Function at 0x1400e3710
Capabilities:
Check if file exists
Create process on windows
Execute command
Get common file path
Get file attributes
Get hostname
Get proxy
Move file
Persist via app paths registry key
Persist via windows accessibility tools
Query or enumerate registry value
Schedule task via at
Self delete
Set registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xcd0]
sub rsp, 0xdd0
mov qword [rbp + 0x10], 0xfffffffffffffffe
mov qword [rsp + 0xe20], rbx
mov rax, qword [0x1401dd1d8]
xor rax, rsp
mov qword [rbp + 0xcc0], rax
mov r13, rdx
mov r12, rcx
mov qword [rbp + 8], rcx
mov qword [rsp + 0x48], rcx
xor eax, eax
mov dword [rbp - 0x50], eax
mov dword [rbp - 0x4c], eax
add rdx, 0x240
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rdx, [r13 + 0x248]
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rbp - 0x20]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
xor r8d, r8d
lea rdx, str.Microsoft_Office
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x1400e394a
xor r8d, r8d
lea rdx, str.Program_Files__x86_
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
lea rdx, [rsp + 0x60]
test eax, eax
jns 0x1400e381f
lea rcx, [rbp - 0x20]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
lea r8, str.Program_Files__x86_
lea rdx, str.Program_Files
lea rcx, [rbp - 0x20]
call qword [sym.imp.mfc140u.dll_CMFCToolBar::RebuildAccelerationKeys]
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rcx, rax
call fcn.1400f7cf0
cmp al, 1
jne 0x1400e386f
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
jmp 0x1400e394a
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rcx, rax
call fcn.1400f7cf0
test al, al
jne 0x1400e386f
lea r8, str.Program_Files
lea rdx, str.Program_Files__x86_
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCToolBar::RebuildAccelerationKeys]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rcx, rax
call fcn.1400f7cf0
cmp al, 1
je 0x1400e394a
mov edx, 0x5c
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_COleControl::ReleaseCaches]
mov ebx, eax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
sub eax, ebx
lea r8d, [rax - 1]
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_12600]
nop
lea rcx, [rsp + 0x40]
call fcn.1400ec6e0
mov r15, rax
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rbp - 0x50], 0xe
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov rdx, r14
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rbp]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
xor r8d, r8d
lea rdx, str.Microsoft_Office
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x1400e3b13
xor r8d, r8d
lea rdx, [0x14017bd20]
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x1400e3ac8
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rcx, rax
call fcn.1400f7cf0
test al, al
jne 0x1400e3ab8
xor r8d, r8d
lea rdx, str.Program_Files__x86_
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x1400e3ab8
lea r8, str.Program_Files
lea rdx, str.Program_Files__x86_
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CMFCToolBar::RebuildAccelerationKeys]
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rcx, rax
call fcn.1400f7cf0
test al, al
jne 0x1400e3ab8
lea rdx, [0x14017bd38]
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rsp + 0x40]
call fcn.1400ec6e0
mov r15, rax
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rbp - 0x50], 0x16
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov rdx, r14
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea r8, [0x14014a9e0]
lea rdx, str.OUTLOOK.EXE
jmp 0x1400e3b09
xor r8d, r8d
lea rdx, str.Program_Files__x86_
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x1400e3b13
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rcx, rax
call fcn.1400f7cf0
test al, al
jne 0x1400e3b13
lea r8, str.Program_Files
lea rdx, str.Program_Files__x86_
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CMFCToolBar::RebuildAccelerationKeys]
xor r8d, r8d
lea rdx, str.SysWOW64
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x1400e3b99
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rcx, rax
call fcn.1400f7cf0
test al, al
jne 0x1400e3b99
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x20]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
lea r8, str.System32
lea rdx, str.SysWOW64
lea rcx, [rbp - 0x20]
call qword [sym.imp.mfc140u.dll_CMFCToolBar::RebuildAccelerationKeys]
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rcx, rax
call fcn.1400f7cf0
cmp al, 1
jne 0x1400e3b99
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
xor r8d, r8d
lea rdx, str.mlcfg32.cpl
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
jle 0x1400e3c0f
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rcx, rax
call fcn.1400f1f40
lea rdx, str.success
mov rcx, r12
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rbp]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x20]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov rax, r12
jmp 0x1400ea254
lea rdx, str.OpenLogFile
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
test eax, eax
jne 0x1400e3d3a
lea rcx, [rsp + 0x40]
call fcn.1400fba40
mov rbx, rax
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov rsi, rax
mov dword [rbp - 0x50], 0x26
mov rcx, rbx
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov edi, eax
mov rcx, rbx
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rbx, rax
lea rcx, str.C:Users_
call qword [sym.imp.mfc140u.dll_CCheckListBox::SetSelectionCheck]
mov r8d, eax
mov dword [rsp + 0x20], edi
mov r9, rbx
lea rdx, str.C:Users_
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
lea r8, [0x14017bdc8]
mov rdx, rsi
lea rcx, [rbp - 0x68]
call fcn.140079660
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, [rbp - 0x68]
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.1400f8750
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, str.success
mov rcx, r12
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x20]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov rax, r12
jmp 0x1400ea254
lea rdx, str.OpenContentInInternetProperties
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
test eax, eax
jne 0x1400e3de3
lea rdx, str.C:WindowsSystem32control.exe_Inetcpl.cpl_Content_3
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__1]
nop
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.1400f8750
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, str.success
mov rcx, r12
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x20]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov rax, r12
jmp 0x1400ea254
lea rdx, str.rundirectmailcfg
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
test eax, eax
jne 0x1400e3f43
lea rdx, str.MLCFG32.CPL
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rsp + 0x40]
call fcn.1400ec6e0
nop
lea r8, [rsp + 0x50]
mov rdx, rax
lea rcx, [rbp - 0x60]
call fcn.140006190
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov rdi, rax
mov dword [rbp - 0x50], operator
mov esi, 0x22
mov word [rbp - 0x4c], si
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r9, rax
mov dword [rsp + 0x20], ebx
mov r12d, 1
mov r8d, r12d
lea rdx, [rbp - 0x4c]
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
movzx r8d, sil
mov rdx, rdi
lea rcx, [rsp + 0x78]
call fcn.140099e70
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, [0x14017bef8]
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rbx, rax
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r8, rax
mov dword [rsp + 0x28], r12d
xor ecx, ecx
mov qword [rsp + 0x20], rcx
mov r9, rbx
lea rdx, str.open
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rdx, str.success
mov rcx, qword [rbp + 8]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x1400ea224
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.displayswitch
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__2]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov esi, 0x22
lea r12d, [rsi - 0x21]
test ebx, ebx
jne 0x1400e412d
lea rdx, str.C:WindowsSystem32DisplaySwitch.exe
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__1]
nop
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.1400f8750
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
xor r14d, r14d
xor r8d, r8d
lea rdx, str..cpl
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x1400e40a5
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov rdi, rax
mov dword [rbp - 0x50], 0x806
mov word [rbp - 0x4c], si
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r9, rax
mov dword [rsp + 0x20], ebx
mov r8d, r12d
lea rdx, [rbp - 0x4c]
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov r8b, 0x22
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.140099e70
nop
mov rdx, rax
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, str.control.exe
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCControlRendererInfo::CMFCControlRendererInfo]
lea rdx, str.regdelete
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
test eax, eax
jne 0x1400e40d2
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rcx, rax
call fcn.1400e0e50
lea rdx, [0x14017c1f8]
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
test eax, eax
jne 0x1400e453c
lea rax, [rsp + 0x40]
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rbx, rax
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.1400ee3d0
jmp 0x1400ea208
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.openPrinterdialog
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__2]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e4211
lea rcx, [rbp - 0x60]
call fcn.1400fd5c0
nop
lea rdx, str.printerdialog.txt
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_COleCurrency::operator]
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rcx, rax
lea rdx, [0x14014a86c]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
mov rbx, rax
test rax, rax
je 0x1400e41c9
mov rdx, rax
lea rcx, str.RUNDLL32.EXE_PRINTUI.DLL_PrintUIEntry__ip
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputws]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r8, rax
mov dword [rsp + 0x28], 5
xor r14d, r14d
mov qword [rsp + 0x20], r14
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x1400e3fe8
lea rdx, str.runmailcfg
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
test eax, eax
jne 0x1400e3fe5
lea rcx, [rsp + 0x70]
call fcn.1400ec760
nop
call fcn.1400f3980
call fcn.1400ef470
test al, al
je 0x1400e4264
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rcx, rax
call fcn.1400f7cf0
test al, al
jne 0x1400e4456
lea rdx, str.C:Program_Files__x86_Microsoft_OfficeOffice15MLCFG32.CPL
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rcx, rax
call fcn.1400f7cf0
test al, al
jne 0x1400e4456
lea rdx, str.C:Program_Files__x86_Microsoft_OfficeOffice14MLCFG32.CPL
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rcx, rax
call fcn.1400f7cf0
test al, al
jne 0x1400e4456
lea rdx, str.C:Program_Files__x86_Microsoft_OfficeOffice16MLCFG32.CPL
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rcx, rax
call fcn.1400f7cf0
test al, al
jne 0x1400e4456
lea rdx, str.C:Program_FilesMicrosoft_Office_rootOffice16MLCFG32.CPL
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
call fcn.1400ef470
test al, al
je 0x1400e4335
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rcx, rax
call fcn.1400f7cf0
test al, al
jne 0x1400e4456
lea rdx, str.C:Program_FilesMicrosoft_OfficeOffice15MLCFG32.CPL
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rcx, rax
call fcn.1400f7cf0
test al, al
jne 0x1400e4456
lea rdx, str.C:Program_FilesMicrosoft_OfficeOffice14MLCFG32.CPL
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rcx, rax
call fcn.1400f7cf0
test al, al
jne 0x1400e4456
lea rdx, str.C:Program_FilesMicrosoft_OfficeOffice16MLCFG32.CPL
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rcx, rax
call fcn.1400f7cf0
test al, al
jne 0x1400e4456
lea rdx, str.MLCFG32.CPL
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rsp + 0x40]
call fcn.1400ec6e0
nop
lea r8, [rsp + 0x50]
mov rdx, rax
lea rcx, [rbp - 0x68]
call fcn.140006190
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, [rbp - 0x68]
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rcx, rax
call fcn.1400f1f40
lea rdx, [0x14015faf8]
mov rcx, qword [rbp + 8]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__1]
nop
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x1400ea224
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov rdi, rax
mov dword [rbp - 0x50], 0x206
mov word [rbp - 0x4c], si
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r9, rax
mov dword [rsp + 0x20], ebx
mov r8d, r12d
lea rdx, [rbp - 0x4c]
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov r8b, 0x22
mov rdx, rdi
lea rcx, [rsp + 0x78]
call fcn.140099e70
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, str.control.exe
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__1]
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rbx, rax
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r8, rax
mov dword [rsp + 0x28], r12d
xor r14d, r14d
mov qword [rsp + 0x20], r14
mov r9, rbx
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x1400e3fe8
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.ChangeProxySetting
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__2]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e47a1
lea rdx, str._8.8.8.8:8080
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400e478d
cmp qword [rbp - 0x40], 0
je 0x1400e478d
mov dword [rbp - 0x4c], r12d
lea rdx, str.ProxyOverride
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__1]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
mov dword [rbp - 0x28], 0x400
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rbp + 0x60]
call fcn.1400da1e0
lea rcx, [rbp - 0x28]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x4f0]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rax]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
lea rax, [rbp + 0x68]
mov rcx, qword [rbp + 0x60]
cmp rcx, rax
je 0x1400e4654
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test ebx, ebx
jne 0x1400e466a
lea rdx, [rbp + 0x4f0]
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCControlRendererInfo::CMFCControlRendererInfo]
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CFileDialog::SetTemplate]
xor r8d, r8d
lea rdx, [0x14014da40]
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
jns 0x1400e46a0
lea rdx, str._local_
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_COleCurrency::operator]
mov dword [rsp + 0x28], 4
lea rax, [rbp - 0x4c]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.ProxyEnable
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, r12d
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_4946]
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov r9d, r12d
xor r8d, r8d
lea rdx, str.ProxyServer
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov r9d, r12d
xor r8d, r8d
lea rdx, str.ProxyOverride
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rbp - 0x4c], r12d
mov dword [rsp + 0x28], 4
lea rax, [rbp - 0x4c]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.AutoDetect
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rbp - 0x60]
jmp 0x1400ea20c
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.proxydialog
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__2]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e4869
xor dil, dil
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, [0x14017c25c]
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__2]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
movzx edi, dil
test ebx, ebx
cmove edi, r12d
xor edx, edx
lea rcx, [rbp + 0x60]
call fcn.14000e7f0
nop
mov byte [rbp + 0x2d0], dil
lea rcx, [rbp + 0x60]
call sub.mfc140u.dll_CD2DPathGeometry::Detach
nop
lea rcx, [rbp + 0x60]
call fcn.14000eb20
jmp 0x1400ea212
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.AntiVirus
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__2]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e49e3
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.HDBFS
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__2]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400ea212
lea rdx, [0x14017c278]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
mov edx, 0xffffffff
mov rcx, rax
call fcn.1400fe770
test al, al
jne 0x1400ea212
lea rdx, str.c:WindowsIAssist
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov rsi, rax
mov dword [rbp - 0x50], 0x1006
lea rcx, str.AnakageProactive.exe
call qword [sym.imp.mfc140u.dll_CCheckListBox::SetSelectionCheck]
mov edi, eax
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], edi
lea r9, str.AnakageProactive.exe
mov r8d, ebx
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov rcx, rsi
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r8, rax
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
lea r9, str.action
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x60]
jmp 0x1400ea20c
lea rdx, str.PrinterDriver
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
test eax, eax
jne 0x1400e5005
lea rdx, str.C:Program_Files__x86_
lea rcx, [rbp - 0x38]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rbp - 0x38]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne dil
lea rcx, [rbp - 0x40]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rdx, [0x140150704]
lea rcx, str.C:WindowsiassistPrinterDriver.txt
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
mov r15, rax
test rax, rax
je 0x1400e4df4
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.PassBook
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__2]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e4c35
call fcn.1400ef470
lea rcx, str.Win10_
lea rdx, str.Win7_
test al, al
cmovne rdx, rcx
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
lea rax, str.64bit
lea rdx, str.32bit
test dil, dil
cmovne rdx, rax
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_COleCurrency::operator]
lea rdx, str.Compuprint_SP40Plus_P2
lea rcx, [rbp - 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
lea rdx, str.Sp40Plus.INF___r__USB001___m__Compuprint_SP40Plus_
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rdx, str._SystemRoot_System32_rundll32.exe_printui.dll_PrintUIEntry__if__b__Compuprint_SP40Plus_P2___f__C:Follow_me_printingSpeed_40_Plus__Windows_driverCompuprint_Drivers_InstallationdriversCompuprint_SP40_SP40Plus_SP40PlusT_
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rbp - 0x50], 0x2006
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
nop
mov rcx, r14
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov dword [rbp - 0x50], 0x6006
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r14
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r14
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rcx, rax
mov rdx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputws]
nop
jmp 0x1400e4de1
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, [0x14017c4c0]
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__2]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e4deb
lea rax, str.WINX64
lea rdx, str.WINX86
test dil, dil
cmovne rdx, rax
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
lea rdx, str.EPSON_LQ_310_ESC_P2
lea rcx, [rbp - 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
lea rdx, str.EBSD053M.INF___r__USB002___m__EPSON_LQ_310_ESC_P2_
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rdx, str._SystemRoot_System32_rundll32.exe_printui.dll_PrintUIEntry__if__b__EPSON_LQ_310_ESC_P2___f__C:Follow_me_printingDriversEpson_LQ_310_DD_PrinterDriverPrinter_
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rbp - 0x50], 0x8006
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
nop
mov rcx, r14
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov dword [rbp - 0x50], 0x18006
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r14
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r14
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rcx, rax
mov rdx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputws]
nop
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x48], rax
lea rdx, [0x1401497d8]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
mov rbx, rax
lea rdx, [0x14017c5d4]
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
mov r8, rbx
mov dl, 1
mov rcx, rax
call fcn.140104150
lea rax, [rbp - 0x80]
mov qword [rsp + 0x48], rax
lea rdx, [0x1401497d8]
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
mov rbx, rax
lea rdx, [0x14017c5d8]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
mov r8, rbx
mov dl, 1
mov rcx, rax
call fcn.140104150
lea rdx, [0x14014a740]
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rbp - 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov rsi, rax
mov dword [rbp - 0x50], 0x20006
lea rcx, [rbp - 0x40]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov edi, eax
lea rcx, [rbp - 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rbx, rax
lea rcx, str._SystemRoot_System32RUNDLL32_PRINTUI.DLL_PrintUIEntry__y__n__
call qword [sym.imp.mfc140u.dll_CCheckListBox::SetSelectionCheck]
mov r8d, eax
mov dword [rsp + 0x20], edi
mov r9, rbx
lea rdx, str._SystemRoot_System32RUNDLL32_PRINTUI.DLL_PrintUIEntry__y__n__
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
lea r8, [rbp - 0x68]
mov rdx, rsi
lea rcx, [rsp + 0x40]
call fcn.140006190
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.1400f8750
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rax, [rbp - 0x70]
mov qword [rsp + 0x48], rax
lea rdx, [0x14014d85c]
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
mov rbx, rax
lea rdx, str.installed_printer_is_making_to_default_failed
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
mov r8d, 0xffffffff
mov rdx, rbx
mov rcx, rax
call fcn.140105fe0
lea rcx, [rbp - 0x48]
call fcn.1400eada0
nop
lea rcx, [rbp - 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
xor r8d, r8d
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x1400e4fcf
call fcn.140104c70
lea rax, [rsp + 0x40]
mov qword [rsp + 0x48], rax
lea rdx, [0x14014d85c]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
mov rbx, rax
lea rdx, str.installed_printer_is_now_default
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
mov r8d, 0xffffffff
mov rdx, rbx
mov rcx, rax
call fcn.140105fe0
nop
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x28]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x38]
jmp 0x1400ea20c
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.deletebrowsinghistory
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__2]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e50d9
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.sitel
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__2]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e50b1
xor edx, edx
mov ecx, r12d
call fcn.1400e1550
xor edx, edx
mov ecx, r12d
call fcn.1400e1810
call fcn.1400e1470
xor edx, edx
mov ecx, r12d
call fcn.1400e1af0
xor edx, edx
mov ecx, r12d
call fcn.1400e1550
xor edx, edx
mov ecx, r12d
call fcn.1400e1810
jmp 0x1400ea212
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.ChangeProxyinMozilla
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__2]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e53b7
lea rdx, str.type__Appdata_MozillaFirefoxprofiles.ini
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__1]
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.1400f8750
nop
xor r8d, r8d
lea rdx, [0x14014fd22]
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov ebx, eax
xor r8d, r8d
lea rdx, str.Default1
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
sub eax, ebx
mov r8d, eax
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_Ordinal_12600]
nop
mov rdx, rax
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
lea r8d, [rax - 0xd]
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CStringList::InsertBefore]
nop
mov rdx, rax
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, str.AnakageFilesVBScriptsEnableMozillaProxy.bat
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rsp + 0x58]
call fcn.1400fa610
nop
lea r8, [rsp + 0x50]
mov rdx, rax
lea rcx, [rbp - 0x60]
call fcn.140006190
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov rsi, rax
mov dword [rbp - 0x50], 0x80006
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov edi, eax
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rbx, rax
lea rcx, [0x14014d7f8]
call qword [sym.imp.mfc140u.dll_CCheckListBox::SetSelectionCheck]
mov r8d, eax
mov dword [rsp + 0x20], edi
mov r9, rbx
lea rdx, [0x14014d7f8]
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
lea r8, [0x140158124]
mov rdx, rsi
lea rcx, [rbp - 0x80]
call fcn.140079660
nop
lea r8, [0x140158124]
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.140079660
nop
lea r8, [0x140158124]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140079660
mov r15, rax
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rbp - 0x50], 0x180006
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov rcx, r14
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r9, rax
xor ecx, ecx
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rcx
lea r8, str.cmd.exe
lea rdx, str.open
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov ecx, 0xfa0
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x70]
jmp 0x1400ea20c
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.SelectFolder
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__2]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e54ee
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x60]
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x20], xmm0
lea rax, [rbp + 0x60]
mov qword [rbp + 0x30], rax
lea rax, str.Please__select_a_folder
mov qword [rbp + 0x38], rax
mov dword [rbp + 0x40], r14d
mov qword [rbp + 0x48], r14
mov qword [rbp + 0x50], r14
mov dword [rbp + 0x58], 0xffffffff
lea rcx, [rbp + 0x20]
call qword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
test rax, rax
je 0x1400e54dd
lea rdx, [rbp + 0x60]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__1]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CFileDialog::SetTemplate]
mov rdx, rax
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x48], rax
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__1]
mov rbx, rax
mov qword [rsp + 0x68], rax
call sub.mfc140u.dll_AfxFieldText
mov rcx, qword [rax + 8]
add rcx, 0x2c8
mov rdx, rbx
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
mov rcx, rbx
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x78]
jmp 0x1400ea20c
lea rdx, str.You_have_cancelled_the_process__Please_exit_the_solution_by_clicking_on_the_cross_Button
lea rcx, [rsp + 0x40]
jmp 0x1400e80d9
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.CreateRegKey
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__2]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e592a
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftOffice16.0ExcelSecurity
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + 0x70], r14d
test eax, eax
jne 0x1400ea212
mov dword [rbp - 0x4c], r14d
mov dword [rbp - 0x40], 4
mov dword [rbp - 0x28], 0x3ff
lea rax, [rbp - 0x28]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x4c]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x40]
xor r8d, r8d
lea rdx, str.ExtensionHardening
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r15d, eax
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rdx, rax
lea rcx, [rbp - 0x60]
call fcn.1400f97e0
nop
lea rdx, str.Temp
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rbp - 0x50], 0x200006
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov rdx, r14
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, str.BackupValue.txt
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rbp - 0x50], 0x400006
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov rdx, r14
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rbx, rax
lea rax, [0x14014e578]
mov qword [rbp + 0x60], rax
lea rcx, [rbp + 0x108]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
mov dword [rbp - 0x50], 0x800006
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x68]
lea rcx, [rbp + 0x60]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
nop
mov rax, qword [rbp + 0x60]
movsxd rcx, dword [rax + 4]
lea rdi, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x60], rdi
mov rax, qword [rbp + 0x60]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x5c], edx
lea rax, [rbp + 0x68]
mov qword [rsp + 0x48], rax
lea rcx, [rbp + 0x68]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
lea rax, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rbp + 0x68], rax
mov byte [rbp + 0xe4], 0
mov byte [rbp + 0xd9], 0
lea rcx, [rbp + 0x68]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
xor ecx, ecx
mov qword [rbp + 0xe8], rcx
mov rax, qword [0x1401dec48]
mov qword [rbp + 0xdc], rax
mov qword [rbp + 0xd0], rcx
lea r9d, [rcx + 0x40]
lea r8d, [rcx + 2]
mov rdx, rbx
lea rcx, [rbp + 0x68]
call fcn.1401004e0
test rax, rax
jne 0x1400e5821
mov rax, qword [rbp + 0x60]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x60]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
mov rax, qword [rbp + 0x60]
movsxd rcx, dword [rax + 4]
test byte [rbp + rcx + 0x70], 6
jne 0x1400e585f
lea rcx, [rbp + 0x60]
test r15d, r15d
jne 0x1400e5853
lea rdx, str.The_Original_value_of_ExtensionHardening_is_:
call fcn.140099aa0
mov rcx, rax
mov edx, dword [rbp - 0x4c]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
jmp 0x1400e585f
lea rdx, str.The_key_ExtensionHardening_is_not_present
call fcn.140099aa0
lea rcx, [rbp + 0x68]
call fcn.140010cd0
test rax, rax
jne 0x1400e5889
mov rax, qword [rbp + 0x60]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x60]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.ExtensionHardening
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rax, qword [rbp + 0x60]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x60], rdi
mov rax, qword [rbp + 0x60]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x5c], edx
lea rcx, [rbp + 0x68]
call fcn.14000e950
lea rcx, [rbp + 0x70]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x108]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x70]
jmp 0x1400ea20c
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.updateSymantec
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__2]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e5a76
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rdx, str.AnakageFilesVBScriptsSymantecLiveUpdate.bat
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rsp + 0x40]
call fcn.1400fa610
nop
lea r8, [rbp - 0x70]
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140006190
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x48], rax
lea rdx, [0x1401497d8]
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
mov rbx, rax
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
xor r8d, r8d
mov rdx, rbx
mov rcx, rax
call fcn.140104750
call sub.mfc140u.dll_AfxFieldText
mov rcx, qword [rax + 8]
cmp dword [rcx + 0x2e0], 0
jne 0x1400e5a4a
lea rdx, str.You_have_cancelled_the_process__so_problem_might_not_be_resolved._Please_contact_IT_Support_team.
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
mov rdx, rax
mov rcx, r13
call fcn.14006d4a0
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x30]
jmp 0x1400ea20c
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.CheckDefaultEmailAppIsOutlook
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__2]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e5baf
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rdx, str.HKEY_CURRENT_USERSoftwareMicrosoftWindowsShellAssociationsUrlAssociationsmailtoUserChoice
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rdx, [rbp - 0x68]
lea rcx, [rsp + 0x78]
call fcn.1400f91c0
mov qword [rbp - 0x60], rax
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400e5b83
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x2f0]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x2f0]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0xffff
lea r8, str.ProgId
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
jmp 0x1400ea20c
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.LaunchMirrorOP
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__2]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e5c5a
call fcn.1400ef3b0
movzx ebx, al
lea rdx, str.C:Program_FilesMirrorOpMirrorOp.exe
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
cmp bl, 1
jne 0x1400e5c27
lea rdx, str.C:Program_Files__x86_MirrorOpMirrorOp.exe
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r8, rax
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r14
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rbp - 0x68]
jmp 0x1400ea20c
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.CloseChrome
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__2]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e5d35
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rdx, str.taskkill__F__IM_chrome.exe__T
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.1400f8750
nop
mov rdx, rax
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x48], rax
lea rdx, [rbp - 0x68]
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rbx, rax
lea rdx, str.closing_chrome_browser_forcefully
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
mov r8d, 0xffffffff
mov rdx, rbx
mov rcx, rax
call fcn.140105fe0
nop
lea rcx, [rbp - 0x68]
jmp 0x1400ea20c
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.CloseZoom
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__2]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e5e10
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rdx, str.taskkill__F__IM_Zoom.exe__T
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.1400f8750
nop
mov rdx, rax
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x48], rax
lea rdx, [rbp - 0x68]
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rbx, rax
lea rdx, str.closing_Zoom_meetings_forcefully
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
mov r8d, 0xffffffff
mov rdx, rbx
mov rcx, rax
call fcn.140105fe0
nop
lea rcx, [rbp - 0x68]
jmp 0x1400ea20c
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.Closeoutlook
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__2]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e5eeb
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rdx, str.taskkill__F__IM_outlook.exe__T
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.1400f8750
nop
mov rdx, rax
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x48], rax
lea rdx, [rbp - 0x68]
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rbx, rax
lea rdx, str.closing_outlook_meetings_forcefully
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
mov r8d, 0xffffffff
mov rdx, rbx
mov rcx, rax
call fcn.140105fe0
nop
lea rcx, [rbp - 0x68]
jmp 0x1400ea20c
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.Zoom
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__2]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e6167
lea rdx, [0x14014a9e0]
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__1]
nop
lea rdx, str.Zoom_binzoom.exe
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rdx, [0x1401497d8]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.1400f97e0
nop
lea r8, [rbp - 0x70]
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.140006190
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea r8, str.Roaming
lea rdx, str.Local
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCToolBar::RebuildAccelerationKeys]
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rcx, rax
call fcn.1400f7cf0
test al, al
jne 0x1400e60da
lea rdx, str.C:Program_Files__x86_Zoom_binzoom.exe
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rcx, rax
call fcn.1400f7cf0
cmp al, 1
jne 0x1400e603d
lea rdx, str.C:_Program_Files__x86__Zoom_binzoom.exe
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__1]
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1400f8750
nop
mov rdx, rax
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
jmp 0x1400e6108
xor r8d, r8d
lea rdx, str.Program_Files__x86_
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x1400e6113
lea r8, str.Program_Files
lea rdx, str.Program_Files__x86_
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCToolBar::RebuildAccelerationKeys]
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rcx, rax
call fcn.1400f7cf0
lea rcx, [rbp - 0x80]
cmp al, 1
jne 0x1400e60c0
lea rdx, str.C:_Program_Files_Zoom_binzoom.exe
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__1]
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1400f8750
nop
mov rdx, rax
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
jmp 0x1400e6108
lea rdx, str.We_are_not_able_to_find_zoom_application_in_your_system._Please_close_the_solution_and_contact_HelpDesk.
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__1]
mov rdx, rax
mov rcx, r13
call fcn.14006d4a0
jmp 0x1400e6113
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1400f8750
nop
mov rdx, rax
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x48], rax
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rbx, rax
lea rdx, str.Checking_zoom_meeting_opening_request:
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
mov r8d, 0xffffffff
mov rdx, rbx
mov rcx, rax
call fcn.140105fe0
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x48]
jmp 0x1400ea20c
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.CloseIE
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__2]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e6242
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rdx, str.taskkill__F__IM_iexplore.exe__T
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.1400f8750
nop
mov rdx, rax
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x48], rax
lea rdx, [rbp - 0x68]
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rbx, rax
lea rdx, str.closing_Internet_explorer_forcefully
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
mov r8d, 0xffffffff
mov rdx, rbx
mov rcx, rax
call fcn.140105fe0
nop
lea rcx, [rbp - 0x68]
jmp 0x1400ea20c
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.systemRestart
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__2]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e631d
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rdx, str.shutdown__r__t_600
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.1400f8750
nop
mov rdx, rax
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x48], rax
lea rdx, [rbp - 0x68]
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rbx, rax
lea rdx, str.Restarting_machine_in_a_time_interval_of_10_minutes
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
mov r8d, 0xffffffff
mov rdx, rbx
mov rcx, rax
call fcn.140105fe0
nop
lea rcx, [rbp - 0x68]
jmp 0x1400ea20c
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.symantecManualUpdate
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__2]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e644a
lea rdx, str.AnakageFilesVBScriptsSymantecManualUpdate.bat
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rsp + 0x40]
call fcn.1400fa610
mov r14, rax
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov dword [rbp - 0x50], 0x4000006
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r14
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r14
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x48], rax
lea rdx, [0x1401497d8]
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
mov rbx, rax
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
xor r8d, r8d
mov rdx, rbx
mov rcx, rax
call fcn.140104750
nop
lea rcx, [rsp + 0x78]
jmp 0x1400ea20c
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.officeRepair
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__2]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e729c
lea rcx, [rbp - 0x38]
call fcn.1400ec760
nop
call fcn.1400ef670
movzx r13d, al
call fcn.1400ef3b0
movzx r12d, al
lea rcx, [rbp - 0x40]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rbp - 0x28]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rbp - 0x38]
call qword [sym.imp.mfc140u.dll_CPngImage::LoadFromBuffer]
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CPngImage::LoadFromBuffer]
mov rcx, rax
lea rdx, str.office
call fcn.14000cf00
test al, al
je 0x1400e6bfd
lea rdx, str.AnakageFilesVBScriptsOfficeConfig.xml
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rsp + 0x40]
call fcn.1400fa610
mov r15, rax
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rbp - 0x50], 0x8000006
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov rdx, r14
lea rcx, [rbp - 0x28]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, [0x14014a740]
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rdx, [0x14014a740]
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r15, rax
mov dword [rbp - 0x50], 0x10000006
lea rcx, [rbp - 0x28]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rbp - 0x28]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
nop
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rbp - 0x50], 0x30000006
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov rdx, r14
lea rcx, [rbp - 0x28]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
xor r8d, r8d
lea rdx, str.office15
lea rcx, [rbp - 0x38]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x1400e670d
lea rdx, str.office13
jmp 0x1400e676e
xor r8d, r8d
lea rdx, [0x14017cf20]
lea rcx, [rbp - 0x38]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x1400e672e
lea rdx, str.office16
jmp 0x1400e676e
xor r8d, r8d
lea rdx, str.office14
lea rcx, [rbp - 0x38]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x1400e674f
lea rdx, str.office10
jmp 0x1400e676e
xor r8d, r8d
lea rdx, [0x14017cf70]
lea rcx, [rbp - 0x38]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x1400e6778
lea rdx, str.office12
lea rcx, [rbp - 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
xor r8d, r8d
lea rdx, str.root
lea rcx, [rbp - 0x38]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
lea rcx, [rbp - 0x60]
test eax, eax
lea rdx, str.ClickToRun
jns 0x1400e67a2
lea rdx, [0x14017cfa4]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, [0x14017cfa4]
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__2]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e698e
lea rcx, [rbp - 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.office13
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__2]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rbp - 0x40]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e6844
lea rdx, str.C:Program_FilesCommon_Filesmicrosoft_sharedOFFICE15Office_Setup_ControllerSetup.exe
jmp 0x1400e6960
lea rcx, [rbp - 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.office16
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__2]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rbp - 0x40]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e6896
lea rdx, str.C:Program_FilesCommon_Filesmicrosoft_sharedOFFICE16Office_Setup_ControllerSetup.exe
jmp 0x1400e6960
lea rcx, [rbp - 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.office10
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__2]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rbp - 0x40]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e68e5
lea rdx, str.C:Program_FilesCommon_Filesmicrosoft_sharedOFFICE14Office_Setup_ControllerSetup.exe
jmp 0x1400e6960
lea rcx, [rbp - 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.office12
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__2]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rbp - 0x40]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e696b
lea rdx, str.C:Program_Files__x86_Common_FilesMicrosoft_SharedOFFICE12Office_Setup_ControllerSETUP.EXE
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rcx, rax
call fcn.1400f7cf0
test al, al
jne 0x1400e696b
lea rdx, str.C:Program_FilesCommon_FilesMicrosoft_SharedOFFICE12Office_Setup_ControllerSETUP.EXE
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
test r13b, r13b
je 0x1400e698e
test r12b, r12b
je 0x1400e698e
lea r8, str.Program_Files__x86_
lea rdx, str.Program_Files
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCToolBar::RebuildAccelerationKeys]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rcx, rax
call fcn.1400f7cf0
test al, al
je 0x1400e6bb7
lea rdx, [0x14014a740]
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rdx, [0x14014a740]
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r15, rax
mov dword [rbp - 0x50], 0x40000006
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
nop
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rbp - 0x50], 0xc0000006
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov rdx, r14
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, str.__repair_standard__config
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_COleCurrency::operator]
lea r8, [rbp - 0x28]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x78]
call fcn.140006190
nop
lea rax, [rsp + 0x40]
mov qword [rsp + 0x48], rax
lea rdx, [0x14014d85c]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
mov rbx, rax
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
mov r8d, 0xffffffff
mov rdx, rbx
mov rcx, rax
call fcn.140105fe0
lea rdx, str.C:windowsiassistlogsAnk.bat
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rcx, rax
lea rdx, [0x140150704]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
mov rbx, rax
test rax, rax
je 0x1400e6b97
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov rcx, rbx
call fcn.140038fe0
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov ecx, 0x88
call fcn.1400f4b20
nop
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x78]
jmp 0x1400e725f
lea rax, [rsp + 0x40]
mov qword [rsp + 0x48], rax
lea rdx, str.NotFound
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
mov rbx, rax
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
mov r8d, 0xffffffff
mov rdx, rbx
mov rcx, rax
call fcn.140105fe0
jmp 0x1400e7266
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CPngImage::LoadFromBuffer]
mov rcx, rax
lea rdx, str.skype
call fcn.14000cf00
test al, al
je 0x1400e7266
lea rdx, str.AnakageFilesVBScriptsSkypeConfig.xml
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rsp + 0x58]
call fcn.1400fa610
mov r15, rax
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rbp - 0x4c], 2
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov rdx, r14
lea rcx, [rbp - 0x28]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, [0x14014a740]
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rdx, [0x14014a740]
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r15, rax
mov dword [rbp - 0x4c], 4
lea rcx, [rbp - 0x28]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rbp - 0x28]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
nop
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rbp - 0x4c], reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov rdx, r14
lea rcx, [rbp - 0x28]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rdx, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionApp_PathsLync.EXEPath
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
lea rdx, [rbp - 0x48]
mov rcx, rax
call fcn.1400ed8d0
test eax, eax
jne 0x1400e7243
lea rax, [rsp + 0x58]
mov qword [rsp + 0x68], rax
lea rdx, [rbp - 0x48]
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rbx, rax
lea rdx, str.Office_Lync_Path
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
mov r8d, 0xffffffff
mov rdx, rbx
mov rcx, rax
call fcn.140105fe0
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_CPngImage::LoadFromBuffer]
mov rcx, rax
xor r8d, r8d
lea rdx, [0x14017cf20]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x1400e6eb6
lea rdx, str.C:Program_FilesCommon_Filesmicrosoft_sharedOFFICE16Office_Setup_Controller_setup.exe
jmp 0x1400e6f08
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_CPngImage::LoadFromBuffer]
mov rcx, rax
xor r8d, r8d
lea rdx, str.office15
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x1400e6ee0
lea rdx, str.C:Program_FilesCommon_Filesmicrosoft_sharedOFFICE15Office_Setup_Controller_setup.exe
jmp 0x1400e6f08
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_CPngImage::LoadFromBuffer]
mov rcx, rax
xor r8d, r8d
lea rdx, str.office14
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x1400e6f13
lea rdx, str.C:Program_FilesCommon_Filesmicrosoft_sharedOFFICE14Office_Setup_Controller_setup.exe
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
test r13b, r13b
je 0x1400e6f36
test r12b, r12b
je 0x1400e6f36
lea r8, str.Program_Files__x86
lea rdx, str.Program_Files
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCToolBar::RebuildAccelerationKeys]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rcx, rax
call fcn.1400f7cf0
test al, al
je 0x1400e7202
lea rdx, [0x14014a740]
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rdx, [0x14014a740]
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r15, rax
mov dword [rbp - 0x4c], 0x10
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
nop
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rbp - 0x4c], gethostbyname
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov rdx, r14
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, str.__repair_Lync__config
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_COleCurrency::operator]
lea r8, [rbp - 0x28]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x78]
call fcn.140006190
nop
lea rax, [rbp - 0x58]
mov qword [rbp - 0x70], rax
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rbx, rax
lea rdx, str.CommandToRun_with_xml_file
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
mov r8d, 0xffffffff
mov rdx, rbx
mov rcx, rax
call fcn.140105fe0
lea rax, [rsp + 0x68]
mov qword [rbp - 0x80], rax
lea rdx, [0x14014d85c]
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
mov rbx, rax
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
mov r8d, 0xffffffff
mov rdx, rbx
mov rcx, rax
call fcn.140105fe0
lea rdx, str.Ank.bat
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rsp + 0x68]
call fcn.1400fd5c0
nop
lea r8, [rsp + 0x58]
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140006190
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rcx, rax
lea rdx, [0x140150704]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
mov rbx, rax
test rax, rax
je 0x1400e71ae
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov rcx, rbx
call fcn.140038fe0
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
lea rax, [rbp - 0x58]
mov qword [rbp - 0x70], rax
lea rdx, [0x1401497d8]
lea rcx, [rbp - 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
mov rbx, rax
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
xor r8d, r8d
mov rdx, rbx
mov rcx, rax
call fcn.140104750
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x1400e7243
lea rax, [rsp + 0x68]
mov qword [rsp + 0x58], rax
lea rdx, str.NotFound
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
mov rbx, rax
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
mov r8d, 0xffffffff
mov rdx, rbx
mov rcx, rax
call fcn.140105fe0
nop
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x28]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x38]
jmp 0x1400ea20c
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.deleteRegistry
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__2]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e72ff
lea rdx, str.SoftwareSymantecPKI_Client
mov rcx, 0xffffffff80000001
call fcn.1400f11c0
jmp 0x1400ea212
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.regset
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__2]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e755d
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.officedisablehardwareaccl
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__2]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e74a5
mov qword [rbp - 0x18], r14
mov dword [rbp - 0x10], r14d
mov qword [rbp - 8], r14
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rsp + 0x48]
call fcn.1400fd7d0
nop
mov rdx, rax
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, str.commongraphics
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_COleCurrency::operator]
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r8, rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r14d
xor r9d, r9d
mov rdx, 0xffffffff80000001
lea rcx, [rbp - 0x18]
call fcn.1400df5a0
test eax, eax
je 0x1400e7439
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x1400e7435
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x18], r14
mov dword [rbp - 0x10], r14d
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r8, rax
mov rdx, 0xffffffff80000001
mov r9d, 0x2001f
lea rcx, [rbp - 0x18]
call fcn.1400f0180
mov rbx, qword [rbp - 0x18]
test eax, eax
jne 0x1400e7495
mov dword [rsp + 0x70], r12d
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.DisableHardwareAcceleration
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
jmp 0x1400e8f70
xor r8d, r8d
lea rdx, [0x14015b940]
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov ebx, eax
mov r8d, eax
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CStringList::InsertBefore]
nop
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
sub eax, ebx
lea r8d, [rax - 1]
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_12600]
nop
lea rax, [rsp + 0x48]
mov qword [rbp - 0x80], rax
lea rax, [rsp + 0x68]
mov qword [rbp - 0x70], rax
lea rdx, str.DWORD
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
mov rdi, rax
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rbx, rax
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call fcn.1400daf10
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
jmp 0x1400ea20c
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.regstringset
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__2]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e7664
xor r8d, r8d
lea rdx, [0x14015b940]
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov ebx, eax
mov r8d, eax
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CStringList::InsertBefore]
nop
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
sub eax, ebx
lea r8d, [rax - 1]
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_12600]
nop
lea rax, [rsp + 0x48]
mov qword [rbp - 0x80], rax
lea rax, [rsp + 0x68]
mov qword [rbp - 0x70], rax
lea rdx, str.string
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
mov rdi, rax
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rbx, rax
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call fcn.1400daf10
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
jmp 0x1400ea20c
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.outlookSettingChange
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__2]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e7b15
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.enabledesktopnotificaion
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__2]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e7985
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
mov qword [rbp - 0x18], r14
mov dword [rbp - 0x10], r14d
mov qword [rbp - 8], r14
lea rdx, str.OutlookPreferences
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rsp + 0x48]
call fcn.1400fd7d0
mov r15, rax
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rbp - 0x4c], 0x100
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov rdx, r14
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r8, rax
mov rdx, 0xffffffff80000001
mov r9d, 0x2001f
lea rcx, [rbp - 0x18]
call fcn.1400f0180
test eax, eax
jne 0x1400e7828
mov dword [rsp + 0x70], r12d
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.NewmailDesktopAlerts
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rdx, str.OutlookOptionsReminders
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rsp + 0x48]
call fcn.1400fd7d0
mov r15, rax
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rbp - 0x4c], 0x200
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov rdx, r14
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r8, rax
mov rdx, 0xffffffff80000001
mov r9d, 0x2001f
lea rcx, [rbp - 0x18]
call fcn.1400f0180
mov rbx, qword [rbp - 0x18]
test eax, eax
jne 0x1400e796d
mov dword [rsp + 0x70], r12d
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.PlaySound
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x70], r12d
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Type
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
test rbx, rbx
je 0x1400e797c
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rbp - 0x60]
jmp 0x1400ea20c
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.AutoArchive
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__2]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400ea212
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
mov qword [rbp - 0x18], r14
mov dword [rbp - 0x10], r14d
mov qword [rbp - 8], r14
lea rdx, str.OutlookPreferences
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rsp + 0x48]
call fcn.1400fd7d0
mov r15, rax
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov r14, rax
mov dword [rbp - 0x4c], 0x400
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov esi, eax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], esi
mov r9, rdi
mov r8d, ebx
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov rdx, r14
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r8, rax
mov rdx, 0xffffffff80000001
mov r9d, 0x2001f
lea rcx, [rbp - 0x18]
call fcn.1400f0180
mov rbx, qword [rbp - 0x18]
test eax, eax
jne 0x1400e7afd
xor ecx, ecx
mov dword [rsp + 0x70], ecx
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9d, [rcx + 4]
xor r8d, r8d
lea rdx, str.DoAging
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
test rbx, rbx
je 0x1400e7b0c
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rbp - 0x68]
jmp 0x1400ea20c
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.runsep
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__2]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e7bbc
lea rcx, [rsp + 0x50]
call fcn.1400eca00
nop
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rcx, rax
call fcn.1400f7cf0
test al, al
je 0x1400e7bb2
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r8, rax
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r14
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rsp + 0x50]
jmp 0x1400ea20c
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, str.regremoveduplicate
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__2]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1400e7c23
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rcx, rax
call fcn.1400f1980
jmp 0x1400ea212
lea rdx, str.runreg
lea rcx, [rsp + 0x60]
call fcn.14000cf00
test al, al
je 0x1400e7c54
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rcx, rax
call fcn.1400f1d20
jmp 0x1400ea212
lea rdx, str.MsTeam
lea rcx, [rsp + 0x60]
call fcn.14000cf00
test al, al
je 0x1400e7dc6
lea rdx, str.openteam
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
test rax, rax
je 0x1400ea212
lea rdx, str.AppDataLocalMicrosoftTeamscurrentTeams.exe
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rdx, [0x14014b478]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rsp + 0x68]
call fcn.1400fba40
nop
mov r8, rax
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x48]
call fcn.140006190
nop
lea r8, [rsp + 0x58]
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140006190
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rax, [rbp - 0x58]
mov qword [rbp - 0x68], rax
lea rdx, str.openteam__
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rdx, [0x14014d85c]
lea rcx, [rbp - 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
mov rbx, rax
lea r8, [rsp + 0x50]
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x70]
call fcn.140006190
nop
mov r8d, 0xffffffff
mov rdx, rbx
mov rcx, rax
call fcn.140105fe0
nop
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r9, rax
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], r14
lea r8, [0x140167600]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rdx, str.success
mov rcx, qword [rbp + 8]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x1400ea224
lea rdx, str.recentfolder
lea rcx, [rsp + 0x60]
call fcn.14000cf00
test al, al
je 0x1400e7e99
lea rdx, str.Recent
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rdx, str.c:users_
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rsp + 0x68]
call fcn.1400fba40
nop
mov r8, rax
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x48]
call fcn.140006190
nop
lea r8, [rsp + 0x58]
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.140006190
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r9, rax
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], r14
lea r8, [0x140167600]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x1400ea208
lea rdx, str.regreadanddelete
lea rcx, [rsp + 0x60]
call fcn.14000cf00
test al, al
je 0x1400e8001
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rdx, str.OutlookSecurityOutlookSecureTempFolder
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rdx, str.HKEY_CURRENT_USER_
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rsp + 0x68]
call fcn.1400fd7d0
nop
mov r8, rax
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x48]
call fcn.140006190
nop
lea r8, [rsp + 0x58]
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.140006190
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rax, [rbp - 0x58]
mov qword [rbp - 0x68], rax
lea rcx, [rbp - 0x58]
call fcn.1400fd7d0
mov rbx, rax
lea rdx, str.Outlook_version_found
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
mov r8d, 0xffffffff
mov rdx, rbx
mov rcx, rax
call fcn.140105fe0
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
lea rdx, [rsp + 0x78]
mov rcx, rax
call fcn.1400ed8d0
test eax, eax
jne 0x1400e7fec
lea rax, [rbp - 0x58]
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rbx, rax
lea rdx, str.Outlook_temp_folder_location
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
mov r8d, 0xffffffff
mov rdx, rbx
mov rcx, rax
call fcn.140105fe0
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rcx, rax
call fcn.1400df9c0
nop
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x78]
jmp 0x1400ea20c
lea rdx, [0x14017bc08]
lea rcx, [rsp + 0x60]
call fcn.14000cf00
test al, al
je 0x1400e80ef
lea rdx, [0x1401497d8]
lea rcx, [rbp - 0x78]
call fcn.140041a90
test al, al
je 0x1400e8079
xor r8d, r8d
lea rdx, str.Program_Files__x86_
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x1400e8079
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rcx, rax
call fcn.1400f7cf0
test al, al
jne 0x1400e8079
lea r8, str.Program_Files
lea rdx, str.Program_Files__x86_
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CMFCToolBar::RebuildAccelerationKeys]
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rcx, rax
call fcn.1400f7cf0
lea rcx, [rbp - 0x78]
cmp al, 1
jne 0x1400e80b5
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r9, rax
mov dword [rsp + 0x28], 3
lea r8, str.notepad.exe
jmp 0x1400e8965
xor r8d, r8d
lea rdx, str.vpncl
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x1400ea212
lea rdx, str.It_looks_like_Cisco_VPN_Client_is_not_installed_on_your_system._Please_contact_helpdesk.
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
mov rdx, rax
mov rcx, r13
call fcn.14006d4a0
jmp 0x1400ea212
lea rdx, str.explorefile
lea rcx, [rsp + 0x60]
call fcn.14000cf00
test al, al
je 0x1400e81dd
lea rdx, [r13 + 0x250]
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rcx, rax
call fcn.1400f7cf0
test al, al
jne 0x1400e81a5
lea r8, str.Program_Files
lea rdx, str.Program_Files__x86_
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CMFCToolBar::RebuildAccelerationKeys]
xor r8d, r8d
lea rdx, str..exe
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
jle 0x1400e81a5
xor r8d, r8d
lea rdx, str.Microsoft_Office
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
jle 0x1400e81a5
lea rcx, [rsp + 0x48]
call fcn.1400ec6e0
nop
mov rdx, rax
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r9, rax
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r14
lea r8, [0x140167600]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rsp + 0x78]
jmp 0x1400ea20c
lea rdx, str.renamefolder
lea rcx, [rsp + 0x60]
call fcn.14000cf00
test al, al
je 0x1400e8254
lea rax, [rsp + 0x48]
mov qword [rsp + 0x58], rax
lea rdx, [0x1401497d8]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
mov rbx, rax
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1400ee3d0
nop
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rcx, rax
call fcn.1401032f0
nop
lea rcx, [rsp + 0x40]
jmp 0x1400ea20c
lea rdx, str.InternetConnection
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
test eax, eax
jne 0x1400e82b3
lea rdx, str.C:WindowsSystem32control.exe_Inetcpl.cpl_Connections_1
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__1]
nop
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.1400f8750
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
jmp 0x1400ea20c
lea rdx, str.renamefolderDeleteFiles
lea rcx, [rsp + 0x60]
call fcn.14000cf00
test al, al
je 0x1400e837d
lea rax, [rsp + 0x48]
mov qword [rsp + 0x58], rax
lea rdx, [0x1401497d8]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
mov rbx, rax
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1400ee3d0
nop
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rcx, rax
call fcn.1401032f0
lea rdx, str.Tracing
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x58]
call fcn.140006190
nop
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rcx, rax
call fcn.1400e07f0
nop
lea rcx, [rbp - 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x50]
jmp 0x1400ea20c
lea rdx, str.runvbscript
lea rcx, [rsp + 0x60]
call fcn.14000cf00
test al, al
je 0x1400e84d0
lea rdx, [0x14015f6f8]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rsp + 0x68]
call fcn.1400fa610
nop
lea r8, [rsp + 0x40]
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140006190
nop
lea r8, [rbp - 0x78]
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140006190
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, str.updateinventory.vbs
lea rcx, [rbp - 0x78]
call fcn.14000cf00
test al, al
je 0x1400e848b
lea rdx, str.Accenture_Workstation_Security_ComplianceScripts_
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rbp - 0x70]
call fcn.1400fa610
nop
lea r8, [rsp + 0x58]
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.140006190
nop
lea r8, [rbp - 0x78]
mov rdx, rax
lea rcx, [rbp - 0x58]
call fcn.140006190
nop
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rbp - 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rax, [rbp - 0x58]
mov qword [rbp - 0x80], rax
lea rdx, [0x1401497d8]
lea rcx, [rbp - 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
mov rbx, rax
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
mov r8, rbx
mov dl, 1
mov rcx, rax
call fcn.1400f1e70
nop
lea rcx, [rsp + 0x50]
jmp 0x1400ea20c
lea rdx, str.deletefolder
lea rcx, [rsp + 0x60]
call fcn.14000cf00
test al, al
je 0x1400e883a
lea rdx, [0x1401497d8]
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rdx, [0x1401497d8]
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rdx, str.prefetch
lea rcx, [rbp - 0x78]
call fcn.14000cf00
test al, al
je 0x1400e8539
lea rdx, str.C:WindowsPrefetch_
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
jmp 0x1400e8801
lea rdx, str.windowstemp
lea rcx, [rbp - 0x78]
call fcn.14000cf00
test al, al
je 0x1400e8564
lea rdx, str.C:WindowsTemp_
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
jmp 0x1400e8801
lea rdx, str.recyclebin
lea rcx, [rbp - 0x78]
call fcn.14000cf00
test al, al
je 0x1400e8596
xor ecx, ecx
call fcn.1400e1450
lea rdx, str.NULL
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
jmp 0x1400e8801
lea rdx, str.msteam
lea rcx, [rbp - 0x78]
call fcn.14000cf00
test al, al
je 0x1400e8665
lea rdx, str.AppDataRoamingMicrosoftTeams
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rdx, [0x14014b478]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rbp - 0x58]
call fcn.1400fba40
nop
mov r8, rax
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x68]
call fcn.140006190
nop
lea r8, [rsp + 0x58]
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140006190
nop
mov rdx, rax
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rcx, rax
call fcn.1400e0ad0
jmp 0x1400e8801
lea rdx, str.usertemp
lea rcx, [rbp - 0x78]
call fcn.14000cf00
test al, al
je 0x1400e86c8
lea rdx, [rbp + 0x60]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__1]
nop
mov rdx, rax
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, [0x14014e590]
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
jmp 0x1400e8801
lea rdx, str.PTCTempFolder
lea rcx, [rbp - 0x78]
call fcn.14000cf00
test al, al
je 0x1400e8780
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1400f97e0
nop
lea r8, str.Roaming
lea rdx, str.Local
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCToolBar::RebuildAccelerationKeys]
lea rdx, str.PTCProENGINEERWildfire.wf
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x68]
call fcn.140006190
nop
mov rdx, rax
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
jmp 0x1400e87f6
lea rdx, str.outlookCache
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
test eax, eax
jne 0x1400e8801
lea rdx, [0x14018b1a8]
lea rcx, [rsp + 0x58]
call fcn.1400fb9d0
nop
lea rdx, str.MicrosoftOutlookRoamCache
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x48]
call fcn.140006190
nop
mov rdx, rax
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rbx, rax
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rcx, rax
mov rdx, rbx
call fcn.1400dfca0
nop
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x70]
jmp 0x1400ea20c
lea rdx, str.PrintDemo
lea rcx, [rsp + 0x60]
call fcn.14000cf00
test al, al
je 0x1400e88fc
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rdx, str.AnakageFilesSelfHealSolutionsiassist_
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rbp - 0x58]
call fcn.1400fa610
nop
lea r8, [rsp + 0x40]
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140006190
nop
lea r8, [rbp - 0x78]
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140006190
nop
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rcx, rax
call fcn.1400f0a20
nop
lea rcx, [rsp + 0x50]
jmp 0x1400ea20c
lea rdx, str.addsite
lea rcx, [rsp + 0x60]
call fcn.14000cf00
test al, al
je 0x1400e8930
lea rdx, [0x140149c08]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
mov rcx, rax
call fcn.1400f4510
jmp 0x1400ea212
lea rdx, str.sccm
lea rcx, [rsp + 0x60]
call fcn.14000cf00
test al, al
je 0x1400e897e
lea rcx, str.start_control_smscfgrc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov dword [rsp + 0x28], r12d
lea r9, str.control_smscfgrc
lea r8, str.control.exe
mov qword [rsp + 0x20], r14
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x1400ea212
lea rdx, str.openExplorer
lea rcx, [rsp + 0x60]
call fcn.14000cf00
test al, al
je 0x1400e8af8
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rdx, rax
lea rcx, [rbp - 0x38]
call fcn.1400f97e0
nop
lea rdx, str.win10
lea rcx, [rbp - 0x78]
call fcn.14000cf00
test al, al
je 0x1400e8a0a
lea rdx, str.MicrosoftWindowsINetCache
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea r8, [rsp + 0x40]
lea rdx, [rbp - 0x38]
lea rcx, [rsp + 0x68]
call fcn.140006190
nop
mov rdx, rax
lea rcx, [rbp - 0x38]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
jmp 0x1400e8a5f
lea rdx, str.win7
lea rcx, [rbp - 0x78]
call fcn.14000cf00
test al, al
je 0x1400e8a6a
lea rdx, str.MicrosoftWindowsTemporary_Internet_Files
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea r8, [rsp + 0x40]
lea rdx, [rbp - 0x38]
lea rcx, [rsp + 0x68]
call fcn.140006190
nop
mov rdx, rax
lea rcx, [rbp - 0x38]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x58]
mov qword [rsp + 0x58], rax
lea rdx, [rbp - 0x38]
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rdi, rax
lea rdx, str.Internet_explorer_path
lea rcx, [rbp - 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
mov rbx, rax
call sub.mfc140u.dll_AfxFieldText
nop
mov r9d, 0xffffffff
mov r8, rdi
mov rdx, rbx
mov rcx, qword [rax + 8]
call fcn.1400591a0
lea rcx, [rbp - 0x38]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r9, rax
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], r14
lea r8, [0x140167600]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rbp - 0x38]
jmp 0x1400ea20c
lea rdx, str.renamefolderDeleteFiles
lea rcx, [rsp + 0x60]
call fcn.14000cf00
test al, al
je 0x1400e8bc2
lea rax, [rsp + 0x48]
mov qword [rsp + 0x58], rax
lea rdx, [0x1401497d8]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
mov rbx, rax
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1400ee3d0
nop
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rcx, rax
call fcn.1401032f0
lea rdx, str.Tracing
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x58]
call fcn.140006190
nop
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rcx, rax
call fcn.1400e07f0
nop
lea rcx, [rbp - 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x50]
jmp 0x1400ea20c
lea rdx, str.forgotNetworks
lea rcx, [rsp + 0x60]
call fcn.14000cf00
test al, al
je 0x1400e8c20
lea rdx, str.netsh_wlan_delete_profile_name_i
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.1400f8750
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
jmp 0x1400ea20c
lea rdx, str.openChrome
lea rcx, [rsp + 0x60]
call fcn.14000cf00
test al, al
je 0x1400e8da2
lea rdx, [0x14017dab4]
lea rcx, [rbp - 0x78]
call fcn.140041a90
test al, al
je 0x1400e8cfb
lea rdx, [0x14015f6f8]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rsp + 0x68]
call fcn.1400fa610
nop
lea r8, [rsp + 0x40]
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140006190
nop
lea r8, [rbp - 0x78]
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.140006190
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rax, [rbp - 0x58]
mov qword [rbp - 0x70], rax
lea rdx, [0x1401497d8]
lea rcx, [rbp - 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
mov rbx, rax
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
mov r8, rbx
mov dl, 1
mov rcx, rax
call fcn.1400f1e70
nop
lea rcx, [rsp + 0x58]
jmp 0x1400ea20c
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.1400f97e0
nop
lea rdx, str._GoogleChromeUser_DataDefault
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x68]
call fcn.140006190
nop
mov rdx, rax
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r9, rax
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], r14
lea r8, [0x140167600]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rsp + 0x78]
jmp 0x1400ea20c
lea rdx, str.applicationiconsetting
lea rcx, [rsp + 0x60]
call fcn.14000cf00
lea rcx, [rbp - 0x78]
test al, al
je 0x1400e8e7d
lea rdx, [0x14017dab4]
call fcn.140041a90
test al, al
je 0x1400ea212
lea rdx, [0x14015f6f8]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rsp + 0x68]
call fcn.1400fa610
nop
lea r8, [rsp + 0x40]
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140006190
nop
lea r8, [rbp - 0x78]
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.140006190
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rax, [rbp - 0x58]
mov qword [rbp - 0x70], rax
lea rdx, [0x1401497d8]
lea rcx, [rbp - 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
mov rbx, rax
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
mov r8, rbx
mov dl, 1
mov rcx, rax
call fcn.1400f1e70
nop
lea rcx, [rsp + 0x58]
jmp 0x1400ea20c
lea rdx, str.HardwareAcceleration
call fcn.14000cf00
test al, al
je 0x1400e8f87
mov qword [rbp - 0x18], r14
mov dword [rbp - 0x10], r14d
mov qword [rbp - 8], r14
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rsp + 0x48]
call fcn.1400fd7d0
nop
mov rdx, rax
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, str.CommonGraphics
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_COleCurrency::operator]
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r8, rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r14d
xor r9d, r9d
mov rdx, 0xffffffff80000001
lea rcx, [rbp - 0x18]
call fcn.1400df5a0
mov rbx, qword [rbp - 0x18]
test eax, eax
je 0x1400e8f33
test rbx, rbx
je 0x1400e8f64
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, r14
jmp 0x1400e8f64
mov dword [rsp + 0x70], r14d
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.DisableHardwareAcceleration
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
test rbx, rbx
je 0x1400ea212
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400ea212
lea rdx, str.openLLFile
lea rcx, [rsp + 0x60]
call fcn.14000cf00
test al, al
jne 0x1400ea212
lea rdx, str.EdgeError
lea rcx, [rsp + 0x60]
call fcn.14000cf00
test al, al
je 0x1400e903f
lea rdx, str.MicrosoftEdgeUser_DataDefaultCache
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rdx, [0x14018b1a8]
lea rcx, [rsp + 0x48]
call fcn.1400fb9d0
nop
lea r8, [rsp + 0x40]
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.140006190
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r8, rax
mov edx, 0x3e8
lea rcx, [rbp + 0x4f0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea rcx, [rbp + 0x4f0]
call fcn.1400e0ad0
nop
lea rcx, [rsp + 0x58]
jmp 0x1400ea20c
lea rdx, str.openDigicertLogFile
lea rcx, [rsp + 0x60]
call fcn.14000cf00
test al, al
je 0x1400e9112
lea rdx, str.DesktopDigitalCert_Logs.txt
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rdx, [0x14014b478]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rsp + 0x68]
call fcn.1400fba40
nop
mov r8, rax
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x48]
call fcn.140006190
nop
lea r8, [rsp + 0x58]
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.140006190
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r9, rax
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], r14
lea r8, [0x140167600]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x1400ea208
lea rdx, str.clearjavacache
lea rcx, [rsp + 0x60]
call fcn.14000cf00
test al, al
je 0x1400e91ed
lea rdx, str.SunJavaDeploymentcache
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rdx, [0x1401497d8]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.1400f97e0
nop
lea r8, [rsp + 0x40]
mov rdx, rax
lea rcx, [rbp - 0x60]
call fcn.140006190
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
xor r8d, r8d
lea rdx, str.Local
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x1400e91b7
lea r8, str.LocalLow
lea rdx, str.Local
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CMFCToolBar::RebuildAccelerationKeys]
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rcx, rax
call fcn.1400f7cf0
test al, al
je 0x1400e91e4
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rcx, rax
call fcn.1400e0ad0
nop
lea rcx, [rbp - 0x60]
jmp 0x1400ea20c
lea rdx, str.runcompliancevbscript
lea rcx, [rsp + 0x60]
call fcn.14000cf00
test al, al
je 0x1400e92b0
lea rdx, str.Accenture_Workstation_Security_ComplianceScripts_
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rsp + 0x68]
call fcn.1400fa610
nop
lea r8, [rsp + 0x40]
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140006190
nop
lea r8, [rbp - 0x78]
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.140006190
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rax, [rbp - 0x58]
mov qword [rbp - 0x70], rax
lea rdx, [0x1401497d8]
lea rcx, [rbp - 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
mov rbx, rax
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
mov r8, rbx
mov dl, 1
mov rcx, rax
call fcn.1400f1e70
nop
lea rcx, [rsp + 0x58]
jmp 0x1400ea20c
lea rdx, str.regnavigate
lea rcx, [rsp + 0x60]
call fcn.14000cf00
test al, al
je 0x1400e92cf
call fcn.1400df710
jmp 0x1400ea212
lea rdx, str.localappdataexplore
lea rcx, [rsp + 0x60]
call fcn.14000cf00
test al, al
je 0x1400e9371
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.1400f97e0
nop
lea rdx, str.PKI_Client
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x68]
call fcn.140006190
nop
mov rdx, rax
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rcx, rax
call fcn.1400e0ad0
nop
lea rcx, [rsp + 0x78]
jmp 0x1400ea20c
lea rdx, str.GetIPAndhostname
lea rcx, [rsp + 0x60]
call fcn.14000cf00
test al, al
je 0x1400e95db
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea r8, [rsp + 0x78]
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x30]
call fcn.1400edf70
call fcn.1400eb9e0
mov rdx, rax
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
mov dword [rsp + 0x70], 0x208
lea r8, [rsp + 0x70]
lea rdx, [rbp + 0x60]
mov ecx, 3
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__1]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CFileDialog::SetTemplate]
mov rdx, rax
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rdx, str.ipandhostname
lea rcx, [rbp - 0x78]
call fcn.14000cf00
test al, al
je 0x1400e9508
lea rdx, str._Click_on__NEXT_STEP__to_know_Domain
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rdx, [0x14014a868]
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rdx, str.Your_Ip_Addressand_Host_Name_is
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea r8, [rbp - 0x68]
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x60]
call fcn.140006190
nop
lea r8, [rsp + 0x58]
mov rdx, rax
lea rcx, [rbp - 0x58]
call fcn.140006190
nop
lea r8, [rsp + 0x78]
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140006190
nop
lea r8, [rbp - 0x80]
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140006190
mov rdx, rax
mov rcx, r13
call fcn.14006d4a0
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x80]
jmp 0x1400e9592
lea rdx, str.DomainName
lea rcx, [rbp - 0x78]
call fcn.14000cf00
test al, al
je 0x1400e9599
lea rdx, str._Click_on__NEXT_STEP_
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rdx, str.Your_Domain_Name_is
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x68]
call fcn.140006190
nop
lea r8, [rsp + 0x58]
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140006190
mov rdx, rax
mov rcx, r13
call fcn.14006d4a0
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x30]
jmp 0x1400ea20c
lea rdx, str.Outlook_Print
lea rcx, [rsp + 0x60]
call fcn.14000cf00
test al, al
je 0x1400e96f4
lea rdx, str.MicrosoftOutlookoutlprnt
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rdx, [0x14018aed8]
lea rcx, [rsp + 0x48]
call fcn.1400fb9d0
nop
lea r8, [rsp + 0x40]
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.140006190
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rcx, rax
call fcn.1400f7cf0
movzx ebx, al
lea rdx, str..old
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x80]
call fcn.140006190
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test bl, bl
je 0x1400e96b8
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rbx, rax
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wrename]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r14
lea r9, [0x14014a9e0]
lea r8, str.outlook.exe
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x78]
jmp 0x1400ea20c
lea rdx, str.Ciscojabber
lea rcx, [rsp + 0x60]
call fcn.14000cf00
test al, al
jne 0x1400ea212
lea rdx, [0x14017dd18]
lea rcx, [rsp + 0x60]
call fcn.14000cf00
test al, al
je 0x1400e9839
call sub.mfc140u.dll_AfxFieldText
mov rdx, qword [rax + 8]
add rdx, 0x2c8
lea rcx, [rbp - 0x38]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rbp - 0x38]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r8, rax
lea rdx, str.openselectedfolder
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCToolBar::RebuildAccelerationKeys]
mov edx, 0x5c
lea rcx, [rbp - 0x38]
call qword [sym.imp.mfc140u.dll_COleControl::ReleaseCaches]
mov r8d, eax
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x38]
call qword [sym.imp.mfc140u.dll_CStringList::InsertBefore]
nop
mov rdx, rax
lea rcx, [rbp - 0x38]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rbp - 0x38]
call qword [sym.imp.mfc140u.dll_CFileDialog::SetTemplate]
lea rdx, [0x14014a740]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea r8, [rbp - 0x38]
lea rdx, [0x1401648e8]
lea rcx, [rsp + 0x68]
call fcn.140099f10
nop
lea r8, [rsp + 0x40]
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140006190
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r8, rax
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r14
lea r9, [0x14014a9e0]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x38]
jmp 0x1400ea20c
lea rdx, str.javacontrolpanel
lea rcx, [rsp + 0x60]
call fcn.14000cf00
test al, al
je 0x1400e98f3
lea rdx, [0x1401497d8]
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rsp + 0x78]
call fcn.1400ebad0
cmp eax, 1
jne 0x1400e98b9
lea rdx, [0x1401497d8]
lea rcx, [rsp + 0x78]
call fcn.140041a90
test al, al
je 0x1400e98e9
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r8, rax
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r14
lea r9, [0x14014a9e0]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x1400e98e9
test eax, eax
jne 0x1400e98c6
lea rdx, str._Java_Runtime__was_not_found_on_your_machine._Please_close_the_solution_and_contact_HelpDesk.
jmp 0x1400e98d2
cmp eax, 1
jle 0x1400e98e9
lea rdx, str.More_than_one__Java_Runtime__was_found_on_your_machine._Please_run__Java__from_control_panel._Wait_for_it_to_load_and_then_click__NEXT_STEP_
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
mov rdx, rax
mov rcx, r13
call fcn.14006d4a0
nop
lea rcx, [rsp + 0x78]
jmp 0x1400ea20c
lea rdx, str.customizedMessage
lea rcx, [rsp + 0x60]
call fcn.14000cf00
test al, al
je 0x1400e9998
call sub.mfc140u.dll_AfxFieldText
mov rdx, qword [rax + 8]
add rdx, 0x2c8
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
call sub.mfc140u.dll_AfxFieldText
mov rdx, qword [rax + 8]
add rdx, 0x2d0
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CFileDialog::SetTemplate]
mov rcx, rax
lea rdx, str.noteMsg
call fcn.14000cf00
lea rcx, [rsp + 0x48]
test al, al
lea rdx, [rsp + 0x40]
jne 0x1400e9970
lea rdx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rdx, rax
mov rcx, r13
call fcn.14006d4a0
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
jmp 0x1400ea20c
lea rdx, str.PrinterInformation
lea rcx, [rsp + 0x60]
call fcn.14000cf00
test al, al
je 0x1400e9f51
call sub.mfc140u.dll_AfxFieldText
mov rcx, qword [rax + 8]
mov rdi, qword [rcx + 0x2e8]
lea rdx, str.Address
lea rcx, [rbp - 0x78]
call fcn.14000cf00
test al, al
je 0x1400e9b72
lea rdx, [rsp + 0x78]
mov rcx, rdi
call fcn.1400c1cb0
nop
lea rcx, [rbp - 0x48]
call fcn.1400fd5c0
nop
lea rdx, [rdi + 0x90]
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rdx, [rdi + 0x90]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rdx, str.WIZARD
lea rcx, [rsp + 0x40]
call fcn.14000cf00
movzx ebx, al
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test bl, bl
je 0x1400e9a94
lea rdx, [rdi + 0x88]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea r8, [rsp + 0x40]
lea rdx, [0x14015a1b0]
lea rcx, [rsp + 0x48]
call fcn.140099f10
nop
mov rdx, rax
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_1667]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rsp + 0x78]
jmp 0x1400e9b28
lea rdx, str.location.txt
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_COleCurrency::operator]
lea rdx, [rbp - 0x48]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rcx, rax
call fcn.1400f7cf0
test al, al
je 0x1400e9ad7
lea rdx, [rbp - 0x48]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rcx, rax
call fcn.1400f7af0
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rcx, rax
lea rdx, [0x14014a86c]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
mov rbx, rax
test rax, rax
je 0x1400e9b10
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputws]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov r8, rax
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x78]
jmp 0x1400ea20c
lea rdx, str.displayName
lea rcx, [rbp - 0x78]
call fcn.14000cf00
test al, al
je 0x1400e9cab
lea rdx, [rdi + 0x38]
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
xor r8d, r8d
lea rdx, [0x140158124]
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
mov r8d, eax
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CStringList::InsertBefore]
nop
lea rdx, str.__printer_in_the_list_given_then_click_on__Next_._Click_on_NEXT_STEP.
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rdx, str._printer_manufacturers_and_then_select_this
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rdx, str.Please_Select_the_
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea r8, [rbp - 0x70]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.140006190
nop
lea r8, [rsp + 0x58]
mov rdx, rax
lea rcx, [rbp - 0x58]
call fcn.140006190
nop
lea r8, [rsp + 0x78]
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140006190
nop
lea r8, [rbp - 0x80]
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140006190
mov rdx, rax
mov rcx, r13
call fcn.14006d4a0
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x78]
jmp 0x1400ea20c
lea rdx, str.color
lea rcx, [rbp - 0x78]
call fcn.14000cf00
test al, al
je 0x1400e9d53
lea rdx, [rdi + 0x30]
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rdx, str._Click_on__NEXT_STEP_
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rdx, str.Please_Change_the_color_configration_to
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea r8, [rbp - 0x80]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x68]
call fcn.140006190
nop
lea r8, [rsp + 0x58]
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140006190
mov rdx, rax
mov rcx, r13
call fcn.14006d4a0
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
jmp 0x1400ea208
lea rdx, str.port
lea rcx, [rbp - 0x78]
call fcn.14000cf00
test al, al
je 0x1400e9dfb
lea rdx, [rdi + 0x28]
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rdx, str._Click_on__NEXT_STEP_
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rdx, str.Please_set_the_port_number
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea r8, [rbp - 0x80]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x68]
call fcn.140006190
nop
lea r8, [rsp + 0x58]
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140006190
mov rdx, rax
mov rcx, r13
call fcn.14006d4a0
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
jmp 0x1400ea208
lea rdx, str.ipAddress
lea rcx, [rbp - 0x78]
call fcn.14000cf00
test al, al
je 0x1400e9ea6
lea rdx, [rdi + 0xa0]
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rdx, str._and_Click_on__NEXT_STEP_
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rdx, str.Please_set_this_ip_address
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea r8, [rbp - 0x80]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x68]
call fcn.140006190
nop
lea r8, [rsp + 0x58]
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140006190
mov rdx, rax
mov rcx, r13
call fcn.14006d4a0
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
jmp 0x1400ea208
lea rdx, str.driverName
lea rcx, [rbp - 0x78]
call fcn.14000cf00
test al, al
je 0x1400ea212
lea rdx, [rdi + 0x88]
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rdx, str._and_open_it_then_click_on__OK._._Click_on__NEXT_STEP_
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rdx, str.Please_find_the_this_driver
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea r8, [rbp - 0x80]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x68]
call fcn.140006190
nop
lea r8, [rsp + 0x58]
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140006190
mov rdx, rax
mov rcx, r13
call fcn.14006d4a0
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
jmp 0x1400ea208
mov edi, r14d
call sub.mfc140u.dll_AfxFieldText
mov rdx, qword [rax + 8]
add rdx, 0x3a0
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
xor r8d, r8d
lea rdx, str.msiexe
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
jns 0x1400e9fcf
xor r8d, r8d
lea rdx, str.control.exe
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
jns 0x1400e9fcf
xor r8d, r8d
lea rdx, str.olidays.exe
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
jns 0x1400e9fcf
xor r8d, r8d
lea rdx, str.ScnCfg32.exe
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
lea rdx, [0x14017e0c0]
lea rcx, [rsp + 0x60]
call fcn.14000cf00
test al, al
je 0x1400ea072
lea rdx, [0x14014a868]
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rdx, [r13 + 0x250]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea r8, [rsp + 0x58]
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x68]
call fcn.140006190
nop
lea r8, [rsp + 0x40]
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140006190
nop
mov rdx, rax
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
xor r8d, r8d
lea rdx, [0x14017e0d0]
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x1400ea133
call sub.mfc140u.dll_AfxFieldText
mov rdx, qword [rax + 8]
add rdx, 0x2c8
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r8, rax
lea rdx, str.m_globalvar1
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CMFCToolBar::RebuildAccelerationKeys]
xor r8d, r8d
lea rdx, [0x140168da0]
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x1400ea120
lea rdx, [0x140150704]
lea rcx, str.C:Windowsiassistprinter.txt
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
mov rbx, rax
test rax, rax
je 0x1400ea116
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputws]
mov edi, r12d
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test edi, edi
jne 0x1400ea208
lea rdx, str.in_flag_0_Appname
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x48]
call fcn.140006190
mov rcx, rax
call fcn.1401069c0
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rax, [rsp + 0x48]
mov qword [rbp - 0x58], rax
lea rdx, str.Args:
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rdx, [0x14017e169]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
mov rbx, rax
lea r8, [rbp - 0x78]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x68]
call fcn.140006190
nop
mov r8d, 0xffffffff
mov rdx, rbx
mov rcx, rax
call fcn.140105fe0
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rbx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r8, rax
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r14
mov r9, rbx
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, str.success
mov rcx, qword [rbp + 8]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rbp]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x20]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov rax, qword [rbp + 8]
mov rcx, qword [rbp + 0xcc0]
xor rcx, rsp
call fcn.14010f260
mov rbx, qword [rsp + 0xe20]
add rsp, 0xdd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret