Function at 0x140026636
Capabilities:
Get geographical location
Reference sql statements

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push r15
xor rax, rax
push rax
push rax
sub rsp, 0x28
call fcn.1400e85c0
mov r15, qword [0x1401b64c0]
and r15, r15
jle 0x14002670f
mov qword [0x1401b64c0], 0
push 0
pop rcx
call fcn.14002123c
mov qword [0x140b36b80], 0
push qword [0x140b36ba0]
pop rcx
call fcn.1400df154
mov rax, rax
push rax
push 9
pop rcx
pop rdx
call fcn.1400c42a8
push 0
push 0x51
pop rcx
pop rdx
call fcn.1400c6d14
push 0
push 8
pop rcx
pop rdx
call fcn.1400c6d14
push 0
push 0xa
pop rcx
pop rdx
call fcn.1400c6d14
push 0
push 0xb
pop rcx
pop rdx
call fcn.1400c6d14
push 0
push 0x36
pop rcx
pop rdx
call fcn.1400c6d14
push 0
push 3
pop rcx
pop rdx
call fcn.1400c42a8
mov qword [0x140b36e28], 0
jmp 0x1400271a9
mov r15, qword [0x140b36e28]
and r15, r15
jle 0x140026720
jmp 0x1400271a9
push 1
push 0x51
pop rcx
pop rdx
call fcn.1400c6d14
push 1
push 8
pop rcx
pop rdx
call fcn.1400c6d14
push 1
push 0xa
pop rcx
pop rdx
call fcn.1400c6d14
push 1
push 0xb
pop rcx
pop rdx
call fcn.1400c6d14
mov qword [0x140b36e28], 1
mov qword [0x1401b64c0], 1
movabs rax, 0x1401a30ac
push rax
push 9
pop rcx
pop rdx
call fcn.1400c6e80
push 1
push 9
pop rcx
pop rdx
call fcn.1400c6d14
push 1
pop rcx
call fcn.14002123c
movabs rax, 0x14019f0ba
push rax
push 7
pop rcx
pop rdx
call fcn.1400c6e80
mov rcx, qword [0x140b36db8]
push rcx
sub rsp, 0x28
call fcn.1400e81a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.1400e81f0
add rsp, 0x28
movabs rcx, str._files
sub rsp, 0x28
call fcn.1400e81f0
add rsp, 0x28
lea rcx, [rsp + 0x30]
pop rdx
call fcn.1400e8260
push qword [rsp + 0x28]
pop rcx
call fcn.1400d1bd4
push 1
sub rsp, 8
push 0
pop rcx
sub rsp, 0x20
call fcn.1400cf580
add rsp, 0x28
mov rax, rax
push rax
pop rcx
pop rdx
call fcn.1400479c2
push 0
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14002bb8f
push rcx
sub rsp, 0x28
call fcn.1400e81a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
mov rcx, qword [rsp + 0x38]
push rcx
sub rsp, 0x28
call fcn.1400e81a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.1400e81f0
add rsp, 0x28
movabs rcx, str.OffScrub_O15msi.vbs
sub rsp, 0x28
call fcn.1400e81f0
add rsp, 0x28
call fcn.1400e84f0
push 0x6f
push rax
call fcn.1400e84c0
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.1400d2860
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14007dbe0
add rsp, 0x28
pop rax
movabs rbp, 0x140a2f48b
mov r15, rbp
movabs rbp, 0x1409cf4af
sub r15, rbp
mov rax, r15
push rax
movabs rbp, 0x1409cf4af
mov rax, rbp
push rax
push 0x6f
pop rcx
pop rdx
pop r8
call fcn.1400d2bc0
push 0x6f
pop rcx
call fcn.1400d24f0
push 0
movabs rax, 0x14019f0ba
push rax
pop rcx
pop rdx
call fcn.140072fcb
push 0
movabs rax, str.__________________________Run_OffScrub_O15msi.vbs_
push rax
pop rcx
pop rdx
call fcn.140072fcb
push 0
movabs rax, 0x14019f0ba
push rax
pop rcx
pop rdx
call fcn.140072fcb
push 0
push 0
mov rax, 1
mov rax, rax
push rax
push qword [rsp + 0x40]
movabs rax, str.OffScrub_O15msi.vbs_ALL__NoCancel__Force__OSE_2_1
push rax
movabs rax, str.cscript.exe___NoLogo
push rax
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400208b5
add rsp, 0x30
push rcx
sub rsp, 0x28
call fcn.1400e81a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
mov rcx, qword [rsp + 0x38]
push rcx
sub rsp, 0x28
call fcn.1400e81a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.1400e81f0
add rsp, 0x28
movabs rcx, str.OffScrub_O16msi.vbs
sub rsp, 0x28
call fcn.1400e81f0
add rsp, 0x28
call fcn.1400e84f0
push 0x6f
push rax
call fcn.1400e84c0
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.1400d2860
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14007dbe0
add rsp, 0x28
pop rax
movabs rbp, 0x140a8f427
mov r15, rbp
movabs rbp, 0x140a2f48b
sub r15, rbp
mov rax, r15
push rax
movabs rbp, 0x140a2f48b
mov rax, rbp
push rax
push 0x6f
pop rcx
pop rdx
pop r8
call fcn.1400d2bc0
push 0x6f
pop rcx
call fcn.1400d24f0
push 0
movabs rax, 0x14019f0ba
push rax
pop rcx
pop rdx
call fcn.140072fcb
push 0
movabs rax, str.__________________________Run_OffScrub_O16msi.vbs_
push rax
pop rcx
pop rdx
call fcn.140072fcb
push 0
movabs rax, 0x14019f0ba
push rax
pop rcx
pop rdx
call fcn.140072fcb
push 0
push 0
mov rax, 1
mov rax, rax
push rax
push qword [rsp + 0x40]
movabs rax, str.OffScrub_O16msi.vbs_ALL__NoCancel__Force__OSE_2_1
push rax
movabs rax, str.cscript.exe___NoLogo
push rax
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400208b5
add rsp, 0x30
push rcx
sub rsp, 0x28
call fcn.1400e81a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
mov rcx, qword [rsp + 0x38]
push rcx
sub rsp, 0x28
call fcn.1400e81a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.1400e81f0
add rsp, 0x28
movabs rcx, str.OffScrubC2R.vbs
sub rsp, 0x28
call fcn.1400e81f0
add rsp, 0x28
call fcn.1400e84f0
push 0x6f
push rax
call fcn.1400e84c0
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.1400d2860
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14007dbe0
add rsp, 0x28
pop rax
movabs rbp, 0x1409c8fd9
mov r15, rbp
movabs rbp, str.reg_add__HKLMSOFTWAREMicrosoftWindows_Script_HostSettings___v_Enabled__t_REG_DWORD__d_1__f_r_ncscript.exe___dp0Office_Uninstall.vbs___Force_r_n_r_n_r_n_Name:_OffScrubC2R.vbs_r_n_Author:_Microsoft_Customer_Support_Services_r_n_Copyright__c__2014___2016_Microsoft_Corporation_r_n_Script_to_remove_Office_Click_To_Run__C2R__products_r_n_when_a_regular_uninstall_is_no_longer_possible_r_n_r_n_Scope:_Office_2013__2016_and_O365_C2R_products_r_n_r_n_r_nOption_Explicit_r_n_r_n________________________________________________________________________________r_n_r_n___Declaration_of_constants_r_n________________________________________________________________________________r_n_r_n_r_nConst_SCRIPTVERSION_____2.19__r_nConst_SCRIPTFILE________OffScrubC2R.vbs__r_nConst_SCRIPTNAME________OffScrubC2R__r_nConst_RETVALFILE________ScrubRetValFile.txt__r_nConst_ONAME_____________Office_C2R___O365__r_nConst_HKCR_____________H80000000_r_nConst_HKCU_____________H80000001_r_nConst_HKLM_____________H80000002_r_nConst_HKU______________H80000003_r_nConst_PRODLEN__________13_r_nConst_SQUISHED_________20_r_nConst_COMPRESSED_______32_r_nConst_REG_ARP___________SOFTWAREMicrosoftWindowsCurrentVersionUninstall__r_nConst_VB_YES___________6_r_nConst_VB_NO____________7_r_n_r_nConst_ERROR_SUCCESS__________________0___Bit_1.__0_indicates_Success._Script_completed_successfully_r_nConst_ERROR_FAIL_____________________1___Bit_1.__Failure_bit._Indicates_an_overall_script_failure._r_n__________________________________________RESERVED_bit__Returned_when_process_is_killed_from_task_manager_r_nConst_ERROR_REBOOT_REQUIRED__________2___Bit_2.__Reboot_bit._If_set_a_reboot_is_required_r_nConst_ERROR_USERCANCEL_______________4___Bit_3.__User_Cancel_bit._Controlled_cancel_from_script_UI_r_nConst_ERROR_STAGE1___________________8___Bit_4.__Informational._Msiexec_based_install_was_not_possible_r_nConst_ERROR_STAGE2___________________16__Bit_5.__Critical._Not_all_of_the_intended_cleanup_operations_could_be_applied_r_nConst_ERROR_INCOMPLETE_______________32__Bit_6.__Pending_file_renames__del_on_reboot____OR___Removal_needs_to_run_again_after_a_system_reboot._r_nConst_ERROR_DCAF_FAILURE_____________64__Bit_7.__Critical._Da_capo_al_fine__second_attempt__still_failed._r_nConst_ERROR_ELEVATION_USERDECLINED___128_Bit_8.__Critical_script_error._User_declined_to_allow_mandatory_script_elevation_r_nConst_ERROR_ELEVATION________________256_Bit_9.__Critical_script_error._The_attempt_to_elevate_the_process_did_not_succeed_r_nConst_ERROR_SCRIPTINIT_______________512_Bit_10._Critical_script_error._Initialization_failed_r_nConst_ERROR_RELAUNCH_________________1024Bit_11._Critical_script_error._This_is_a_temporary_value_and_must_not_be_the_final_return_code_r_nConst_ERROR_UNKNOWN__________________2048Bit_12_Critical_script_error._Script_did_not_complete_in_a_well_defined_state_r_nConst_ERROR_ALL______________________4095Full_BitMask_r_nConst_ERROR_USER_ABORT_______________HC000013A_RESERVED._Dec__1073741510._Critical_error._Returned_when_user_aborts_with__Ctrl__Break__or_closes_the_cmd_window_r_nConst_ERROR_SUCCESS_CONFIG_COMPLETE__1728_r_nConst_ERROR_SUCCESS_REBOOT_REQUIRED__3010_r_n_r_n________________________________________________________________________________r_n_r_n___Declaration_of_variables_r_n________________________________________________________________________________r_n_r_nDim_oFso__oMsi__oReg__oWShell__oWmiLocal__oShellApp_r_nDim_ComputerItem__Key__Item__LogStream__TmpKey_r_nDim_arrVersion_r_nDim_dicKeepLis__dicApps__dicKeepFolder__dicDelRegKey__dicKeepReg__dicSC_r_nDim_dicInstalledSku__dicRemoveSku__dicKeepSku__dicC2RSuite__dicDelInUse_r_nDim_dicDelFolder_r_nDim_sAppData__sScrubDir__sProgramFiles__sProgramFilesX86__sCommonProgramFiles_r_nDim_sAllusersProfile__sOSVersion__sWinDir__sWICacheDir__sCommonProgramFilesX86_r_nD
sub r15, rbp
mov rax, r15
push rax
movabs rbp, str.reg_add__HKLMSOFTWAREMicrosoftWindows_Script_HostSettings___v_Enabled__t_REG_DWORD__d_1__f_r_ncscript.exe___dp0Office_Uninstall.vbs___Force_r_n_r_n_r_n_Name:_OffScrubC2R.vbs_r_n_Author:_Microsoft_Customer_Support_Services_r_n_Copyright__c__2014___2016_Microsoft_Corporation_r_n_Script_to_remove_Office_Click_To_Run__C2R__products_r_n_when_a_regular_uninstall_is_no_longer_possible_r_n_r_n_Scope:_Office_2013__2016_and_O365_C2R_products_r_n_r_n_r_nOption_Explicit_r_n_r_n________________________________________________________________________________r_n_r_n___Declaration_of_constants_r_n________________________________________________________________________________r_n_r_n_r_nConst_SCRIPTVERSION_____2.19__r_nConst_SCRIPTFILE________OffScrubC2R.vbs__r_nConst_SCRIPTNAME________OffScrubC2R__r_nConst_RETVALFILE________ScrubRetValFile.txt__r_nConst_ONAME_____________Office_C2R___O365__r_nConst_HKCR_____________H80000000_r_nConst_HKCU_____________H80000001_r_nConst_HKLM_____________H80000002_r_nConst_HKU______________H80000003_r_nConst_PRODLEN__________13_r_nConst_SQUISHED_________20_r_nConst_COMPRESSED_______32_r_nConst_REG_ARP___________SOFTWAREMicrosoftWindowsCurrentVersionUninstall__r_nConst_VB_YES___________6_r_nConst_VB_NO____________7_r_n_r_nConst_ERROR_SUCCESS__________________0___Bit_1.__0_indicates_Success._Script_completed_successfully_r_nConst_ERROR_FAIL_____________________1___Bit_1.__Failure_bit._Indicates_an_overall_script_failure._r_n__________________________________________RESERVED_bit__Returned_when_process_is_killed_from_task_manager_r_nConst_ERROR_REBOOT_REQUIRED__________2___Bit_2.__Reboot_bit._If_set_a_reboot_is_required_r_nConst_ERROR_USERCANCEL_______________4___Bit_3.__User_Cancel_bit._Controlled_cancel_from_script_UI_r_nConst_ERROR_STAGE1___________________8___Bit_4.__Informational._Msiexec_based_install_was_not_possible_r_nConst_ERROR_STAGE2___________________16__Bit_5.__Critical._Not_all_of_the_intended_cleanup_operations_could_be_applied_r_nConst_ERROR_INCOMPLETE_______________32__Bit_6.__Pending_file_renames__del_on_reboot____OR___Removal_needs_to_run_again_after_a_system_reboot._r_nConst_ERROR_DCAF_FAILURE_____________64__Bit_7.__Critical._Da_capo_al_fine__second_attempt__still_failed._r_nConst_ERROR_ELEVATION_USERDECLINED___128_Bit_8.__Critical_script_error._User_declined_to_allow_mandatory_script_elevation_r_nConst_ERROR_ELEVATION________________256_Bit_9.__Critical_script_error._The_attempt_to_elevate_the_process_did_not_succeed_r_nConst_ERROR_SCRIPTINIT_______________512_Bit_10._Critical_script_error._Initialization_failed_r_nConst_ERROR_RELAUNCH_________________1024Bit_11._Critical_script_error._This_is_a_temporary_value_and_must_not_be_the_final_return_code_r_nConst_ERROR_UNKNOWN__________________2048Bit_12_Critical_script_error._Script_did_not_complete_in_a_well_defined_state_r_nConst_ERROR_ALL______________________4095Full_BitMask_r_nConst_ERROR_USER_ABORT_______________HC000013A_RESERVED._Dec__1073741510._Critical_error._Returned_when_user_aborts_with__Ctrl__Break__or_closes_the_cmd_window_r_nConst_ERROR_SUCCESS_CONFIG_COMPLETE__1728_r_nConst_ERROR_SUCCESS_REBOOT_REQUIRED__3010_r_n_r_n________________________________________________________________________________r_n_r_n___Declaration_of_variables_r_n________________________________________________________________________________r_n_r_nDim_oFso__oMsi__oReg__oWShell__oWmiLocal__oShellApp_r_nDim_ComputerItem__Key__Item__LogStream__TmpKey_r_nDim_arrVersion_r_nDim_dicKeepLis__dicApps__dicKeepFolder__dicDelRegKey__dicKeepReg__dicSC_r_nDim_dicInstalledSku__dicRemoveSku__dicKeepSku__dicC2RSuite__dicDelInUse_r_nDim_dicDelFolder_r_nDim_sAppData__sScrubDir__sProgramFiles__sProgramFilesX86__sCommonProgramFiles_r_nDim_sAllusersProfile__sOSVersion__sWinDir__sWICacheDir__sCommonProgramFilesX86_r_nD
mov rax, rbp
push rax
push 0x6f
pop rcx
pop rdx
pop r8
call fcn.1400d2bc0
push 0x6f
pop rcx
call fcn.1400d24f0
push 0
movabs rax, 0x14019f0ba
push rax
pop rcx
pop rdx
call fcn.140072fcb
push 0
movabs rax, str.__________________________Run_OffScrubC2R.vbs_
push rax
pop rcx
pop rdx
call fcn.140072fcb
push 0
movabs rax, 0x14019f0ba
push rax
pop rcx
pop rdx
call fcn.140072fcb
push 0
push 0
mov rax, 1
mov rax, rax
push rax
push qword [rsp + 0x40]
movabs rax, str.OffScrubC2R.vbs_ALL__NoCancel__OSE_2_1
push rax
movabs rax, str.cscript.exe___NoLogo
push rax
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400208b5
add rsp, 0x30
push rcx
sub rsp, 0x28
call fcn.1400e81a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
mov rcx, qword [rsp + 0x38]
push rcx
sub rsp, 0x28
call fcn.1400e81a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.1400e81f0
add rsp, 0x28
movabs rcx, str.OLicenseCleanup.vbs
sub rsp, 0x28
call fcn.1400e81f0
add rsp, 0x28
call fcn.1400e84f0
push 0x6f
push rax
call fcn.1400e84c0
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.1400d2860
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14007dbe0
add rsp, 0x28
pop rax
movabs rbp, 0x1409cf4af
mov r15, rbp
movabs rbp, 0x1409c8fd9
sub r15, rbp
mov rax, r15
push rax
movabs rbp, 0x1409c8fd9
mov rax, rbp
push rax
push 0x6f
pop rcx
pop rdx
pop r8
call fcn.1400d2bc0
push 0x6f
pop rcx
call fcn.1400d24f0
push 0
movabs rax, 0x14019f0ba
push rax
pop rcx
pop rdx
call fcn.140072fcb
push 0
movabs rax, str.________________________Run_OLicenseCleanup.vbs_
push rax
pop rcx
pop rdx
call fcn.140072fcb
push 0
movabs rax, 0x14019f0ba
push rax
pop rcx
pop rdx
call fcn.140072fcb
push 0
push 0
mov rax, 1
mov rax, rax
push rax
push qword [rsp + 0x40]
movabs rax, str.OLicenseCleanup.vbs_2_1
push rax
movabs rax, str.cscript.exe___NoLogo
push rax
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400208b5
add rsp, 0x30
push rcx
sub rsp, 0x28
call fcn.1400e81a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push 3
movabs rax, 0x14019f0ba
push rax
mov rcx, qword [0x140b36db8]
push rcx
sub rsp, 0x28
call fcn.1400e81a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.1400e81f0
add rsp, 0x28
movabs rcx, str._files
sub rsp, 0x28
call fcn.1400e81f0
add rsp, 0x28
push rax
call fcn.1400e84c0
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.1400d187c
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14007dbe0
add rsp, 0x28
pop rax
push 0
sub rsp, 8
push 0
pop rcx
sub rsp, 0x20
call fcn.1400cf580
add rsp, 0x28
mov rax, rax
push rax
pop rcx
pop rdx
call fcn.1400479c2
push 0x100
push 1
pop rcx
pop rdx
call fcn.14007ca58
movabs rax, 0x1401a00e6
push rax
movabs rax, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstallProplusRetail___en_us
push rax
pop rcx
pop rdx
call fcn.14007c15d
movabs rax, 0x1401a00e6
push rax
movabs rax, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstallProplusRetail___ru_ru
push rax
pop rcx
pop rdx
call fcn.14007c15d
movabs rax, 0x1401a00e6
push rax
movabs rax, str.HKEY_CLASSES_ROOTInstallerProducts00006109C80000000000000000F01FEC
push rax
pop rcx
pop rdx
call fcn.14007c15d
movabs rax, 0x1401a00e6
push rax
movabs rax, str.HKEY_CLASSES_ROOTInstallerProducts00006109C80090400000000000F01FEC
push rax
pop rcx
pop rdx
call fcn.14007c15d
movabs rax, 0x1401a00e6
push rax
movabs rax, str.HKEY_CLASSES_ROOTInstallerProducts00006109F80000000100000000F01FEC
push rax
pop rcx
pop rdx
call fcn.14007c15d
movabs rax, 0x1401a00e6
push rax
movabs rax, str.HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftOffice16.0CommonOfficeUpdate
push rax
pop rcx
pop rdx
call fcn.14007c15d
push rcx
sub rsp, 0x28
call fcn.1400e81a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push 0
push 0
xor rax, rax
mov rax, rax
push rax
mov rcx, qword [0x140b36868]
push rcx
sub rsp, 0x20
call fcn.1400e81a0
add rsp, 0x20
pop rcx
push rax
sub rsp, 0x20
call fcn.1400e81f0
add rsp, 0x20
movabs rcx, str.System32
sub rsp, 0x20
call fcn.1400e81f0
add rsp, 0x20
call fcn.1400e84f0
movabs rax, str.delete__HKLMSOFTWAREPoliciesMicrosoftOffice16.0CommonOfficeUpdate___f__v_UpdateBranch
push rax
movabs rax, str.reg.exe
push rax
push rax
call fcn.1400e84c0
mov rdx, rax
pop rax
add qword [rsp + 0x10], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400208b5
add rsp, 0x38
pop rcx
push rax
sub rsp, 0x28
call fcn.14007dbe0
add rsp, 0x28
pop rax
push rcx
sub rsp, 0x28
call fcn.1400e81a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
mov rcx, qword [0x140b367f0]
push rcx
sub rsp, 0x28
call fcn.1400e81a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.1400e81f0
add rsp, 0x28
movabs rcx, str.ProgramDataMicrosoftOfficeSoftwareProtectionPlatform
sub rsp, 0x28
call fcn.1400e81f0
add rsp, 0x28
push rax
call fcn.1400e84c0
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
sub rsp, 0x20
call fcn.1400d15f4
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14007dbe0
add rsp, 0x28
pop rax
mov r15, rax
cmp r15, 0xfffffffffffffffe
jne 0x1400270c6
push rcx
sub rsp, 0x28
call fcn.1400e81a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push 3
movabs rax, 0x14019f0ba
push rax
mov rcx, qword [0x140b367f0]
push rcx
sub rsp, 0x28
call fcn.1400e81a0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.1400e81f0
add rsp, 0x28
movabs rcx, str.ProgramDataMicrosoftOfficeSoftwareProtectionPlatform
sub rsp, 0x28
call fcn.1400e81f0
add rsp, 0x28
push rax
call fcn.1400e84c0
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.1400d187c
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14007dbe0
add rsp, 0x28
pop rax
push 0
movabs rax, str._Completed_
push rax
pop rcx
pop rdx
call fcn.140072fcb
push 0
movabs rax, 0x14019f0ba
push rax
pop rcx
pop rdx
call fcn.140072fcb
push 0
push 9
pop rcx
pop rdx
call fcn.1400c6d14
mov qword [0x140b36b80], 1
push rcx
sub rsp, 0x28
call fcn.1400e81a0
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.1400e81a0
add rsp, 0x20
pop rcx
push rax
sub rsp, 0x20
call fcn.14007c72e
add rsp, 0x28
lea rcx, [rsp + 0x38]
pop rdx
call fcn.1400e8260
push 1
push qword [0x140b36930]
push qword [rsp + 0x40]
pop rcx
pop rdx
pop r8
call fcn.1400e5470
mov r15, rax
and r15, r15
jle 0x140027184
push qword [rsp + 0x30]
push 0
pop rcx
pop rdx
call sub.USER32.dll_FindWindowW
mov rax, rax
push rax
pop rcx
call sub.USER32.dll_SetForegroundWindow
jmp 0x1400271a1
push qword [rsp + 0x30]
movabs rcx, 0x14019f0ba
pop rdx
call fcn.1400e8340
or rax, rax
je 0x140027110
call fcn.14007424c
xor rax, rax
push rax
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.1400e8630
add rsp, 0x28
mov rcx, qword [rsp + 0x38]
sub rsp, 0x28
call fcn.1400e8630
add rsp, 0x28
pop rax
add rsp, 0x38
pop r15
pop rbp
ret