Function at 0x1400f3534
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x1810]
mov eax, 0x1910
call fcn.140109ab0
sub rsp, rax
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rsp + 0x1928], rbx
mov qword [rsp + 0x1930], rsi
mov qword [rsp + 0x1938], rdi
mov rax, qword [0x1401d1010]
xor rax, rsp
mov qword [rbp + 0x1800], rax
mov rdi, rcx
mov qword [rsp + 0x78], rcx
xor esi, esi
mov dword [rsp + 0x40], esi
mov byte [rbp - 0x40], sil
mov qword [rbp - 0x28], rsi
lea ebx, [rsi + 7]
mov qword [rbp - 0x20], rbx
mov word [rbp - 0x38], si
lea rdx, str.Office_OOBE_AFO_1000
lea rcx, [rbp - 0x38]
call fcn.14000c968
mov byte [rbp - 0x18], sil
mov byte [rbp - 0x10], 1
mov qword [rbp + 8], rsi
mov qword [rbp + 0x10], rbx
mov word [rbp - 8], si
lea rdx, str.Office_OOBE_AFO_1001
lea rcx, [rbp - 8]
call fcn.14000c968
mov byte [rbp + 0x18], sil
mov byte [rbp + 0x20], 2
mov qword [rbp + 0x38], rsi
mov qword [rbp + 0x40], rbx
mov word [rbp + 0x28], si
lea rdx, str.Office_OOBE_AFO_1002
lea rcx, [rbp + 0x28]
call fcn.14000c968
mov byte [rbp + 0x48], sil
mov byte [rbp + 0x50], 3
mov qword [rbp + 0x68], rsi
mov qword [rbp + 0x70], rbx
mov word [rbp + 0x58], si
lea rdx, str.Office_OOBE_AFO_1003
lea rcx, [rbp + 0x58]
call fcn.14000c968
mov byte [rbp + 0x78], sil
mov byte [rbp + 0x80], 4
mov qword [rbp + 0x98], rsi
mov qword [rbp + 0xa0], rbx
mov word [rbp + 0x88], si
lea rdx, str.Office_OOBE_AFO_1004
lea rcx, [rbp + 0x88]
call fcn.14000c968
mov byte [rbp + 0xa8], sil
mov byte [rbp + 0xb0], 5
mov qword [rbp + 0xc8], rsi
mov qword [rbp + 0xd0], rbx
mov word [rbp + 0xb8], si
lea rdx, str.Office_OOBE_AFO_1005
lea rcx, [rbp + 0xb8]
call fcn.14000c968
mov byte [rbp + 0xd8], sil
mov byte [rbp + 0xe0], 6
mov qword [rbp + 0xf8], rsi
mov qword [rbp + 0x100], rbx
mov word [rbp + 0xe8], si
lea rdx, str.Office_OOBE_AFO_1006
lea rcx, [rbp + 0xe8]
call fcn.14000c968
mov byte [rbp + 0x108], sil
mov byte [rbp + 0x110], bl
mov qword [rbp + 0x128], rsi
mov qword [rbp + 0x130], rbx
mov word [rbp + 0x118], si
lea rdx, str.Office_OOBE_AFO_1007
lea rcx, [rbp + 0x118]
call fcn.14000c968
mov byte [rbp + 0x138], sil
mov byte [rbp + 0x140], 8
mov qword [rbp + 0x158], rsi
mov qword [rbp + 0x160], rbx
mov word [rbp + 0x148], si
lea rdx, str.Office_OOBE_AFO_1008
lea rcx, [rbp + 0x148]
call fcn.14000c968
mov byte [rbp + 0x168], sil
mov byte [rbp + 0x170], 9
mov qword [rbp + 0x188], rsi
mov qword [rbp + 0x190], rbx
mov word [rbp + 0x178], si
lea rdx, str.Office_LIC_ACTIVATION_1009
lea rcx, [rbp + 0x178]
call fcn.14000c968
mov byte [rbp + 0x198], sil
mov byte [rbp + 0x1a0], 0xa
mov qword [rbp + 0x1b8], rsi
mov qword [rbp + 0x1c0], rbx
mov word [rbp + 0x1a8], si
lea rdx, str.Office_LIC_ACTIVATION_1010
lea rcx, [rbp + 0x1a8]
call fcn.14000c968
mov byte [rbp + 0x1c8], sil
mov byte [rbp + 0x1d0], 0xb
mov qword [rbp + 0x1e8], rsi
mov qword [rbp + 0x1f0], rbx
mov word [rbp + 0x1d8], si
lea rdx, str.Office_LIC_ACTIVATION_1011
lea rcx, [rbp + 0x1d8]
call fcn.14000c968
mov byte [rbp + 0x1f8], sil
mov byte [rbp + 0x200], 0xc
mov qword [rbp + 0x218], rsi
mov qword [rbp + 0x220], rbx
mov word [rbp + 0x208], si
lea rdx, str.Office_LIC_ACTIVATION_1012
lea rcx, [rbp + 0x208]
call fcn.14000c968
mov byte [rbp + 0x228], sil
mov byte [rbp + 0x230], 0xd
mov qword [rbp + 0x248], rsi
mov qword [rbp + 0x250], rbx
mov word [rbp + 0x238], si
lea rdx, str.Office_LIC_ACTIVATION_1013
lea rcx, [rbp + 0x238]
call fcn.14000c968
mov byte [rbp + 0x258], sil
mov byte [rbp + 0x260], 0xe
mov qword [rbp + 0x278], rsi
mov qword [rbp + 0x280], rbx
mov word [rbp + 0x268], si
lea rdx, str.Office_LIC_ACTIVATION_1014
lea rcx, [rbp + 0x268]
call fcn.14000c968
mov byte [rbp + 0x288], sil
mov byte [rbp + 0x290], 0xf
mov qword [rbp + 0x2a8], rsi
mov qword [rbp + 0x2b0], rbx
mov word [rbp + 0x298], si
lea rdx, str.Office_LIC_ACTIVATION_1015
lea rcx, [rbp + 0x298]
call fcn.14000c968
mov byte [rbp + 0x2b8], sil
mov byte [rbp + 0x2c0], 0x10
mov qword [rbp + 0x2d8], rsi
mov qword [rbp + 0x2e0], rbx
mov word [rbp + 0x2c8], si
lea rdx, str.Office_LIC_ACTIVATION_1016
lea rcx, [rbp + 0x2c8]
call fcn.14000c968
mov byte [rbp + 0x2e8], sil
mov byte [rbp + 0x2f0], 0x11
mov qword [rbp + 0x308], rsi
mov qword [rbp + 0x310], rbx
mov word [rbp + 0x2f8], si
lea rdx, str.Office_LIC_ACTIVATION_1017
lea rcx, [rbp + 0x2f8]
call fcn.14000c968
mov byte [rbp + 0x318], sil
mov byte [rbp + 0x320], 0x12
mov qword [rbp + 0x338], rsi
mov qword [rbp + 0x340], rbx
mov word [rbp + 0x328], si
lea rdx, str.Office_LIC_ACTIVATION_1018
lea rcx, [rbp + 0x328]
call fcn.14000c968
mov byte [rbp + 0x348], sil
mov byte [rbp + 0x350], Ordinal_25
mov qword [rbp + 0x368], rsi
mov qword [rbp + 0x370], rbx
mov word [rbp + 0x358], si
lea rdx, str.Office_OOBE_INFO_1020
lea rcx, [rbp + 0x358]
call fcn.14000c968
mov byte [rbp + 0x378], sil
mov byte [rbp + 0x380], Ordinal_26
mov qword [rbp + 0x398], rsi
mov qword [rbp + 0x3a0], rbx
mov word [rbp + 0x388], si
lea rdx, str.Office_OOBE_INFO_1021
lea rcx, [rbp + 0x388]
call fcn.14000c968
mov byte [rbp + 0x3a8], sil
mov byte [rbp + 0x3b0], Ordinal_26
mov qword [rbp + 0x3c8], rsi
mov qword [rbp + 0x3d0], rbx
mov word [rbp + 0x3b8], si
lea rdx, str.Office_OOBE_INFO_1022
lea rcx, [rbp + 0x3b8]
call fcn.14000c968
mov byte [rbp + 0x3d8], sil
mov byte [rbp + 0x3e0], Ordinal_26
mov qword [rbp + 0x3f8], rsi
mov qword [rbp + 0x400], rbx
mov word [rbp + 0x3e8], si
lea rdx, str.Office_LIC_ACTIVATION_1023
lea rcx, [rbp + 0x3e8]
call fcn.14000c968
mov byte [rbp + 0x408], sil
mov byte [rbp + 0x410], Ordinal_26
mov qword [rbp + 0x428], rsi
mov qword [rbp + 0x430], rbx
mov word [rbp + 0x418], si
lea rdx, str.Office_LIC_ACTIVATION_1024
lea rcx, [rbp + 0x418]
call fcn.14000c968
mov byte [rbp + 0x438], sil
mov byte [rbp + 0x440], Ordinal_26
mov qword [rbp + 0x458], rsi
mov qword [rbp + 0x460], rbx
mov word [rbp + 0x448], si
lea rdx, str.Office_LIC_ACTIVATION_1025
lea rcx, [rbp + 0x448]
call fcn.14000c968
mov byte [rbp + 0x468], sil
mov byte [rbp + 0x470], reloc.hlink.dll_Ordinal_25
mov qword [rbp + 0x488], rsi
mov qword [rbp + 0x490], rbx
mov word [rbp + 0x478], si
lea rdx, str.Office_LIC_ACTIVATION_1026
lea rcx, [rbp + 0x478]
call fcn.14000c968
mov byte [rbp + 0x498], sil
mov byte [rbp + 0x4a0], reloc.hlink.dll_Ordinal_26
mov qword [rbp + 0x4b8], rsi
mov qword [rbp + 0x4c0], rbx
mov word [rbp + 0x4a8], si
lea rdx, str.Office_LIC_ACTIVATION_1034
lea rcx, [rbp + 0x4a8]
call fcn.14000c968
mov byte [rbp + 0x4c8], sil
mov byte [rbp + 0x4d0], 0x1b
mov qword [rbp + 0x4e8], rsi
mov qword [rbp + 0x4f0], rbx
mov word [rbp + 0x4d8], si
lea rdx, str.Office_LIC_ACTIVATION_1036
lea rcx, [rbp + 0x4d8]
call fcn.14000c968
mov byte [rbp + 0x4f8], sil
mov byte [rbp + 0x500], 0x1c
mov qword [rbp + 0x518], rsi
mov qword [rbp + 0x520], rbx
mov word [rbp + 0x508], si
lea rdx, str.Office_NEWLIC_UX_SIGNOUT
lea rcx, [rbp + 0x508]
call fcn.14000c968
mov byte [rbp + 0x528], sil
mov byte [rbp + 0x530], 0x1d
mov qword [rbp + 0x548], rsi
mov qword [rbp + 0x550], rbx
mov word [rbp + 0x538], si
lea rdx, str.NEWLIC_EXACT_ERR_NOCONN
lea rcx, [rbp + 0x538]
call fcn.14000c968
mov byte [rbp + 0x558], 1
mov byte [rbp + 0x560], 0x1e
mov qword [rbp + 0x578], rsi
mov qword [rbp + 0x580], rbx
mov word [rbp + 0x568], si
lea rdx, str.NEWLIC_EXACT_ERR_SVC
lea rcx, [rbp + 0x568]
call fcn.14000c968
mov byte [rbp + 0x588], 1
mov byte [rbp + 0x590], 0x1f
mov qword [rbp + 0x5a8], rsi
mov qword [rbp + 0x5b0], rbx
mov word [rbp + 0x598], si
lea rdx, str.NEWLIC_NEWACT_ERR_SVC_1ST
lea rcx, [rbp + 0x598]
call fcn.14000c968
mov byte [rbp + 0x5b8], 1
mov byte [rbp + 0x5c0], 0x20
mov qword [rbp + 0x5d8], rsi
mov qword [rbp + 0x5e0], rbx
mov word [rbp + 0x5c8], si
lea rdx, str.NEWLIC_NEWACT_ERR_SVC_2ND
lea rcx, [rbp + 0x5c8]
call fcn.14000c968
mov byte [rbp + 0x5e8], 1
mov byte [rbp + 0x5f0], 0x21
mov qword [rbp + 0x608], rsi
mov qword [rbp + 0x610], rbx
mov word [rbp + 0x5f8], si
lea rdx, str.NEWLIC_EXACT_DBL_EXPIRING
lea rcx, [rbp + 0x5f8]
call fcn.14000c968
mov byte [rbp + 0x618], 1
mov byte [rbp + 0x620], 0x22
mov qword [rbp + 0x638], rsi
mov qword [rbp + 0x640], rbx
mov word [rbp + 0x628], si
lea rdx, str.NEWLIC_EXACT_DBL_EXPIRED
lea rcx, [rbp + 0x628]
call fcn.14000c968
mov byte [rbp + 0x648], 1
mov byte [rbp + 0x650], 0x23
mov qword [rbp + 0x668], rsi
mov qword [rbp + 0x670], rbx
mov word [rbp + 0x658], si
lea rdx, str.NEWLIC_READONLY_WDAG
lea rcx, [rbp + 0x658]
call fcn.14000c968
mov byte [rbp + 0x678], 1
mov byte [rbp + 0x680], 0x24
mov qword [rbp + 0x698], rsi
mov qword [rbp + 0x6a0], rbx
mov word [rbp + 0x688], si
lea rdx, str.CANTACT_COM_NOLICENSE
lea rcx, [rbp + 0x688]
call fcn.14000c968
mov byte [rbp + 0x6a8], 1
mov byte [rbp + 0x6b0], 0x25
mov qword [rbp + 0x6c8], rsi
mov qword [rbp + 0x6d0], rbx
mov word [rbp + 0x6b8], si
lea rdx, str.CANTACT_CON_NOPRODUCT
lea rcx, [rbp + 0x6b8]
call fcn.14000c968
mov byte [rbp + 0x6d8], 1
mov byte [rbp + 0x6e0], 0x26
mov qword [rbp + 0x6f8], rsi
mov qword [rbp + 0x700], rbx
mov word [rbp + 0x6e8], si
lea rdx, str.CANTACT_CON_EXPIRED
lea rcx, [rbp + 0x6e8]
call fcn.14000c968
mov byte [rbp + 0x708], 1
mov byte [rbp + 0x710], 0x27
mov qword [rbp + 0x728], rsi
mov qword [rbp + 0x730], rbx
mov word [rbp + 0x718], si
lea rdx, str.CANTACT_CON_TRIALEXPIRED
lea rcx, [rbp + 0x718]
call fcn.14000c968
mov byte [rbp + 0x738], 1
mov byte [rbp + 0x740], 0x28
mov qword [rbp + 0x758], rsi
mov qword [rbp + 0x760], rbx
mov word [rbp + 0x748], si
lea rdx, str.CANTACT_CON_BILLPROB
lea rcx, [rbp + 0x748]
call fcn.14000c968
mov byte [rbp + 0x768], 1
xor edx, edx
mov r8d, 0x1048
lea rcx, [rbp + 0x7b0]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.Mso30Win32Client.dll_Ordinal_15]
mov r9, rax
mov r8d, 0x824
lea rdx, [rbp + 0x7b0]
mov ecx, ebx
call fcn.14002b604
lea rdx, [rbp + 0x7b0]
lea rcx, [rsp + 0x48]
call fcn.140050760
lea rbx, [rbp - 0x40]
cmp byte [rbx], 8
je 0x1400f3e4d
add rbx, 0x30
lea rax, [rbp + 0x770]
cmp rbx, rax
jne 0x1400f3e31
lea rbx, [rbp + 0x770]
lea rax, [rbp + 0x770]
cmp rbx, rax
je 0x1400f4046
lea rdx, [rbx + 8]
lea rcx, [rbp - 0x68]
call fcn.14000cc2c
mov al, byte [rbx + 0x28]
mov byte [rbp - 0x48], al
mov rcx, qword [rsp + 0x48]
test rcx, rcx
jne 0x1400f3e88
xor edx, edx
mov ecx, 0x152139a
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_2055]
int3
mov rax, qword [rcx]
lea r8, [rbp - 0x68]
cmp qword [rbp - 0x50], 8
cmovae r8, qword [rbp - 0x68]
lea rdx, str.HelpID
mov rax, qword [rax + 0x28]
call qword [case.0x140089b1f.8]
mov r8b, byte [rbp - 0x48]
lea rdx, [rsp + 0x48]
mov rcx, rdi
call fcn.1400f31b8
mov dword [rsp + 0x40], 1
lea rax, vtable.Mso::Logging::StructuredObject_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t____0_.0
mov qword [rbp + 0x770], rax
lea rax, str.Return
mov qword [rbp + 0x778], rax
mov rdx, rdi
lea rcx, [rbp + 0x780]
call fcn.14000cc2c
mov word [rbp + 0x7a0], si
lea rax, vtable.Mso::Logging::StructuredObject_wchar_t_const____ptr64__1_.0
mov qword [rsp + 0x50], rax
lea rax, str.Information
mov qword [rsp + 0x58], rax
lea rax, str.GetLicensingHelpURL_return
mov qword [rsp + 0x60], rax
mov word [rsp + 0x68], si
lea rax, [rbp + 0x770]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, str.GetLicensingHelpURL
mov qword [rsp + 0x20], rax
mov edx, 0x44c
mov ecx, 0x1709459
mov r8d, 0x32
call fcn.140012d4c
mov ebx, 0x1000
mov rax, qword [rbp + 0x798]
cmp rax, 8
jb 0x1400f3f9d
lea rax, [rax*2 + 2]
mov rcx, qword [rbp + 0x780]
mov rdx, rcx
cmp rax, rbx
jb 0x1400f3f96
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
jbe 0x1400f3f96
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
nop
mov rax, qword [rbp - 0x50]
cmp rax, 8
jb 0x1400f3fd9
lea rax, [rax*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rdx, rcx
cmp rax, rbx
jb 0x1400f3fd3
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
jbe 0x1400f3fd3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
movdqa xmm0, xmmword [0x140195bf0]
movdqu xmmword [rbp - 0x58], xmm0
mov word [rbp - 0x68], si
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400f4002
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140089b1f.8]
nop
lea r9, [fcn.140017bf0]
mov edx, 0x30
lea r8d, [rdx - 7]
lea rcx, [rbp - 0x40]
call fcn.140107e78
mov rax, rdi
mov rcx, qword [rbp + 0x1800]
xor rcx, rsp
call fcn.140107ad0
lea r11, [rsp + 0x1910]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
lea rdx, str.key_not_found
lea rcx, [rbp - 0x80]
call fcn.1400136e4
lea rdx, [0x140196e10]
lea rcx, [rbp - 0x80]
call sub.VCRUNTIME140.dll__CxxThrowException
int3