Function at 0x1400383ac
Capabilities:
Get graphical window text
Parse pe header

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbp
push r15
xor rax, rax
push rax
push rax
sub rsp, 0x28
call fcn.1400ebc50
push 0
push 0x10ca0001
movabs rax, 0x1401d70cc
push rax
push qword [rsp + 0x80]
push qword [rsp + 0x80]
push qword [rsp + 0x80]
push qword [rsp + 0x80]
push 0x51
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.140050f4c
add rsp, 0x40
sub rsp, 8
push 0
movabs rax, str.Office_Installer
push rax
push socket
push 0xaf
push reloc.WS2_32.dll_recv
push reloc.OLEAUT32.dll_SafeArrayPutElement
push IsNetDrive
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.140059ba1
add rsp, 0x40
push 3
pop rcx
call fcn.1400ea8ac
mov rax, rax
push rax
push IsNetDrive
pop rcx
pop rdx
call fcn.1400b36b0
sub rsp, 8
push 1
push qword [0x140880240]
push reloc.WS2_32.dll_select
push reloc.msi.dll_MsiGetPropertyW
push reloc.WS2_32.dll_select
push 0x8e
push IsNetDrive
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.140059ba1
add rsp, 0x40
sub rsp, 8
push 0
push qword [0x140880160]
push 0x1e
push 0x1f4
push recv
push 0xfd
push IsNetDrive
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.140059ba1
add rsp, 0x40
push 4
pop rcx
call fcn.1400ea8ac
mov rax, rax
push rax
push IsNetDrive
pop rcx
pop rdx
call fcn.1400b36b0
sub rsp, 8
push 3
push 0x24e
push 0x2e
push 0xfd
push 0x52
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400b1eb0
add rsp, 0x30
push 1
push 0x52
pop rcx
pop rdx
call fcn.1400b0dec
push reloc.WS2_32.dll_ioctlsocket
push 0
push qword [0x140880160]
push 0x23
push 0xe1
push 0x3c
push reloc.WS2_32.dll_ioctlsocket
push 0x24
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14002a9e1
add rsp, 0x40
push 5
push 0
push qword [0x1408800d0]
push 0x23
push 0xe1
push 0x64
push reloc.WS2_32.dll_ioctlsocket
push 0x25
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14002a9e1
add rsp, 0x40
push reloc.WS2_32.dll_inet_addr
push 0
push qword [0x140880178]
push 0x23
push 0xe1
push 0x8c
push reloc.WS2_32.dll_ioctlsocket
push gethostname
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14002a9e1
add rsp, 0x40
push 7
push 0
push qword [0x140880088]
push 0x23
push 0xe1
push 0xb4
push reloc.WS2_32.dll_ioctlsocket
push 0x26
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14002a9e1
add rsp, 0x40
push 8
push 0
push qword [0x14087ff90]
push 0x23
push 0xe1
push 0x186
push reloc.WS2_32.dll_ioctlsocket
push 0x3a
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14002a9e1
add rsp, 0x40
push SafeArrayGetLBound
push 0
push qword [0x1408801e8]
push 0x23
push 0xe1
push 0x1ae
push reloc.WS2_32.dll_ioctlsocket
push 0x3b
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14002a9e1
add rsp, 0x40
push 6
push 0
push qword [0x14087ff30]
push 0x23
push 0xe1
push 0x1d6
push reloc.WS2_32.dll_ioctlsocket
push MsiGetActiveDatabase
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14002a9e1
add rsp, 0x40
push recvfrom
push 0
push qword [0x14087ff58]
push 0x23
push 0xe1
push 0x1fe
push reloc.WS2_32.dll_ioctlsocket
push MsiGetActiveDatabase
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14002a9e1
add rsp, 0x40
push 0
push 0x1f4
push 0x266
push 0x3c
push 0xf2
push reloc.OLEAUT32.dll_SafeArrayGetLBound
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.140060e4a
add rsp, 0x30
push reloc.WS2_32.dll_select
pop rcx
call fcn.1400e1ea8
mov rax, rax
push rax
push 0x23
push 0x23
push 0
push 0
push 0x4f
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400b2f5c
add rsp, 0x30
push rcx
sub rsp, 0x28
call fcn.1400eb920
add rsp, 0x28
pop rcx
push rax
push 0
push rcx
sub rsp, 0x28
call fcn.1400eb920
add rsp, 0x28
pop rcx
push rax
movabs rcx, str.OS:
sub rsp, 0x28
call fcn.1400eb970
add rsp, 0x28
mov rcx, qword [0x1408800d8]
sub rsp, 0x28
call fcn.1400eb970
add rsp, 0x28
movabs rcx, str.__build
sub rsp, 0x28
call fcn.1400eb970
add rsp, 0x28
mov rcx, qword [0x1408800e8]
sub rsp, 0x28
call fcn.1400eb970
add rsp, 0x28
call fcn.1400ebb80
push reloc.WS2_32.dll_select
push 0x1d6
push reloc.WS2_32.dll_ioctlsocket
push gethostbyaddr
push 0x50
push rax
call fcn.1400ebb50
mov rdx, rax
pop rax
add qword [rsp + 0x28], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.140059ba1
add rsp, 0x38
pop rcx
push rax
sub rsp, 0x28
call fcn.140066ed4
add rsp, 0x28
pop rax
push 3
pop rcx
call fcn.1400ea8ac
mov rax, rax
push rax
push 0x50
pop rcx
pop rdx
call fcn.1400b36b0
push 0
movabs rax, 0x1401d70cc
push rax
movabs rax, 0x1401d9fa6
push rax
push 0x23
push 0x82
push 0x28
push 0
push gethostbyaddr
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14002d57f
add rsp, 0x40
push 0
movabs rax, 0x1401d70cc
push rax
movabs rax, 0x1401e0600
push rax
push 0x23
push 0x82
push 0x28
push 0x8c
push gethostbyaddr
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14002d57f
add rsp, 0x40
push 0
movabs rax, 0x1401d70cc
push rax
push qword [0x1408800b8]
push 0x23
push 0x82
push 0x1ae
push 0x1c7
push 0x2e
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14002d57f
add rsp, 0x40
push 0x800
push 0x145
push 0x249
push 0x5a
push 0
push 0x53
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14005f72e
add rsp, 0x30
call fcn.1400b3680
push 1
push reloc.OLEAUT32.dll_SafeArrayGetLBound
pop rcx
pop rdx
call fcn.1400b0dec
push 0
push 0x1f4
push 0x28e
push 0x3c
push 0xf2
push socket
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.140060e4a
add rsp, 0x30
push 0
push 0x23
push 0xe6
push 0
push 0
push reloc.SHELL32.dll_IsNetDrive
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.140066735
add rsp, 0x30
push 1
pop rcx
call fcn.1400ea8ac
mov rax, rax
push rax
push reloc.SHELL32.dll_IsNetDrive
pop rcx
pop rdx
call fcn.1400b36b0
push 0x1e
push 0
push 0x153
sub rsp, 8
push reloc.SHELL32.dll_IsNetDrive
pop rcx
sub rsp, 0x20
call fcn.1400b2628
add rsp, 0x28
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
pop r9
call sub.USER32.dll_SendMessageW
mov rcx, qword [0x1408808b0]
call fcn.1400e31c8
mov rcx, qword [0x1408808b0]
call fcn.1400e31dc
or rax, rax
je 0x140038a7e
mov rbp, qword [0x1408808b8]
push qword [rbp + 0x10]
push 0xffffffffffffffff
push reloc.SHELL32.dll_IsNetDrive
pop rcx
pop rdx
pop r8
call fcn.1400b288c
jmp 0x140038a4e
push 1
push reloc.SHELL32.dll_IsNetDrive
pop rcx
pop rdx
call fcn.1400b0d98
push 0
push 0x23
push 0x5a
push 0
push 0xf0
push 0x48
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.140066735
add rsp, 0x30
push 1
pop rcx
call fcn.1400ea8ac
mov rax, rax
push rax
push 0x48
pop rcx
pop rdx
call fcn.1400b36b0
push reloc.OLEAUT32.dll_SafeArrayPutElement
push 0
push 0x153
sub rsp, 8
push 0x48
pop rcx
sub rsp, 0x20
call fcn.1400b2628
add rsp, 0x28
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
pop r9
call sub.USER32.dll_SendMessageW
movabs rax, 0x1401e728e
push rax
push 0xffffffffffffffff
push 0x48
pop rcx
pop rdx
pop r8
call fcn.1400b288c
movabs rax, 0x1401e3aec
push rax
push 0xffffffffffffffff
push 0x48
pop rcx
pop rdx
pop r8
call fcn.1400b288c
push 1
push 0x48
pop rcx
pop rdx
call fcn.1400b0d98
mov qword [rsp + 0x58], reloc.msi.dll_MsiGetActiveDatabase
mov qword [rsp + 0x28], SafeArrayPutElement
sub rsp, 8
push 0
movabs rax, str.Word
push rax
push reloc.OLEAUT32.dll_SafeArrayPutElement
push 0x64
push qword [rsp + 0x80]
push 0
push 0x59
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14005fed4
add rsp, 0x40
mov r15, qword [rsp + 0x58]
add r15, qword [rsp + 0x28]
mov qword [rsp + 0x58], r15
sub rsp, 8
push 0
movabs rax, str.Excel
push rax
push reloc.OLEAUT32.dll_SafeArrayPutElement
push 0x64
push qword [rsp + 0x80]
push 0
push 0x5a
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14005fed4
add rsp, 0x40
mov r15, qword [rsp + 0x58]
add r15, qword [rsp + 0x28]
mov qword [rsp + 0x58], r15
sub rsp, 8
push 0
movabs rax, str.Access
push rax
push reloc.OLEAUT32.dll_SafeArrayPutElement
push 0x64
push qword [rsp + 0x80]
push 0
push 0x5b
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14005fed4
add rsp, 0x40
mov r15, qword [rsp + 0x58]
add r15, qword [rsp + 0x28]
mov qword [rsp + 0x58], r15
sub rsp, 8
push 0
movabs rax, str.Publisher
push rax
push reloc.OLEAUT32.dll_SafeArrayPutElement
push 0x64
push qword [rsp + 0x80]
push 0
push 0x5c
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14005fed4
add rsp, 0x40
mov r15, qword [rsp + 0x58]
add r15, qword [rsp + 0x28]
mov qword [rsp + 0x58], r15
sub rsp, 8
push 0
movabs rax, str.Teams
push rax
push reloc.OLEAUT32.dll_SafeArrayPutElement
push 0x78
push qword [rsp + 0x80]
push 0
push 0x5d
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14005fed4
add rsp, 0x40
mov r15, qword [rsp + 0x58]
add r15, qword [rsp + 0x28]
mov qword [rsp + 0x58], r15
sub rsp, 8
push 0
movabs rax, str.OneDrive_for_business
push rax
push reloc.OLEAUT32.dll_SafeArrayPutElement
push 0x9a
push qword [rsp + 0x80]
push 0
push 0x5e
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14005fed4
add rsp, 0x40
mov r15, qword [rsp + 0x58]
add r15, qword [rsp + 0x28]
mov qword [rsp + 0x58], r15
sub rsp, 8
push 0
movabs rax, str.Skype_for_business
push rax
push reloc.OLEAUT32.dll_SafeArrayPutElement
push 0x98
push qword [rsp + 0x80]
push 0
push 0x5f
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14005fed4
add rsp, 0x40
mov r15, qword [rsp + 0x58]
add r15, qword [rsp + 0x28]
mov qword [rsp + 0x58], r15
sub rsp, 8
push 0
movabs rax, str.OneNote
push rax
push reloc.OLEAUT32.dll_SafeArrayPutElement
push 0x64
push qword [rsp + 0x80]
push 0
push 0x60
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14005fed4
add rsp, 0x40
mov r15, qword [rsp + 0x58]
add r15, qword [rsp + 0x28]
mov qword [rsp + 0x58], r15
sub rsp, 8
push 0
movabs rax, str.Outlook
push rax
push reloc.OLEAUT32.dll_SafeArrayPutElement
push 0x64
push qword [rsp + 0x80]
push 0
push 0x61
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14005fed4
add rsp, 0x40
mov r15, qword [rsp + 0x58]
add r15, qword [rsp + 0x28]
mov qword [rsp + 0x58], r15
sub rsp, 8
push 0
movabs rax, str.PowerPoint
push rax
push reloc.OLEAUT32.dll_SafeArrayPutElement
push 0x64
push qword [rsp + 0x80]
push 0
push 0x62
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14005fed4
add rsp, 0x40
mov r15, qword [rsp + 0x58]
add r15, qword [rsp + 0x28]
mov qword [rsp + 0x58], r15
sub rsp, 8
push 0
movabs rax, str.OneDrive
push rax
push reloc.OLEAUT32.dll_SafeArrayPutElement
push 0x64
push qword [rsp + 0x80]
push 0
push 0x63
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14005fed4
add rsp, 0x40
mov r15, qword [rsp + 0x58]
add r15, qword [rsp + 0x28]
mov qword [rsp + 0x58], r15
sub rsp, 8
push 0
movabs rax, str.Project
push rax
push reloc.OLEAUT32.dll_SafeArrayPutElement
push 0x56
push qword [rsp + 0x80]
push 0
push 0x64
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14005fed4
add rsp, 0x40
mov r15, qword [rsp + 0x58]
add r15, qword [rsp + 0x28]
mov qword [rsp + 0x58], r15
sub rsp, 8
push 0
movabs rax, str.ProjectPro
push rax
push reloc.OLEAUT32.dll_SafeArrayPutElement
push 0x56
push qword [rsp + 0x80]
push 0
push 0x65
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14005fed4
add rsp, 0x40
mov r15, qword [rsp + 0x58]
add r15, qword [rsp + 0x28]
mov qword [rsp + 0x58], r15
sub rsp, 8
push 0
movabs rax, str.ProjectMondo
push rax
push reloc.OLEAUT32.dll_SafeArrayPutElement
push 0x64
push qword [rsp + 0x80]
push 0
push 0x66
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14005fed4
add rsp, 0x40
mov r15, qword [rsp + 0x58]
add r15, qword [rsp + 0x28]
mov qword [rsp + 0x58], r15
sub rsp, 8
push 0
movabs rax, str.Visio
push rax
push reloc.OLEAUT32.dll_SafeArrayPutElement
push 0x58
push qword [rsp + 0x80]
push 0
push 0x67
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14005fed4
add rsp, 0x40
mov r15, qword [rsp + 0x58]
add r15, qword [rsp + 0x28]
mov qword [rsp + 0x58], r15
sub rsp, 8
push 0
movabs rax, str.VisioPro
push rax
push reloc.OLEAUT32.dll_SafeArrayPutElement
push 0x58
push qword [rsp + 0x80]
push 0
push 0x68
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14005fed4
add rsp, 0x40
mov r15, qword [rsp + 0x58]
add r15, qword [rsp + 0x28]
mov qword [rsp + 0x58], r15
sub rsp, 8
push 0
movabs rax, str.VisioMondo
push rax
push reloc.OLEAUT32.dll_SafeArrayPutElement
push 0x58
push qword [rsp + 0x80]
push 0
push 0x69
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14005fed4
add rsp, 0x40
mov r15, qword [rsp + 0x58]
add r15, qword [rsp + 0x28]
mov qword [rsp + 0x58], r15
sub rsp, 8
push 0
push qword [0x1408801a8]
push reloc.OLEAUT32.dll_SafeArrayPutElement
push 0xa4
push qword [rsp + 0x80]
push 0
push reloc.WS2_32.dll_WSACleanup
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14005fed4
add rsp, 0x40
mov r15, qword [rsp + 0x58]
add r15, qword [rsp + 0x28]
mov qword [rsp + 0x58], r15
push 0
movabs rax, 0x1401d70cc
push rax
push qword [0x140880008]
push 0x23
push 0x82
push 0x19a
push 0x154
push gethostbyaddr
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14002d57f
add rsp, 0x40
sub rsp, 8
push 1
movabs rax, 0x1401d70cc
push rax
push SafeArrayPutElement
push 0x14a
push 0x181
push 0
push 0x56
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.140059ba1
add rsp, 0x40
push 0
push 0x23
push 0x14a
push 0x19a
push 0
push MsiGetPropertyW
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.140066735
add rsp, 0x30
push 1
pop rcx
call fcn.1400ea8ac
mov rax, rax
push rax
push MsiGetPropertyW
pop rcx
pop rdx
call fcn.1400b36b0
push reloc.OLEAUT32.dll_SafeArrayPutElement
push 0
push 0x153
sub rsp, 8
push MsiGetPropertyW
pop rcx
sub rsp, 0x20
call fcn.1400b2628
add rsp, 0x28
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
pop r9
call sub.USER32.dll_SendMessageW
push MsiGetPropertyW
pop rcx
call fcn.14003b7f5
push 0
push MsiGetPropertyW
pop rcx
pop rdx
call fcn.1400b0d98
push 1
push 0x64
movabs rax, str.Langs
push rax
push 0x145
push 0x64
push 0
push 0x1f4
push 0x55
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400594b4
add rsp, 0x40
mov qword [rsp + 0x30], 0
jmp 0x140039287
push qword [0x140880860]
pop rcx
call fcn.1400d6400
cmp rax, qword [rsp + 0x30]
jl 0x1400392de
mov rdx, qword [0x140880868]
imul rdx, qword [rsp + 0x30]
mov rbp, rdx
push rbp
mov rax, 1
pop rbp
add rbp, rax
shl rbp, 3
add rbp, qword [0x140880860]
push qword [rbp]
push 0xffffffffffffffff
push 0x55
pop rcx
pop rdx
pop r8
call fcn.1400b288c
inc qword [rsp + 0x30]
jno 0x140039287
sub rsp, 8
push 0
movabs rax, 0x1401d70cc
push rax
push 0x140
push 0xfa
push reloc.msi.dll_MsiGetActiveDatabase
push 0xf0
push MsiGetPropertyW
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.140059ba1
add rsp, 0x40
mov r15, qword [0x14087fef8]
and r15, r15
jle 0x140039344
push 0x292521
push 2
push 0x53
pop rcx
pop rdx
pop r8
call fcn.140066318
jmp 0x14003935d
push qword [0x140880038]
push 2
push 0x53
pop rcx
pop rdx
pop r8
call fcn.140066318
call fcn.1400b3680
push 1
push socket
pop rcx
pop rdx
call fcn.1400b0dec
push 0
push 0x1f4
push 0x28e
push 0x3c
push 0xf2
push reloc.WS2_32.dll_socket
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.140060e4a
add rsp, 0x30
push 0
movabs rax, 0x1401d70cc
push rax
push qword [0x14087ff50]
push 0x23
push 0x104
push 0
push 0
push gethostname
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14002d57f
add rsp, 0x40
push 0
movabs rax, 0x1401d70cc
push rax
push qword [0x14087ff78]
push 0x23
push 0x82
push 0
push 0x10e
push gethostname
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14002d57f
add rsp, 0x40
push 0
push 0x23
push 0x14a
push 0x50
push 0
push 0x47
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.140066735
add rsp, 0x30
push 1
pop rcx
call fcn.1400ea8ac
mov rax, rax
push rax
push 0x47
pop rcx
pop rdx
call fcn.1400b36b0
push reloc.OLEAUT32.dll_SafeArrayPutElement
push 0
push 0x153
sub rsp, 8
push 0x47
pop rcx
sub rsp, 0x20
call fcn.1400b2628
add rsp, 0x28
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
pop r9
call sub.USER32.dll_SendMessageW
push 0x47
pop rcx
call fcn.14003b7f5
push qword [0x14087fed0]
push 0xffffffffffffffff
push 0x47
pop rcx
pop rdx
pop r8
call fcn.1400b288c
push 0
push 0x47
pop rcx
pop rdx
call fcn.1400b0d98
sub rsp, 8
push 0
movabs rax, 0x1401d70cc
push rax
push 0xb4
push 0x1f4
push __WSAFDIsSet
push 0
push MsiGetPropertyW
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.140059ba1
add rsp, 0x40
sub rsp, 8
push 1
movabs rax, 0x1401d70cc
push rax
push SafeArrayPutElement
push 0x14a
push gethostname
push 0
push 0x58
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.140059ba1
add rsp, 0x40
push 0
movabs rax, 0x1401d70cc
push rax
movabs rax, str.Word
push rax
push reloc.OLEAUT32.dll_SafeArrayPutElement
push 0x82
push 0x154
push 0
push 0x6a
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14002d57f
add rsp, 0x40
push 0
movabs rax, 0x1401d70cc
push rax
movabs rax, str.Excel
push rax
push reloc.OLEAUT32.dll_SafeArrayPutElement
push 0x82
push 0x172
push 0
push 0x6b
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14002d57f
add rsp, 0x40
push 0
movabs rax, 0x1401d70cc
push rax
movabs rax, str.Access
push rax
push reloc.OLEAUT32.dll_SafeArrayPutElement
push 0x82
push 0x190
push 0
push 0x6c
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14002d57f
add rsp, 0x40
push 0
movabs rax, 0x1401d70cc
push rax
movabs rax, str.Outlook
push rax
push reloc.OLEAUT32.dll_SafeArrayPutElement
push 0x82
push 0x1ae
push 0
push 0x6d
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14002d57f
add rsp, 0x40
push 0
movabs rax, 0x1401d70cc
push rax
movabs rax, str.OneNote
push rax
push reloc.OLEAUT32.dll_SafeArrayPutElement
push 0x82
push 0x154
push __WSAFDIsSet
push 0x6e
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14002d57f
add rsp, 0x40
push 0
movabs rax, 0x1401d70cc
push rax
movabs rax, str.PowerPoint
push rax
push reloc.OLEAUT32.dll_SafeArrayPutElement
push 0x82
push 0x172
push __WSAFDIsSet
push WSAStartup
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14002d57f
add rsp, 0x40
push 0
movabs rax, 0x1401d70cc
push rax
movabs rax, str.Publisher
push rax
push reloc.OLEAUT32.dll_SafeArrayPutElement
push 0x82
push 0x190
push __WSAFDIsSet
push WSACleanup
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14002d57f
add rsp, 0x40
push 0
movabs rax, 0x1401d70cc
push rax
movabs rax, str.Skype
push rax
push reloc.OLEAUT32.dll_SafeArrayPutElement
push 0x82
push 0x1ae
push __WSAFDIsSet
push WSACleanup
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14002d57f
add rsp, 0x40
push 0
movabs rax, 0x1401d70cc
push rax
movabs rax, str.Project
push rax
push reloc.OLEAUT32.dll_SafeArrayPutElement
push 0x82
push 0x154
push 0x12c
push WSACleanup
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14002d57f
add rsp, 0x40
push 0
movabs rax, 0x1401d70cc
push rax
movabs rax, str.Visio
push rax
push reloc.OLEAUT32.dll_SafeArrayPutElement
push 0x82
push 0x172
push 0x12c
push reloc.WS2_32.dll_WSAStartup
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14002d57f
add rsp, 0x40
call fcn.1400b3680
push 1
push reloc.WS2_32.dll_socket
pop rcx
pop rdx
call fcn.1400b0dec
push 0
push 0x1f4
push 0x28e
push 0x3c
push 0xf2
push SafeArrayPutElement
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.140060e4a
add rsp, 0x30
push 0x40000001
push 0x246
movabs rax, str.Office_C2R_Product:
push rax
push 0x118
push 0x248
push 0
push 0
push IsNetDrive
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400594b4
add rsp, 0x40
sub rsp, 8
push 0
push 0
push 0xfe
push reloc.OLEAUT32.dll_SafeArrayPutElement
push 1
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.COMCTL32.dll_ImageList_Create
add rsp, 0x30
mov rax, rax
push rax
push 1
push 0x1003
sub rsp, 8
push IsNetDrive
pop rcx
sub rsp, 0x20
call fcn.1400b2628
add rsp, 0x28
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
pop r9
call sub.USER32.dll_SendMessageW
push 1
pop rcx
call fcn.1400ea8ac
mov rax, rax
push rax
push IsNetDrive
pop rcx
pop rdx
call fcn.1400b36b0
push 0x800
push 0x118
push 0x249
push 0
push 0
push 0x54
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14005f72e
add rsp, 0x30
mov r15, qword [0x14087fef8]
and r15, r15
jle 0x140039982
push 0x292521
push 2
push 0x54
pop rcx
pop rdx
pop r8
call fcn.140066318
jmp 0x14003999b
push qword [0x140880038]
push 2
push 0x54
pop rcx
pop rdx
pop r8
call fcn.140066318
push 1
push 0x54
pop rcx
pop rdx
call fcn.1400b0dec
push 0
movabs rax, 0x1401d70cc
push rax
push qword [0x140880078]
push 0x23
push 0x82
push 0x12c
push 0
push gethostbyaddr
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14002d57f
add rsp, 0x40
push 0
movabs rax, 0x1401d70cc
push rax
push qword [0x140880028]
push 0x23
push 0x82
push 0x12c
push 0x8c
push reloc.WS2_32.dll_gethostbyname
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14002d57f
add rsp, 0x40
push 0
movabs rax, 0x1401d70cc
push rax
push qword [0x140880218]
push 0x23
push 0xdc
push 0x12c
push 0x16d
push reloc.WS2_32.dll_gethostbyaddr
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14002d57f
add rsp, 0x40
call fcn.1400b3680
push 1
push SafeArrayPutElement
pop rcx
pop rdx
call fcn.1400b0dec
push 0
push 0x1f4
push 0x28e
push 0x3c
push 0xf2
push SafeArrayPutElement
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.140060e4a
add rsp, 0x30
call fcn.1400b3680
push 1
push SafeArrayPutElement
pop rcx
pop rdx
call fcn.1400b0dec
push 0
push 0x1f4
push 0x28e
push 0x3c
push 0xf2
push reloc.OLEAUT32.dll_SafeArrayPutElement
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.140060e4a
add rsp, 0x30
push 0
push 0x23
push 0x14a
push 0
push 0
push 0x1c
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.140066735
add rsp, 0x30
push 1
pop rcx
call fcn.1400ea8ac
mov rax, rax
push rax
push 0x1c
pop rcx
pop rdx
call fcn.1400b36b0
push reloc.OLEAUT32.dll_SafeArrayPutElement
push 0
push 0x153
sub rsp, 8
push 0x1c
pop rcx
sub rsp, 0x20
call fcn.1400b2628
add rsp, 0x28
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
pop r9
call sub.USER32.dll_SendMessageW
push 0x1c
pop rcx
call fcn.14003b7f5
push 0
push 0x1c
pop rcx
pop rdx
call fcn.1400b0d98
push 0
push 0x23
push 0x5a
push 0
push 0x154
push 0x1d
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.140066735
add rsp, 0x30
push 1
pop rcx
call fcn.1400ea8ac
mov rax, rax
push rax
push 0x1d
pop rcx
pop rdx
call fcn.1400b36b0
push reloc.OLEAUT32.dll_SafeArrayPutElement
push 0
push 0x153
sub rsp, 8
push 0x1d
pop rcx
sub rsp, 0x20
call fcn.1400b2628
add rsp, 0x28
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
pop r9
call sub.USER32.dll_SendMessageW
movabs rax, 0x1401e728e
push rax
push 0xffffffffffffffff
push 0x1d
pop rcx
pop rdx
pop r8
call fcn.1400b288c
movabs rax, 0x1401e3aec
push rax
push 0xffffffffffffffff
push 0x1d
pop rcx
pop rdx
pop r8
call fcn.1400b288c
movabs rax, 0x1401e8e0e
push rax
push 0xffffffffffffffff
push 0x1d
pop rcx
pop rdx
pop r8
call fcn.1400b288c
push 1
push 0x1d
pop rcx
pop rdx
call fcn.1400b0d98
push 1
push 0x64
movabs rax, str.Langs
push rax
push 0x145
push 0x64
push 0
push 0x1b8
push 0x1e
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400594b4
add rsp, 0x40
mov qword [rsp + 0x30], 0
jmp 0x140039cd5
push qword [0x140880860]
pop rcx
call fcn.1400d6400
cmp rax, qword [rsp + 0x30]
jl 0x140039d2c
mov rdx, qword [0x140880868]
imul rdx, qword [rsp + 0x30]
mov rbp, rdx
push rbp
mov rax, 1
pop rbp
add rbp, rax
shl rbp, 3
add rbp, qword [0x140880860]
push qword [rbp]
push 0xffffffffffffffff
push 0x1e
pop rcx
pop rdx
pop r8
call fcn.1400b288c
inc qword [rsp + 0x30]
jno 0x140039cd5
sub rsp, 8
push 1
movabs rax, 0x1401d70cc
push rax
push SafeArrayPutElement
push 0x14d
push gethostname
push 0
push 0x57
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.140059ba1
add rsp, 0x40
push 0
movabs rax, 0x1401d70cc
push rax
push qword [0x14087ff90]
push 0x23
push 0x14d
push 0x50
push 0
push 0x20
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14002d57f
add rsp, 0x40
push 0
movabs rax, 0x1401d70cc
push rax
push qword [0x14087fee8]
push 0x23
push 0x5a
push 0x50
push 0x156
push 0x21
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14002d57f
add rsp, 0x40
push 0
movabs rax, 0x1401d70cc
push rax
push qword [0x140880108]
push 0x23
push 0x1b0
push __WSAFDIsSet
push 0
push 0x22
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14002d57f
add rsp, 0x40
push 1
push 0x22
pop rcx
pop rdx
call fcn.1400363d0
sub rsp, 8
push 1
movabs rax, 0x1401d70cc
push rax
push 0x1e
push 0x19a
push 0xd2
push 0
push 0x3c
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.140059ba1
add rsp, 0x40
sub rsp, 8
push 1
movabs rax, 0x1401d70cc
push rax
push 0x1e
push 0x1a4
push 0xe1
push 0
push 0x3d
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.140059ba1
add rsp, 0x40
sub rsp, 8
push 0
movabs rax, 0x1401d70cc
push rax
push 0x12c
push 0x1ae
push 0x10e
push 0
push reloc.msi.dll_MsiGetPropertyW
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.140059ba1
add rsp, 0x40
call fcn.1400b3680
push 1
push reloc.OLEAUT32.dll_SafeArrayPutElement
pop rcx
pop rdx
call fcn.1400b0dec
push 0
push 0x1f4
push 0x28e
push 0x3c
push 0xf2
push 0x1a
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.140060e4a
add rsp, 0x30
push 0x4000000d
push 0x28a
movabs rax, str.Licenses
push rax
push 0x1a4
push 0x258
push 0
push 0
push 0x1f
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400594b4
add rsp, 0x40
push 0
pop rcx
call fcn.1400ea8ac
mov rax, rax
push rax
push 0x1f
pop rcx
pop rdx
call fcn.1400b36b0
push 0
push qword [0x140880018]
push 0xffffffffffffffff
push 0x1f
pop rcx
pop rdx
pop r8
pop r9
call fcn.1400b29a8
push 0
movabs rax, 0x1401d70cc
push rax
push qword [0x140880028]
push 0x23
push 0x82
push 0x1ae
push 0
push 0x27
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14002d57f
add rsp, 0x40
push 0
movabs rax, 0x1401d70cc
push rax
push qword [0x1408801e0]
push 0x23
push 0x82
push 0x1ae
push 0x8c
push 0x28
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14002d57f
add rsp, 0x40
sub rsp, 8
push 0
push qword [0x140880030]
push 0x1c
push 0xaa
push 0x1b3
push 0x12c
push MsiGetActiveDatabase
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14005fed4
add rsp, 0x40
call fcn.1400b3680
push 1
push 0x1a
pop rcx
pop rdx
call fcn.1400b0dec
push 0
push 0x1f4
push 0x28e
push 0x3c
push 0xf2
push 0x1b
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.140060e4a
add rsp, 0x30
sub rsp, 8
push 0
push qword [0x1408801c8]
push 0x1e
push 0x12c
push 0
push 0
push 0x49
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14005fed4
add rsp, 0x40
sub rsp, 8
push 0
push qword [0x1408801b0]
push 0x1e
push 0x15e
push 0x23
push 0
push 0x4a
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14005fed4
add rsp, 0x40
sub rsp, 8
push 0
push qword [0x140880168]
push 0x1e
push 0xfa
push reloc.msi.dll_MsiGetPropertyW
push 0
push 0x4c
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14005fed4
add rsp, 0x40
sub rsp, 8
push 0
movabs rax, 0x1401d70cc
push rax
push SafeArrayPutElement
push __WSAFDIsSet
push 0x4a
push 0x10e
push 0x4d
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14005a543
add rsp, 0x40
sub rsp, 8
push 0
movabs rax, 0x1401d70cc
push rax
push SafeArrayPutElement
push gethostbyaddr
push 0x4a
push 0x1ae
push 0x4e
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14005a543
add rsp, 0x40
sub rsp, 8
push 0
push qword [0x14087ff48]
push 0x1e
push 0x15e
push 0x69
push 0
push 0x4b
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14005fed4
add rsp, 0x40
push 1
push 0x4d
pop rcx
pop rdx
call fcn.1400b36b0
push 1
push 0x4e
pop rcx
pop rdx
call fcn.1400b36b0
call fcn.1400b3680
push 1
push 0x1b
pop rcx
pop rdx
call fcn.1400b0dec
push 0
push 0x1f4
push 0x28e
push 0x3c
push 0xf2
push SafeArrayPutElement
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.140060e4a
add rsp, 0x30
push 0
movabs rax, 0x1401e1394
push rax
movabs rax, str.Go_msfree.su
push rax
push 0x23
push 0x82
push 0
push 0
push gethostname
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14002d57f
add rsp, 0x40
push 0
movabs rax, 0x1401d70cc
push rax
movabs rax, str.Donate
push rax
push 0x23
push 0x82
push 0
push 0x8c
push reloc.WS2_32.dll_gethostname
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14002d57f
add rsp, 0x40
push recv
pop rcx
call fcn.1400e1ea8
mov rax, rax
push rax
push 0x1c2
push 0x1c2
push 0x28
push 0x50
push recvfrom
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400b2f5c
add rsp, 0x30
call fcn.1400b3680
push 1
push SafeArrayPutElement
pop rcx
pop rdx
call fcn.1400b0dec
xor rax, rax
add rsp, 0x38
pop r15
pop rbp
ret