Function at 0x41939a
Capabilities:
Get geographical location
Reference sql statements

Disassembly:
push ebp
push ebx
push edi
xor eax, eax
push eax
push eax
call fcn.004ceb50
mov ebx, dword [0x5fd3f8]
and ebx, ebx
jle 0x419458
mov dword [0x5fd3f8], 0
push 0
call fcn.00415e3b
mov dword [0xf815ec], 0
push dword [0xf815fc]
call fcn.004c78ad
cdq
push edx
push eax
push 9
call fcn.004b031c
push 0
push 0x51
call fcn.004b2448
push 0
push 8
call fcn.004b2448
push 0
push 0xa
call fcn.004b2448
push 0
push 0xb
call fcn.004b2448
push 0
push 0x36
call fcn.004b2448
push 0
push 0
push 3
call fcn.004b031c
mov dword [0xf81740], 0
jmp 0x419a9a
mov ebx, dword [0xf81740]
and ebx, ebx
jle 0x419467
jmp 0x419a9a
push 1
push 0x51
call fcn.004b2448
push 1
push 8
call fcn.004b2448
push 1
push 0xa
call fcn.004b2448
push 1
push 0xb
call fcn.004b2448
mov dword [0xf81740], 1
mov dword [0x5fd3f8], 1
mov eax, 0x5ea0b6
push eax
push 9
call fcn.004b253c
push 1
push 9
call fcn.004b2448
push 1
call fcn.00415e3b
mov eax, 0x5e60ba
push eax
push 7
call fcn.004b253c
mov edx, dword [0xf81708]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, str._files
push edx
call fcn.004cea70
lea eax, [esp + 4]
push eax
call fcn.004ceac0
push dword [esp]
call fcn.004bacd8
push 1
push 0
call fcn.004b8b03
push eax
call fcn.0042d28e
push 0
push dword [esp + 4]
call fcn.0041c9db
push edx
call fcn.004cea40
pop edx
push eax
mov edx, dword [esp + 4]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, str.OffScrub_O15msi.vbs
push edx
call fcn.004cea70
call fcn.004ceb30
push 0x6f
call fcn.0044f422
add dword [esp + 4], edx
call fcn.004bb760
call fcn.0044f440
mov ebp, 0xe79db3
mov ebx, ebp
mov ebp, 0xe19dd7
sub ebx, ebp
push ebx
mov ebp, 0xe19dd7
push ebp
push 0x6f
call fcn.004bba00
push 0x6f
call fcn.004bb470
push 0
mov eax, 0x5e60ba
push eax
call fcn.00447a41
push 0
mov eax, str.__________________________Run_OffScrub_O15msi.vbs_
push eax
call fcn.00447a41
push 0
mov eax, 0x5e60ba
push eax
call fcn.00447a41
push 0
push 0
mov eax, 1
push eax
push dword [esp + 0xc]
mov eax, 0x5eaa54
push eax
mov eax, str.cscript.exe___NoLogo
push eax
call fcn.0041592e
push edx
call fcn.004cea40
pop edx
push eax
mov edx, dword [esp + 4]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, str.OffScrub_O16msi.vbs
push edx
call fcn.004cea70
call fcn.004ceb30
push 0x6f
call fcn.0044f422
add dword [esp + 4], edx
call fcn.004bb760
call fcn.0044f440
mov ebp, 0xed9d4f
mov ebx, ebp
mov ebp, 0xe79db3
sub ebx, ebp
push ebx
mov ebp, 0xe79db3
push ebp
push 0x6f
call fcn.004bba00
push 0x6f
call fcn.004bb470
push 0
mov eax, 0x5e60ba
push eax
call fcn.00447a41
push 0
mov eax, str.__________________________Run_OffScrub_O16msi.vbs_
push eax
call fcn.00447a41
push 0
mov eax, 0x5e60ba
push eax
call fcn.00447a41
push 0
push 0
mov eax, 1
push eax
push dword [esp + 0xc]
mov eax, str.OffScrub_O16msi.vbs_ALL__NoCancel__Force__OSE_2_1
push eax
mov eax, str.cscript.exe___NoLogo
push eax
call fcn.0041592e
push edx
call fcn.004cea40
pop edx
push eax
mov edx, dword [esp + 4]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, str.OffScrubC2R.vbs
push edx
call fcn.004cea70
call fcn.004ceb30
push 0x6f
call fcn.0044f422
add dword [esp + 4], edx
call fcn.004bb760
call fcn.0044f440
mov ebp, 0xe13901
mov ebx, ebp
mov ebp, str.reg_add__HKLMSOFTWAREMicrosoftWindows_Script_HostSettings___v_Enabled__t_REG_DWORD__d_1__f_r_ncscript.exe___dp0Office_Uninstall.vbs___Force_r_n_r_n_r_n_Name:_OffScrubC2R.vbs_r_n_Author:_Microsoft_Customer_Support_Services_r_n_Copyright__c__2014___2016_Microsoft_Corporation_r_n_Script_to_remove_Office_Click_To_Run__C2R__products_r_n_when_a_regular_uninstall_is_no_longer_possible_r_n_r_n_Scope:_Office_2013__2016_and_O365_C2R_products_r_n_r_n_r_nOption_Explicit_r_n_r_n________________________________________________________________________________r_n_r_n___Declaration_of_constants_r_n________________________________________________________________________________r_n_r_n_r_nConst_SCRIPTVERSION_____2.19__r_nConst_SCRIPTFILE________OffScrubC2R.vbs__r_nConst_SCRIPTNAME________OffScrubC2R__r_nConst_RETVALFILE________ScrubRetValFile.txt__r_nConst_ONAME_____________Office_C2R___O365__r_nConst_HKCR_____________H80000000_r_nConst_HKCU_____________H80000001_r_nConst_HKLM_____________H80000002_r_nConst_HKU______________H80000003_r_nConst_PRODLEN__________13_r_nConst_SQUISHED_________20_r_nConst_COMPRESSED_______32_r_nConst_REG_ARP___________SOFTWAREMicrosoftWindowsCurrentVersionUninstall__r_nConst_VB_YES___________6_r_nConst_VB_NO____________7_r_n_r_nConst_ERROR_SUCCESS__________________0___Bit_1.__0_indicates_Success._Script_completed_successfully_r_nConst_ERROR_FAIL_____________________1___Bit_1.__Failure_bit._Indicates_an_overall_script_failure._r_n__________________________________________RESERVED_bit__Returned_when_process_is_killed_from_task_manager_r_nConst_ERROR_REBOOT_REQUIRED__________2___Bit_2.__Reboot_bit._If_set_a_reboot_is_required_r_nConst_ERROR_USERCANCEL_______________4___Bit_3.__User_Cancel_bit._Controlled_cancel_from_script_UI_r_nConst_ERROR_STAGE1___________________8___Bit_4.__Informational._Msiexec_based_install_was_not_possible_r_nConst_ERROR_STAGE2___________________16__Bit_5.__Critical._Not_all_of_the_intended_cleanup_operations_could_be_applied_r_nConst_ERROR_INCOMPLETE_______________32__Bit_6.__Pending_file_renames__del_on_reboot____OR___Removal_needs_to_run_again_after_a_system_reboot._r_nConst_ERROR_DCAF_FAILURE_____________64__Bit_7.__Critical._Da_capo_al_fine__second_attempt__still_failed._r_nConst_ERROR_ELEVATION_USERDECLINED___128_Bit_8.__Critical_script_error._User_declined_to_allow_mandatory_script_elevation_r_nConst_ERROR_ELEVATION________________256_Bit_9.__Critical_script_error._The_attempt_to_elevate_the_process_did_not_succeed_r_nConst_ERROR_SCRIPTINIT_______________512_Bit_10._Critical_script_error._Initialization_failed_r_nConst_ERROR_RELAUNCH_________________1024Bit_11._Critical_script_error._This_is_a_temporary_value_and_must_not_be_the_final_return_code_r_nConst_ERROR_UNKNOWN__________________2048Bit_12_Critical_script_error._Script_did_not_complete_in_a_well_defined_state_r_nConst_ERROR_ALL______________________4095Full_BitMask_r_nConst_ERROR_USER_ABORT_______________HC000013A_RESERVED._Dec__1073741510._Critical_error._Returned_when_user_aborts_with__Ctrl__Break__or_closes_the_cmd_window_r_nConst_ERROR_SUCCESS_CONFIG_COMPLETE__1728_r_nConst_ERROR_SUCCESS_REBOOT_REQUIRED__3010_r_n_r_n________________________________________________________________________________r_n_r_n___Declaration_of_variables_r_n________________________________________________________________________________r_n_r_nDim_oFso__oMsi__oReg__oWShell__oWmiLocal__oShellApp_r_nDim_ComputerItem__Key__Item__LogStream__TmpKey_r_nDim_arrVersion_r_nDim_dicKeepLis__dicApps__dicKeepFolder__dicDelRegKey__dicKeepReg__dicSC_r_nDim_dicInstalledSku__dicRemoveSku__dicKeepSku__dicC2RSuite__dicDelInUse_r_nDim_dicDelFolder_r_nDim_sAppData__sScrubDir__sProgramFiles__sProgramFilesX86__sCommonProgramFiles_r_nDim_sAllusersProfile__sOSVersion__sWinDir__sWICacheDir__sCommonProgramFilesX86_r_nD
sub ebx, ebp
push ebx
mov ebp, str.reg_add__HKLMSOFTWAREMicrosoftWindows_Script_HostSettings___v_Enabled__t_REG_DWORD__d_1__f_r_ncscript.exe___dp0Office_Uninstall.vbs___Force_r_n_r_n_r_n_Name:_OffScrubC2R.vbs_r_n_Author:_Microsoft_Customer_Support_Services_r_n_Copyright__c__2014___2016_Microsoft_Corporation_r_n_Script_to_remove_Office_Click_To_Run__C2R__products_r_n_when_a_regular_uninstall_is_no_longer_possible_r_n_r_n_Scope:_Office_2013__2016_and_O365_C2R_products_r_n_r_n_r_nOption_Explicit_r_n_r_n________________________________________________________________________________r_n_r_n___Declaration_of_constants_r_n________________________________________________________________________________r_n_r_n_r_nConst_SCRIPTVERSION_____2.19__r_nConst_SCRIPTFILE________OffScrubC2R.vbs__r_nConst_SCRIPTNAME________OffScrubC2R__r_nConst_RETVALFILE________ScrubRetValFile.txt__r_nConst_ONAME_____________Office_C2R___O365__r_nConst_HKCR_____________H80000000_r_nConst_HKCU_____________H80000001_r_nConst_HKLM_____________H80000002_r_nConst_HKU______________H80000003_r_nConst_PRODLEN__________13_r_nConst_SQUISHED_________20_r_nConst_COMPRESSED_______32_r_nConst_REG_ARP___________SOFTWAREMicrosoftWindowsCurrentVersionUninstall__r_nConst_VB_YES___________6_r_nConst_VB_NO____________7_r_n_r_nConst_ERROR_SUCCESS__________________0___Bit_1.__0_indicates_Success._Script_completed_successfully_r_nConst_ERROR_FAIL_____________________1___Bit_1.__Failure_bit._Indicates_an_overall_script_failure._r_n__________________________________________RESERVED_bit__Returned_when_process_is_killed_from_task_manager_r_nConst_ERROR_REBOOT_REQUIRED__________2___Bit_2.__Reboot_bit._If_set_a_reboot_is_required_r_nConst_ERROR_USERCANCEL_______________4___Bit_3.__User_Cancel_bit._Controlled_cancel_from_script_UI_r_nConst_ERROR_STAGE1___________________8___Bit_4.__Informational._Msiexec_based_install_was_not_possible_r_nConst_ERROR_STAGE2___________________16__Bit_5.__Critical._Not_all_of_the_intended_cleanup_operations_could_be_applied_r_nConst_ERROR_INCOMPLETE_______________32__Bit_6.__Pending_file_renames__del_on_reboot____OR___Removal_needs_to_run_again_after_a_system_reboot._r_nConst_ERROR_DCAF_FAILURE_____________64__Bit_7.__Critical._Da_capo_al_fine__second_attempt__still_failed._r_nConst_ERROR_ELEVATION_USERDECLINED___128_Bit_8.__Critical_script_error._User_declined_to_allow_mandatory_script_elevation_r_nConst_ERROR_ELEVATION________________256_Bit_9.__Critical_script_error._The_attempt_to_elevate_the_process_did_not_succeed_r_nConst_ERROR_SCRIPTINIT_______________512_Bit_10._Critical_script_error._Initialization_failed_r_nConst_ERROR_RELAUNCH_________________1024Bit_11._Critical_script_error._This_is_a_temporary_value_and_must_not_be_the_final_return_code_r_nConst_ERROR_UNKNOWN__________________2048Bit_12_Critical_script_error._Script_did_not_complete_in_a_well_defined_state_r_nConst_ERROR_ALL______________________4095Full_BitMask_r_nConst_ERROR_USER_ABORT_______________HC000013A_RESERVED._Dec__1073741510._Critical_error._Returned_when_user_aborts_with__Ctrl__Break__or_closes_the_cmd_window_r_nConst_ERROR_SUCCESS_CONFIG_COMPLETE__1728_r_nConst_ERROR_SUCCESS_REBOOT_REQUIRED__3010_r_n_r_n________________________________________________________________________________r_n_r_n___Declaration_of_variables_r_n________________________________________________________________________________r_n_r_nDim_oFso__oMsi__oReg__oWShell__oWmiLocal__oShellApp_r_nDim_ComputerItem__Key__Item__LogStream__TmpKey_r_nDim_arrVersion_r_nDim_dicKeepLis__dicApps__dicKeepFolder__dicDelRegKey__dicKeepReg__dicSC_r_nDim_dicInstalledSku__dicRemoveSku__dicKeepSku__dicC2RSuite__dicDelInUse_r_nDim_dicDelFolder_r_nDim_sAppData__sScrubDir__sProgramFiles__sProgramFilesX86__sCommonProgramFiles_r_nDim_sAllusersProfile__sOSVersion__sWinDir__sWICacheDir__sCommonProgramFilesX86_r_nD
push ebp
push 0x6f
call fcn.004bba00
push 0x6f
call fcn.004bb470
push 0
mov eax, 0x5e60ba
push eax
call fcn.00447a41
push 0
mov eax, str.__________________________Run_OffScrubC2R.vbs_
push eax
call fcn.00447a41
push 0
mov eax, 0x5e60ba
push eax
call fcn.00447a41
push 0
push 0
mov eax, 1
push eax
push dword [esp + 0xc]
mov eax, str.OffScrubC2R.vbs_ALL__NoCancel__OSE_2_1
push eax
mov eax, str.cscript.exe___NoLogo
push eax
call fcn.0041592e
push edx
call fcn.004cea40
pop edx
push eax
mov edx, dword [esp + 4]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, str.OLicenseCleanup.vbs
push edx
call fcn.004cea70
call fcn.004ceb30
push 0x6f
call fcn.0044f422
add dword [esp + 4], edx
call fcn.004bb760
call fcn.0044f440
mov ebp, 0xe19dd7
mov ebx, ebp
mov ebp, 0xe13901
sub ebx, ebp
push ebx
mov ebp, 0xe13901
push ebp
push 0x6f
call fcn.004bba00
push 0x6f
call fcn.004bb470
push 0
mov eax, 0x5e60ba
push eax
call fcn.00447a41
push 0
mov eax, str.________________________Run_OLicenseCleanup.vbs_
push eax
call fcn.00447a41
push 0
mov eax, 0x5e60ba
push eax
call fcn.00447a41
push 0
push 0
mov eax, 1
push eax
push dword [esp + 0xc]
mov eax, str.OLicenseCleanup.vbs_2_1
push eax
mov eax, str.cscript.exe___NoLogo
push eax
call fcn.0041592e
push edx
call fcn.004cea40
pop edx
push eax
push 3
mov eax, 0x5e60ba
push eax
mov edx, dword [0xf81708]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, str._files
push edx
call fcn.004cea70
call fcn.0044f422
add dword [esp], edx
call fcn.004ba98a
call fcn.0044f440
push 0
push 0
call fcn.004b8b03
push eax
call fcn.0042d28e
push 0x100
push 1
call fcn.0044d9d7
mov eax, 0x5e70f0
push eax
mov eax, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstallProplusRetail___en_us
push eax
call fcn.0044d41c
mov eax, 0x5e70f0
push eax
mov eax, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstallProplusRetail___ru_ru
push eax
call fcn.0044d41c
mov eax, 0x5e70f0
push eax
mov eax, str.HKEY_CLASSES_ROOTInstallerProducts00006109C80000000000000000F01FEC
push eax
call fcn.0044d41c
mov eax, 0x5e70f0
push eax
mov eax, str.HKEY_CLASSES_ROOTInstallerProducts00006109C80090400000000000F01FEC
push eax
call fcn.0044d41c
mov eax, 0x5e70f0
push eax
mov eax, str.HKEY_CLASSES_ROOTInstallerProducts00006109F80000000100000000F01FEC
push eax
call fcn.0044d41c
mov eax, 0x5e70f0
push eax
mov eax, str.HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftOffice16.0CommonOfficeUpdate
push eax
call fcn.0044d41c
push edx
call fcn.004cea40
pop edx
push eax
push 0
push 0
xor eax, eax
push eax
mov edx, dword [0xf8145c]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, str.System32
push edx
call fcn.004cea70
call fcn.004ceb30
mov eax, str.delete__HKLMSOFTWAREPoliciesMicrosoftOffice16.0CommonOfficeUpdate___f__v_UpdateBranch
push eax
mov eax, str.reg.exe
push eax
call fcn.0044f422
add dword [esp + 8], edx
call fcn.0041592e
call fcn.0044f440
push edx
call fcn.004cea40
pop edx
push eax
mov edx, dword [0xf81420]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, str.ProgramDataMicrosoftOfficeSoftwareProtectionPlatform
push edx
call fcn.004cea70
call fcn.0044f422
add dword [esp], edx
call fcn.004ba779
call fcn.0044f440
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x4199b1
cmp edi, 0xffffffff
je 0x4199b5
xor eax, eax
jmp 0x4199ba
mov eax, 1
or eax, eax
je 0x419a02
push edx
call fcn.004cea40
pop edx
push eax
push 3
mov eax, 0x5e60ba
push eax
mov edx, dword [0xf81420]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, str.ProgramDataMicrosoftOfficeSoftwareProtectionPlatform
push edx
call fcn.004cea70
call fcn.0044f422
add dword [esp], edx
call fcn.004ba98a
call fcn.0044f440
push 0
mov eax, str._Completed_
push eax
call fcn.00447a41
push 0
mov eax, 0x5e60ba
push eax
call fcn.00447a41
push 0
push 9
call fcn.004b2448
mov dword [0xf815ec], 1
push edx
call fcn.004cea40
pop edx
push eax
call fcn.0044d7a5
lea eax, [esp + 8]
push eax
call fcn.004ceac0
push 1
push dword [0xf814c0]
push dword [esp + 0xc]
call fcn.004cc720
mov ebx, eax
and ebx, ebx
jle 0x419a82
push dword [esp + 4]
push 0
call sub.USER32.dll_FindWindowW
push eax
call sub.USER32.dll_SetForegroundWindow
jmp 0x419a93
push dword [esp + 4]
mov edx, 0x5e60ba
pop ecx
call fcn.0044f3d0
je 0x419a3b
call fcn.00448548
xor eax, eax
push dword [esp]
call fcn.004cebc0
push dword [esp + 4]
call fcn.004cebc0
add esp, 8
pop edi
pop ebx
pop ebp
ret 4