Function at 0x4194d8
Capabilities:
Get geographical location
Reference sql statements

Disassembly:
push ebp
push ebx
push edi
xor eax, eax
push eax
push eax
push eax
push eax
call fcn.004ceb50
mov ebx, dword [0xf81050]
and ebx, ebx
jne 0x41961a
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
call fcn.0048e048
call fcn.0044f422
add dword [esp], edx
call fcn.004ba6b4
lea eax, [esp + 4]
push eax
call fcn.004ceac0
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
mov eax, 0x5e60ba
push eax
mov eax, str.ProgramsOffice_2013_2024_C2R_Install_
push eax
push dword [esp + 0x10]
call fcn.004cc8b0
lea eax, [esp + 8]
push eax
call fcn.004ceac0
push edx
call fcn.004cea40
pop edx
push eax
mov edx, dword [esp + 8]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, str.KMSTools_Lite.exe
push edx
call fcn.004cea70
call fcn.0044f422
add dword [esp], edx
call fcn.004ba73d
call fcn.0044f440
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jl 0x4195ad
jg 0x4195a9
cmp ebx, 0x1312d00
jb 0x4195ad
xor eax, eax
jmp 0x4195b2
mov eax, 1
or eax, eax
je 0x41960f
push edx
call fcn.004cea40
pop edx
push eax
mov edx, dword [esp + 4]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, 0x5ed358
push edx
call fcn.004cea70
call fcn.0044f422
add dword [esp], edx
call fcn.004ba73d
call fcn.0044f440
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x4195ff
cmp edi, 0xffffffff
jne 0x4195ff
xor eax, eax
jmp 0x419604
mov eax, 1
or eax, eax
je 0x41960f
mov eax, 1
jmp 0x419611
xor eax, eax
and eax, eax
je 0x41961a
jmp 0x41245b
mov ebx, dword [0x5fd01c]
and ebx, ebx
jle 0x4196cc
mov dword [0x5fd01c], 0
push 0
call fcn.00415f79
mov dword [0xf81208], 0
push dword [0xf81218]
call fcn.004c78ad
cdq
push edx
push eax
push 9
call fcn.004b031c
push 0
push 0x51
call fcn.004b2448
push 0
push 8
call fcn.004b2448
push 0
push 0xa
call fcn.004b2448
push 0
push 0xb
call fcn.004b2448
push 0
push 0x36
call fcn.004b2448
push 0
push 0
push 3
call fcn.004b031c
mov dword [0xf81360], 0
jmp 0x419d0f
mov ebx, dword [0xf81360]
and ebx, ebx
jle 0x4196db
jmp 0x419d0f
push 1
push 0x51
call fcn.004b2448
push 1
push 8
call fcn.004b2448
push 1
push 0xa
call fcn.004b2448
push 1
push 0xb
call fcn.004b2448
mov dword [0xf81360], 1
mov dword [0x5fd01c], 1
mov eax, 0x5ea04e
push eax
push 9
call fcn.004b253c
push 1
push 9
call fcn.004b2448
push 1
call fcn.00415f79
mov eax, 0x5e60ba
push eax
push 7
call fcn.004b253c
mov edx, dword [0xf81328]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, str._files
push edx
call fcn.004cea70
lea eax, [esp + 0xc]
push eax
call fcn.004ceac0
push dword [esp + 8]
call fcn.004bacd8
push 1
push 0
call fcn.004b8b03
push eax
call fcn.0042d65c
push 0
push dword [esp + 0xc]
call fcn.0041cc62
push edx
call fcn.004cea40
pop edx
push eax
mov edx, dword [esp + 0xc]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, str.OffScrub_O15msi.vbs
push edx
call fcn.004cea70
call fcn.004ceb30
push 0x6f
call fcn.0044f422
add dword [esp + 4], edx
call fcn.004bb760
call fcn.0044f440
mov ebp, 0xe799d7
mov ebx, ebp
mov ebp, 0xe199fb
sub ebx, ebp
push ebx
mov ebp, 0xe199fb
push ebp
push 0x6f
call fcn.004bba00
push 0x6f
call fcn.004bb470
push 0
mov eax, 0x5e60ba
push eax
call fcn.00447c99
push 0
mov eax, str.__________________________Run_OffScrub_O15msi.vbs_
push eax
call fcn.00447c99
push 0
mov eax, 0x5e60ba
push eax
call fcn.00447c99
push 0
push 0
mov eax, 1
push eax
push dword [esp + 0x14]
mov eax, 0x5ea9b8
push eax
mov eax, str.cscript.exe___NoLogo
push eax
call fcn.00415a6c
push edx
call fcn.004cea40
pop edx
push eax
mov edx, dword [esp + 0xc]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, str.OffScrub_O16msi.vbs
push edx
call fcn.004cea70
call fcn.004ceb30
push 0x6f
call fcn.0044f422
add dword [esp + 4], edx
call fcn.004bb760
call fcn.0044f440
mov ebp, 0xed9973
mov ebx, ebp
mov ebp, 0xe799d7
sub ebx, ebp
push ebx
mov ebp, 0xe799d7
push ebp
push 0x6f
call fcn.004bba00
push 0x6f
call fcn.004bb470
push 0
mov eax, 0x5e60ba
push eax
call fcn.00447c99
push 0
mov eax, str.__________________________Run_OffScrub_O16msi.vbs_
push eax
call fcn.00447c99
push 0
mov eax, 0x5e60ba
push eax
call fcn.00447c99
push 0
push 0
mov eax, 1
push eax
push dword [esp + 0x14]
mov eax, str.OffScrub_O16msi.vbs_ALL__NoCancel__Force__OSE_2_1
push eax
mov eax, str.cscript.exe___NoLogo
push eax
call fcn.00415a6c
push edx
call fcn.004cea40
pop edx
push eax
mov edx, dword [esp + 0xc]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, str.OffScrubC2R.vbs
push edx
call fcn.004cea70
call fcn.004ceb30
push 0x6f
call fcn.0044f422
add dword [esp + 4], edx
call fcn.004bb760
call fcn.0044f440
mov ebp, 0xe13525
mov ebx, ebp
mov ebp, str.reg_add__HKLMSOFTWAREMicrosoftWindows_Script_HostSettings___v_Enabled__t_REG_DWORD__d_1__f_r_ncscript.exe___dp0Office_Uninstall.vbs___Force_r_n_r_n_r_n_Name:_OffScrubC2R.vbs_r_n_Author:_Microsoft_Customer_Support_Services_r_n_Copyright__c__2014___2016_Microsoft_Corporation_r_n_Script_to_remove_Office_Click_To_Run__C2R__products_r_n_when_a_regular_uninstall_is_no_longer_possible_r_n_r_n_Scope:_Office_2013__2016_and_O365_C2R_products_r_n_r_n_r_nOption_Explicit_r_n_r_n________________________________________________________________________________r_n_r_n___Declaration_of_constants_r_n________________________________________________________________________________r_n_r_n_r_nConst_SCRIPTVERSION_____2.19__r_nConst_SCRIPTFILE________OffScrubC2R.vbs__r_nConst_SCRIPTNAME________OffScrubC2R__r_nConst_RETVALFILE________ScrubRetValFile.txt__r_nConst_ONAME_____________Office_C2R___O365__r_nConst_HKCR_____________H80000000_r_nConst_HKCU_____________H80000001_r_nConst_HKLM_____________H80000002_r_nConst_HKU______________H80000003_r_nConst_PRODLEN__________13_r_nConst_SQUISHED_________20_r_nConst_COMPRESSED_______32_r_nConst_REG_ARP___________SOFTWAREMicrosoftWindowsCurrentVersionUninstall__r_nConst_VB_YES___________6_r_nConst_VB_NO____________7_r_n_r_nConst_ERROR_SUCCESS__________________0___Bit_1.__0_indicates_Success._Script_completed_successfully_r_nConst_ERROR_FAIL_____________________1___Bit_1.__Failure_bit._Indicates_an_overall_script_failure._r_n__________________________________________RESERVED_bit__Returned_when_process_is_killed_from_task_manager_r_nConst_ERROR_REBOOT_REQUIRED__________2___Bit_2.__Reboot_bit._If_set_a_reboot_is_required_r_nConst_ERROR_USERCANCEL_______________4___Bit_3.__User_Cancel_bit._Controlled_cancel_from_script_UI_r_nConst_ERROR_STAGE1___________________8___Bit_4.__Informational._Msiexec_based_install_was_not_possible_r_nConst_ERROR_STAGE2___________________16__Bit_5.__Critical._Not_all_of_the_intended_cleanup_operations_could_be_applied_r_nConst_ERROR_INCOMPLETE_______________32__Bit_6.__Pending_file_renames__del_on_reboot____OR___Removal_needs_to_run_again_after_a_system_reboot._r_nConst_ERROR_DCAF_FAILURE_____________64__Bit_7.__Critical._Da_capo_al_fine__second_attempt__still_failed._r_nConst_ERROR_ELEVATION_USERDECLINED___128_Bit_8.__Critical_script_error._User_declined_to_allow_mandatory_script_elevation_r_nConst_ERROR_ELEVATION________________256_Bit_9.__Critical_script_error._The_attempt_to_elevate_the_process_did_not_succeed_r_nConst_ERROR_SCRIPTINIT_______________512_Bit_10._Critical_script_error._Initialization_failed_r_nConst_ERROR_RELAUNCH_________________1024Bit_11._Critical_script_error._This_is_a_temporary_value_and_must_not_be_the_final_return_code_r_nConst_ERROR_UNKNOWN__________________2048Bit_12_Critical_script_error._Script_did_not_complete_in_a_well_defined_state_r_nConst_ERROR_ALL______________________4095Full_BitMask_r_nConst_ERROR_USER_ABORT_______________HC000013A_RESERVED._Dec__1073741510._Critical_error._Returned_when_user_aborts_with__Ctrl__Break__or_closes_the_cmd_window_r_nConst_ERROR_SUCCESS_CONFIG_COMPLETE__1728_r_nConst_ERROR_SUCCESS_REBOOT_REQUIRED__3010_r_n_r_n________________________________________________________________________________r_n_r_n___Declaration_of_variables_r_n________________________________________________________________________________r_n_r_nDim_oFso__oMsi__oReg__oWShell__oWmiLocal__oShellApp_r_nDim_ComputerItem__Key__Item__LogStream__TmpKey_r_nDim_arrVersion_r_nDim_dicKeepLis__dicApps__dicKeepFolder__dicDelRegKey__dicKeepReg__dicSC_r_nDim_dicInstalledSku__dicRemoveSku__dicKeepSku__dicC2RSuite__dicDelInUse_r_nDim_dicDelFolder_r_nDim_sAppData__sScrubDir__sProgramFiles__sProgramFilesX86__sCommonProgramFiles_r_nDim_sAllusersProfile__sOSVersion__sWinDir__sWICacheDir__sCommonProgramFilesX86_r_nD
sub ebx, ebp
push ebx
mov ebp, str.reg_add__HKLMSOFTWAREMicrosoftWindows_Script_HostSettings___v_Enabled__t_REG_DWORD__d_1__f_r_ncscript.exe___dp0Office_Uninstall.vbs___Force_r_n_r_n_r_n_Name:_OffScrubC2R.vbs_r_n_Author:_Microsoft_Customer_Support_Services_r_n_Copyright__c__2014___2016_Microsoft_Corporation_r_n_Script_to_remove_Office_Click_To_Run__C2R__products_r_n_when_a_regular_uninstall_is_no_longer_possible_r_n_r_n_Scope:_Office_2013__2016_and_O365_C2R_products_r_n_r_n_r_nOption_Explicit_r_n_r_n________________________________________________________________________________r_n_r_n___Declaration_of_constants_r_n________________________________________________________________________________r_n_r_n_r_nConst_SCRIPTVERSION_____2.19__r_nConst_SCRIPTFILE________OffScrubC2R.vbs__r_nConst_SCRIPTNAME________OffScrubC2R__r_nConst_RETVALFILE________ScrubRetValFile.txt__r_nConst_ONAME_____________Office_C2R___O365__r_nConst_HKCR_____________H80000000_r_nConst_HKCU_____________H80000001_r_nConst_HKLM_____________H80000002_r_nConst_HKU______________H80000003_r_nConst_PRODLEN__________13_r_nConst_SQUISHED_________20_r_nConst_COMPRESSED_______32_r_nConst_REG_ARP___________SOFTWAREMicrosoftWindowsCurrentVersionUninstall__r_nConst_VB_YES___________6_r_nConst_VB_NO____________7_r_n_r_nConst_ERROR_SUCCESS__________________0___Bit_1.__0_indicates_Success._Script_completed_successfully_r_nConst_ERROR_FAIL_____________________1___Bit_1.__Failure_bit._Indicates_an_overall_script_failure._r_n__________________________________________RESERVED_bit__Returned_when_process_is_killed_from_task_manager_r_nConst_ERROR_REBOOT_REQUIRED__________2___Bit_2.__Reboot_bit._If_set_a_reboot_is_required_r_nConst_ERROR_USERCANCEL_______________4___Bit_3.__User_Cancel_bit._Controlled_cancel_from_script_UI_r_nConst_ERROR_STAGE1___________________8___Bit_4.__Informational._Msiexec_based_install_was_not_possible_r_nConst_ERROR_STAGE2___________________16__Bit_5.__Critical._Not_all_of_the_intended_cleanup_operations_could_be_applied_r_nConst_ERROR_INCOMPLETE_______________32__Bit_6.__Pending_file_renames__del_on_reboot____OR___Removal_needs_to_run_again_after_a_system_reboot._r_nConst_ERROR_DCAF_FAILURE_____________64__Bit_7.__Critical._Da_capo_al_fine__second_attempt__still_failed._r_nConst_ERROR_ELEVATION_USERDECLINED___128_Bit_8.__Critical_script_error._User_declined_to_allow_mandatory_script_elevation_r_nConst_ERROR_ELEVATION________________256_Bit_9.__Critical_script_error._The_attempt_to_elevate_the_process_did_not_succeed_r_nConst_ERROR_SCRIPTINIT_______________512_Bit_10._Critical_script_error._Initialization_failed_r_nConst_ERROR_RELAUNCH_________________1024Bit_11._Critical_script_error._This_is_a_temporary_value_and_must_not_be_the_final_return_code_r_nConst_ERROR_UNKNOWN__________________2048Bit_12_Critical_script_error._Script_did_not_complete_in_a_well_defined_state_r_nConst_ERROR_ALL______________________4095Full_BitMask_r_nConst_ERROR_USER_ABORT_______________HC000013A_RESERVED._Dec__1073741510._Critical_error._Returned_when_user_aborts_with__Ctrl__Break__or_closes_the_cmd_window_r_nConst_ERROR_SUCCESS_CONFIG_COMPLETE__1728_r_nConst_ERROR_SUCCESS_REBOOT_REQUIRED__3010_r_n_r_n________________________________________________________________________________r_n_r_n___Declaration_of_variables_r_n________________________________________________________________________________r_n_r_nDim_oFso__oMsi__oReg__oWShell__oWmiLocal__oShellApp_r_nDim_ComputerItem__Key__Item__LogStream__TmpKey_r_nDim_arrVersion_r_nDim_dicKeepLis__dicApps__dicKeepFolder__dicDelRegKey__dicKeepReg__dicSC_r_nDim_dicInstalledSku__dicRemoveSku__dicKeepSku__dicC2RSuite__dicDelInUse_r_nDim_dicDelFolder_r_nDim_sAppData__sScrubDir__sProgramFiles__sProgramFilesX86__sCommonProgramFiles_r_nDim_sAllusersProfile__sOSVersion__sWinDir__sWICacheDir__sCommonProgramFilesX86_r_nD
push ebp
push 0x6f
call fcn.004bba00
push 0x6f
call fcn.004bb470
push 0
mov eax, 0x5e60ba
push eax
call fcn.00447c99
push 0
mov eax, str.__________________________Run_OffScrubC2R.vbs_
push eax
call fcn.00447c99
push 0
mov eax, 0x5e60ba
push eax
call fcn.00447c99
push 0
push 0
mov eax, 1
push eax
push dword [esp + 0x14]
mov eax, str.OffScrubC2R.vbs_ALL__NoCancel__OSE_2_1
push eax
mov eax, str.cscript.exe___NoLogo
push eax
call fcn.00415a6c
push edx
call fcn.004cea40
pop edx
push eax
mov edx, dword [esp + 0xc]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, str.OLicenseCleanup.vbs
push edx
call fcn.004cea70
call fcn.004ceb30
push 0x6f
call fcn.0044f422
add dword [esp + 4], edx
call fcn.004bb760
call fcn.0044f440
mov ebp, 0xe199fb
mov ebx, ebp
mov ebp, 0xe13525
sub ebx, ebp
push ebx
mov ebp, 0xe13525
push ebp
push 0x6f
call fcn.004bba00
push 0x6f
call fcn.004bb470
push 0
mov eax, 0x5e60ba
push eax
call fcn.00447c99
push 0
mov eax, str.________________________Run_OLicenseCleanup.vbs_
push eax
call fcn.00447c99
push 0
mov eax, 0x5e60ba
push eax
call fcn.00447c99
push 0
push 0
mov eax, 1
push eax
push dword [esp + 0x14]
mov eax, str.OLicenseCleanup.vbs_2_1
push eax
mov eax, str.cscript.exe___NoLogo
push eax
call fcn.00415a6c
push edx
call fcn.004cea40
pop edx
push eax
push 3
mov eax, 0x5e60ba
push eax
mov edx, dword [0xf81328]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, str._files
push edx
call fcn.004cea70
call fcn.0044f422
add dword [esp], edx
call fcn.004ba98a
call fcn.0044f440
push 0
push 0
call fcn.004b8b03
push eax
call fcn.0042d65c
push 0x100
push 1
call fcn.0044dc2f
mov eax, 0x5e70f4
push eax
mov eax, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstallProplusRetail___en_us
push eax
call fcn.0044d674
mov eax, 0x5e70f4
push eax
mov eax, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstallProplusRetail___ru_ru
push eax
call fcn.0044d674
mov eax, 0x5e70f4
push eax
mov eax, str.HKEY_CLASSES_ROOTInstallerProducts00006109C80000000000000000F01FEC
push eax
call fcn.0044d674
mov eax, 0x5e70f4
push eax
mov eax, str.HKEY_CLASSES_ROOTInstallerProducts00006109C80090400000000000F01FEC
push eax
call fcn.0044d674
mov eax, 0x5e70f4
push eax
mov eax, str.HKEY_CLASSES_ROOTInstallerProducts00006109F80000000100000000F01FEC
push eax
call fcn.0044d674
mov eax, 0x5e70f4
push eax
mov eax, str.HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftOffice16.0CommonOfficeUpdate
push eax
call fcn.0044d674
push edx
call fcn.004cea40
pop edx
push eax
push 0
push 0
xor eax, eax
push eax
mov edx, dword [0xf8107c]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, str.System32
push edx
call fcn.004cea70
call fcn.004ceb30
mov eax, str.delete__HKLMSOFTWAREPoliciesMicrosoftOffice16.0CommonOfficeUpdate___f__v_UpdateBranch
push eax
mov eax, str.reg.exe
push eax
call fcn.0044f422
add dword [esp + 8], edx
call fcn.00415a6c
call fcn.0044f440
push edx
call fcn.004cea40
pop edx
push eax
mov edx, dword [0xf81040]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, str.ProgramDataMicrosoftOfficeSoftwareProtectionPlatform
push edx
call fcn.004cea70
call fcn.0044f422
add dword [esp], edx
call fcn.004ba73d
call fcn.0044f440
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x419c26
cmp edi, 0xffffffff
je 0x419c2a
xor eax, eax
jmp 0x419c2f
mov eax, 1
or eax, eax
je 0x419c77
push edx
call fcn.004cea40
pop edx
push eax
push 3
mov eax, 0x5e60ba
push eax
mov edx, dword [0xf81040]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, str.ProgramDataMicrosoftOfficeSoftwareProtectionPlatform
push edx
call fcn.004cea70
call fcn.0044f422
add dword [esp], edx
call fcn.004ba98a
call fcn.0044f440
push 0
mov eax, str._Completed_
push eax
call fcn.00447c99
push 0
mov eax, 0x5e60ba
push eax
call fcn.00447c99
push 0
push 9
call fcn.004b2448
mov dword [0xf81208], 1
push edx
call fcn.004cea40
pop edx
push eax
call fcn.0044d9fd
lea eax, [esp + 0x10]
push eax
call fcn.004ceac0
push 1
push dword [0xf810e0]
push dword [esp + 0x14]
call fcn.004cca70
mov ebx, eax
and ebx, ebx
jle 0x419cf7
push dword [esp + 0xc]
push 0
call sub.USER32.dll_FindWindowW
push eax
call sub.USER32.dll_SetForegroundWindow
jmp 0x419d08
push dword [esp + 0xc]
mov edx, 0x5e60ba
pop ecx
call fcn.0044f3d0
je 0x419cb0
call fcn.004487a0
xor eax, eax
push dword [esp + 8]
call fcn.004cebc0
push dword [esp]
call fcn.004cebc0
push dword [esp + 4]
call fcn.004cebc0
push dword [esp + 0xc]
call fcn.004cebc0
add esp, 0x10
pop edi
pop ebx
pop ebp
ret 4