Function at 0x14001f8d4
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push r15
xor rax, rax
push rax
push rax
push rax
push rax
sub rsp, 0x28
call fcn.1400928f0
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x28]
sub rsp, 0x10
call fcn.1400929c0
add rsp, 0x10
mov qword [rsp + 0x30], 0
mov rcx, qword [0x140319a94]
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
lea rcx, [rsp + 0x40]
pop rdx
call fcn.140092680
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
mov rcx, qword [0x140319e3c]
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
movabs rcx, 0x1401051f2
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
push rax
call fcn.1400927f0
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
sub rsp, 0x20
call fcn.140073d70
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140041f24
add rsp, 0x28
pop rax
mov r15, rax
cmp r15, 0xfffffffffffffffe
jne 0x14001fa51
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push 3
movabs rax, 0x140103028
push rax
mov rcx, qword [0x140319e3c]
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
movabs rcx, 0x1401051f2
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
push rax
call fcn.1400927f0
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.14007419c
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140041f24
add rsp, 0x28
pop rax
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
mov rcx, qword [0x140319e3c]
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
movabs rcx, 0x140105244
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
push rax
call fcn.1400927f0
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
sub rsp, 0x20
call fcn.140073d70
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140041f24
add rsp, 0x28
pop rax
mov r15, rax
cmp r15, 0xfffffffffffffffe
jne 0x14001fb67
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push 3
movabs rax, 0x140103028
push rax
mov rcx, qword [0x140319e3c]
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
movabs rcx, 0x140105244
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
push rax
call fcn.1400927f0
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.14007419c
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140041f24
add rsp, 0x28
pop rax
movabs rax, str.Office16StandardR_
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jle 0x14001fbac
movabs rax, str.dedfa23d_6ed1_45a6_85dc_63cae0546de6
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jne 0x14001fbac
mov rax, 1
jmp 0x14001fbaf
xor rax, rax
and rax, rax
je 0x14001fcc1
movabs rax, str.lic16
push rax
movabs rax, str.StandardVL_
push rax
movabs rbp, str.Copyright__c__Microsoft_Corporation._All_rights_reserved._r_n_________________________________________________________________________________________r_n_________________________________________________________________________________________r_nCONST_wshOK_____________________________0_r_nCONST_VALUE_ICON_WARNING________________16_r_nCONST_wshYesNoDialog____________________4_r_nCONST_VALUE_ICON_QUESTIONMARK___________32_r_nCONST_VALUE_ICON_INFORMATION____________64_r_nCONST_HKEY_LOCAL_MACHINE________________H80000002_r_nCONST_KEY_SET_VALUE_____________________H0002_r_nCONST_KEY_QUERY_VALUE___________________H0001_r_nCONST_REG_SZ____________________________1_r_nCONST_OfficeAppId_________________________0ff1ce15_a989_479d_af46_f275c6370663__r_nCONST_STR_SYS32PATH_______________________:WindowsSystem32__r_nCONST_STR_OSPPREARMPATH___________________Microsoft_OfficeOffice16OSPPREARM.EXE__r_nCONST_STR_OSPPREARMPATH_DEBUG_____________Microsoft_Office_DebugOffice16OSPPREARM.EXE__r_nCONST_REG_OSPP____________________________SOFTWAREMicrosoftOfficeSoftwareProtectionPlatform__r_nCONST_STR_HEARTBEATPATH___________________MicrosoftOfficeHeartbeatHeartbeatCache.xml__r_nCONST_REG_SPP_____________________________SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatform__r_nCONST_REG_SCAEXP_BASE_____________________HKCUSOFTWAREMicrosoftOffice16.0CommonExperimentEcs__r_nCONST_REG_SCAEXP_END_______________________Flightsofc5juzsw45rcw0__r_nCONST_REG_SCAEXP_OVERRIDE_________________HKLMSOFTWAREMicrosoftOfficeCommonExperimentofc5juzsw45rcw0__r_nCONST_REG_SCAO15__________________________HKLMSOFTWAREMicrosoftOffice15.0ClickToRunConfigurationSharedComputerLicensing__r_nCONST_REG_SCAO16__________________________HKLMSOFTWAREMicrosoftOfficeClickToRunConfigurationSharedComputerLicensing__r_nCONST_VALUE_SCAEXP_FLAVOR_________________exp__r_nCONST_VALUE_SCAEXP_OVERRIDE_FLAVOR________expoverride__r_nCONST_VALUE_SCAO15_FLAVOR_________________o15__r_nCONST_VALUE_SCA016_FLAVOR_________________o16__r_nCONST_VALUE_SCAREGKEY_SINGLE_TYPE_________single__r_nCONST_VALUE_SCAREGKEY_PER_APP_TYPE________perapp__r_nCONST_VER_INFO____________________________Version_Info:_2016_1.0__r_n_________________________________________________________________________________________r_nCONST_MSG_NOREGRIGHTS_____________________Insufficient_rights_to_perform_operation.__r_nCONST_MSG_ISCMD_ELEVATED__________________Ensure_cmd.exe_is_elevated__right_click___run_as_administrator_.__r_nCONST_MSG_CREDENTIALFAILURE_______________Connection_failed_with_passed_credentials.__r_nCONST_MSG_FILENOTFOUND____________________File_not_found:___________________r_nCONST_MSG_SEPERATESMALL____________________________________r_nCONST_MSG_SEPERATE_________________________________________________________________r_nCONST_MSG_PROCESSING_________________________Processing____________________________r_nCONST_MSG_EXIT_______________________________Exiting_______________________________r_nCONST_MSG_UNSUPPORTED_____________________Unsupported_command_passed.__r_nCONST_MSG_UNSUPPORTEDOPEROS7______________The_following_command_is_supported_on_Windows_7_only:___r_nCONST_MSG_UNSUPPORTEDOPEROS8______________The_following_command_is_supported_on_Windows_8_and_above_only:___r_nCONST_MSG_UNSUPPORTEDLOCAL________________The_following_command_is_supported_on_local_machine_only:___r_nCONST_MSG_CREDENTIALERR___________________Passing_credentials_is_not_supported_for_this_command.__r_nCONST_MSG_SUCCESS_________________________Successfully_applied_setting.__r_nCONST_MSG_NOKMSLICS_______________________No_Office_KMS_licenses_were_found_on_the_system.__r_nCONST_MSG_ACTATTEMPT______________________Installed_product_key_detected___attempting_to_activate_the_following_product:__r_nCONST_MSG_TOKACTATTEMPT___________________Installed_product_key_detected___attempting_to_token_activate_the_following_product:__r_nCONST_MSG_NOKEYSINSTALLED__________________No_installed_product
mov rax, rbp
push rax
movabs rbp, 0x140281d06
mov rax, rbp
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.1400163b8
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.1400925c0
add rsp, 0x20
pop rcx
push rax
mov rax, 1
mov rax, rax
push rax
push qword [rsp + 0x50]
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
movabs rcx, 0x1401038ea
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
mov rcx, qword [0x140319dfc]
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
movabs rcx, str.____NoLogo__unpkey:CR4MR
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
call fcn.140092820
movabs rax, str.cscript.exe
push rax
push rax
call fcn.1400927f0
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001284f
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140041f24
add rsp, 0x28
pop rax
mov qword [rsp + 0x30], 1
movabs rax, str.Office16ProjectStdR_
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jle 0x14001fd06
movabs rax, str.da7ddabc_3fbe_4447_9e01_6ab7440b4cd4
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jne 0x14001fd06
mov rax, 1
jmp 0x14001fd09
xor rax, rax
and rax, rax
je 0x14001fe1b
movabs rax, str.lic16
push rax
movabs rax, str.ProjectStdVL_
push rax
movabs rbp, str.Copyright__c__Microsoft_Corporation._All_rights_reserved._r_n_________________________________________________________________________________________r_n_________________________________________________________________________________________r_nCONST_wshOK_____________________________0_r_nCONST_VALUE_ICON_WARNING________________16_r_nCONST_wshYesNoDialog____________________4_r_nCONST_VALUE_ICON_QUESTIONMARK___________32_r_nCONST_VALUE_ICON_INFORMATION____________64_r_nCONST_HKEY_LOCAL_MACHINE________________H80000002_r_nCONST_KEY_SET_VALUE_____________________H0002_r_nCONST_KEY_QUERY_VALUE___________________H0001_r_nCONST_REG_SZ____________________________1_r_nCONST_OfficeAppId_________________________0ff1ce15_a989_479d_af46_f275c6370663__r_nCONST_STR_SYS32PATH_______________________:WindowsSystem32__r_nCONST_STR_OSPPREARMPATH___________________Microsoft_OfficeOffice16OSPPREARM.EXE__r_nCONST_STR_OSPPREARMPATH_DEBUG_____________Microsoft_Office_DebugOffice16OSPPREARM.EXE__r_nCONST_REG_OSPP____________________________SOFTWAREMicrosoftOfficeSoftwareProtectionPlatform__r_nCONST_STR_HEARTBEATPATH___________________MicrosoftOfficeHeartbeatHeartbeatCache.xml__r_nCONST_REG_SPP_____________________________SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatform__r_nCONST_REG_SCAEXP_BASE_____________________HKCUSOFTWAREMicrosoftOffice16.0CommonExperimentEcs__r_nCONST_REG_SCAEXP_END_______________________Flightsofc5juzsw45rcw0__r_nCONST_REG_SCAEXP_OVERRIDE_________________HKLMSOFTWAREMicrosoftOfficeCommonExperimentofc5juzsw45rcw0__r_nCONST_REG_SCAO15__________________________HKLMSOFTWAREMicrosoftOffice15.0ClickToRunConfigurationSharedComputerLicensing__r_nCONST_REG_SCAO16__________________________HKLMSOFTWAREMicrosoftOfficeClickToRunConfigurationSharedComputerLicensing__r_nCONST_VALUE_SCAEXP_FLAVOR_________________exp__r_nCONST_VALUE_SCAEXP_OVERRIDE_FLAVOR________expoverride__r_nCONST_VALUE_SCAO15_FLAVOR_________________o15__r_nCONST_VALUE_SCA016_FLAVOR_________________o16__r_nCONST_VALUE_SCAREGKEY_SINGLE_TYPE_________single__r_nCONST_VALUE_SCAREGKEY_PER_APP_TYPE________perapp__r_nCONST_VER_INFO____________________________Version_Info:_2016_1.0__r_n_________________________________________________________________________________________r_nCONST_MSG_NOREGRIGHTS_____________________Insufficient_rights_to_perform_operation.__r_nCONST_MSG_ISCMD_ELEVATED__________________Ensure_cmd.exe_is_elevated__right_click___run_as_administrator_.__r_nCONST_MSG_CREDENTIALFAILURE_______________Connection_failed_with_passed_credentials.__r_nCONST_MSG_FILENOTFOUND____________________File_not_found:___________________r_nCONST_MSG_SEPERATESMALL____________________________________r_nCONST_MSG_SEPERATE_________________________________________________________________r_nCONST_MSG_PROCESSING_________________________Processing____________________________r_nCONST_MSG_EXIT_______________________________Exiting_______________________________r_nCONST_MSG_UNSUPPORTED_____________________Unsupported_command_passed.__r_nCONST_MSG_UNSUPPORTEDOPEROS7______________The_following_command_is_supported_on_Windows_7_only:___r_nCONST_MSG_UNSUPPORTEDOPEROS8______________The_following_command_is_supported_on_Windows_8_and_above_only:___r_nCONST_MSG_UNSUPPORTEDLOCAL________________The_following_command_is_supported_on_local_machine_only:___r_nCONST_MSG_CREDENTIALERR___________________Passing_credentials_is_not_supported_for_this_command.__r_nCONST_MSG_SUCCESS_________________________Successfully_applied_setting.__r_nCONST_MSG_NOKMSLICS_______________________No_Office_KMS_licenses_were_found_on_the_system.__r_nCONST_MSG_ACTATTEMPT______________________Installed_product_key_detected___attempting_to_activate_the_following_product:__r_nCONST_MSG_TOKACTATTEMPT___________________Installed_product_key_detected___attempting_to_token_activate_the_following_product:__r_nCONST_MSG_NOKEYSINSTALLED__________________No_installed_product
mov rax, rbp
push rax
movabs rbp, 0x140281d06
mov rax, rbp
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.1400163b8
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.1400925c0
add rsp, 0x20
pop rcx
push rax
mov rax, 1
mov rax, rax
push rax
push qword [rsp + 0x50]
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
movabs rcx, 0x1401038ea
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
mov rcx, qword [0x140319dfc]
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
movabs rcx, str.____NoLogo__unpkey:6XX33
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
call fcn.140092820
movabs rax, str.cscript.exe
push rax
push rax
call fcn.1400927f0
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001284f
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140041f24
add rsp, 0x28
pop rax
mov qword [rsp + 0x30], 1
movabs rax, str.Office16VisioStdR_
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jle 0x14001fe60
movabs rax, str.aa2a7821_1827_4c2c_8f1d_4513a34dda97
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jne 0x14001fe60
mov rax, 1
jmp 0x14001fe63
xor rax, rax
and rax, rax
je 0x14001ff75
movabs rax, str.lic16
push rax
movabs rax, str.VisioStdVL_
push rax
movabs rbp, str.Copyright__c__Microsoft_Corporation._All_rights_reserved._r_n_________________________________________________________________________________________r_n_________________________________________________________________________________________r_nCONST_wshOK_____________________________0_r_nCONST_VALUE_ICON_WARNING________________16_r_nCONST_wshYesNoDialog____________________4_r_nCONST_VALUE_ICON_QUESTIONMARK___________32_r_nCONST_VALUE_ICON_INFORMATION____________64_r_nCONST_HKEY_LOCAL_MACHINE________________H80000002_r_nCONST_KEY_SET_VALUE_____________________H0002_r_nCONST_KEY_QUERY_VALUE___________________H0001_r_nCONST_REG_SZ____________________________1_r_nCONST_OfficeAppId_________________________0ff1ce15_a989_479d_af46_f275c6370663__r_nCONST_STR_SYS32PATH_______________________:WindowsSystem32__r_nCONST_STR_OSPPREARMPATH___________________Microsoft_OfficeOffice16OSPPREARM.EXE__r_nCONST_STR_OSPPREARMPATH_DEBUG_____________Microsoft_Office_DebugOffice16OSPPREARM.EXE__r_nCONST_REG_OSPP____________________________SOFTWAREMicrosoftOfficeSoftwareProtectionPlatform__r_nCONST_STR_HEARTBEATPATH___________________MicrosoftOfficeHeartbeatHeartbeatCache.xml__r_nCONST_REG_SPP_____________________________SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatform__r_nCONST_REG_SCAEXP_BASE_____________________HKCUSOFTWAREMicrosoftOffice16.0CommonExperimentEcs__r_nCONST_REG_SCAEXP_END_______________________Flightsofc5juzsw45rcw0__r_nCONST_REG_SCAEXP_OVERRIDE_________________HKLMSOFTWAREMicrosoftOfficeCommonExperimentofc5juzsw45rcw0__r_nCONST_REG_SCAO15__________________________HKLMSOFTWAREMicrosoftOffice15.0ClickToRunConfigurationSharedComputerLicensing__r_nCONST_REG_SCAO16__________________________HKLMSOFTWAREMicrosoftOfficeClickToRunConfigurationSharedComputerLicensing__r_nCONST_VALUE_SCAEXP_FLAVOR_________________exp__r_nCONST_VALUE_SCAEXP_OVERRIDE_FLAVOR________expoverride__r_nCONST_VALUE_SCAO15_FLAVOR_________________o15__r_nCONST_VALUE_SCA016_FLAVOR_________________o16__r_nCONST_VALUE_SCAREGKEY_SINGLE_TYPE_________single__r_nCONST_VALUE_SCAREGKEY_PER_APP_TYPE________perapp__r_nCONST_VER_INFO____________________________Version_Info:_2016_1.0__r_n_________________________________________________________________________________________r_nCONST_MSG_NOREGRIGHTS_____________________Insufficient_rights_to_perform_operation.__r_nCONST_MSG_ISCMD_ELEVATED__________________Ensure_cmd.exe_is_elevated__right_click___run_as_administrator_.__r_nCONST_MSG_CREDENTIALFAILURE_______________Connection_failed_with_passed_credentials.__r_nCONST_MSG_FILENOTFOUND____________________File_not_found:___________________r_nCONST_MSG_SEPERATESMALL____________________________________r_nCONST_MSG_SEPERATE_________________________________________________________________r_nCONST_MSG_PROCESSING_________________________Processing____________________________r_nCONST_MSG_EXIT_______________________________Exiting_______________________________r_nCONST_MSG_UNSUPPORTED_____________________Unsupported_command_passed.__r_nCONST_MSG_UNSUPPORTEDOPEROS7______________The_following_command_is_supported_on_Windows_7_only:___r_nCONST_MSG_UNSUPPORTEDOPEROS8______________The_following_command_is_supported_on_Windows_8_and_above_only:___r_nCONST_MSG_UNSUPPORTEDLOCAL________________The_following_command_is_supported_on_local_machine_only:___r_nCONST_MSG_CREDENTIALERR___________________Passing_credentials_is_not_supported_for_this_command.__r_nCONST_MSG_SUCCESS_________________________Successfully_applied_setting.__r_nCONST_MSG_NOKMSLICS_______________________No_Office_KMS_licenses_were_found_on_the_system.__r_nCONST_MSG_ACTATTEMPT______________________Installed_product_key_detected___attempting_to_activate_the_following_product:__r_nCONST_MSG_TOKACTATTEMPT___________________Installed_product_key_detected___attempting_to_token_activate_the_following_product:__r_nCONST_MSG_NOKEYSINSTALLED__________________No_installed_product
mov rax, rbp
push rax
movabs rbp, 0x140281d06
mov rax, rbp
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.1400163b8
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.1400925c0
add rsp, 0x20
pop rcx
push rax
mov rax, 1
mov rax, rax
push rax
push qword [rsp + 0x50]
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
movabs rcx, 0x1401038ea
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
mov rcx, qword [0x140319dfc]
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
movabs rcx, str.____NoLogo__unpkey:MKMYV
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
call fcn.140092820
movabs rax, str.cscript.exe
push rax
push rax
call fcn.1400927f0
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001284f
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140041f24
add rsp, 0x28
pop rax
mov qword [rsp + 0x30], 1
movabs rax, str.Office16ProPlusR_
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jle 0x14001ffba
movabs rax, str.d450596f_894d_49e0_966a_fd39ed4c4c64
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jne 0x14001ffba
mov rax, 1
jmp 0x14001ffbd
xor rax, rax
and rax, rax
je 0x1400200cf
movabs rax, str.lic16
push rax
movabs rax, str.ProPlusVL_
push rax
movabs rbp, str.Copyright__c__Microsoft_Corporation._All_rights_reserved._r_n_________________________________________________________________________________________r_n_________________________________________________________________________________________r_nCONST_wshOK_____________________________0_r_nCONST_VALUE_ICON_WARNING________________16_r_nCONST_wshYesNoDialog____________________4_r_nCONST_VALUE_ICON_QUESTIONMARK___________32_r_nCONST_VALUE_ICON_INFORMATION____________64_r_nCONST_HKEY_LOCAL_MACHINE________________H80000002_r_nCONST_KEY_SET_VALUE_____________________H0002_r_nCONST_KEY_QUERY_VALUE___________________H0001_r_nCONST_REG_SZ____________________________1_r_nCONST_OfficeAppId_________________________0ff1ce15_a989_479d_af46_f275c6370663__r_nCONST_STR_SYS32PATH_______________________:WindowsSystem32__r_nCONST_STR_OSPPREARMPATH___________________Microsoft_OfficeOffice16OSPPREARM.EXE__r_nCONST_STR_OSPPREARMPATH_DEBUG_____________Microsoft_Office_DebugOffice16OSPPREARM.EXE__r_nCONST_REG_OSPP____________________________SOFTWAREMicrosoftOfficeSoftwareProtectionPlatform__r_nCONST_STR_HEARTBEATPATH___________________MicrosoftOfficeHeartbeatHeartbeatCache.xml__r_nCONST_REG_SPP_____________________________SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatform__r_nCONST_REG_SCAEXP_BASE_____________________HKCUSOFTWAREMicrosoftOffice16.0CommonExperimentEcs__r_nCONST_REG_SCAEXP_END_______________________Flightsofc5juzsw45rcw0__r_nCONST_REG_SCAEXP_OVERRIDE_________________HKLMSOFTWAREMicrosoftOfficeCommonExperimentofc5juzsw45rcw0__r_nCONST_REG_SCAO15__________________________HKLMSOFTWAREMicrosoftOffice15.0ClickToRunConfigurationSharedComputerLicensing__r_nCONST_REG_SCAO16__________________________HKLMSOFTWAREMicrosoftOfficeClickToRunConfigurationSharedComputerLicensing__r_nCONST_VALUE_SCAEXP_FLAVOR_________________exp__r_nCONST_VALUE_SCAEXP_OVERRIDE_FLAVOR________expoverride__r_nCONST_VALUE_SCAO15_FLAVOR_________________o15__r_nCONST_VALUE_SCA016_FLAVOR_________________o16__r_nCONST_VALUE_SCAREGKEY_SINGLE_TYPE_________single__r_nCONST_VALUE_SCAREGKEY_PER_APP_TYPE________perapp__r_nCONST_VER_INFO____________________________Version_Info:_2016_1.0__r_n_________________________________________________________________________________________r_nCONST_MSG_NOREGRIGHTS_____________________Insufficient_rights_to_perform_operation.__r_nCONST_MSG_ISCMD_ELEVATED__________________Ensure_cmd.exe_is_elevated__right_click___run_as_administrator_.__r_nCONST_MSG_CREDENTIALFAILURE_______________Connection_failed_with_passed_credentials.__r_nCONST_MSG_FILENOTFOUND____________________File_not_found:___________________r_nCONST_MSG_SEPERATESMALL____________________________________r_nCONST_MSG_SEPERATE_________________________________________________________________r_nCONST_MSG_PROCESSING_________________________Processing____________________________r_nCONST_MSG_EXIT_______________________________Exiting_______________________________r_nCONST_MSG_UNSUPPORTED_____________________Unsupported_command_passed.__r_nCONST_MSG_UNSUPPORTEDOPEROS7______________The_following_command_is_supported_on_Windows_7_only:___r_nCONST_MSG_UNSUPPORTEDOPEROS8______________The_following_command_is_supported_on_Windows_8_and_above_only:___r_nCONST_MSG_UNSUPPORTEDLOCAL________________The_following_command_is_supported_on_local_machine_only:___r_nCONST_MSG_CREDENTIALERR___________________Passing_credentials_is_not_supported_for_this_command.__r_nCONST_MSG_SUCCESS_________________________Successfully_applied_setting.__r_nCONST_MSG_NOKMSLICS_______________________No_Office_KMS_licenses_were_found_on_the_system.__r_nCONST_MSG_ACTATTEMPT______________________Installed_product_key_detected___attempting_to_activate_the_following_product:__r_nCONST_MSG_TOKACTATTEMPT___________________Installed_product_key_detected___attempting_to_token_activate_the_following_product:__r_nCONST_MSG_NOKEYSINSTALLED__________________No_installed_product
mov rax, rbp
push rax
movabs rbp, 0x140281d06
mov rax, rbp
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.1400163b8
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.1400925c0
add rsp, 0x20
pop rcx
push rax
mov rax, 1
mov rax, rax
push rax
push qword [rsp + 0x50]
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
movabs rcx, 0x1401038ea
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
mov rcx, qword [0x140319dfc]
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
movabs rcx, str.____NoLogo__unpkey:BTDRB
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
call fcn.140092820
movabs rax, str.cscript.exe
push rax
push rax
call fcn.1400927f0
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001284f
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140041f24
add rsp, 0x28
pop rax
mov qword [rsp + 0x30], 1
movabs rax, str.Office16ProjectProR_
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jle 0x140020114
movabs rax, str.4f414197_0fc2_4c01_b68a_86cbb9ac254c
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jne 0x140020114
mov rax, 1
jmp 0x140020117
xor rax, rax
and rax, rax
je 0x140020229
movabs rax, str.lic16
push rax
movabs rax, str.ProjectProVL_
push rax
movabs rbp, str.Copyright__c__Microsoft_Corporation._All_rights_reserved._r_n_________________________________________________________________________________________r_n_________________________________________________________________________________________r_nCONST_wshOK_____________________________0_r_nCONST_VALUE_ICON_WARNING________________16_r_nCONST_wshYesNoDialog____________________4_r_nCONST_VALUE_ICON_QUESTIONMARK___________32_r_nCONST_VALUE_ICON_INFORMATION____________64_r_nCONST_HKEY_LOCAL_MACHINE________________H80000002_r_nCONST_KEY_SET_VALUE_____________________H0002_r_nCONST_KEY_QUERY_VALUE___________________H0001_r_nCONST_REG_SZ____________________________1_r_nCONST_OfficeAppId_________________________0ff1ce15_a989_479d_af46_f275c6370663__r_nCONST_STR_SYS32PATH_______________________:WindowsSystem32__r_nCONST_STR_OSPPREARMPATH___________________Microsoft_OfficeOffice16OSPPREARM.EXE__r_nCONST_STR_OSPPREARMPATH_DEBUG_____________Microsoft_Office_DebugOffice16OSPPREARM.EXE__r_nCONST_REG_OSPP____________________________SOFTWAREMicrosoftOfficeSoftwareProtectionPlatform__r_nCONST_STR_HEARTBEATPATH___________________MicrosoftOfficeHeartbeatHeartbeatCache.xml__r_nCONST_REG_SPP_____________________________SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatform__r_nCONST_REG_SCAEXP_BASE_____________________HKCUSOFTWAREMicrosoftOffice16.0CommonExperimentEcs__r_nCONST_REG_SCAEXP_END_______________________Flightsofc5juzsw45rcw0__r_nCONST_REG_SCAEXP_OVERRIDE_________________HKLMSOFTWAREMicrosoftOfficeCommonExperimentofc5juzsw45rcw0__r_nCONST_REG_SCAO15__________________________HKLMSOFTWAREMicrosoftOffice15.0ClickToRunConfigurationSharedComputerLicensing__r_nCONST_REG_SCAO16__________________________HKLMSOFTWAREMicrosoftOfficeClickToRunConfigurationSharedComputerLicensing__r_nCONST_VALUE_SCAEXP_FLAVOR_________________exp__r_nCONST_VALUE_SCAEXP_OVERRIDE_FLAVOR________expoverride__r_nCONST_VALUE_SCAO15_FLAVOR_________________o15__r_nCONST_VALUE_SCA016_FLAVOR_________________o16__r_nCONST_VALUE_SCAREGKEY_SINGLE_TYPE_________single__r_nCONST_VALUE_SCAREGKEY_PER_APP_TYPE________perapp__r_nCONST_VER_INFO____________________________Version_Info:_2016_1.0__r_n_________________________________________________________________________________________r_nCONST_MSG_NOREGRIGHTS_____________________Insufficient_rights_to_perform_operation.__r_nCONST_MSG_ISCMD_ELEVATED__________________Ensure_cmd.exe_is_elevated__right_click___run_as_administrator_.__r_nCONST_MSG_CREDENTIALFAILURE_______________Connection_failed_with_passed_credentials.__r_nCONST_MSG_FILENOTFOUND____________________File_not_found:___________________r_nCONST_MSG_SEPERATESMALL____________________________________r_nCONST_MSG_SEPERATE_________________________________________________________________r_nCONST_MSG_PROCESSING_________________________Processing____________________________r_nCONST_MSG_EXIT_______________________________Exiting_______________________________r_nCONST_MSG_UNSUPPORTED_____________________Unsupported_command_passed.__r_nCONST_MSG_UNSUPPORTEDOPEROS7______________The_following_command_is_supported_on_Windows_7_only:___r_nCONST_MSG_UNSUPPORTEDOPEROS8______________The_following_command_is_supported_on_Windows_8_and_above_only:___r_nCONST_MSG_UNSUPPORTEDLOCAL________________The_following_command_is_supported_on_local_machine_only:___r_nCONST_MSG_CREDENTIALERR___________________Passing_credentials_is_not_supported_for_this_command.__r_nCONST_MSG_SUCCESS_________________________Successfully_applied_setting.__r_nCONST_MSG_NOKMSLICS_______________________No_Office_KMS_licenses_were_found_on_the_system.__r_nCONST_MSG_ACTATTEMPT______________________Installed_product_key_detected___attempting_to_activate_the_following_product:__r_nCONST_MSG_TOKACTATTEMPT___________________Installed_product_key_detected___attempting_to_token_activate_the_following_product:__r_nCONST_MSG_NOKEYSINSTALLED__________________No_installed_product
mov rax, rbp
push rax
movabs rbp, 0x140281d06
mov rax, rbp
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.1400163b8
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.1400925c0
add rsp, 0x20
pop rcx
push rax
mov rax, 1
mov rax, rax
push rax
push qword [rsp + 0x50]
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
movabs rcx, 0x1401038ea
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
mov rcx, qword [0x140319dfc]
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
movabs rcx, str.____NoLogo__unpkey:92FK9
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
call fcn.140092820
movabs rax, str.cscript.exe
push rax
push rax
call fcn.1400927f0
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001284f
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140041f24
add rsp, 0x28
pop rax
mov qword [rsp + 0x30], 1
movabs rax, str.Office16VisioProR_
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jle 0x14002026e
movabs rax, str.6bf301c1_b94a_43e9_ba31_d494598c47fb
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jne 0x14002026e
mov rax, 1
jmp 0x140020271
xor rax, rax
and rax, rax
je 0x140020383
movabs rax, str.lic16
push rax
movabs rax, str.VisioProVL_
push rax
movabs rbp, str.Copyright__c__Microsoft_Corporation._All_rights_reserved._r_n_________________________________________________________________________________________r_n_________________________________________________________________________________________r_nCONST_wshOK_____________________________0_r_nCONST_VALUE_ICON_WARNING________________16_r_nCONST_wshYesNoDialog____________________4_r_nCONST_VALUE_ICON_QUESTIONMARK___________32_r_nCONST_VALUE_ICON_INFORMATION____________64_r_nCONST_HKEY_LOCAL_MACHINE________________H80000002_r_nCONST_KEY_SET_VALUE_____________________H0002_r_nCONST_KEY_QUERY_VALUE___________________H0001_r_nCONST_REG_SZ____________________________1_r_nCONST_OfficeAppId_________________________0ff1ce15_a989_479d_af46_f275c6370663__r_nCONST_STR_SYS32PATH_______________________:WindowsSystem32__r_nCONST_STR_OSPPREARMPATH___________________Microsoft_OfficeOffice16OSPPREARM.EXE__r_nCONST_STR_OSPPREARMPATH_DEBUG_____________Microsoft_Office_DebugOffice16OSPPREARM.EXE__r_nCONST_REG_OSPP____________________________SOFTWAREMicrosoftOfficeSoftwareProtectionPlatform__r_nCONST_STR_HEARTBEATPATH___________________MicrosoftOfficeHeartbeatHeartbeatCache.xml__r_nCONST_REG_SPP_____________________________SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatform__r_nCONST_REG_SCAEXP_BASE_____________________HKCUSOFTWAREMicrosoftOffice16.0CommonExperimentEcs__r_nCONST_REG_SCAEXP_END_______________________Flightsofc5juzsw45rcw0__r_nCONST_REG_SCAEXP_OVERRIDE_________________HKLMSOFTWAREMicrosoftOfficeCommonExperimentofc5juzsw45rcw0__r_nCONST_REG_SCAO15__________________________HKLMSOFTWAREMicrosoftOffice15.0ClickToRunConfigurationSharedComputerLicensing__r_nCONST_REG_SCAO16__________________________HKLMSOFTWAREMicrosoftOfficeClickToRunConfigurationSharedComputerLicensing__r_nCONST_VALUE_SCAEXP_FLAVOR_________________exp__r_nCONST_VALUE_SCAEXP_OVERRIDE_FLAVOR________expoverride__r_nCONST_VALUE_SCAO15_FLAVOR_________________o15__r_nCONST_VALUE_SCA016_FLAVOR_________________o16__r_nCONST_VALUE_SCAREGKEY_SINGLE_TYPE_________single__r_nCONST_VALUE_SCAREGKEY_PER_APP_TYPE________perapp__r_nCONST_VER_INFO____________________________Version_Info:_2016_1.0__r_n_________________________________________________________________________________________r_nCONST_MSG_NOREGRIGHTS_____________________Insufficient_rights_to_perform_operation.__r_nCONST_MSG_ISCMD_ELEVATED__________________Ensure_cmd.exe_is_elevated__right_click___run_as_administrator_.__r_nCONST_MSG_CREDENTIALFAILURE_______________Connection_failed_with_passed_credentials.__r_nCONST_MSG_FILENOTFOUND____________________File_not_found:___________________r_nCONST_MSG_SEPERATESMALL____________________________________r_nCONST_MSG_SEPERATE_________________________________________________________________r_nCONST_MSG_PROCESSING_________________________Processing____________________________r_nCONST_MSG_EXIT_______________________________Exiting_______________________________r_nCONST_MSG_UNSUPPORTED_____________________Unsupported_command_passed.__r_nCONST_MSG_UNSUPPORTEDOPEROS7______________The_following_command_is_supported_on_Windows_7_only:___r_nCONST_MSG_UNSUPPORTEDOPEROS8______________The_following_command_is_supported_on_Windows_8_and_above_only:___r_nCONST_MSG_UNSUPPORTEDLOCAL________________The_following_command_is_supported_on_local_machine_only:___r_nCONST_MSG_CREDENTIALERR___________________Passing_credentials_is_not_supported_for_this_command.__r_nCONST_MSG_SUCCESS_________________________Successfully_applied_setting.__r_nCONST_MSG_NOKMSLICS_______________________No_Office_KMS_licenses_were_found_on_the_system.__r_nCONST_MSG_ACTATTEMPT______________________Installed_product_key_detected___attempting_to_activate_the_following_product:__r_nCONST_MSG_TOKACTATTEMPT___________________Installed_product_key_detected___attempting_to_token_activate_the_following_product:__r_nCONST_MSG_NOKEYSINSTALLED__________________No_installed_product
mov rax, rbp
push rax
movabs rbp, 0x140281d06
mov rax, rbp
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.1400163b8
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.1400925c0
add rsp, 0x20
pop rcx
push rax
mov rax, 1
mov rax, rax
push rax
push qword [rsp + 0x50]
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
movabs rcx, 0x1401038ea
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
mov rcx, qword [0x140319dfc]
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
movabs rcx, str.____NoLogo__unpkey:F6YYT
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
call fcn.140092820
movabs rax, str.cscript.exe
push rax
push rax
call fcn.1400927f0
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001284f
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140041f24
add rsp, 0x28
pop rax
mov qword [rsp + 0x30], 1
movabs rax, str.Office16WordR_
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jle 0x1400203c8
movabs rax, str.bb11badf_d8aa_470e_9311_20eaf80fe5cc
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jne 0x1400203c8
mov rax, 1
jmp 0x1400203cb
xor rax, rax
and rax, rax
je 0x1400204dd
movabs rax, str.lic16
push rax
movabs rax, str.WordVL_
push rax
movabs rbp, str.Copyright__c__Microsoft_Corporation._All_rights_reserved._r_n_________________________________________________________________________________________r_n_________________________________________________________________________________________r_nCONST_wshOK_____________________________0_r_nCONST_VALUE_ICON_WARNING________________16_r_nCONST_wshYesNoDialog____________________4_r_nCONST_VALUE_ICON_QUESTIONMARK___________32_r_nCONST_VALUE_ICON_INFORMATION____________64_r_nCONST_HKEY_LOCAL_MACHINE________________H80000002_r_nCONST_KEY_SET_VALUE_____________________H0002_r_nCONST_KEY_QUERY_VALUE___________________H0001_r_nCONST_REG_SZ____________________________1_r_nCONST_OfficeAppId_________________________0ff1ce15_a989_479d_af46_f275c6370663__r_nCONST_STR_SYS32PATH_______________________:WindowsSystem32__r_nCONST_STR_OSPPREARMPATH___________________Microsoft_OfficeOffice16OSPPREARM.EXE__r_nCONST_STR_OSPPREARMPATH_DEBUG_____________Microsoft_Office_DebugOffice16OSPPREARM.EXE__r_nCONST_REG_OSPP____________________________SOFTWAREMicrosoftOfficeSoftwareProtectionPlatform__r_nCONST_STR_HEARTBEATPATH___________________MicrosoftOfficeHeartbeatHeartbeatCache.xml__r_nCONST_REG_SPP_____________________________SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatform__r_nCONST_REG_SCAEXP_BASE_____________________HKCUSOFTWAREMicrosoftOffice16.0CommonExperimentEcs__r_nCONST_REG_SCAEXP_END_______________________Flightsofc5juzsw45rcw0__r_nCONST_REG_SCAEXP_OVERRIDE_________________HKLMSOFTWAREMicrosoftOfficeCommonExperimentofc5juzsw45rcw0__r_nCONST_REG_SCAO15__________________________HKLMSOFTWAREMicrosoftOffice15.0ClickToRunConfigurationSharedComputerLicensing__r_nCONST_REG_SCAO16__________________________HKLMSOFTWAREMicrosoftOfficeClickToRunConfigurationSharedComputerLicensing__r_nCONST_VALUE_SCAEXP_FLAVOR_________________exp__r_nCONST_VALUE_SCAEXP_OVERRIDE_FLAVOR________expoverride__r_nCONST_VALUE_SCAO15_FLAVOR_________________o15__r_nCONST_VALUE_SCA016_FLAVOR_________________o16__r_nCONST_VALUE_SCAREGKEY_SINGLE_TYPE_________single__r_nCONST_VALUE_SCAREGKEY_PER_APP_TYPE________perapp__r_nCONST_VER_INFO____________________________Version_Info:_2016_1.0__r_n_________________________________________________________________________________________r_nCONST_MSG_NOREGRIGHTS_____________________Insufficient_rights_to_perform_operation.__r_nCONST_MSG_ISCMD_ELEVATED__________________Ensure_cmd.exe_is_elevated__right_click___run_as_administrator_.__r_nCONST_MSG_CREDENTIALFAILURE_______________Connection_failed_with_passed_credentials.__r_nCONST_MSG_FILENOTFOUND____________________File_not_found:___________________r_nCONST_MSG_SEPERATESMALL____________________________________r_nCONST_MSG_SEPERATE_________________________________________________________________r_nCONST_MSG_PROCESSING_________________________Processing____________________________r_nCONST_MSG_EXIT_______________________________Exiting_______________________________r_nCONST_MSG_UNSUPPORTED_____________________Unsupported_command_passed.__r_nCONST_MSG_UNSUPPORTEDOPEROS7______________The_following_command_is_supported_on_Windows_7_only:___r_nCONST_MSG_UNSUPPORTEDOPEROS8______________The_following_command_is_supported_on_Windows_8_and_above_only:___r_nCONST_MSG_UNSUPPORTEDLOCAL________________The_following_command_is_supported_on_local_machine_only:___r_nCONST_MSG_CREDENTIALERR___________________Passing_credentials_is_not_supported_for_this_command.__r_nCONST_MSG_SUCCESS_________________________Successfully_applied_setting.__r_nCONST_MSG_NOKMSLICS_______________________No_Office_KMS_licenses_were_found_on_the_system.__r_nCONST_MSG_ACTATTEMPT______________________Installed_product_key_detected___attempting_to_activate_the_following_product:__r_nCONST_MSG_TOKACTATTEMPT___________________Installed_product_key_detected___attempting_to_token_activate_the_following_product:__r_nCONST_MSG_NOKEYSINSTALLED__________________No_installed_product
mov rax, rbp
push rax
movabs rbp, 0x140281d06
mov rax, rbp
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.1400163b8
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.1400925c0
add rsp, 0x20
pop rcx
push rax
mov rax, 1
mov rax, rax
push rax
push qword [rsp + 0x50]
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
movabs rcx, 0x1401038ea
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
mov rcx, qword [0x140319dfc]
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
movabs rcx, str.____NoLogo__unpkey:YG92Y
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
call fcn.140092820
movabs rax, str.cscript.exe
push rax
push rax
call fcn.1400927f0
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001284f
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140041f24
add rsp, 0x28
pop rax
mov qword [rsp + 0x30], 1
movabs rax, str.Office16ExcelR_
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jle 0x140020522
movabs rax, str.c3e65d36_141f_4d2f_a303_a842ee756a29
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jne 0x140020522
mov rax, 1
jmp 0x140020525
xor rax, rax
and rax, rax
je 0x140020637
movabs rax, str.lic16
push rax
movabs rax, str.ExcelVL_
push rax
movabs rbp, str.Copyright__c__Microsoft_Corporation._All_rights_reserved._r_n_________________________________________________________________________________________r_n_________________________________________________________________________________________r_nCONST_wshOK_____________________________0_r_nCONST_VALUE_ICON_WARNING________________16_r_nCONST_wshYesNoDialog____________________4_r_nCONST_VALUE_ICON_QUESTIONMARK___________32_r_nCONST_VALUE_ICON_INFORMATION____________64_r_nCONST_HKEY_LOCAL_MACHINE________________H80000002_r_nCONST_KEY_SET_VALUE_____________________H0002_r_nCONST_KEY_QUERY_VALUE___________________H0001_r_nCONST_REG_SZ____________________________1_r_nCONST_OfficeAppId_________________________0ff1ce15_a989_479d_af46_f275c6370663__r_nCONST_STR_SYS32PATH_______________________:WindowsSystem32__r_nCONST_STR_OSPPREARMPATH___________________Microsoft_OfficeOffice16OSPPREARM.EXE__r_nCONST_STR_OSPPREARMPATH_DEBUG_____________Microsoft_Office_DebugOffice16OSPPREARM.EXE__r_nCONST_REG_OSPP____________________________SOFTWAREMicrosoftOfficeSoftwareProtectionPlatform__r_nCONST_STR_HEARTBEATPATH___________________MicrosoftOfficeHeartbeatHeartbeatCache.xml__r_nCONST_REG_SPP_____________________________SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatform__r_nCONST_REG_SCAEXP_BASE_____________________HKCUSOFTWAREMicrosoftOffice16.0CommonExperimentEcs__r_nCONST_REG_SCAEXP_END_______________________Flightsofc5juzsw45rcw0__r_nCONST_REG_SCAEXP_OVERRIDE_________________HKLMSOFTWAREMicrosoftOfficeCommonExperimentofc5juzsw45rcw0__r_nCONST_REG_SCAO15__________________________HKLMSOFTWAREMicrosoftOffice15.0ClickToRunConfigurationSharedComputerLicensing__r_nCONST_REG_SCAO16__________________________HKLMSOFTWAREMicrosoftOfficeClickToRunConfigurationSharedComputerLicensing__r_nCONST_VALUE_SCAEXP_FLAVOR_________________exp__r_nCONST_VALUE_SCAEXP_OVERRIDE_FLAVOR________expoverride__r_nCONST_VALUE_SCAO15_FLAVOR_________________o15__r_nCONST_VALUE_SCA016_FLAVOR_________________o16__r_nCONST_VALUE_SCAREGKEY_SINGLE_TYPE_________single__r_nCONST_VALUE_SCAREGKEY_PER_APP_TYPE________perapp__r_nCONST_VER_INFO____________________________Version_Info:_2016_1.0__r_n_________________________________________________________________________________________r_nCONST_MSG_NOREGRIGHTS_____________________Insufficient_rights_to_perform_operation.__r_nCONST_MSG_ISCMD_ELEVATED__________________Ensure_cmd.exe_is_elevated__right_click___run_as_administrator_.__r_nCONST_MSG_CREDENTIALFAILURE_______________Connection_failed_with_passed_credentials.__r_nCONST_MSG_FILENOTFOUND____________________File_not_found:___________________r_nCONST_MSG_SEPERATESMALL____________________________________r_nCONST_MSG_SEPERATE_________________________________________________________________r_nCONST_MSG_PROCESSING_________________________Processing____________________________r_nCONST_MSG_EXIT_______________________________Exiting_______________________________r_nCONST_MSG_UNSUPPORTED_____________________Unsupported_command_passed.__r_nCONST_MSG_UNSUPPORTEDOPEROS7______________The_following_command_is_supported_on_Windows_7_only:___r_nCONST_MSG_UNSUPPORTEDOPEROS8______________The_following_command_is_supported_on_Windows_8_and_above_only:___r_nCONST_MSG_UNSUPPORTEDLOCAL________________The_following_command_is_supported_on_local_machine_only:___r_nCONST_MSG_CREDENTIALERR___________________Passing_credentials_is_not_supported_for_this_command.__r_nCONST_MSG_SUCCESS_________________________Successfully_applied_setting.__r_nCONST_MSG_NOKMSLICS_______________________No_Office_KMS_licenses_were_found_on_the_system.__r_nCONST_MSG_ACTATTEMPT______________________Installed_product_key_detected___attempting_to_activate_the_following_product:__r_nCONST_MSG_TOKACTATTEMPT___________________Installed_product_key_detected___attempting_to_token_activate_the_following_product:__r_nCONST_MSG_NOKEYSINSTALLED__________________No_installed_product
mov rax, rbp
push rax
movabs rbp, 0x140281d06
mov rax, rbp
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.1400163b8
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.1400925c0
add rsp, 0x20
pop rcx
push rax
mov rax, 1
mov rax, rax
push rax
push qword [rsp + 0x50]
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
movabs rcx, 0x1401038ea
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
mov rcx, qword [0x140319dfc]
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
movabs rcx, str.____NoLogo__unpkey:RGDRJ
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
call fcn.140092820
movabs rax, str.cscript.exe
push rax
push rax
call fcn.1400927f0
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001284f
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140041f24
add rsp, 0x28
pop rax
mov qword [rsp + 0x30], 1
movabs rax, str.Office16MondoR_
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jle 0x14002067c
movabs rax, str.d450596f_894d_49e0_966a_fd39ed4c4c64
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jne 0x14002067c
mov rax, 1
jmp 0x14002067f
xor rax, rax
and rax, rax
je 0x140020791
movabs rax, str.lic16
push rax
movabs rax, str.MondoVL_
push rax
movabs rbp, str.Copyright__c__Microsoft_Corporation._All_rights_reserved._r_n_________________________________________________________________________________________r_n_________________________________________________________________________________________r_nCONST_wshOK_____________________________0_r_nCONST_VALUE_ICON_WARNING________________16_r_nCONST_wshYesNoDialog____________________4_r_nCONST_VALUE_ICON_QUESTIONMARK___________32_r_nCONST_VALUE_ICON_INFORMATION____________64_r_nCONST_HKEY_LOCAL_MACHINE________________H80000002_r_nCONST_KEY_SET_VALUE_____________________H0002_r_nCONST_KEY_QUERY_VALUE___________________H0001_r_nCONST_REG_SZ____________________________1_r_nCONST_OfficeAppId_________________________0ff1ce15_a989_479d_af46_f275c6370663__r_nCONST_STR_SYS32PATH_______________________:WindowsSystem32__r_nCONST_STR_OSPPREARMPATH___________________Microsoft_OfficeOffice16OSPPREARM.EXE__r_nCONST_STR_OSPPREARMPATH_DEBUG_____________Microsoft_Office_DebugOffice16OSPPREARM.EXE__r_nCONST_REG_OSPP____________________________SOFTWAREMicrosoftOfficeSoftwareProtectionPlatform__r_nCONST_STR_HEARTBEATPATH___________________MicrosoftOfficeHeartbeatHeartbeatCache.xml__r_nCONST_REG_SPP_____________________________SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatform__r_nCONST_REG_SCAEXP_BASE_____________________HKCUSOFTWAREMicrosoftOffice16.0CommonExperimentEcs__r_nCONST_REG_SCAEXP_END_______________________Flightsofc5juzsw45rcw0__r_nCONST_REG_SCAEXP_OVERRIDE_________________HKLMSOFTWAREMicrosoftOfficeCommonExperimentofc5juzsw45rcw0__r_nCONST_REG_SCAO15__________________________HKLMSOFTWAREMicrosoftOffice15.0ClickToRunConfigurationSharedComputerLicensing__r_nCONST_REG_SCAO16__________________________HKLMSOFTWAREMicrosoftOfficeClickToRunConfigurationSharedComputerLicensing__r_nCONST_VALUE_SCAEXP_FLAVOR_________________exp__r_nCONST_VALUE_SCAEXP_OVERRIDE_FLAVOR________expoverride__r_nCONST_VALUE_SCAO15_FLAVOR_________________o15__r_nCONST_VALUE_SCA016_FLAVOR_________________o16__r_nCONST_VALUE_SCAREGKEY_SINGLE_TYPE_________single__r_nCONST_VALUE_SCAREGKEY_PER_APP_TYPE________perapp__r_nCONST_VER_INFO____________________________Version_Info:_2016_1.0__r_n_________________________________________________________________________________________r_nCONST_MSG_NOREGRIGHTS_____________________Insufficient_rights_to_perform_operation.__r_nCONST_MSG_ISCMD_ELEVATED__________________Ensure_cmd.exe_is_elevated__right_click___run_as_administrator_.__r_nCONST_MSG_CREDENTIALFAILURE_______________Connection_failed_with_passed_credentials.__r_nCONST_MSG_FILENOTFOUND____________________File_not_found:___________________r_nCONST_MSG_SEPERATESMALL____________________________________r_nCONST_MSG_SEPERATE_________________________________________________________________r_nCONST_MSG_PROCESSING_________________________Processing____________________________r_nCONST_MSG_EXIT_______________________________Exiting_______________________________r_nCONST_MSG_UNSUPPORTED_____________________Unsupported_command_passed.__r_nCONST_MSG_UNSUPPORTEDOPEROS7______________The_following_command_is_supported_on_Windows_7_only:___r_nCONST_MSG_UNSUPPORTEDOPEROS8______________The_following_command_is_supported_on_Windows_8_and_above_only:___r_nCONST_MSG_UNSUPPORTEDLOCAL________________The_following_command_is_supported_on_local_machine_only:___r_nCONST_MSG_CREDENTIALERR___________________Passing_credentials_is_not_supported_for_this_command.__r_nCONST_MSG_SUCCESS_________________________Successfully_applied_setting.__r_nCONST_MSG_NOKMSLICS_______________________No_Office_KMS_licenses_were_found_on_the_system.__r_nCONST_MSG_ACTATTEMPT______________________Installed_product_key_detected___attempting_to_activate_the_following_product:__r_nCONST_MSG_TOKACTATTEMPT___________________Installed_product_key_detected___attempting_to_token_activate_the_following_product:__r_nCONST_MSG_NOKEYSINSTALLED__________________No_installed_product
mov rax, rbp
push rax
movabs rbp, 0x140281d06
mov rax, rbp
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.1400163b8
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.1400925c0
add rsp, 0x20
pop rcx
push rax
mov rax, 1
mov rax, rax
push rax
push qword [rsp + 0x50]
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
movabs rcx, 0x1401038ea
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
mov rcx, qword [0x140319dfc]
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
movabs rcx, str.____NoLogo__unpkey:7H7DH
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
call fcn.140092820
movabs rax, str.cscript.exe
push rax
push rax
call fcn.1400927f0
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001284f
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140041f24
add rsp, 0x28
pop rax
mov qword [rsp + 0x30], 1
movabs rax, str.Office16PowerPointR_
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jle 0x1400207d6
movabs rax, str.d70b1bba_b893_4544_96e2_b7a318091c33
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jne 0x1400207d6
mov rax, 1
jmp 0x1400207d9
xor rax, rax
and rax, rax
je 0x1400208eb
movabs rax, str.lic16
push rax
movabs rax, str.PowerPointVL_
push rax
movabs rbp, str.Copyright__c__Microsoft_Corporation._All_rights_reserved._r_n_________________________________________________________________________________________r_n_________________________________________________________________________________________r_nCONST_wshOK_____________________________0_r_nCONST_VALUE_ICON_WARNING________________16_r_nCONST_wshYesNoDialog____________________4_r_nCONST_VALUE_ICON_QUESTIONMARK___________32_r_nCONST_VALUE_ICON_INFORMATION____________64_r_nCONST_HKEY_LOCAL_MACHINE________________H80000002_r_nCONST_KEY_SET_VALUE_____________________H0002_r_nCONST_KEY_QUERY_VALUE___________________H0001_r_nCONST_REG_SZ____________________________1_r_nCONST_OfficeAppId_________________________0ff1ce15_a989_479d_af46_f275c6370663__r_nCONST_STR_SYS32PATH_______________________:WindowsSystem32__r_nCONST_STR_OSPPREARMPATH___________________Microsoft_OfficeOffice16OSPPREARM.EXE__r_nCONST_STR_OSPPREARMPATH_DEBUG_____________Microsoft_Office_DebugOffice16OSPPREARM.EXE__r_nCONST_REG_OSPP____________________________SOFTWAREMicrosoftOfficeSoftwareProtectionPlatform__r_nCONST_STR_HEARTBEATPATH___________________MicrosoftOfficeHeartbeatHeartbeatCache.xml__r_nCONST_REG_SPP_____________________________SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatform__r_nCONST_REG_SCAEXP_BASE_____________________HKCUSOFTWAREMicrosoftOffice16.0CommonExperimentEcs__r_nCONST_REG_SCAEXP_END_______________________Flightsofc5juzsw45rcw0__r_nCONST_REG_SCAEXP_OVERRIDE_________________HKLMSOFTWAREMicrosoftOfficeCommonExperimentofc5juzsw45rcw0__r_nCONST_REG_SCAO15__________________________HKLMSOFTWAREMicrosoftOffice15.0ClickToRunConfigurationSharedComputerLicensing__r_nCONST_REG_SCAO16__________________________HKLMSOFTWAREMicrosoftOfficeClickToRunConfigurationSharedComputerLicensing__r_nCONST_VALUE_SCAEXP_FLAVOR_________________exp__r_nCONST_VALUE_SCAEXP_OVERRIDE_FLAVOR________expoverride__r_nCONST_VALUE_SCAO15_FLAVOR_________________o15__r_nCONST_VALUE_SCA016_FLAVOR_________________o16__r_nCONST_VALUE_SCAREGKEY_SINGLE_TYPE_________single__r_nCONST_VALUE_SCAREGKEY_PER_APP_TYPE________perapp__r_nCONST_VER_INFO____________________________Version_Info:_2016_1.0__r_n_________________________________________________________________________________________r_nCONST_MSG_NOREGRIGHTS_____________________Insufficient_rights_to_perform_operation.__r_nCONST_MSG_ISCMD_ELEVATED__________________Ensure_cmd.exe_is_elevated__right_click___run_as_administrator_.__r_nCONST_MSG_CREDENTIALFAILURE_______________Connection_failed_with_passed_credentials.__r_nCONST_MSG_FILENOTFOUND____________________File_not_found:___________________r_nCONST_MSG_SEPERATESMALL____________________________________r_nCONST_MSG_SEPERATE_________________________________________________________________r_nCONST_MSG_PROCESSING_________________________Processing____________________________r_nCONST_MSG_EXIT_______________________________Exiting_______________________________r_nCONST_MSG_UNSUPPORTED_____________________Unsupported_command_passed.__r_nCONST_MSG_UNSUPPORTEDOPEROS7______________The_following_command_is_supported_on_Windows_7_only:___r_nCONST_MSG_UNSUPPORTEDOPEROS8______________The_following_command_is_supported_on_Windows_8_and_above_only:___r_nCONST_MSG_UNSUPPORTEDLOCAL________________The_following_command_is_supported_on_local_machine_only:___r_nCONST_MSG_CREDENTIALERR___________________Passing_credentials_is_not_supported_for_this_command.__r_nCONST_MSG_SUCCESS_________________________Successfully_applied_setting.__r_nCONST_MSG_NOKMSLICS_______________________No_Office_KMS_licenses_were_found_on_the_system.__r_nCONST_MSG_ACTATTEMPT______________________Installed_product_key_detected___attempting_to_activate_the_following_product:__r_nCONST_MSG_TOKACTATTEMPT___________________Installed_product_key_detected___attempting_to_token_activate_the_following_product:__r_nCONST_MSG_NOKEYSINSTALLED__________________No_installed_product
mov rax, rbp
push rax
movabs rbp, 0x140281d06
mov rax, rbp
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.1400163b8
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.1400925c0
add rsp, 0x20
pop rcx
push rax
mov rax, 1
mov rax, rax
push rax
push qword [rsp + 0x50]
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
movabs rcx, 0x1401038ea
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
mov rcx, qword [0x140319dfc]
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
movabs rcx, str.____NoLogo__unpkey:BDW7J
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
call fcn.140092820
movabs rax, str.cscript.exe
push rax
push rax
call fcn.1400927f0
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001284f
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140041f24
add rsp, 0x28
pop rax
mov qword [rsp + 0x30], 1
movabs rax, str.Office16AccessR_
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jle 0x140020930
movabs rax, str.67c0fc0c_deba_401b_bf8b_9c8ad8395804
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jne 0x140020930
mov rax, 1
jmp 0x140020933
xor rax, rax
and rax, rax
je 0x140020a45
movabs rax, str.lic16
push rax
movabs rax, str.AccessVL_
push rax
movabs rbp, str.Copyright__c__Microsoft_Corporation._All_rights_reserved._r_n_________________________________________________________________________________________r_n_________________________________________________________________________________________r_nCONST_wshOK_____________________________0_r_nCONST_VALUE_ICON_WARNING________________16_r_nCONST_wshYesNoDialog____________________4_r_nCONST_VALUE_ICON_QUESTIONMARK___________32_r_nCONST_VALUE_ICON_INFORMATION____________64_r_nCONST_HKEY_LOCAL_MACHINE________________H80000002_r_nCONST_KEY_SET_VALUE_____________________H0002_r_nCONST_KEY_QUERY_VALUE___________________H0001_r_nCONST_REG_SZ____________________________1_r_nCONST_OfficeAppId_________________________0ff1ce15_a989_479d_af46_f275c6370663__r_nCONST_STR_SYS32PATH_______________________:WindowsSystem32__r_nCONST_STR_OSPPREARMPATH___________________Microsoft_OfficeOffice16OSPPREARM.EXE__r_nCONST_STR_OSPPREARMPATH_DEBUG_____________Microsoft_Office_DebugOffice16OSPPREARM.EXE__r_nCONST_REG_OSPP____________________________SOFTWAREMicrosoftOfficeSoftwareProtectionPlatform__r_nCONST_STR_HEARTBEATPATH___________________MicrosoftOfficeHeartbeatHeartbeatCache.xml__r_nCONST_REG_SPP_____________________________SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatform__r_nCONST_REG_SCAEXP_BASE_____________________HKCUSOFTWAREMicrosoftOffice16.0CommonExperimentEcs__r_nCONST_REG_SCAEXP_END_______________________Flightsofc5juzsw45rcw0__r_nCONST_REG_SCAEXP_OVERRIDE_________________HKLMSOFTWAREMicrosoftOfficeCommonExperimentofc5juzsw45rcw0__r_nCONST_REG_SCAO15__________________________HKLMSOFTWAREMicrosoftOffice15.0ClickToRunConfigurationSharedComputerLicensing__r_nCONST_REG_SCAO16__________________________HKLMSOFTWAREMicrosoftOfficeClickToRunConfigurationSharedComputerLicensing__r_nCONST_VALUE_SCAEXP_FLAVOR_________________exp__r_nCONST_VALUE_SCAEXP_OVERRIDE_FLAVOR________expoverride__r_nCONST_VALUE_SCAO15_FLAVOR_________________o15__r_nCONST_VALUE_SCA016_FLAVOR_________________o16__r_nCONST_VALUE_SCAREGKEY_SINGLE_TYPE_________single__r_nCONST_VALUE_SCAREGKEY_PER_APP_TYPE________perapp__r_nCONST_VER_INFO____________________________Version_Info:_2016_1.0__r_n_________________________________________________________________________________________r_nCONST_MSG_NOREGRIGHTS_____________________Insufficient_rights_to_perform_operation.__r_nCONST_MSG_ISCMD_ELEVATED__________________Ensure_cmd.exe_is_elevated__right_click___run_as_administrator_.__r_nCONST_MSG_CREDENTIALFAILURE_______________Connection_failed_with_passed_credentials.__r_nCONST_MSG_FILENOTFOUND____________________File_not_found:___________________r_nCONST_MSG_SEPERATESMALL____________________________________r_nCONST_MSG_SEPERATE_________________________________________________________________r_nCONST_MSG_PROCESSING_________________________Processing____________________________r_nCONST_MSG_EXIT_______________________________Exiting_______________________________r_nCONST_MSG_UNSUPPORTED_____________________Unsupported_command_passed.__r_nCONST_MSG_UNSUPPORTEDOPEROS7______________The_following_command_is_supported_on_Windows_7_only:___r_nCONST_MSG_UNSUPPORTEDOPEROS8______________The_following_command_is_supported_on_Windows_8_and_above_only:___r_nCONST_MSG_UNSUPPORTEDLOCAL________________The_following_command_is_supported_on_local_machine_only:___r_nCONST_MSG_CREDENTIALERR___________________Passing_credentials_is_not_supported_for_this_command.__r_nCONST_MSG_SUCCESS_________________________Successfully_applied_setting.__r_nCONST_MSG_NOKMSLICS_______________________No_Office_KMS_licenses_were_found_on_the_system.__r_nCONST_MSG_ACTATTEMPT______________________Installed_product_key_detected___attempting_to_activate_the_following_product:__r_nCONST_MSG_TOKACTATTEMPT___________________Installed_product_key_detected___attempting_to_token_activate_the_following_product:__r_nCONST_MSG_NOKEYSINSTALLED__________________No_installed_product
mov rax, rbp
push rax
movabs rbp, 0x140281d06
mov rax, rbp
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.1400163b8
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.1400925c0
add rsp, 0x20
pop rcx
push rax
mov rax, 1
mov rax, rax
push rax
push qword [rsp + 0x50]
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
movabs rcx, 0x1401038ea
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
mov rcx, qword [0x140319dfc]
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
movabs rcx, str.____NoLogo__unpkey:P379P
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
call fcn.140092820
movabs rax, str.cscript.exe
push rax
push rax
call fcn.1400927f0
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001284f
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140041f24
add rsp, 0x28
pop rax
mov qword [rsp + 0x30], 1
movabs rax, str.Office16PublisherR_
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jle 0x140020a8a
movabs rax, str.041a06cb_c5b8_4772_809f_416d03d16654
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jne 0x140020a8a
mov rax, 1
jmp 0x140020a8d
xor rax, rax
and rax, rax
je 0x140020b9f
movabs rax, str.lic16
push rax
movabs rax, str.PublisherVL_
push rax
movabs rbp, str.Copyright__c__Microsoft_Corporation._All_rights_reserved._r_n_________________________________________________________________________________________r_n_________________________________________________________________________________________r_nCONST_wshOK_____________________________0_r_nCONST_VALUE_ICON_WARNING________________16_r_nCONST_wshYesNoDialog____________________4_r_nCONST_VALUE_ICON_QUESTIONMARK___________32_r_nCONST_VALUE_ICON_INFORMATION____________64_r_nCONST_HKEY_LOCAL_MACHINE________________H80000002_r_nCONST_KEY_SET_VALUE_____________________H0002_r_nCONST_KEY_QUERY_VALUE___________________H0001_r_nCONST_REG_SZ____________________________1_r_nCONST_OfficeAppId_________________________0ff1ce15_a989_479d_af46_f275c6370663__r_nCONST_STR_SYS32PATH_______________________:WindowsSystem32__r_nCONST_STR_OSPPREARMPATH___________________Microsoft_OfficeOffice16OSPPREARM.EXE__r_nCONST_STR_OSPPREARMPATH_DEBUG_____________Microsoft_Office_DebugOffice16OSPPREARM.EXE__r_nCONST_REG_OSPP____________________________SOFTWAREMicrosoftOfficeSoftwareProtectionPlatform__r_nCONST_STR_HEARTBEATPATH___________________MicrosoftOfficeHeartbeatHeartbeatCache.xml__r_nCONST_REG_SPP_____________________________SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatform__r_nCONST_REG_SCAEXP_BASE_____________________HKCUSOFTWAREMicrosoftOffice16.0CommonExperimentEcs__r_nCONST_REG_SCAEXP_END_______________________Flightsofc5juzsw45rcw0__r_nCONST_REG_SCAEXP_OVERRIDE_________________HKLMSOFTWAREMicrosoftOfficeCommonExperimentofc5juzsw45rcw0__r_nCONST_REG_SCAO15__________________________HKLMSOFTWAREMicrosoftOffice15.0ClickToRunConfigurationSharedComputerLicensing__r_nCONST_REG_SCAO16__________________________HKLMSOFTWAREMicrosoftOfficeClickToRunConfigurationSharedComputerLicensing__r_nCONST_VALUE_SCAEXP_FLAVOR_________________exp__r_nCONST_VALUE_SCAEXP_OVERRIDE_FLAVOR________expoverride__r_nCONST_VALUE_SCAO15_FLAVOR_________________o15__r_nCONST_VALUE_SCA016_FLAVOR_________________o16__r_nCONST_VALUE_SCAREGKEY_SINGLE_TYPE_________single__r_nCONST_VALUE_SCAREGKEY_PER_APP_TYPE________perapp__r_nCONST_VER_INFO____________________________Version_Info:_2016_1.0__r_n_________________________________________________________________________________________r_nCONST_MSG_NOREGRIGHTS_____________________Insufficient_rights_to_perform_operation.__r_nCONST_MSG_ISCMD_ELEVATED__________________Ensure_cmd.exe_is_elevated__right_click___run_as_administrator_.__r_nCONST_MSG_CREDENTIALFAILURE_______________Connection_failed_with_passed_credentials.__r_nCONST_MSG_FILENOTFOUND____________________File_not_found:___________________r_nCONST_MSG_SEPERATESMALL____________________________________r_nCONST_MSG_SEPERATE_________________________________________________________________r_nCONST_MSG_PROCESSING_________________________Processing____________________________r_nCONST_MSG_EXIT_______________________________Exiting_______________________________r_nCONST_MSG_UNSUPPORTED_____________________Unsupported_command_passed.__r_nCONST_MSG_UNSUPPORTEDOPEROS7______________The_following_command_is_supported_on_Windows_7_only:___r_nCONST_MSG_UNSUPPORTEDOPEROS8______________The_following_command_is_supported_on_Windows_8_and_above_only:___r_nCONST_MSG_UNSUPPORTEDLOCAL________________The_following_command_is_supported_on_local_machine_only:___r_nCONST_MSG_CREDENTIALERR___________________Passing_credentials_is_not_supported_for_this_command.__r_nCONST_MSG_SUCCESS_________________________Successfully_applied_setting.__r_nCONST_MSG_NOKMSLICS_______________________No_Office_KMS_licenses_were_found_on_the_system.__r_nCONST_MSG_ACTATTEMPT______________________Installed_product_key_detected___attempting_to_activate_the_following_product:__r_nCONST_MSG_TOKACTATTEMPT___________________Installed_product_key_detected___attempting_to_token_activate_the_following_product:__r_nCONST_MSG_NOKEYSINSTALLED__________________No_installed_product
mov rax, rbp
push rax
movabs rbp, 0x140281d06
mov rax, rbp
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.1400163b8
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.1400925c0
add rsp, 0x20
pop rcx
push rax
mov rax, 1
mov rax, rax
push rax
push qword [rsp + 0x50]
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
movabs rcx, 0x1401038ea
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
mov rcx, qword [0x140319dfc]
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
movabs rcx, str.____NoLogo__unpkey:GMVFC
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
call fcn.140092820
movabs rax, str.cscript.exe
push rax
push rax
call fcn.1400927f0
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001284f
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140041f24
add rsp, 0x28
pop rax
mov qword [rsp + 0x30], 1
movabs rax, str.Office16OneNoteR_
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jle 0x140020be4
movabs rax, str.d8cace59_33d2_4ac7_9b1b_9b72339c51c8
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jne 0x140020be4
mov rax, 1
jmp 0x140020be7
xor rax, rax
and rax, rax
je 0x140020cf9
movabs rax, str.lic16
push rax
movabs rax, 0x1401032fc
push rax
movabs rbp, str.Copyright__c__Microsoft_Corporation._All_rights_reserved._r_n_________________________________________________________________________________________r_n_________________________________________________________________________________________r_nCONST_wshOK_____________________________0_r_nCONST_VALUE_ICON_WARNING________________16_r_nCONST_wshYesNoDialog____________________4_r_nCONST_VALUE_ICON_QUESTIONMARK___________32_r_nCONST_VALUE_ICON_INFORMATION____________64_r_nCONST_HKEY_LOCAL_MACHINE________________H80000002_r_nCONST_KEY_SET_VALUE_____________________H0002_r_nCONST_KEY_QUERY_VALUE___________________H0001_r_nCONST_REG_SZ____________________________1_r_nCONST_OfficeAppId_________________________0ff1ce15_a989_479d_af46_f275c6370663__r_nCONST_STR_SYS32PATH_______________________:WindowsSystem32__r_nCONST_STR_OSPPREARMPATH___________________Microsoft_OfficeOffice16OSPPREARM.EXE__r_nCONST_STR_OSPPREARMPATH_DEBUG_____________Microsoft_Office_DebugOffice16OSPPREARM.EXE__r_nCONST_REG_OSPP____________________________SOFTWAREMicrosoftOfficeSoftwareProtectionPlatform__r_nCONST_STR_HEARTBEATPATH___________________MicrosoftOfficeHeartbeatHeartbeatCache.xml__r_nCONST_REG_SPP_____________________________SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatform__r_nCONST_REG_SCAEXP_BASE_____________________HKCUSOFTWAREMicrosoftOffice16.0CommonExperimentEcs__r_nCONST_REG_SCAEXP_END_______________________Flightsofc5juzsw45rcw0__r_nCONST_REG_SCAEXP_OVERRIDE_________________HKLMSOFTWAREMicrosoftOfficeCommonExperimentofc5juzsw45rcw0__r_nCONST_REG_SCAO15__________________________HKLMSOFTWAREMicrosoftOffice15.0ClickToRunConfigurationSharedComputerLicensing__r_nCONST_REG_SCAO16__________________________HKLMSOFTWAREMicrosoftOfficeClickToRunConfigurationSharedComputerLicensing__r_nCONST_VALUE_SCAEXP_FLAVOR_________________exp__r_nCONST_VALUE_SCAEXP_OVERRIDE_FLAVOR________expoverride__r_nCONST_VALUE_SCAO15_FLAVOR_________________o15__r_nCONST_VALUE_SCA016_FLAVOR_________________o16__r_nCONST_VALUE_SCAREGKEY_SINGLE_TYPE_________single__r_nCONST_VALUE_SCAREGKEY_PER_APP_TYPE________perapp__r_nCONST_VER_INFO____________________________Version_Info:_2016_1.0__r_n_________________________________________________________________________________________r_nCONST_MSG_NOREGRIGHTS_____________________Insufficient_rights_to_perform_operation.__r_nCONST_MSG_ISCMD_ELEVATED__________________Ensure_cmd.exe_is_elevated__right_click___run_as_administrator_.__r_nCONST_MSG_CREDENTIALFAILURE_______________Connection_failed_with_passed_credentials.__r_nCONST_MSG_FILENOTFOUND____________________File_not_found:___________________r_nCONST_MSG_SEPERATESMALL____________________________________r_nCONST_MSG_SEPERATE_________________________________________________________________r_nCONST_MSG_PROCESSING_________________________Processing____________________________r_nCONST_MSG_EXIT_______________________________Exiting_______________________________r_nCONST_MSG_UNSUPPORTED_____________________Unsupported_command_passed.__r_nCONST_MSG_UNSUPPORTEDOPEROS7______________The_following_command_is_supported_on_Windows_7_only:___r_nCONST_MSG_UNSUPPORTEDOPEROS8______________The_following_command_is_supported_on_Windows_8_and_above_only:___r_nCONST_MSG_UNSUPPORTEDLOCAL________________The_following_command_is_supported_on_local_machine_only:___r_nCONST_MSG_CREDENTIALERR___________________Passing_credentials_is_not_supported_for_this_command.__r_nCONST_MSG_SUCCESS_________________________Successfully_applied_setting.__r_nCONST_MSG_NOKMSLICS_______________________No_Office_KMS_licenses_were_found_on_the_system.__r_nCONST_MSG_ACTATTEMPT______________________Installed_product_key_detected___attempting_to_activate_the_following_product:__r_nCONST_MSG_TOKACTATTEMPT___________________Installed_product_key_detected___attempting_to_token_activate_the_following_product:__r_nCONST_MSG_NOKEYSINSTALLED__________________No_installed_product
mov rax, rbp
push rax
movabs rbp, 0x140281d06
mov rax, rbp
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.1400163b8
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.1400925c0
add rsp, 0x20
pop rcx
push rax
mov rax, 1
mov rax, rax
push rax
push qword [rsp + 0x50]
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
movabs rcx, 0x1401038ea
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
mov rcx, qword [0x140319dfc]
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
movabs rcx, str.____NoLogo__unpkey:94THG
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
call fcn.140092820
movabs rax, str.cscript.exe
push rax
push rax
call fcn.1400927f0
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001284f
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140041f24
add rsp, 0x28
pop rax
mov qword [rsp + 0x30], 1
movabs rax, str.Office16OutlookR_
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jle 0x140020d3e
movabs rax, str.ec9d9265_9d1e_4ed0_838a_cdc20f2551a1
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jne 0x140020d3e
mov rax, 1
jmp 0x140020d41
xor rax, rax
and rax, rax
je 0x140020e53
movabs rax, str.lic16
push rax
movabs rax, str.OutlookVL_
push rax
movabs rbp, str.Copyright__c__Microsoft_Corporation._All_rights_reserved._r_n_________________________________________________________________________________________r_n_________________________________________________________________________________________r_nCONST_wshOK_____________________________0_r_nCONST_VALUE_ICON_WARNING________________16_r_nCONST_wshYesNoDialog____________________4_r_nCONST_VALUE_ICON_QUESTIONMARK___________32_r_nCONST_VALUE_ICON_INFORMATION____________64_r_nCONST_HKEY_LOCAL_MACHINE________________H80000002_r_nCONST_KEY_SET_VALUE_____________________H0002_r_nCONST_KEY_QUERY_VALUE___________________H0001_r_nCONST_REG_SZ____________________________1_r_nCONST_OfficeAppId_________________________0ff1ce15_a989_479d_af46_f275c6370663__r_nCONST_STR_SYS32PATH_______________________:WindowsSystem32__r_nCONST_STR_OSPPREARMPATH___________________Microsoft_OfficeOffice16OSPPREARM.EXE__r_nCONST_STR_OSPPREARMPATH_DEBUG_____________Microsoft_Office_DebugOffice16OSPPREARM.EXE__r_nCONST_REG_OSPP____________________________SOFTWAREMicrosoftOfficeSoftwareProtectionPlatform__r_nCONST_STR_HEARTBEATPATH___________________MicrosoftOfficeHeartbeatHeartbeatCache.xml__r_nCONST_REG_SPP_____________________________SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatform__r_nCONST_REG_SCAEXP_BASE_____________________HKCUSOFTWAREMicrosoftOffice16.0CommonExperimentEcs__r_nCONST_REG_SCAEXP_END_______________________Flightsofc5juzsw45rcw0__r_nCONST_REG_SCAEXP_OVERRIDE_________________HKLMSOFTWAREMicrosoftOfficeCommonExperimentofc5juzsw45rcw0__r_nCONST_REG_SCAO15__________________________HKLMSOFTWAREMicrosoftOffice15.0ClickToRunConfigurationSharedComputerLicensing__r_nCONST_REG_SCAO16__________________________HKLMSOFTWAREMicrosoftOfficeClickToRunConfigurationSharedComputerLicensing__r_nCONST_VALUE_SCAEXP_FLAVOR_________________exp__r_nCONST_VALUE_SCAEXP_OVERRIDE_FLAVOR________expoverride__r_nCONST_VALUE_SCAO15_FLAVOR_________________o15__r_nCONST_VALUE_SCA016_FLAVOR_________________o16__r_nCONST_VALUE_SCAREGKEY_SINGLE_TYPE_________single__r_nCONST_VALUE_SCAREGKEY_PER_APP_TYPE________perapp__r_nCONST_VER_INFO____________________________Version_Info:_2016_1.0__r_n_________________________________________________________________________________________r_nCONST_MSG_NOREGRIGHTS_____________________Insufficient_rights_to_perform_operation.__r_nCONST_MSG_ISCMD_ELEVATED__________________Ensure_cmd.exe_is_elevated__right_click___run_as_administrator_.__r_nCONST_MSG_CREDENTIALFAILURE_______________Connection_failed_with_passed_credentials.__r_nCONST_MSG_FILENOTFOUND____________________File_not_found:___________________r_nCONST_MSG_SEPERATESMALL____________________________________r_nCONST_MSG_SEPERATE_________________________________________________________________r_nCONST_MSG_PROCESSING_________________________Processing____________________________r_nCONST_MSG_EXIT_______________________________Exiting_______________________________r_nCONST_MSG_UNSUPPORTED_____________________Unsupported_command_passed.__r_nCONST_MSG_UNSUPPORTEDOPEROS7______________The_following_command_is_supported_on_Windows_7_only:___r_nCONST_MSG_UNSUPPORTEDOPEROS8______________The_following_command_is_supported_on_Windows_8_and_above_only:___r_nCONST_MSG_UNSUPPORTEDLOCAL________________The_following_command_is_supported_on_local_machine_only:___r_nCONST_MSG_CREDENTIALERR___________________Passing_credentials_is_not_supported_for_this_command.__r_nCONST_MSG_SUCCESS_________________________Successfully_applied_setting.__r_nCONST_MSG_NOKMSLICS_______________________No_Office_KMS_licenses_were_found_on_the_system.__r_nCONST_MSG_ACTATTEMPT______________________Installed_product_key_detected___attempting_to_activate_the_following_product:__r_nCONST_MSG_TOKACTATTEMPT___________________Installed_product_key_detected___attempting_to_token_activate_the_following_product:__r_nCONST_MSG_NOKEYSINSTALLED__________________No_installed_product
mov rax, rbp
push rax
movabs rbp, 0x140281d06
mov rax, rbp
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.1400163b8
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.1400925c0
add rsp, 0x20
pop rcx
push rax
mov rax, 1
mov rax, rax
push rax
push qword [rsp + 0x50]
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
movabs rcx, 0x1401038ea
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
mov rcx, qword [0x140319dfc]
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
movabs rcx, str.____NoLogo__unpkey:BKMX7
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
call fcn.140092820
movabs rax, str.cscript.exe
push rax
push rax
call fcn.1400927f0
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001284f
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140041f24
add rsp, 0x28
pop rax
mov qword [rsp + 0x30], 1
movabs rax, str.Office19Access2019R_
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jle 0x140020e98
movabs rax, str.9e9bceeb_e736_4f26_88de_763f87dcc485
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jne 0x140020e98
mov rax, 1
jmp 0x140020e9b
xor rax, rax
and rax, rax
je 0x140020fad
movabs rax, str.lic16
push rax
movabs rax, str.Access2019VL_
push rax
movabs rbp, str.Copyright__c__Microsoft_Corporation._All_rights_reserved._r_n_________________________________________________________________________________________r_n_________________________________________________________________________________________r_nCONST_wshOK_____________________________0_r_nCONST_VALUE_ICON_WARNING________________16_r_nCONST_wshYesNoDialog____________________4_r_nCONST_VALUE_ICON_QUESTIONMARK___________32_r_nCONST_VALUE_ICON_INFORMATION____________64_r_nCONST_HKEY_LOCAL_MACHINE________________H80000002_r_nCONST_KEY_SET_VALUE_____________________H0002_r_nCONST_KEY_QUERY_VALUE___________________H0001_r_nCONST_REG_SZ____________________________1_r_nCONST_OfficeAppId_________________________0ff1ce15_a989_479d_af46_f275c6370663__r_nCONST_STR_SYS32PATH_______________________:WindowsSystem32__r_nCONST_STR_OSPPREARMPATH___________________Microsoft_OfficeOffice16OSPPREARM.EXE__r_nCONST_STR_OSPPREARMPATH_DEBUG_____________Microsoft_Office_DebugOffice16OSPPREARM.EXE__r_nCONST_REG_OSPP____________________________SOFTWAREMicrosoftOfficeSoftwareProtectionPlatform__r_nCONST_STR_HEARTBEATPATH___________________MicrosoftOfficeHeartbeatHeartbeatCache.xml__r_nCONST_REG_SPP_____________________________SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatform__r_nCONST_REG_SCAEXP_BASE_____________________HKCUSOFTWAREMicrosoftOffice16.0CommonExperimentEcs__r_nCONST_REG_SCAEXP_END_______________________Flightsofc5juzsw45rcw0__r_nCONST_REG_SCAEXP_OVERRIDE_________________HKLMSOFTWAREMicrosoftOfficeCommonExperimentofc5juzsw45rcw0__r_nCONST_REG_SCAO15__________________________HKLMSOFTWAREMicrosoftOffice15.0ClickToRunConfigurationSharedComputerLicensing__r_nCONST_REG_SCAO16__________________________HKLMSOFTWAREMicrosoftOfficeClickToRunConfigurationSharedComputerLicensing__r_nCONST_VALUE_SCAEXP_FLAVOR_________________exp__r_nCONST_VALUE_SCAEXP_OVERRIDE_FLAVOR________expoverride__r_nCONST_VALUE_SCAO15_FLAVOR_________________o15__r_nCONST_VALUE_SCA016_FLAVOR_________________o16__r_nCONST_VALUE_SCAREGKEY_SINGLE_TYPE_________single__r_nCONST_VALUE_SCAREGKEY_PER_APP_TYPE________perapp__r_nCONST_VER_INFO____________________________Version_Info:_2016_1.0__r_n_________________________________________________________________________________________r_nCONST_MSG_NOREGRIGHTS_____________________Insufficient_rights_to_perform_operation.__r_nCONST_MSG_ISCMD_ELEVATED__________________Ensure_cmd.exe_is_elevated__right_click___run_as_administrator_.__r_nCONST_MSG_CREDENTIALFAILURE_______________Connection_failed_with_passed_credentials.__r_nCONST_MSG_FILENOTFOUND____________________File_not_found:___________________r_nCONST_MSG_SEPERATESMALL____________________________________r_nCONST_MSG_SEPERATE_________________________________________________________________r_nCONST_MSG_PROCESSING_________________________Processing____________________________r_nCONST_MSG_EXIT_______________________________Exiting_______________________________r_nCONST_MSG_UNSUPPORTED_____________________Unsupported_command_passed.__r_nCONST_MSG_UNSUPPORTEDOPEROS7______________The_following_command_is_supported_on_Windows_7_only:___r_nCONST_MSG_UNSUPPORTEDOPEROS8______________The_following_command_is_supported_on_Windows_8_and_above_only:___r_nCONST_MSG_UNSUPPORTEDLOCAL________________The_following_command_is_supported_on_local_machine_only:___r_nCONST_MSG_CREDENTIALERR___________________Passing_credentials_is_not_supported_for_this_command.__r_nCONST_MSG_SUCCESS_________________________Successfully_applied_setting.__r_nCONST_MSG_NOKMSLICS_______________________No_Office_KMS_licenses_were_found_on_the_system.__r_nCONST_MSG_ACTATTEMPT______________________Installed_product_key_detected___attempting_to_activate_the_following_product:__r_nCONST_MSG_TOKACTATTEMPT___________________Installed_product_key_detected___attempting_to_token_activate_the_following_product:__r_nCONST_MSG_NOKEYSINSTALLED__________________No_installed_product
mov rax, rbp
push rax
movabs rbp, 0x140281d06
mov rax, rbp
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.1400163b8
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.1400925c0
add rsp, 0x20
pop rcx
push rax
mov rax, 1
mov rax, rax
push rax
push qword [rsp + 0x50]
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
movabs rcx, 0x1401038ea
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
mov rcx, qword [0x140319dfc]
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
movabs rcx, str.____NoLogo__unpkey:GX2DJ
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
call fcn.140092820
movabs rax, str.cscript.exe
push rax
push rax
call fcn.1400927f0
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001284f
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140041f24
add rsp, 0x28
pop rax
mov qword [rsp + 0x30], 1
movabs rax, str.Office19Excel2019R_
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jle 0x140020ff2
movabs rax, str.237854e9_79fc_4497_a0c1_a70969691c6b
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jne 0x140020ff2
mov rax, 1
jmp 0x140020ff5
xor rax, rax
and rax, rax
je 0x140021107
movabs rax, str.lic16
push rax
movabs rax, str.Excel2019VL_
push rax
movabs rbp, str.Copyright__c__Microsoft_Corporation._All_rights_reserved._r_n_________________________________________________________________________________________r_n_________________________________________________________________________________________r_nCONST_wshOK_____________________________0_r_nCONST_VALUE_ICON_WARNING________________16_r_nCONST_wshYesNoDialog____________________4_r_nCONST_VALUE_ICON_QUESTIONMARK___________32_r_nCONST_VALUE_ICON_INFORMATION____________64_r_nCONST_HKEY_LOCAL_MACHINE________________H80000002_r_nCONST_KEY_SET_VALUE_____________________H0002_r_nCONST_KEY_QUERY_VALUE___________________H0001_r_nCONST_REG_SZ____________________________1_r_nCONST_OfficeAppId_________________________0ff1ce15_a989_479d_af46_f275c6370663__r_nCONST_STR_SYS32PATH_______________________:WindowsSystem32__r_nCONST_STR_OSPPREARMPATH___________________Microsoft_OfficeOffice16OSPPREARM.EXE__r_nCONST_STR_OSPPREARMPATH_DEBUG_____________Microsoft_Office_DebugOffice16OSPPREARM.EXE__r_nCONST_REG_OSPP____________________________SOFTWAREMicrosoftOfficeSoftwareProtectionPlatform__r_nCONST_STR_HEARTBEATPATH___________________MicrosoftOfficeHeartbeatHeartbeatCache.xml__r_nCONST_REG_SPP_____________________________SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatform__r_nCONST_REG_SCAEXP_BASE_____________________HKCUSOFTWAREMicrosoftOffice16.0CommonExperimentEcs__r_nCONST_REG_SCAEXP_END_______________________Flightsofc5juzsw45rcw0__r_nCONST_REG_SCAEXP_OVERRIDE_________________HKLMSOFTWAREMicrosoftOfficeCommonExperimentofc5juzsw45rcw0__r_nCONST_REG_SCAO15__________________________HKLMSOFTWAREMicrosoftOffice15.0ClickToRunConfigurationSharedComputerLicensing__r_nCONST_REG_SCAO16__________________________HKLMSOFTWAREMicrosoftOfficeClickToRunConfigurationSharedComputerLicensing__r_nCONST_VALUE_SCAEXP_FLAVOR_________________exp__r_nCONST_VALUE_SCAEXP_OVERRIDE_FLAVOR________expoverride__r_nCONST_VALUE_SCAO15_FLAVOR_________________o15__r_nCONST_VALUE_SCA016_FLAVOR_________________o16__r_nCONST_VALUE_SCAREGKEY_SINGLE_TYPE_________single__r_nCONST_VALUE_SCAREGKEY_PER_APP_TYPE________perapp__r_nCONST_VER_INFO____________________________Version_Info:_2016_1.0__r_n_________________________________________________________________________________________r_nCONST_MSG_NOREGRIGHTS_____________________Insufficient_rights_to_perform_operation.__r_nCONST_MSG_ISCMD_ELEVATED__________________Ensure_cmd.exe_is_elevated__right_click___run_as_administrator_.__r_nCONST_MSG_CREDENTIALFAILURE_______________Connection_failed_with_passed_credentials.__r_nCONST_MSG_FILENOTFOUND____________________File_not_found:___________________r_nCONST_MSG_SEPERATESMALL____________________________________r_nCONST_MSG_SEPERATE_________________________________________________________________r_nCONST_MSG_PROCESSING_________________________Processing____________________________r_nCONST_MSG_EXIT_______________________________Exiting_______________________________r_nCONST_MSG_UNSUPPORTED_____________________Unsupported_command_passed.__r_nCONST_MSG_UNSUPPORTEDOPEROS7______________The_following_command_is_supported_on_Windows_7_only:___r_nCONST_MSG_UNSUPPORTEDOPEROS8______________The_following_command_is_supported_on_Windows_8_and_above_only:___r_nCONST_MSG_UNSUPPORTEDLOCAL________________The_following_command_is_supported_on_local_machine_only:___r_nCONST_MSG_CREDENTIALERR___________________Passing_credentials_is_not_supported_for_this_command.__r_nCONST_MSG_SUCCESS_________________________Successfully_applied_setting.__r_nCONST_MSG_NOKMSLICS_______________________No_Office_KMS_licenses_were_found_on_the_system.__r_nCONST_MSG_ACTATTEMPT______________________Installed_product_key_detected___attempting_to_activate_the_following_product:__r_nCONST_MSG_TOKACTATTEMPT___________________Installed_product_key_detected___attempting_to_token_activate_the_following_product:__r_nCONST_MSG_NOKEYSINSTALLED__________________No_installed_product
mov rax, rbp
push rax
movabs rbp, 0x140281d06
mov rax, rbp
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.1400163b8
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.1400925c0
add rsp, 0x20
pop rcx
push rax
mov rax, 1
mov rax, rax
push rax
push qword [rsp + 0x50]
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
movabs rcx, 0x1401038ea
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
mov rcx, qword [0x140319dfc]
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
movabs rcx, str.____NoLogo__unpkey:TJHHK
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
call fcn.140092820
movabs rax, str.cscript.exe
push rax
push rax
call fcn.1400927f0
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001284f
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140041f24
add rsp, 0x28
pop rax
mov qword [rsp + 0x30], 1
movabs rax, str.Office19PowerPoint2019R_
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jle 0x14002114c
movabs rax, str.3131fd61_5e4f_4308_8d6d_62be1987c92c
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jne 0x14002114c
mov rax, 1
jmp 0x14002114f
xor rax, rax
and rax, rax
je 0x140021261
movabs rax, str.lic16
push rax
movabs rax, str.PowerPoint2019VL_
push rax
movabs rbp, str.Copyright__c__Microsoft_Corporation._All_rights_reserved._r_n_________________________________________________________________________________________r_n_________________________________________________________________________________________r_nCONST_wshOK_____________________________0_r_nCONST_VALUE_ICON_WARNING________________16_r_nCONST_wshYesNoDialog____________________4_r_nCONST_VALUE_ICON_QUESTIONMARK___________32_r_nCONST_VALUE_ICON_INFORMATION____________64_r_nCONST_HKEY_LOCAL_MACHINE________________H80000002_r_nCONST_KEY_SET_VALUE_____________________H0002_r_nCONST_KEY_QUERY_VALUE___________________H0001_r_nCONST_REG_SZ____________________________1_r_nCONST_OfficeAppId_________________________0ff1ce15_a989_479d_af46_f275c6370663__r_nCONST_STR_SYS32PATH_______________________:WindowsSystem32__r_nCONST_STR_OSPPREARMPATH___________________Microsoft_OfficeOffice16OSPPREARM.EXE__r_nCONST_STR_OSPPREARMPATH_DEBUG_____________Microsoft_Office_DebugOffice16OSPPREARM.EXE__r_nCONST_REG_OSPP____________________________SOFTWAREMicrosoftOfficeSoftwareProtectionPlatform__r_nCONST_STR_HEARTBEATPATH___________________MicrosoftOfficeHeartbeatHeartbeatCache.xml__r_nCONST_REG_SPP_____________________________SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatform__r_nCONST_REG_SCAEXP_BASE_____________________HKCUSOFTWAREMicrosoftOffice16.0CommonExperimentEcs__r_nCONST_REG_SCAEXP_END_______________________Flightsofc5juzsw45rcw0__r_nCONST_REG_SCAEXP_OVERRIDE_________________HKLMSOFTWAREMicrosoftOfficeCommonExperimentofc5juzsw45rcw0__r_nCONST_REG_SCAO15__________________________HKLMSOFTWAREMicrosoftOffice15.0ClickToRunConfigurationSharedComputerLicensing__r_nCONST_REG_SCAO16__________________________HKLMSOFTWAREMicrosoftOfficeClickToRunConfigurationSharedComputerLicensing__r_nCONST_VALUE_SCAEXP_FLAVOR_________________exp__r_nCONST_VALUE_SCAEXP_OVERRIDE_FLAVOR________expoverride__r_nCONST_VALUE_SCAO15_FLAVOR_________________o15__r_nCONST_VALUE_SCA016_FLAVOR_________________o16__r_nCONST_VALUE_SCAREGKEY_SINGLE_TYPE_________single__r_nCONST_VALUE_SCAREGKEY_PER_APP_TYPE________perapp__r_nCONST_VER_INFO____________________________Version_Info:_2016_1.0__r_n_________________________________________________________________________________________r_nCONST_MSG_NOREGRIGHTS_____________________Insufficient_rights_to_perform_operation.__r_nCONST_MSG_ISCMD_ELEVATED__________________Ensure_cmd.exe_is_elevated__right_click___run_as_administrator_.__r_nCONST_MSG_CREDENTIALFAILURE_______________Connection_failed_with_passed_credentials.__r_nCONST_MSG_FILENOTFOUND____________________File_not_found:___________________r_nCONST_MSG_SEPERATESMALL____________________________________r_nCONST_MSG_SEPERATE_________________________________________________________________r_nCONST_MSG_PROCESSING_________________________Processing____________________________r_nCONST_MSG_EXIT_______________________________Exiting_______________________________r_nCONST_MSG_UNSUPPORTED_____________________Unsupported_command_passed.__r_nCONST_MSG_UNSUPPORTEDOPEROS7______________The_following_command_is_supported_on_Windows_7_only:___r_nCONST_MSG_UNSUPPORTEDOPEROS8______________The_following_command_is_supported_on_Windows_8_and_above_only:___r_nCONST_MSG_UNSUPPORTEDLOCAL________________The_following_command_is_supported_on_local_machine_only:___r_nCONST_MSG_CREDENTIALERR___________________Passing_credentials_is_not_supported_for_this_command.__r_nCONST_MSG_SUCCESS_________________________Successfully_applied_setting.__r_nCONST_MSG_NOKMSLICS_______________________No_Office_KMS_licenses_were_found_on_the_system.__r_nCONST_MSG_ACTATTEMPT______________________Installed_product_key_detected___attempting_to_activate_the_following_product:__r_nCONST_MSG_TOKACTATTEMPT___________________Installed_product_key_detected___attempting_to_token_activate_the_following_product:__r_nCONST_MSG_NOKEYSINSTALLED__________________No_installed_product
mov rax, rbp
push rax
movabs rbp, 0x140281d06
mov rax, rbp
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.1400163b8
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.1400925c0
add rsp, 0x20
pop rcx
push rax
mov rax, 1
mov rax, rax
push rax
push qword [rsp + 0x50]
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
movabs rcx, 0x1401038ea
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
mov rcx, qword [0x140319dfc]
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
movabs rcx, str.____NoLogo__unpkey:9BWH2
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
call fcn.140092820
movabs rax, str.cscript.exe
push rax
push rax
call fcn.1400927f0
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001284f
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140041f24
add rsp, 0x28
pop rax
mov qword [rsp + 0x30], 1
movabs rax, str.Office19Publisher2019R_
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jle 0x1400212a6
movabs rax, str.9d3e4cca_e172_46f1_a2f4_1d2107051444
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jne 0x1400212a6
mov rax, 1
jmp 0x1400212a9
xor rax, rax
and rax, rax
je 0x1400213bb
movabs rax, str.lic16
push rax
movabs rax, str.Publisher2019VL_
push rax
movabs rbp, str.Copyright__c__Microsoft_Corporation._All_rights_reserved._r_n_________________________________________________________________________________________r_n_________________________________________________________________________________________r_nCONST_wshOK_____________________________0_r_nCONST_VALUE_ICON_WARNING________________16_r_nCONST_wshYesNoDialog____________________4_r_nCONST_VALUE_ICON_QUESTIONMARK___________32_r_nCONST_VALUE_ICON_INFORMATION____________64_r_nCONST_HKEY_LOCAL_MACHINE________________H80000002_r_nCONST_KEY_SET_VALUE_____________________H0002_r_nCONST_KEY_QUERY_VALUE___________________H0001_r_nCONST_REG_SZ____________________________1_r_nCONST_OfficeAppId_________________________0ff1ce15_a989_479d_af46_f275c6370663__r_nCONST_STR_SYS32PATH_______________________:WindowsSystem32__r_nCONST_STR_OSPPREARMPATH___________________Microsoft_OfficeOffice16OSPPREARM.EXE__r_nCONST_STR_OSPPREARMPATH_DEBUG_____________Microsoft_Office_DebugOffice16OSPPREARM.EXE__r_nCONST_REG_OSPP____________________________SOFTWAREMicrosoftOfficeSoftwareProtectionPlatform__r_nCONST_STR_HEARTBEATPATH___________________MicrosoftOfficeHeartbeatHeartbeatCache.xml__r_nCONST_REG_SPP_____________________________SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatform__r_nCONST_REG_SCAEXP_BASE_____________________HKCUSOFTWAREMicrosoftOffice16.0CommonExperimentEcs__r_nCONST_REG_SCAEXP_END_______________________Flightsofc5juzsw45rcw0__r_nCONST_REG_SCAEXP_OVERRIDE_________________HKLMSOFTWAREMicrosoftOfficeCommonExperimentofc5juzsw45rcw0__r_nCONST_REG_SCAO15__________________________HKLMSOFTWAREMicrosoftOffice15.0ClickToRunConfigurationSharedComputerLicensing__r_nCONST_REG_SCAO16__________________________HKLMSOFTWAREMicrosoftOfficeClickToRunConfigurationSharedComputerLicensing__r_nCONST_VALUE_SCAEXP_FLAVOR_________________exp__r_nCONST_VALUE_SCAEXP_OVERRIDE_FLAVOR________expoverride__r_nCONST_VALUE_SCAO15_FLAVOR_________________o15__r_nCONST_VALUE_SCA016_FLAVOR_________________o16__r_nCONST_VALUE_SCAREGKEY_SINGLE_TYPE_________single__r_nCONST_VALUE_SCAREGKEY_PER_APP_TYPE________perapp__r_nCONST_VER_INFO____________________________Version_Info:_2016_1.0__r_n_________________________________________________________________________________________r_nCONST_MSG_NOREGRIGHTS_____________________Insufficient_rights_to_perform_operation.__r_nCONST_MSG_ISCMD_ELEVATED__________________Ensure_cmd.exe_is_elevated__right_click___run_as_administrator_.__r_nCONST_MSG_CREDENTIALFAILURE_______________Connection_failed_with_passed_credentials.__r_nCONST_MSG_FILENOTFOUND____________________File_not_found:___________________r_nCONST_MSG_SEPERATESMALL____________________________________r_nCONST_MSG_SEPERATE_________________________________________________________________r_nCONST_MSG_PROCESSING_________________________Processing____________________________r_nCONST_MSG_EXIT_______________________________Exiting_______________________________r_nCONST_MSG_UNSUPPORTED_____________________Unsupported_command_passed.__r_nCONST_MSG_UNSUPPORTEDOPEROS7______________The_following_command_is_supported_on_Windows_7_only:___r_nCONST_MSG_UNSUPPORTEDOPEROS8______________The_following_command_is_supported_on_Windows_8_and_above_only:___r_nCONST_MSG_UNSUPPORTEDLOCAL________________The_following_command_is_supported_on_local_machine_only:___r_nCONST_MSG_CREDENTIALERR___________________Passing_credentials_is_not_supported_for_this_command.__r_nCONST_MSG_SUCCESS_________________________Successfully_applied_setting.__r_nCONST_MSG_NOKMSLICS_______________________No_Office_KMS_licenses_were_found_on_the_system.__r_nCONST_MSG_ACTATTEMPT______________________Installed_product_key_detected___attempting_to_activate_the_following_product:__r_nCONST_MSG_TOKACTATTEMPT___________________Installed_product_key_detected___attempting_to_token_activate_the_following_product:__r_nCONST_MSG_NOKEYSINSTALLED__________________No_installed_product
mov rax, rbp
push rax
movabs rbp, 0x140281d06
mov rax, rbp
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.1400163b8
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.1400925c0
add rsp, 0x20
pop rcx
push rax
mov rax, 1
mov rax, rax
push rax
push qword [rsp + 0x50]
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
movabs rcx, 0x1401038ea
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
mov rcx, qword [0x140319dfc]
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
movabs rcx, str.____NoLogo__unpkey:CBBC2
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
call fcn.140092820
movabs rax, str.cscript.exe
push rax
push rax
call fcn.1400927f0
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001284f
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140041f24
add rsp, 0x28
pop rax
mov qword [rsp + 0x30], 1
movabs rax, str.Office19Word2019R_
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jle 0x140021400
movabs rax, str.059834fe_a8ea_4bff_b67b_4d006b5447d3
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jne 0x140021400
mov rax, 1
jmp 0x140021403
xor rax, rax
and rax, rax
je 0x140021515
movabs rax, str.lic16
push rax
movabs rax, str.Word2019VL_
push rax
movabs rbp, str.Copyright__c__Microsoft_Corporation._All_rights_reserved._r_n_________________________________________________________________________________________r_n_________________________________________________________________________________________r_nCONST_wshOK_____________________________0_r_nCONST_VALUE_ICON_WARNING________________16_r_nCONST_wshYesNoDialog____________________4_r_nCONST_VALUE_ICON_QUESTIONMARK___________32_r_nCONST_VALUE_ICON_INFORMATION____________64_r_nCONST_HKEY_LOCAL_MACHINE________________H80000002_r_nCONST_KEY_SET_VALUE_____________________H0002_r_nCONST_KEY_QUERY_VALUE___________________H0001_r_nCONST_REG_SZ____________________________1_r_nCONST_OfficeAppId_________________________0ff1ce15_a989_479d_af46_f275c6370663__r_nCONST_STR_SYS32PATH_______________________:WindowsSystem32__r_nCONST_STR_OSPPREARMPATH___________________Microsoft_OfficeOffice16OSPPREARM.EXE__r_nCONST_STR_OSPPREARMPATH_DEBUG_____________Microsoft_Office_DebugOffice16OSPPREARM.EXE__r_nCONST_REG_OSPP____________________________SOFTWAREMicrosoftOfficeSoftwareProtectionPlatform__r_nCONST_STR_HEARTBEATPATH___________________MicrosoftOfficeHeartbeatHeartbeatCache.xml__r_nCONST_REG_SPP_____________________________SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatform__r_nCONST_REG_SCAEXP_BASE_____________________HKCUSOFTWAREMicrosoftOffice16.0CommonExperimentEcs__r_nCONST_REG_SCAEXP_END_______________________Flightsofc5juzsw45rcw0__r_nCONST_REG_SCAEXP_OVERRIDE_________________HKLMSOFTWAREMicrosoftOfficeCommonExperimentofc5juzsw45rcw0__r_nCONST_REG_SCAO15__________________________HKLMSOFTWAREMicrosoftOffice15.0ClickToRunConfigurationSharedComputerLicensing__r_nCONST_REG_SCAO16__________________________HKLMSOFTWAREMicrosoftOfficeClickToRunConfigurationSharedComputerLicensing__r_nCONST_VALUE_SCAEXP_FLAVOR_________________exp__r_nCONST_VALUE_SCAEXP_OVERRIDE_FLAVOR________expoverride__r_nCONST_VALUE_SCAO15_FLAVOR_________________o15__r_nCONST_VALUE_SCA016_FLAVOR_________________o16__r_nCONST_VALUE_SCAREGKEY_SINGLE_TYPE_________single__r_nCONST_VALUE_SCAREGKEY_PER_APP_TYPE________perapp__r_nCONST_VER_INFO____________________________Version_Info:_2016_1.0__r_n_________________________________________________________________________________________r_nCONST_MSG_NOREGRIGHTS_____________________Insufficient_rights_to_perform_operation.__r_nCONST_MSG_ISCMD_ELEVATED__________________Ensure_cmd.exe_is_elevated__right_click___run_as_administrator_.__r_nCONST_MSG_CREDENTIALFAILURE_______________Connection_failed_with_passed_credentials.__r_nCONST_MSG_FILENOTFOUND____________________File_not_found:___________________r_nCONST_MSG_SEPERATESMALL____________________________________r_nCONST_MSG_SEPERATE_________________________________________________________________r_nCONST_MSG_PROCESSING_________________________Processing____________________________r_nCONST_MSG_EXIT_______________________________Exiting_______________________________r_nCONST_MSG_UNSUPPORTED_____________________Unsupported_command_passed.__r_nCONST_MSG_UNSUPPORTEDOPEROS7______________The_following_command_is_supported_on_Windows_7_only:___r_nCONST_MSG_UNSUPPORTEDOPEROS8______________The_following_command_is_supported_on_Windows_8_and_above_only:___r_nCONST_MSG_UNSUPPORTEDLOCAL________________The_following_command_is_supported_on_local_machine_only:___r_nCONST_MSG_CREDENTIALERR___________________Passing_credentials_is_not_supported_for_this_command.__r_nCONST_MSG_SUCCESS_________________________Successfully_applied_setting.__r_nCONST_MSG_NOKMSLICS_______________________No_Office_KMS_licenses_were_found_on_the_system.__r_nCONST_MSG_ACTATTEMPT______________________Installed_product_key_detected___attempting_to_activate_the_following_product:__r_nCONST_MSG_TOKACTATTEMPT___________________Installed_product_key_detected___attempting_to_token_activate_the_following_product:__r_nCONST_MSG_NOKEYSINSTALLED__________________No_installed_product
mov rax, rbp
push rax
movabs rbp, 0x140281d06
mov rax, rbp
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.1400163b8
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.1400925c0
add rsp, 0x20
pop rcx
push rax
mov rax, 1
mov rax, rax
push rax
push qword [rsp + 0x50]
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
movabs rcx, 0x1401038ea
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
mov rcx, qword [0x140319dfc]
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
movabs rcx, str.____NoLogo__unpkey:PDPCD
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
call fcn.140092820
movabs rax, str.cscript.exe
push rax
push rax
call fcn.1400927f0
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001284f
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140041f24
add rsp, 0x28
pop rax
mov qword [rsp + 0x30], 1
movabs rax, str.Office19Outlook2019R_
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jle 0x14002155a
movabs rax, str.c8f8a301_19f5_4132_96ce_2de9d4adbd33
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jne 0x14002155a
mov rax, 1
jmp 0x14002155d
xor rax, rax
and rax, rax
je 0x14002166f
movabs rax, str.lic16
push rax
movabs rax, str.Outlook2019VL_
push rax
movabs rbp, str.Copyright__c__Microsoft_Corporation._All_rights_reserved._r_n_________________________________________________________________________________________r_n_________________________________________________________________________________________r_nCONST_wshOK_____________________________0_r_nCONST_VALUE_ICON_WARNING________________16_r_nCONST_wshYesNoDialog____________________4_r_nCONST_VALUE_ICON_QUESTIONMARK___________32_r_nCONST_VALUE_ICON_INFORMATION____________64_r_nCONST_HKEY_LOCAL_MACHINE________________H80000002_r_nCONST_KEY_SET_VALUE_____________________H0002_r_nCONST_KEY_QUERY_VALUE___________________H0001_r_nCONST_REG_SZ____________________________1_r_nCONST_OfficeAppId_________________________0ff1ce15_a989_479d_af46_f275c6370663__r_nCONST_STR_SYS32PATH_______________________:WindowsSystem32__r_nCONST_STR_OSPPREARMPATH___________________Microsoft_OfficeOffice16OSPPREARM.EXE__r_nCONST_STR_OSPPREARMPATH_DEBUG_____________Microsoft_Office_DebugOffice16OSPPREARM.EXE__r_nCONST_REG_OSPP____________________________SOFTWAREMicrosoftOfficeSoftwareProtectionPlatform__r_nCONST_STR_HEARTBEATPATH___________________MicrosoftOfficeHeartbeatHeartbeatCache.xml__r_nCONST_REG_SPP_____________________________SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatform__r_nCONST_REG_SCAEXP_BASE_____________________HKCUSOFTWAREMicrosoftOffice16.0CommonExperimentEcs__r_nCONST_REG_SCAEXP_END_______________________Flightsofc5juzsw45rcw0__r_nCONST_REG_SCAEXP_OVERRIDE_________________HKLMSOFTWAREMicrosoftOfficeCommonExperimentofc5juzsw45rcw0__r_nCONST_REG_SCAO15__________________________HKLMSOFTWAREMicrosoftOffice15.0ClickToRunConfigurationSharedComputerLicensing__r_nCONST_REG_SCAO16__________________________HKLMSOFTWAREMicrosoftOfficeClickToRunConfigurationSharedComputerLicensing__r_nCONST_VALUE_SCAEXP_FLAVOR_________________exp__r_nCONST_VALUE_SCAEXP_OVERRIDE_FLAVOR________expoverride__r_nCONST_VALUE_SCAO15_FLAVOR_________________o15__r_nCONST_VALUE_SCA016_FLAVOR_________________o16__r_nCONST_VALUE_SCAREGKEY_SINGLE_TYPE_________single__r_nCONST_VALUE_SCAREGKEY_PER_APP_TYPE________perapp__r_nCONST_VER_INFO____________________________Version_Info:_2016_1.0__r_n_________________________________________________________________________________________r_nCONST_MSG_NOREGRIGHTS_____________________Insufficient_rights_to_perform_operation.__r_nCONST_MSG_ISCMD_ELEVATED__________________Ensure_cmd.exe_is_elevated__right_click___run_as_administrator_.__r_nCONST_MSG_CREDENTIALFAILURE_______________Connection_failed_with_passed_credentials.__r_nCONST_MSG_FILENOTFOUND____________________File_not_found:___________________r_nCONST_MSG_SEPERATESMALL____________________________________r_nCONST_MSG_SEPERATE_________________________________________________________________r_nCONST_MSG_PROCESSING_________________________Processing____________________________r_nCONST_MSG_EXIT_______________________________Exiting_______________________________r_nCONST_MSG_UNSUPPORTED_____________________Unsupported_command_passed.__r_nCONST_MSG_UNSUPPORTEDOPEROS7______________The_following_command_is_supported_on_Windows_7_only:___r_nCONST_MSG_UNSUPPORTEDOPEROS8______________The_following_command_is_supported_on_Windows_8_and_above_only:___r_nCONST_MSG_UNSUPPORTEDLOCAL________________The_following_command_is_supported_on_local_machine_only:___r_nCONST_MSG_CREDENTIALERR___________________Passing_credentials_is_not_supported_for_this_command.__r_nCONST_MSG_SUCCESS_________________________Successfully_applied_setting.__r_nCONST_MSG_NOKMSLICS_______________________No_Office_KMS_licenses_were_found_on_the_system.__r_nCONST_MSG_ACTATTEMPT______________________Installed_product_key_detected___attempting_to_activate_the_following_product:__r_nCONST_MSG_TOKACTATTEMPT___________________Installed_product_key_detected___attempting_to_token_activate_the_following_product:__r_nCONST_MSG_NOKEYSINSTALLED__________________No_installed_product
mov rax, rbp
push rax
movabs rbp, 0x140281d06
mov rax, rbp
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.1400163b8
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.1400925c0
add rsp, 0x20
pop rcx
push rax
mov rax, 1
mov rax, rax
push rax
push qword [rsp + 0x50]
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
movabs rcx, 0x1401038ea
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
mov rcx, qword [0x140319dfc]
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
movabs rcx, str.____NoLogo__unpkey:F9DX8
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
call fcn.140092820
movabs rax, str.cscript.exe
push rax
push rax
call fcn.1400927f0
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001284f
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140041f24
add rsp, 0x28
pop rax
mov qword [rsp + 0x30], 1
movabs rax, str.Office19ProjectStd2019R_
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jle 0x1400216b4
movabs rax, str.1777f0e3_7392_4198_97ea_8ae4de6f6381
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jne 0x1400216b4
mov rax, 1
jmp 0x1400216b7
xor rax, rax
and rax, rax
je 0x1400217c9
movabs rax, str.lic16
push rax
movabs rax, str.ProjectStd2019VL_
push rax
movabs rbp, str.Copyright__c__Microsoft_Corporation._All_rights_reserved._r_n_________________________________________________________________________________________r_n_________________________________________________________________________________________r_nCONST_wshOK_____________________________0_r_nCONST_VALUE_ICON_WARNING________________16_r_nCONST_wshYesNoDialog____________________4_r_nCONST_VALUE_ICON_QUESTIONMARK___________32_r_nCONST_VALUE_ICON_INFORMATION____________64_r_nCONST_HKEY_LOCAL_MACHINE________________H80000002_r_nCONST_KEY_SET_VALUE_____________________H0002_r_nCONST_KEY_QUERY_VALUE___________________H0001_r_nCONST_REG_SZ____________________________1_r_nCONST_OfficeAppId_________________________0ff1ce15_a989_479d_af46_f275c6370663__r_nCONST_STR_SYS32PATH_______________________:WindowsSystem32__r_nCONST_STR_OSPPREARMPATH___________________Microsoft_OfficeOffice16OSPPREARM.EXE__r_nCONST_STR_OSPPREARMPATH_DEBUG_____________Microsoft_Office_DebugOffice16OSPPREARM.EXE__r_nCONST_REG_OSPP____________________________SOFTWAREMicrosoftOfficeSoftwareProtectionPlatform__r_nCONST_STR_HEARTBEATPATH___________________MicrosoftOfficeHeartbeatHeartbeatCache.xml__r_nCONST_REG_SPP_____________________________SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatform__r_nCONST_REG_SCAEXP_BASE_____________________HKCUSOFTWAREMicrosoftOffice16.0CommonExperimentEcs__r_nCONST_REG_SCAEXP_END_______________________Flightsofc5juzsw45rcw0__r_nCONST_REG_SCAEXP_OVERRIDE_________________HKLMSOFTWAREMicrosoftOfficeCommonExperimentofc5juzsw45rcw0__r_nCONST_REG_SCAO15__________________________HKLMSOFTWAREMicrosoftOffice15.0ClickToRunConfigurationSharedComputerLicensing__r_nCONST_REG_SCAO16__________________________HKLMSOFTWAREMicrosoftOfficeClickToRunConfigurationSharedComputerLicensing__r_nCONST_VALUE_SCAEXP_FLAVOR_________________exp__r_nCONST_VALUE_SCAEXP_OVERRIDE_FLAVOR________expoverride__r_nCONST_VALUE_SCAO15_FLAVOR_________________o15__r_nCONST_VALUE_SCA016_FLAVOR_________________o16__r_nCONST_VALUE_SCAREGKEY_SINGLE_TYPE_________single__r_nCONST_VALUE_SCAREGKEY_PER_APP_TYPE________perapp__r_nCONST_VER_INFO____________________________Version_Info:_2016_1.0__r_n_________________________________________________________________________________________r_nCONST_MSG_NOREGRIGHTS_____________________Insufficient_rights_to_perform_operation.__r_nCONST_MSG_ISCMD_ELEVATED__________________Ensure_cmd.exe_is_elevated__right_click___run_as_administrator_.__r_nCONST_MSG_CREDENTIALFAILURE_______________Connection_failed_with_passed_credentials.__r_nCONST_MSG_FILENOTFOUND____________________File_not_found:___________________r_nCONST_MSG_SEPERATESMALL____________________________________r_nCONST_MSG_SEPERATE_________________________________________________________________r_nCONST_MSG_PROCESSING_________________________Processing____________________________r_nCONST_MSG_EXIT_______________________________Exiting_______________________________r_nCONST_MSG_UNSUPPORTED_____________________Unsupported_command_passed.__r_nCONST_MSG_UNSUPPORTEDOPEROS7______________The_following_command_is_supported_on_Windows_7_only:___r_nCONST_MSG_UNSUPPORTEDOPEROS8______________The_following_command_is_supported_on_Windows_8_and_above_only:___r_nCONST_MSG_UNSUPPORTEDLOCAL________________The_following_command_is_supported_on_local_machine_only:___r_nCONST_MSG_CREDENTIALERR___________________Passing_credentials_is_not_supported_for_this_command.__r_nCONST_MSG_SUCCESS_________________________Successfully_applied_setting.__r_nCONST_MSG_NOKMSLICS_______________________No_Office_KMS_licenses_were_found_on_the_system.__r_nCONST_MSG_ACTATTEMPT______________________Installed_product_key_detected___attempting_to_activate_the_following_product:__r_nCONST_MSG_TOKACTATTEMPT___________________Installed_product_key_detected___attempting_to_token_activate_the_following_product:__r_nCONST_MSG_NOKEYSINSTALLED__________________No_installed_product
mov rax, rbp
push rax
movabs rbp, 0x140281d06
mov rax, rbp
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.1400163b8
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.1400925c0
add rsp, 0x20
pop rcx
push rax
mov rax, 1
mov rax, rax
push rax
push qword [rsp + 0x50]
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
movabs rcx, 0x1401038ea
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
mov rcx, qword [0x140319dfc]
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
movabs rcx, str.____NoLogo__unpkey:RM7PJ
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
call fcn.140092820
movabs rax, str.cscript.exe
push rax
push rax
call fcn.1400927f0
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001284f
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140041f24
add rsp, 0x28
pop rax
mov qword [rsp + 0x30], 1
movabs rax, str.Office19VisioStd2019R_
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jle 0x14002180e
movabs rax, str.e06d7df3_aad0_419d_8dfb_0ac37e2bdf39
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jne 0x14002180e
mov rax, 1
jmp 0x140021811
xor rax, rax
and rax, rax
je 0x140021923
movabs rax, str.lic16
push rax
movabs rax, str.VisioStd2019VL_
push rax
movabs rbp, str.Copyright__c__Microsoft_Corporation._All_rights_reserved._r_n_________________________________________________________________________________________r_n_________________________________________________________________________________________r_nCONST_wshOK_____________________________0_r_nCONST_VALUE_ICON_WARNING________________16_r_nCONST_wshYesNoDialog____________________4_r_nCONST_VALUE_ICON_QUESTIONMARK___________32_r_nCONST_VALUE_ICON_INFORMATION____________64_r_nCONST_HKEY_LOCAL_MACHINE________________H80000002_r_nCONST_KEY_SET_VALUE_____________________H0002_r_nCONST_KEY_QUERY_VALUE___________________H0001_r_nCONST_REG_SZ____________________________1_r_nCONST_OfficeAppId_________________________0ff1ce15_a989_479d_af46_f275c6370663__r_nCONST_STR_SYS32PATH_______________________:WindowsSystem32__r_nCONST_STR_OSPPREARMPATH___________________Microsoft_OfficeOffice16OSPPREARM.EXE__r_nCONST_STR_OSPPREARMPATH_DEBUG_____________Microsoft_Office_DebugOffice16OSPPREARM.EXE__r_nCONST_REG_OSPP____________________________SOFTWAREMicrosoftOfficeSoftwareProtectionPlatform__r_nCONST_STR_HEARTBEATPATH___________________MicrosoftOfficeHeartbeatHeartbeatCache.xml__r_nCONST_REG_SPP_____________________________SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatform__r_nCONST_REG_SCAEXP_BASE_____________________HKCUSOFTWAREMicrosoftOffice16.0CommonExperimentEcs__r_nCONST_REG_SCAEXP_END_______________________Flightsofc5juzsw45rcw0__r_nCONST_REG_SCAEXP_OVERRIDE_________________HKLMSOFTWAREMicrosoftOfficeCommonExperimentofc5juzsw45rcw0__r_nCONST_REG_SCAO15__________________________HKLMSOFTWAREMicrosoftOffice15.0ClickToRunConfigurationSharedComputerLicensing__r_nCONST_REG_SCAO16__________________________HKLMSOFTWAREMicrosoftOfficeClickToRunConfigurationSharedComputerLicensing__r_nCONST_VALUE_SCAEXP_FLAVOR_________________exp__r_nCONST_VALUE_SCAEXP_OVERRIDE_FLAVOR________expoverride__r_nCONST_VALUE_SCAO15_FLAVOR_________________o15__r_nCONST_VALUE_SCA016_FLAVOR_________________o16__r_nCONST_VALUE_SCAREGKEY_SINGLE_TYPE_________single__r_nCONST_VALUE_SCAREGKEY_PER_APP_TYPE________perapp__r_nCONST_VER_INFO____________________________Version_Info:_2016_1.0__r_n_________________________________________________________________________________________r_nCONST_MSG_NOREGRIGHTS_____________________Insufficient_rights_to_perform_operation.__r_nCONST_MSG_ISCMD_ELEVATED__________________Ensure_cmd.exe_is_elevated__right_click___run_as_administrator_.__r_nCONST_MSG_CREDENTIALFAILURE_______________Connection_failed_with_passed_credentials.__r_nCONST_MSG_FILENOTFOUND____________________File_not_found:___________________r_nCONST_MSG_SEPERATESMALL____________________________________r_nCONST_MSG_SEPERATE_________________________________________________________________r_nCONST_MSG_PROCESSING_________________________Processing____________________________r_nCONST_MSG_EXIT_______________________________Exiting_______________________________r_nCONST_MSG_UNSUPPORTED_____________________Unsupported_command_passed.__r_nCONST_MSG_UNSUPPORTEDOPEROS7______________The_following_command_is_supported_on_Windows_7_only:___r_nCONST_MSG_UNSUPPORTEDOPEROS8______________The_following_command_is_supported_on_Windows_8_and_above_only:___r_nCONST_MSG_UNSUPPORTEDLOCAL________________The_following_command_is_supported_on_local_machine_only:___r_nCONST_MSG_CREDENTIALERR___________________Passing_credentials_is_not_supported_for_this_command.__r_nCONST_MSG_SUCCESS_________________________Successfully_applied_setting.__r_nCONST_MSG_NOKMSLICS_______________________No_Office_KMS_licenses_were_found_on_the_system.__r_nCONST_MSG_ACTATTEMPT______________________Installed_product_key_detected___attempting_to_activate_the_following_product:__r_nCONST_MSG_TOKACTATTEMPT___________________Installed_product_key_detected___attempting_to_token_activate_the_following_product:__r_nCONST_MSG_NOKEYSINSTALLED__________________No_installed_product
mov rax, rbp
push rax
movabs rbp, 0x140281d06
mov rax, rbp
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.1400163b8
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.1400925c0
add rsp, 0x20
pop rcx
push rax
mov rax, 1
mov rax, rax
push rax
push qword [rsp + 0x50]
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
movabs rcx, 0x1401038ea
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
mov rcx, qword [0x140319dfc]
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
movabs rcx, str.____NoLogo__unpkey:V8TWH
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
call fcn.140092820
movabs rax, str.cscript.exe
push rax
push rax
call fcn.1400927f0
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001284f
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140041f24
add rsp, 0x28
pop rax
mov qword [rsp + 0x30], 1
movabs rax, str.Office19ProjectPro2019R_
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jle 0x140021968
movabs rax, str.2ca2bf3f_949e_446a_82c7_e25a15ec78c4
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jne 0x140021968
mov rax, 1
jmp 0x14002196b
xor rax, rax
and rax, rax
je 0x140021a7d
movabs rax, str.lic16
push rax
movabs rax, 0x140103be8
push rax
movabs rbp, str.Copyright__c__Microsoft_Corporation._All_rights_reserved._r_n_________________________________________________________________________________________r_n_________________________________________________________________________________________r_nCONST_wshOK_____________________________0_r_nCONST_VALUE_ICON_WARNING________________16_r_nCONST_wshYesNoDialog____________________4_r_nCONST_VALUE_ICON_QUESTIONMARK___________32_r_nCONST_VALUE_ICON_INFORMATION____________64_r_nCONST_HKEY_LOCAL_MACHINE________________H80000002_r_nCONST_KEY_SET_VALUE_____________________H0002_r_nCONST_KEY_QUERY_VALUE___________________H0001_r_nCONST_REG_SZ____________________________1_r_nCONST_OfficeAppId_________________________0ff1ce15_a989_479d_af46_f275c6370663__r_nCONST_STR_SYS32PATH_______________________:WindowsSystem32__r_nCONST_STR_OSPPREARMPATH___________________Microsoft_OfficeOffice16OSPPREARM.EXE__r_nCONST_STR_OSPPREARMPATH_DEBUG_____________Microsoft_Office_DebugOffice16OSPPREARM.EXE__r_nCONST_REG_OSPP____________________________SOFTWAREMicrosoftOfficeSoftwareProtectionPlatform__r_nCONST_STR_HEARTBEATPATH___________________MicrosoftOfficeHeartbeatHeartbeatCache.xml__r_nCONST_REG_SPP_____________________________SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatform__r_nCONST_REG_SCAEXP_BASE_____________________HKCUSOFTWAREMicrosoftOffice16.0CommonExperimentEcs__r_nCONST_REG_SCAEXP_END_______________________Flightsofc5juzsw45rcw0__r_nCONST_REG_SCAEXP_OVERRIDE_________________HKLMSOFTWAREMicrosoftOfficeCommonExperimentofc5juzsw45rcw0__r_nCONST_REG_SCAO15__________________________HKLMSOFTWAREMicrosoftOffice15.0ClickToRunConfigurationSharedComputerLicensing__r_nCONST_REG_SCAO16__________________________HKLMSOFTWAREMicrosoftOfficeClickToRunConfigurationSharedComputerLicensing__r_nCONST_VALUE_SCAEXP_FLAVOR_________________exp__r_nCONST_VALUE_SCAEXP_OVERRIDE_FLAVOR________expoverride__r_nCONST_VALUE_SCAO15_FLAVOR_________________o15__r_nCONST_VALUE_SCA016_FLAVOR_________________o16__r_nCONST_VALUE_SCAREGKEY_SINGLE_TYPE_________single__r_nCONST_VALUE_SCAREGKEY_PER_APP_TYPE________perapp__r_nCONST_VER_INFO____________________________Version_Info:_2016_1.0__r_n_________________________________________________________________________________________r_nCONST_MSG_NOREGRIGHTS_____________________Insufficient_rights_to_perform_operation.__r_nCONST_MSG_ISCMD_ELEVATED__________________Ensure_cmd.exe_is_elevated__right_click___run_as_administrator_.__r_nCONST_MSG_CREDENTIALFAILURE_______________Connection_failed_with_passed_credentials.__r_nCONST_MSG_FILENOTFOUND____________________File_not_found:___________________r_nCONST_MSG_SEPERATESMALL____________________________________r_nCONST_MSG_SEPERATE_________________________________________________________________r_nCONST_MSG_PROCESSING_________________________Processing____________________________r_nCONST_MSG_EXIT_______________________________Exiting_______________________________r_nCONST_MSG_UNSUPPORTED_____________________Unsupported_command_passed.__r_nCONST_MSG_UNSUPPORTEDOPEROS7______________The_following_command_is_supported_on_Windows_7_only:___r_nCONST_MSG_UNSUPPORTEDOPEROS8______________The_following_command_is_supported_on_Windows_8_and_above_only:___r_nCONST_MSG_UNSUPPORTEDLOCAL________________The_following_command_is_supported_on_local_machine_only:___r_nCONST_MSG_CREDENTIALERR___________________Passing_credentials_is_not_supported_for_this_command.__r_nCONST_MSG_SUCCESS_________________________Successfully_applied_setting.__r_nCONST_MSG_NOKMSLICS_______________________No_Office_KMS_licenses_were_found_on_the_system.__r_nCONST_MSG_ACTATTEMPT______________________Installed_product_key_detected___attempting_to_activate_the_following_product:__r_nCONST_MSG_TOKACTATTEMPT___________________Installed_product_key_detected___attempting_to_token_activate_the_following_product:__r_nCONST_MSG_NOKEYSINSTALLED__________________No_installed_product
mov rax, rbp
push rax
movabs rbp, 0x140281d06
mov rax, rbp
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.1400163b8
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.1400925c0
add rsp, 0x20
pop rcx
push rax
mov rax, 1
mov rax, rax
push rax
push qword [rsp + 0x50]
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
movabs rcx, 0x1401038ea
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
mov rcx, qword [0x140319dfc]
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
movabs rcx, str.____NoLogo__unpkey:B4JJJ
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
call fcn.140092820
movabs rax, str.cscript.exe
push rax
push rax
call fcn.1400927f0
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001284f
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140041f24
add rsp, 0x28
pop rax
mov qword [rsp + 0x30], 1
movabs rax, str.Office19VisioPro2019R_
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jle 0x140021ac2
movabs rax, str.5b5cf08f_b81a_431d_b080_3450d8620565
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jne 0x140021ac2
mov rax, 1
jmp 0x140021ac5
xor rax, rax
and rax, rax
je 0x140021bd7
movabs rax, str.lic16
push rax
movabs rax, str.VisioPro2019VL_
push rax
movabs rbp, str.Copyright__c__Microsoft_Corporation._All_rights_reserved._r_n_________________________________________________________________________________________r_n_________________________________________________________________________________________r_nCONST_wshOK_____________________________0_r_nCONST_VALUE_ICON_WARNING________________16_r_nCONST_wshYesNoDialog____________________4_r_nCONST_VALUE_ICON_QUESTIONMARK___________32_r_nCONST_VALUE_ICON_INFORMATION____________64_r_nCONST_HKEY_LOCAL_MACHINE________________H80000002_r_nCONST_KEY_SET_VALUE_____________________H0002_r_nCONST_KEY_QUERY_VALUE___________________H0001_r_nCONST_REG_SZ____________________________1_r_nCONST_OfficeAppId_________________________0ff1ce15_a989_479d_af46_f275c6370663__r_nCONST_STR_SYS32PATH_______________________:WindowsSystem32__r_nCONST_STR_OSPPREARMPATH___________________Microsoft_OfficeOffice16OSPPREARM.EXE__r_nCONST_STR_OSPPREARMPATH_DEBUG_____________Microsoft_Office_DebugOffice16OSPPREARM.EXE__r_nCONST_REG_OSPP____________________________SOFTWAREMicrosoftOfficeSoftwareProtectionPlatform__r_nCONST_STR_HEARTBEATPATH___________________MicrosoftOfficeHeartbeatHeartbeatCache.xml__r_nCONST_REG_SPP_____________________________SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatform__r_nCONST_REG_SCAEXP_BASE_____________________HKCUSOFTWAREMicrosoftOffice16.0CommonExperimentEcs__r_nCONST_REG_SCAEXP_END_______________________Flightsofc5juzsw45rcw0__r_nCONST_REG_SCAEXP_OVERRIDE_________________HKLMSOFTWAREMicrosoftOfficeCommonExperimentofc5juzsw45rcw0__r_nCONST_REG_SCAO15__________________________HKLMSOFTWAREMicrosoftOffice15.0ClickToRunConfigurationSharedComputerLicensing__r_nCONST_REG_SCAO16__________________________HKLMSOFTWAREMicrosoftOfficeClickToRunConfigurationSharedComputerLicensing__r_nCONST_VALUE_SCAEXP_FLAVOR_________________exp__r_nCONST_VALUE_SCAEXP_OVERRIDE_FLAVOR________expoverride__r_nCONST_VALUE_SCAO15_FLAVOR_________________o15__r_nCONST_VALUE_SCA016_FLAVOR_________________o16__r_nCONST_VALUE_SCAREGKEY_SINGLE_TYPE_________single__r_nCONST_VALUE_SCAREGKEY_PER_APP_TYPE________perapp__r_nCONST_VER_INFO____________________________Version_Info:_2016_1.0__r_n_________________________________________________________________________________________r_nCONST_MSG_NOREGRIGHTS_____________________Insufficient_rights_to_perform_operation.__r_nCONST_MSG_ISCMD_ELEVATED__________________Ensure_cmd.exe_is_elevated__right_click___run_as_administrator_.__r_nCONST_MSG_CREDENTIALFAILURE_______________Connection_failed_with_passed_credentials.__r_nCONST_MSG_FILENOTFOUND____________________File_not_found:___________________r_nCONST_MSG_SEPERATESMALL____________________________________r_nCONST_MSG_SEPERATE_________________________________________________________________r_nCONST_MSG_PROCESSING_________________________Processing____________________________r_nCONST_MSG_EXIT_______________________________Exiting_______________________________r_nCONST_MSG_UNSUPPORTED_____________________Unsupported_command_passed.__r_nCONST_MSG_UNSUPPORTEDOPEROS7______________The_following_command_is_supported_on_Windows_7_only:___r_nCONST_MSG_UNSUPPORTEDOPEROS8______________The_following_command_is_supported_on_Windows_8_and_above_only:___r_nCONST_MSG_UNSUPPORTEDLOCAL________________The_following_command_is_supported_on_local_machine_only:___r_nCONST_MSG_CREDENTIALERR___________________Passing_credentials_is_not_supported_for_this_command.__r_nCONST_MSG_SUCCESS_________________________Successfully_applied_setting.__r_nCONST_MSG_NOKMSLICS_______________________No_Office_KMS_licenses_were_found_on_the_system.__r_nCONST_MSG_ACTATTEMPT______________________Installed_product_key_detected___attempting_to_activate_the_following_product:__r_nCONST_MSG_TOKACTATTEMPT___________________Installed_product_key_detected___attempting_to_token_activate_the_following_product:__r_nCONST_MSG_NOKEYSINSTALLED__________________No_installed_product
mov rax, rbp
push rax
movabs rbp, 0x140281d06
mov rax, rbp
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.1400163b8
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.1400925c0
add rsp, 0x20
pop rcx
push rax
mov rax, 1
mov rax, rax
push rax
push qword [rsp + 0x50]
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
movabs rcx, 0x1401038ea
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
mov rcx, qword [0x140319dfc]
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
movabs rcx, str.____NoLogo__unpkey:684YW
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
call fcn.140092820
movabs rax, str.cscript.exe
push rax
push rax
call fcn.1400927f0
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001284f
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140041f24
add rsp, 0x28
pop rax
mov qword [rsp + 0x30], 1
movabs rax, str.Office19ProPlus2019R_
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jle 0x140021c1c
movabs rax, str.85dd8b5f_eaa4_4af3_a628_cce9e77c9a03
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jne 0x140021c1c
mov rax, 1
jmp 0x140021c1f
xor rax, rax
and rax, rax
je 0x140021d31
movabs rax, str.lic16
push rax
movabs rax, str.ProPlus2019VL_
push rax
movabs rbp, str.Copyright__c__Microsoft_Corporation._All_rights_reserved._r_n_________________________________________________________________________________________r_n_________________________________________________________________________________________r_nCONST_wshOK_____________________________0_r_nCONST_VALUE_ICON_WARNING________________16_r_nCONST_wshYesNoDialog____________________4_r_nCONST_VALUE_ICON_QUESTIONMARK___________32_r_nCONST_VALUE_ICON_INFORMATION____________64_r_nCONST_HKEY_LOCAL_MACHINE________________H80000002_r_nCONST_KEY_SET_VALUE_____________________H0002_r_nCONST_KEY_QUERY_VALUE___________________H0001_r_nCONST_REG_SZ____________________________1_r_nCONST_OfficeAppId_________________________0ff1ce15_a989_479d_af46_f275c6370663__r_nCONST_STR_SYS32PATH_______________________:WindowsSystem32__r_nCONST_STR_OSPPREARMPATH___________________Microsoft_OfficeOffice16OSPPREARM.EXE__r_nCONST_STR_OSPPREARMPATH_DEBUG_____________Microsoft_Office_DebugOffice16OSPPREARM.EXE__r_nCONST_REG_OSPP____________________________SOFTWAREMicrosoftOfficeSoftwareProtectionPlatform__r_nCONST_STR_HEARTBEATPATH___________________MicrosoftOfficeHeartbeatHeartbeatCache.xml__r_nCONST_REG_SPP_____________________________SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatform__r_nCONST_REG_SCAEXP_BASE_____________________HKCUSOFTWAREMicrosoftOffice16.0CommonExperimentEcs__r_nCONST_REG_SCAEXP_END_______________________Flightsofc5juzsw45rcw0__r_nCONST_REG_SCAEXP_OVERRIDE_________________HKLMSOFTWAREMicrosoftOfficeCommonExperimentofc5juzsw45rcw0__r_nCONST_REG_SCAO15__________________________HKLMSOFTWAREMicrosoftOffice15.0ClickToRunConfigurationSharedComputerLicensing__r_nCONST_REG_SCAO16__________________________HKLMSOFTWAREMicrosoftOfficeClickToRunConfigurationSharedComputerLicensing__r_nCONST_VALUE_SCAEXP_FLAVOR_________________exp__r_nCONST_VALUE_SCAEXP_OVERRIDE_FLAVOR________expoverride__r_nCONST_VALUE_SCAO15_FLAVOR_________________o15__r_nCONST_VALUE_SCA016_FLAVOR_________________o16__r_nCONST_VALUE_SCAREGKEY_SINGLE_TYPE_________single__r_nCONST_VALUE_SCAREGKEY_PER_APP_TYPE________perapp__r_nCONST_VER_INFO____________________________Version_Info:_2016_1.0__r_n_________________________________________________________________________________________r_nCONST_MSG_NOREGRIGHTS_____________________Insufficient_rights_to_perform_operation.__r_nCONST_MSG_ISCMD_ELEVATED__________________Ensure_cmd.exe_is_elevated__right_click___run_as_administrator_.__r_nCONST_MSG_CREDENTIALFAILURE_______________Connection_failed_with_passed_credentials.__r_nCONST_MSG_FILENOTFOUND____________________File_not_found:___________________r_nCONST_MSG_SEPERATESMALL____________________________________r_nCONST_MSG_SEPERATE_________________________________________________________________r_nCONST_MSG_PROCESSING_________________________Processing____________________________r_nCONST_MSG_EXIT_______________________________Exiting_______________________________r_nCONST_MSG_UNSUPPORTED_____________________Unsupported_command_passed.__r_nCONST_MSG_UNSUPPORTEDOPEROS7______________The_following_command_is_supported_on_Windows_7_only:___r_nCONST_MSG_UNSUPPORTEDOPEROS8______________The_following_command_is_supported_on_Windows_8_and_above_only:___r_nCONST_MSG_UNSUPPORTEDLOCAL________________The_following_command_is_supported_on_local_machine_only:___r_nCONST_MSG_CREDENTIALERR___________________Passing_credentials_is_not_supported_for_this_command.__r_nCONST_MSG_SUCCESS_________________________Successfully_applied_setting.__r_nCONST_MSG_NOKMSLICS_______________________No_Office_KMS_licenses_were_found_on_the_system.__r_nCONST_MSG_ACTATTEMPT______________________Installed_product_key_detected___attempting_to_activate_the_following_product:__r_nCONST_MSG_TOKACTATTEMPT___________________Installed_product_key_detected___attempting_to_token_activate_the_following_product:__r_nCONST_MSG_NOKEYSINSTALLED__________________No_installed_product
mov rax, rbp
push rax
movabs rbp, 0x140281d06
mov rax, rbp
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.1400163b8
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.1400925c0
add rsp, 0x20
pop rcx
push rax
mov rax, 1
mov rax, rax
push rax
push qword [rsp + 0x50]
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
movabs rcx, 0x1401038ea
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
mov rcx, qword [0x140319dfc]
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
movabs rcx, str.____NoLogo__unpkey:8MBCX
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
call fcn.140092820
movabs rax, str.cscript.exe
push rax
push rax
call fcn.1400927f0
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001284f
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140041f24
add rsp, 0x28
pop rax
mov qword [rsp + 0x30], 1
movabs rax, str.Office19Standard2019R_
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jle 0x140021d76
movabs rax, str.6912a74b_a5fb_401a_bfdb_2e3ab46f4b02
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jne 0x140021d76
mov rax, 1
jmp 0x140021d79
xor rax, rax
and rax, rax
je 0x140021e8b
movabs rax, str.lic16
push rax
movabs rax, str.Standard2019VL_
push rax
movabs rbp, str.Copyright__c__Microsoft_Corporation._All_rights_reserved._r_n_________________________________________________________________________________________r_n_________________________________________________________________________________________r_nCONST_wshOK_____________________________0_r_nCONST_VALUE_ICON_WARNING________________16_r_nCONST_wshYesNoDialog____________________4_r_nCONST_VALUE_ICON_QUESTIONMARK___________32_r_nCONST_VALUE_ICON_INFORMATION____________64_r_nCONST_HKEY_LOCAL_MACHINE________________H80000002_r_nCONST_KEY_SET_VALUE_____________________H0002_r_nCONST_KEY_QUERY_VALUE___________________H0001_r_nCONST_REG_SZ____________________________1_r_nCONST_OfficeAppId_________________________0ff1ce15_a989_479d_af46_f275c6370663__r_nCONST_STR_SYS32PATH_______________________:WindowsSystem32__r_nCONST_STR_OSPPREARMPATH___________________Microsoft_OfficeOffice16OSPPREARM.EXE__r_nCONST_STR_OSPPREARMPATH_DEBUG_____________Microsoft_Office_DebugOffice16OSPPREARM.EXE__r_nCONST_REG_OSPP____________________________SOFTWAREMicrosoftOfficeSoftwareProtectionPlatform__r_nCONST_STR_HEARTBEATPATH___________________MicrosoftOfficeHeartbeatHeartbeatCache.xml__r_nCONST_REG_SPP_____________________________SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatform__r_nCONST_REG_SCAEXP_BASE_____________________HKCUSOFTWAREMicrosoftOffice16.0CommonExperimentEcs__r_nCONST_REG_SCAEXP_END_______________________Flightsofc5juzsw45rcw0__r_nCONST_REG_SCAEXP_OVERRIDE_________________HKLMSOFTWAREMicrosoftOfficeCommonExperimentofc5juzsw45rcw0__r_nCONST_REG_SCAO15__________________________HKLMSOFTWAREMicrosoftOffice15.0ClickToRunConfigurationSharedComputerLicensing__r_nCONST_REG_SCAO16__________________________HKLMSOFTWAREMicrosoftOfficeClickToRunConfigurationSharedComputerLicensing__r_nCONST_VALUE_SCAEXP_FLAVOR_________________exp__r_nCONST_VALUE_SCAEXP_OVERRIDE_FLAVOR________expoverride__r_nCONST_VALUE_SCAO15_FLAVOR_________________o15__r_nCONST_VALUE_SCA016_FLAVOR_________________o16__r_nCONST_VALUE_SCAREGKEY_SINGLE_TYPE_________single__r_nCONST_VALUE_SCAREGKEY_PER_APP_TYPE________perapp__r_nCONST_VER_INFO____________________________Version_Info:_2016_1.0__r_n_________________________________________________________________________________________r_nCONST_MSG_NOREGRIGHTS_____________________Insufficient_rights_to_perform_operation.__r_nCONST_MSG_ISCMD_ELEVATED__________________Ensure_cmd.exe_is_elevated__right_click___run_as_administrator_.__r_nCONST_MSG_CREDENTIALFAILURE_______________Connection_failed_with_passed_credentials.__r_nCONST_MSG_FILENOTFOUND____________________File_not_found:___________________r_nCONST_MSG_SEPERATESMALL____________________________________r_nCONST_MSG_SEPERATE_________________________________________________________________r_nCONST_MSG_PROCESSING_________________________Processing____________________________r_nCONST_MSG_EXIT_______________________________Exiting_______________________________r_nCONST_MSG_UNSUPPORTED_____________________Unsupported_command_passed.__r_nCONST_MSG_UNSUPPORTEDOPEROS7______________The_following_command_is_supported_on_Windows_7_only:___r_nCONST_MSG_UNSUPPORTEDOPEROS8______________The_following_command_is_supported_on_Windows_8_and_above_only:___r_nCONST_MSG_UNSUPPORTEDLOCAL________________The_following_command_is_supported_on_local_machine_only:___r_nCONST_MSG_CREDENTIALERR___________________Passing_credentials_is_not_supported_for_this_command.__r_nCONST_MSG_SUCCESS_________________________Successfully_applied_setting.__r_nCONST_MSG_NOKMSLICS_______________________No_Office_KMS_licenses_were_found_on_the_system.__r_nCONST_MSG_ACTATTEMPT______________________Installed_product_key_detected___attempting_to_activate_the_following_product:__r_nCONST_MSG_TOKACTATTEMPT___________________Installed_product_key_detected___attempting_to_token_activate_the_following_product:__r_nCONST_MSG_NOKEYSINSTALLED__________________No_installed_product
mov rax, rbp
push rax
movabs rbp, 0x140281d06
mov rax, rbp
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.1400163b8
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.1400925c0
add rsp, 0x20
pop rcx
push rax
mov rax, 1
mov rax, rax
push rax
push qword [rsp + 0x50]
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
movabs rcx, 0x1401038ea
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
mov rcx, qword [0x140319dfc]
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
movabs rcx, str.____NoLogo__unpkey:Y4JMV
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
call fcn.140092820
movabs rax, str.cscript.exe
push rax
push rax
call fcn.1400927f0
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001284f
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140041f24
add rsp, 0x28
pop rax
mov qword [rsp + 0x30], 1
movabs rax, str.Office21Standard2021R_
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jle 0x140021ed0
movabs rax, str.080a45c5_9f9f_49eb_b4b0_c3c610a5ebd3
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jne 0x140021ed0
mov rax, 1
jmp 0x140021ed3
xor rax, rax
and rax, rax
je 0x140021fe5
movabs rax, str.lic16
push rax
movabs rax, str.Standard2021VL_
push rax
movabs rbp, str.Copyright__c__Microsoft_Corporation._All_rights_reserved._r_n_________________________________________________________________________________________r_n_________________________________________________________________________________________r_nCONST_wshOK_____________________________0_r_nCONST_VALUE_ICON_WARNING________________16_r_nCONST_wshYesNoDialog____________________4_r_nCONST_VALUE_ICON_QUESTIONMARK___________32_r_nCONST_VALUE_ICON_INFORMATION____________64_r_nCONST_HKEY_LOCAL_MACHINE________________H80000002_r_nCONST_KEY_SET_VALUE_____________________H0002_r_nCONST_KEY_QUERY_VALUE___________________H0001_r_nCONST_REG_SZ____________________________1_r_nCONST_OfficeAppId_________________________0ff1ce15_a989_479d_af46_f275c6370663__r_nCONST_STR_SYS32PATH_______________________:WindowsSystem32__r_nCONST_STR_OSPPREARMPATH___________________Microsoft_OfficeOffice16OSPPREARM.EXE__r_nCONST_STR_OSPPREARMPATH_DEBUG_____________Microsoft_Office_DebugOffice16OSPPREARM.EXE__r_nCONST_REG_OSPP____________________________SOFTWAREMicrosoftOfficeSoftwareProtectionPlatform__r_nCONST_STR_HEARTBEATPATH___________________MicrosoftOfficeHeartbeatHeartbeatCache.xml__r_nCONST_REG_SPP_____________________________SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatform__r_nCONST_REG_SCAEXP_BASE_____________________HKCUSOFTWAREMicrosoftOffice16.0CommonExperimentEcs__r_nCONST_REG_SCAEXP_END_______________________Flightsofc5juzsw45rcw0__r_nCONST_REG_SCAEXP_OVERRIDE_________________HKLMSOFTWAREMicrosoftOfficeCommonExperimentofc5juzsw45rcw0__r_nCONST_REG_SCAO15__________________________HKLMSOFTWAREMicrosoftOffice15.0ClickToRunConfigurationSharedComputerLicensing__r_nCONST_REG_SCAO16__________________________HKLMSOFTWAREMicrosoftOfficeClickToRunConfigurationSharedComputerLicensing__r_nCONST_VALUE_SCAEXP_FLAVOR_________________exp__r_nCONST_VALUE_SCAEXP_OVERRIDE_FLAVOR________expoverride__r_nCONST_VALUE_SCAO15_FLAVOR_________________o15__r_nCONST_VALUE_SCA016_FLAVOR_________________o16__r_nCONST_VALUE_SCAREGKEY_SINGLE_TYPE_________single__r_nCONST_VALUE_SCAREGKEY_PER_APP_TYPE________perapp__r_nCONST_VER_INFO____________________________Version_Info:_2016_1.0__r_n_________________________________________________________________________________________r_nCONST_MSG_NOREGRIGHTS_____________________Insufficient_rights_to_perform_operation.__r_nCONST_MSG_ISCMD_ELEVATED__________________Ensure_cmd.exe_is_elevated__right_click___run_as_administrator_.__r_nCONST_MSG_CREDENTIALFAILURE_______________Connection_failed_with_passed_credentials.__r_nCONST_MSG_FILENOTFOUND____________________File_not_found:___________________r_nCONST_MSG_SEPERATESMALL____________________________________r_nCONST_MSG_SEPERATE_________________________________________________________________r_nCONST_MSG_PROCESSING_________________________Processing____________________________r_nCONST_MSG_EXIT_______________________________Exiting_______________________________r_nCONST_MSG_UNSUPPORTED_____________________Unsupported_command_passed.__r_nCONST_MSG_UNSUPPORTEDOPEROS7______________The_following_command_is_supported_on_Windows_7_only:___r_nCONST_MSG_UNSUPPORTEDOPEROS8______________The_following_command_is_supported_on_Windows_8_and_above_only:___r_nCONST_MSG_UNSUPPORTEDLOCAL________________The_following_command_is_supported_on_local_machine_only:___r_nCONST_MSG_CREDENTIALERR___________________Passing_credentials_is_not_supported_for_this_command.__r_nCONST_MSG_SUCCESS_________________________Successfully_applied_setting.__r_nCONST_MSG_NOKMSLICS_______________________No_Office_KMS_licenses_were_found_on_the_system.__r_nCONST_MSG_ACTATTEMPT______________________Installed_product_key_detected___attempting_to_activate_the_following_product:__r_nCONST_MSG_TOKACTATTEMPT___________________Installed_product_key_detected___attempting_to_token_activate_the_following_product:__r_nCONST_MSG_NOKEYSINSTALLED__________________No_installed_product
mov rax, rbp
push rax
movabs rbp, 0x140281d06
mov rax, rbp
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.1400163b8
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.1400925c0
add rsp, 0x20
pop rcx
push rax
mov rax, 1
mov rax, rax
push rax
push qword [rsp + 0x50]
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
movabs rcx, 0x1401038ea
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
mov rcx, qword [0x140319dfc]
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
movabs rcx, str.____NoLogo__unpkey:TRBHK
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
call fcn.140092820
movabs rax, str.cscript.exe
push rax
push rax
call fcn.1400927f0
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001284f
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140041f24
add rsp, 0x28
pop rax
mov qword [rsp + 0x30], 1
movabs rax, str.Office21ProPlus2021R_
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jle 0x14002202a
movabs rax, str.fbdb3e18_a8ef_4fb3_9183_dffd60bd0984
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jne 0x14002202a
mov rax, 1
jmp 0x14002202d
xor rax, rax
and rax, rax
je 0x14002213f
movabs rax, str.lic16
push rax
movabs rax, str.ProPlus2021VL_
push rax
movabs rbp, str.Copyright__c__Microsoft_Corporation._All_rights_reserved._r_n_________________________________________________________________________________________r_n_________________________________________________________________________________________r_nCONST_wshOK_____________________________0_r_nCONST_VALUE_ICON_WARNING________________16_r_nCONST_wshYesNoDialog____________________4_r_nCONST_VALUE_ICON_QUESTIONMARK___________32_r_nCONST_VALUE_ICON_INFORMATION____________64_r_nCONST_HKEY_LOCAL_MACHINE________________H80000002_r_nCONST_KEY_SET_VALUE_____________________H0002_r_nCONST_KEY_QUERY_VALUE___________________H0001_r_nCONST_REG_SZ____________________________1_r_nCONST_OfficeAppId_________________________0ff1ce15_a989_479d_af46_f275c6370663__r_nCONST_STR_SYS32PATH_______________________:WindowsSystem32__r_nCONST_STR_OSPPREARMPATH___________________Microsoft_OfficeOffice16OSPPREARM.EXE__r_nCONST_STR_OSPPREARMPATH_DEBUG_____________Microsoft_Office_DebugOffice16OSPPREARM.EXE__r_nCONST_REG_OSPP____________________________SOFTWAREMicrosoftOfficeSoftwareProtectionPlatform__r_nCONST_STR_HEARTBEATPATH___________________MicrosoftOfficeHeartbeatHeartbeatCache.xml__r_nCONST_REG_SPP_____________________________SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatform__r_nCONST_REG_SCAEXP_BASE_____________________HKCUSOFTWAREMicrosoftOffice16.0CommonExperimentEcs__r_nCONST_REG_SCAEXP_END_______________________Flightsofc5juzsw45rcw0__r_nCONST_REG_SCAEXP_OVERRIDE_________________HKLMSOFTWAREMicrosoftOfficeCommonExperimentofc5juzsw45rcw0__r_nCONST_REG_SCAO15__________________________HKLMSOFTWAREMicrosoftOffice15.0ClickToRunConfigurationSharedComputerLicensing__r_nCONST_REG_SCAO16__________________________HKLMSOFTWAREMicrosoftOfficeClickToRunConfigurationSharedComputerLicensing__r_nCONST_VALUE_SCAEXP_FLAVOR_________________exp__r_nCONST_VALUE_SCAEXP_OVERRIDE_FLAVOR________expoverride__r_nCONST_VALUE_SCAO15_FLAVOR_________________o15__r_nCONST_VALUE_SCA016_FLAVOR_________________o16__r_nCONST_VALUE_SCAREGKEY_SINGLE_TYPE_________single__r_nCONST_VALUE_SCAREGKEY_PER_APP_TYPE________perapp__r_nCONST_VER_INFO____________________________Version_Info:_2016_1.0__r_n_________________________________________________________________________________________r_nCONST_MSG_NOREGRIGHTS_____________________Insufficient_rights_to_perform_operation.__r_nCONST_MSG_ISCMD_ELEVATED__________________Ensure_cmd.exe_is_elevated__right_click___run_as_administrator_.__r_nCONST_MSG_CREDENTIALFAILURE_______________Connection_failed_with_passed_credentials.__r_nCONST_MSG_FILENOTFOUND____________________File_not_found:___________________r_nCONST_MSG_SEPERATESMALL____________________________________r_nCONST_MSG_SEPERATE_________________________________________________________________r_nCONST_MSG_PROCESSING_________________________Processing____________________________r_nCONST_MSG_EXIT_______________________________Exiting_______________________________r_nCONST_MSG_UNSUPPORTED_____________________Unsupported_command_passed.__r_nCONST_MSG_UNSUPPORTEDOPEROS7______________The_following_command_is_supported_on_Windows_7_only:___r_nCONST_MSG_UNSUPPORTEDOPEROS8______________The_following_command_is_supported_on_Windows_8_and_above_only:___r_nCONST_MSG_UNSUPPORTEDLOCAL________________The_following_command_is_supported_on_local_machine_only:___r_nCONST_MSG_CREDENTIALERR___________________Passing_credentials_is_not_supported_for_this_command.__r_nCONST_MSG_SUCCESS_________________________Successfully_applied_setting.__r_nCONST_MSG_NOKMSLICS_______________________No_Office_KMS_licenses_were_found_on_the_system.__r_nCONST_MSG_ACTATTEMPT______________________Installed_product_key_detected___attempting_to_activate_the_following_product:__r_nCONST_MSG_TOKACTATTEMPT___________________Installed_product_key_detected___attempting_to_token_activate_the_following_product:__r_nCONST_MSG_NOKEYSINSTALLED__________________No_installed_product
mov rax, rbp
push rax
movabs rbp, 0x140281d06
mov rax, rbp
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.1400163b8
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.1400925c0
add rsp, 0x20
pop rcx
push rax
mov rax, 1
mov rax, rax
push rax
push qword [rsp + 0x50]
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
movabs rcx, 0x1401038ea
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
mov rcx, qword [0x140319dfc]
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
movabs rcx, str.____NoLogo__unpkey:PG343
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
call fcn.140092820
movabs rax, str.cscript.exe
push rax
push rax
call fcn.1400927f0
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001284f
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140041f24
add rsp, 0x28
pop rax
mov qword [rsp + 0x30], 1
movabs rax, str.Office21ProjectStd2021R_
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jle 0x140022184
movabs rax, str.6dd72704_f752_4b71_94c7_11cec6bfc355
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jne 0x140022184
mov rax, 1
jmp 0x140022187
xor rax, rax
and rax, rax
je 0x140022299
movabs rax, str.lic16
push rax
movabs rax, str.ProjectStd2021VL_
push rax
movabs rbp, str.Copyright__c__Microsoft_Corporation._All_rights_reserved._r_n_________________________________________________________________________________________r_n_________________________________________________________________________________________r_nCONST_wshOK_____________________________0_r_nCONST_VALUE_ICON_WARNING________________16_r_nCONST_wshYesNoDialog____________________4_r_nCONST_VALUE_ICON_QUESTIONMARK___________32_r_nCONST_VALUE_ICON_INFORMATION____________64_r_nCONST_HKEY_LOCAL_MACHINE________________H80000002_r_nCONST_KEY_SET_VALUE_____________________H0002_r_nCONST_KEY_QUERY_VALUE___________________H0001_r_nCONST_REG_SZ____________________________1_r_nCONST_OfficeAppId_________________________0ff1ce15_a989_479d_af46_f275c6370663__r_nCONST_STR_SYS32PATH_______________________:WindowsSystem32__r_nCONST_STR_OSPPREARMPATH___________________Microsoft_OfficeOffice16OSPPREARM.EXE__r_nCONST_STR_OSPPREARMPATH_DEBUG_____________Microsoft_Office_DebugOffice16OSPPREARM.EXE__r_nCONST_REG_OSPP____________________________SOFTWAREMicrosoftOfficeSoftwareProtectionPlatform__r_nCONST_STR_HEARTBEATPATH___________________MicrosoftOfficeHeartbeatHeartbeatCache.xml__r_nCONST_REG_SPP_____________________________SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatform__r_nCONST_REG_SCAEXP_BASE_____________________HKCUSOFTWAREMicrosoftOffice16.0CommonExperimentEcs__r_nCONST_REG_SCAEXP_END_______________________Flightsofc5juzsw45rcw0__r_nCONST_REG_SCAEXP_OVERRIDE_________________HKLMSOFTWAREMicrosoftOfficeCommonExperimentofc5juzsw45rcw0__r_nCONST_REG_SCAO15__________________________HKLMSOFTWAREMicrosoftOffice15.0ClickToRunConfigurationSharedComputerLicensing__r_nCONST_REG_SCAO16__________________________HKLMSOFTWAREMicrosoftOfficeClickToRunConfigurationSharedComputerLicensing__r_nCONST_VALUE_SCAEXP_FLAVOR_________________exp__r_nCONST_VALUE_SCAEXP_OVERRIDE_FLAVOR________expoverride__r_nCONST_VALUE_SCAO15_FLAVOR_________________o15__r_nCONST_VALUE_SCA016_FLAVOR_________________o16__r_nCONST_VALUE_SCAREGKEY_SINGLE_TYPE_________single__r_nCONST_VALUE_SCAREGKEY_PER_APP_TYPE________perapp__r_nCONST_VER_INFO____________________________Version_Info:_2016_1.0__r_n_________________________________________________________________________________________r_nCONST_MSG_NOREGRIGHTS_____________________Insufficient_rights_to_perform_operation.__r_nCONST_MSG_ISCMD_ELEVATED__________________Ensure_cmd.exe_is_elevated__right_click___run_as_administrator_.__r_nCONST_MSG_CREDENTIALFAILURE_______________Connection_failed_with_passed_credentials.__r_nCONST_MSG_FILENOTFOUND____________________File_not_found:___________________r_nCONST_MSG_SEPERATESMALL____________________________________r_nCONST_MSG_SEPERATE_________________________________________________________________r_nCONST_MSG_PROCESSING_________________________Processing____________________________r_nCONST_MSG_EXIT_______________________________Exiting_______________________________r_nCONST_MSG_UNSUPPORTED_____________________Unsupported_command_passed.__r_nCONST_MSG_UNSUPPORTEDOPEROS7______________The_following_command_is_supported_on_Windows_7_only:___r_nCONST_MSG_UNSUPPORTEDOPEROS8______________The_following_command_is_supported_on_Windows_8_and_above_only:___r_nCONST_MSG_UNSUPPORTEDLOCAL________________The_following_command_is_supported_on_local_machine_only:___r_nCONST_MSG_CREDENTIALERR___________________Passing_credentials_is_not_supported_for_this_command.__r_nCONST_MSG_SUCCESS_________________________Successfully_applied_setting.__r_nCONST_MSG_NOKMSLICS_______________________No_Office_KMS_licenses_were_found_on_the_system.__r_nCONST_MSG_ACTATTEMPT______________________Installed_product_key_detected___attempting_to_activate_the_following_product:__r_nCONST_MSG_TOKACTATTEMPT___________________Installed_product_key_detected___attempting_to_token_activate_the_following_product:__r_nCONST_MSG_NOKEYSINSTALLED__________________No_installed_product
mov rax, rbp
push rax
movabs rbp, 0x140281d06
mov rax, rbp
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.1400163b8
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.1400925c0
add rsp, 0x20
pop rcx
push rax
mov rax, 1
mov rax, rax
push rax
push qword [rsp + 0x50]
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
movabs rcx, 0x1401038ea
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
mov rcx, qword [0x140319dfc]
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
movabs rcx, str.____NoLogo__unpkey:QYMFQ
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
call fcn.140092820
movabs rax, str.cscript.exe
push rax
push rax
call fcn.1400927f0
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001284f
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140041f24
add rsp, 0x28
pop rax
mov qword [rsp + 0x30], 1
movabs rax, str.Office21ProjectPro2021R_
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jle 0x1400222de
movabs rax, str.76881159_155c_43e0_9db7_2d70a9a3a4ca
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jne 0x1400222de
mov rax, 1
jmp 0x1400222e1
xor rax, rax
and rax, rax
je 0x1400223f3
movabs rax, str.lic16
push rax
movabs rax, str.ProjectPro2021VL_
push rax
movabs rbp, str.Copyright__c__Microsoft_Corporation._All_rights_reserved._r_n_________________________________________________________________________________________r_n_________________________________________________________________________________________r_nCONST_wshOK_____________________________0_r_nCONST_VALUE_ICON_WARNING________________16_r_nCONST_wshYesNoDialog____________________4_r_nCONST_VALUE_ICON_QUESTIONMARK___________32_r_nCONST_VALUE_ICON_INFORMATION____________64_r_nCONST_HKEY_LOCAL_MACHINE________________H80000002_r_nCONST_KEY_SET_VALUE_____________________H0002_r_nCONST_KEY_QUERY_VALUE___________________H0001_r_nCONST_REG_SZ____________________________1_r_nCONST_OfficeAppId_________________________0ff1ce15_a989_479d_af46_f275c6370663__r_nCONST_STR_SYS32PATH_______________________:WindowsSystem32__r_nCONST_STR_OSPPREARMPATH___________________Microsoft_OfficeOffice16OSPPREARM.EXE__r_nCONST_STR_OSPPREARMPATH_DEBUG_____________Microsoft_Office_DebugOffice16OSPPREARM.EXE__r_nCONST_REG_OSPP____________________________SOFTWAREMicrosoftOfficeSoftwareProtectionPlatform__r_nCONST_STR_HEARTBEATPATH___________________MicrosoftOfficeHeartbeatHeartbeatCache.xml__r_nCONST_REG_SPP_____________________________SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatform__r_nCONST_REG_SCAEXP_BASE_____________________HKCUSOFTWAREMicrosoftOffice16.0CommonExperimentEcs__r_nCONST_REG_SCAEXP_END_______________________Flightsofc5juzsw45rcw0__r_nCONST_REG_SCAEXP_OVERRIDE_________________HKLMSOFTWAREMicrosoftOfficeCommonExperimentofc5juzsw45rcw0__r_nCONST_REG_SCAO15__________________________HKLMSOFTWAREMicrosoftOffice15.0ClickToRunConfigurationSharedComputerLicensing__r_nCONST_REG_SCAO16__________________________HKLMSOFTWAREMicrosoftOfficeClickToRunConfigurationSharedComputerLicensing__r_nCONST_VALUE_SCAEXP_FLAVOR_________________exp__r_nCONST_VALUE_SCAEXP_OVERRIDE_FLAVOR________expoverride__r_nCONST_VALUE_SCAO15_FLAVOR_________________o15__r_nCONST_VALUE_SCA016_FLAVOR_________________o16__r_nCONST_VALUE_SCAREGKEY_SINGLE_TYPE_________single__r_nCONST_VALUE_SCAREGKEY_PER_APP_TYPE________perapp__r_nCONST_VER_INFO____________________________Version_Info:_2016_1.0__r_n_________________________________________________________________________________________r_nCONST_MSG_NOREGRIGHTS_____________________Insufficient_rights_to_perform_operation.__r_nCONST_MSG_ISCMD_ELEVATED__________________Ensure_cmd.exe_is_elevated__right_click___run_as_administrator_.__r_nCONST_MSG_CREDENTIALFAILURE_______________Connection_failed_with_passed_credentials.__r_nCONST_MSG_FILENOTFOUND____________________File_not_found:___________________r_nCONST_MSG_SEPERATESMALL____________________________________r_nCONST_MSG_SEPERATE_________________________________________________________________r_nCONST_MSG_PROCESSING_________________________Processing____________________________r_nCONST_MSG_EXIT_______________________________Exiting_______________________________r_nCONST_MSG_UNSUPPORTED_____________________Unsupported_command_passed.__r_nCONST_MSG_UNSUPPORTEDOPEROS7______________The_following_command_is_supported_on_Windows_7_only:___r_nCONST_MSG_UNSUPPORTEDOPEROS8______________The_following_command_is_supported_on_Windows_8_and_above_only:___r_nCONST_MSG_UNSUPPORTEDLOCAL________________The_following_command_is_supported_on_local_machine_only:___r_nCONST_MSG_CREDENTIALERR___________________Passing_credentials_is_not_supported_for_this_command.__r_nCONST_MSG_SUCCESS_________________________Successfully_applied_setting.__r_nCONST_MSG_NOKMSLICS_______________________No_Office_KMS_licenses_were_found_on_the_system.__r_nCONST_MSG_ACTATTEMPT______________________Installed_product_key_detected___attempting_to_activate_the_following_product:__r_nCONST_MSG_TOKACTATTEMPT___________________Installed_product_key_detected___attempting_to_token_activate_the_following_product:__r_nCONST_MSG_NOKEYSINSTALLED__________________No_installed_product
mov rax, rbp
push rax
movabs rbp, 0x140281d06
mov rax, rbp
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.1400163b8
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.1400925c0
add rsp, 0x20
pop rcx
push rax
mov rax, 1
mov rax, rax
push rax
push qword [rsp + 0x50]
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
movabs rcx, 0x1401038ea
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
mov rcx, qword [0x140319dfc]
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
movabs rcx, str.____NoLogo__unpkey:FVYFG
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
call fcn.140092820
movabs rax, str.cscript.exe
push rax
push rax
call fcn.1400927f0
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001284f
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140041f24
add rsp, 0x28
pop rax
mov qword [rsp + 0x30], 1
movabs rax, str.Office21VisioStd2021R_
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jle 0x140022438
movabs rax, 0x140103df0
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jne 0x140022438
mov rax, 1
jmp 0x14002243b
xor rax, rax
and rax, rax
je 0x14002254d
movabs rax, str.lic16
push rax
movabs rax, str.VisioStd2021VL_
push rax
movabs rbp, str.Copyright__c__Microsoft_Corporation._All_rights_reserved._r_n_________________________________________________________________________________________r_n_________________________________________________________________________________________r_nCONST_wshOK_____________________________0_r_nCONST_VALUE_ICON_WARNING________________16_r_nCONST_wshYesNoDialog____________________4_r_nCONST_VALUE_ICON_QUESTIONMARK___________32_r_nCONST_VALUE_ICON_INFORMATION____________64_r_nCONST_HKEY_LOCAL_MACHINE________________H80000002_r_nCONST_KEY_SET_VALUE_____________________H0002_r_nCONST_KEY_QUERY_VALUE___________________H0001_r_nCONST_REG_SZ____________________________1_r_nCONST_OfficeAppId_________________________0ff1ce15_a989_479d_af46_f275c6370663__r_nCONST_STR_SYS32PATH_______________________:WindowsSystem32__r_nCONST_STR_OSPPREARMPATH___________________Microsoft_OfficeOffice16OSPPREARM.EXE__r_nCONST_STR_OSPPREARMPATH_DEBUG_____________Microsoft_Office_DebugOffice16OSPPREARM.EXE__r_nCONST_REG_OSPP____________________________SOFTWAREMicrosoftOfficeSoftwareProtectionPlatform__r_nCONST_STR_HEARTBEATPATH___________________MicrosoftOfficeHeartbeatHeartbeatCache.xml__r_nCONST_REG_SPP_____________________________SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatform__r_nCONST_REG_SCAEXP_BASE_____________________HKCUSOFTWAREMicrosoftOffice16.0CommonExperimentEcs__r_nCONST_REG_SCAEXP_END_______________________Flightsofc5juzsw45rcw0__r_nCONST_REG_SCAEXP_OVERRIDE_________________HKLMSOFTWAREMicrosoftOfficeCommonExperimentofc5juzsw45rcw0__r_nCONST_REG_SCAO15__________________________HKLMSOFTWAREMicrosoftOffice15.0ClickToRunConfigurationSharedComputerLicensing__r_nCONST_REG_SCAO16__________________________HKLMSOFTWAREMicrosoftOfficeClickToRunConfigurationSharedComputerLicensing__r_nCONST_VALUE_SCAEXP_FLAVOR_________________exp__r_nCONST_VALUE_SCAEXP_OVERRIDE_FLAVOR________expoverride__r_nCONST_VALUE_SCAO15_FLAVOR_________________o15__r_nCONST_VALUE_SCA016_FLAVOR_________________o16__r_nCONST_VALUE_SCAREGKEY_SINGLE_TYPE_________single__r_nCONST_VALUE_SCAREGKEY_PER_APP_TYPE________perapp__r_nCONST_VER_INFO____________________________Version_Info:_2016_1.0__r_n_________________________________________________________________________________________r_nCONST_MSG_NOREGRIGHTS_____________________Insufficient_rights_to_perform_operation.__r_nCONST_MSG_ISCMD_ELEVATED__________________Ensure_cmd.exe_is_elevated__right_click___run_as_administrator_.__r_nCONST_MSG_CREDENTIALFAILURE_______________Connection_failed_with_passed_credentials.__r_nCONST_MSG_FILENOTFOUND____________________File_not_found:___________________r_nCONST_MSG_SEPERATESMALL____________________________________r_nCONST_MSG_SEPERATE_________________________________________________________________r_nCONST_MSG_PROCESSING_________________________Processing____________________________r_nCONST_MSG_EXIT_______________________________Exiting_______________________________r_nCONST_MSG_UNSUPPORTED_____________________Unsupported_command_passed.__r_nCONST_MSG_UNSUPPORTEDOPEROS7______________The_following_command_is_supported_on_Windows_7_only:___r_nCONST_MSG_UNSUPPORTEDOPEROS8______________The_following_command_is_supported_on_Windows_8_and_above_only:___r_nCONST_MSG_UNSUPPORTEDLOCAL________________The_following_command_is_supported_on_local_machine_only:___r_nCONST_MSG_CREDENTIALERR___________________Passing_credentials_is_not_supported_for_this_command.__r_nCONST_MSG_SUCCESS_________________________Successfully_applied_setting.__r_nCONST_MSG_NOKMSLICS_______________________No_Office_KMS_licenses_were_found_on_the_system.__r_nCONST_MSG_ACTATTEMPT______________________Installed_product_key_detected___attempting_to_activate_the_following_product:__r_nCONST_MSG_TOKACTATTEMPT___________________Installed_product_key_detected___attempting_to_token_activate_the_following_product:__r_nCONST_MSG_NOKEYSINSTALLED__________________No_installed_product
mov rax, rbp
push rax
movabs rbp, 0x140281d06
mov rax, rbp
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.1400163b8
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.1400925c0
add rsp, 0x20
pop rcx
push rax
mov rax, 1
mov rax, rax
push rax
push qword [rsp + 0x50]
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
movabs rcx, 0x1401038ea
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
mov rcx, qword [0x140319dfc]
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
movabs rcx, str.____NoLogo__unpkey:V8VVX
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
call fcn.140092820
movabs rax, str.cscript.exe
push rax
push rax
call fcn.1400927f0
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001284f
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140041f24
add rsp, 0x28
pop rax
mov qword [rsp + 0x30], 1
movabs rax, str.Office21VisioPro2021R_
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jle 0x140022592
movabs rax, str.fb61ac9a_1688_45d2_8f6b_0674dbffa33c
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jne 0x140022592
mov rax, 1
jmp 0x140022595
xor rax, rax
and rax, rax
je 0x1400226a7
movabs rax, str.lic16
push rax
movabs rax, str.VisioPro2021VL_
push rax
movabs rbp, str.Copyright__c__Microsoft_Corporation._All_rights_reserved._r_n_________________________________________________________________________________________r_n_________________________________________________________________________________________r_nCONST_wshOK_____________________________0_r_nCONST_VALUE_ICON_WARNING________________16_r_nCONST_wshYesNoDialog____________________4_r_nCONST_VALUE_ICON_QUESTIONMARK___________32_r_nCONST_VALUE_ICON_INFORMATION____________64_r_nCONST_HKEY_LOCAL_MACHINE________________H80000002_r_nCONST_KEY_SET_VALUE_____________________H0002_r_nCONST_KEY_QUERY_VALUE___________________H0001_r_nCONST_REG_SZ____________________________1_r_nCONST_OfficeAppId_________________________0ff1ce15_a989_479d_af46_f275c6370663__r_nCONST_STR_SYS32PATH_______________________:WindowsSystem32__r_nCONST_STR_OSPPREARMPATH___________________Microsoft_OfficeOffice16OSPPREARM.EXE__r_nCONST_STR_OSPPREARMPATH_DEBUG_____________Microsoft_Office_DebugOffice16OSPPREARM.EXE__r_nCONST_REG_OSPP____________________________SOFTWAREMicrosoftOfficeSoftwareProtectionPlatform__r_nCONST_STR_HEARTBEATPATH___________________MicrosoftOfficeHeartbeatHeartbeatCache.xml__r_nCONST_REG_SPP_____________________________SOFTWAREMicrosoftWindows_NTCurrentVersionSoftwareProtectionPlatform__r_nCONST_REG_SCAEXP_BASE_____________________HKCUSOFTWAREMicrosoftOffice16.0CommonExperimentEcs__r_nCONST_REG_SCAEXP_END_______________________Flightsofc5juzsw45rcw0__r_nCONST_REG_SCAEXP_OVERRIDE_________________HKLMSOFTWAREMicrosoftOfficeCommonExperimentofc5juzsw45rcw0__r_nCONST_REG_SCAO15__________________________HKLMSOFTWAREMicrosoftOffice15.0ClickToRunConfigurationSharedComputerLicensing__r_nCONST_REG_SCAO16__________________________HKLMSOFTWAREMicrosoftOfficeClickToRunConfigurationSharedComputerLicensing__r_nCONST_VALUE_SCAEXP_FLAVOR_________________exp__r_nCONST_VALUE_SCAEXP_OVERRIDE_FLAVOR________expoverride__r_nCONST_VALUE_SCAO15_FLAVOR_________________o15__r_nCONST_VALUE_SCA016_FLAVOR_________________o16__r_nCONST_VALUE_SCAREGKEY_SINGLE_TYPE_________single__r_nCONST_VALUE_SCAREGKEY_PER_APP_TYPE________perapp__r_nCONST_VER_INFO____________________________Version_Info:_2016_1.0__r_n_________________________________________________________________________________________r_nCONST_MSG_NOREGRIGHTS_____________________Insufficient_rights_to_perform_operation.__r_nCONST_MSG_ISCMD_ELEVATED__________________Ensure_cmd.exe_is_elevated__right_click___run_as_administrator_.__r_nCONST_MSG_CREDENTIALFAILURE_______________Connection_failed_with_passed_credentials.__r_nCONST_MSG_FILENOTFOUND____________________File_not_found:___________________r_nCONST_MSG_SEPERATESMALL____________________________________r_nCONST_MSG_SEPERATE_________________________________________________________________r_nCONST_MSG_PROCESSING_________________________Processing____________________________r_nCONST_MSG_EXIT_______________________________Exiting_______________________________r_nCONST_MSG_UNSUPPORTED_____________________Unsupported_command_passed.__r_nCONST_MSG_UNSUPPORTEDOPEROS7______________The_following_command_is_supported_on_Windows_7_only:___r_nCONST_MSG_UNSUPPORTEDOPEROS8______________The_following_command_is_supported_on_Windows_8_and_above_only:___r_nCONST_MSG_UNSUPPORTEDLOCAL________________The_following_command_is_supported_on_local_machine_only:___r_nCONST_MSG_CREDENTIALERR___________________Passing_credentials_is_not_supported_for_this_command.__r_nCONST_MSG_SUCCESS_________________________Successfully_applied_setting.__r_nCONST_MSG_NOKMSLICS_______________________No_Office_KMS_licenses_were_found_on_the_system.__r_nCONST_MSG_ACTATTEMPT______________________Installed_product_key_detected___attempting_to_activate_the_following_product:__r_nCONST_MSG_TOKACTATTEMPT___________________Installed_product_key_detected___attempting_to_token_activate_the_following_product:__r_nCONST_MSG_NOKEYSINSTALLED__________________No_installed_product
mov rax, rbp
push rax
movabs rbp, 0x140281d06
mov rax, rbp
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.1400163b8
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.1400925c0
add rsp, 0x20
pop rcx
push rax
mov rax, 1
mov rax, rax
push rax
push qword [rsp + 0x50]
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
movabs rcx, 0x1401038ea
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
mov rcx, qword [0x140319dfc]
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
movabs rcx, str.____NoLogo__unpkey:Q7DBB
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
call fcn.140092820
movabs rax, str.cscript.exe
push rax
push rax
call fcn.1400927f0
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001284f
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140041f24
add rsp, 0x28
pop rax
mov qword [rsp + 0x30], 1
movabs rax, str.OfficeStandardR_
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jle 0x1400226ec
movabs rax, str.b13afb38_cd79_4ae5_9f7f_eed058d750ca
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jne 0x1400226ec
mov rax, 1
jmp 0x1400226ef
xor rax, rax
and rax, rax
je 0x140022801
movabs rax, str.lic15
push rax
movabs rax, str.StandardVL_
push rax
movabs rbp, 0x140281d06
mov rax, rbp
push rax
movabs rbp, 0x14023f6de
mov rax, rbp
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.1400163b8
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.1400925c0
add rsp, 0x20
pop rcx
push rax
mov rax, 1
mov rax, rax
push rax
push qword [rsp + 0x50]
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
movabs rcx, 0x1401038ea
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
mov rcx, qword [0x140319dfc]
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
movabs rcx, str.____NoLogo__unpkey:P343Y
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
call fcn.140092820
movabs rax, str.cscript.exe
push rax
push rax
call fcn.1400927f0
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001284f
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140041f24
add rsp, 0x28
pop rax
mov qword [rsp + 0x30], 1
movabs rax, str.OfficeProjectStdR_
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jle 0x140022846
movabs rax, str.427a28d1_d17c_4abf_b717_32c780ba6f07
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jne 0x140022846
mov rax, 1
jmp 0x140022849
xor rax, rax
and rax, rax
je 0x14002295b
movabs rax, str.lic15
push rax
movabs rax, str.ProjectStdVL_
push rax
movabs rbp, 0x140281d06
mov rax, rbp
push rax
movabs rbp, 0x14023f6de
mov rax, rbp
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.1400163b8
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.1400925c0
add rsp, 0x20
pop rcx
push rax
mov rax, 1
mov rax, rax
push rax
push qword [rsp + 0x50]
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
movabs rcx, 0x1401038ea
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
mov rcx, qword [0x140319dfc]
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
movabs rcx, str.____NoLogo__unpkey:MY29C
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
call fcn.140092820
movabs rax, str.cscript.exe
push rax
push rax
call fcn.1400927f0
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001284f
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140041f24
add rsp, 0x28
pop rax
mov qword [rsp + 0x30], 1
movabs rax, str.OfficeVisioStdR_
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jle 0x1400229a0
movabs rax, str.ac4efaf0_f81f_4f61_bdf7_ea32b02ab117
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jne 0x1400229a0
mov rax, 1
jmp 0x1400229a3
xor rax, rax
and rax, rax
je 0x140022ab5
movabs rax, str.lic15
push rax
movabs rax, str.VisioStdVL_
push rax
movabs rbp, 0x140281d06
mov rax, rbp
push rax
movabs rbp, 0x14023f6de
mov rax, rbp
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.1400163b8
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.1400925c0
add rsp, 0x20
pop rcx
push rax
mov rax, 1
mov rax, rax
push rax
push qword [rsp + 0x50]
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
movabs rcx, 0x1401038ea
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
mov rcx, qword [0x140319dfc]
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
movabs rcx, str.____NoLogo__unpkey:MDT2D
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
call fcn.140092820
movabs rax, str.cscript.exe
push rax
push rax
call fcn.1400927f0
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001284f
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140041f24
add rsp, 0x28
pop rax
mov qword [rsp + 0x30], 1
movabs rax, str.OfficeProPlusR_
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jle 0x140022afa
movabs rax, str.b322da9c_a2e2_4058_9e4e_f59a6970bd69
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jne 0x140022afa
mov rax, 1
jmp 0x140022afd
xor rax, rax
and rax, rax
je 0x140022c0f
movabs rax, str.lic15
push rax
movabs rax, str.ProPlusVL_
push rax
movabs rbp, 0x140281d06
mov rax, rbp
push rax
movabs rbp, 0x14023f6de
mov rax, rbp
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.1400163b8
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.1400925c0
add rsp, 0x20
pop rcx
push rax
mov rax, 1
mov rax, rax
push rax
push qword [rsp + 0x50]
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
movabs rcx, 0x1401038ea
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
mov rcx, qword [0x140319dfc]
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
movabs rcx, str.____NoLogo__unpkey:27GXM
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
call fcn.140092820
movabs rax, str.cscript.exe
push rax
push rax
call fcn.1400927f0
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001284f
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140041f24
add rsp, 0x28
pop rax
mov qword [rsp + 0x30], 1
movabs rax, str.OfficeProjectProR_
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jle 0x140022c54
movabs rax, str.4a5d124a_e620_44ba_b6ff_658961b33b9a
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jne 0x140022c54
mov rax, 1
jmp 0x140022c57
xor rax, rax
and rax, rax
je 0x140022d69
movabs rax, str.lic15
push rax
movabs rax, str.ProjectProVL_
push rax
movabs rbp, 0x140281d06
mov rax, rbp
push rax
movabs rbp, 0x14023f6de
mov rax, rbp
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.1400163b8
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.1400925c0
add rsp, 0x20
pop rcx
push rax
mov rax, 1
mov rax, rax
push rax
push qword [rsp + 0x50]
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
movabs rcx, 0x1401038ea
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
mov rcx, qword [0x140319dfc]
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
movabs rcx, str.____NoLogo__unpkey:GMQ44
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
call fcn.140092820
movabs rax, str.cscript.exe
push rax
push rax
call fcn.1400927f0
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001284f
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140041f24
add rsp, 0x28
pop rax
mov qword [rsp + 0x30], 1
movabs rax, str.OfficeVisioProR_
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jle 0x140022dae
movabs rax, str.e13ac10e_75d0_4aff_a0cd_764982cf541c
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jne 0x140022dae
mov rax, 1
jmp 0x140022db1
xor rax, rax
and rax, rax
je 0x140022ec3
movabs rax, str.lic15
push rax
movabs rax, str.VisioProVL_
push rax
movabs rbp, 0x140281d06
mov rax, rbp
push rax
movabs rbp, 0x14023f6de
mov rax, rbp
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.1400163b8
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.1400925c0
add rsp, 0x20
pop rcx
push rax
mov rax, 1
mov rax, rax
push rax
push qword [rsp + 0x50]
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
movabs rcx, 0x1401038ea
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
mov rcx, qword [0x140319dfc]
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
movabs rcx, str.____NoLogo__unpkey:29VV8
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
call fcn.140092820
movabs rax, str.cscript.exe
push rax
push rax
call fcn.1400927f0
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001284f
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140041f24
add rsp, 0x28
pop rax
mov qword [rsp + 0x30], 1
movabs rax, str.OfficeWordR_
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jle 0x140022f08
movabs rax, str.d9f5b1c6_5386_495a_88f9_9ad6b41ac9b3
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jne 0x140022f08
mov rax, 1
jmp 0x140022f0b
xor rax, rax
and rax, rax
je 0x14002301d
movabs rax, str.lic15
push rax
movabs rax, str.WordVL_
push rax
movabs rbp, 0x140281d06
mov rax, rbp
push rax
movabs rbp, 0x14023f6de
mov rax, rbp
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.1400163b8
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.1400925c0
add rsp, 0x20
pop rcx
push rax
mov rax, 1
mov rax, rax
push rax
push qword [rsp + 0x50]
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
movabs rcx, 0x1401038ea
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
mov rcx, qword [0x140319dfc]
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
movabs rcx, str.____NoLogo__unpkey:72XPP
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
call fcn.140092820
movabs rax, str.cscript.exe
push rax
push rax
call fcn.1400927f0
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001284f
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140041f24
add rsp, 0x28
pop rax
mov qword [rsp + 0x30], 1
movabs rax, str.OfficeExcelR_
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jle 0x140023062
movabs rax, str.f7461d52_7c2b_43b2_8744_ea958e0bd09a
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jne 0x140023062
mov rax, 1
jmp 0x140023065
xor rax, rax
and rax, rax
je 0x140023177
movabs rax, str.lic15
push rax
movabs rax, str.ExcelVL_
push rax
movabs rbp, 0x140281d06
mov rax, rbp
push rax
movabs rbp, 0x14023f6de
mov rax, rbp
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.1400163b8
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.1400925c0
add rsp, 0x20
pop rcx
push rax
mov rax, 1
mov rax, rax
push rax
push qword [rsp + 0x50]
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
movabs rcx, 0x1401038ea
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
mov rcx, qword [0x140319dfc]
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
movabs rcx, str.____NoLogo__unpkey:88CWT
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
call fcn.140092820
movabs rax, str.cscript.exe
push rax
push rax
call fcn.1400927f0
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001284f
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140041f24
add rsp, 0x28
pop rax
mov qword [rsp + 0x30], 1
movabs rax, str.OfficeMondoR_
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jle 0x1400231bc
movabs rax, str.dc981c6b_fc8e_420f_aa43_f8f33e5c0923
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jne 0x1400231bc
mov rax, 1
jmp 0x1400231bf
xor rax, rax
and rax, rax
je 0x1400232d1
movabs rax, str.lic15
push rax
movabs rax, str.MondoVL_
push rax
movabs rbp, 0x140281d06
mov rax, rbp
push rax
movabs rbp, 0x14023f6de
mov rax, rbp
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.1400163b8
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.1400925c0
add rsp, 0x20
pop rcx
push rax
mov rax, 1
mov rax, rax
push rax
push qword [rsp + 0x50]
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
movabs rcx, 0x1401038ea
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
mov rcx, qword [0x140319dfc]
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
movabs rcx, str.____NoLogo__unpkey:VQTMJ
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
call fcn.140092820
movabs rax, str.cscript.exe
push rax
push rax
call fcn.1400927f0
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001284f
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140041f24
add rsp, 0x28
pop rax
mov qword [rsp + 0x30], 1
movabs rax, str.OfficeAccessR_
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jle 0x140023316
movabs rax, str.6ee7622c_18d8_4005_9fb7_92db644a279b
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jne 0x140023316
mov rax, 1
jmp 0x140023319
xor rax, rax
and rax, rax
je 0x14002342b
movabs rax, str.lic15
push rax
movabs rax, str.AccessVL_
push rax
movabs rbp, 0x140281d06
mov rax, rbp
push rax
movabs rbp, 0x14023f6de
mov rax, rbp
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.1400163b8
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.1400925c0
add rsp, 0x20
pop rcx
push rax
mov rax, 1
mov rax, rax
push rax
push qword [rsp + 0x50]
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
movabs rcx, 0x1401038ea
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
mov rcx, qword [0x140319dfc]
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
movabs rcx, str.____NoLogo__unpkey:Y7RM7
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
call fcn.140092820
movabs rax, str.cscript.exe
push rax
push rax
call fcn.1400927f0
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001284f
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140041f24
add rsp, 0x28
pop rax
mov qword [rsp + 0x30], 1
movabs rax, str.OfficeOutlookR_
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jle 0x140023470
movabs rax, str.771c3afa_50c5_443f_b151_ff2546d863a0
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jne 0x140023470
mov rax, 1
jmp 0x140023473
xor rax, rax
and rax, rax
je 0x140023585
movabs rax, str.lic15
push rax
movabs rax, str.OutlookVL_
push rax
movabs rbp, 0x140281d06
mov rax, rbp
push rax
movabs rbp, 0x14023f6de
mov rax, rbp
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.1400163b8
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.1400925c0
add rsp, 0x20
pop rcx
push rax
mov rax, 1
mov rax, rax
push rax
push qword [rsp + 0x50]
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
movabs rcx, 0x1401038ea
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
mov rcx, qword [0x140319dfc]
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
movabs rcx, str.____NoLogo__unpkey:7T7MM
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
call fcn.140092820
movabs rax, str.cscript.exe
push rax
push rax
call fcn.1400927f0
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001284f
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140041f24
add rsp, 0x28
pop rax
mov qword [rsp + 0x30], 1
movabs rax, str.OfficePublisherR_
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jle 0x1400235ca
movabs rax, str.00c79ff1_6850_443d_bf61_71cde0de305f
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jne 0x1400235ca
mov rax, 1
jmp 0x1400235cd
xor rax, rax
and rax, rax
je 0x1400236df
movabs rax, str.lic15
push rax
movabs rax, str.PublisherVL_
push rax
movabs rbp, 0x140281d06
mov rax, rbp
push rax
movabs rbp, 0x14023f6de
mov rax, rbp
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.1400163b8
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.1400925c0
add rsp, 0x20
pop rcx
push rax
mov rax, 1
mov rax, rax
push rax
push qword [rsp + 0x50]
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
movabs rcx, 0x1401038ea
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
mov rcx, qword [0x140319dfc]
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
movabs rcx, str.____NoLogo__unpkey:P9VT9
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
call fcn.140092820
movabs rax, str.cscript.exe
push rax
push rax
call fcn.1400927f0
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001284f
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140041f24
add rsp, 0x28
pop rax
mov qword [rsp + 0x30], 1
movabs rax, str.OfficePowerPointR_
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jle 0x140023724
movabs rax, str.8c762649_97d1_4953_ad27_b7e2c25b972e
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jne 0x140023724
mov rax, 1
jmp 0x140023727
xor rax, rax
and rax, rax
je 0x140023839
movabs rax, str.lic15
push rax
movabs rax, str.PowerPointVL_
push rax
movabs rbp, 0x140281d06
mov rax, rbp
push rax
movabs rbp, 0x14023f6de
mov rax, rbp
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.1400163b8
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.1400925c0
add rsp, 0x20
pop rcx
push rax
mov rax, 1
mov rax, rax
push rax
push qword [rsp + 0x50]
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
movabs rcx, 0x1401038ea
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
mov rcx, qword [0x140319dfc]
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
movabs rcx, str.____NoLogo__unpkey:QGKHX
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
call fcn.140092820
movabs rax, str.cscript.exe
push rax
push rax
call fcn.1400927f0
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001284f
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140041f24
add rsp, 0x28
pop rax
mov qword [rsp + 0x30], 1
movabs rax, str.OfficeOneNoteR_
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jle 0x14002387e
movabs rax, str.efe1f3e6_aea2_4144_a208_32aa872b6545
push rax
push qword [rsp + 0x30]
pop rcx
pop rdx
call fcn.14008f740
mov r15, rax
and r15, r15
jne 0x14002387e
mov rax, 1
jmp 0x140023881
xor rax, rax
and rax, rax
je 0x140023993
movabs rax, str.lic15
push rax
movabs rax, 0x1401032fc
push rax
movabs rbp, 0x140281d06
mov rax, rbp
push rax
movabs rbp, 0x14023f6de
mov rax, rbp
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.1400163b8
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.1400925c0
add rsp, 0x20
pop rcx
push rax
mov rax, 1
mov rax, rax
push rax
push qword [rsp + 0x50]
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
movabs rcx, 0x1401038ea
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
mov rcx, qword [0x140319dfc]
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
movabs rcx, str.____NoLogo__unpkey:68YBD
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
call fcn.140092820
movabs rax, str.cscript.exe
push rax
push rax
call fcn.1400927f0
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14001284f
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140041f24
add rsp, 0x28
pop rax
mov qword [rsp + 0x30], 1
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
mov rcx, qword [0x140319e3c]
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
movabs rcx, 0x1401051f2
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
push rax
call fcn.1400927f0
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
sub rsp, 0x20
call fcn.140073d70
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140041f24
add rsp, 0x28
pop rax
mov r15, rax
cmp r15, 0xfffffffffffffffe
jne 0x140023aa9
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push 3
movabs rax, 0x140103028
push rax
mov rcx, qword [0x140319e3c]
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
movabs rcx, 0x1401051f2
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
push rax
call fcn.1400927f0
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.14007419c
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140041f24
add rsp, 0x28
pop rax
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
mov rcx, qword [0x140319e3c]
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
movabs rcx, 0x140105244
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
push rax
call fcn.1400927f0
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
sub rsp, 0x20
call fcn.140073d70
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140041f24
add rsp, 0x28
pop rax
mov r15, rax
cmp r15, 0xfffffffffffffffe
jne 0x140023bbf
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push 3
movabs rax, 0x140103028
push rax
mov rcx, qword [0x140319e3c]
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
movabs rcx, 0x140105244
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
push rax
call fcn.1400927f0
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.14007419c
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140041f24
add rsp, 0x28
pop rax
mov rax, qword [rsp + 0x30]
jmp 0x140023bc9
push rax
mov rcx, qword [rsp + 0x40]
sub rsp, 0x28
call fcn.140092990
add rsp, 0x28
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.140092990
add rsp, 0x28
pop rax
add rsp, 0x48
pop r15
pop rbp
ret