Function at 0x140026235
Capabilities:
Get geographical location
Reference sql statements

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push r15
xor rax, rax
push rax
push rax
sub rsp, 0x28
call fcn.1400e85c0
mov r15, qword [0x1401b6040]
and r15, r15
jle 0x14002630e
mov qword [0x1401b6040], 0
push 0
pop rcx
call fcn.140020e3b
mov qword [0x140b366e8], 0
push qword [0x140b36708]
pop rcx
call fcn.1400df154
mov rax, rax
push rax
push 9
pop rcx
pop rdx
call fcn.1400c42a8
push 0
push 0x51
pop rcx
pop rdx
call fcn.1400c6d14
push 0
push 8
pop rcx
pop rdx
call fcn.1400c6d14
push 0
push 0xa
pop rcx
pop rdx
call fcn.1400c6d14
push 0
push 0xb
pop rcx
pop rdx
call fcn.1400c6d14
push 0
push 0x36
pop rcx
pop rdx
call fcn.1400c6d14
push 0
push 3
pop rcx
pop rdx
call fcn.1400c42a8
mov qword [0x140b36990], 0
jmp 0x140026da8
mov r15, qword [0x140b36990]
and r15, r15
jle 0x14002631f
jmp 0x140026da8
push 1
push 0x51
pop rcx
pop rdx
call fcn.1400c6d14
push 1
push 8
pop rcx
pop rdx
call fcn.1400c6d14
push 1
push 0xa
pop rcx
pop rdx
call fcn.1400c6d14
push 1
push 0xb
pop rcx
pop rdx
call fcn.1400c6d14
mov qword [0x140b36990], 1
mov qword [0x1401b6040], 1
movabs rax, 0x1401a304e
push rax
push 9
pop rcx
pop rdx
call fcn.1400c6e80
push 1
push 9
pop rcx
pop rdx
call fcn.1400c6d14
push 1
pop rcx
call fcn.140020e3b
movabs rax, 0x14019f0ba
push rax
push 7
pop rcx
pop rdx
call fcn.1400c6e80
mov rcx, qword [0x140b36920]
push rcx
sub rsp, 0x28
call fcn.1400e81a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.1400e81f0
add rsp, 0x28
movabs rcx, str._files
sub rsp, 0x28
call fcn.1400e81f0
add rsp, 0x28
lea rcx, [rsp + 0x30]
pop rdx
call fcn.1400e8260
push qword [rsp + 0x28]
pop rcx
call fcn.1400d1bd4
push 1
sub rsp, 8
push 0
pop rcx
sub rsp, 0x20
call fcn.1400cf580
add rsp, 0x28
mov rax, rax
push rax
pop rcx
pop rdx
call fcn.140047631
push 0
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14002b78e
push rcx
sub rsp, 0x28
call fcn.1400e81a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
mov rcx, qword [rsp + 0x38]
push rcx
sub rsp, 0x28
call fcn.1400e81a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.1400e81f0
add rsp, 0x28
movabs rcx, str.OffScrub_O15msi.vbs
sub rsp, 0x28
call fcn.1400e81f0
add rsp, 0x28
call fcn.1400e84f0
push 0x6f
push rax
call fcn.1400e84c0
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.1400d2860
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14007d1a8
add rsp, 0x28
pop rax
movabs rbp, 0x140a2f00b
mov r15, rbp
movabs rbp, 0x1409cf02f
sub r15, rbp
mov rax, r15
push rax
movabs rbp, 0x1409cf02f
mov rax, rbp
push rax
push 0x6f
pop rcx
pop rdx
pop r8
call fcn.1400d2bc0
push 0x6f
pop rcx
call fcn.1400d24f0
push 0
movabs rax, 0x14019f0ba
push rax
pop rcx
pop rdx
call fcn.140072593
push 0
movabs rax, str.__________________________Run_OffScrub_O15msi.vbs_
push rax
pop rcx
pop rdx
call fcn.140072593
push 0
movabs rax, 0x14019f0ba
push rax
pop rcx
pop rdx
call fcn.140072593
push 0
push 0
mov rax, 1
mov rax, rax
push rax
push qword [rsp + 0x40]
movabs rax, 0x1401a39b8
push rax
movabs rax, str.cscript.exe___NoLogo
push rax
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400204b4
add rsp, 0x30
push rcx
sub rsp, 0x28
call fcn.1400e81a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
mov rcx, qword [rsp + 0x38]
push rcx
sub rsp, 0x28
call fcn.1400e81a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.1400e81f0
add rsp, 0x28
movabs rcx, str.OffScrub_O16msi.vbs
sub rsp, 0x28
call fcn.1400e81f0
add rsp, 0x28
call fcn.1400e84f0
push 0x6f
push rax
call fcn.1400e84c0
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.1400d2860
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14007d1a8
add rsp, 0x28
pop rax
movabs rbp, 0x140a8efa7
mov r15, rbp
movabs rbp, 0x140a2f00b
sub r15, rbp
mov rax, r15
push rax
movabs rbp, 0x140a2f00b
mov rax, rbp
push rax
push 0x6f
pop rcx
pop rdx
pop r8
call fcn.1400d2bc0
push 0x6f
pop rcx
call fcn.1400d24f0
push 0
movabs rax, 0x14019f0ba
push rax
pop rcx
pop rdx
call fcn.140072593
push 0
movabs rax, str.__________________________Run_OffScrub_O16msi.vbs_
push rax
pop rcx
pop rdx
call fcn.140072593
push 0
movabs rax, 0x14019f0ba
push rax
pop rcx
pop rdx
call fcn.140072593
push 0
push 0
mov rax, 1
mov rax, rax
push rax
push qword [rsp + 0x40]
movabs rax, str.OffScrub_O16msi.vbs_ALL__NoCancel__Force__OSE_2_1
push rax
movabs rax, str.cscript.exe___NoLogo
push rax
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400204b4
add rsp, 0x30
push rcx
sub rsp, 0x28
call fcn.1400e81a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
mov rcx, qword [rsp + 0x38]
push rcx
sub rsp, 0x28
call fcn.1400e81a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.1400e81f0
add rsp, 0x28
movabs rcx, str.OffScrubC2R.vbs
sub rsp, 0x28
call fcn.1400e81f0
add rsp, 0x28
call fcn.1400e84f0
push 0x6f
push rax
call fcn.1400e84c0
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.1400d2860
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14007d1a8
add rsp, 0x28
pop rax
movabs rbp, 0x1409c8b59
mov r15, rbp
movabs rbp, str.reg_add__HKLMSOFTWAREMicrosoftWindows_Script_HostSettings___v_Enabled__t_REG_DWORD__d_1__f_r_ncscript.exe___dp0Office_Uninstall.vbs___Force_r_n_r_n_r_n_Name:_OffScrubC2R.vbs_r_n_Author:_Microsoft_Customer_Support_Services_r_n_Copyright__c__2014___2016_Microsoft_Corporation_r_n_Script_to_remove_Office_Click_To_Run__C2R__products_r_n_when_a_regular_uninstall_is_no_longer_possible_r_n_r_n_Scope:_Office_2013__2016_and_O365_C2R_products_r_n_r_n_r_nOption_Explicit_r_n_r_n________________________________________________________________________________r_n_r_n___Declaration_of_constants_r_n________________________________________________________________________________r_n_r_n_r_nConst_SCRIPTVERSION_____2.19__r_nConst_SCRIPTFILE________OffScrubC2R.vbs__r_nConst_SCRIPTNAME________OffScrubC2R__r_nConst_RETVALFILE________ScrubRetValFile.txt__r_nConst_ONAME_____________Office_C2R___O365__r_nConst_HKCR_____________H80000000_r_nConst_HKCU_____________H80000001_r_nConst_HKLM_____________H80000002_r_nConst_HKU______________H80000003_r_nConst_PRODLEN__________13_r_nConst_SQUISHED_________20_r_nConst_COMPRESSED_______32_r_nConst_REG_ARP___________SOFTWAREMicrosoftWindowsCurrentVersionUninstall__r_nConst_VB_YES___________6_r_nConst_VB_NO____________7_r_n_r_nConst_ERROR_SUCCESS__________________0___Bit_1.__0_indicates_Success._Script_completed_successfully_r_nConst_ERROR_FAIL_____________________1___Bit_1.__Failure_bit._Indicates_an_overall_script_failure._r_n__________________________________________RESERVED_bit__Returned_when_process_is_killed_from_task_manager_r_nConst_ERROR_REBOOT_REQUIRED__________2___Bit_2.__Reboot_bit._If_set_a_reboot_is_required_r_nConst_ERROR_USERCANCEL_______________4___Bit_3.__User_Cancel_bit._Controlled_cancel_from_script_UI_r_nConst_ERROR_STAGE1___________________8___Bit_4.__Informational._Msiexec_based_install_was_not_possible_r_nConst_ERROR_STAGE2___________________16__Bit_5.__Critical._Not_all_of_the_intended_cleanup_operations_could_be_applied_r_nConst_ERROR_INCOMPLETE_______________32__Bit_6.__Pending_file_renames__del_on_reboot____OR___Removal_needs_to_run_again_after_a_system_reboot._r_nConst_ERROR_DCAF_FAILURE_____________64__Bit_7.__Critical._Da_capo_al_fine__second_attempt__still_failed._r_nConst_ERROR_ELEVATION_USERDECLINED___128_Bit_8.__Critical_script_error._User_declined_to_allow_mandatory_script_elevation_r_nConst_ERROR_ELEVATION________________256_Bit_9.__Critical_script_error._The_attempt_to_elevate_the_process_did_not_succeed_r_nConst_ERROR_SCRIPTINIT_______________512_Bit_10._Critical_script_error._Initialization_failed_r_nConst_ERROR_RELAUNCH_________________1024Bit_11._Critical_script_error._This_is_a_temporary_value_and_must_not_be_the_final_return_code_r_nConst_ERROR_UNKNOWN__________________2048Bit_12_Critical_script_error._Script_did_not_complete_in_a_well_defined_state_r_nConst_ERROR_ALL______________________4095Full_BitMask_r_nConst_ERROR_USER_ABORT_______________HC000013A_RESERVED._Dec__1073741510._Critical_error._Returned_when_user_aborts_with__Ctrl__Break__or_closes_the_cmd_window_r_nConst_ERROR_SUCCESS_CONFIG_COMPLETE__1728_r_nConst_ERROR_SUCCESS_REBOOT_REQUIRED__3010_r_n_r_n________________________________________________________________________________r_n_r_n___Declaration_of_variables_r_n________________________________________________________________________________r_n_r_nDim_oFso__oMsi__oReg__oWShell__oWmiLocal__oShellApp_r_nDim_ComputerItem__Key__Item__LogStream__TmpKey_r_nDim_arrVersion_r_nDim_dicKeepLis__dicApps__dicKeepFolder__dicDelRegKey__dicKeepReg__dicSC_r_nDim_dicInstalledSku__dicRemoveSku__dicKeepSku__dicC2RSuite__dicDelInUse_r_nDim_dicDelFolder_r_nDim_sAppData__sScrubDir__sProgramFiles__sProgramFilesX86__sCommonProgramFiles_r_nDim_sAllusersProfile__sOSVersion__sWinDir__sWICacheDir__sCommonProgramFilesX86_r_nD
sub r15, rbp
mov rax, r15
push rax
movabs rbp, str.reg_add__HKLMSOFTWAREMicrosoftWindows_Script_HostSettings___v_Enabled__t_REG_DWORD__d_1__f_r_ncscript.exe___dp0Office_Uninstall.vbs___Force_r_n_r_n_r_n_Name:_OffScrubC2R.vbs_r_n_Author:_Microsoft_Customer_Support_Services_r_n_Copyright__c__2014___2016_Microsoft_Corporation_r_n_Script_to_remove_Office_Click_To_Run__C2R__products_r_n_when_a_regular_uninstall_is_no_longer_possible_r_n_r_n_Scope:_Office_2013__2016_and_O365_C2R_products_r_n_r_n_r_nOption_Explicit_r_n_r_n________________________________________________________________________________r_n_r_n___Declaration_of_constants_r_n________________________________________________________________________________r_n_r_n_r_nConst_SCRIPTVERSION_____2.19__r_nConst_SCRIPTFILE________OffScrubC2R.vbs__r_nConst_SCRIPTNAME________OffScrubC2R__r_nConst_RETVALFILE________ScrubRetValFile.txt__r_nConst_ONAME_____________Office_C2R___O365__r_nConst_HKCR_____________H80000000_r_nConst_HKCU_____________H80000001_r_nConst_HKLM_____________H80000002_r_nConst_HKU______________H80000003_r_nConst_PRODLEN__________13_r_nConst_SQUISHED_________20_r_nConst_COMPRESSED_______32_r_nConst_REG_ARP___________SOFTWAREMicrosoftWindowsCurrentVersionUninstall__r_nConst_VB_YES___________6_r_nConst_VB_NO____________7_r_n_r_nConst_ERROR_SUCCESS__________________0___Bit_1.__0_indicates_Success._Script_completed_successfully_r_nConst_ERROR_FAIL_____________________1___Bit_1.__Failure_bit._Indicates_an_overall_script_failure._r_n__________________________________________RESERVED_bit__Returned_when_process_is_killed_from_task_manager_r_nConst_ERROR_REBOOT_REQUIRED__________2___Bit_2.__Reboot_bit._If_set_a_reboot_is_required_r_nConst_ERROR_USERCANCEL_______________4___Bit_3.__User_Cancel_bit._Controlled_cancel_from_script_UI_r_nConst_ERROR_STAGE1___________________8___Bit_4.__Informational._Msiexec_based_install_was_not_possible_r_nConst_ERROR_STAGE2___________________16__Bit_5.__Critical._Not_all_of_the_intended_cleanup_operations_could_be_applied_r_nConst_ERROR_INCOMPLETE_______________32__Bit_6.__Pending_file_renames__del_on_reboot____OR___Removal_needs_to_run_again_after_a_system_reboot._r_nConst_ERROR_DCAF_FAILURE_____________64__Bit_7.__Critical._Da_capo_al_fine__second_attempt__still_failed._r_nConst_ERROR_ELEVATION_USERDECLINED___128_Bit_8.__Critical_script_error._User_declined_to_allow_mandatory_script_elevation_r_nConst_ERROR_ELEVATION________________256_Bit_9.__Critical_script_error._The_attempt_to_elevate_the_process_did_not_succeed_r_nConst_ERROR_SCRIPTINIT_______________512_Bit_10._Critical_script_error._Initialization_failed_r_nConst_ERROR_RELAUNCH_________________1024Bit_11._Critical_script_error._This_is_a_temporary_value_and_must_not_be_the_final_return_code_r_nConst_ERROR_UNKNOWN__________________2048Bit_12_Critical_script_error._Script_did_not_complete_in_a_well_defined_state_r_nConst_ERROR_ALL______________________4095Full_BitMask_r_nConst_ERROR_USER_ABORT_______________HC000013A_RESERVED._Dec__1073741510._Critical_error._Returned_when_user_aborts_with__Ctrl__Break__or_closes_the_cmd_window_r_nConst_ERROR_SUCCESS_CONFIG_COMPLETE__1728_r_nConst_ERROR_SUCCESS_REBOOT_REQUIRED__3010_r_n_r_n________________________________________________________________________________r_n_r_n___Declaration_of_variables_r_n________________________________________________________________________________r_n_r_nDim_oFso__oMsi__oReg__oWShell__oWmiLocal__oShellApp_r_nDim_ComputerItem__Key__Item__LogStream__TmpKey_r_nDim_arrVersion_r_nDim_dicKeepLis__dicApps__dicKeepFolder__dicDelRegKey__dicKeepReg__dicSC_r_nDim_dicInstalledSku__dicRemoveSku__dicKeepSku__dicC2RSuite__dicDelInUse_r_nDim_dicDelFolder_r_nDim_sAppData__sScrubDir__sProgramFiles__sProgramFilesX86__sCommonProgramFiles_r_nDim_sAllusersProfile__sOSVersion__sWinDir__sWICacheDir__sCommonProgramFilesX86_r_nD
mov rax, rbp
push rax
push 0x6f
pop rcx
pop rdx
pop r8
call fcn.1400d2bc0
push 0x6f
pop rcx
call fcn.1400d24f0
push 0
movabs rax, 0x14019f0ba
push rax
pop rcx
pop rdx
call fcn.140072593
push 0
movabs rax, str.__________________________Run_OffScrubC2R.vbs_
push rax
pop rcx
pop rdx
call fcn.140072593
push 0
movabs rax, 0x14019f0ba
push rax
pop rcx
pop rdx
call fcn.140072593
push 0
push 0
mov rax, 1
mov rax, rax
push rax
push qword [rsp + 0x40]
movabs rax, str.OffScrubC2R.vbs_ALL__NoCancel__OSE_2_1
push rax
movabs rax, str.cscript.exe___NoLogo
push rax
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400204b4
add rsp, 0x30
push rcx
sub rsp, 0x28
call fcn.1400e81a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
mov rcx, qword [rsp + 0x38]
push rcx
sub rsp, 0x28
call fcn.1400e81a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.1400e81f0
add rsp, 0x28
movabs rcx, str.OLicenseCleanup.vbs
sub rsp, 0x28
call fcn.1400e81f0
add rsp, 0x28
call fcn.1400e84f0
push 0x6f
push rax
call fcn.1400e84c0
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.1400d2860
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14007d1a8
add rsp, 0x28
pop rax
movabs rbp, 0x1409cf02f
mov r15, rbp
movabs rbp, 0x1409c8b59
sub r15, rbp
mov rax, r15
push rax
movabs rbp, 0x1409c8b59
mov rax, rbp
push rax
push 0x6f
pop rcx
pop rdx
pop r8
call fcn.1400d2bc0
push 0x6f
pop rcx
call fcn.1400d24f0
push 0
movabs rax, 0x14019f0ba
push rax
pop rcx
pop rdx
call fcn.140072593
push 0
movabs rax, str.________________________Run_OLicenseCleanup.vbs_
push rax
pop rcx
pop rdx
call fcn.140072593
push 0
movabs rax, 0x14019f0ba
push rax
pop rcx
pop rdx
call fcn.140072593
push 0
push 0
mov rax, 1
mov rax, rax
push rax
push qword [rsp + 0x40]
movabs rax, 0x1401a574c
push rax
movabs rax, str.cscript.exe___NoLogo
push rax
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400204b4
add rsp, 0x30
push rcx
sub rsp, 0x28
call fcn.1400e81a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push 3
movabs rax, 0x14019f0ba
push rax
mov rcx, qword [0x140b36920]
push rcx
sub rsp, 0x28
call fcn.1400e81a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.1400e81f0
add rsp, 0x28
movabs rcx, str._files
sub rsp, 0x28
call fcn.1400e81f0
add rsp, 0x28
push rax
call fcn.1400e84c0
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.1400d187c
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14007d1a8
add rsp, 0x28
pop rax
push 0
sub rsp, 8
push 0
pop rcx
sub rsp, 0x20
call fcn.1400cf580
add rsp, 0x28
mov rax, rax
push rax
pop rcx
pop rdx
call fcn.140047631
push 0x100
push 1
pop rcx
pop rdx
call fcn.14007c020
movabs rax, 0x1401a00f4
push rax
movabs rax, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstallProplusRetail___en_us
push rax
pop rcx
pop rdx
call fcn.14007b725
movabs rax, 0x1401a00f4
push rax
movabs rax, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstallProplusRetail___ru_ru
push rax
pop rcx
pop rdx
call fcn.14007b725
movabs rax, 0x1401a00f4
push rax
movabs rax, str.HKEY_CLASSES_ROOTInstallerProducts00006109C80000000000000000F01FEC
push rax
pop rcx
pop rdx
call fcn.14007b725
movabs rax, 0x1401a00f4
push rax
movabs rax, str.HKEY_CLASSES_ROOTInstallerProducts00006109C80090400000000000F01FEC
push rax
pop rcx
pop rdx
call fcn.14007b725
movabs rax, 0x1401a00f4
push rax
movabs rax, str.HKEY_CLASSES_ROOTInstallerProducts00006109F80000000100000000F01FEC
push rax
pop rcx
pop rdx
call fcn.14007b725
movabs rax, 0x1401a00f4
push rax
movabs rax, str.HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftOffice16.0CommonOfficeUpdate
push rax
pop rcx
pop rdx
call fcn.14007b725
push rcx
sub rsp, 0x28
call fcn.1400e81a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push 0
push 0
xor rax, rax
mov rax, rax
push rax
mov rcx, qword [0x140b363e8]
push rcx
sub rsp, 0x20
call fcn.1400e81a0
add rsp, 0x20
pop rcx
push rax
sub rsp, 0x20
call fcn.1400e81f0
add rsp, 0x20
movabs rcx, str.System32
sub rsp, 0x20
call fcn.1400e81f0
add rsp, 0x20
call fcn.1400e84f0
movabs rax, str.delete__HKLMSOFTWAREPoliciesMicrosoftOffice16.0CommonOfficeUpdate___f__v_UpdateBranch
push rax
movabs rax, str.reg.exe
push rax
push rax
call fcn.1400e84c0
mov rdx, rax
pop rax
add qword [rsp + 0x10], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400204b4
add rsp, 0x38
pop rcx
push rax
sub rsp, 0x28
call fcn.14007d1a8
add rsp, 0x28
pop rax
push rcx
sub rsp, 0x28
call fcn.1400e81a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
mov rcx, qword [0x140b36370]
push rcx
sub rsp, 0x28
call fcn.1400e81a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.1400e81f0
add rsp, 0x28
movabs rcx, str.ProgramDataMicrosoftOfficeSoftwareProtectionPlatform
sub rsp, 0x28
call fcn.1400e81f0
add rsp, 0x28
push rax
call fcn.1400e84c0
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
sub rsp, 0x20
call fcn.1400d1630
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14007d1a8
add rsp, 0x28
pop rax
mov r15, rax
cmp r15, 0xfffffffffffffffe
jne 0x140026cc5
push rcx
sub rsp, 0x28
call fcn.1400e81a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push 3
movabs rax, 0x14019f0ba
push rax
mov rcx, qword [0x140b36370]
push rcx
sub rsp, 0x28
call fcn.1400e81a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.1400e81f0
add rsp, 0x28
movabs rcx, str.ProgramDataMicrosoftOfficeSoftwareProtectionPlatform
sub rsp, 0x28
call fcn.1400e81f0
add rsp, 0x28
push rax
call fcn.1400e84c0
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.1400d187c
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14007d1a8
add rsp, 0x28
pop rax
push 0
movabs rax, str._Completed_
push rax
pop rcx
pop rdx
call fcn.140072593
push 0
movabs rax, 0x14019f0ba
push rax
pop rcx
pop rdx
call fcn.140072593
push 0
push 9
pop rcx
pop rdx
call fcn.1400c6d14
mov qword [0x140b366e8], 1
push rcx
sub rsp, 0x28
call fcn.1400e81a0
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.1400e81a0
add rsp, 0x20
pop rcx
push rax
sub rsp, 0x20
call fcn.14007bcf6
add rsp, 0x28
lea rcx, [rsp + 0x38]
pop rdx
call fcn.1400e8260
push 1
push qword [0x140b364b0]
push qword [rsp + 0x40]
pop rcx
pop rdx
pop r8
call fcn.1400e5470
mov r15, rax
and r15, r15
jle 0x140026d83
push qword [rsp + 0x30]
push 0
pop rcx
pop rdx
call sub.USER32.dll_FindWindowW
mov rax, rax
push rax
pop rcx
call sub.USER32.dll_SetForegroundWindow
jmp 0x140026da0
push qword [rsp + 0x30]
movabs rcx, 0x14019f0ba
pop rdx
call fcn.1400e8340
or rax, rax
je 0x140026d0f
call fcn.140073814
xor rax, rax
push rax
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.1400e8630
add rsp, 0x28
mov rcx, qword [rsp + 0x38]
sub rsp, 0x28
call fcn.1400e8630
add rsp, 0x28
pop rax
add rsp, 0x38
pop r15
pop rbp
ret