Function at 0x1400d81f0
Capabilities:
Create process on windows
Execute command
Get common file path
Get proxy
Persist via app paths registry key
Query or enumerate registry value
Schedule task via at
Self delete
Set registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x880]
sub rsp, 0x980
mov qword [rbp + 0x10], 0xfffffffffffffffe
mov qword [rsp + 0x9d0], rbx
mov rax, qword [0x1401b5148]
xor rax, rsp
mov qword [rbp + 0x870], rax
mov r13, rdx
mov r12, rcx
mov qword [rsp + 0x58], rcx
xor eax, eax
mov dword [rbp - 0x58], eax
mov dword [rbp - 0x60], eax
add rdx, 0x240
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
nop
lea rdx, [r13 + 0x248]
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
nop
lea rcx, [rbp - 0x18]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
xor r8d, r8d
lea rdx, str.Microsoft_Office
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x1400d8423
xor r8d, r8d
lea rdx, str.Program_Files__x86_
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
lea rdx, [rsp + 0x50]
test eax, eax
jns 0x1400d82fc
lea rcx, [rbp - 0x18]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
lea r8, str.Program_Files__x86_
lea rdx, str.Program_Files
lea rcx, [rbp - 0x18]
call qword [sym.imp.mfc140u.dll_CMFCToolBar::RebuildAccelerationKeys]
lea rdx, [rbp - 0x18]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rcx, rax
call fcn.1400e5df0
cmp al, 1
jne 0x1400d834c
lea rdx, [rbp - 0x18]
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
jmp 0x1400d8423
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rcx, rax
call fcn.1400e5df0
test al, al
jne 0x1400d834c
lea r8, str.Program_Files
lea rdx, str.Program_Files__x86_
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCToolBar::RebuildAccelerationKeys]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rcx, rax
call fcn.1400e5df0
cmp al, 1
je 0x1400d8423
mov edx, 0x5c
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_COleControl::ReleaseCaches]
mov ebx, eax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
sub eax, ebx
lea r8d, [rax - 1]
lea rdx, [rbp - 0x68]
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_12600]
nop
lea rcx, [rsp + 0x40]
call fcn.1400df470
mov r15, rax
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rbp - 0x58], 0xe
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov rdx, r14
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rbp + 8]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
xor r8d, r8d
lea rdx, str.Microsoft_Office
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x1400d85f2
xor r8d, r8d
lea rdx, [0x14015e558]
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x1400d85a4
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rcx, rax
call fcn.1400e5df0
test al, al
jne 0x1400d8594
xor r8d, r8d
lea rdx, str.Program_Files__x86_
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x1400d8594
lea r8, str.Program_Files
lea rdx, str.Program_Files__x86_
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCToolBar::RebuildAccelerationKeys]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rcx, rax
call fcn.1400e5df0
test al, al
jne 0x1400d8594
lea rdx, [0x14015e570]
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rsp + 0x40]
call fcn.1400df470
mov r15, rax
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rbp - 0x58], 0x16
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov rdx, r14
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea r8, [0x14012c468]
lea rdx, [0x14015e580]
jmp 0x1400d85e7
xor r8d, r8d
lea rdx, str.Program_Files__x86_
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x1400d85f2
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rcx, rax
call fcn.1400e5df0
test al, al
jne 0x1400d85f2
lea r8, str.Program_Files
lea rdx, str.Program_Files__x86_
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCToolBar::RebuildAccelerationKeys]
xor r8d, r8d
lea rdx, str.SysWOW64
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x1400d8678
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rcx, rax
call fcn.1400e5df0
test al, al
jne 0x1400d8678
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x18]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
lea r8, str.System32
lea rdx, str.SysWOW64
lea rcx, [rbp - 0x18]
call qword [sym.imp.mfc140u.dll_CMFCToolBar::RebuildAccelerationKeys]
lea rdx, [rbp - 0x18]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rcx, rax
call fcn.1400e5df0
cmp al, 1
jne 0x1400d8678
lea rdx, [rbp - 0x18]
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
xor r8d, r8d
lea rdx, str.mlcfg32.cpl
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
jle 0x1400d86ae
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rcx, rax
call fcn.1400e35d0
jmp 0x1400dd6ea
lea rdx, str.rundirectmailcfg
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
test eax, eax
jne 0x1400d8811
lea rdx, str.MLCFG32.CPL
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rsp + 0x40]
call fcn.1400df470
nop
lea r8, [rsp + 0x48]
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.14000ce20
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov rdi, rax
mov dword [rbp - 0x58], 0x46
mov esi, 0x22
mov word [rbp - 0x60], si
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r9, rax
mov dword [rsp + 0x20], ebx
lea r8d, [rsi - 0x21]
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
movzx r8d, sil
mov rdx, rdi
lea rcx, [rbp - 0x68]
call fcn.14008c910
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, [0x14015e608]
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rbx, rax
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r8, rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
mov r9, rbx
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rdx, str.success
mov rcx, r12
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x1400dd6fb
lea rdx, str.displayswitch
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov esi, 0x22
test eax, eax
jne 0x1400d89ce
lea rdx, str.C:WindowsSystem32DisplaySwitch.exe
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__9]
nop
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rdx, rax
lea rcx, [rbp - 0x70]
call fcn.1400e6110
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
xor r15d, r15d
xor r8d, r8d
lea rdx, str..cpl
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x1400d8939
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov rdi, rax
mov dword [rbp - 0x58], CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup
mov word [rbp - 0x60], si
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r9, rax
mov dword [rsp + 0x20], ebx
mov r8d, 1
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov r8b, 0x22
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.14008c910
nop
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, str.control.exe
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCControlRendererInfo::CMFCControlRendererInfo]
lea rdx, str.regdelete
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
test eax, eax
jne 0x1400d8967
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rcx, rax
call fcn.1400d61e0
lea rdx, [0x14015e890]
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
test eax, eax
jne 0x1400d8cfa
lea rax, [rsp + 0x40]
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rbx, rax
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.1400e0ca0
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x1400dd6ea
lea rdx, str.runmailcfg
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
test eax, eax
jne 0x1400d8875
lea rcx, [rsp + 0x68]
call fcn.1400df4f0
nop
call fcn.1400e4880
call fcn.1400e1780
test al, al
je 0x1400d8a21
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rcx, rax
call fcn.1400e5df0
test al, al
jne 0x1400d8c11
lea rdx, str.C:Program_Files__x86_Microsoft_OfficeOffice15MLCFG32.CPL
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rcx, rax
call fcn.1400e5df0
test al, al
jne 0x1400d8c11
lea rdx, str.C:Program_Files__x86_Microsoft_OfficeOffice14MLCFG32.CPL
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rcx, rax
call fcn.1400e5df0
test al, al
jne 0x1400d8c11
lea rdx, str.C:Program_Files__x86_Microsoft_OfficeOffice16MLCFG32.CPL
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rcx, rax
call fcn.1400e5df0
test al, al
jne 0x1400d8c11
lea rdx, str.C:Program_FilesMicrosoft_Office_rootOffice16MLCFG32.CPL
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
call fcn.1400e1780
test al, al
je 0x1400d8af2
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rcx, rax
call fcn.1400e5df0
test al, al
jne 0x1400d8c11
lea rdx, str.C:Program_FilesMicrosoft_OfficeOffice15MLCFG32.CPL
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rcx, rax
call fcn.1400e5df0
test al, al
jne 0x1400d8c11
lea rdx, str.C:Program_FilesMicrosoft_OfficeOffice14MLCFG32.CPL
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rcx, rax
call fcn.1400e5df0
test al, al
jne 0x1400d8c11
lea rdx, str.C:Program_FilesMicrosoft_OfficeOffice16MLCFG32.CPL
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rcx, rax
call fcn.1400e5df0
test al, al
jne 0x1400d8c11
lea rdx, str.MLCFG32.CPL
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rsp + 0x40]
call fcn.1400df470
nop
lea r8, [rsp + 0x48]
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.14000ce20
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, [rbp - 0x78]
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rcx, rax
call fcn.1400e35d0
lea rdx, [0x140144a28]
mov rcx, r12
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__9]
nop
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x1400dd6fb
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov rdi, rax
mov dword [rbp - 0x58], operator
mov word [rbp - 0x60], si
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r9, rax
mov dword [rsp + 0x20], ebx
mov r8d, 1
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov r8b, 0x22
mov rdx, rdi
lea rcx, [rbp - 0x68]
call fcn.14008c910
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, str.control.exe
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__9]
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rbx, rax
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r8, rax
mov dword [rsp + 0x28], 1
xor r15d, r15d
mov qword [rsp + 0x20], r15
mov r9, rbx
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x1400d8878
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.ChangeProxySetting
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400d8f78
lea rdx, str._8.8.8.8:8080
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400d8f5d
cmp qword [rbp - 0x30], 0
je 0x1400d8f5d
mov dword [rbp - 0x60], 1
lea rdx, str.ProxyOverride
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__9]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
mov dword [rbp - 0x20], 0x400
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rbp + 0x60]
call fcn.1400d2c50
lea rcx, [rbp - 0x20]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x470]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rax]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
lea rax, [rbp + 0x68]
mov rcx, qword [rbp + 0x60]
cmp rcx, rax
je 0x1400d8e16
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test ebx, ebx
jne 0x1400d8e2c
lea rdx, [rbp + 0x470]
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCControlRendererInfo::CMFCControlRendererInfo]
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CFileDialog::SetTemplate]
xor r8d, r8d
lea rdx, [0x140136680]
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
jns 0x1400d8e62
lea rdx, str._local_
lea rcx, [rsp + 0x68]
call qword [0x14012a1a8]
mov dword [rsp + 0x28], 4
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.ProxyEnable
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, 1
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_4946]
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.ProxyServer
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.ProxyOverride
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rbp - 0x60], 1
mov dword [rsp + 0x28], 4
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.AutoDetect
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x1400dd6ea
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.deletebrowsinghistory
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400d904e
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.sitel
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400d9026
xor edx, edx
lea ecx, [rbx + 1]
call fcn.1400d6870
xor edx, edx
lea ecx, [rbx + 1]
call fcn.1400d6b30
call fcn.1400d6790
xor edx, edx
lea ecx, [rdx + 1]
call fcn.1400d6e10
xor edx, edx
lea ecx, [rdx + 1]
call fcn.1400d6870
xor edx, edx
lea ecx, [rdx + 1]
call fcn.1400d6b30
jmp 0x1400dd6ea
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.SelectFolder
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400d9186
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x60]
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x20], xmm0
lea rax, [rbp + 0x60]
mov qword [rbp + 0x30], rax
lea rax, str.Please__select_a_folder
mov qword [rbp + 0x38], rax
mov dword [rbp + 0x40], r15d
mov qword [rbp + 0x48], r15
mov qword [rbp + 0x50], r15
mov dword [rbp + 0x58], 0xffffffff
lea rcx, [rbp + 0x20]
call qword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
test rax, rax
je 0x1400d9175
lea rdx, [rbp + 0x60]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea rdx, [rbp + 0x60]
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__9]
nop
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CFileDialog::SetTemplate]
mov rdx, rax
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x58], rax
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__9]
mov rbx, rax
mov qword [rbp - 0x80], rax
call sub.mfc140u.dll_AfxFieldText
mov rcx, qword [rax + 8]
add rcx, 0x1f8
mov rdx, rbx
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
mov rcx, rbx
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x1400dd6ea
lea rdx, str.You_have_cancelled_the_process__Please_exit_the_solution_by_clicking_on_the_cross_Button
lea rcx, [rsp + 0x40]
jmp 0x1400db834
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.CreateRegKey
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400d9507
lea rax, [rbp - 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftOffice16.0ExcelSecurity
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + 0x68], r15d
test eax, eax
jne 0x1400dd6ea
mov dword [rbp - 0x60], r15d
mov dword [rbp - 0x30], 4
mov dword [rbp - 0x20], 0x3ff
lea rax, [rbp - 0x20]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x30]
xor r8d, r8d
lea rdx, str.ExtensionHardening
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r15d, eax
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rbp - 0x40]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.1400e6e30
nop
lea rdx, str.Temp
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rbp - 0x58], 0x806
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov rdx, r14
lea rcx, [rbp - 0x40]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, str.BackupValue.txt
lea rcx, [rbp - 0x28]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rbp - 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rbp - 0x58], 0x1006
lea rcx, [rbp - 0x28]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rbp - 0x28]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
lea rcx, [rbp - 0x40]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
lea rcx, [rbp - 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov rdx, r14
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x28]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], 1
mov r9d, 0x40
lea r8d, [r9 - 0x3e]
lea rcx, [rbp + 0x60]
call fcn.14000fa10
nop
mov rax, qword [rbp + 0x60]
movsxd rcx, dword [rax + 4]
test byte [rbp + rcx + 0x70], 6
jne 0x1400d942c
lea rcx, [rbp + 0x60]
test r15d, r15d
jne 0x1400d9420
lea rdx, str.The_Original_value_of_ExtensionHardening_is_:
call fcn.14000f1b0
mov rcx, rax
mov edx, dword [rbp - 0x60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
jmp 0x1400d942c
lea rdx, str.The_key_ExtensionHardening_is_not_present
call fcn.14000f1b0
lea rcx, [rbp + 0x68]
call fcn.140011950
test rax, rax
jne 0x1400d9456
mov rax, qword [rbp + 0x60]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x60]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.ExtensionHardening
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rax, qword [rbp + 0x60]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x60], rax
mov rax, qword [rbp + 0x60]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x5c], edx
lea rcx, [rbp + 0x68]
call fcn.14000fcb0
lea rcx, [rbp + 0x70]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x108]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x1400dd6ea
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.updateSymantec
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400d965a
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rdx, str.AnakageFilesVBScriptsSymantecLiveUpdate.bat
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rsp + 0x40]
call fcn.1400e7c60
nop
lea r8, [rsp + 0x70]
mov rdx, rax
lea rcx, [rbp - 0x48]
call fcn.14000ce20
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rax, [rbp - 0x70]
mov qword [rsp + 0x58], rax
lea rdx, [0x1401312ec]
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
mov rbx, rax
lea rdx, [rbp - 0x48]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
nop
xor r8d, r8d
mov rdx, rbx
mov rcx, rax
call fcn.1400ee720
call sub.mfc140u.dll_AfxFieldText
mov rcx, qword [rax + 8]
cmp dword [rcx + 0x208], 0
jne 0x1400d9629
lea rdx, str.You_have_cancelled_the_process__so_problem_might_not_be_resolved._Please_contact_IT_Support_team.
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
mov rdx, rax
mov rcx, r13
call fcn.14006c340
nop
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x1400dd6ea
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.CheckDefaultEmailAppIsOutlook
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400d97a1
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rdx, str.HKEY_CURRENT_USERSoftwareMicrosoftWindowsShellAssociationsUrlAssociationsmailtoUserChoice
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x78]
call fcn.1400e6b90
mov qword [rsp + 0x78], rax
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400d976e
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x270]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x270]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0xffff
lea r8, str.ProgId
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x1400dd6ea
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.LaunchMirrorOP
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400d985c
call fcn.1400e16c0
movzx ebx, al
lea rdx, str.C:Program_FilesMirrorOpMirrorOp.exe
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
cmp bl, 1
jne 0x1400d981e
lea rdx, str.C:Program_Files__x86_MirrorOpMirrorOp.exe
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r8, rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r15
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x1400dd6ea
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.CloseChrome
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400d9941
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rdx, str.taskkill__F__IM_chrome.exe__T
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
mov rdx, rax
lea rcx, [rbp - 0x70]
call fcn.1400e6110
nop
mov rdx, rax
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rbx, rax
lea rdx, str.closing_chrome_browser_forcefully
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
mov r8d, 0xffffffff
mov rdx, rbx
mov rcx, rax
call fcn.1400ee8c0
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x1400dd6ea
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.CloseZoom
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400d9a26
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rdx, str.taskkill__F__IM_Zoom.exe__T
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
mov rdx, rax
lea rcx, [rbp - 0x70]
call fcn.1400e6110
nop
mov rdx, rax
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rbx, rax
lea rdx, str.closing_Zoom_meetings_forcefully
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
mov r8d, 0xffffffff
mov rdx, rbx
mov rcx, rax
call fcn.1400ee8c0
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x1400dd6ea
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.Closeoutlook
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400d9b0b
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rdx, str.taskkill__F__IM_outlook.exe__T
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
mov rdx, rax
lea rcx, [rbp - 0x70]
call fcn.1400e6110
nop
mov rdx, rax
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rbx, rax
lea rdx, str.closing_outlook_meetings_forcefully
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
mov r8d, 0xffffffff
mov rdx, rbx
mov rcx, rax
call fcn.1400ee8c0
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x1400dd6ea
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.symantecManualUpdate
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400d9c6e
lea rdx, str.AnakageFilesVBScriptsSymantecManualUpdate.bat
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rsp + 0x40]
call fcn.1400e7c60
mov r14, rax
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov dword [rbp - 0x58], 0x4006
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r14
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r14
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rax, [rbp - 0x70]
mov qword [rsp + 0x58], rax
lea rdx, [0x1401312ec]
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
mov rbx, rax
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
nop
xor r8d, r8d
mov rdx, rbx
mov rcx, rax
call fcn.1400ee720
call sub.mfc140u.dll_AfxFieldText
mov rcx, qword [rax + 8]
cmp dword [rcx + 0x208], 0
jne 0x1400d9c5f
lea rdx, str.You_have_cancelled_the_process__so_problem_might_not_be_resolved._Please_contact_IT_Support_team.
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
mov rdx, rax
mov rcx, r13
call fcn.14006c340
nop
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x1400dd6ea
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.officeRepair
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400daac4
lea rcx, [rbp - 0x40]
call fcn.1400df4f0
nop
call fcn.1400e18a0
mov byte [rbp - 0x38], al
call fcn.1400e16c0
mov byte [rbp - 0x60], al
lea rcx, [rbp - 0x20]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rbp - 0x40]
call qword [sym.imp.mfc140u.dll_CPngImage::LoadFromBuffer]
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CPngImage::LoadFromBuffer]
mov rcx, rax
lea rdx, str.office
call fcn.14000e250
test al, al
je 0x1400da3f8
lea rdx, str.AnakageFilesVBScriptsOfficeConfig.xml
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rsp + 0x40]
call fcn.1400e7c60
mov r15, rax
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rbp - 0x58], 0x8006
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov rdx, r14
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, [0x140134cd0]
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rdx, [0x140134cd0]
lea rcx, [rbp - 0x28]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rbp - 0x28]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r15, rax
mov dword [rbp - 0x58], 0x10006
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
lea rcx, [rbp - 0x28]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
lea rcx, [rbp - 0x28]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
nop
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rbp - 0x58], 0x30006
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov rdx, r14
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x28]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
xor r8d, r8d
lea rdx, str.office15
lea rcx, [rbp - 0x40]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x1400d9f37
lea rdx, str.office13
jmp 0x1400d9f77
xor r8d, r8d
lea rdx, [0x14015edd8]
lea rcx, [rbp - 0x40]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x1400d9f58
lea rdx, str.office16
jmp 0x1400d9f77
xor r8d, r8d
lea rdx, str.office14
lea rcx, [rbp - 0x40]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x1400d9f81
lea rdx, str.office10
lea rcx, [rbp - 0x20]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
xor r8d, r8d
lea rdx, str.root
lea rcx, [rbp - 0x40]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
lea rcx, [rsp + 0x78]
test eax, eax
lea rdx, str.ClickToRun
jns 0x1400d9fac
lea rdx, [0x14015ee34]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, [0x14015ee34]
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400da128
lea rcx, [rbp - 0x20]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.office13
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rbp - 0x20]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400da056
lea rdx, str.C:Program_FilesCommon_Filesmicrosoft_sharedOFFICE15Office_Setup_ControllerSetup.exe
jmp 0x1400da0f8
lea rcx, [rbp - 0x20]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.office16
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rbp - 0x20]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400da0a8
lea rdx, str.C:Program_FilesCommon_Filesmicrosoft_sharedOFFICE16Office_Setup_ControllerSetup.exe
jmp 0x1400da0f8
lea rcx, [rbp - 0x20]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.office10
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rbp - 0x20]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400da103
lea rdx, str.C:Program_FilesCommon_Filesmicrosoft_sharedOFFICE14Office_Setup_ControllerSetup.exe
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
cmp byte [rbp - 0x38], 0
je 0x1400da128
cmp byte [rbp - 0x60], 0
je 0x1400da128
lea r8, str.Program_Files__x86
lea rdx, str.Program_Files
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCToolBar::RebuildAccelerationKeys]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rcx, rax
call fcn.1400e5df0
test al, al
je 0x1400da3b3
lea rdx, [0x140134cd0]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rdx, [0x140134cd0]
lea rcx, [rbp - 0x28]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rbp - 0x28]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r15, rax
mov dword [rbp - 0x58], 0x40006
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
lea rcx, [rbp - 0x28]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
lea rcx, [rbp - 0x28]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
nop
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rbp - 0x58], 0xc0006
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov rdx, r14
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x28]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, str.__repair_standard__config
lea rcx, [rsp + 0x68]
call qword [0x14012a1a8]
lea r8, [rbp - 0x30]
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x68]
call fcn.14000ce20
nop
lea rax, [rsp + 0x40]
mov qword [rsp + 0x58], rax
lea rdx, [0x14013e710]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
mov rbx, rax
lea rdx, [rbp - 0x68]
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
nop
mov r8d, 0xffffffff
mov rdx, rbx
mov rcx, rax
call fcn.1400ee8c0
lea rdx, str.Ank.bat
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rsp + 0x40]
call fcn.1400e91b0
nop
lea r8, [rbp - 0x60]
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.14000ce20
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rcx, rax
lea rdx, [0x140139944]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
mov rbx, rax
test rax, rax
je 0x1400da363
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov rcx, rbx
call fcn.14003ce20
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
lea rax, [rbp - 0x70]
mov qword [rsp + 0x58], rax
lea rdx, [0x1401312ec]
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
mov rbx, rax
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
nop
xor r8d, r8d
mov rdx, rbx
mov rcx, rax
call fcn.1400ee720
nop
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x68]
jmp 0x1400daa51
lea rax, [rsp + 0x40]
mov qword [rsp + 0x58], rax
lea rdx, str.NotFound
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
mov rbx, rax
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
nop
mov r8d, 0xffffffff
mov rdx, rbx
mov rcx, rax
call fcn.1400ee8c0
jmp 0x1400daa57
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CPngImage::LoadFromBuffer]
mov rcx, rax
lea rdx, str.skype
call fcn.14000e250
test al, al
je 0x1400daa57
lea rdx, str.AnakageFilesVBScriptsSkypeConfig.xml
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rbp - 0x70]
call fcn.1400e7c60
mov r15, rax
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rbp - 0x58], 0x400006
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov rdx, r14
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, [0x140134cd0]
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rdx, [0x140134cd0]
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r15, rax
mov dword [rbp - 0x58], 0x800006
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
nop
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rbp - 0x58], 0x1800006
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov rdx, r14
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rdx, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionApp_PathsLync.EXEPath
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rbp - 0x28]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
lea rdx, [rbp - 0x28]
mov rcx, rax
call fcn.1400e01e0
test eax, eax
jne 0x1400daa35
lea rax, [rbp - 0x50]
mov qword [rbp - 0x80], rax
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rbx, rax
lea rdx, str.Office_Lync_Path
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
mov r8d, 0xffffffff
mov rdx, rbx
mov rcx, rax
call fcn.1400ee8c0
lea rcx, [rbp - 0x28]
call qword [sym.imp.mfc140u.dll_CPngImage::LoadFromBuffer]
mov rcx, rax
xor r8d, r8d
lea rdx, [0x14015edd8]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x1400da6b0
lea rdx, str.C:Program_FilesCommon_Filesmicrosoft_sharedOFFICE16Office_Setup_Controller_setup.exe
jmp 0x1400da702
lea rcx, [rbp - 0x28]
call qword [sym.imp.mfc140u.dll_CPngImage::LoadFromBuffer]
mov rcx, rax
xor r8d, r8d
lea rdx, str.office15
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x1400da6da
lea rdx, str.C:Program_FilesCommon_Filesmicrosoft_sharedOFFICE15Office_Setup_Controller_setup.exe
jmp 0x1400da702
lea rcx, [rbp - 0x28]
call qword [sym.imp.mfc140u.dll_CPngImage::LoadFromBuffer]
mov rcx, rax
xor r8d, r8d
lea rdx, str.office14
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x1400da70d
lea rdx, str.C:Program_FilesCommon_Filesmicrosoft_sharedOFFICE14Office_Setup_Controller_setup.exe
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
cmp byte [rbp - 0x38], 0
je 0x1400da732
cmp byte [rbp - 0x60], 0
je 0x1400da732
lea r8, str.Program_Files__x86
lea rdx, str.Program_Files
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCToolBar::RebuildAccelerationKeys]
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rcx, rax
call fcn.1400e5df0
test al, al
je 0x1400da9f7
lea rdx, [0x140134cd0]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rdx, [0x140134cd0]
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r15, rax
mov dword [rbp - 0x58], 0x2000006
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
nop
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rbp - 0x58], 0x6000006
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov rdx, r14
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, str.__repair_Lync__config
lea rcx, [rsp + 0x68]
call qword [0x14012a1a8]
lea r8, [rbp - 0x30]
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x60]
call fcn.14000ce20
nop
lea rax, [rbp - 0x50]
mov qword [rbp - 0x48], rax
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rbx, rax
lea rdx, str.CommandToRun_with_xml_file
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
mov r8d, 0xffffffff
mov rdx, rbx
mov rcx, rax
call fcn.1400ee8c0
lea rax, [rbp - 0x80]
mov qword [rsp + 0x70], rax
lea rdx, [0x14013e710]
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
mov rbx, rax
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
nop
mov r8d, 0xffffffff
mov rdx, rbx
mov rcx, rax
call fcn.1400ee8c0
lea rdx, str.Ank.bat
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rbp - 0x80]
call fcn.1400e91b0
nop
lea r8, [rbp - 0x70]
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.14000ce20
nop
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rcx, rax
lea rdx, [0x140139944]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
mov rbx, rax
test rax, rax
je 0x1400da9a5
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov rcx, rbx
call fcn.14003ce20
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
lea rax, [rbp - 0x50]
mov qword [rbp - 0x48], rax
lea rdx, [0x1401312ec]
lea rcx, [rbp - 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
mov rbx, rax
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
nop
xor r8d, r8d
mov rdx, rbx
mov rcx, rax
call fcn.1400ee720
nop
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x1400daa35
lea rax, [rbp - 0x80]
mov qword [rbp - 0x70], rax
lea rdx, str.NotFound
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
mov rbx, rax
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
nop
mov r8d, 0xffffffff
mov rdx, rbx
mov rcx, rax
call fcn.1400ee8c0
nop
lea rcx, [rbp - 0x28]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
call sub.mfc140u.dll_AfxFieldText
mov rcx, qword [rax + 8]
cmp dword [rcx + 0x208], 0
jne 0x1400daa87
lea rdx, str.You_have_cancelled_the_process__so_problem_might_not_be_resolved._Please_contact_IT_Support_team.
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
mov rdx, rax
mov rcx, r13
call fcn.14006c340
nop
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x20]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x1400dd6ea
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.deleteRegistry
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400dab27
lea rdx, str.SoftwareSymantecPKI_Client
mov rcx, 0xffffffff80000001
call fcn.1400e2a10
jmp 0x1400dd6ea
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.regset
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400dad96
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.officedisablehardwareaccl
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400dacd8
mov qword [rbp - 0x10], r15
mov dword [rbp - 8], r15d
mov qword [rbp], r15
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rsp + 0x58]
call fcn.1400e93c0
nop
mov rdx, rax
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, str.commongraphics
lea rcx, [rsp + 0x78]
call qword [0x14012a1a8]
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r8, rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r15d
xor r9d, r9d
mov rdx, 0xffffffff80000001
lea rcx, [rbp - 0x10]
call fcn.1400d4830
test eax, eax
je 0x1400dac67
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x1400dac63
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x10], r15
mov dword [rbp - 8], r15d
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r8, rax
mov rdx, 0xffffffff80000001
mov r9d, 0x2001f
lea rcx, [rbp - 0x10]
call fcn.1400e21d0
mov rbx, qword [rbp - 0x10]
test eax, eax
jne 0x1400dacc7
mov dword [rsp + 0x68], 1
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.DisableHardwareAcceleration
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
jmp 0x1400dcee7
xor r8d, r8d
lea rdx, [0x1401413b0]
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov ebx, eax
mov r8d, eax
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CStringList::InsertBefore]
nop
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
sub eax, ebx
lea r8d, [rax - 1]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_12600]
nop
lea rax, [rsp + 0x58]
mov qword [rsp + 0x70], rax
lea rax, [rbp - 0x80]
mov qword [rbp - 0x48], rax
lea rdx, str.DWORD
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
mov rdi, rax
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rbx, rax
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
nop
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call fcn.1400d2f80
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x1400dd6ea
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.regstringset
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400daea3
xor r8d, r8d
lea rdx, [0x1401413b0]
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov ebx, eax
mov r8d, eax
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CStringList::InsertBefore]
nop
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
sub eax, ebx
lea r8d, [rax - 1]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_12600]
nop
lea rax, [rsp + 0x58]
mov qword [rsp + 0x70], rax
lea rax, [rbp - 0x80]
mov qword [rbp - 0x48], rax
lea rdx, str.string
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
mov rdi, rax
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rbx, rax
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
nop
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call fcn.1400d2f80
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x1400dd6ea
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.outlookSettingChange
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400db373
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.enabledesktopnotificaion
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400db1db
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
mov qword [rbp - 0x10], r15
mov dword [rbp - 8], r15d
mov qword [rbp], r15
lea rdx, str.OutlookPreferences
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rsp + 0x58]
call fcn.1400e93c0
mov r15, rax
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rbp - 0x58], 0x20000006
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov rdx, r14
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r8, rax
mov rdx, 0xffffffff80000001
mov r9d, 0x2001f
lea rcx, [rbp - 0x10]
call fcn.1400e21d0
test eax, eax
jne 0x1400db06f
mov dword [rsp + 0x68], 1
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.NewmailDesktopAlerts
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rdx, str.OutlookOptionsReminders
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rsp + 0x58]
call fcn.1400e93c0
mov r15, rax
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rbp - 0x58], 0x40000006
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov rdx, r14
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r8, rax
mov rdx, 0xffffffff80000001
mov r9d, 0x2001f
lea rcx, [rbp - 0x10]
call fcn.1400e21d0
mov rbx, qword [rbp - 0x10]
test eax, eax
jne 0x1400db1bc
mov dword [rsp + 0x68], 1
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.PlaySound
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x68], 1
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, [0x140142cc0]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
test rbx, rbx
je 0x1400db1cb
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x1400dd6ea
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.AutoArchive
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400dd6ea
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
mov qword [rbp - 0x10], r15
mov dword [rbp - 8], r15d
mov qword [rbp], r15
lea rdx, str.OutlookPreferences
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rsp + 0x58]
call fcn.1400e93c0
mov r15, rax
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rbp - 0x58], 0x80000006
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov rdx, r14
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r8, rax
mov rdx, 0xffffffff80000001
mov r9d, 0x2001f
lea rcx, [rbp - 0x10]
call fcn.1400e21d0
mov rbx, qword [rbp - 0x10]
test eax, eax
jne 0x1400db355
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.DoAging
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
test rbx, rbx
je 0x1400db364
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x1400dd6ea
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.runsep
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400db423
lea rcx, [rsp + 0x48]
call fcn.1400df790
nop
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rcx, rax
call fcn.1400e5df0
test al, al
je 0x1400db413
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r8, rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r15
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x1400dd6ea
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.regremoveduplicate
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400db48b
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rcx, rax
call fcn.1400e3030
jmp 0x1400dd6ea
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.runreg
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400db4f3
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rcx, rax
call fcn.1400e33d0
jmp 0x1400dd6ea
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.regreadanddelete
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400db6ea
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rdx, str.OutlookSecurityOutlookSecureTempFolder
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rdx, str.HKEY_CURRENT_USER_
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rsp + 0x58]
call fcn.1400e93c0
mov rbx, rax
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rbp - 0x60], 1
mov rcx, rbx
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
mov rcx, rbx
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
lea r8, [rbp - 0x70]
mov rdx, r14
lea rcx, [rsp + 0x70]
call fcn.14000ce20
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x48], rax
lea rcx, [rbp - 0x80]
call fcn.1400e93c0
mov rbx, rax
lea rdx, str.Outlook_version_found
lea rcx, [rbp - 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
mov r8d, 0xffffffff
mov rdx, rbx
mov rcx, rax
call fcn.1400ee8c0
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
lea rdx, [rsp + 0x78]
mov rcx, rax
call fcn.1400e01e0
test eax, eax
jne 0x1400db6ce
lea rax, [rbp - 0x80]
mov qword [rbp - 0x48], rax
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rbx, rax
lea rdx, str.Outlook_temp_folder_location
lea rcx, [rbp - 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
mov r8d, 0xffffffff
mov rdx, rbx
mov rcx, rax
call fcn.1400ee8c0
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rcx, rax
call fcn.1400d57f0
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x1400dd6ea
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, [0x14015e430]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400db84a
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, [0x1401312ec]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
je 0x1400db7d2
xor r8d, r8d
lea rdx, str.Program_Files__x86_
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x1400db7d2
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rcx, rax
call fcn.1400e5df0
test al, al
jne 0x1400db7d2
lea r8, str.Program_Files
lea rdx, str.Program_Files__x86_
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCToolBar::RebuildAccelerationKeys]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rcx, rax
call fcn.1400e5df0
lea rcx, [rsp + 0x60]
cmp al, 1
jne 0x1400db810
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r9, rax
mov dword [rsp + 0x28], 3
lea r8, str.notepad.exe
jmp 0x1400dd6d6
xor r8d, r8d
lea rdx, str.vpncl
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x1400dd6ea
lea rdx, str.It_looks_like_Cisco_VPN_Client_is_not_installed_on_your_system._Please_contact_helpdesk.
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
mov rdx, rax
mov rcx, r13
call fcn.14006c340
jmp 0x1400dd6ea
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.explorefile
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400db975
lea rdx, [r13 + 0x250]
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
nop
lea rdx, [rbp - 0x68]
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rcx, rax
call fcn.1400e5df0
test al, al
jne 0x1400db934
lea r8, str.Program_Files
lea rdx, str.Program_Files__x86_
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCToolBar::RebuildAccelerationKeys]
xor r8d, r8d
lea rdx, [0x14013bf48]
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
jle 0x1400db934
xor r8d, r8d
lea rdx, str.Microsoft_Office
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
jle 0x1400db934
lea rcx, [rsp + 0x58]
call fcn.1400df470
nop
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r9, rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r15
lea r8, [0x140148770]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x1400dd6ea
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.renamefolder
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400dba27
lea rax, [rsp + 0x58]
mov qword [rbp - 0x70], rax
lea rdx, [0x1401312ec]
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
mov rbx, rax
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1400e0ca0
nop
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rcx, rax
call fcn.1400edfe0
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x1400dd6ea
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.renamefolderDeleteFiles
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400dbb88
lea rax, [rsp + 0x58]
mov qword [rsp + 0x40], rax
lea rdx, [0x1401312ec]
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
mov rbx, rax
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.1400e0ca0
nop
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rcx, rax
call fcn.1400edfe0
lea rdx, str.Tracing
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rbp - 0x60], 8
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov rcx, r14
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rcx, rax
call fcn.1400d5d10
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x1400dd6ea
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.runvbscript
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400dbe8f
lea rdx, str.AnakageFilesVBScripts_
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rsp + 0x58]
call fcn.1400e7c60
mov r14, rax
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r15, rax
mov dword [rbp - 0x60], 0x10
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r14
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r14
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
nop
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov dword [rbp - 0x60], gethostbyname
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov dword [rbp - 0x60], 0x20
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.updateinventory.vbs
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
test eax, eax
sete bl
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test bl, bl
je 0x1400dbe67
lea rdx, str.Accenture_Workstation_Security_ComplianceScripts_
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rbp - 0x80]
call fcn.1400e7c60
mov r14, rax
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r15, rax
mov dword [rbp - 0x60], 0x60
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r14
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r14
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
nop
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rbp - 0x60], 0xe0
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov rdx, r14
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov dword [rbp - 0x60], 0x20
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, [rbp - 0x68]
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov dl, 1
mov rcx, rax
call fcn.1400e3520
nop
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x1400dd6ea
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.deletefolder
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400dc255
lea rdx, [0x1401312ec]
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rdx, [0x1401312ec]
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.prefetch
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400dbf65
lea rdx, str.C:WindowsPrefetch_
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
jmp 0x1400dc216
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.windowstemp
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400dbfc7
lea rdx, str.C:WindowsTemp_
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
jmp 0x1400dc216
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.recyclebin
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400dc02e
call fcn.1400d6780
lea rdx, str.NULL
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
jmp 0x1400dc216
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.usertemp
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400dc0c8
lea rdx, [rbp + 0x60]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__9]
nop
mov rdx, rax
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, str.Anakage
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
jmp 0x1400dc216
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.PTCTempFolder
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400dc216
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.1400e6e30
nop
lea r8, str.Roaming
lea rdx, str.Local
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCToolBar::RebuildAccelerationKeys]
lea rdx, str.PTCProENGINEERWildfire.wf
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rbp - 0x60], 0x100
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov rdx, r14
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rbx, rax
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rcx, rax
mov rdx, rbx
call fcn.1400d5a70
nop
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x1400dd6ea
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.PrintDemo
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400dc3fc
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rdx, str.AnakageFilesSelfHealSolutionsiassist_
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rsp + 0x58]
call fcn.1400e7c60
mov r14, rax
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r15, rax
mov dword [rbp - 0x60], 0x200
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r14
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r14
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
nop
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rbp - 0x60], 0x600
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov rdx, r14
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rcx, rax
call fcn.1400e29b0
nop
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x1400dd6ea
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.addsite
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400dc466
lea rdx, [0x140132be8]
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
mov rcx, rax
call fcn.1400e4ac0
jmp 0x1400dd6ea
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.sccm
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400dc4d1
lea rcx, str.start_control_smscfgrc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea r9, str.control_smscfgrc
lea r8, str.control.exe
jmp 0x1400dd6ce
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.openExplorer
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400dc7b8
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.1400e6e30
nop
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.win10
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400dc62e
lea rdx, str.MicrosoftWindowsINetCache
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rbp - 0x60], 0x800
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov rdx, r14
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
jmp 0x1400dc719
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.win7
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400dc724
lea rdx, str.MicrosoftWindowsTemporary_Internet_Files
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rbp - 0x60], 0x1000
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov rdx, r14
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x50]
mov qword [rbp - 0x70], rax
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rdi, rax
lea rdx, str.Internet_explorer_path
lea rcx, [rbp - 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
mov rbx, rax
call sub.mfc140u.dll_AfxFieldText
nop
mov r9d, 0xffffffff
mov r8, rdi
mov rdx, rbx
mov rcx, qword [rax + 8]
call fcn.140058140
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r9, rax
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], r15
lea r8, [0x140148770]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x1400dd6ea
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.renamefolderDeleteFiles
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400dc919
lea rax, [rsp + 0x58]
mov qword [rsp + 0x40], rax
lea rdx, [0x1401312ec]
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
mov rbx, rax
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.1400e0ca0
nop
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rcx, rax
call fcn.1400edfe0
lea rdx, str.Tracing
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rbp - 0x60], 0x2000
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov rcx, r14
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rcx, rax
call fcn.1400d5d10
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x1400dd6ea
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.openChrome
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400dcbf5
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, [0x14015f6f4]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
je 0x1400dcaf5
lea rdx, str.AnakageFilesVBScripts_
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rsp + 0x58]
call fcn.1400e7c60
mov r14, rax
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r15, rax
mov dword [rbp - 0x60], 0x4000
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r14
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r14
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
nop
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov dword [rbp - 0x60], 0xc000
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov dword [rbp - 0x60], 0x8000
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, [rbp - 0x78]
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov dl, 1
mov rcx, rax
call fcn.1400e3520
nop
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x1400dd6ea
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.1400e6e30
nop
lea rdx, str._GoogleChromeUser_DataDefault
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rbp - 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rbp - 0x60], 0x10000
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
lea rcx, [rbp - 0x40]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
lea rcx, [rbp - 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov rdx, r14
lea rcx, [rbp - 0x40]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rbp - 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r9, rax
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], r15
lea r8, [0x140148770]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rbp - 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x1400dd6ea
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.applicationiconsetting
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rcx, [rsp + 0x40]
test ebx, ebx
jne 0x1400dcdd1
lea rdx, [0x14015f6f4]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
je 0x1400dd6ea
lea rdx, str.AnakageFilesVBScripts_
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rsp + 0x58]
call fcn.1400e7c60
mov r14, rax
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r15, rax
mov dword [rbp - 0x60], 0x20000
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r14
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r14
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
nop
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov dword [rbp - 0x60], 0x60000
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov dword [rbp - 0x60], 0x40000
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, [rbp - 0x78]
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov dl, 1
mov rcx, rax
call fcn.1400e3520
nop
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x1400dd6ea
lea rdx, str.HardwareAcceleration
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400dcefe
mov qword [rbp - 0x10], r15
mov dword [rbp - 8], r15d
mov qword [rbp], r15
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rsp + 0x58]
call fcn.1400e93c0
nop
mov rdx, rax
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, str.CommonGraphics
lea rcx, [rbp - 0x68]
call qword [0x14012a1a8]
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r8, rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r15d
xor r9d, r9d
mov rdx, 0xffffffff80000001
lea rcx, [rbp - 0x10]
call fcn.1400d4830
mov rbx, qword [rbp - 0x10]
test eax, eax
je 0x1400dceab
test rbx, rbx
je 0x1400dcedc
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, r15
jmp 0x1400dcedc
mov dword [rsp + 0x68], r15d
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.DisableHardwareAcceleration
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
test rbx, rbx
je 0x1400dd6ea
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400dd6ea
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.openLLFile
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
je 0x1400dd6ea
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.runcompliancevbscript
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400dd0da
lea rdx, str.Accenture_Workstation_Security_ComplianceScripts_
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rsp + 0x58]
call fcn.1400e7c60
mov r14, rax
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r15, rax
mov dword [rbp - 0x60], 0x80000
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r14
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r14
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
nop
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov dword [rbp - 0x60], 0x180000
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov dword [rbp - 0x60], 0x100000
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, [rbp - 0x78]
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov dl, 1
mov rcx, rax
call fcn.1400e3520
nop
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x1400dd6ea
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.regnavigate
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400dd12f
call fcn.1400d49a0
jmp 0x1400dd6ea
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.localappdataexplore
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400dd260
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.1400e6e30
nop
lea rdx, str.PKI_Client
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rbp - 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rbp - 0x60], 0x200000
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
lea rcx, [rbp - 0x40]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
lea rcx, [rbp - 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov rdx, r14
lea rcx, [rbp - 0x40]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rbp - 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rcx, rax
call fcn.1400d5f80
nop
lea rcx, [rbp - 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x1400dd6ea
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.Ciscojabber
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
je 0x1400dd6ea
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.javacontrolpanel
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400dd3de
lea rdx, [0x1401312ec]
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rsp + 0x78]
call fcn.1400de9b0
cmp eax, 1
jne 0x1400dd39e
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, [0x1401312ec]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
je 0x1400dd3ce
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r8, rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r15
lea r9, [0x14012c468]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x1400dd3ce
test eax, eax
jne 0x1400dd3ab
lea rdx, str._Java_Runtime__was_not_found_on_your_machine._Please_close_the_solution_and_contact_HelpDesk.
jmp 0x1400dd3b7
cmp eax, 1
jle 0x1400dd3ce
lea rdx, str.More_than_one__Java_Runtime__was_found_on_your_machine._Please_run__Java__from_control_panel._Wait_for_it_to_load_and_then_click__NEXT_STEP_
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
mov rdx, rax
mov rcx, r13
call fcn.14006c340
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x1400dd6ea
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.customizedMessage
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400dd4bd
call sub.mfc140u.dll_AfxFieldText
mov rdx, qword [rax + 8]
add rdx, 0x1f8
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
nop
call sub.mfc140u.dll_AfxFieldText
mov rdx, qword [rax + 8]
add rdx, 0x200
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
nop
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CFileDialog::SetTemplate]
mov rcx, rax
lea rdx, str.noteMsg
call fcn.14000e250
lea rcx, [rsp + 0x58]
test al, al
lea rdx, [rsp + 0x40]
jne 0x1400dd490
lea rdx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
mov rdx, rax
mov rcx, r13
call fcn.14006c340
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x1400dd6ea
xor r8d, r8d
lea rdx, str.msiexe
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
jns 0x1400dd51d
xor r8d, r8d
lea rdx, str.control.exe
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
jns 0x1400dd51d
xor r8d, r8d
lea rdx, str.olidays.exe
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
jns 0x1400dd51d
xor r8d, r8d
lea rdx, str.ScnCfg32.exe
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, [0x14015f938]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400dd64e
lea rdx, [0x1401354c4]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rdx, [r13 + 0x250]
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
nop
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rbp - 0x60], 0x3000000
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
lea r8, [rbp - 0x70]
mov rdx, r14
lea rcx, [rsp + 0x58]
call fcn.14000ce20
nop
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
xor r8d, r8d
lea rdx, [0x14015f948]
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x1400dd6af
call sub.mfc140u.dll_AfxFieldText
mov rdx, qword [rax + 8]
add rdx, 0x1f8
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r8, rax
lea rdx, str.m_globalvar1
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCToolBar::RebuildAccelerationKeys]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rbx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r8, rax
mov r9, rbx
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r15
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rdx, str.success
mov rcx, r12
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
nop
lea rcx, [rbp + 8]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x18]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov rax, r12
mov rcx, qword [rbp + 0x870]
xor rcx, rsp
call fcn.1400f76d0
mov rbx, qword [rsp + 0x9d0]
add rsp, 0x980
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret