Function at 0x425830
Capabilities:
Execute vbscript javascript or jscript in memory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x426bfb
mov eax, dword fs:[0]
push eax
sub esp, 0xdc
mov eax, dword [0x43700c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x28]
call fcn.00408420
mov dword [ebp - 0xb4], 0
push str.UnInstallAddin.vbs
lea ecx, [ebp - 0x30]
call fcn.00409a40
mov dword [ebp - 4], 0
mov dword [ebp - 0x74], 1
mov dword [ebp - 0xb8], 0
mov byte [ebp - 0x29], 0
lea eax, [ebp - 0x40]
push eax
push 0x4272d0
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x28]
push eax
mov ecx, dword [edx]
call ecx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x74], 1
jne 0x4258f8
lea edx, [ebp - 0x20]
push edx
push str.VBScript
call dword [sym.imp.ole32.dll_CLSIDFromProgID]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jge 0x4258f3
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xb0], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00409a20
mov eax, dword [ebp - 0xb0]
jmp 0x425e63
jmp 0x425b41
cmp dword [ebp - 0x74], 2
jne 0x425b41
push 0x42d2f8
lea ecx, [ebp - 0x34]
call fcn.00409a40
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x34]
call fcn.00409ce0
movzx ecx, al
test ecx, ecx
je 0x425980
lea edx, [ebp - 0x20]
push edx
push str.JScript
call dword [sym.imp.ole32.dll_CLSIDFromProgID]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jge 0x425977
push 0x10
push str.UnInstallAddin
push str.JScript_is_not_available_on_this_computer.
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x78], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x34]
call fcn.00409a20
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00409a20
mov eax, dword [ebp - 0x78]
jmp 0x425e63
mov byte [ebp - 0x29], 1
jmp 0x425b35
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x38]
call fcn.00409ac0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x38]
call fcn.00409590
push 0
push str.chakra
lea ecx, [ebp - 0x38]
call fcn.004095e0
test eax, eax
jl 0x425a11
lea edx, [ebp - 0x20]
push edx
push str.1b7cd997_e5ff_4932_a7a6_2a9e636da385
call dword [sym.imp.ole32.dll_CLSIDFromString]
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jge 0x425a0c
push 0x10
push str.UnInstallAddin
push str.Chakra_is_not_available_on_this_computer.
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x7c], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x38]
call fcn.00409a20
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x34]
call fcn.00409a20
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00409a20
mov eax, dword [ebp - 0x7c]
jmp 0x425e63
jmp 0x425b29
push 0
push str.jscript9
lea ecx, [ebp - 0x38]
call fcn.004095e0
test eax, eax
jl 0x425a8e
lea ecx, [ebp - 0x20]
push ecx
push str.16d51579_a30b_4c8b_a276_0ff4dc41e755
call dword [sym.imp.ole32.dll_CLSIDFromString]
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jge 0x425a85
push 0x10
push str.UnInstallAddin
push str.JScript_v9_is_not_available_on_this_computer.
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov edx, dword [ebp - 0x48]
mov dword [ebp - 0x80], edx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x38]
call fcn.00409a20
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x34]
call fcn.00409a20
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00409a20
mov eax, dword [ebp - 0x80]
jmp 0x425e63
mov byte [ebp - 0x29], 1
jmp 0x425b29
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x34]
call fcn.00401a80
push eax
call dword [sym.imp.ole32.dll_CLSIDFromString]
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jge 0x425b29
push str._is_not_available_on_this_computer.
lea ecx, [ebp - 0x34]
push ecx
lea edx, [ebp - 0x88]
push edx
call fcn.00409280
add esp, 0xc
mov dword [ebp - 0x84], eax
push 0x10
push str.UnInstallAddin
mov ecx, dword [ebp - 0x84]
call fcn.00401a80
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp - 0x88]
call fcn.00409a20
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x8c], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x38]
call fcn.00409a20
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x34]
call fcn.00409a20
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00409a20
mov eax, dword [ebp - 0x8c]
jmp 0x425e63
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x38]
call fcn.00409a20
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x34]
call fcn.00409a20
mov ecx, dword [ebp - 0x28]
add ecx, 0x5c
call fcn.00401a90
push eax
push 0x4272e0
push 1
push 0
lea ecx, [ebp - 0x20]
push ecx
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jge 0x425b8c
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x90], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00409a20
mov eax, dword [ebp - 0x90]
jmp 0x425e63
movzx eax, byte [ebp - 0x29]
test eax, eax
je 0x425c11
mov ecx, dword [ebp - 0x28]
add ecx, 0x5c
call fcn.00401a80
mov dword [ebp - 0x50], eax
lea ecx, [ebp - 0x3c]
push ecx
push 0x427300
mov edx, dword [ebp - 0x50]
push edx
mov eax, dword [ebp - 0x50]
mov ecx, dword [eax]
mov edx, dword [ecx]
call edx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x425c11
lea eax, [ebp - 0xc8]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov ecx, 3
mov word [ebp - 0xc8], cx
mov dword [ebp - 0xc0], 2
lea edx, [ebp - 0xc8]
push edx
push 0
push 0x4000
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x3c]
push edx
mov eax, dword [ecx + 0x10]
call eax
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x3c]
push eax
mov ecx, dword [edx + 8]
call ecx
mov ecx, dword [ebp - 0x28]
add ecx, 0x5c
call fcn.00401a80
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x28]
add ecx, 0x60
call fcn.00401a90
push eax
push 0x4272f0
mov edx, dword [ebp - 0x54]
push edx
mov eax, dword [ebp - 0x54]
mov ecx, dword [eax]
mov edx, dword [ecx]
call edx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jge 0x425c69
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x94], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00409a20
mov eax, dword [ebp - 0x94]
jmp 0x425e63
mov ecx, dword [ebp - 0x28]
add ecx, 0x5c
call fcn.00401a80
mov dword [ebp - 0x58], eax
mov ecx, dword [ebp - 0x40]
push ecx
mov edx, dword [ebp - 0x58]
push edx
mov eax, dword [ebp - 0x58]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
call edx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jge 0x425cb5
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x98], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00409a20
mov eax, dword [ebp - 0x98]
jmp 0x425e63
mov ecx, dword [ebp - 0x28]
add ecx, 0x60
call fcn.00401a80
mov dword [ebp - 0x5c], eax
mov ecx, dword [ebp - 0x5c]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x5c]
push eax
mov ecx, dword [edx + 0xc]
call ecx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jge 0x425cfd
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x9c], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00409a20
mov eax, dword [ebp - 0x9c]
jmp 0x425e63
mov ecx, dword [ebp - 0x28]
add ecx, 0x5c
call fcn.00401a80
mov dword [ebp - 0x60], eax
push 6
push 0x42d528
mov eax, dword [ebp - 0x60]
push eax
mov ecx, dword [ebp - 0x60]
mov edx, dword [ecx]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jge 0x425d4c
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0xa0], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00409a20
mov eax, dword [ebp - 0xa0]
jmp 0x425e63
mov edx, dword [ebp - 0x40]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x40]
push ecx
mov edx, dword [eax + 4]
call edx
mov eax, dword [ebp - 0x28]
mov dword [eax + 0x50], 0
mov dword [ebp - 0xa4], 0
mov ecx, dword [ebp - 0x28]
add ecx, 0x60
call fcn.00401a80
mov dword [ebp - 0x64], eax
lea ecx, [ebp - 0xe8]
push ecx
push 0
push 0x42
push 0
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 0x50]
push eax
push 0
mov ecx, dword [ebp - 0xa4]
push ecx
push 0
push str.Const_HKEY_USERS__H80000003_r_nConst_OFFICE_VERSION___HKCUSoftwareVB_and_VBA_Program_SettingsAbacusConfig__r_nConst_OFFICE_32___HKLMSOFTWAREAVSAbacusSettings__r_nConst_OFFICE_64___HKLMSOFTWAREWOW6432NodeAVSAbacusSettings__r_n_r_n________________________________________________________________________________________r_n___This_uninstalls_older_versions_of_Abacus_and_is_run_after_Abacus_3.0_installation____r_n___is_complete._All_icons_for_Abacus_2.0_are_removed_and_registry_entries_for_all_______r_n___users_are_removed._t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_________r_n________________________________________________________________________________________r_n_r_n_r_nDim_AddinPath_r_nDim_objShell_r_nDim_iOffice_r_nDim_strOffice_r_nDim_bInstalled_r_nDim_iOpen_r_n_r_nOn_Error_Resume_Next__r_n_r_nSet_objShell__CreateObject__WScript.Shell___r_nSet_fso__CreateObject__Scripting.FileSystemObject___r_n_r_n_r_n_r_n__________________________32_bit_or_64_bit_Office______________________________r_nDim_OfficeBitness_r_n_r_nIf_GetKeyValue_OFFICE_64___InstallPath_______Then_r_n_tOfficeBitness_64__r_nElse_r_n_tOfficeBitness_32__r_nEnd_If_r_n_r_n___________________________Find_Addin_Path________________________________________r_nIf_OfficeBitness_64__then_r_n_tAddinPathOld__Chr_34___GetKeyValue_OFFICE_64___InstallPath_____AddinAbacus2007.xlam___Chr_34__r_nElse_r_n_tAddinPathOld__Chr_34___GetKeyValue_OFFICE_32___InstallPath_____AddinAbacus2007.xlam___Chr_34__r_nEnd_If_r_n_r_nAddinPathNew____Abacus2007.xlam____r_nAddinPathLoader_____Loader.xlam____r_n_r_nAddinPathArray_AddinPathOld__r_n_r_n_r_n_______________________________________________________________________________r_n_t_t_t_t_t_t_t_tDELETE_DESKTOP_ICON_r_n_______________________________________________________________________________r_n_r_nstrLinkUser__objShell.SpecialFolders__Desktop___r_nstrLinkAllUsers__objShell.SpecialFolders__AllUsersDesktop___r_n_r_nIf_fso.FileExists_strLinkUser___Abacus_2.0.lnk___Then_r_n__fso.DeleteFile_strLinkUser___Abacus_2.0.lnk__r_nEnd_If_r_n_r_nIf_fso.FileExists_strLinkUser___Abacus.lnk___Then_r_n__fso.DeleteFile_strLinkUser___Abacus.lnk__r_nEnd_If_r_n_r_nIf_fso.FileExists_strLinkAllUsers___Abacus_2.0.lnk___Then_r_n__fso.DeleteFile_strLinkAllUsers___Abacus_2.0.lnk__r_nEnd_If_r_n_r_nIf_fso.FileExists_strLinkAllUsers___Abacus.lnk___Then_r_n__fso.DeleteFile_strLinkAllUsers___Abacus.lnk__r_nEnd_If_r_n_r_n_r_n_________________________________________________________________________________r_n_t_t_t_t_t_t_t_tHKCU_t_t_t_r_n_________________________________________________________________________________r_nFor_Each_AP_In_AddinPath_r_n_r_n_tFor_iOffice__12_To_20__Office_versions_2007_to_..._____r_n_t_tstrOffice___HKCUSOFTWAREMicrosoftOffice___iOffice___.0__r_n_t_r_n_t____iOpen__1_t_r_n_t_t_r_n_t____If_KeyExists_strOffice__Then_r_n_t_____tFind_Options_Key_r_n_t________If_KeyExists_strOffice___ExcelOptions___Then_r_n_t____________r_n_t___________Find_OPEN_Key_r_n_t____________If_KeyExists_strOffice___ExcelOptionsOPEN___Then_r_n_t_____________r_n_t________________If_GetKeyValue_strOffice___ExcelOptionsOPEN____AP_Then_r_n_t___________________DeleteKey_strOffice___ExcelOptionsOPEN___r_n_t________________Else_r_n_t_________________r_n_t____________________iOpen__1_r_n_t_____________________r_n_t____________________Do_Until_KeyExists_strOffice___ExcelOptionsOPEN___iOpen___False_Or_iOpen__100_r_n_t________________________If_GetKeyValue_strOffice___ExcelOptionsOPEN___iOpen___AP_Then_r_n_t____________________________DeleteKey_strOffice___ExcelOptionsOPEN___iOpen__r_n_t________________________Else_r_n_t____________________________iOpen__iOpen__1_r_n_t________________________End_If_r_n_t____________________Loop_r_n_t__________r_n_t________________End_If_r_n_t_____________r_n_t____________Else_r_n_t_____________r_n_t________________Do_Until_KeyExists_strOffice___ExcelOptionsOPEN___iOpen___False_Or_iOpen__100_r_n_t
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
push eax
mov edx, dword [ebp - 0x64]
push edx
mov eax, dword [ebp - 0x64]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x14]
call edx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jge 0x425de1
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xa8], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00409a20
mov eax, dword [ebp - 0xa8]
jmp 0x425e63
mov ecx, dword [ebp - 0x28]
add ecx, 0x5c
call fcn.00401a80
mov dword [ebp - 0x68], eax
push 2
mov ecx, dword [ebp - 0x68]
push ecx
mov edx, dword [ebp - 0x68]
mov eax, dword [edx]
mov ecx, dword [eax + 0x14]
call ecx
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x28]
add ecx, 0x5c
call fcn.00401a80
mov dword [ebp - 0x6c], eax
push 3
mov edx, dword [ebp - 0x6c]
push edx
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x14]
call edx
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x28]
add ecx, 0x5c
call fcn.00401a80
mov dword [ebp - 0x70], eax
push 4
mov eax, dword [ebp - 0x70]
push eax
mov ecx, dword [ebp - 0x70]
mov edx, dword [ecx]
mov eax, dword [edx + 0x14]
call eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0xac], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00409a20
mov eax, dword [ebp - 0xac]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040e627
mov esp, ebp
pop ebp
ret