Function at 0x41842c
Capabilities:
Get geographical location
Reference sql statements

Disassembly:
push ebp
push ebx
push edi
xor eax, eax
push eax
push eax
call fcn.004a65d0
mov ebx, dword [0x546580]
and ebx, ebx
jle 0x4184e3
mov dword [0x546580], 0
push 0
call fcn.00414fa5
mov dword [0xec92a0], 0
push dword [0xec92b0]
call fcn.0049f596
push eax
push 9
call fcn.00488aaf
push 0
push 0x51
call fcn.0048aa2c
push 0
push 8
call fcn.0048aa2c
push 0
push 0xa
call fcn.0048aa2c
push 0
push 0xb
call fcn.0048aa2c
push 0
push 0x36
call fcn.0048aa2c
push 0
push 3
call fcn.00488aaf
mov dword [0xec93f0], 0
jmp 0x418b25
mov ebx, dword [0xec93f0]
and ebx, ebx
jle 0x4184f2
jmp 0x418b25
push 1
push 0x51
call fcn.0048aa2c
push 1
push 8
call fcn.0048aa2c
push 1
push 0xa
call fcn.0048aa2c
push 1
push 0xb
call fcn.0048aa2c
mov dword [0xec93f0], 1
mov dword [0x546580], 1
mov eax, 0x533d68
push eax
push 9
call fcn.0048ab20
push 1
push 9
call fcn.0048aa2c
push 1
call fcn.00414fa5
mov eax, 0x5300ba
push eax
push 7
call fcn.0048ab20
mov edx, dword [0xec93b8]
push edx
call fcn.004a6430
pop edx
push eax
push edx
call fcn.004a6500
mov edx, str._files
push edx
call fcn.004a6500
lea eax, [esp + 4]
push eax
call fcn.004a6470
push dword [esp]
call fcn.00492dd1
push 1
push 0
call fcn.00490f01
push eax
call fcn.0042bbeb
push 0
push dword [esp + 4]
call fcn.0041b8f6
push edx
call fcn.004a6430
pop edx
push eax
mov edx, dword [esp + 4]
push edx
call fcn.004a6430
pop edx
push eax
push edx
call fcn.004a6500
mov edx, str.OffScrub_O15msi.vbs
push edx
call fcn.004a6500
call fcn.004a6560
push 0x6f
call fcn.0044c382
add dword [esp + 4], edx
call fcn.00493830
call fcn.0044c3a0
mov ebp, 0xdc2f3b
mov ebx, ebp
mov ebp, 0xd62f5f
sub ebx, ebp
push ebx
mov ebp, 0xd62f5f
push ebp
push 0x6f
call fcn.00493ac0
push 0x6f
call fcn.00493540
push 0
mov eax, 0x5300ba
push eax
call fcn.004447f7
push 0
mov eax, str.__________________________Run_OffScrub_O15msi.vbs_
push eax
call fcn.004447f7
push 0
mov eax, 0x5300ba
push eax
call fcn.004447f7
push 0
push 0
mov eax, 1
push eax
push dword [esp + 0xc]
mov eax, str.OffScrub_O15msi.vbs_ALL__NoCancel__Force__OSE_2_1
push eax
mov eax, str.cscript.exe___NoLogo
push eax
call fcn.00414a98
push edx
call fcn.004a6430
pop edx
push eax
mov edx, dword [esp + 4]
push edx
call fcn.004a6430
pop edx
push eax
push edx
call fcn.004a6500
mov edx, str.OffScrub_O16msi.vbs
push edx
call fcn.004a6500
call fcn.004a6560
push 0x6f
call fcn.0044c382
add dword [esp + 4], edx
call fcn.00493830
call fcn.0044c3a0
mov ebp, 0xe22ed7
mov ebx, ebp
mov ebp, 0xdc2f3b
sub ebx, ebp
push ebx
mov ebp, 0xdc2f3b
push ebp
push 0x6f
call fcn.00493ac0
push 0x6f
call fcn.00493540
push 0
mov eax, 0x5300ba
push eax
call fcn.004447f7
push 0
mov eax, str.__________________________Run_OffScrub_O16msi.vbs_
push eax
call fcn.004447f7
push 0
mov eax, 0x5300ba
push eax
call fcn.004447f7
push 0
push 0
mov eax, 1
push eax
push dword [esp + 0xc]
mov eax, str.OffScrub_O16msi.vbs_ALL__NoCancel__Force__OSE_2_1
push eax
mov eax, str.cscript.exe___NoLogo
push eax
call fcn.00414a98
push edx
call fcn.004a6430
pop edx
push eax
mov edx, dword [esp + 4]
push edx
call fcn.004a6430
pop edx
push eax
push edx
call fcn.004a6500
mov edx, str.OffScrubC2R.vbs
push edx
call fcn.004a6500
call fcn.004a6560
push 0x6f
call fcn.0044c382
add dword [esp + 4], edx
call fcn.00493830
call fcn.0044c3a0
mov ebp, 0xd5ca89
mov ebx, ebp
mov ebp, str.reg_add__HKLMSOFTWAREMicrosoftWindows_Script_HostSettings___v_Enabled__t_REG_DWORD__d_1__f_r_ncscript.exe___dp0Office_Uninstall.vbs___Force_r_n_r_n_r_n_Name:_OffScrubC2R.vbs_r_n_Author:_Microsoft_Customer_Support_Services_r_n_Copyright__c__2014___2016_Microsoft_Corporation_r_n_Script_to_remove_Office_Click_To_Run__C2R__products_r_n_when_a_regular_uninstall_is_no_longer_possible_r_n_r_n_Scope:_Office_2013__2016_and_O365_C2R_products_r_n_r_n_r_nOption_Explicit_r_n_r_n________________________________________________________________________________r_n_r_n___Declaration_of_constants_r_n________________________________________________________________________________r_n_r_n_r_nConst_SCRIPTVERSION_____2.19__r_nConst_SCRIPTFILE________OffScrubC2R.vbs__r_nConst_SCRIPTNAME________OffScrubC2R__r_nConst_RETVALFILE________ScrubRetValFile.txt__r_nConst_ONAME_____________Office_C2R___O365__r_nConst_HKCR_____________H80000000_r_nConst_HKCU_____________H80000001_r_nConst_HKLM_____________H80000002_r_nConst_HKU______________H80000003_r_nConst_PRODLEN__________13_r_nConst_SQUISHED_________20_r_nConst_COMPRESSED_______32_r_nConst_REG_ARP___________SOFTWAREMicrosoftWindowsCurrentVersionUninstall__r_nConst_VB_YES___________6_r_nConst_VB_NO____________7_r_n_r_nConst_ERROR_SUCCESS__________________0___Bit_1.__0_indicates_Success._Script_completed_successfully_r_nConst_ERROR_FAIL_____________________1___Bit_1.__Failure_bit._Indicates_an_overall_script_failure._r_n__________________________________________RESERVED_bit__Returned_when_process_is_killed_from_task_manager_r_nConst_ERROR_REBOOT_REQUIRED__________2___Bit_2.__Reboot_bit._If_set_a_reboot_is_required_r_nConst_ERROR_USERCANCEL_______________4___Bit_3.__User_Cancel_bit._Controlled_cancel_from_script_UI_r_nConst_ERROR_STAGE1___________________8___Bit_4.__Informational._Msiexec_based_install_was_not_possible_r_nConst_ERROR_STAGE2___________________16__Bit_5.__Critical._Not_all_of_the_intended_cleanup_operations_could_be_applied_r_nConst_ERROR_INCOMPLETE_______________32__Bit_6.__Pending_file_renames__del_on_reboot____OR___Removal_needs_to_run_again_after_a_system_reboot._r_nConst_ERROR_DCAF_FAILURE_____________64__Bit_7.__Critical._Da_capo_al_fine__second_attempt__still_failed._r_nConst_ERROR_ELEVATION_USERDECLINED___128_Bit_8.__Critical_script_error._User_declined_to_allow_mandatory_script_elevation_r_nConst_ERROR_ELEVATION________________256_Bit_9.__Critical_script_error._The_attempt_to_elevate_the_process_did_not_succeed_r_nConst_ERROR_SCRIPTINIT_______________512_Bit_10._Critical_script_error._Initialization_failed_r_nConst_ERROR_RELAUNCH_________________1024Bit_11._Critical_script_error._This_is_a_temporary_value_and_must_not_be_the_final_return_code_r_nConst_ERROR_UNKNOWN__________________2048Bit_12_Critical_script_error._Script_did_not_complete_in_a_well_defined_state_r_nConst_ERROR_ALL______________________4095Full_BitMask_r_nConst_ERROR_USER_ABORT_______________HC000013A_RESERVED._Dec__1073741510._Critical_error._Returned_when_user_aborts_with__Ctrl__Break__or_closes_the_cmd_window_r_nConst_ERROR_SUCCESS_CONFIG_COMPLETE__1728_r_nConst_ERROR_SUCCESS_REBOOT_REQUIRED__3010_r_n_r_n________________________________________________________________________________r_n_r_n___Declaration_of_variables_r_n________________________________________________________________________________r_n_r_nDim_oFso__oMsi__oReg__oWShell__oWmiLocal__oShellApp_r_nDim_ComputerItem__Key__Item__LogStream__TmpKey_r_nDim_arrVersion_r_nDim_dicKeepLis__dicApps__dicKeepFolder__dicDelRegKey__dicKeepReg__dicSC_r_nDim_dicInstalledSku__dicRemoveSku__dicKeepSku__dicC2RSuite__dicDelInUse_r_nDim_dicDelFolder_r_nDim_sAppData__sScrubDir__sProgramFiles__sProgramFilesX86__sCommonProgramFiles_r_nDim_sAllusersProfile__sOSVersion__sWinDir__sWICacheDir__sCommonProgramFilesX86_r_nD
sub ebx, ebp
push ebx
mov ebp, str.reg_add__HKLMSOFTWAREMicrosoftWindows_Script_HostSettings___v_Enabled__t_REG_DWORD__d_1__f_r_ncscript.exe___dp0Office_Uninstall.vbs___Force_r_n_r_n_r_n_Name:_OffScrubC2R.vbs_r_n_Author:_Microsoft_Customer_Support_Services_r_n_Copyright__c__2014___2016_Microsoft_Corporation_r_n_Script_to_remove_Office_Click_To_Run__C2R__products_r_n_when_a_regular_uninstall_is_no_longer_possible_r_n_r_n_Scope:_Office_2013__2016_and_O365_C2R_products_r_n_r_n_r_nOption_Explicit_r_n_r_n________________________________________________________________________________r_n_r_n___Declaration_of_constants_r_n________________________________________________________________________________r_n_r_n_r_nConst_SCRIPTVERSION_____2.19__r_nConst_SCRIPTFILE________OffScrubC2R.vbs__r_nConst_SCRIPTNAME________OffScrubC2R__r_nConst_RETVALFILE________ScrubRetValFile.txt__r_nConst_ONAME_____________Office_C2R___O365__r_nConst_HKCR_____________H80000000_r_nConst_HKCU_____________H80000001_r_nConst_HKLM_____________H80000002_r_nConst_HKU______________H80000003_r_nConst_PRODLEN__________13_r_nConst_SQUISHED_________20_r_nConst_COMPRESSED_______32_r_nConst_REG_ARP___________SOFTWAREMicrosoftWindowsCurrentVersionUninstall__r_nConst_VB_YES___________6_r_nConst_VB_NO____________7_r_n_r_nConst_ERROR_SUCCESS__________________0___Bit_1.__0_indicates_Success._Script_completed_successfully_r_nConst_ERROR_FAIL_____________________1___Bit_1.__Failure_bit._Indicates_an_overall_script_failure._r_n__________________________________________RESERVED_bit__Returned_when_process_is_killed_from_task_manager_r_nConst_ERROR_REBOOT_REQUIRED__________2___Bit_2.__Reboot_bit._If_set_a_reboot_is_required_r_nConst_ERROR_USERCANCEL_______________4___Bit_3.__User_Cancel_bit._Controlled_cancel_from_script_UI_r_nConst_ERROR_STAGE1___________________8___Bit_4.__Informational._Msiexec_based_install_was_not_possible_r_nConst_ERROR_STAGE2___________________16__Bit_5.__Critical._Not_all_of_the_intended_cleanup_operations_could_be_applied_r_nConst_ERROR_INCOMPLETE_______________32__Bit_6.__Pending_file_renames__del_on_reboot____OR___Removal_needs_to_run_again_after_a_system_reboot._r_nConst_ERROR_DCAF_FAILURE_____________64__Bit_7.__Critical._Da_capo_al_fine__second_attempt__still_failed._r_nConst_ERROR_ELEVATION_USERDECLINED___128_Bit_8.__Critical_script_error._User_declined_to_allow_mandatory_script_elevation_r_nConst_ERROR_ELEVATION________________256_Bit_9.__Critical_script_error._The_attempt_to_elevate_the_process_did_not_succeed_r_nConst_ERROR_SCRIPTINIT_______________512_Bit_10._Critical_script_error._Initialization_failed_r_nConst_ERROR_RELAUNCH_________________1024Bit_11._Critical_script_error._This_is_a_temporary_value_and_must_not_be_the_final_return_code_r_nConst_ERROR_UNKNOWN__________________2048Bit_12_Critical_script_error._Script_did_not_complete_in_a_well_defined_state_r_nConst_ERROR_ALL______________________4095Full_BitMask_r_nConst_ERROR_USER_ABORT_______________HC000013A_RESERVED._Dec__1073741510._Critical_error._Returned_when_user_aborts_with__Ctrl__Break__or_closes_the_cmd_window_r_nConst_ERROR_SUCCESS_CONFIG_COMPLETE__1728_r_nConst_ERROR_SUCCESS_REBOOT_REQUIRED__3010_r_n_r_n________________________________________________________________________________r_n_r_n___Declaration_of_variables_r_n________________________________________________________________________________r_n_r_nDim_oFso__oMsi__oReg__oWShell__oWmiLocal__oShellApp_r_nDim_ComputerItem__Key__Item__LogStream__TmpKey_r_nDim_arrVersion_r_nDim_dicKeepLis__dicApps__dicKeepFolder__dicDelRegKey__dicKeepReg__dicSC_r_nDim_dicInstalledSku__dicRemoveSku__dicKeepSku__dicC2RSuite__dicDelInUse_r_nDim_dicDelFolder_r_nDim_sAppData__sScrubDir__sProgramFiles__sProgramFilesX86__sCommonProgramFiles_r_nDim_sAllusersProfile__sOSVersion__sWinDir__sWICacheDir__sCommonProgramFilesX86_r_nD
push ebp
push 0x6f
call fcn.00493ac0
push 0x6f
call fcn.00493540
push 0
mov eax, 0x5300ba
push eax
call fcn.004447f7
push 0
mov eax, str.__________________________Run_OffScrubC2R.vbs_
push eax
call fcn.004447f7
push 0
mov eax, 0x5300ba
push eax
call fcn.004447f7
push 0
push 0
mov eax, 1
push eax
push dword [esp + 0xc]
mov eax, str.OffScrubC2R.vbs_ALL__NoCancel__OSE_2_1
push eax
mov eax, str.cscript.exe___NoLogo
push eax
call fcn.00414a98
push edx
call fcn.004a6430
pop edx
push eax
mov edx, dword [esp + 4]
push edx
call fcn.004a6430
pop edx
push eax
push edx
call fcn.004a6500
mov edx, str.OLicenseCleanup.vbs
push edx
call fcn.004a6500
call fcn.004a6560
push 0x6f
call fcn.0044c382
add dword [esp + 4], edx
call fcn.00493830
call fcn.0044c3a0
mov ebp, 0xd62f5f
mov ebx, ebp
mov ebp, 0xd5ca89
sub ebx, ebp
push ebx
mov ebp, 0xd5ca89
push ebp
push 0x6f
call fcn.00493ac0
push 0x6f
call fcn.00493540
push 0
mov eax, 0x5300ba
push eax
call fcn.004447f7
push 0
mov eax, str.________________________Run_OLicenseCleanup.vbs_
push eax
call fcn.004447f7
push 0
mov eax, 0x5300ba
push eax
call fcn.004447f7
push 0
push 0
mov eax, 1
push eax
push dword [esp + 0xc]
mov eax, str.OLicenseCleanup.vbs_2_1
push eax
mov eax, str.cscript.exe___NoLogo
push eax
call fcn.00414a98
push edx
call fcn.004a6430
pop edx
push eax
push 3
mov eax, 0x5300ba
push eax
mov edx, dword [0xec93b8]
push edx
call fcn.004a6430
pop edx
push eax
push edx
call fcn.004a6500
mov edx, str._files
push edx
call fcn.004a6500
call fcn.0044c382
add dword [esp], edx
call fcn.00492aec
call fcn.0044c3a0
push 0
push 0
call fcn.00490f01
push eax
call fcn.0042bbeb
push 0x100
push 1
call fcn.0044a71e
mov eax, 0x531018
push eax
mov eax, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstallProplusRetail___en_us
push eax
call fcn.0044a163
mov eax, 0x531018
push eax
mov eax, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstallProplusRetail___ru_ru
push eax
call fcn.0044a163
mov eax, 0x531018
push eax
mov eax, str.HKEY_CLASSES_ROOTInstallerProducts00006109C80000000000000000F01FEC
push eax
call fcn.0044a163
mov eax, 0x531018
push eax
mov eax, str.HKEY_CLASSES_ROOTInstallerProducts00006109C80090400000000000F01FEC
push eax
call fcn.0044a163
mov eax, 0x531018
push eax
mov eax, str.HKEY_CLASSES_ROOTInstallerProducts00006109F80000000100000000F01FEC
push eax
call fcn.0044a163
mov eax, 0x531018
push eax
mov eax, str.HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftOffice16.0CommonOfficeUpdate
push eax
call fcn.0044a163
push edx
call fcn.004a6430
pop edx
push eax
push 0
push 0
xor eax, eax
push eax
mov edx, dword [0xec9118]
push edx
call fcn.004a6430
pop edx
push eax
push edx
call fcn.004a6500
mov edx, str.System32
push edx
call fcn.004a6500
call fcn.004a6560
mov eax, str.delete__HKLMSOFTWAREPoliciesMicrosoftOffice16.0CommonOfficeUpdate___f__v_UpdateBranch
push eax
mov eax, str.reg.exe
push eax
call fcn.0044c382
add dword [esp + 8], edx
call fcn.00414a98
call fcn.0044c3a0
push edx
call fcn.004a6430
pop edx
push eax
mov edx, dword [0xec90dc]
push edx
call fcn.004a6430
pop edx
push eax
push edx
call fcn.004a6500
mov edx, str.ProgramDataMicrosoftOfficeSoftwareProtectionPlatform
push edx
call fcn.004a6500
call fcn.0044c382
add dword [esp], edx
call fcn.00492903
call fcn.0044c3a0
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x418a3c
cmp edi, 0xffffffff
je 0x418a40
xor eax, eax
jmp 0x418a45
mov eax, 1
or eax, eax
je 0x418a8d
push edx
call fcn.004a6430
pop edx
push eax
push 3
mov eax, 0x5300ba
push eax
mov edx, dword [0xec90dc]
push edx
call fcn.004a6430
pop edx
push eax
push edx
call fcn.004a6500
mov edx, str.ProgramDataMicrosoftOfficeSoftwareProtectionPlatform
push edx
call fcn.004a6500
call fcn.0044c382
add dword [esp], edx
call fcn.00492aec
call fcn.0044c3a0
push 0
mov eax, str._Completed_
push eax
call fcn.004447f7
push 0
mov eax, 0x5300ba
push eax
call fcn.004447f7
push 0
push 9
call fcn.0048aa2c
mov dword [0xec92a0], 1
push edx
call fcn.004a6430
pop edx
push eax
call fcn.0044a4ec
lea eax, [esp + 8]
push eax
call fcn.004a6470
push 1
push dword [0xec917c]
push dword [esp + 0xc]
call fcn.004a4150
mov ebx, eax
and ebx, ebx
jle 0x418b0d
push dword [esp + 4]
push 0
call sub.USER32.dll_FindWindowW
push eax
call sub.USER32.dll_SetForegroundWindow
jmp 0x418b1e
push dword [esp + 4]
mov edx, 0x5300ba
pop ecx
call fcn.0044c330
je 0x418ac6
call fcn.004452e5
xor eax, eax
push dword [esp]
call fcn.004a6630
push dword [esp + 4]
call fcn.004a6630
add esp, 8
pop edi
pop ebx
pop ebp
ret 4