Function at 0x4192f2
Capabilities:
Get geographical location
Reference sql statements

Disassembly:
push ebp
push ebx
push edi
xor eax, eax
push eax
push eax
call fcn.004ceb50
mov ebx, dword [0x5fd424]
and ebx, ebx
jle 0x4193b0
mov dword [0x5fd424], 0
push 0
call fcn.00415d93
mov dword [0xf8161c], 0
push dword [0xf8162c]
call fcn.004c78ad
cdq
push edx
push eax
push 9
call fcn.004b031c
push 0
push 0x51
call fcn.004b2448
push 0
push 8
call fcn.004b2448
push 0
push 0xa
call fcn.004b2448
push 0
push 0xb
call fcn.004b2448
push 0
push 0x36
call fcn.004b2448
push 0
push 0
push 3
call fcn.004b031c
mov dword [0xf81770], 0
jmp 0x4199f2
mov ebx, dword [0xf81770]
and ebx, ebx
jle 0x4193bf
jmp 0x4199f2
push 1
push 0x51
call fcn.004b2448
push 1
push 8
call fcn.004b2448
push 1
push 0xa
call fcn.004b2448
push 1
push 0xb
call fcn.004b2448
mov dword [0xf81770], 1
mov dword [0x5fd424], 1
mov eax, 0x5ea0ac
push eax
push 9
call fcn.004b253c
push 1
push 9
call fcn.004b2448
push 1
call fcn.00415d93
mov eax, 0x5e60ba
push eax
push 7
call fcn.004b253c
mov edx, dword [0xf81738]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, str._files
push edx
call fcn.004cea70
lea eax, [esp + 4]
push eax
call fcn.004ceac0
push dword [esp]
call fcn.004bacd8
push 1
push 0
call fcn.004b8b03
push eax
call fcn.0042d3cb
push 0
push dword [esp + 4]
call fcn.0041c933
push edx
call fcn.004cea40
pop edx
push eax
mov edx, dword [esp + 4]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, str.OffScrub_O15msi.vbs
push edx
call fcn.004cea70
call fcn.004ceb30
push 0x6f
call fcn.0044f422
add dword [esp + 4], edx
call fcn.004bb760
call fcn.0044f440
mov ebp, 0xe79ddf
mov ebx, ebp
mov ebp, 0xe19e03
sub ebx, ebp
push ebx
mov ebp, 0xe19e03
push ebp
push 0x6f
call fcn.004bba00
push 0x6f
call fcn.004bb470
push 0
mov eax, 0x5e60ba
push eax
call fcn.00447b7e
push 0
mov eax, str.__________________________Run_OffScrub_O15msi.vbs_
push eax
call fcn.00447b7e
push 0
mov eax, 0x5e60ba
push eax
call fcn.00447b7e
push 0
push 0
mov eax, 1
push eax
push dword [esp + 0xc]
mov eax, str.OffScrub_O15msi.vbs_ALL__NoCancel__Force__OSE_2_1
push eax
mov eax, str.cscript.exe___NoLogo
push eax
call fcn.00415886
push edx
call fcn.004cea40
pop edx
push eax
mov edx, dword [esp + 4]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, str.OffScrub_O16msi.vbs
push edx
call fcn.004cea70
call fcn.004ceb30
push 0x6f
call fcn.0044f422
add dword [esp + 4], edx
call fcn.004bb760
call fcn.0044f440
mov ebp, 0xed9d7b
mov ebx, ebp
mov ebp, 0xe79ddf
sub ebx, ebp
push ebx
mov ebp, 0xe79ddf
push ebp
push 0x6f
call fcn.004bba00
push 0x6f
call fcn.004bb470
push 0
mov eax, 0x5e60ba
push eax
call fcn.00447b7e
push 0
mov eax, str.__________________________Run_OffScrub_O16msi.vbs_
push eax
call fcn.00447b7e
push 0
mov eax, 0x5e60ba
push eax
call fcn.00447b7e
push 0
push 0
mov eax, 1
push eax
push dword [esp + 0xc]
mov eax, str.OffScrub_O16msi.vbs_ALL__NoCancel__Force__OSE_2_1
push eax
mov eax, str.cscript.exe___NoLogo
push eax
call fcn.00415886
push edx
call fcn.004cea40
pop edx
push eax
mov edx, dword [esp + 4]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, str.OffScrubC2R.vbs
push edx
call fcn.004cea70
call fcn.004ceb30
push 0x6f
call fcn.0044f422
add dword [esp + 4], edx
call fcn.004bb760
call fcn.0044f440
mov ebp, 0xe1392d
mov ebx, ebp
mov ebp, str.reg_add__HKLMSOFTWAREMicrosoftWindows_Script_HostSettings___v_Enabled__t_REG_DWORD__d_1__f_r_ncscript.exe___dp0Office_Uninstall.vbs___Force_r_n_r_n_r_n_Name:_OffScrubC2R.vbs_r_n_Author:_Microsoft_Customer_Support_Services_r_n_Copyright__c__2014___2016_Microsoft_Corporation_r_n_Script_to_remove_Office_Click_To_Run__C2R__products_r_n_when_a_regular_uninstall_is_no_longer_possible_r_n_r_n_Scope:_Office_2013__2016_and_O365_C2R_products_r_n_r_n_r_nOption_Explicit_r_n_r_n________________________________________________________________________________r_n_r_n___Declaration_of_constants_r_n________________________________________________________________________________r_n_r_n_r_nConst_SCRIPTVERSION_____2.19__r_nConst_SCRIPTFILE________OffScrubC2R.vbs__r_nConst_SCRIPTNAME________OffScrubC2R__r_nConst_RETVALFILE________ScrubRetValFile.txt__r_nConst_ONAME_____________Office_C2R___O365__r_nConst_HKCR_____________H80000000_r_nConst_HKCU_____________H80000001_r_nConst_HKLM_____________H80000002_r_nConst_HKU______________H80000003_r_nConst_PRODLEN__________13_r_nConst_SQUISHED_________20_r_nConst_COMPRESSED_______32_r_nConst_REG_ARP___________SOFTWAREMicrosoftWindowsCurrentVersionUninstall__r_nConst_VB_YES___________6_r_nConst_VB_NO____________7_r_n_r_nConst_ERROR_SUCCESS__________________0___Bit_1.__0_indicates_Success._Script_completed_successfully_r_nConst_ERROR_FAIL_____________________1___Bit_1.__Failure_bit._Indicates_an_overall_script_failure._r_n__________________________________________RESERVED_bit__Returned_when_process_is_killed_from_task_manager_r_nConst_ERROR_REBOOT_REQUIRED__________2___Bit_2.__Reboot_bit._If_set_a_reboot_is_required_r_nConst_ERROR_USERCANCEL_______________4___Bit_3.__User_Cancel_bit._Controlled_cancel_from_script_UI_r_nConst_ERROR_STAGE1___________________8___Bit_4.__Informational._Msiexec_based_install_was_not_possible_r_nConst_ERROR_STAGE2___________________16__Bit_5.__Critical._Not_all_of_the_intended_cleanup_operations_could_be_applied_r_nConst_ERROR_INCOMPLETE_______________32__Bit_6.__Pending_file_renames__del_on_reboot____OR___Removal_needs_to_run_again_after_a_system_reboot._r_nConst_ERROR_DCAF_FAILURE_____________64__Bit_7.__Critical._Da_capo_al_fine__second_attempt__still_failed._r_nConst_ERROR_ELEVATION_USERDECLINED___128_Bit_8.__Critical_script_error._User_declined_to_allow_mandatory_script_elevation_r_nConst_ERROR_ELEVATION________________256_Bit_9.__Critical_script_error._The_attempt_to_elevate_the_process_did_not_succeed_r_nConst_ERROR_SCRIPTINIT_______________512_Bit_10._Critical_script_error._Initialization_failed_r_nConst_ERROR_RELAUNCH_________________1024Bit_11._Critical_script_error._This_is_a_temporary_value_and_must_not_be_the_final_return_code_r_nConst_ERROR_UNKNOWN__________________2048Bit_12_Critical_script_error._Script_did_not_complete_in_a_well_defined_state_r_nConst_ERROR_ALL______________________4095Full_BitMask_r_nConst_ERROR_USER_ABORT_______________HC000013A_RESERVED._Dec__1073741510._Critical_error._Returned_when_user_aborts_with__Ctrl__Break__or_closes_the_cmd_window_r_nConst_ERROR_SUCCESS_CONFIG_COMPLETE__1728_r_nConst_ERROR_SUCCESS_REBOOT_REQUIRED__3010_r_n_r_n________________________________________________________________________________r_n_r_n___Declaration_of_variables_r_n________________________________________________________________________________r_n_r_nDim_oFso__oMsi__oReg__oWShell__oWmiLocal__oShellApp_r_nDim_ComputerItem__Key__Item__LogStream__TmpKey_r_nDim_arrVersion_r_nDim_dicKeepLis__dicApps__dicKeepFolder__dicDelRegKey__dicKeepReg__dicSC_r_nDim_dicInstalledSku__dicRemoveSku__dicKeepSku__dicC2RSuite__dicDelInUse_r_nDim_dicDelFolder_r_nDim_sAppData__sScrubDir__sProgramFiles__sProgramFilesX86__sCommonProgramFiles_r_nDim_sAllusersProfile__sOSVersion__sWinDir__sWICacheDir__sCommonProgramFilesX86_r_nD
sub ebx, ebp
push ebx
mov ebp, str.reg_add__HKLMSOFTWAREMicrosoftWindows_Script_HostSettings___v_Enabled__t_REG_DWORD__d_1__f_r_ncscript.exe___dp0Office_Uninstall.vbs___Force_r_n_r_n_r_n_Name:_OffScrubC2R.vbs_r_n_Author:_Microsoft_Customer_Support_Services_r_n_Copyright__c__2014___2016_Microsoft_Corporation_r_n_Script_to_remove_Office_Click_To_Run__C2R__products_r_n_when_a_regular_uninstall_is_no_longer_possible_r_n_r_n_Scope:_Office_2013__2016_and_O365_C2R_products_r_n_r_n_r_nOption_Explicit_r_n_r_n________________________________________________________________________________r_n_r_n___Declaration_of_constants_r_n________________________________________________________________________________r_n_r_n_r_nConst_SCRIPTVERSION_____2.19__r_nConst_SCRIPTFILE________OffScrubC2R.vbs__r_nConst_SCRIPTNAME________OffScrubC2R__r_nConst_RETVALFILE________ScrubRetValFile.txt__r_nConst_ONAME_____________Office_C2R___O365__r_nConst_HKCR_____________H80000000_r_nConst_HKCU_____________H80000001_r_nConst_HKLM_____________H80000002_r_nConst_HKU______________H80000003_r_nConst_PRODLEN__________13_r_nConst_SQUISHED_________20_r_nConst_COMPRESSED_______32_r_nConst_REG_ARP___________SOFTWAREMicrosoftWindowsCurrentVersionUninstall__r_nConst_VB_YES___________6_r_nConst_VB_NO____________7_r_n_r_nConst_ERROR_SUCCESS__________________0___Bit_1.__0_indicates_Success._Script_completed_successfully_r_nConst_ERROR_FAIL_____________________1___Bit_1.__Failure_bit._Indicates_an_overall_script_failure._r_n__________________________________________RESERVED_bit__Returned_when_process_is_killed_from_task_manager_r_nConst_ERROR_REBOOT_REQUIRED__________2___Bit_2.__Reboot_bit._If_set_a_reboot_is_required_r_nConst_ERROR_USERCANCEL_______________4___Bit_3.__User_Cancel_bit._Controlled_cancel_from_script_UI_r_nConst_ERROR_STAGE1___________________8___Bit_4.__Informational._Msiexec_based_install_was_not_possible_r_nConst_ERROR_STAGE2___________________16__Bit_5.__Critical._Not_all_of_the_intended_cleanup_operations_could_be_applied_r_nConst_ERROR_INCOMPLETE_______________32__Bit_6.__Pending_file_renames__del_on_reboot____OR___Removal_needs_to_run_again_after_a_system_reboot._r_nConst_ERROR_DCAF_FAILURE_____________64__Bit_7.__Critical._Da_capo_al_fine__second_attempt__still_failed._r_nConst_ERROR_ELEVATION_USERDECLINED___128_Bit_8.__Critical_script_error._User_declined_to_allow_mandatory_script_elevation_r_nConst_ERROR_ELEVATION________________256_Bit_9.__Critical_script_error._The_attempt_to_elevate_the_process_did_not_succeed_r_nConst_ERROR_SCRIPTINIT_______________512_Bit_10._Critical_script_error._Initialization_failed_r_nConst_ERROR_RELAUNCH_________________1024Bit_11._Critical_script_error._This_is_a_temporary_value_and_must_not_be_the_final_return_code_r_nConst_ERROR_UNKNOWN__________________2048Bit_12_Critical_script_error._Script_did_not_complete_in_a_well_defined_state_r_nConst_ERROR_ALL______________________4095Full_BitMask_r_nConst_ERROR_USER_ABORT_______________HC000013A_RESERVED._Dec__1073741510._Critical_error._Returned_when_user_aborts_with__Ctrl__Break__or_closes_the_cmd_window_r_nConst_ERROR_SUCCESS_CONFIG_COMPLETE__1728_r_nConst_ERROR_SUCCESS_REBOOT_REQUIRED__3010_r_n_r_n________________________________________________________________________________r_n_r_n___Declaration_of_variables_r_n________________________________________________________________________________r_n_r_nDim_oFso__oMsi__oReg__oWShell__oWmiLocal__oShellApp_r_nDim_ComputerItem__Key__Item__LogStream__TmpKey_r_nDim_arrVersion_r_nDim_dicKeepLis__dicApps__dicKeepFolder__dicDelRegKey__dicKeepReg__dicSC_r_nDim_dicInstalledSku__dicRemoveSku__dicKeepSku__dicC2RSuite__dicDelInUse_r_nDim_dicDelFolder_r_nDim_sAppData__sScrubDir__sProgramFiles__sProgramFilesX86__sCommonProgramFiles_r_nDim_sAllusersProfile__sOSVersion__sWinDir__sWICacheDir__sCommonProgramFilesX86_r_nD
push ebp
push 0x6f
call fcn.004bba00
push 0x6f
call fcn.004bb470
push 0
mov eax, 0x5e60ba
push eax
call fcn.00447b7e
push 0
mov eax, str.__________________________Run_OffScrubC2R.vbs_
push eax
call fcn.00447b7e
push 0
mov eax, 0x5e60ba
push eax
call fcn.00447b7e
push 0
push 0
mov eax, 1
push eax
push dword [esp + 0xc]
mov eax, str.OffScrubC2R.vbs_ALL__NoCancel__OSE_2_1
push eax
mov eax, str.cscript.exe___NoLogo
push eax
call fcn.00415886
push edx
call fcn.004cea40
pop edx
push eax
mov edx, dword [esp + 4]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, str.OLicenseCleanup.vbs
push edx
call fcn.004cea70
call fcn.004ceb30
push 0x6f
call fcn.0044f422
add dword [esp + 4], edx
call fcn.004bb760
call fcn.0044f440
mov ebp, 0xe19e03
mov ebx, ebp
mov ebp, 0xe1392d
sub ebx, ebp
push ebx
mov ebp, 0xe1392d
push ebp
push 0x6f
call fcn.004bba00
push 0x6f
call fcn.004bb470
push 0
mov eax, 0x5e60ba
push eax
call fcn.00447b7e
push 0
mov eax, str.________________________Run_OLicenseCleanup.vbs_
push eax
call fcn.00447b7e
push 0
mov eax, 0x5e60ba
push eax
call fcn.00447b7e
push 0
push 0
mov eax, 1
push eax
push dword [esp + 0xc]
mov eax, str.OLicenseCleanup.vbs_2_1
push eax
mov eax, str.cscript.exe___NoLogo
push eax
call fcn.00415886
push edx
call fcn.004cea40
pop edx
push eax
push 3
mov eax, 0x5e60ba
push eax
mov edx, dword [0xf81738]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, str._files
push edx
call fcn.004cea70
call fcn.0044f422
add dword [esp], edx
call fcn.004ba98a
call fcn.0044f440
push 0
push 0
call fcn.004b8b03
push eax
call fcn.0042d3cb
push 0x100
push 1
call fcn.0044db14
mov eax, 0x5e70e6
push eax
mov eax, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstallProplusRetail___en_us
push eax
call fcn.0044d559
mov eax, 0x5e70e6
push eax
mov eax, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstallProplusRetail___ru_ru
push eax
call fcn.0044d559
mov eax, 0x5e70e6
push eax
mov eax, str.HKEY_CLASSES_ROOTInstallerProducts00006109C80000000000000000F01FEC
push eax
call fcn.0044d559
mov eax, 0x5e70e6
push eax
mov eax, str.HKEY_CLASSES_ROOTInstallerProducts00006109C80090400000000000F01FEC
push eax
call fcn.0044d559
mov eax, 0x5e70e6
push eax
mov eax, str.HKEY_CLASSES_ROOTInstallerProducts00006109F80000000100000000F01FEC
push eax
call fcn.0044d559
mov eax, 0x5e70e6
push eax
mov eax, str.HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftOffice16.0CommonOfficeUpdate
push eax
call fcn.0044d559
push edx
call fcn.004cea40
pop edx
push eax
push 0
push 0
xor eax, eax
push eax
mov edx, dword [0xf8148c]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, str.System32
push edx
call fcn.004cea70
call fcn.004ceb30
mov eax, str.delete__HKLMSOFTWAREPoliciesMicrosoftOffice16.0CommonOfficeUpdate___f__v_UpdateBranch
push eax
mov eax, str.reg.exe
push eax
call fcn.0044f422
add dword [esp + 8], edx
call fcn.00415886
call fcn.0044f440
push edx
call fcn.004cea40
pop edx
push eax
mov edx, dword [0xf81450]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, str.ProgramDataMicrosoftOfficeSoftwareProtectionPlatform
push edx
call fcn.004cea70
call fcn.0044f422
add dword [esp], edx
call fcn.004ba779
call fcn.0044f440
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x419909
cmp edi, 0xffffffff
je 0x41990d
xor eax, eax
jmp 0x419912
mov eax, 1
or eax, eax
je 0x41995a
push edx
call fcn.004cea40
pop edx
push eax
push 3
mov eax, 0x5e60ba
push eax
mov edx, dword [0xf81450]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, str.ProgramDataMicrosoftOfficeSoftwareProtectionPlatform
push edx
call fcn.004cea70
call fcn.0044f422
add dword [esp], edx
call fcn.004ba98a
call fcn.0044f440
push 0
mov eax, 0x5f1aa6
push eax
call fcn.00447b7e
push 0
mov eax, 0x5e60ba
push eax
call fcn.00447b7e
push 0
push 9
call fcn.004b2448
mov dword [0xf8161c], 1
push edx
call fcn.004cea40
pop edx
push eax
call fcn.0044d8e2
lea eax, [esp + 8]
push eax
call fcn.004ceac0
push 1
push dword [0xf814f0]
push dword [esp + 0xc]
call fcn.004cc720
mov ebx, eax
and ebx, ebx
jle 0x4199da
push dword [esp + 4]
push 0
call sub.USER32.dll_FindWindowW
push eax
call sub.USER32.dll_SetForegroundWindow
jmp 0x4199eb
push dword [esp + 4]
mov edx, 0x5e60ba
pop ecx
call fcn.0044f3d0
je 0x419993
call fcn.00448685
xor eax, eax
push dword [esp]
call fcn.004cebc0
push dword [esp + 4]
call fcn.004cebc0
add esp, 8
pop edi
pop ebx
pop ebp
ret 4