemRestart
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e38ad
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rdx, str.shutdown__r__t_600
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.1400f5c80
nop
mov rdx, rax
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x48], rax
lea rdx, [rbp - 0x68]
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
mov rbx, rax
lea rdx, str.Restarting_machine_in_a_time_interval_of_10_minutes
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
mov r8d, 0xffffffff
mov rdx, rbx
mov rcx, rax
call fcn.1401028d0
nop
lea rcx, [rbp - 0x68]
jmp 0x1400e7731
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.symantecManualUpdate
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e39da
lea rdx, str.AnakageFilesVBScriptsSymantecManualUpdate.bat
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x40]
call fcn.1400f7b40
mov r14, rax
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov dword [rbp - 0x50], 0x4000006
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r14
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r14
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x48], rax
lea rdx, [0x140144758]
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rbx, rax
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
nop
xor r8d, r8d
mov rdx, rbx
mov rcx, rax
call fcn.140101190
nop
lea rcx, [rsp + 0x78]
jmp 0x1400e7731
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.officeRepair
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e482c
lea rcx, [rbp - 0x38]
call fcn.1400e9c90
nop
call fcn.1400ecba0
movzx r13d, al
call fcn.1400ec8e0
movzx r12d, al
lea rcx, [rbp - 0x40]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rbp - 0x28]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rbp - 0x38]
call qword [sym.imp.mfc140u.dll_CPngImage::LoadFromBuffer]
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CPngImage::LoadFromBuffer]
mov rcx, rax
lea rdx, str.office
call fcn.14000ca00
test al, al
je 0x1400e418d
lea rdx, str.AnakageFilesVBScriptsOfficeConfig.xml
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x40]
call fcn.1400f7b40
mov r15, rax
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rbp - 0x50], 0x8000006
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov rdx, r14
lea rcx, [rbp - 0x28]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, [0x1401456c0]
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rdx, [0x1401456c0]
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r15, rax
mov dword [rbp - 0x50], 0x10000006
lea rcx, [rbp - 0x28]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rbp - 0x28]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
nop
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rbp - 0x50], 0x30000006
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov rdx, r14
lea rcx, [rbp - 0x28]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
xor r8d, r8d
lea rdx, str.office15
lea rcx, [rbp - 0x38]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x1400e3c9d
lea rdx, str.office13
jmp 0x1400e3cfe
xor r8d, r8d
lea rdx, [0x140177730]
lea rcx, [rbp - 0x38]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x1400e3cbe
lea rdx, str.office16
jmp 0x1400e3cfe
xor r8d, r8d
lea rdx, str.office14
lea rcx, [rbp - 0x38]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x1400e3cdf
lea rdx, str.office10
jmp 0x1400e3cfe
xor r8d, r8d
lea rdx, [0x140177780]
lea rcx, [rbp - 0x38]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x1400e3d08
lea rdx, str.office12
lea rcx, [rbp - 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
xor r8d, r8d
lea rdx, str.root
lea rcx, [rbp - 0x38]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
lea rcx, [rbp - 0x60]
test eax, eax
lea rdx, str.ClickToRun
jns 0x1400e3d32
lea rdx, [0x1401777b4]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, [0x1401777b4]
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e3f1e
lea rcx, [rbp - 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.office13
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rbp - 0x40]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e3dd4
lea rdx, str.C:Program_FilesCommon_Filesmicrosoft_sharedOFFICE15Office_Setup_ControllerSetup.exe
jmp 0x1400e3ef0
lea rcx, [rbp - 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.office16
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rbp - 0x40]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e3e26
lea rdx, str.C:Program_FilesCommon_Filesmicrosoft_sharedOFFICE16Office_Setup_ControllerSetup.exe
jmp 0x1400e3ef0
lea rcx, [rbp - 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.office10
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rbp - 0x40]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e3e75
lea rdx, str.C:Program_FilesCommon_Filesmicrosoft_sharedOFFICE14Office_Setup_ControllerSetup.exe
jmp 0x1400e3ef0
lea rcx, [rbp - 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.office12
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rbp - 0x40]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e3efb
lea rdx, str.C:Program_Files__x86_Common_FilesMicrosoft_SharedOFFICE12Office_Setup_ControllerSETUP.EXE
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
mov rcx, rax
call fcn.1400f5220
test al, al
jne 0x1400e3efb
lea rdx, str.C:Program_FilesCommon_FilesMicrosoft_SharedOFFICE12Office_Setup_ControllerSETUP.EXE
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
test r13b, r13b
je 0x1400e3f1e
test r12b, r12b
je 0x1400e3f1e
lea r8, str.Program_Files__x86_
lea rdx, str.Program_Files
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCToolBar::RebuildAccelerationKeys]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
mov rcx, rax
call fcn.1400f5220
test al, al
je 0x1400e4147
lea rdx, [0x1401456c0]
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rdx, [0x1401456c0]
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r15, rax
mov dword [rbp - 0x50], 0x40000006
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
nop
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rbp - 0x50], 0xc0000006
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov rdx, r14
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, str.__repair_standard__config
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_COleCurrency::operator]
lea r8, [rbp - 0x28]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x78]
call fcn.140006190
nop
lea rax, [rsp + 0x40]
mov qword [rsp + 0x48], rax
lea rdx, [0x1401486fc]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rbx, rax
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
nop
mov r8d, 0xffffffff
mov rdx, rbx
mov rcx, rax
call fcn.1401028d0
lea rdx, str.C:windowsiassistlogsAnk.bat
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rcx, rax
lea rdx, [0x14014b5a4]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
mov rbx, rax
test rax, rax
je 0x1400e4127
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov rcx, rbx
call fcn.140038ae0
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov ecx, 0x88
call fcn.1400f2050
nop
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x78]
jmp 0x1400e47ef
lea rax, [rsp + 0x40]
mov qword [rsp + 0x48], rax
lea rdx, str.NotFound
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rbx, rax
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
nop
mov r8d, 0xffffffff
mov rdx, rbx
mov rcx, rax
call fcn.1401028d0
jmp 0x1400e47f6
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CPngImage::LoadFromBuffer]
mov rcx, rax
lea rdx, str.skype
call fcn.14000ca00
test al, al
je 0x1400e47f6
lea rdx, str.AnakageFilesVBScriptsSkypeConfig.xml
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x58]
call fcn.1400f7b40
mov r15, rax
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rbp - 0x4c], 2
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov rdx, r14
lea rcx, [rbp - 0x28]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, [0x1401456c0]
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rdx, [0x1401456c0]
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r15, rax
mov dword [rbp - 0x4c], 4
lea rcx, [rbp - 0x28]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rbp - 0x28]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
nop
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rbp - 0x4c], reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov rdx, r14
lea rcx, [rbp - 0x28]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rdx, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionApp_PathsLync.EXEPath
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
lea rdx, [rbp - 0x48]
mov rcx, rax
call fcn.1400eae00
test eax, eax
jne 0x1400e47d3
lea rax, [rsp + 0x58]
mov qword [rsp + 0x68], rax
lea rdx, [rbp - 0x48]
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
mov rbx, rax
lea rdx, str.Office_Lync_Path
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
mov r8d, 0xffffffff
mov rdx, rbx
mov rcx, rax
call fcn.1401028d0
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_CPngImage::LoadFromBuffer]
mov rcx, rax
xor r8d, r8d
lea rdx, [0x140177730]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x1400e4446
lea rdx, str.C:Program_FilesCommon_Filesmicrosoft_sharedOFFICE16Office_Setup_Controller_setup.exe
jmp 0x1400e4498
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_CPngImage::LoadFromBuffer]
mov rcx, rax
xor r8d, r8d
lea rdx, str.office15
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x1400e4470
lea rdx, str.C:Program_FilesCommon_Filesmicrosoft_sharedOFFICE15Office_Setup_Controller_setup.exe
jmp 0x1400e4498
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_CPngImage::LoadFromBuffer]
mov rcx, rax
xor r8d, r8d
lea rdx, str.office14
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x1400e44a3
lea rdx, str.C:Program_FilesCommon_Filesmicrosoft_sharedOFFICE14Office_Setup_Controller_setup.exe
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
test r13b, r13b
je 0x1400e44c6
test r12b, r12b
je 0x1400e44c6
lea r8, str.Program_Files__x86
lea rdx, str.Program_Files
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCToolBar::RebuildAccelerationKeys]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
mov rcx, rax
call fcn.1400f5220
test al, al
je 0x1400e4792
lea rdx, [0x1401456c0]
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rdx, [0x1401456c0]
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r15, rax
mov dword [rbp - 0x4c], 0x10
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
nop
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rbp - 0x4c], gethostbyname
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov rdx, r14
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, str.__repair_Lync__config
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_COleCurrency::operator]
lea r8, [rbp - 0x28]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x78]
call fcn.140006190
nop
lea rax, [rbp - 0x58]
mov qword [rbp - 0x70], rax
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
mov rbx, rax
lea rdx, str.CommandToRun_with_xml_file
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
mov r8d, 0xffffffff
mov rdx, rbx
mov rcx, rax
call fcn.1401028d0
lea rax, [rsp + 0x68]
mov qword [rbp - 0x80], rax
lea rdx, [0x1401486fc]
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rbx, rax
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
nop
mov r8d, 0xffffffff
mov rdx, rbx
mov rcx, rax
call fcn.1401028d0
lea rdx, str.Ank.bat
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x68]
call fcn.1400fa2b0
nop
lea r8, [rsp + 0x58]
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140006190
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rcx, rax
lea rdx, [0x14014b5a4]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
mov rbx, rax
test rax, rax
je 0x1400e473e
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov rcx, rbx
call fcn.140038ae0
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
lea rax, [rbp - 0x58]
mov qword [rbp - 0x70], rax
lea rdx, [0x140144758]
lea rcx, [rbp - 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rbx, rax
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
nop
xor r8d, r8d
mov rdx, rbx
mov rcx, rax
call fcn.140101190
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x1400e47d3
lea rax, [rsp + 0x68]
mov qword [rsp + 0x58], rax
lea rdx, str.NotFound
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rbx, rax
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
nop
mov r8d, 0xffffffff
mov rdx, rbx
mov rcx, rax
call fcn.1401028d0
nop
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x28]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x38]
jmp 0x1400e7731
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.deleteRegistry
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e488f
lea rdx, str.SoftwareSymantecPKI_Client
mov rcx, 0xffffffff80000001
call fcn.1400ee6f0
jmp 0x1400e7737
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.regset
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e4aed
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.officedisablehardwareaccl
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e4a35
mov qword [rbp - 0x18], r14
mov dword [rbp - 0x10], r14d
mov qword [rbp - 8], r14
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rsp + 0x48]
call fcn.1400fa4c0
nop
mov rdx, rax
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, str.commongraphics
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_COleCurrency::operator]
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r8, rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r14d
xor r9d, r9d
mov rdx, 0xffffffff80000001
lea rcx, [rbp - 0x18]
call fcn.1400dd030
test eax, eax
je 0x1400e49c9
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x1400e49c5
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x18], r14
mov dword [rbp - 0x10], r14d
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r8, rax
mov rdx, 0xffffffff80000001
mov r9d, 0x2001f
lea rcx, [rbp - 0x18]
call fcn.1400ed6b0
mov rbx, qword [rbp - 0x18]
test eax, eax
jne 0x1400e4a25
mov dword [rsp + 0x70], r12d
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.DisableHardwareAcceleration
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
jmp 0x1400e6536
xor r8d, r8d
lea rdx, [0x1401567c0]
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov ebx, eax
mov r8d, eax
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CStringList::InsertBefore]
nop
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
sub eax, ebx
lea r8d, [rax - 1]
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_12600]
nop
lea rax, [rsp + 0x48]
mov qword [rbp - 0x80], rax
lea rax, [rsp + 0x68]
mov qword [rbp - 0x70], rax
lea rdx, str.DWORD
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rdi, rax
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
mov rbx, rax
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
nop
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call fcn.1400d8ee0
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
jmp 0x1400e7731
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.regstringset
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e4bf4
xor r8d, r8d
lea rdx, [0x1401567c0]
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov ebx, eax
mov r8d, eax
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CStringList::InsertBefore]
nop
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
sub eax, ebx
lea r8d, [rax - 1]
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_12600]
nop
lea rax, [rsp + 0x48]
mov qword [rbp - 0x80], rax
lea rax, [rsp + 0x68]
mov qword [rbp - 0x70], rax
lea rdx, str.string
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rdi, rax
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
mov rbx, rax
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
nop
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call fcn.1400d8ee0
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
jmp 0x1400e7731
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.outlookSettingChange
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e50a5
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.enabledesktopnotificaion
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e4f15
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
mov qword [rbp - 0x18], r14
mov dword [rbp - 0x10], r14d
mov qword [rbp - 8], r14
lea rdx, str.OutlookPreferences
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x48]
call fcn.1400fa4c0
mov r15, rax
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rbp - 0x4c], 0x100
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov rdx, r14
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r8, rax
mov rdx, 0xffffffff80000001
mov r9d, 0x2001f
lea rcx, [rbp - 0x18]
call fcn.1400ed6b0
test eax, eax
jne 0x1400e4db8
mov dword [rsp + 0x70], r12d
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.NewmailDesktopAlerts
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rdx, str.OutlookOptionsReminders
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x48]
call fcn.1400fa4c0
mov r15, rax
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rbp - 0x4c], 0x200
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov rdx, r14
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r8, rax
mov rdx, 0xffffffff80000001
mov r9d, 0x2001f
lea rcx, [rbp - 0x18]
call fcn.1400ed6b0
mov rbx, qword [rbp - 0x18]
test eax, eax
jne 0x1400e4efd
mov dword [rsp + 0x70], r12d
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.PlaySound
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x70], r12d
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Type
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
test rbx, rbx
je 0x1400e4f0c
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rbp - 0x60]
jmp 0x1400e7731
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.AutoArchive
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e7737
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
mov qword [rbp - 0x18], r14
mov dword [rbp - 0x10], r14d
mov qword [rbp - 8], r14
lea rdx, str.OutlookPreferences
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x48]
call fcn.1400fa4c0
mov r15, rax
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rbp - 0x4c], 0x400
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov rdx, r14
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r8, rax
mov rdx, 0xffffffff80000001
mov r9d, 0x2001f
lea rcx, [rbp - 0x18]
call fcn.1400ed6b0
mov rbx, qword [rbp - 0x18]
test eax, eax
jne 0x1400e508d
xor ecx, ecx
mov dword [rsp + 0x70], ecx
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9d, [rcx + 4]
xor r8d, r8d
lea rdx, str.DoAging
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
test rbx, rbx
je 0x1400e509c
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rbp - 0x68]
jmp 0x1400e7731
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.runsep
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e514c
lea rcx, [rsp + 0x50]
call fcn.1400e9f30
nop
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
mov rcx, rax
call fcn.1400f5220
test al, al
je 0x1400e5142
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r8, rax
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r14
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rsp + 0x50]
jmp 0x1400e7731
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.regremoveduplicate
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e51b3
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
mov rcx, rax
call fcn.1400eeeb0
jmp 0x1400e7737
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.runreg
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e521a
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
mov rcx, rax
call fcn.1400ef250
jmp 0x1400e7737
lea rdx, str.MsTeam
lea rcx, [rsp + 0x60]
call fcn.14000ca00
test al, al
je 0x1400e538c
lea rdx, str.openteam
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
test rax, rax
je 0x1400e7737
lea rdx, str.AppDataLocalMicrosoftTeamscurrentTeams.exe
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rdx, [0x1401463f8]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x68]
call fcn.1400f8f70
nop
mov r8, rax
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x48]
call fcn.140006190
nop
lea r8, [rsp + 0x58]
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140006190
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rax, [rbp - 0x58]
mov qword [rbp - 0x68], rax
lea rdx, str.openteam__
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rdx, [0x1401486fc]
lea rcx, [rbp - 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rbx, rax
lea r8, [rsp + 0x50]
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x70]
call fcn.140006190
nop
mov r8d, 0xffffffff
mov rdx, rbx
mov rcx, rax
call fcn.1401028d0
nop
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r9, rax
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], r14
lea r8, [0x1401626f0]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rdx, str.success
mov rcx, qword [rbp + 8]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x1400e7749
lea rdx, str.recentfolder
lea rcx, [rsp + 0x60]
call fcn.14000ca00
test al, al
je 0x1400e545f
lea rdx, str.Recent
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rdx, str.c:users_
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x68]
call fcn.1400f8f70
nop
mov r8, rax
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x48]
call fcn.140006190
nop
lea r8, [rsp + 0x58]
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.140006190
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r9, rax
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], r14
lea r8, [0x1401626f0]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x1400e772d
lea rdx, str.regreadanddelete
lea rcx, [rsp + 0x60]
call fcn.14000ca00
test al, al
je 0x1400e55c7
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rdx, str.OutlookSecurityOutlookSecureTempFolder
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rdx, str.HKEY_CURRENT_USER_
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x68]
call fcn.1400fa4c0
nop
mov r8, rax
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x48]
call fcn.140006190
nop
lea r8, [rsp + 0x58]
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.140006190
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rax, [rbp - 0x58]
mov qword [rbp - 0x68], rax
lea rcx, [rbp - 0x58]
call fcn.1400fa4c0
mov rbx, rax
lea rdx, str.Outlook_version_found
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
mov r8d, 0xffffffff
mov rdx, rbx
mov rcx, rax
call fcn.1401028d0
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
lea rdx, [rsp + 0x78]
mov rcx, rax
call fcn.1400eae00
test eax, eax
jne 0x1400e55b2
lea rax, [rbp - 0x58]
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
mov rbx, rax
lea rdx, str.Outlook_temp_folder_location
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
mov r8d, 0xffffffff
mov rdx, rbx
mov rcx, rax
call fcn.1401028d0
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rcx, rax
call fcn.1400dd450
nop
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x78]
jmp 0x1400e7731
lea rdx, [0x140176418]
lea rcx, [rsp + 0x60]
call fcn.14000ca00
test al, al
je 0x1400e56b5
lea rdx, [0x140144758]
lea rcx, [rbp - 0x78]
call fcn.140041590
test al, al
je 0x1400e563f
xor r8d, r8d
lea rdx, str.Program_Files__x86_
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x1400e563f
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
mov rcx, rax
call fcn.1400f5220
test al, al
jne 0x1400e563f
lea r8, str.Program_Files
lea rdx, str.Program_Files__x86_
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CMFCToolBar::RebuildAccelerationKeys]
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
mov rcx, rax
call fcn.1400f5220
lea rcx, [rbp - 0x78]
cmp al, 1
jne 0x1400e567b
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r9, rax
mov dword [rsp + 0x28], 3
lea r8, str.notepad.exe
jmp 0x1400e5f2b
xor r8d, r8d
lea rdx, str.vpncl
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x1400e7737
lea rdx, str.It_looks_like_Cisco_VPN_Client_is_not_installed_on_your_system._Please_contact_helpdesk.
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rdx, rax
mov rcx, r13
call fcn.14006cef0
jmp 0x1400e7737
lea rdx, str.explorefile
lea rcx, [rsp + 0x60]
call fcn.14000ca00
test al, al
je 0x1400e57a3
lea rdx, [r13 + 0x250]
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
nop
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
mov rcx, rax
call fcn.1400f5220
test al, al
jne 0x1400e576b
lea r8, str.Program_Files
lea rdx, str.Program_Files__x86_
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CMFCToolBar::RebuildAccelerationKeys]
xor r8d, r8d
lea rdx, str..exe
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
jle 0x1400e576b
xor r8d, r8d
lea rdx, str.Microsoft_Office
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
jle 0x1400e576b
lea rcx, [rsp + 0x48]
call fcn.1400e9c10
nop
mov rdx, rax
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r9, rax
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r14
lea r8, [0x1401626f0]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rsp + 0x78]
jmp 0x1400e7731
lea rdx, str.renamefolder
lea rcx, [rsp + 0x60]
call fcn.14000ca00
test al, al
je 0x1400e581a
lea rax, [rsp + 0x48]
mov qword [rsp + 0x58], rax
lea rdx, [0x140144758]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rbx, rax
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1400eb900
nop
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
mov rcx, rax
call fcn.1400ffd30
nop
lea rcx, [rsp + 0x40]
jmp 0x1400e7731
lea rdx, str.InternetConnection
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
test eax, eax
jne 0x1400e5879
lea rdx, str.C:WindowsSystem32control.exe_Inetcpl.cpl_Connections_1
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t_]
nop
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.1400f5c80
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
jmp 0x1400e7731
lea rdx, str.renamefolderDeleteFiles
lea rcx, [rsp + 0x60]
call fcn.14000ca00
test al, al
je 0x1400e5943
lea rax, [rsp + 0x48]
mov qword [rsp + 0x58], rax
lea rdx, [0x140144758]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rbx, rax
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1400eb900
nop
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
mov rcx, rax
call fcn.1400ffd30
lea rdx, str.Tracing
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x58]
call fcn.140006190
nop
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rcx, rax
call fcn.1400ddd80
nop
lea rcx, [rbp - 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x50]
jmp 0x1400e7731
lea rdx, str.runvbscript
lea rcx, [rsp + 0x60]
call fcn.14000ca00
test al, al
je 0x1400e5a96
lea rdx, [0x14015a550]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x68]
call fcn.1400f7b40
nop
lea r8, [rsp + 0x40]
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140006190
nop
lea r8, [rbp - 0x78]
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140006190
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, str.updateinventory.vbs
lea rcx, [rbp - 0x78]
call fcn.14000ca00
test al, al
je 0x1400e5a51
lea rdx, str.Accenture_Workstation_Security_ComplianceScripts_
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rbp - 0x70]
call fcn.1400f7b40
nop
lea r8, [rsp + 0x58]
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.140006190
nop
lea r8, [rbp - 0x78]
mov rdx, rax
lea rcx, [rbp - 0x58]
call fcn.140006190
nop
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rbp - 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rax, [rbp - 0x58]
mov qword [rbp - 0x80], rax
lea rdx, [0x140144758]
lea rcx, [rbp - 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rbx, rax
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
nop
mov r8, rbx
mov dl, 1
mov rcx, rax
call fcn.1400ef3a0
nop
lea rcx, [rsp + 0x50]
jmp 0x1400e7731
lea rdx, str.deletefolder
lea rcx, [rsp + 0x60]
call fcn.14000ca00
test al, al
je 0x1400e5e00
lea rdx, [0x140144758]
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rdx, [0x140144758]
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rdx, str.prefetch
lea rcx, [rbp - 0x78]
call fcn.14000ca00
test al, al
je 0x1400e5aff
lea rdx, str.C:WindowsPrefetch_
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
jmp 0x1400e5dc7
lea rdx, str.windowstemp
lea rcx, [rbp - 0x78]
call fcn.14000ca00
test al, al
je 0x1400e5b2a
lea rdx, str.C:WindowsTemp_
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
jmp 0x1400e5dc7
lea rdx, str.recyclebin
lea rcx, [rbp - 0x78]
call fcn.14000ca00
test al, al
je 0x1400e5b5c
xor ecx, ecx
call fcn.1400de9e0
lea rdx, str.NULL
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
jmp 0x1400e5dc7
lea rdx, str.msteam
lea rcx, [rbp - 0x78]
call fcn.14000ca00
test al, al
je 0x1400e5c2b
lea rdx, str.AppDataRoamingMicrosoftTeams
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rdx, [0x1401463f8]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rbp - 0x58]
call fcn.1400f8f70
nop
mov r8, rax
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x68]
call fcn.140006190
nop
lea r8, [rsp + 0x58]
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140006190
nop
mov rdx, rax
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rcx, rax
call fcn.1400de060
jmp 0x1400e5dc7
lea rdx, str.usertemp
lea rcx, [rbp - 0x78]
call fcn.14000ca00
test al, al
je 0x1400e5c8e
lea rdx, [rbp + 0x60]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t_]
nop
mov rdx, rax
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, [0x140149430]
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
jmp 0x1400e5dc7
lea rdx, str.PTCTempFolder
lea rcx, [rbp - 0x78]
call fcn.14000ca00
test al, al
je 0x1400e5d46
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1400f6d10
nop
lea r8, str.Roaming
lea rdx, str.Local
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCToolBar::RebuildAccelerationKeys]
lea rdx, str.PTCProENGINEERWildfire.wf
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x68]
call fcn.140006190
nop
mov rdx, rax
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
jmp 0x1400e5dbc
lea rdx, str.outlookCache
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
test eax, eax
jne 0x1400e5dc7
lea rdx, [0x140185558]
lea rcx, [rsp + 0x58]
call fcn.1400f8f00
nop
lea rdx, str.MicrosoftOutlookRoamCache
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x48]
call fcn.140006190
nop
mov rdx, rax
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rbx, rax
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rcx, rax
mov rdx, rbx
call fcn.1400dd730
nop
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x70]
jmp 0x1400e7731
lea rdx, str.PrintDemo
lea rcx, [rsp + 0x60]
call fcn.14000ca00
test al, al
je 0x1400e5ec2
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rdx, str.AnakageFilesSelfHealSolutionsiassist_
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rbp - 0x58]
call fcn.1400f7b40
nop
lea r8, [rsp + 0x40]
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140006190
nop
lea r8, [rbp - 0x78]
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140006190
nop
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rcx, rax
call fcn.1400edf50
nop
lea rcx, [rsp + 0x50]
jmp 0x1400e7731
lea rdx, str.addsite
lea rcx, [rsp + 0x60]
call fcn.14000ca00
test al, al
je 0x1400e5ef6
lea rdx, [0x140144b88]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rcx, rax
call fcn.1400f1a40
jmp 0x1400e7737
lea rdx, str.sccm
lea rcx, [rsp + 0x60]
call fcn.14000ca00
test al, al
je 0x1400e5f44
lea rcx, str.start_control_smscfgrc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov dword [rsp + 0x28], r12d
lea r9, str.control_smscfgrc
lea r8, str.control.exe
mov qword [rsp + 0x20], r14
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x1400e7737
lea rdx, str.openExplorer
lea rcx, [rsp + 0x60]
call fcn.14000ca00
test al, al
je 0x1400e60be
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
mov rdx, rax
lea rcx, [rbp - 0x38]
call fcn.1400f6d10
nop
lea rdx, str.win10
lea rcx, [rbp - 0x78]
call fcn.14000ca00
test al, al
je 0x1400e5fd0
lea rdx, str.MicrosoftWindowsINetCache
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea r8, [rsp + 0x40]
lea rdx, [rbp - 0x38]
lea rcx, [rsp + 0x68]
call fcn.140006190
nop
mov rdx, rax
lea rcx, [rbp - 0x38]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
jmp 0x1400e6025
lea rdx, str.win7
lea rcx, [rbp - 0x78]
call fcn.14000ca00
test al, al
je 0x1400e6030
lea rdx, str.MicrosoftWindowsTemporary_Internet_Files
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea r8, [rsp + 0x40]
lea rdx, [rbp - 0x38]
lea rcx, [rsp + 0x68]
call fcn.140006190
nop
mov rdx, rax
lea rcx, [rbp - 0x38]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x58]
mov qword [rsp + 0x58], rax
lea rdx, [rbp - 0x38]
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
mov rdi, rax
lea rdx, str.Internet_explorer_path
lea rcx, [rbp - 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rbx, rax
call sub.mfc140u.dll_AfxFieldText
nop
mov r9d, 0xffffffff
mov r8, rdi
mov rdx, rbx
mov rcx, qword [rax + 8]
call fcn.140058bf0
lea rcx, [rbp - 0x38]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r9, rax
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], r14
lea r8, [0x1401626f0]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rbp - 0x38]
jmp 0x1400e7731
lea rdx, str.renamefolderDeleteFiles
lea rcx, [rsp + 0x60]
call fcn.14000ca00
test al, al
je 0x1400e6188
lea rax, [rsp + 0x48]
mov qword [rsp + 0x58], rax
lea rdx, [0x140144758]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rbx, rax
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1400eb900
nop
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
mov rcx, rax
call fcn.1400ffd30
lea rdx, str.Tracing
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x58]
call fcn.140006190
nop
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rcx, rax
call fcn.1400ddd80
nop
lea rcx, [rbp - 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x50]
jmp 0x1400e7731
lea rdx, str.forgotNetworks
lea rcx, [rsp + 0x60]
call fcn.14000ca00
test al, al
je 0x1400e61e6
lea rdx, str.netsh_wlan_delete_profile_name_i
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.1400f5c80
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
jmp 0x1400e7731
lea rdx, str.openChrome
lea rcx, [rsp + 0x60]
call fcn.14000ca00
test al, al
je 0x1400e6368
lea rdx, [0x1401782ec]
lea rcx, [rbp - 0x78]
call fcn.140041590
test al, al
je 0x1400e62c1
lea rdx, [0x14015a550]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x68]
call fcn.1400f7b40
nop
lea r8, [rsp + 0x40]
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140006190
nop
lea r8, [rbp - 0x78]
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.140006190
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rax, [rbp - 0x58]
mov qword [rbp - 0x70], rax
lea rdx, [0x140144758]
lea rcx, [rbp - 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rbx, rax
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
nop
mov r8, rbx
mov dl, 1
mov rcx, rax
call fcn.1400ef3a0
nop
lea rcx, [rsp + 0x58]
jmp 0x1400e7731
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.1400f6d10
nop
lea rdx, str._GoogleChromeUser_DataDefault
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x68]
call fcn.140006190
nop
mov rdx, rax
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r9, rax
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], r14
lea r8, [0x1401626f0]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rsp + 0x78]
jmp 0x1400e7731
lea rdx, str.applicationiconsetting
lea rcx, [rsp + 0x60]
call fcn.14000ca00
lea rcx, [rbp - 0x78]
test al, al
je 0x1400e6443
lea rdx, [0x1401782ec]
call fcn.140041590
test al, al
je 0x1400e7737
lea rdx, [0x14015a550]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x68]
call fcn.1400f7b40
nop
lea r8, [rsp + 0x40]
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140006190
nop
lea r8, [rbp - 0x78]
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.140006190
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rax, [rbp - 0x58]
mov qword [rbp - 0x70], rax
lea rdx, [0x140144758]
lea rcx, [rbp - 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rbx, rax
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
nop
mov r8, rbx
mov dl, 1
mov rcx, rax
call fcn.1400ef3a0
nop
lea rcx, [rsp + 0x58]
jmp 0x1400e7731
lea rdx, str.HardwareAcceleration
call fcn.14000ca00
test al, al
je 0x1400e654d
mov qword [rbp - 0x18], r14
mov dword [rbp - 0x10], r14d
mov qword [rbp - 8], r14
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rsp + 0x48]
call fcn.1400fa4c0
nop
mov rdx, rax
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, str.CommonGraphics
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_COleCurrency::operator]
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r8, rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r14d
xor r9d, r9d
mov rdx, 0xffffffff80000001
lea rcx, [rbp - 0x18]
call fcn.1400dd030
mov rbx, qword [rbp - 0x18]
test eax, eax
je 0x1400e64f9
test rbx, rbx
je 0x1400e652a
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, r14
jmp 0x1400e652a
mov dword [rsp + 0x70], r14d
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.DisableHardwareAcceleration
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
test rbx, rbx
je 0x1400e7737
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400e7737
lea rdx, str.openLLFile
lea rcx, [rsp + 0x60]
call fcn.14000ca00
test al, al
jne 0x1400e7737
lea rdx, str.EdgeError
lea rcx, [rsp + 0x60]
call fcn.14000ca00
test al, al
je 0x1400e6605
lea rdx, str.MicrosoftEdgeUser_DataDefaultCache
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rdx, [0x140185558]
lea rcx, [rsp + 0x48]
call fcn.1400f8f00
nop
lea r8, [rsp + 0x40]
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.140006190
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r8, rax
mov edx, 0x3e8
lea rcx, [rbp + 0x4f0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea rcx, [rbp + 0x4f0]
call fcn.1400de060
nop
lea rcx, [rsp + 0x58]
jmp 0x1400e7731
lea rdx, str.openDigicertLogFile
lea rcx, [rsp + 0x60]
call fcn.14000ca00
test al, al
je 0x1400e66d8
lea rdx, str.DesktopDigitalCert_Logs.txt
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rdx, [0x1401463f8]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x68]
call fcn.1400f8f70
nop
mov r8, rax
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x48]
call fcn.140006190
nop
lea r8, [rsp + 0x58]
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.140006190
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r9, rax
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], r14
lea r8, [0x1401626f0]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x1400e772d
lea rdx, str.clearjavacache
lea rcx, [rsp + 0x60]
call fcn.14000ca00
test al, al
je 0x1400e67b3
lea rdx, str.SunJavaDeploymentcache
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rdx, [0x140144758]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.1400f6d10
nop
lea r8, [rsp + 0x40]
mov rdx, rax
lea rcx, [rbp - 0x60]
call fcn.140006190
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
xor r8d, r8d
lea rdx, str.Local
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x1400e677d
lea r8, str.LocalLow
lea rdx, str.Local
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CMFCToolBar::RebuildAccelerationKeys]
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
mov rcx, rax
call fcn.1400f5220
test al, al
je 0x1400e67aa
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rcx, rax
call fcn.1400de060
nop
lea rcx, [rbp - 0x60]
jmp 0x1400e7731
lea rdx, str.runcompliancevbscript
lea rcx, [rsp + 0x60]
call fcn.14000ca00
test al, al
je 0x1400e6876
lea rdx, str.Accenture_Workstation_Security_ComplianceScripts_
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x68]
call fcn.1400f7b40
nop
lea r8, [rsp + 0x40]
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140006190
nop
lea r8, [rbp - 0x78]
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.140006190
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rax, [rbp - 0x58]
mov qword [rbp - 0x70], rax
lea rdx, [0x140144758]
lea rcx, [rbp - 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rbx, rax
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
nop
mov r8, rbx
mov dl, 1
mov rcx, rax
call fcn.1400ef3a0
nop
lea rcx, [rsp + 0x58]
jmp 0x1400e7731
lea rdx, str.regnavigate
lea rcx, [rsp + 0x60]
call fcn.14000ca00
test al, al
je 0x1400e6895
call fcn.1400dd1a0
jmp 0x1400e7737
lea rdx, str.localappdataexplore
lea rcx, [rsp + 0x60]
call fcn.14000ca00
test al, al
je 0x1400e6937
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.1400f6d10
nop
lea rdx, str.PKI_Client
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x68]
call fcn.140006190
nop
mov rdx, rax
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rcx, rax
call fcn.1400de060
nop
lea rcx, [rsp + 0x78]
jmp 0x1400e7731
lea rdx, str.GetIPAndhostname
lea rcx, [rsp + 0x60]
call fcn.14000ca00
test al, al
je 0x1400e6ba1
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea r8, [rsp + 0x78]
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x30]
call fcn.1400eb4a0
call fcn.1400e8f10
mov rdx, rax
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
mov dword [rsp + 0x70], 0x208
lea r8, [rsp + 0x70]
lea rdx, [rbp + 0x60]
mov ecx, 3
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t_]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CFileDialog::SetTemplate]
mov rdx, rax
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
nop
lea rdx, str.ipandhostname
lea rcx, [rbp - 0x78]
call fcn.14000ca00
test al, al
je 0x1400e6ace
lea rdx, str._Click_on__NEXT_STEP__to_know_Domain
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rdx, [0x1401457e8]
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rdx, str.Your_Ip_Addressand_Host_Name_is
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea r8, [rbp - 0x68]
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x60]
call fcn.140006190
nop
lea r8, [rsp + 0x58]
mov rdx, rax
lea rcx, [rbp - 0x58]
call fcn.140006190
nop
lea r8, [rsp + 0x78]
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140006190
nop
lea r8, [rbp - 0x80]
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140006190
mov rdx, rax
mov rcx, r13
call fcn.14006cef0
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x80]
jmp 0x1400e6b58
lea rdx, str.DomainName
lea rcx, [rbp - 0x78]
call fcn.14000ca00
test al, al
je 0x1400e6b5f
lea rdx, str._Click_on__NEXT_STEP_
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rdx, str.Your_Domain_Name_is
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x68]
call fcn.140006190
nop
lea r8, [rsp + 0x58]
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140006190
mov rdx, rax
mov rcx, r13
call fcn.14006cef0
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x30]
jmp 0x1400e7731
lea rdx, str.Outlook_Print
lea rcx, [rsp + 0x60]
call fcn.14000ca00
test al, al
je 0x1400e6cba
lea rdx, str.MicrosoftOutlookoutlprnt
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rdx, [0x140185288]
lea rcx, [rsp + 0x48]
call fcn.1400f8f00
nop
lea r8, [rsp + 0x40]
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.140006190
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
mov rcx, rax
call fcn.1400f5220
movzx ebx, al
lea rdx, str..old
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x80]
call fcn.140006190
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test bl, bl
je 0x1400e6c7e
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rbx, rax
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wrename]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r14
lea r9, [0x140145960]
lea r8, str.outlook.exe
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x78]
jmp 0x1400e7731
lea rdx, str.Ciscojabber
lea rcx, [rsp + 0x60]
call fcn.14000ca00
test al, al
jne 0x1400e7737
lea rdx, [0x140178550]
lea rcx, [rsp + 0x60]
call fcn.14000ca00
test al, al
je 0x1400e6dff
call sub.mfc140u.dll_AfxFieldText
mov rdx, qword [rax + 8]
add rdx, 0x2b8
lea rcx, [rbp - 0x38]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
nop
lea rcx, [rbp - 0x38]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r8, rax
lea rdx, str.openselectedfolder
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCToolBar::RebuildAccelerationKeys]
mov edx, 0x5c
lea rcx, [rbp - 0x38]
call qword [sym.imp.mfc140u.dll_COleControl::ReleaseCaches]
mov r8d, eax
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x38]
call qword [sym.imp.mfc140u.dll_CStringList::InsertBefore]
nop
mov rdx, rax
lea rcx, [rbp - 0x38]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rbp - 0x38]
call qword [sym.imp.mfc140u.dll_CFileDialog::SetTemplate]
lea rdx, [0x1401456c0]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea r8, [rbp - 0x38]
lea rdx, [0x14015fa98]
lea rcx, [rsp + 0x68]
call fcn.140099860
nop
lea r8, [rsp + 0x40]
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140006190
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r8, rax
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r14
lea r9, [0x140145960]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x38]
jmp 0x1400e7731
lea rdx, str.javacontrolpanel
lea rcx, [rsp + 0x60]
call fcn.14000ca00
test al, al
je 0x1400e6eb9
lea rdx, [0x140144758]
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x78]
call fcn.1400e9000
cmp eax, 1
jne 0x1400e6e7f
lea rdx, [0x140144758]
lea rcx, [rsp + 0x78]
call fcn.140041590
test al, al
je 0x1400e6eaf
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r8, rax
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r14
lea r9, [0x140145960]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x1400e6eaf
test eax, eax
jne 0x1400e6e8c
lea rdx, str._Java_Runtime__was_not_found_on_your_machine._Please_close_the_solution_and_contact_HelpDesk.
jmp 0x1400e6e98
cmp eax, 1
jle 0x1400e6eaf
lea rdx, str.More_than_one__Java_Runtime__was_found_on_your_machine._Please_run__Java__from_control_panel._Wait_for_it_to_load_and_then_click__NEXT_STEP_
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rdx, rax
mov rcx, r13
call fcn.14006cef0
nop
lea rcx, [rsp + 0x78]
jmp 0x1400e7731
lea rdx, str.customizedMessage
lea rcx, [rsp + 0x60]
call fcn.14000ca00
test al, al
je 0x1400e6f5e
call sub.mfc140u.dll_AfxFieldText
mov rdx, qword [rax + 8]
add rdx, 0x2b8
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
nop
call sub.mfc140u.dll_AfxFieldText
mov rdx, qword [rax + 8]
add rdx, 0x2c0
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
nop
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CFileDialog::SetTemplate]
mov rcx, rax
lea rdx, str.noteMsg
call fcn.14000ca00
lea rcx, [rsp + 0x48]
test al, al
lea rdx, [rsp + 0x40]
jne 0x1400e6f36
lea rdx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
mov rdx, rax
mov rcx, r13
call fcn.14006cef0
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
jmp 0x1400e7731
lea rdx, str.PrinterInformation
lea rcx, [rsp + 0x60]
call fcn.14000ca00
test al, al
je 0x1400e7517
call sub.mfc140u.dll_AfxFieldText
mov rcx, qword [rax + 8]
mov rdi, qword [rcx + 0x2d8]
lea rdx, str.Address
lea rcx, [rbp - 0x78]
call fcn.14000ca00
test al, al
je 0x1400e7138
lea rdx, [rsp + 0x78]
mov rcx, rdi
call fcn.1400c0230
nop
lea rcx, [rbp - 0x48]
call fcn.1400fa2b0
nop
lea rdx, [rdi + 0x90]
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
nop
lea rdx, [rdi + 0x90]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
nop
lea rdx, str.WIZARD
lea rcx, [rsp + 0x40]
call fcn.14000ca00
movzx ebx, al
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test bl, bl
je 0x1400e705a
lea rdx, [rdi + 0x88]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
nop
lea r8, [rsp + 0x40]
lea rdx, [0x140155030]
lea rcx, [rsp + 0x48]
call fcn.140099860
nop
mov rdx, rax
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_1667]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rsp + 0x78]
jmp 0x1400e70ee
lea rdx, str.location.txt
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_COleCurrency::operator]
lea rdx, [rbp - 0x48]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
mov rcx, rax
call fcn.1400f5220
test al, al
je 0x1400e709d
lea rdx, [rbp - 0x48]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
mov rcx, rax
call fcn.1400f5020
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rcx, rax
lea rdx, [0x1401457ec]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
mov rbx, rax
test rax, rax
je 0x1400e70d6
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputws]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov r8, rax
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x78]
jmp 0x1400e7731
lea rdx, str.displayName
lea rcx, [rbp - 0x78]
call fcn.14000ca00
test al, al
je 0x1400e7271
lea rdx, [rdi + 0x38]
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
nop
xor r8d, r8d
lea rdx, [0x140152fc4]
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov r8d, eax
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CStringList::InsertBefore]
nop
lea rdx, str.__printer_in_the_list_given_then_click_on__Next_._Click_on_NEXT_STEP.
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rdx, str._printer_manufacturers_and_then_select_this
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rdx, str.Please_Select_the_
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea r8, [rbp - 0x70]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.140006190
nop
lea r8, [rsp + 0x58]
mov rdx, rax
lea rcx, [rbp - 0x58]
call fcn.140006190
nop
lea r8, [rsp + 0x78]
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140006190
nop
lea r8, [rbp - 0x80]
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140006190
mov rdx, rax
mov rcx, r13
call fcn.14006cef0
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x78]
jmp 0x1400e7731
lea rdx, str.color
lea rcx, [rbp - 0x78]
call fcn.14000ca00
test al, al
je 0x1400e7319
lea rdx, [rdi + 0x30]
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
nop
lea rdx, str._Click_on__NEXT_STEP_
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rdx, str.Please_Change_the_color_configration_to
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea r8, [rbp - 0x80]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x68]
call fcn.140006190
nop
lea r8, [rsp + 0x58]
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140006190
mov rdx, rax
mov rcx, r13
call fcn.14006cef0
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
jmp 0x1400e772d
lea rdx, str.port
lea rcx, [rbp - 0x78]
call fcn.14000ca00
test al, al
je 0x1400e73c1
lea rdx, [rdi + 0x28]
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
nop
lea rdx, str._Click_on__NEXT_STEP_
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rdx, str.Please_set_the_port_number
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea r8, [rbp - 0x80]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x68]
call fcn.140006190
nop
lea r8, [rsp + 0x58]
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140006190
mov rdx, rax
mov rcx, r13
call fcn.14006cef0
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
jmp 0x1400e772d
lea rdx, str.ipAddress
lea rcx, [rbp - 0x78]
call fcn.14000ca00
test al, al
je 0x1400e746c
lea rdx, [rdi + 0xa0]
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
nop
lea rdx, str._and_Click_on__NEXT_STEP_
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rdx, str.Please_set_this_ip_address
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea r8, [rbp - 0x80]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x68]
call fcn.140006190
nop
lea r8, [rsp + 0x58]
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140006190
mov rdx, rax
mov rcx, r13
call fcn.14006cef0
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
jmp 0x1400e772d
lea rdx, str.driverName
lea rcx, [rbp - 0x78]
call fcn.14000ca00
test al, al
je 0x1400e7737
lea rdx, [rdi + 0x88]
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
nop
lea rdx, str._and_open_it_then_click_on__OK._._Click_on__NEXT_STEP_
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rdx, str.Please_find_the_this_driver
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea r8, [rbp - 0x80]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x68]
call fcn.140006190
nop
lea r8, [rsp + 0x58]
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140006190
mov rdx, rax
mov rcx, r13
call fcn.14006cef0
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
jmp 0x1400e772d
mov edi, r14d
call sub.mfc140u.dll_AfxFieldText
mov rdx, qword [rax + 8]
add rdx, 0x390
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
nop
xor r8d, r8d
lea rdx, str.msiexe
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
jns 0x1400e7595
xor r8d, r8d
lea rdx, str.control.exe
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
jns 0x1400e7595
xor r8d, r8d
lea rdx, str.olidays.exe
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
jns 0x1400e7595
xor r8d, r8d
lea rdx, str.ScnCfg32.exe
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
lea rdx, [0x140178900]
lea rcx, [rsp + 0x60]
call fcn.14000ca00
test al, al
je 0x1400e7638
lea rdx, [0x1401457e8]
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rdx, [r13 + 0x250]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
nop
lea r8, [rsp + 0x58]
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x68]
call fcn.140006190
nop
lea r8, [rsp + 0x40]
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140006190
nop
mov rdx, rax
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
xor r8d, r8d
lea rdx, [0x140178910]
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x1400e76f5
call sub.mfc140u.dll_AfxFieldText
mov rdx, qword [rax + 8]
add rdx, 0x2b8
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r8, rax
lea rdx, str.m_globalvar1
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CMFCToolBar::RebuildAccelerationKeys]
xor r8d, r8d
lea rdx, [0x140163b90]
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x1400e76e6
lea rdx, [0x14014b5a4]
lea rcx, str.C:Windowsiassistprinter.txt
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
mov rbx, rax
test rax, rax
je 0x1400e76dc
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputws]
mov edi, r12d
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test edi, edi
jne 0x1400e772d
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rbx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r8, rax
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r14
mov r9, rbx
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, str.success
mov rcx, qword [rbp + 8]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rbp]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x20]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov rax, qword [rbp + 8]
mov rcx, qword [rbp + 0xcc0]
xor rcx, rsp
call fcn.14010bb40
mov rbx, qword [rsp + 0xe20]
add rsp, 0xdd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret