Function at 0x419637
Capabilities:
Get geographical location
Reference sql statements

Disassembly:
push ebp
push ebx
push edi
xor eax, eax
push eax
push eax
call fcn.004ceb50
mov ebx, dword [0x5fd264]
and ebx, ebx
jle 0x4196f5
mov dword [0x5fd264], 0
push 0
call fcn.004160d8
mov dword [0xf81454], 0
push dword [0xf81464]
call fcn.004c78ad
cdq
push edx
push eax
push 9
call fcn.004b031c
push 0
push 0x51
call fcn.004b2448
push 0
push 8
call fcn.004b2448
push 0
push 0xa
call fcn.004b2448
push 0
push 0xb
call fcn.004b2448
push 0
push 0x36
call fcn.004b2448
push 0
push 0
push 3
call fcn.004b031c
mov dword [0xf815a8], 0
jmp 0x419d37
mov ebx, dword [0xf815a8]
and ebx, ebx
jle 0x419704
jmp 0x419d37
push 1
push 0x51
call fcn.004b2448
push 1
push 8
call fcn.004b2448
push 1
push 0xa
call fcn.004b2448
push 1
push 0xb
call fcn.004b2448
mov dword [0xf815a8], 1
mov dword [0x5fd264], 1
mov eax, 0x5ea0fc
push eax
push 9
call fcn.004b253c
push 1
push 9
call fcn.004b2448
push 1
call fcn.004160d8
mov eax, 0x5e60ba
push eax
push 7
call fcn.004b253c
mov edx, dword [0xf81570]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, str._files
push edx
call fcn.004cea70
lea eax, [esp + 4]
push eax
call fcn.004ceac0
push dword [esp]
call fcn.004bacd8
push 1
push 0
call fcn.004b8b03
push eax
call fcn.0042d441
push 0
push dword [esp + 4]
call fcn.0041cc78
push edx
call fcn.004cea40
pop edx
push eax
mov edx, dword [esp + 4]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, str.OffScrub_O15msi.vbs
push edx
call fcn.004cea70
call fcn.004ceb30
push 0x6f
call fcn.0044f422
add dword [esp + 4], edx
call fcn.004bb760
call fcn.0044f440
mov ebp, 0xe79c1f
mov ebx, ebp
mov ebp, 0xe19c43
sub ebx, ebp
push ebx
mov ebp, 0xe19c43
push ebp
push 0x6f
call fcn.004bba00
push 0x6f
call fcn.004bb470
push 0
mov eax, 0x5e60ba
push eax
call fcn.00447847
push 0
mov eax, str.__________________________Run_OffScrub_O15msi.vbs_
push eax
call fcn.00447847
push 0
mov eax, 0x5e60ba
push eax
call fcn.00447847
push 0
push 0
mov eax, 1
push eax
push dword [esp + 0xc]
mov eax, str.OffScrub_O15msi.vbs_ALL__NoCancel__Force__OSE_2_1
push eax
mov eax, str.cscript.exe___NoLogo
push eax
call fcn.00415bcb
push edx
call fcn.004cea40
pop edx
push eax
mov edx, dword [esp + 4]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, str.OffScrub_O16msi.vbs
push edx
call fcn.004cea70
call fcn.004ceb30
push 0x6f
call fcn.0044f422
add dword [esp + 4], edx
call fcn.004bb760
call fcn.0044f440
mov ebp, 0xed9bbb
mov ebx, ebp
mov ebp, 0xe79c1f
sub ebx, ebp
push ebx
mov ebp, 0xe79c1f
push ebp
push 0x6f
call fcn.004bba00
push 0x6f
call fcn.004bb470
push 0
mov eax, 0x5e60ba
push eax
call fcn.00447847
push 0
mov eax, str.__________________________Run_OffScrub_O16msi.vbs_
push eax
call fcn.00447847
push 0
mov eax, 0x5e60ba
push eax
call fcn.00447847
push 0
push 0
mov eax, 1
push eax
push dword [esp + 0xc]
mov eax, str.OffScrub_O16msi.vbs_ALL__NoCancel__Force__OSE_2_1
push eax
mov eax, str.cscript.exe___NoLogo
push eax
call fcn.00415bcb
push edx
call fcn.004cea40
pop edx
push eax
mov edx, dword [esp + 4]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, str.OffScrubC2R.vbs
push edx
call fcn.004cea70
call fcn.004ceb30
push 0x6f
call fcn.0044f422
add dword [esp + 4], edx
call fcn.004bb760
call fcn.0044f440
mov ebp, 0xe1376d
mov ebx, ebp
mov ebp, str.reg_add__HKLMSOFTWAREMicrosoftWindows_Script_HostSettings___v_Enabled__t_REG_DWORD__d_1__f_r_ncscript.exe___dp0Office_Uninstall.vbs___Force_r_n_r_n_r_n_Name:_OffScrubC2R.vbs_r_n_Author:_Microsoft_Customer_Support_Services_r_n_Copyright__c__2014___2016_Microsoft_Corporation_r_n_Script_to_remove_Office_Click_To_Run__C2R__products_r_n_when_a_regular_uninstall_is_no_longer_possible_r_n_r_n_Scope:_Office_2013__2016_and_O365_C2R_products_r_n_r_n_r_nOption_Explicit_r_n_r_n________________________________________________________________________________r_n_r_n___Declaration_of_constants_r_n________________________________________________________________________________r_n_r_n_r_nConst_SCRIPTVERSION_____2.19__r_nConst_SCRIPTFILE________OffScrubC2R.vbs__r_nConst_SCRIPTNAME________OffScrubC2R__r_nConst_RETVALFILE________ScrubRetValFile.txt__r_nConst_ONAME_____________Office_C2R___O365__r_nConst_HKCR_____________H80000000_r_nConst_HKCU_____________H80000001_r_nConst_HKLM_____________H80000002_r_nConst_HKU______________H80000003_r_nConst_PRODLEN__________13_r_nConst_SQUISHED_________20_r_nConst_COMPRESSED_______32_r_nConst_REG_ARP___________SOFTWAREMicrosoftWindowsCurrentVersionUninstall__r_nConst_VB_YES___________6_r_nConst_VB_NO____________7_r_n_r_nConst_ERROR_SUCCESS__________________0___Bit_1.__0_indicates_Success._Script_completed_successfully_r_nConst_ERROR_FAIL_____________________1___Bit_1.__Failure_bit._Indicates_an_overall_script_failure._r_n__________________________________________RESERVED_bit__Returned_when_process_is_killed_from_task_manager_r_nConst_ERROR_REBOOT_REQUIRED__________2___Bit_2.__Reboot_bit._If_set_a_reboot_is_required_r_nConst_ERROR_USERCANCEL_______________4___Bit_3.__User_Cancel_bit._Controlled_cancel_from_script_UI_r_nConst_ERROR_STAGE1___________________8___Bit_4.__Informational._Msiexec_based_install_was_not_possible_r_nConst_ERROR_STAGE2___________________16__Bit_5.__Critical._Not_all_of_the_intended_cleanup_operations_could_be_applied_r_nConst_ERROR_INCOMPLETE_______________32__Bit_6.__Pending_file_renames__del_on_reboot____OR___Removal_needs_to_run_again_after_a_system_reboot._r_nConst_ERROR_DCAF_FAILURE_____________64__Bit_7.__Critical._Da_capo_al_fine__second_attempt__still_failed._r_nConst_ERROR_ELEVATION_USERDECLINED___128_Bit_8.__Critical_script_error._User_declined_to_allow_mandatory_script_elevation_r_nConst_ERROR_ELEVATION________________256_Bit_9.__Critical_script_error._The_attempt_to_elevate_the_process_did_not_succeed_r_nConst_ERROR_SCRIPTINIT_______________512_Bit_10._Critical_script_error._Initialization_failed_r_nConst_ERROR_RELAUNCH_________________1024Bit_11._Critical_script_error._This_is_a_temporary_value_and_must_not_be_the_final_return_code_r_nConst_ERROR_UNKNOWN__________________2048Bit_12_Critical_script_error._Script_did_not_complete_in_a_well_defined_state_r_nConst_ERROR_ALL______________________4095Full_BitMask_r_nConst_ERROR_USER_ABORT_______________HC000013A_RESERVED._Dec__1073741510._Critical_error._Returned_when_user_aborts_with__Ctrl__Break__or_closes_the_cmd_window_r_nConst_ERROR_SUCCESS_CONFIG_COMPLETE__1728_r_nConst_ERROR_SUCCESS_REBOOT_REQUIRED__3010_r_n_r_n________________________________________________________________________________r_n_r_n___Declaration_of_variables_r_n________________________________________________________________________________r_n_r_nDim_oFso__oMsi__oReg__oWShell__oWmiLocal__oShellApp_r_nDim_ComputerItem__Key__Item__LogStream__TmpKey_r_nDim_arrVersion_r_nDim_dicKeepLis__dicApps__dicKeepFolder__dicDelRegKey__dicKeepReg__dicSC_r_nDim_dicInstalledSku__dicRemoveSku__dicKeepSku__dicC2RSuite__dicDelInUse_r_nDim_dicDelFolder_r_nDim_sAppData__sScrubDir__sProgramFiles__sProgramFilesX86__sCommonProgramFiles_r_nDim_sAllusersProfile__sOSVersion__sWinDir__sWICacheDir__sCommonProgramFilesX86_r_nD
sub ebx, ebp
push ebx
mov ebp, str.reg_add__HKLMSOFTWAREMicrosoftWindows_Script_HostSettings___v_Enabled__t_REG_DWORD__d_1__f_r_ncscript.exe___dp0Office_Uninstall.vbs___Force_r_n_r_n_r_n_Name:_OffScrubC2R.vbs_r_n_Author:_Microsoft_Customer_Support_Services_r_n_Copyright__c__2014___2016_Microsoft_Corporation_r_n_Script_to_remove_Office_Click_To_Run__C2R__products_r_n_when_a_regular_uninstall_is_no_longer_possible_r_n_r_n_Scope:_Office_2013__2016_and_O365_C2R_products_r_n_r_n_r_nOption_Explicit_r_n_r_n________________________________________________________________________________r_n_r_n___Declaration_of_constants_r_n________________________________________________________________________________r_n_r_n_r_nConst_SCRIPTVERSION_____2.19__r_nConst_SCRIPTFILE________OffScrubC2R.vbs__r_nConst_SCRIPTNAME________OffScrubC2R__r_nConst_RETVALFILE________ScrubRetValFile.txt__r_nConst_ONAME_____________Office_C2R___O365__r_nConst_HKCR_____________H80000000_r_nConst_HKCU_____________H80000001_r_nConst_HKLM_____________H80000002_r_nConst_HKU______________H80000003_r_nConst_PRODLEN__________13_r_nConst_SQUISHED_________20_r_nConst_COMPRESSED_______32_r_nConst_REG_ARP___________SOFTWAREMicrosoftWindowsCurrentVersionUninstall__r_nConst_VB_YES___________6_r_nConst_VB_NO____________7_r_n_r_nConst_ERROR_SUCCESS__________________0___Bit_1.__0_indicates_Success._Script_completed_successfully_r_nConst_ERROR_FAIL_____________________1___Bit_1.__Failure_bit._Indicates_an_overall_script_failure._r_n__________________________________________RESERVED_bit__Returned_when_process_is_killed_from_task_manager_r_nConst_ERROR_REBOOT_REQUIRED__________2___Bit_2.__Reboot_bit._If_set_a_reboot_is_required_r_nConst_ERROR_USERCANCEL_______________4___Bit_3.__User_Cancel_bit._Controlled_cancel_from_script_UI_r_nConst_ERROR_STAGE1___________________8___Bit_4.__Informational._Msiexec_based_install_was_not_possible_r_nConst_ERROR_STAGE2___________________16__Bit_5.__Critical._Not_all_of_the_intended_cleanup_operations_could_be_applied_r_nConst_ERROR_INCOMPLETE_______________32__Bit_6.__Pending_file_renames__del_on_reboot____OR___Removal_needs_to_run_again_after_a_system_reboot._r_nConst_ERROR_DCAF_FAILURE_____________64__Bit_7.__Critical._Da_capo_al_fine__second_attempt__still_failed._r_nConst_ERROR_ELEVATION_USERDECLINED___128_Bit_8.__Critical_script_error._User_declined_to_allow_mandatory_script_elevation_r_nConst_ERROR_ELEVATION________________256_Bit_9.__Critical_script_error._The_attempt_to_elevate_the_process_did_not_succeed_r_nConst_ERROR_SCRIPTINIT_______________512_Bit_10._Critical_script_error._Initialization_failed_r_nConst_ERROR_RELAUNCH_________________1024Bit_11._Critical_script_error._This_is_a_temporary_value_and_must_not_be_the_final_return_code_r_nConst_ERROR_UNKNOWN__________________2048Bit_12_Critical_script_error._Script_did_not_complete_in_a_well_defined_state_r_nConst_ERROR_ALL______________________4095Full_BitMask_r_nConst_ERROR_USER_ABORT_______________HC000013A_RESERVED._Dec__1073741510._Critical_error._Returned_when_user_aborts_with__Ctrl__Break__or_closes_the_cmd_window_r_nConst_ERROR_SUCCESS_CONFIG_COMPLETE__1728_r_nConst_ERROR_SUCCESS_REBOOT_REQUIRED__3010_r_n_r_n________________________________________________________________________________r_n_r_n___Declaration_of_variables_r_n________________________________________________________________________________r_n_r_nDim_oFso__oMsi__oReg__oWShell__oWmiLocal__oShellApp_r_nDim_ComputerItem__Key__Item__LogStream__TmpKey_r_nDim_arrVersion_r_nDim_dicKeepLis__dicApps__dicKeepFolder__dicDelRegKey__dicKeepReg__dicSC_r_nDim_dicInstalledSku__dicRemoveSku__dicKeepSku__dicC2RSuite__dicDelInUse_r_nDim_dicDelFolder_r_nDim_sAppData__sScrubDir__sProgramFiles__sProgramFilesX86__sCommonProgramFiles_r_nDim_sAllusersProfile__sOSVersion__sWinDir__sWICacheDir__sCommonProgramFilesX86_r_nD
push ebp
push 0x6f
call fcn.004bba00
push 0x6f
call fcn.004bb470
push 0
mov eax, 0x5e60ba
push eax
call fcn.00447847
push 0
mov eax, str.__________________________Run_OffScrubC2R.vbs_
push eax
call fcn.00447847
push 0
mov eax, 0x5e60ba
push eax
call fcn.00447847
push 0
push 0
mov eax, 1
push eax
push dword [esp + 0xc]
mov eax, str.OffScrubC2R.vbs_ALL__NoCancel__OSE_2_1
push eax
mov eax, str.cscript.exe___NoLogo
push eax
call fcn.00415bcb
push edx
call fcn.004cea40
pop edx
push eax
mov edx, dword [esp + 4]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, str.OLicenseCleanup.vbs
push edx
call fcn.004cea70
call fcn.004ceb30
push 0x6f
call fcn.0044f422
add dword [esp + 4], edx
call fcn.004bb760
call fcn.0044f440
mov ebp, 0xe19c43
mov ebx, ebp
mov ebp, 0xe1376d
sub ebx, ebp
push ebx
mov ebp, 0xe1376d
push ebp
push 0x6f
call fcn.004bba00
push 0x6f
call fcn.004bb470
push 0
mov eax, 0x5e60ba
push eax
call fcn.00447847
push 0
mov eax, str.________________________Run_OLicenseCleanup.vbs_
push eax
call fcn.00447847
push 0
mov eax, 0x5e60ba
push eax
call fcn.00447847
push 0
push 0
mov eax, 1
push eax
push dword [esp + 0xc]
mov eax, str.OLicenseCleanup.vbs_2_1
push eax
mov eax, str.cscript.exe___NoLogo
push eax
call fcn.00415bcb
push edx
call fcn.004cea40
pop edx
push eax
push 3
mov eax, 0x5e60ba
push eax
mov edx, dword [0xf81570]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, str._files
push edx
call fcn.004cea70
call fcn.0044f422
add dword [esp], edx
call fcn.004ba98a
call fcn.0044f440
push 0
push 0
call fcn.004b8b03
push eax
call fcn.0042d441
push 0x100
push 1
call fcn.0044d7dd
mov eax, 0x5e7158
push eax
mov eax, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstallProplusRetail___en_us
push eax
call fcn.0044d222
mov eax, 0x5e7158
push eax
mov eax, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstallProplusRetail___ru_ru
push eax
call fcn.0044d222
mov eax, 0x5e7158
push eax
mov eax, str.HKEY_CLASSES_ROOTInstallerProducts00006109C80000000000000000F01FEC
push eax
call fcn.0044d222
mov eax, 0x5e7158
push eax
mov eax, str.HKEY_CLASSES_ROOTInstallerProducts00006109C80090400000000000F01FEC
push eax
call fcn.0044d222
mov eax, 0x5e7158
push eax
mov eax, str.HKEY_CLASSES_ROOTInstallerProducts00006109F80000000100000000F01FEC
push eax
call fcn.0044d222
mov eax, 0x5e7158
push eax
mov eax, str.HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftOffice16.0CommonOfficeUpdate
push eax
call fcn.0044d222
push edx
call fcn.004cea40
pop edx
push eax
push 0
push 0
xor eax, eax
push eax
mov edx, dword [0xf812cc]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, str.System32
push edx
call fcn.004cea70
call fcn.004ceb30
mov eax, str.delete__HKLMSOFTWAREPoliciesMicrosoftOffice16.0CommonOfficeUpdate___f__v_UpdateBranch
push eax
mov eax, str.reg.exe
push eax
call fcn.0044f422
add dword [esp + 8], edx
call fcn.00415bcb
call fcn.0044f440
push edx
call fcn.004cea40
pop edx
push eax
mov edx, dword [0xf81290]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, str.ProgramDataMicrosoftOfficeSoftwareProtectionPlatform
push edx
call fcn.004cea70
call fcn.0044f422
add dword [esp], edx
call fcn.004ba779
call fcn.0044f440
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x419c4e
cmp edi, 0xffffffff
je 0x419c52
xor eax, eax
jmp 0x419c57
mov eax, 1
or eax, eax
je 0x419c9f
push edx
call fcn.004cea40
pop edx
push eax
push 3
mov eax, 0x5e60ba
push eax
mov edx, dword [0xf81290]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, str.ProgramDataMicrosoftOfficeSoftwareProtectionPlatform
push edx
call fcn.004cea70
call fcn.0044f422
add dword [esp], edx
call fcn.004ba98a
call fcn.0044f440
push 0
mov eax, str._Completed_
push eax
call fcn.00447847
push 0
mov eax, 0x5e60ba
push eax
call fcn.00447847
push 0
push 9
call fcn.004b2448
mov dword [0xf81454], 1
push edx
call fcn.004cea40
pop edx
push eax
call fcn.0044d5ab
lea eax, [esp + 8]
push eax
call fcn.004ceac0
push 1
push dword [0xf81330]
push dword [esp + 0xc]
call fcn.004cc720
mov ebx, eax
and ebx, ebx
jle 0x419d1f
push dword [esp + 4]
push 0
call sub.USER32.dll_FindWindowW
push eax
call sub.USER32.dll_SetForegroundWindow
jmp 0x419d30
push dword [esp + 4]
mov edx, 0x5e60ba
pop ecx
call fcn.0044f3d0
je 0x419cd8
call fcn.0044834e
xor eax, eax
push dword [esp]
call fcn.004cebc0
push dword [esp + 4]
call fcn.004cebc0
add esp, 8
pop edi
pop ebx
pop ebp
ret 4