Function at 0x1400094d8
Capabilities:
Enumerate gui resources

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
test rdx, rdx
je 0x14000960e
lea rcx, [0x140054370]
call fcn.14000381c
cmp rax, qword [rbx + 8]
je 0x14000960e
cmp dword [0x14005438c], 0
jne 0x140009607
cmp dword [rbx], 0x467
je 0x14000957b
cmp qword [0x1400543c0], 0
je 0x14000952f
mov rdx, rbx
call fcn.1400091a8
test al, al
jne 0x140009607
cmp byte [0x140054371], 0
je 0x14000957b
lea rcx, [0x140054370]
call fcn.14000381c
mov rcx, rax
mov edx, 0xfffffff0
call qword [sym.imp.USER32.dll_GetWindowLongW]
bt eax, 0x1d
jae 0x14000957b
lea rcx, [0x140054370]
call fcn.14000381c
mov rcx, rax
xor r9d, r9d
mov edx, VarUI4FromDisp
mov r8d, 0xf120
call qword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [rbx]
sub ecx, 0x465
je 0x140009600
sub ecx, 1
je 0x1400095f3
sub ecx, 1
je 0x1400095e9
sub ecx, 1
je 0x1400095dc
sub ecx, 1
je 0x1400095cf
sub ecx, 1
je 0x1400095c2
sub ecx, 1
je 0x1400095b5
cmp ecx, 1
jne 0x14000960e
mov rdx, rbx
add rsp, 0x20
pop rbx
jmp 0x14000a0d0
mov rdx, rbx
add rsp, 0x20
pop rbx
jmp 0x140009e54
mov rdx, rbx
add rsp, 0x20
pop rbx
jmp 0x140009d38
mov rdx, rbx
add rsp, 0x20
pop rbx
jmp 0x140009b90
mov rdx, rbx
add rsp, 0x20
pop rbx
jmp 0x140009a40
add rsp, 0x20
pop rbx
jmp 0x14000a1d0
mov rdx, rbx
add rsp, 0x20
pop rbx
jmp 0x140009708
add rsp, 0x20
pop rbx
jmp 0x140009618
mov eax, 1
jmp 0x140009610
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov r11, rsp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbp
push rbx
mov rbp, rsp
sub rsp, 0x78
xor ebx, ebx
mov byte [rbp + 0x21], bl
lea eax, [rbx + 2]
mov word [rbp - 0x48], ax
mov byte [rbp - 0x46], 1
mov byte [rbp + 0x19], bl
mov byte [rbp + 0x29], bl
mov byte [rbp + 0x31], bl
lea rax, [rbp + 0x20]
mov qword [r11 - 0x60], rax
lea rax, [rbp - 0x48]
mov qword [r11 - 0x68], rax
lea r9, [rbp + 0x18]
lea r8, [rbp + 0x28]
lea rdx, [rbp + 0x30]
lea rcx, [rbp - 0x40]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_28717]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_8978]
lea rcx, vtable.Mso::Telemetry::EventName.0
mov qword [rbp - 0x28], rcx
mov qword [rbp - 0x20], rax
lea rax, str.FHandleHomepage
mov qword [rbp - 0x18], rax
mov word [rbp + 0x20], 0x100
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_2143]
test rax, rax
je 0x1400096a7
mov rcx, rax
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_50412]
jmp 0x1400096ad
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_58358]
lea rcx, [rbp - 0x40]
mov qword [rsp + 0x20], rcx
movzx r9d, word [rbp + 0x20]
mov r8, rax
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x38]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_24582]
mov rcx, qword [0x1400543e0]
call fcn.140011c6c
movzx ebx, al
mov byte [rbp + 0x20], bl
mov byte [rbp + 0x21], 1
lea rcx, [rbp - 0x38]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_21867]
movzx ecx, word [rbp + 0x20]
mov word [rax], cx
lea rcx, [rbp - 0x38]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_241]
mov eax, ebx
add rsp, 0x78
pop rbx
pop rbp
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r15
lea rbp, [rsp - 0x40]
sub rsp, 0x140
mov rax, qword [0x140054040]
xor rax, rsp
mov qword [rbp + 0x30], rax
mov rbx, rdx
xor esi, esi
mov byte [rsp + 0x31], sil
lea r15d, [rsi + 2]
mov word [rsp + 0x38], r15w
mov byte [rsp + 0x3a], 1
mov byte [rsp + 0x33], sil
mov byte [rsp + 0x35], sil
mov byte [rsp + 0x37], sil
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x32]
lea r8, [rsp + 0x34]
lea rdx, [rsp + 0x36]
lea rcx, [rsp + 0x40]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_28717]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_8978]
lea rdi, vtable.Mso::Telemetry::EventName.0
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rax
lea rax, str.FHandleIncomingSearch
mov qword [rsp + 0x58], rax
mov word [rsp + 0x30], 0x100
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_2143]
test rax, rax
je 0x1400097c6
mov rcx, rax
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_50412]
jmp 0x1400097cc
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_58358]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rcx
movzx r9d, word [rsp + 0x30]
mov r8, rax
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x68]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_24582]
mov r8d, dword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
lea rcx, [rbp - 0x40]
nop dword [rax + rax]
call fcn.14000a390
lea rdx, [rbp + 8]
lea rcx, [rbp - 0x68]
call fcn.14000a440
lea rbx, [rbp - 0x68]
cmp qword [rbp - 0x50], 7
cmova rbx, qword [rbp - 0x68]
mov byte [rsp + 0x37], sil
mov word [rsp + 0x40], r15w
mov byte [rsp + 0x42], 1
mov byte [rsp + 0x35], sil
mov byte [rsp + 0x33], sil
mov byte [rsp + 0x39], sil
lea rax, [rsp + 0x36]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
lea r8, [rsp + 0x32]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x60]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_28717]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_8978]
mov qword [rsp + 0x78], rdi
mov qword [rbp - 0x80], rax
lea rax, str.HrExecuteSearch
mov qword [rbp - 0x78], rax
mov word [rsp + 0x30], 0x100
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_2143]
test rax, rax
je 0x1400098a4
mov rcx, rax
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_50412]
jmp 0x1400098aa
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_58358]
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
movzx r9d, word [rsp + 0x30]
mov r8, rax
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x48]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_24582]
mov rdi, qword [0x1400543e0]
test rdi, rdi
je 0x140009918
test rbx, rbx
je 0x140009918
cmp word [rbx], si
je 0x140009918
mov edx, 1
mov ecx, 0x1010
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_52497]
test rax, rax
jne 0x1400098ff
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_59938]
int3
xor r8d, r8d
mov rdx, rbx
mov rcx, rax
call fcn.14000ffcc
mov rdx, rax
mov rcx, rdi
call fcn.140010f10
mov word [rsp + 0x30], 0x101
lea rcx, [rsp + 0x48]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_21867]
mov rcx, rax
movzx eax, word [rsp + 0x30]
mov word [rcx], ax
lea rcx, [rsp + 0x48]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_241]
mov rax, qword [rbp - 0x50]
cmp rax, 7
jbe 0x14000997f
lea rax, [rax*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rdx, rcx
cmp rax, 0x1000
jb 0x140009979
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
jbe 0x140009979
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov word [rsp + 0x30], 0x101
lea rcx, [rsp + 0x68]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_21867]
movzx ecx, word [rsp + 0x30]
mov word [rax], cx
lea rcx, [rbp - 0x40]
call fcn.1400099d8
lea rcx, [rsp + 0x68]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_241]
mov eax, 1
mov rcx, qword [rbp + 0x30]
xor rcx, rsp
call fcn.140038c60
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop rdi
pop rbp
ret
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 8], rcx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x70
mov rbx, rdx
mov byte [rbp + 0x21], 0
mov eax, 2
mov word [rbp - 0x3e], ax
mov byte [rbp - 0x3c], 1
mov byte [rbp + 0x31], 0
mov byte [rbp + 0x39], 0
mov byte [rbp - 0x3f], 0
lea rax, [rbp + 0x20]
mov qword [r11 - 0x60], rax
lea rax, [rbp - 0x3e]
mov qword [r11 - 0x68], rax
lea r9, [rbp + 0x30]
lea r8, [rbp + 0x38]
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x38]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_28717]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_8978]
lea rcx, vtable.Mso::Telemetry::EventName.0
mov qword [rbp - 0x20], rcx
mov qword [rbp - 0x18], rax
lea rax, str.FHandleIncomingTemplateTask
mov qword [rbp - 0x10], rax
mov word [rbp + 0x20], 0x100
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_2143]
test rax, rax
je 0x140009ad7
mov rcx, rax
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_50412]
jmp 0x140009add
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_58358]
lea rcx, [rbp - 0x38]
mov qword [rsp + 0x20], rcx
movzx r9d, word [rbp + 0x20]
mov r8, rax
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x30]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_24582]
mov rdi, qword [rbx + 0x18]
mov rsi, qword [0x1400543e0]
mov edx, 1
lea ecx, [rdx + 0x3f]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_52497]
mov rbx, rax
test rax, rax
jne 0x140009b24
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_59938]
int3
and dword [rax + 8], 0
and dword [rax + 0xc], 0
lea rax, vtable.CLViewTemplateHelpNavigationRequest.0
mov qword [rbx], rax
lea rcx, [rbx + 0x10]
or r9, 0xffffffffffffffff
mov r8, rdi
lea edx, [r9 + 0x19]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
mov rdx, rbx
mov rcx, rsi
call fcn.140010f10
movzx ebx, al
mov byte [rbp + 0x20], bl
mov byte [rbp + 0x21], 1
lea rcx, [rbp - 0x30]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_21867]
movzx ecx, word [rbp + 0x20]
mov word [rax], cx
lea rcx, [rbp - 0x30]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_241]
mov eax, ebx
mov rbx, qword [rsp + 0x98]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x100
mov rax, qword [0x140054040]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rdi, rdx
xor ebx, ebx
mov byte [rbp - 0x78], bl
lea eax, [rbx + 2]
mov word [rbp - 0x71], ax
mov byte [rbp - 0x6f], 1
mov byte [rbp - 0x76], bl
mov byte [rbp - 0x74], bl
mov byte [rbp - 0x72], bl
lea rax, [rbp - 0x79]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x71]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x77]
lea r8, [rbp - 0x75]
lea rdx, [rbp - 0x73]
lea rcx, [rbp - 0x69]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_28717]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_8978]
lea rcx, vtable.Mso::Telemetry::EventName.0
mov qword [rbp - 0x51], rcx
mov qword [rbp - 0x49], rax
lea rax, str.FHandleHelpId
mov qword [rbp - 0x41], rax
mov word [rbp - 0x79], 0x100
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_2143]
test rax, rax
je 0x140009c35
mov rcx, rax
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_50412]
jmp 0x140009c3b
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_58358]
lea rcx, [rbp - 0x69]
mov qword [rsp + 0x20], rcx
movzx r9d, word [rbp - 0x79]
mov r8, rax
lea rdx, [rbp - 0x51]
lea rcx, [rbp - 0x61]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_24582]
mov rdx, qword [rdi + 0x18]
test rdx, rdx
je 0x140009cf1
mov r8d, dword [rdi + 0x10]
lea rcx, [rbp - 0x29]
call fcn.14000a390
mov rbx, qword [0x1400543e0]
lea rdx, [rbp + 0x1f]
lea rcx, [rbp - 0x51]
call fcn.14000a440
lea rdx, [rbp - 0x51]
cmp qword [rbp - 0x39], 7
cmova rdx, qword [rbp - 0x51]
mov rcx, rbx
nop dword [rax]
call fcn.140011cb8
movzx ebx, al
mov rax, qword [rbp - 0x39]
cmp rax, 7
jbe 0x140009ce8
lea rax, [rax*2 + 2]
mov rcx, qword [rbp - 0x51]
mov rdx, rcx
cmp rax, 0x1000
jb 0x140009ce1
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
jbe 0x140009ce1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
nop
lea rcx, [rbp - 0x29]
call fcn.1400099d8
mov byte [rbp - 0x79], bl
mov byte [rbp - 0x78], 1
lea rcx, [rbp - 0x61]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_21867]
movzx ecx, word [rbp - 0x79]
mov word [rax], cx
lea rcx, [rbp - 0x61]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_241]
mov eax, ebx
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140038c60
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
mov qword [rsp + 8], rcx
push rbp
push rbx
push rdi
mov rbp, rsp
sub rsp, 0x70
mov rdi, rdx
xor ebx, ebx
mov byte [rbp + 0x21], bl
lea eax, [rbx + 2]
mov word [rbp - 0x3e], ax
mov byte [rbp - 0x3c], 1
mov byte [rbp + 0x31], bl
mov byte [rbp + 0x39], bl
mov byte [rbp - 0x3f], bl
lea rax, [rbp + 0x20]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x3e]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x30]
lea r8, [rbp + 0x38]
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x38]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_28717]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_8978]
lea rcx, vtable.Mso::Telemetry::EventName.0
mov qword [rbp - 0x20], rcx
mov qword [rbp - 0x18], rax
lea rax, str.FHandleUrl
mov qword [rbp - 0x10], rax
mov word [rbp + 0x20], 0x100
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_2143]
test rax, rax
je 0x140009dc7
mov rcx, rax
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_50412]
jmp 0x140009dcd
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_58358]
lea rcx, [rbp - 0x38]
mov qword [rsp + 0x20], rcx
movzx r9d, word [rbp + 0x20]
mov r8, rax
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x30]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_24582]
mov rdi, qword [rdi + 0x18]
test rdi, rdi
je 0x140009e27
cmp byte [rdi], bl
je 0x140009e27
movzx ecx, word [rdi]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_61916]
cmp word [rdi + 2], 0x3a
je 0x140009e27
cmp ax, 0x48
je 0x140009e15
cmp ax, 0x4d
jne 0x140009e27
mov rdx, rdi
mov rcx, qword [0x1400543e0]
call fcn.140011e5c
movzx ebx, al
mov byte [rbp + 0x20], bl
mov byte [rbp + 0x21], 1
lea rcx, [rbp - 0x30]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_21867]
movzx ecx, word [rbp + 0x20]
mov word [rax], cx
lea rcx, [rbp - 0x30]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_241]
mov eax, ebx
add rsp, 0x70
pop rdi
pop rbx
pop rbp
ret
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x100
mov rax, qword [0x140054040]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rbx, rdx
xor edi, edi
mov byte [rsp + 0x31], dil
lea r15d, [rdi + 2]
mov word [rsp + 0x38], r15w
mov byte [rbp - 0x7f], 1
mov byte [rsp + 0x33], dil
mov byte [rsp + 0x35], dil
mov byte [rsp + 0x37], dil
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x32]
lea r8, [rsp + 0x34]
lea rdx, [rsp + 0x36]
lea rcx, [rbp - 0x79]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_28717]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_8978]
lea rcx, vtable.Mso::Telemetry::EventName.0
mov qword [rbp - 0x61], rcx
mov qword [rbp - 0x59], rax
lea rax, str.FHandleFormattedMessage
mov qword [rbp - 0x51], rax
mov word [rsp + 0x30], 0x100
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_2143]
test rax, rax
je 0x140009f12
mov rcx, rax
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_50412]
jmp 0x140009f18
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_58358]
lea rcx, [rbp - 0x79]
mov qword [rsp + 0x20], rcx
movzx r9d, word [rsp + 0x30]
mov r8, rax
lea rdx, [rbp - 0x61]
lea rcx, [rbp - 0x71]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_24582]
mov r8d, dword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
lea rcx, [rbp - 0x39]
call fcn.14000a390
lea rdx, [rbp + 0xf]
lea rcx, [rbp - 0x61]
call fcn.14000a440
lea rsi, [rbp - 0x61]
mov rax, qword [rbp - 0x49]
cmp rax, 7
cmova rsi, qword [rbp - 0x61]
mov rcx, qword [rbp - 0x51]
cmp rcx, 9
jb 0x140009fbf
lea r14, [rcx - 8]
lea r14, [rsi + r14*2]
mov rbx, rsi
mov r8, r14
sub r8, rbx
sar r8, 1
mov edx, 0x3c
mov rcx, rbx
call fcn.14000a7f4
mov rbx, rax
test rax, rax
je 0x140009fbb
lea r8d, [rdx - 0x33]
mov rcx, rax
call fcn.14000a6cc
test eax, eax
je 0x140009faf
add rbx, r15
jmp 0x140009f7c
sub rbx, rsi
sar rbx, 1
mov rax, qword [rbp - 0x49]
jmp 0x140009fc3
mov rax, qword [rbp - 0x49]
or rbx, 0xffffffffffffffff
mov esi, 0x1000
cmp rax, 7
jbe 0x14000a000
lea rax, [rax*2 + 2]
mov rcx, qword [rbp - 0x61]
mov rdx, rcx
cmp rax, rsi
jb 0x140009ffa
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
jbe 0x140009ffa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test rbx, rbx
jne 0x14000a074
lea rdx, [rbp + 0xf]
lea rcx, [rbp - 0x61]
call fcn.14000a440
nop
lea rbx, [rbp - 0x61]
cmp qword [rbp - 0x49], 7
cmova rbx, qword [rbp - 0x61]
call fcn.140004438
mov rdx, rbx
mov rcx, qword [0x1400543d0]
call fcn.14000fa48
movzx edi, al
mov rax, qword [rbp - 0x49]
cmp rax, 7
jbe 0x14000a074
lea rax, [rax*2 + 2]
mov rcx, qword [rbp - 0x61]
mov rdx, rcx
cmp rax, rsi
jb 0x14000a06e
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
jbe 0x14000a06e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov byte [rsp + 0x30], dil
mov byte [rsp + 0x31], 1
lea rcx, [rbp - 0x71]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_21867]
movzx ecx, word [rsp + 0x30]
mov word [rax], cx
lea rcx, [rbp - 0x39]
call fcn.1400099d8
lea rcx, [rbp - 0x71]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_241]
mov eax, edi
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140038c60
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov qword [rsp + 8], rcx
push rbp
push rbx
push rdi
mov rbp, rsp
sub rsp, 0x70
mov rdi, rdx
xor ebx, ebx
mov byte [rbp + 0x21], bl
lea eax, [rbx + 2]
mov word [rbp - 0x3e], ax
mov byte [rbp - 0x3c], 1
mov byte [rbp + 0x31], bl
mov byte [rbp + 0x39], bl
mov byte [rbp - 0x3f], bl
lea rax, [rbp + 0x20]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x3e]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x30]
lea r8, [rbp + 0x38]
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x38]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_28717]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_8978]
lea rcx, vtable.Mso::Telemetry::EventName.0
mov qword [rbp - 0x20], rcx
mov qword [rbp - 0x18], rax
lea rax, str.FHandleHtmlMessage
mov qword [rbp - 0x10], rax
mov word [rbp + 0x20], 0x100
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_2143]
test rax, rax
je 0x14000a15f
mov rcx, rax
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_50412]
jmp 0x14000a165
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_58358]
lea rcx, [rbp - 0x38]
mov qword [rsp + 0x20], rcx
movzx r9d, word [rbp + 0x20]
mov r8, rax
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x30]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_24582]
test rdi, rdi
je 0x14000a1a3
mov rdx, qword [rdi + 0x18]
test rdx, rdx
je 0x14000a1a3
mov r8d, dword [rdi + 0x10]
test r8d, r8d
je 0x14000a1a3
call fcn.140011d30
movzx ebx, al
mov byte [rbp + 0x20], bl
mov byte [rbp + 0x21], 1
lea rcx, [rbp - 0x30]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_21867]
movzx ecx, word [rbp + 0x20]
mov word [rax], cx
lea rcx, [rbp - 0x30]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_241]
mov eax, ebx
add rsp, 0x70
pop rdi
pop rbx
pop rbp
ret
mov qword [rsp + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov byte [rbp + 0x11], 0
mov eax, 2
mov word [rbp - 0x40], ax
mov byte [rbp - 0x3e], 1
mov byte [rbp + 0x19], 0
mov byte [rbp + 0x21], 0
mov byte [rbp + 0x29], 0
lea rax, [rbp + 0x10]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x18]
lea r8, [rbp + 0x20]
lea rdx, [rbp + 0x28]
lea rcx, [rbp - 0x38]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_28717]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_8978]
lea rcx, vtable.Mso::Telemetry::EventName.0
mov qword [rbp - 0x20], rcx
mov qword [rbp - 0x18], rax
lea rax, str.FHandleIncomingAppQuit
mov qword [rbp - 0x10], rax
mov word [rbp + 0x10], 0x100
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_2143]
test rax, rax
je 0x14000a25e
mov rcx, rax
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_50412]
jmp 0x14000a264
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_58358]
lea rcx, [rbp - 0x38]
mov qword [rsp + 0x20], rcx
movzx r9d, word [rbp + 0x10]
mov r8, rax
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x30]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_24582]
xor edx, edx
lea rcx, [0x140004350]
call qword [sym.imp.USER32.dll_EnumWindows]
test eax, eax
je 0x14000a29d
xor edx, edx
call fcn.14000324c
mov word [rbp + 0x10], 0x101
lea rcx, [rbp - 0x30]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_21867]
movzx ecx, word [rbp + 0x10]
mov word [rax], cx
lea rcx, [rbp - 0x30]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_241]
mov eax, 1
add rsp, 0x70
pop rbp
ret