Function at 0x140007390
Capabilities:
Initialize winsock library

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x548]
sub rsp, 0x620
mov qword [rbp - 0x10], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14001e048]
xor rax, rsp
mov qword [rbp + 0x510], rax
mov r15, r8
xor r12d, r12d
mov qword [rbp - 0x80], r12
xor r8d, r8d
lea r13d, [r12 + 1]
mov edx, r13d
lea rax, [rbp - 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea rcx, [0x1400166f0]
call qword [sym.imp.OLEAUT32.dll_RegisterTypeLib]
test eax, eax
jns 0x140007434
lea rdx, [rbp - 0x80]
lea rcx, str.InstallerMainShell.tlb
call qword [sym.imp.OLEAUT32.dll_LoadRegTypeLib]
test eax, eax
js 0x140007434
xor r8d, r8d
lea rdx, str.InstallerMainShell.tlb
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.OLEAUT32.dll_QueryPathOfRegTypeLib]
mov ebx, eax
test eax, eax
js 0x140008094
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov ebx, eax
test eax, eax
js 0x140008094
lea rbx, [0x14001e160]
lea rdx, [0x140015820]
mov rcx, qword [rbx + 8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140007474
add rbx, 0x48
lea rax, [0x14001e310]
cmp rbx, rax
jne 0x14000744d
jmp 0x14000747c
mov rcx, rbx
call fcn.14000bbb8
lea rbx, [0x140015850]
mov rcx, rbx
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_631]
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x50], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x40], xmm1
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], rbx
mov dword [rbp - 0x20], r12d
mov r14d, 2
mov dword [rbp - 0x1c], r14d
lea ecx, [r14 + 0x36]
mov dword [rbp - 0x18], ecx
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_147]
mov edx, r13d
lea rcx, [rbp - 0x50]
call qword [sym.imp.Mso30Win32Client.dll_Ordinal_75]
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x300]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.Mso30Win32Client.dll_Ordinal_1102]
mov r10, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 8]
mov dword [rsp + 0x30], 7
mov dword [rsp + 0x28], 0x104
lea rcx, [rbp + 0x300]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x98
mov rcx, r10
call qword [case.0x14001195e.0]
test eax, eax
je 0x14000806a
cmp word [rbp + 0x300], r12w
je 0x14000806a
lea r8, [rbp + 0x10]
xor edx, edx
lea rcx, [rbp + 0x300]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x14000806a
test byte [rbp + 0x10], 0x10
jne 0x14000806a
mov edx, r14d
lea rcx, [rbp - 0x50]
call qword [sym.imp.Mso30Win32Client.dll_Ordinal_75]
lea edx, [r14 + 1]
lea rcx, [rbp - 0x50]
call qword [sym.imp.Mso30Win32Client.dll_Ordinal_75]
mov byte [rsp + 0x44], r12b
mov word [rsp + 0x52], r14w
mov byte [rsp + 0x50], r13b
mov byte [rsp + 0x48], r12b
mov byte [rsp + 0x4c], r12b
mov word [rsp + 0x40], 0x101
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x4c]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x58]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_2306]
lea rdi, vtable.Mso::Telemetry::EventName.0
mov qword [rbp - 8], rdi
lea rsi, vtable.Mso::Telemetry::TelemetryNamespace.0
mov qword [rbp], rsi
lea rax, str.OsfInstallerStartMain
mov qword [rbp + 8], rax
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_162]
test rax, rax
je 0x1400075fc
mov rcx, rax
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_1638]
jmp 0x140007602
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_92]
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8, rax
lea rdx, [rbp - 8]
lea rcx, [rbp - 0x78]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_1998]
lea rdx, [0x140015878]
mov rcx, r15
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
jne 0x140007c03
lea rdx, str._Embedding
mov rcx, r15
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
jne 0x140007c03
mov byte [rsp + 0x4c], r12b
mov word [rsp + 0x52], r14w
mov byte [rsp + 0x50], r13b
mov byte [rsp + 0x48], r12b
mov byte [rsp + 0x44], r12b
mov word [rsp + 0x40], 0x101
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x44]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x58]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_2306]
mov qword [rbp - 8], rdi
mov qword [rbp], rsi
lea rax, str.OsfInstallerStartNotCOM
mov qword [rbp + 8], rax
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_162]
test rax, rax
je 0x1400076ca
mov rcx, rax
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_1638]
jmp 0x1400076d0
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_92]
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8, rax
lea rdx, [rbp - 8]
lea rcx, [rsp + 0x60]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_1998]
mov qword [rsp + 0x70], r12
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, reloc.AppVIsvSubsystems64.dll_Ordinal_1
xor r8d, r8d
lea edx, [r8 + 4]
lea rcx, [0x140016700]
call qword [sym.imp.ole32.dll_CoGetClassObject]
mov edi, eax
mov edx, eax
lea rcx, [rsp + 0x60]
call fcn.140007170
test edi, edi
js 0x140007be6
mov qword [rsp + 0x78], r12
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
lea r9, [rsp + 0x78]
lea r8, str.1qyp_
xor edx, edx
mov rax, qword [rax + 0x18]
call qword [case.0x14001195e.0]
mov edi, eax
mov edx, eax
lea rcx, [rsp + 0x60]
call fcn.140007170
test edi, edi
js 0x140007bce
lea rcx, [rbp - 8]
call qword [sym.imp.ole32.dll_CoCreateGuid]
mov ebx, eax
test eax, eax
jns 0x1400077ba
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140007792
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14001195e.0]
nop
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1400077aa
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14001195e.0]
nop
lea rcx, [rsp + 0x60]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_426]
jmp 0x14000805e
mov r8d, 0x28
lea rdx, [rbp + 0x2a0]
lea rcx, [rbp - 8]
call qword [sym.imp.ole32.dll_StringFromGUID2]
test eax, eax
je 0x140007bce
movdqa xmm0, xmmword [0x140016ea0]
movdqu xmmword [rbp + 0x20], xmm0
mov word [rbp + 0x10], r12w
lea rcx, [rbp + 0x2a0]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r12w
jne 0x1400077f6
mov r8, rax
lea rdx, [rbp + 0x2a0]
lea rcx, [rbp + 0x10]
call fcn.140008d78
lea r8, [rbp + 0x10]
cmp qword [rbp + 0x28], 8
cmovae r8, qword [rbp + 0x10]
mov edx, r13d
xor ecx, ecx
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_1344]
mov rsi, rax
test rax, rax
je 0x140007b69
mov qword [rsp + 0x58], r12
mov rdi, qword [rsp + 0x78]
mov rax, qword [rdi]
mov r14, qword [rax + 0x18]
lea rcx, [rbp + 0x10]
cmp qword [rbp + 0x28], 8
jb 0x140007bb0
mov rcx, qword [rbp + 0x10]
test rcx, rcx
jne 0x140007bb0
mov rbx, r12
lea r9, [rsp + 0x58]
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
mov rax, r14
call qword [case.0x14001195e.0]
mov edi, eax
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test edi, edi
js 0x140007b58
mov qword [rsp + 0x50], r12
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
lea r8, [rsp + 0x50]
lea rdx, [0x140015a68]
mov rax, qword [rax]
call qword [case.0x14001195e.0]
mov edi, eax
test eax, eax
js 0x140007b40
mov edx, eax
lea rcx, [rsp + 0x60]
call fcn.140007170
lea rax, [0x140014ca0]
mov qword [rbp + 0x90], rax
lea rax, [rbp + 0x90]
mov qword [rbp + 0xc8], rax
mov qword [rbp + 0x78], r12
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0x40]
call fcn.140009240
mov word [rbp + 0x80], r13w
mov qword [rbp + 0x88], r12
lea r8, [rbp + 0x40]
lea rdx, str.Microsoft.Office.OEP.OsfInstallerDefaultTask
lea rcx, [rbp + 0xd0]
call fcn.1400071e4
mov rcx, rax
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_2477]
mov bl, al
lea rcx, [rbp + 0xd0]
call fcn.1400072e0
mov r8, qword [rbp + 0x78]
test r8, r8
je 0x14000795e
mov rcx, qword [r8]
mov rax, qword [rcx + 0x20]
lea rcx, [rbp + 0x40]
cmp r8, rcx
setne dl
mov rcx, r8
call qword [case.0x14001195e.0]
mov qword [rbp + 0x78], r12
mov rcx, qword [rbp + 0xc8]
test rcx, rcx
je 0x140007985
mov rax, qword [rcx]
lea rdx, [rbp + 0x90]
cmp rcx, rdx
setne dl
mov rax, qword [rax + 0x20]
call qword [case.0x14001195e.0]
nop
lea rcx, [rsp + 0x60]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_1869]
mov r8b, bl
lea rdx, str.DefaultTaskEnabled
mov rcx, rax
call fcn.140009b74
test bl, bl
je 0x140007a77
call fcn.14000fa80
test al, al
je 0x140007a77
call fcn.14000ec4c
mov r14d, eax
lea rcx, [rsp + 0x60]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_1869]
mov r8d, r14d
lea rdx, str.NetworkCost
mov rcx, rax
call fcn.140009c3c
xor ecx, ecx
call fcn.14000faf8
movzx ebx, al
lea rcx, [rsp + 0x60]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_1869]
mov r8d, ebx
lea rdx, str.CanRunCheck
mov rcx, rax
call fcn.140009c3c
test bl, bl
je 0x140007a77
test r14d, r14d
jne 0x140007a77
lea rdx, str._onlogon
mov rcx, r15
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
mov rdi, rax
test rax, rax
setne bl
lea rcx, [rsp + 0x60]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_1869]
mov r8b, bl
lea rdx, str.OnLogon
mov rcx, rax
call fcn.140009b74
neg rdi
sbb edx, edx
neg edx
add edx, 2
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
mov rax, qword [rax + 0x18]
call qword [case.0x14001195e.0]
mov edi, eax
mov edx, eax
lea rcx, [rsp + 0x60]
call fcn.140007170
lea r8, [0x140020920]
lea rdx, str.Microsoft.Office.Experimentation.SDXFlighting
lea rcx, [rbp + 0xd0]
call fcn.1400071e4
mov rcx, rax
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_2477]
mov bl, al
lea rcx, [rbp + 0xd0]
call fcn.1400072e0
test bl, bl
je 0x140007adb
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 6]
mov rax, qword [rax + 0x18]
call qword [case.0x14001195e.0]
mov edi, eax
mov edx, eax
lea rcx, [rsp + 0x60]
call fcn.140007170
lea r8, [0x140020970]
lea rdx, str.Microsoft.Office.Experimentation.ExpFirstSessionTask
lea rcx, [rbp + 0xd0]
call fcn.1400071e4
mov rcx, rax
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_2477]
mov bl, al
lea rcx, [rbp + 0xd0]
call fcn.1400072e0
test bl, bl
je 0x140007b40
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 5]
mov rax, qword [rax + 0x18]
call qword [case.0x14001195e.0]
mov edi, eax
mov edx, eax
lea rcx, [rsp + 0x60]
call fcn.140007170
nop
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140007b58
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14001195e.0]
nop
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov r14d, 2
test rsi, rsi
je 0x140007b77
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbp + 0x28]
cmp rax, 8
jb 0x140007bce
lea rax, [rax*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rdx, rcx
cmp rax, 0x1000
jb 0x140007bc7
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
jbe 0x140007bc7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
test rax, rax
je 0x1400080e8
jmp 0x140007868
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
nop
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140007be6
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14001195e.0]
nop
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140007bfe
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14001195e.0]
nop
jmp 0x140007fe9
lea rax, [0x140014cd0]
mov qword [rbp + 0x90], rax
lea rax, [rbp + 0x90]
mov qword [rbp + 0xc8], rax
mov qword [rbp + 0x78], r12
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0x40]
call fcn.140009240
mov word [rbp + 0x80], r13w
mov qword [rbp + 0x88], r12
lea r8, [rbp + 0x40]
lea rdx, str.Microsoft.Office.OEP.ChangeGate.SDXHelperBackgroundMode
lea rcx, [rbp + 0xd0]
call fcn.1400071e4
mov rcx, rax
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_2477]
mov bl, al
lea rcx, [rbp + 0xd0]
call fcn.1400072e0
mov rcx, qword [rbp + 0x78]
test rcx, rcx
je 0x140007c94
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x20]
lea rdx, [rbp + 0x40]
cmp rcx, rdx
setne dl
call qword [case.0x14001195e.0]
mov qword [rbp + 0x78], r12
mov rcx, qword [rbp + 0xc8]
test rcx, rcx
je 0x140007cbb
mov rax, qword [rcx]
lea rdx, [rbp + 0x90]
cmp rcx, rdx
setne dl
mov rax, qword [rax + 0x20]
call qword [case.0x14001195e.0]
nop
test bl, bl
je 0x140007cd3
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x100000
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov byte [rsp + 0x4c], r12b
mov word [rsp + 0x52], r14w
mov byte [rsp + 0x50], r13b
mov byte [rsp + 0x48], r12b
mov byte [rsp + 0x44], r12b
mov word [rsp + 0x40], 0x101
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x44]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x58]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_2306]
mov qword [rbp - 8], rdi
mov qword [rbp], rsi
lea rax, str.OsfInstallerStartCom
mov qword [rbp + 8], rax
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_162]
test rax, rax
je 0x140007d4b
mov rcx, rax
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_1638]
jmp 0x140007d51
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_92]
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8, rax
lea rdx, [rbp - 8]
lea rcx, [rsp + 0x60]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_1998]
call fcn.1400066fc
call fcn.140006180
mov edi, eax
mov edx, eax
lea rcx, [rsp + 0x60]
call fcn.140007170
test edi, edi
js 0x140007fe9
call qword [sym.imp.ole32.dll_CoResumeClassObjects]
mov edi, eax
mov edx, eax
lea rcx, [rsp + 0x60]
call fcn.140007170
test edi, edi
js 0x140007fe9
lea rax, [0x140014d08]
mov qword [rbp + 0x2a0], rax
mov qword [rbp + 0x2a8], r12
mov qword [rbp + 0x2b0], r12
mov qword [rbp + 0x2b8], r12
mov qword [rbp + 0x2c0], r12
mov rsi, qword [0x14001fea8]
lea rcx, [rsi + 0x18]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14001ffb8]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r14d, eax
mov ecx, dword [rbx + 0x10]
add ecx, r13d
movsxd rdx, ecx
mov r8d, 4
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__recalloc]
test rax, rax
je 0x140007e67
mov qword [rbx], rax
mov eax, dword [rbx + 0x10]
add eax, r13d
movsxd rdx, eax
mov r8d, 8
mov rcx, qword [rbx + 8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__recalloc]
test rax, rax
je 0x140007e67
mov qword [rbx + 8], rax
movsxd rdx, dword [rbx + 0x10]
mov rcx, qword [rbx]
lea r8, [rcx + rdx*4]
test r8, r8
je 0x140007e50
mov dword [r8], r14d
mov rax, qword [rbx + 8]
lea rcx, [rax + rdx*8]
test rcx, rcx
je 0x140007e63
lea rax, [rbp + 0x2a0]
mov qword [rcx], rax
add dword [rbx + 0x10], r13d
lea rcx, [rsi + 0x18]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rax, [0x140014d00]
mov qword [rsp + 0x70], rax
mov edx, dword [rbp + 0x2b0]
movsxd r8, dword [rbp + 0x2b4]
cmp edx, r8d
jne 0x140007efb
lea rax, [rsp + 0x58]
mov r9, qword [rbp + 0x2a8]
cmp rax, r9
jb 0x140007eb2
lea rcx, [r9 + r8*8]
lea rax, [rsp + 0x58]
cmp rax, rcx
jb 0x1400080dd
test r8d, r8d
jne 0x140007ebc
mov ebx, r13d
jmp 0x140007ec3
lea ebx, [rdx + rdx]
test ebx, ebx
js 0x140007f25
movsxd rdx, ebx
cmp rdx, 0xfffffff
ja 0x140007f25
mov r8d, 8
mov rcx, r9
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__recalloc]
mov rcx, rax
test rax, rax
je 0x140007f25
mov dword [rbp + 0x2b4], ebx
mov qword [rbp + 0x2a8], rax
mov edx, dword [rbp + 0x2b0]
jmp 0x140007f02
mov rcx, qword [rbp + 0x2a8]
movsxd rax, edx
lea r8, [rcx + rax*8]
test r8, r8
je 0x140007f1c
lea rax, [rsp + 0x70]
mov qword [r8], rax
mov edx, dword [rbp + 0x2b0]
add edx, r13d
mov dword [rbp + 0x2b0], edx
mov r14d, 2
mov ecx, r14d
lea rdx, [rbp + 0x100]
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov ebx, eax
lea rcx, [rbp + 0x2a0]
call fcn.14000650c
test ebx, ebx
jne 0x140007f53
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov rsi, qword [0x14001fea8]
lea rcx, [rsi + 0x18]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14001ffb8]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r10d, eax
mov edx, r12d
or rax, 0xffffffffffffffff
cmp dword [rbx + 0x10], r12d
jle 0x140007f9f
movsxd r9, dword [rbx + 0x10]
mov r8, r12
mov rcx, qword [rbx]
cmp dword [rcx], r10d
je 0x140007fa1
add edx, r13d
add r8, r13
add rcx, 4
cmp r8, r9
jl 0x140007f8b
mov edx, eax
cmp edx, eax
je 0x140007fad
mov rcx, rbx
call fcn.140008c18
lea rcx, [rsi + 0x18]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rbp + 0x2b8]
test rcx, rcx
je 0x140007fd0
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbp + 0x2b8], r12
mov qword [rbp + 0x2c0], r12
mov rcx, qword [rbp + 0x2a8]
test rcx, rcx
je 0x140007fe9
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rcx, [rsp + 0x60]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_426]
mov ebx, edi
shr ebx, 0x1f
xor bl, r13b
lea rcx, [rbp - 0x78]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_143]
cmp byte [rax], r12b
mov byte [rax + 1], bl
jne 0x140008011
mov byte [rax], r13b
lea rcx, [rbp - 0x78]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_827]
mov qword [rbp - 0x68], r12
mov qword [rbp - 0x58], r12
mov byte [rbp - 0x60], r13b
mov edx, 3
lea rcx, [rbp - 0x68]
call qword [sym.imp.Mso30Win32Client.dll_Ordinal_202]
mov edx, r14d
lea rcx, [rbp - 0x68]
call qword [sym.imp.Mso30Win32Client.dll_Ordinal_202]
mov edx, r13d
lea rcx, [rbp - 0x68]
call qword [sym.imp.Mso30Win32Client.dll_Ordinal_202]
call qword [sym.imp.Mso30Win32Client.dll_Ordinal_220]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov ebx, edi
lea rcx, [rbp - 0x78]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_426]
jmp 0x140008094
mov qword [rbp - 8], r12
mov qword [rbp + 8], r12
mov byte [rbp], r13b
mov edx, r13d
lea rcx, [rbp - 8]
call qword [sym.imp.Mso30Win32Client.dll_Ordinal_202]
call qword [sym.imp.Mso30Win32Client.dll_Ordinal_220]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov ebx, 0x80004005
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x1400080ab
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x10]
call qword [case.0x14001195e.0]
nop
mov eax, ebx
mov rcx, qword [rbp + 0x510]
xor rcx, rsp
call fcn.140010d90
lea r11, [rsp + 0x620]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x80004005
call fcn.140002b80
int3
mov ecx, 0x8007000e
call fcn.140002b80
int3