Function at 0x140026482
Capabilities:
Get geographical location
Reference sql statements

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push r15
xor rax, rax
push rax
push rax
sub rsp, 0x28
call fcn.1400e85c0
mov r15, qword [0x1401b64b8]
and r15, r15
jle 0x14002655b
mov qword [0x1401b64b8], 0
push 0
pop rcx
call fcn.140021088
mov qword [0x140b36b78], 0
push qword [0x140b36b98]
pop rcx
call fcn.1400df154
mov rax, rax
push rax
push 9
pop rcx
pop rdx
call fcn.1400c42a8
push 0
push 0x51
pop rcx
pop rdx
call fcn.1400c6d14
push 0
push 8
pop rcx
pop rdx
call fcn.1400c6d14
push 0
push 0xa
pop rcx
pop rdx
call fcn.1400c6d14
push 0
push 0xb
pop rcx
pop rdx
call fcn.1400c6d14
push 0
push 0x36
pop rcx
pop rdx
call fcn.1400c6d14
push 0
push 3
pop rcx
pop rdx
call fcn.1400c42a8
mov qword [0x140b36e20], 0
jmp 0x140026ff5
mov r15, qword [0x140b36e20]
and r15, r15
jle 0x14002656c
jmp 0x140026ff5
push 1
push 0x51
pop rcx
pop rdx
call fcn.1400c6d14
push 1
push 8
pop rcx
pop rdx
call fcn.1400c6d14
push 1
push 0xa
pop rcx
pop rdx
call fcn.1400c6d14
push 1
push 0xb
pop rcx
pop rdx
call fcn.1400c6d14
mov qword [0x140b36e20], 1
mov qword [0x1401b64b8], 1
movabs rax, 0x1401a30ac
push rax
push 9
pop rcx
pop rdx
call fcn.1400c6e80
push 1
push 9
pop rcx
pop rdx
call fcn.1400c6d14
push 1
pop rcx
call fcn.140021088
movabs rax, 0x14019f0ba
push rax
push 7
pop rcx
pop rdx
call fcn.1400c6e80
mov rcx, qword [0x140b36db0]
push rcx
sub rsp, 0x28
call fcn.1400e81a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.1400e81f0
add rsp, 0x28
movabs rcx, str._files
sub rsp, 0x28
call fcn.1400e81f0
add rsp, 0x28
lea rcx, [rsp + 0x30]
pop rdx
call fcn.1400e8260
push qword [rsp + 0x28]
pop rcx
call fcn.1400d1bd4
push 1
sub rsp, 8
push 0
pop rcx
sub rsp, 0x20
call fcn.1400cf580
add rsp, 0x28
mov rax, rax
push rax
pop rcx
pop rdx
call fcn.140047bce
push 0
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14002b9db
push rcx
sub rsp, 0x28
call fcn.1400e81a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
mov rcx, qword [rsp + 0x38]
push rcx
sub rsp, 0x28
call fcn.1400e81a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.1400e81f0
add rsp, 0x28
movabs rcx, str.OffScrub_O15msi.vbs
sub rsp, 0x28
call fcn.1400e81f0
add rsp, 0x28
call fcn.1400e84f0
push 0x6f
push rax
call fcn.1400e84c0
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.1400d2860
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14007ddec
add rsp, 0x28
pop rax
movabs rbp, 0x140a2f483
mov r15, rbp
movabs rbp, 0x1409cf4a7
sub r15, rbp
mov rax, r15
push rax
movabs rbp, 0x1409cf4a7
mov rax, rbp
push rax
push 0x6f
pop rcx
pop rdx
pop r8
call fcn.1400d2bc0
push 0x6f
pop rcx
call fcn.1400d24f0
push 0
movabs rax, 0x14019f0ba
push rax
pop rcx
pop rdx
call fcn.1400731d7
push 0
movabs rax, str.__________________________Run_OffScrub_O15msi.vbs_
push rax
pop rcx
pop rdx
call fcn.1400731d7
push 0
movabs rax, 0x14019f0ba
push rax
pop rcx
pop rdx
call fcn.1400731d7
push 0
push 0
mov rax, 1
mov rax, rax
push rax
push qword [rsp + 0x40]
movabs rax, str.OffScrub_O15msi.vbs_ALL__NoCancel__Force__OSE_2_1
push rax
movabs rax, str.cscript.exe___NoLogo
push rax
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.140020701
add rsp, 0x30
push rcx
sub rsp, 0x28
call fcn.1400e81a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
mov rcx, qword [rsp + 0x38]
push rcx
sub rsp, 0x28
call fcn.1400e81a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.1400e81f0
add rsp, 0x28
movabs rcx, str.OffScrub_O16msi.vbs
sub rsp, 0x28
call fcn.1400e81f0
add rsp, 0x28
call fcn.1400e84f0
push 0x6f
push rax
call fcn.1400e84c0
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.1400d2860
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14007ddec
add rsp, 0x28
pop rax
movabs rbp, 0x140a8f41f
mov r15, rbp
movabs rbp, 0x140a2f483
sub r15, rbp
mov rax, r15
push rax
movabs rbp, 0x140a2f483
mov rax, rbp
push rax
push 0x6f
pop rcx
pop rdx
pop r8
call fcn.1400d2bc0
push 0x6f
pop rcx
call fcn.1400d24f0
push 0
movabs rax, 0x14019f0ba
push rax
pop rcx
pop rdx
call fcn.1400731d7
push 0
movabs rax, str.__________________________Run_OffScrub_O16msi.vbs_
push rax
pop rcx
pop rdx
call fcn.1400731d7
push 0
movabs rax, 0x14019f0ba
push rax
pop rcx
pop rdx
call fcn.1400731d7
push 0
push 0
mov rax, 1
mov rax, rax
push rax
push qword [rsp + 0x40]
movabs rax, str.OffScrub_O16msi.vbs_ALL__NoCancel__Force__OSE_2_1
push rax
movabs rax, str.cscript.exe___NoLogo
push rax
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.140020701
add rsp, 0x30
push rcx
sub rsp, 0x28
call fcn.1400e81a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
mov rcx, qword [rsp + 0x38]
push rcx
sub rsp, 0x28
call fcn.1400e81a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.1400e81f0
add rsp, 0x28
movabs rcx, str.OffScrubC2R.vbs
sub rsp, 0x28
call fcn.1400e81f0
add rsp, 0x28
call fcn.1400e84f0
push 0x6f
push rax
call fcn.1400e84c0
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.1400d2860
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14007ddec
add rsp, 0x28
pop rax
movabs rbp, 0x1409c8fd1
mov r15, rbp
movabs rbp, str.reg_add__HKLMSOFTWAREMicrosoftWindows_Script_HostSettings___v_Enabled__t_REG_DWORD__d_1__f_r_ncscript.exe___dp0Office_Uninstall.vbs___Force_r_n_r_n_r_n_Name:_OffScrubC2R.vbs_r_n_Author:_Microsoft_Customer_Support_Services_r_n_Copyright__c__2014___2016_Microsoft_Corporation_r_n_Script_to_remove_Office_Click_To_Run__C2R__products_r_n_when_a_regular_uninstall_is_no_longer_possible_r_n_r_n_Scope:_Office_2013__2016_and_O365_C2R_products_r_n_r_n_r_nOption_Explicit_r_n_r_n________________________________________________________________________________r_n_r_n___Declaration_of_constants_r_n________________________________________________________________________________r_n_r_n_r_nConst_SCRIPTVERSION_____2.19__r_nConst_SCRIPTFILE________OffScrubC2R.vbs__r_nConst_SCRIPTNAME________OffScrubC2R__r_nConst_RETVALFILE________ScrubRetValFile.txt__r_nConst_ONAME_____________Office_C2R___O365__r_nConst_HKCR_____________H80000000_r_nConst_HKCU_____________H80000001_r_nConst_HKLM_____________H80000002_r_nConst_HKU______________H80000003_r_nConst_PRODLEN__________13_r_nConst_SQUISHED_________20_r_nConst_COMPRESSED_______32_r_nConst_REG_ARP___________SOFTWAREMicrosoftWindowsCurrentVersionUninstall__r_nConst_VB_YES___________6_r_nConst_VB_NO____________7_r_n_r_nConst_ERROR_SUCCESS__________________0___Bit_1.__0_indicates_Success._Script_completed_successfully_r_nConst_ERROR_FAIL_____________________1___Bit_1.__Failure_bit._Indicates_an_overall_script_failure._r_n__________________________________________RESERVED_bit__Returned_when_process_is_killed_from_task_manager_r_nConst_ERROR_REBOOT_REQUIRED__________2___Bit_2.__Reboot_bit._If_set_a_reboot_is_required_r_nConst_ERROR_USERCANCEL_______________4___Bit_3.__User_Cancel_bit._Controlled_cancel_from_script_UI_r_nConst_ERROR_STAGE1___________________8___Bit_4.__Informational._Msiexec_based_install_was_not_possible_r_nConst_ERROR_STAGE2___________________16__Bit_5.__Critical._Not_all_of_the_intended_cleanup_operations_could_be_applied_r_nConst_ERROR_INCOMPLETE_______________32__Bit_6.__Pending_file_renames__del_on_reboot____OR___Removal_needs_to_run_again_after_a_system_reboot._r_nConst_ERROR_DCAF_FAILURE_____________64__Bit_7.__Critical._Da_capo_al_fine__second_attempt__still_failed._r_nConst_ERROR_ELEVATION_USERDECLINED___128_Bit_8.__Critical_script_error._User_declined_to_allow_mandatory_script_elevation_r_nConst_ERROR_ELEVATION________________256_Bit_9.__Critical_script_error._The_attempt_to_elevate_the_process_did_not_succeed_r_nConst_ERROR_SCRIPTINIT_______________512_Bit_10._Critical_script_error._Initialization_failed_r_nConst_ERROR_RELAUNCH_________________1024Bit_11._Critical_script_error._This_is_a_temporary_value_and_must_not_be_the_final_return_code_r_nConst_ERROR_UNKNOWN__________________2048Bit_12_Critical_script_error._Script_did_not_complete_in_a_well_defined_state_r_nConst_ERROR_ALL______________________4095Full_BitMask_r_nConst_ERROR_USER_ABORT_______________HC000013A_RESERVED._Dec__1073741510._Critical_error._Returned_when_user_aborts_with__Ctrl__Break__or_closes_the_cmd_window_r_nConst_ERROR_SUCCESS_CONFIG_COMPLETE__1728_r_nConst_ERROR_SUCCESS_REBOOT_REQUIRED__3010_r_n_r_n________________________________________________________________________________r_n_r_n___Declaration_of_variables_r_n________________________________________________________________________________r_n_r_nDim_oFso__oMsi__oReg__oWShell__oWmiLocal__oShellApp_r_nDim_ComputerItem__Key__Item__LogStream__TmpKey_r_nDim_arrVersion_r_nDim_dicKeepLis__dicApps__dicKeepFolder__dicDelRegKey__dicKeepReg__dicSC_r_nDim_dicInstalledSku__dicRemoveSku__dicKeepSku__dicC2RSuite__dicDelInUse_r_nDim_dicDelFolder_r_nDim_sAppData__sScrubDir__sProgramFiles__sProgramFilesX86__sCommonProgramFiles_r_nDim_sAllusersProfile__sOSVersion__sWinDir__sWICacheDir__sCommonProgramFilesX86_r_nD
sub r15, rbp
mov rax, r15
push rax
movabs rbp, str.reg_add__HKLMSOFTWAREMicrosoftWindows_Script_HostSettings___v_Enabled__t_REG_DWORD__d_1__f_r_ncscript.exe___dp0Office_Uninstall.vbs___Force_r_n_r_n_r_n_Name:_OffScrubC2R.vbs_r_n_Author:_Microsoft_Customer_Support_Services_r_n_Copyright__c__2014___2016_Microsoft_Corporation_r_n_Script_to_remove_Office_Click_To_Run__C2R__products_r_n_when_a_regular_uninstall_is_no_longer_possible_r_n_r_n_Scope:_Office_2013__2016_and_O365_C2R_products_r_n_r_n_r_nOption_Explicit_r_n_r_n________________________________________________________________________________r_n_r_n___Declaration_of_constants_r_n________________________________________________________________________________r_n_r_n_r_nConst_SCRIPTVERSION_____2.19__r_nConst_SCRIPTFILE________OffScrubC2R.vbs__r_nConst_SCRIPTNAME________OffScrubC2R__r_nConst_RETVALFILE________ScrubRetValFile.txt__r_nConst_ONAME_____________Office_C2R___O365__r_nConst_HKCR_____________H80000000_r_nConst_HKCU_____________H80000001_r_nConst_HKLM_____________H80000002_r_nConst_HKU______________H80000003_r_nConst_PRODLEN__________13_r_nConst_SQUISHED_________20_r_nConst_COMPRESSED_______32_r_nConst_REG_ARP___________SOFTWAREMicrosoftWindowsCurrentVersionUninstall__r_nConst_VB_YES___________6_r_nConst_VB_NO____________7_r_n_r_nConst_ERROR_SUCCESS__________________0___Bit_1.__0_indicates_Success._Script_completed_successfully_r_nConst_ERROR_FAIL_____________________1___Bit_1.__Failure_bit._Indicates_an_overall_script_failure._r_n__________________________________________RESERVED_bit__Returned_when_process_is_killed_from_task_manager_r_nConst_ERROR_REBOOT_REQUIRED__________2___Bit_2.__Reboot_bit._If_set_a_reboot_is_required_r_nConst_ERROR_USERCANCEL_______________4___Bit_3.__User_Cancel_bit._Controlled_cancel_from_script_UI_r_nConst_ERROR_STAGE1___________________8___Bit_4.__Informational._Msiexec_based_install_was_not_possible_r_nConst_ERROR_STAGE2___________________16__Bit_5.__Critical._Not_all_of_the_intended_cleanup_operations_could_be_applied_r_nConst_ERROR_INCOMPLETE_______________32__Bit_6.__Pending_file_renames__del_on_reboot____OR___Removal_needs_to_run_again_after_a_system_reboot._r_nConst_ERROR_DCAF_FAILURE_____________64__Bit_7.__Critical._Da_capo_al_fine__second_attempt__still_failed._r_nConst_ERROR_ELEVATION_USERDECLINED___128_Bit_8.__Critical_script_error._User_declined_to_allow_mandatory_script_elevation_r_nConst_ERROR_ELEVATION________________256_Bit_9.__Critical_script_error._The_attempt_to_elevate_the_process_did_not_succeed_r_nConst_ERROR_SCRIPTINIT_______________512_Bit_10._Critical_script_error._Initialization_failed_r_nConst_ERROR_RELAUNCH_________________1024Bit_11._Critical_script_error._This_is_a_temporary_value_and_must_not_be_the_final_return_code_r_nConst_ERROR_UNKNOWN__________________2048Bit_12_Critical_script_error._Script_did_not_complete_in_a_well_defined_state_r_nConst_ERROR_ALL______________________4095Full_BitMask_r_nConst_ERROR_USER_ABORT_______________HC000013A_RESERVED._Dec__1073741510._Critical_error._Returned_when_user_aborts_with__Ctrl__Break__or_closes_the_cmd_window_r_nConst_ERROR_SUCCESS_CONFIG_COMPLETE__1728_r_nConst_ERROR_SUCCESS_REBOOT_REQUIRED__3010_r_n_r_n________________________________________________________________________________r_n_r_n___Declaration_of_variables_r_n________________________________________________________________________________r_n_r_nDim_oFso__oMsi__oReg__oWShell__oWmiLocal__oShellApp_r_nDim_ComputerItem__Key__Item__LogStream__TmpKey_r_nDim_arrVersion_r_nDim_dicKeepLis__dicApps__dicKeepFolder__dicDelRegKey__dicKeepReg__dicSC_r_nDim_dicInstalledSku__dicRemoveSku__dicKeepSku__dicC2RSuite__dicDelInUse_r_nDim_dicDelFolder_r_nDim_sAppData__sScrubDir__sProgramFiles__sProgramFilesX86__sCommonProgramFiles_r_nDim_sAllusersProfile__sOSVersion__sWinDir__sWICacheDir__sCommonProgramFilesX86_r_nD
mov rax, rbp
push rax
push 0x6f
pop rcx
pop rdx
pop r8
call fcn.1400d2bc0
push 0x6f
pop rcx
call fcn.1400d24f0
push 0
movabs rax, 0x14019f0ba
push rax
pop rcx
pop rdx
call fcn.1400731d7
push 0
movabs rax, str.__________________________Run_OffScrubC2R.vbs_
push rax
pop rcx
pop rdx
call fcn.1400731d7
push 0
movabs rax, 0x14019f0ba
push rax
pop rcx
pop rdx
call fcn.1400731d7
push 0
push 0
mov rax, 1
mov rax, rax
push rax
push qword [rsp + 0x40]
movabs rax, str.OffScrubC2R.vbs_ALL__NoCancel__OSE_2_1
push rax
movabs rax, str.cscript.exe___NoLogo
push rax
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.140020701
add rsp, 0x30
push rcx
sub rsp, 0x28
call fcn.1400e81a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
mov rcx, qword [rsp + 0x38]
push rcx
sub rsp, 0x28
call fcn.1400e81a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.1400e81f0
add rsp, 0x28
movabs rcx, str.OLicenseCleanup.vbs
sub rsp, 0x28
call fcn.1400e81f0
add rsp, 0x28
call fcn.1400e84f0
push 0x6f
push rax
call fcn.1400e84c0
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.1400d2860
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14007ddec
add rsp, 0x28
pop rax
movabs rbp, 0x1409cf4a7
mov r15, rbp
movabs rbp, 0x1409c8fd1
sub r15, rbp
mov rax, r15
push rax
movabs rbp, 0x1409c8fd1
mov rax, rbp
push rax
push 0x6f
pop rcx
pop rdx
pop r8
call fcn.1400d2bc0
push 0x6f
pop rcx
call fcn.1400d24f0
push 0
movabs rax, 0x14019f0ba
push rax
pop rcx
pop rdx
call fcn.1400731d7
push 0
movabs rax, str.________________________Run_OLicenseCleanup.vbs_
push rax
pop rcx
pop rdx
call fcn.1400731d7
push 0
movabs rax, 0x14019f0ba
push rax
pop rcx
pop rdx
call fcn.1400731d7
push 0
push 0
mov rax, 1
mov rax, rax
push rax
push qword [rsp + 0x40]
movabs rax, str.OLicenseCleanup.vbs_2_1
push rax
movabs rax, str.cscript.exe___NoLogo
push rax
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.140020701
add rsp, 0x30
push rcx
sub rsp, 0x28
call fcn.1400e81a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push 3
movabs rax, 0x14019f0ba
push rax
mov rcx, qword [0x140b36db0]
push rcx
sub rsp, 0x28
call fcn.1400e81a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.1400e81f0
add rsp, 0x28
movabs rcx, str._files
sub rsp, 0x28
call fcn.1400e81f0
add rsp, 0x28
push rax
call fcn.1400e84c0
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.1400d187c
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14007ddec
add rsp, 0x28
pop rax
push 0
sub rsp, 8
push 0
pop rcx
sub rsp, 0x20
call fcn.1400cf580
add rsp, 0x28
mov rax, rax
push rax
pop rcx
pop rdx
call fcn.140047bce
push 0x100
push 1
pop rcx
pop rdx
call fcn.14007cc64
movabs rax, 0x1401a00e6
push rax
movabs rax, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstallProplusRetail___en_us
push rax
pop rcx
pop rdx
call fcn.14007c369
movabs rax, 0x1401a00e6
push rax
movabs rax, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstallProplusRetail___ru_ru
push rax
pop rcx
pop rdx
call fcn.14007c369
movabs rax, 0x1401a00e6
push rax
movabs rax, str.HKEY_CLASSES_ROOTInstallerProducts00006109C80000000000000000F01FEC
push rax
pop rcx
pop rdx
call fcn.14007c369
movabs rax, 0x1401a00e6
push rax
movabs rax, str.HKEY_CLASSES_ROOTInstallerProducts00006109C80090400000000000F01FEC
push rax
pop rcx
pop rdx
call fcn.14007c369
movabs rax, 0x1401a00e6
push rax
movabs rax, str.HKEY_CLASSES_ROOTInstallerProducts00006109F80000000100000000F01FEC
push rax
pop rcx
pop rdx
call fcn.14007c369
movabs rax, 0x1401a00e6
push rax
movabs rax, str.HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftOffice16.0CommonOfficeUpdate
push rax
pop rcx
pop rdx
call fcn.14007c369
push rcx
sub rsp, 0x28
call fcn.1400e81a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push 0
push 0
xor rax, rax
mov rax, rax
push rax
mov rcx, qword [0x140b36868]
push rcx
sub rsp, 0x20
call fcn.1400e81a0
add rsp, 0x20
pop rcx
push rax
sub rsp, 0x20
call fcn.1400e81f0
add rsp, 0x20
movabs rcx, str.System32
sub rsp, 0x20
call fcn.1400e81f0
add rsp, 0x20
call fcn.1400e84f0
movabs rax, str.delete__HKLMSOFTWAREPoliciesMicrosoftOffice16.0CommonOfficeUpdate___f__v_UpdateBranch
push rax
movabs rax, str.reg.exe
push rax
push rax
call fcn.1400e84c0
mov rdx, rax
pop rax
add qword [rsp + 0x10], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.140020701
add rsp, 0x38
pop rcx
push rax
sub rsp, 0x28
call fcn.14007ddec
add rsp, 0x28
pop rax
push rcx
sub rsp, 0x28
call fcn.1400e81a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
mov rcx, qword [0x140b367f0]
push rcx
sub rsp, 0x28
call fcn.1400e81a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.1400e81f0
add rsp, 0x28
movabs rcx, str.ProgramDataMicrosoftOfficeSoftwareProtectionPlatform
sub rsp, 0x28
call fcn.1400e81f0
add rsp, 0x28
push rax
call fcn.1400e84c0
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
sub rsp, 0x20
call fcn.1400d1630
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14007ddec
add rsp, 0x28
pop rax
mov r15, rax
cmp r15, 0xfffffffffffffffe
jne 0x140026f12
push rcx
sub rsp, 0x28
call fcn.1400e81a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push 3
movabs rax, 0x14019f0ba
push rax
mov rcx, qword [0x140b367f0]
push rcx
sub rsp, 0x28
call fcn.1400e81a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.1400e81f0
add rsp, 0x28
movabs rcx, str.ProgramDataMicrosoftOfficeSoftwareProtectionPlatform
sub rsp, 0x28
call fcn.1400e81f0
add rsp, 0x28
push rax
call fcn.1400e84c0
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.1400d187c
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14007ddec
add rsp, 0x28
pop rax
push 0
movabs rax, str._Completed_
push rax
pop rcx
pop rdx
call fcn.1400731d7
push 0
movabs rax, 0x14019f0ba
push rax
pop rcx
pop rdx
call fcn.1400731d7
push 0
push 9
pop rcx
pop rdx
call fcn.1400c6d14
mov qword [0x140b36b78], 1
push rcx
sub rsp, 0x28
call fcn.1400e81a0
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.1400e81a0
add rsp, 0x20
pop rcx
push rax
sub rsp, 0x20
call fcn.14007c93a
add rsp, 0x28
lea rcx, [rsp + 0x38]
pop rdx
call fcn.1400e8260
push 1
push qword [0x140b36930]
push qword [rsp + 0x40]
pop rcx
pop rdx
pop r8
call fcn.1400e5470
mov r15, rax
and r15, r15
jle 0x140026fd0
push qword [rsp + 0x30]
push 0
pop rcx
pop rdx
call sub.USER32.dll_FindWindowW
mov rax, rax
push rax
pop rcx
call sub.USER32.dll_SetForegroundWindow
jmp 0x140026fed
push qword [rsp + 0x30]
movabs rcx, 0x14019f0ba
pop rdx
call fcn.1400e8340
or rax, rax
je 0x140026f5c
call fcn.140074458
xor rax, rax
push rax
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.1400e8630
add rsp, 0x28
mov rcx, qword [rsp + 0x38]
sub rsp, 0x28
call fcn.1400e8630
add rsp, 0x28
pop rax
add rsp, 0x38
pop r15
pop rbp
ret