Function at 0x140009cd4
Capabilities:
Enumerate gui resources

Disassembly:
push rbx
sub rsp, 0x20
lea rcx, [0x140061590]
mov rbx, rdx
call fcn.14000350c
cmp rax, qword [rbx + 8]
jne 0x140008e92
xor eax, eax
jmp 0x140008fa2
cmp dword [0x1400615ac], 0
jne 0x140008f9d
cmp dword [rbx], 0x467
je 0x140008f0d
cmp qword [0x1400615e0], 0
je 0x140008ec1
mov rdx, rbx
call fcn.140008b74
test al, al
jne 0x140008f9d
cmp byte [0x140061591], 0
je 0x140008f0d
lea rcx, [0x140061590]
call fcn.14000350c
mov rcx, rax
mov edx, 0xfffffff0
call qword [sym.imp.USER32.dll_GetWindowLongW]
bt eax, 0x1d
jae 0x140008f0d
lea rcx, [0x140061590]
call fcn.14000350c
mov rcx, rax
xor r9d, r9d
mov edx, VarUI4FromDisp
mov r8d, 0xf120
call qword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [rbx]
sub ecx, 0x465
je 0x140008f96
sub ecx, 1
je 0x140008f89
sub ecx, 1
je 0x140008f7f
sub ecx, 1
je 0x140008f72
sub ecx, 1
je 0x140008f65
sub ecx, 1
je 0x140008f58
sub ecx, 1
je 0x140008f4b
cmp ecx, 1
jne 0x140008e8b
mov rdx, rbx
add rsp, 0x20
pop rbx
jmp 0x140009bd0
mov rdx, rbx
add rsp, 0x20
pop rbx
jmp 0x140009894
mov rdx, rbx
add rsp, 0x20
pop rbx
jmp 0x140009774
mov rdx, rbx
add rsp, 0x20
pop rbx
jmp 0x140009560
mov rdx, rbx
add rsp, 0x20
pop rbx
jmp 0x140009414
add rsp, 0x20
pop rbx
jmp 0x140009cd4
mov rdx, rbx
add rsp, 0x20
pop rbx
jmp 0x140009098
add rsp, 0x20
pop rbx
jmp 0x140008fa8
mov eax, 1
add rsp, 0x20
pop rbx
ret
mov r11, rsp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbp
push rbx
mov rbp, rsp
sub rsp, 0x78
mov qword [rbp - 0x38], 0xfffffffffffffffe
mov byte [rbp + 0x20], 0
mov eax, 2
mov word [rbp - 0x46], ax
mov byte [rbp - 0x48], 1
mov byte [rbp + 0x18], 0
mov byte [rbp + 0x28], 0
mov byte [rbp + 0x30], 0
lea rax, [rbp + 0x20]
mov qword [r11 - 0x60], rax
lea rax, [rbp - 0x48]
mov qword [r11 - 0x68], rax
lea r9, [rbp + 0x18]
lea r8, [rbp + 0x28]
lea rdx, [rbp + 0x30]
lea rcx, [rbp - 0x40]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_2306]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_1348]
lea rcx, vtable.Mso::Telemetry::EventName.0
mov qword [rbp - 0x20], rcx
mov qword [rbp - 0x18], rax
lea rax, str.FHandleHomepage
mov qword [rbp - 0x10], rax
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_162]
test rax, rax
je 0x14000903d
mov rcx, rax
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_1638]
jmp 0x140009043
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_92]
lea rcx, [rbp - 0x40]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8, rax
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x30]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_1998]
mov rcx, qword [0x140061600]
call fcn.140010130
movzx ebx, al
lea rcx, [rbp - 0x30]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_143]
cmp byte [rax], 0
mov byte [rax + 1], bl
jne 0x140009084
mov byte [rax], 1
lea rcx, [rbp - 0x30]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_426]
mov eax, ebx
add rsp, 0x78
pop rbx
pop rbp
ret
mov rax, rsp
push rbp
push rdi
push r15
lea rbp, [rax - 0x58]
sub rsp, 0x140
mov qword [rbp - 0x70], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x140058010]
xor rax, rsp
mov qword [rbp + 0x30], rax
mov rbx, rdx
xor esi, esi
mov byte [rsp + 0x30], sil
lea r15d, [rsi + 2]
mov word [rsp + 0x42], r15w
mov byte [rsp + 0x40], 1
mov byte [rsp + 0x34], sil
mov byte [rsp + 0x38], sil
mov byte [rsp + 0x3c], sil
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x3c]
lea rcx, [rsp + 0x48]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_2306]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_1348]
lea rdi, vtable.Mso::Telemetry::EventName.0
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rax
lea rax, str.FHandleIncomingSearch
mov qword [rsp + 0x60], rax
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_162]
test rax, rax
je 0x140009157
mov rcx, rax
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_1638]
jmp 0x14000915d
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_92]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8, rax
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x68]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_1998]
mov r8d, dword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
lea rcx, [rbp - 0x40]
call fcn.140009e90
lea rdx, [rbp + 8]
lea rcx, [rbp - 0x60]
call fcn.140009f44
lea rbx, [rbp - 0x60]
cmp qword [rbp - 0x48], 8
cmovae rbx, qword [rbp - 0x60]
mov byte [rsp + 0x3c], sil
mov word [rsp + 0x42], r15w
mov byte [rsp + 0x40], 1
mov byte [rsp + 0x38], sil
mov byte [rsp + 0x34], sil
mov byte [rsp + 0x30], sil
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x34]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x48]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_2306]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_1348]
mov qword [rsp + 0x78], rdi
mov qword [rbp - 0x80], rax
lea rax, str.HrExecuteSearch
mov qword [rbp - 0x78], rax
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_162]
test rax, rax
je 0x140009226
mov rcx, rax
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_1638]
jmp 0x14000922c
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_92]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8, rax
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x50]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_1998]
mov rdi, qword [0x140061600]
test rdi, rdi
je 0x14000929f
nop dword [rax + rax]
test rbx, rbx
je 0x14000929f
cmp word [rbx], si
je 0x14000929f
mov edx, 1
mov ecx, 0x1010
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_378]
test rax, rax
jne 0x140009286
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_1135]
int3
xor r8d, r8d
mov rdx, rbx
mov rcx, rax
call fcn.14000e48c
mov rdx, rax
mov rcx, rdi
call fcn.14000f360
lea rcx, [rsp + 0x50]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_143]
cmp byte [rax], sil
je 0x1400092b5
mov byte [rax + 1], 1
jmp 0x1400092ba
mov word [rax], 0x101
lea rcx, [rsp + 0x50]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_426]
mov ebx, 0x1000
mov rax, qword [rbp - 0x48]
cmp rax, 8
jb 0x140009306
lea rax, [rax*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rdx, rcx
cmp rax, rbx
jb 0x140009300
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
jbe 0x140009300
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rcx, [rsp + 0x68]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_143]
cmp byte [rax], sil
je 0x14000931c
mov byte [rax + 1], 1
jmp 0x140009321
mov word [rax], 0x101
mov rax, qword [rbp + 0x20]
cmp rax, 8
jb 0x14000935d
lea rax, [rax*2 + 2]
mov rcx, qword [rbp + 8]
mov rdx, rcx
cmp rax, rbx
jb 0x140009357
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
jbe 0x140009357
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbp + 0x18], rsi
mov qword [rbp + 0x20], 7
mov word [rbp + 8], si
lea rcx, [rbp - 0x40]
call fcn.140008dbc
lea rcx, [rsp + 0x68]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_426]
mov eax, 1
mov rcx, qword [rbp + 0x30]
xor rcx, rsp
call fcn.140037600
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop rdi
pop rbp
ret
mov r11, rsp
mov qword [r11 + 8], rcx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x30], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov rbx, rdx
mov byte [rbp + 0x20], 0
mov eax, 2
mov word [rbp - 0x3a], ax
mov byte [rbp - 0x3c], 1
mov byte [rbp + 0x30], 0
mov byte [rbp + 0x38], 0
mov byte [rbp - 0x40], 0
lea rax, [rbp + 0x20]
mov qword [r11 - 0x60], rax
lea rax, [rbp - 0x3c]
mov qword [r11 - 0x68], rax
lea r9, [rbp + 0x30]
lea r8, [rbp + 0x38]
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x38]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_2306]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_1348]
lea rcx, vtable.Mso::Telemetry::EventName.0
mov qword [rbp - 0x18], rcx
mov qword [rbp - 0x10], rax
lea rax, str.FHandleIncomingTemplateTask
mov qword [rbp - 8], rax
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_162]
test rax, rax
je 0x1400094ad
mov rcx, rax
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_1638]
jmp 0x1400094b3
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_92]
lea rcx, [rbp - 0x38]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8, rax
lea rdx, [rbp - 0x18]
lea rcx, [rbp - 0x28]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_1998]
mov rdi, qword [rbx + 0x18]
mov rsi, qword [0x140061600]
mov edx, 1
lea ecx, [rdx + 0x3f]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_378]
mov rbx, rax
test rax, rax
jne 0x1400094f8
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_1135]
int3
and dword [rax + 8], 0
and dword [rax + 0xc], 0
lea rax, vtable.CLViewTemplateHelpNavigationRequest.0
mov qword [rbx], rax
lea rcx, [rbx + 0x10]
or r9, 0xffffffffffffffff
mov r8, rdi
lea edx, [r9 + 0x19]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
mov rdx, rbx
mov rcx, rsi
call fcn.14000f360
movzx ebx, al
lea rcx, [rbp - 0x28]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_143]
cmp byte [rax], 0
mov byte [rax + 1], bl
jne 0x140009542
mov byte [rax], 1
lea rcx, [rbp - 0x28]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_426]
mov eax, ebx
mov rbx, qword [rsp + 0x98]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
mov rax, rsp
push rbp
lea rbp, [rax - 0x18]
sub rsp, 0x110
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x140058010]
xor rax, rsp
mov qword [rbp], rax
mov rdi, rdx
xor esi, esi
mov byte [rsp + 0x30], sil
lea eax, [rsi + 2]
mov word [rsp + 0x42], ax
mov byte [rsp + 0x40], 1
mov byte [rsp + 0x34], sil
mov byte [rsp + 0x38], sil
mov byte [rsp + 0x3c], sil
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x3c]
lea rcx, [rsp + 0x48]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_2306]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_1348]
lea rcx, vtable.Mso::Telemetry::EventName.0
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rax
lea rax, str.FHandleHelpId
mov qword [rsp + 0x78], rax
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_162]
test rax, rax
je 0x14000961f
mov rcx, rax
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_1638]
jmp 0x140009625
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_92]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8, rax
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x50]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_1998]
mov ebx, esi
mov rdx, qword [rdi + 0x18]
test rdx, rdx
je 0x140009729
mov r8d, dword [rdi + 0x10]
lea rcx, [rbp - 0x70]
call fcn.140009e90
mov rbx, qword [0x140061600]
lea rdx, [rbp - 0x28]
lea rcx, [rsp + 0x68]
call fcn.140009f44
lea rdx, [rsp + 0x68]
cmp qword [rbp - 0x80], 8
cmovae rdx, qword [rsp + 0x68]
mov rcx, rbx
call fcn.14001017c
movzx ebx, al
mov edi, 0x1000
mov rax, qword [rbp - 0x80]
cmp rax, 8
jb 0x1400096d4
lea rax, [rax*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rdx, rcx
cmp rax, rdi
jb 0x1400096cd
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
jbe 0x1400096cd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
nop
mov rax, qword [rbp - 0x10]
cmp rax, 8
jb 0x140009710
lea rax, [rax*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rdx, rcx
cmp rax, rdi
jb 0x14000970a
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
jbe 0x14000970a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbp - 0x18], rsi
mov qword [rbp - 0x10], 7
mov word [rbp - 0x28], si
lea rcx, [rbp - 0x70]
call fcn.140008dbc
lea rcx, [rsp + 0x50]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_143]
cmp byte [rax], sil
mov byte [rax + 1], bl
jne 0x14000973f
mov byte [rax], 1
lea rcx, [rsp + 0x50]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_426]
mov eax, ebx
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.140037600
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
mov qword [rsp + 8], rcx
push rbp
push rbx
push rdi
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x30], 0xfffffffffffffffe
mov rbx, rdx
mov byte [rbp + 0x20], 0
mov eax, 2
mov word [rbp - 0x3a], ax
mov byte [rbp - 0x3c], 1
mov byte [rbp + 0x30], 0
mov byte [rbp + 0x38], 0
mov byte [rbp - 0x40], 0
lea rax, [rbp + 0x20]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x30]
lea r8, [rbp + 0x38]
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x38]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_2306]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_1348]
lea rcx, vtable.Mso::Telemetry::EventName.0
mov qword [rbp - 0x18], rcx
mov qword [rbp - 0x10], rax
lea rax, str.FHandleUrl
mov qword [rbp - 8], rax
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_162]
test rax, rax
je 0x140009809
mov rcx, rax
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_1638]
jmp 0x14000980f
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_92]
lea rcx, [rbp - 0x38]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8, rax
lea rdx, [rbp - 0x18]
lea rcx, [rbp - 0x28]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_1998]
xor edi, edi
mov rbx, qword [rbx + 0x18]
test rbx, rbx
je 0x14000986a
cmp byte [rbx], dil
je 0x14000986a
movzx ecx, word [rbx]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_1714]
cmp word [rbx + 2], 0x3a
je 0x14000986a
cmp ax, 0x48
je 0x140009858
cmp ax, 0x4d
jne 0x14000986a
mov rdx, rbx
mov rcx, qword [0x140061600]
call fcn.140010328
movzx edi, al
lea rcx, [rbp - 0x28]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_143]
cmp byte [rax], 0
mov byte [rax + 1], dil
jne 0x140009880
mov byte [rax], 1
lea rcx, [rbp - 0x28]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_426]
mov eax, edi
add rsp, 0x70
pop rdi
pop rbx
pop rbp
ret
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x38]
sub rsp, 0x110
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x140058010]
xor rax, rsp
mov qword [rbp], rax
mov rbx, rdx
xor r15d, r15d
mov byte [rsp + 0x30], r15b
lea r13d, [r15 + 2]
mov word [rsp + 0x42], r13w
mov byte [rsp + 0x40], 1
mov byte [rsp + 0x34], r15b
mov byte [rsp + 0x38], r15b
mov byte [rsp + 0x3c], r15b
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x3c]
lea rcx, [rsp + 0x48]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_2306]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_1348]
lea rcx, vtable.Mso::Telemetry::EventName.0
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rax
lea rax, str.FHandleFormattedMessage
mov qword [rsp + 0x78], rax
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_162]
test rax, rax
je 0x14000995e
mov rcx, rax
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_1638]
jmp 0x140009964
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_92]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8, rax
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x50]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_1998]
mov edi, r15d
mov r8d, dword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
lea rcx, [rbp - 0x70]
call fcn.140009e90
lea rdx, [rbp - 0x28]
lea rcx, [rsp + 0x68]
call fcn.140009f44
lea r11, [rsp + 0x68]
mov rdx, qword [rsp + 0x68]
mov rsi, qword [rbp - 0x80]
cmp rsi, 8
cmovae r11, rdx
mov rax, qword [rsp + 0x78]
cmp rax, 9
jb 0x140009a67
lea r14, [rax - 8]
lea r14, [r11 + r14*2]
mov rbx, r11
mov r12d, 0x3c
lea r8, str._MESSAGE_
mov qword [rsp + 0x48], r8
mov rax, r14
sub rax, rbx
sar rax, 1
mov rcx, r15
je 0x140009a0d
jmp 0x140009a04
cmp rax, 1
je 0x140009a0d
dec rax
add rbx, r13
cmp word [rbx], r12w
jne 0x1400099f8
mov rcx, rbx
mov rbx, rcx
test rcx, rcx
je 0x140009a67
mov r9d, 9
mov rcx, r8
movzx eax, word [rbx]
mov r8d, r12d
cmp ax, r12w
jb 0x140009a53
mov r10, rbx
sub r10, qword [rsp + 0x48]
cmp ax, r8w
ja 0x140009a53
cmp r9, 1
je 0x140009a5f
dec r9
add rcx, r13
movzx eax, word [rcx + r10]
movzx r8d, word [rcx]
cmp ax, r8w
jae 0x140009a36
add rbx, r13
lea r8, str._MESSAGE_
jmp 0x1400099e8
sub rbx, r11
sar rbx, 1
jmp 0x140009a6b
or rbx, 0xffffffffffffffff
mov r14d, 0x1000
cmp rsi, 8
jb 0x140009aa8
lea rax, [rsi*2 + 2]
mov rcx, rdx
cmp rax, r14
jb 0x140009a9f
mov rdx, qword [rdx - 8]
sub rcx, rdx
lea rax, [rcx - 8]
cmp rax, 0x1f
jbe 0x140009a9f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test rbx, rbx
jne 0x140009b29
lea rdx, [rbp - 0x28]
lea rcx, [rsp + 0x68]
call fcn.140009f44
nop
lea rbx, [rsp + 0x68]
cmp qword [rbp - 0x80], 8
cmovae rbx, qword [rsp + 0x68]
cmp byte [0x140061590], r15b
jne 0x140009ada
call fcn.140004148
mov rdx, rbx
mov rcx, qword [0x1400615f0]
call fcn.14000df38
movzx edi, al
mov rax, qword [rbp - 0x80]
cmp rax, 8
jb 0x140009b29
lea rax, [rax*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rdx, rcx
cmp rax, r14
jb 0x140009b23
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
jbe 0x140009b23
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rcx, [rsp + 0x50]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_143]
cmp byte [rax], r15b
mov byte [rax + 1], dil
jne 0x140009b40
mov byte [rax], 1
mov rax, qword [rbp - 0x10]
cmp rax, 8
jb 0x140009b7c
lea rax, [rax*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rdx, rcx
cmp rax, r14
jb 0x140009b76
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
jbe 0x140009b76
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbp - 0x18], r15
mov qword [rbp - 0x10], 7
mov word [rbp - 0x28], r15w
lea rcx, [rbp - 0x70]
call fcn.140008dbc
lea rcx, [rsp + 0x50]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_426]
mov eax, edi
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.140037600
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov qword [rsp + 8], rcx
push rbp
push rbx
push rdi
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x30], 0xfffffffffffffffe
mov rdi, rdx
mov byte [rbp + 0x20], 0
mov eax, 2
mov word [rbp - 0x3a], ax
mov byte [rbp - 0x3c], 1
mov byte [rbp + 0x30], 0
mov byte [rbp + 0x38], 0
mov byte [rbp - 0x40], 0
lea rax, [rbp + 0x20]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x30]
lea r8, [rbp + 0x38]
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x38]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_2306]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_1348]
lea rcx, vtable.Mso::Telemetry::EventName.0
mov qword [rbp - 0x18], rcx
mov qword [rbp - 0x10], rax
lea rax, str.FHandleHtmlMessage
mov qword [rbp - 8], rax
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_162]
test rax, rax
je 0x140009c65
mov rcx, rax
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_1638]
jmp 0x140009c6b
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_92]
lea rcx, [rbp - 0x38]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8, rax
lea rdx, [rbp - 0x18]
lea rcx, [rbp - 0x28]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_1998]
xor ebx, ebx
test rdi, rdi
je 0x140009ca9
mov rdx, qword [rdi + 0x18]
test rdx, rdx
je 0x140009ca9
mov r8d, dword [rdi + 0x10]
test r8d, r8d
je 0x140009ca9
call fcn.1400101f4
movzx ebx, al
lea rcx, [rbp - 0x28]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_143]
cmp byte [rax], 0
mov byte [rax + 1], bl
jne 0x140009cbe
mov byte [rax], 1
lea rcx, [rbp - 0x28]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_426]
mov eax, ebx
add rsp, 0x70
pop rdi
pop rbx
pop rbp
ret
mov qword [rsp + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x30], 0xfffffffffffffffe
mov byte [rbp + 0x10], 0
mov eax, 2
mov word [rbp - 0x3e], ax
mov byte [rbp - 0x40], 1
mov byte [rbp + 0x18], 0
mov byte [rbp + 0x20], 0
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x10]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x18]
lea r8, [rbp + 0x20]
lea rdx, [rbp + 0x28]
lea rcx, [rbp - 0x38]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_2306]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_1348]
lea rcx, vtable.Mso::Telemetry::EventName.0
mov qword [rbp - 0x18], rcx
mov qword [rbp - 0x10], rax
lea rax, str.FHandleIncomingAppQuit
mov qword [rbp - 8], rax
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_162]
test rax, rax
je 0x140009d64
mov rcx, rax
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_1638]
jmp 0x140009d6a
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_92]
lea rcx, [rbp - 0x38]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8, rax
lea rdx, [rbp - 0x18]
lea rcx, [rbp - 0x28]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_1998]
xor edx, edx
lea rcx, [0x140004060]
call qword [sym.imp.USER32.dll_EnumWindows]
test eax, eax
je 0x140009da1
xor edx, edx
call fcn.140002edc
lea rcx, [rbp - 0x28]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_143]
cmp byte [rax], 0
je 0x140009db6
mov byte [rax + 1], 1
jmp 0x140009dbb
mov word [rax], 0x101
lea rcx, [rbp - 0x28]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_426]
mov eax, 1
add rsp, 0x70
pop rbp
ret