Function at 0x140005fe8
Capabilities:
Initialize winsock library

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x4b8]
sub rsp, 0x590
mov rax, qword [0x14001d040]
xor rax, rsp
mov qword [rbp + 0x480], rax
xor r13d, r13d
lea rax, [rbp - 0x70]
mov r12, r8
mov qword [rbp - 0x70], r13
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea rcx, [0x140016598]
lea r15d, [r13 + 1]
mov edx, r15d
call qword [sym.imp.OLEAUT32.dll_RegisterTypeLib]
test eax, eax
jns 0x140006083
lea rdx, [rbp - 0x70]
lea rcx, str.InstallerMainShell.tlb
call qword [sym.imp.OLEAUT32.dll_LoadRegTypeLib]
test eax, eax
js 0x140006083
mov rcx, qword [rbp - 0x70]
lea rdx, str.InstallerMainShell.tlb
xor r8d, r8d
call qword [sym.imp.OLEAUT32.dll_QueryPathOfRegTypeLib]
mov ebx, eax
test eax, eax
js 0x140006c2a
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov ebx, eax
test eax, eax
js 0x140006c2a
lea rbx, [0x14001d400]
mov rcx, qword [rbx + 8]
lea rdx, [0x1400158f0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x1400060c3
add rbx, 0x40
lea rax, [0x14001d580]
cmp rbx, rax
jne 0x14000609c
jmp 0x1400060cb
mov rcx, rbx
call fcn.14000b1e0
lea rbx, [0x140015898]
mov rcx, rbx
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_631]
mov r14d, 2
mov qword [rbp - 0x20], r13
xorps xmm0, xmm0
mov qword [rbp - 0x18], rbx
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x40], xmm0
movdqa xmmword [rbp - 0x30], xmm1
lea ecx, [r14 + 0x36]
mov dword [rbp - 0x10], r13d
mov dword [rbp - 8], ecx
mov dword [rbp - 0xc], r14d
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_147]
mov edx, r15d
lea rcx, [rbp - 0x40]
call qword [sym.imp.Mso30Win32Client.dll_Ordinal_75]
mov al, byte [0x14001d120]
test al, al
js 0x14000612a
setne al
jmp 0x140006137
lea rcx, [0x14001d120]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_3392]
test al, al
je 0x140006144
mov cl, r15b
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_45]
xor edx, edx
lea rcx, [rbp + 0x270]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.Mso30Win32Client.dll_Ordinal_1102]
mov dword [rsp + 0x30], 7
xor r9d, r9d
mov r10, rax
mov dword [rsp + 0x28], 0x104
xor r8d, r8d
mov edx, 0x97
mov rcx, qword [rax]
mov rax, qword [rcx + 0x10]
lea rcx, [rbp + 0x270]
mov qword [rsp + 0x20], rcx
mov rcx, r10
call qword [0x140014498]
test al, al
je 0x140006bfc
cmp word [rbp + 0x270], r13w
je 0x140006bfc
lea r8, [rbp]
xor edx, edx
lea rcx, [rbp + 0x270]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x1400061ce
test byte [rbp], 0x10
mov eax, r15d
je 0x1400061d1
mov eax, r13d
test eax, eax
je 0x140006bfc
mov edx, r14d
lea rcx, [rbp - 0x40]
call qword [sym.imp.Mso30Win32Client.dll_Ordinal_75]
mov edx, 3
lea rcx, [rbp - 0x40]
call qword [sym.imp.Mso30Win32Client.dll_Ordinal_75]
lea rax, [rsp + 0x42]
mov byte [rsp + 0x43], r13b
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x44]
lea rax, [rsp + 0x48]
mov word [rsp + 0x48], r14w
lea r8, [rsp + 0x46]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x40]
mov byte [rsp + 0x4a], r15b
lea rcx, [rsp + 0x50]
mov byte [rsp + 0x45], r13b
mov byte [rsp + 0x47], r13b
mov word [rsp + 0x40], 0x101
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_3572]
lea rax, str.OsfInstallerStartMain
mov word [rsp + 0x40], 0x100
lea rdi, vtable.Mso::Telemetry::EventName.0
mov qword [rsp + 0x68], rax
lea rsi, [0x140016ba8]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rsi
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_162]
test rax, rax
je 0x140006285
mov rcx, rax
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_1638]
jmp 0x14000628b
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_92]
movzx r9d, word [rsp + 0x40]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x20], rcx
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x68]
mov r8, rax
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_2794]
lea rdx, [0x140015938]
mov rcx, r12
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
jne 0x1400067d0
lea rdx, str._Embedding
mov rcx, r12
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
jne 0x1400067d0
lea rax, [rsp + 0x46]
mov byte [rsp + 0x47], r13b
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x44]
lea rax, [rsp + 0x48]
mov word [rsp + 0x48], r14w
lea r8, [rsp + 0x42]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x40]
mov byte [rsp + 0x4a], r15b
lea rcx, [rsp + 0x50]
mov byte [rsp + 0x45], r13b
mov byte [rsp + 0x43], r13b
mov word [rsp + 0x40], 0x101
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_3572]
lea rax, str.OsfInstallerStartNotCOM
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x60], rsi
mov word [rsp + 0x40], 0x100
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_162]
test rax, rax
je 0x140006361
mov rcx, rax
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_1638]
jmp 0x140006367
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_92]
movzx r9d, word [rsp + 0x40]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x20], rcx
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x70]
mov r8, rax
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_2794]
xor r8d, r8d
mov qword [rbp - 0x80], r13
lea rax, [rbp - 0x80]
lea r9, reloc.AppVIsvSubsystems64.dll_Ordinal_1
mov qword [rsp + 0x20], rax
lea rcx, [0x1400165a8]
lea r14d, [r8 + 4]
mov edx, r14d
call qword [sym.imp.ole32.dll_CoGetClassObject]
mov edx, eax
lea rcx, [rsp + 0x70]
mov edi, eax
call fcn.140005ce8
test edi, edi
js 0x1400067ab
mov rcx, qword [rbp - 0x80]
lea r9, [rbp - 0x78]
mov qword [rbp - 0x78], r13
lea r8, str.1qyp_
xor edx, edx
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [0x140014498]
mov edx, eax
lea rcx, [rsp + 0x70]
mov edi, eax
call fcn.140005ce8
test edi, edi
js 0x14000678d
lea rcx, [rbp + 0x28]
call qword [sym.imp.ole32.dll_CoCreateGuid]
mov ebx, eax
test eax, eax
jns 0x14000644f
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x140006429
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140014498]
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x14000643f
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140014498]
lea rcx, [rsp + 0x70]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_426]
jmp 0x140006bf0
mov r8d, 0x28
lea rdx, [rbp + 0x210]
lea rcx, [rbp + 0x28]
call qword [sym.imp.ole32.dll_StringFromGUID2]
test eax, eax
je 0x14000678d
mov qword [rbp], r13
lea rcx, [rbp + 0x210]
mov qword [rbp + 0x10], r13
or rax, 0xffffffffffffffff
mov qword [rbp + 0x18], 7
inc rax
cmp word [rcx + rax*2], r13w
jne 0x140006489
mov r8, rax
lea rdx, [rbp + 0x210]
lea rcx, [rbp]
call fcn.1400077c0
cmp qword [rbp + 0x18], 8
lea r8, [rbp]
mov dl, r15b
cmovae r8, qword [rbp]
xor ecx, ecx
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_1341]
mov rsi, rax
test rax, rax
je 0x140006746
cmp qword [rbp + 0x18], 8
lea rcx, [rbp]
mov rdi, qword [rbp - 0x78]
cmovae rcx, qword [rbp]
mov qword [rsp + 0x50], r13
mov rax, qword [rdi]
mov r15, qword [rax + 0x18]
test rcx, rcx
jne 0x14000668a
mov rbx, r13
lea r9, [rsp + 0x50]
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
mov rax, r15
call qword [0x140014498]
mov rcx, rbx
mov edi, eax
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test edi, edi
js 0x140006724
mov rcx, qword [rbp - 0x78]
lea r8, [rsp + 0x48]
mov qword [rsp + 0x48], r13
lea rdx, [0x140015af0]
mov rax, qword [rcx]
mov rax, qword [rax]
call qword [0x140014498]
mov edi, eax
test eax, eax
js 0x140006705
mov edx, eax
lea rcx, [rsp + 0x70]
call fcn.140005ce8
lea rax, [0x140015ad0]
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x58]
mov eax, 1
lea rdx, str.Microsoft.Office.OEP.OsfInstallerDefaultTask
lea rcx, [rbp + 0x38]
mov word [rsp + 0x60], ax
call fcn.140005e70
mov rcx, rax
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_2477]
lea rcx, [rbp + 0x38]
mov bl, al
call fcn.140005f4c
mov rdx, qword [rsp + 0x58]
test rdx, rdx
je 0x1400065b4
mov rcx, qword [rdx]
mov rax, qword [rcx + 0x10]
mov rcx, rdx
call qword [0x140014498]
lea rcx, [rsp + 0x70]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_1869]
mov r9d, r14d
lea rdx, str.DefaultTaskEnabled
mov rcx, rax
mov r8b, bl
call fcn.140008298
test bl, bl
je 0x1400066a1
call fcn.14000faf0
test al, al
je 0x1400066a1
call fcn.14000ef34
lea rcx, [rsp + 0x70]
mov ebx, eax
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_1869]
mov r9d, r14d
lea rdx, str.NetworkCost
mov rcx, rax
mov r8d, ebx
call fcn.140008324
test ebx, ebx
jne 0x1400066a1
lea rdx, str._onlogon
mov rcx, r12
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
lea rcx, [rsp + 0x70]
mov rbx, rax
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_1869]
test rbx, rbx
lea rdx, str.OnLogon
mov r9d, r14d
mov rcx, rax
setne r8b
call fcn.140008298
mov rcx, qword [rsp + 0x48]
neg rbx
mov r12d, 2
mov dword [rsp + 0x20], r13d
sbb edx, edx
xor r9d, r9d
neg edx
xor r8d, r8d
mov rax, qword [rcx]
add edx, r12d
mov rax, qword [rax + 0x18]
call qword [0x140014498]
mov edx, eax
lea rcx, [rsp + 0x70]
call fcn.140005ce8
jmp 0x1400066a7
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
test rax, rax
je 0x140006c7d
jmp 0x1400064f5
mov r12d, 2
mov rcx, qword [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], r13d
mov rax, qword [rcx]
lea edx, [r9 + 6]
mov rax, qword [rax + 0x18]
call qword [0x140014498]
mov edx, eax
lea rcx, [rsp + 0x70]
call fcn.140005ce8
mov rcx, qword [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], r13d
mov rax, qword [rcx]
lea edx, [r9 + 5]
mov rax, qword [rax + 0x18]
call qword [0x140014498]
mov edx, eax
lea rcx, [rsp + 0x70]
mov edi, eax
call fcn.140005ce8
jmp 0x14000670b
mov r12d, 2
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14000672a
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140014498]
jmp 0x14000672a
mov r12d, 2
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r15d, 1
jmp 0x14000674c
mov r12d, 2
mov rax, qword [rbp + 0x18]
cmp rax, 8
jb 0x140006793
mov rcx, qword [rbp]
lea rax, [rax*2 + 2]
mov rdx, rcx
cmp rax, 0x1000
jb 0x140006785
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
jbe 0x140006785
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140006793
mov r12d, 2
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x1400067b1
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140014498]
jmp 0x1400067b1
mov r12d, 2
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x140006b75
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140014498]
jmp 0x140006b75
lea rax, [0x140015ae0]
mov word [rsp + 0x60], r15w
lea r8, [rsp + 0x58]
mov qword [rsp + 0x58], rax
lea rdx, str.Microsoft.Office.OEP.TestGate.SDXHelperBackgroundMode
mov qword [rsp + 0x68], r13
lea rcx, [rbp + 0x38]
call fcn.140005e70
mov rcx, rax
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_2477]
lea rcx, [rbp + 0x38]
mov bl, al
call fcn.140005f4c
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140006827
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x10]
call qword [0x140014498]
test bl, bl
je 0x14000683f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x100000
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
lea rax, [rsp + 0x46]
mov byte [rsp + 0x47], r13b
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x44]
lea rax, [rsp + 0x48]
mov word [rsp + 0x48], r14w
lea r8, [rsp + 0x42]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x40]
mov byte [rsp + 0x4a], r15b
lea rcx, [rsp + 0x50]
mov byte [rsp + 0x45], r13b
mov byte [rsp + 0x43], r13b
mov word [rsp + 0x40], 0x101
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_3572]
lea rax, str.OsfInstallerStartCom
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x60], rsi
mov word [rsp + 0x40], 0x100
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_162]
test rax, rax
je 0x1400068c1
mov rcx, rax
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_1638]
jmp 0x1400068c7
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_92]
movzx r9d, word [rsp + 0x40]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x20], rcx
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x70]
mov r8, rax
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_2794]
call fcn.1400052bc
call fcn.140004d38
mov edx, eax
lea rcx, [rsp + 0x70]
mov edi, eax
call fcn.140005ce8
test edi, edi
js 0x140006b72
call qword [sym.imp.ole32.dll_CoResumeClassObjects]
mov edx, eax
lea rcx, [rsp + 0x70]
mov edi, eax
call fcn.140005ce8
test edi, edi
js 0x140006b72
mov rsi, qword [0x14001ef28]
lea rax, [0x140014ca8]
mov qword [rbp + 0x210], rax
mov qword [rbp + 0x218], r13
mov qword [rbp + 0x220], r13
lea rcx, [rsi + 0x18]
mov qword [rbp + 0x228], r13
mov qword [rbp + 0x230], r13
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14001f0d8]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [rbx + 0x10]
mov r12d, 1
add ecx, r12d
mov r15d, eax
movsxd rdx, ecx
mov rcx, qword [rbx]
lea r14d, [r12 + 3]
mov r8d, r14d
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__recalloc]
test rax, rax
je 0x1400069e8
mov rcx, qword [rbx + 8]
lea r8d, [r12 + 7]
mov qword [rbx], rax
mov eax, dword [rbx + 0x10]
add eax, r12d
movsxd rdx, eax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__recalloc]
test rax, rax
je 0x1400069e8
movsxd rdx, dword [rbx + 0x10]
mov qword [rbx + 8], rax
mov rax, qword [rbx]
lea rcx, [rax + rdx*4]
test rcx, rcx
je 0x1400069cd
mov dword [rcx], r15d
mov rax, qword [rbx + 8]
lea rdx, [rax + rdx*8]
test rdx, rdx
je 0x1400069e4
lea rax, [rbp + 0x210]
mov qword [rdx], rax
add dword [rbx + 0x10], r12d
lea rcx, [rsi + 0x18]
mov r15, r12
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
movsxd r8, dword [rbp + 0x224]
lea rax, [0x140014ca0]
mov edx, dword [rbp + 0x220]
mov qword [rbp - 0x80], rax
cmp edx, r8d
jne 0x140006a87
mov r9, qword [rbp + 0x218]
lea rax, [rsp + 0x50]
cmp rax, r9
jb 0x140006a34
lea rax, [rsp + 0x50]
lea rcx, [r9 + r8*8]
cmp rax, rcx
mov eax, r13d
jb 0x140006a37
mov eax, r15d
test eax, eax
je 0x140006c72
test r8d, r8d
jne 0x140006a49
mov ebx, r15d
jmp 0x140006a50
lea ebx, [rdx + rdx]
test ebx, ebx
js 0x140006ab0
mov edx, ebx
cmp rdx, 0xfffffff
ja 0x140006ab0
mov r8d, 8
mov rcx, r9
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__recalloc]
mov rcx, rax
test rax, rax
je 0x140006ab0
mov edx, dword [rbp + 0x220]
mov dword [rbp + 0x224], ebx
mov qword [rbp + 0x218], rax
jmp 0x140006a8e
mov rcx, qword [rbp + 0x218]
movsxd rax, edx
lea r8, [rcx + rax*8]
test r8, r8
je 0x140006aa7
lea rax, [rbp - 0x80]
mov qword [r8], rax
mov edx, dword [rbp + 0x220]
add edx, r15d
mov dword [rbp + 0x220], edx
mov r12d, 2
lea rdx, [rbp + 0x70]
mov ecx, r12d
call qword [sym.imp.WS2_32.dll_WSAStartup]
lea rcx, [rbp + 0x210]
mov ebx, eax
call fcn.1400050cc
test ebx, ebx
jne 0x140006adb
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov rsi, qword [0x14001ef28]
lea rcx, [rsi + 0x18]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14001f0d8]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r10d, eax
mov edx, r13d
or rax, 0xffffffffffffffff
cmp dword [rbx + 0x10], r13d
jle 0x140006b26
movsxd r9, dword [rbx + 0x10]
mov r8, r13
mov rcx, qword [rbx]
cmp dword [rcx], r10d
je 0x140006b28
add edx, r15d
add r8, r15
add rcx, r14
cmp r8, r9
jl 0x140006b13
mov edx, eax
cmp edx, eax
je 0x140006b34
mov rcx, rbx
call fcn.140007600
lea rcx, [rsi + 0x18]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rbp + 0x228]
test rcx, rcx
je 0x140006b57
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbp + 0x228], r13
mov rcx, qword [rbp + 0x218]
mov qword [rbp + 0x230], r13
test rcx, rcx
je 0x140006b75
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140006b75
mov r12d, r14d
lea rcx, [rsp + 0x70]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_426]
mov eax, edi
mov byte [rsp + 0x41], r15b
shr eax, 0x1f
lea rcx, [rbp - 0x68]
xor al, r15b
mov byte [rsp + 0x40], al
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_3604]
movzx ecx, word [rsp + 0x40]
mov word [rax], cx
lea rcx, [rbp - 0x68]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_827]
mov edx, 3
mov qword [rbp - 0x58], r13
lea rcx, [rbp - 0x58]
mov qword [rbp - 0x48], r13
mov byte [rbp - 0x50], r15b
call qword [sym.imp.Mso30Win32Client.dll_Ordinal_202]
mov edx, r12d
lea rcx, [rbp - 0x58]
call qword [sym.imp.Mso30Win32Client.dll_Ordinal_202]
mov edx, r15d
lea rcx, [rbp - 0x58]
call qword [sym.imp.Mso30Win32Client.dll_Ordinal_202]
call qword [sym.imp.Mso30Win32Client.dll_Ordinal_220]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov ebx, edi
lea rcx, [rbp - 0x68]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_426]
jmp 0x140006c2a
mov edx, r15d
mov qword [rsp + 0x58], r13
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x68], r13
mov byte [rsp + 0x60], r15b
call qword [sym.imp.Mso30Win32Client.dll_Ordinal_202]
call qword [sym.imp.Mso30Win32Client.dll_Ordinal_220]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov ebx, 0x80004005
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x140006c40
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x10]
call qword [0x140014498]
mov eax, ebx
mov rcx, qword [rbp + 0x480]
xor rcx, rsp
call fcn.140011250
lea r11, [rsp + 0x590]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x80004005
call fcn.1400012f0
int3
mov ecx, 0x8007000e
call fcn.1400012f0
int3