Function at 0x12daa3c0
Capabilities:
Accept command line arguments

Disassembly:
push 0xffffffffffffffff
push 0x13057458
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x264
mov eax, dword [0x13199068]
push ebx
push ebp
push esi
push edi
xor ebp, ebp
mov edi, ecx
cmp eax, ebp
mov dword [esp + 0x3c], edi
je 0x12daa404
push str.CCurrentFileMgr::CheckOfficeReg
push str.CurrentFileMgr
push 1
call fcn.12dad750
add esp, 0xc
call fcn.12d92e30
test eax, eax
jne 0x12daa427
call fcn.12d92e00
test eax, eax
jne 0x12daa427
push ebp
call fcn.12d91b20
add esp, 4
test eax, eax
je 0x12dab058
mov ecx, edi
call fcn.12daa300
cmp eax, ebp
je 0x12dab058
push 0x13198dc0
lea ecx, [esp + 0x14]
call fcn.12f41640
push 0x13198dc0
lea ecx, [esp + 0x1c]
mov dword [esp + 0x280], ebp
call fcn.12f41640
push 0x13198dc0
lea ecx, [esp + 0x18]
mov byte [esp + 0x280], 1
call fcn.12f41640
push 0x13198dc0
lea ecx, [esp + 0x28]
mov byte [esp + 0x280], 2
call fcn.12f41640
push 0x13198dc0
lea ecx, [esp + 0x5c]
mov byte [esp + 0x280], 3
call fcn.12f41640
push 0x13198dc0
lea ecx, [esp + 0x2c]
mov byte [esp + 0x280], 4
call fcn.12f41640
push 0x13198dc0
lea ecx, [esp + 0x24]
mov byte [esp + 0x280], 5
call fcn.12f41640
push 0x13198dc0
lea ecx, [esp + 0x20]
mov byte [esp + 0x280], 6
call fcn.12f41640
mov esi, dword [0x13196dcc]
mov byte [esp + 0x27c], 7
cmp esi, ebp
je 0x12daab59
push str.winword.exe
push esi
call fcn.12f5e2a4
add esp, 8
test eax, eax
jne 0x12daa54c
push str.TSafeWord_Addin
lea ecx, [esp + 0x20]
call fcn.12f421d0
lea eax, [esp + 0x20]
lea ecx, [esp + 0x10]
push eax
push ecx
push ecx
mov ecx, esp
mov dword [esp + 0x40], esp
push str.TSafeWordAddin.Addin
call fcn.12f41640
push ecx
mov byte [esp + 0x28c], 8
mov ecx, esp
mov dword [esp + 0x50], esp
push str.Word
call fcn.12f41640
jmp 0x12daa64f
push str.excel.exe
push esi
call fcn.12f5e2a4
add esp, 8
test eax, eax
jne 0x12daa5a5
push str.TSafeExcel_Addin
lea ecx, [esp + 0x20]
call fcn.12f421d0
lea eax, [esp + 0x20]
lea ecx, [esp + 0x10]
push eax
push ecx
push ecx
mov ecx, esp
mov dword [esp + 0x40], esp
push str.TSafeExcelAddin.Addin
call fcn.12f41640
push ecx
mov byte [esp + 0x28c], 0xa
mov ecx, esp
mov dword [esp + 0x50], esp
push str.Excel
call fcn.12f41640
jmp 0x12daa64f
push str.powerpnt.exe
push esi
call fcn.12f5e2a4
add esp, 8
test eax, eax
jne 0x12daa5fb
push str.TSafePPT_Addin
lea ecx, [esp + 0x20]
call fcn.12f421d0
lea eax, [esp + 0x20]
lea ecx, [esp + 0x10]
push eax
push ecx
push ecx
mov ecx, esp
mov dword [esp + 0x40], esp
push str.TSafePPTAddin.Addin
call fcn.12f41640
push ecx
mov byte [esp + 0x28c], 0xc
mov ecx, esp
mov dword [esp + 0x50], esp
push str.PowerPoint
call fcn.12f41640
jmp 0x12daa64f
push str.visio.exe
push esi
call fcn.12f5e2a4
add esp, 8
test eax, eax
jne 0x12daa672
push str.TSafeVisio_Addin
lea ecx, [esp + 0x20]
call fcn.12f421d0
lea eax, [esp + 0x20]
lea ecx, [esp + 0x10]
push eax
push ecx
push ecx
mov ecx, esp
mov dword [esp + 0x40], esp
push str.TSafeVisioAddin.Addin
call fcn.12f41640
push ecx
mov byte [esp + 0x28c], 0xe
mov ecx, esp
mov dword [esp + 0x50], esp
push str.Visio
call fcn.12f41640
lea edx, [esp + 0x38]
lea eax, [esp + 0x34]
push edx
lea ecx, [esp + 0x28]
push eax
lea edx, [esp + 0x30]
push ecx
push edx
mov ecx, edi
mov byte [esp + 0x29c], 7
call fcn.12dab480
cmp dword [0x13199068], ebp
je 0x12daa7a5
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x34]
push eax
call fcn.12f469f0
mov esi, eax
mov ecx, dword [esp + 0x10]
mov byte [esp + 0x27c], 0x10
push ecx
lea ecx, [esp + 0x44]
call fcn.12f469f0
mov edi, eax
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0x2c]
push edx
mov byte [esp + 0x280], 0x11
call fcn.12f469f0
mov ebp, eax
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x64]
push eax
mov byte [esp + 0x280], 0x12
call fcn.12f469f0
mov ebx, eax
mov ecx, dword [esp + 0x14]
mov byte [esp + 0x27c], 0x13
push ecx
lea ecx, [esp + 0x60]
call fcn.12f469f0
mov dword [esp + 0x60], eax
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x68]
push edx
mov byte [esp + 0x280], 0x14
call fcn.12f469f0
mov ecx, dword [esi]
mov edx, dword [edi]
push ecx
mov ecx, dword [ebp]
mov eax, dword [eax]
push edx
mov edx, dword [ebx]
push ecx
mov ecx, dword [esp + 0x6c]
push edx
mov byte [esp + 0x28c], 0x15
mov edx, dword [ecx]
push edx
push eax
push str.CCurrentFileMgr::CheckOfficeReg_strSecurity__s__strStarupItems__s__strDisabledItems__s__strDllName__s__strRegItem__s__strClickToRunRegItem__s_
push str.CurrentFileMgr
push 1
call fcn.12dad750
add esp, 0x24
lea ecx, [esp + 0x68]
mov byte [esp + 0x27c], 0x14
call fcn.12f472f0
lea ecx, [esp + 0x5c]
mov byte [esp + 0x27c], 0x13
call fcn.12f472f0
lea ecx, [esp + 0x64]
mov byte [esp + 0x27c], 0x12
call fcn.12f472f0
lea ecx, [esp + 0x2c]
mov byte [esp + 0x27c], 0x11
call fcn.12f472f0
lea ecx, [esp + 0x40]
mov byte [esp + 0x27c], 0x10
call fcn.12f472f0
lea ecx, [esp + 0x34]
mov byte [esp + 0x27c], 7
call fcn.12f472f0
mov edi, dword [esp + 0x3c]
xor ebp, ebp
mov ecx, dword [esp + 0x10]
cmp dword [ecx - 8], ebp
je 0x12daab59
lea ecx, [esp + 0x2c]
call fcn.12f56d80
mov byte [esp + 0x27c], 0x16
mov dword [esp + 0x34], reloc.WS2_32.dll_accept
mov dword [esp + 0x38], reloc.OLEAUT32.dll_SysReAllocString
lea edi, [esp + 0x34]
mov ebx, 2
mov edx, dword [esp + 0x10]
mov esi, dword [edi]
push 0x2001f
push edx
push esi
lea ecx, [esp + 0x38]
call fcn.12f56ef0
test eax, eax
je 0x12daa80c
push ebp
push str.LoadBehavior
lea ecx, [esp + 0x34]
call fcn.12f57090
cmp eax, 3
je 0x12daa869
jmp 0x12daa859
mov eax, dword [esp + 0x10]
push 0x2001f
push eax
push esi
lea ecx, [esp + 0x38]
call fcn.12f56f60
test eax, eax
je 0x12daa872
mov ecx, dword [esp + 0x1c]
push ecx
push str.FriendlyName
lea ecx, [esp + 0x34]
call fcn.12f581d0
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x2c]
push edx
push str.Description
call fcn.12f581d0
push ebp
push str.CommandLineSafe
lea ecx, [esp + 0x34]
call fcn.12f58020
push 3
push str.LoadBehavior
lea ecx, [esp + 0x34]
call fcn.12f58020
lea ecx, [esp + 0x2c]
call fcn.12f56f40
add edi, 4
dec ebx
jne 0x12daa7dc
mov eax, dword [esp + 0x18]
push 0x2001f
push eax
push reloc.WS2_32.dll_accept
lea ecx, [esp + 0x38]
call fcn.12f56ef0
test eax, eax
je 0x12daa907
push ebp
push str.RequireAddinSig
lea ecx, [esp + 0x34]
call fcn.12f57090
test eax, eax
je 0x12daa8ba
push ebp
push str.RequireAddinSig
lea ecx, [esp + 0x34]
call fcn.12f58020
push ebp
push str.DisableAllAddins
lea ecx, [esp + 0x34]
call fcn.12f57090
test eax, eax
je 0x12daa8dc
push ebp
push str.DisableAllAddins
lea ecx, [esp + 0x34]
call fcn.12f58020
push ebp
push str.NoTBPromptUnsignedAddin
lea ecx, [esp + 0x34]
call fcn.12f57090
cmp eax, ebp
je 0x12daa8fe
push ebp
push str.NoTBPromptUnsignedAddin
lea ecx, [esp + 0x34]
call fcn.12f58020
lea ecx, [esp + 0x2c]
call fcn.12f56f40
mov ecx, dword [esp + 0x24]
push 0x2001f
push ecx
push reloc.WS2_32.dll_accept
lea ecx, [esp + 0x38]
call fcn.12f56ef0
test eax, eax
je 0x12daa99e
lea ecx, [esp + 0x48]
call fcn.12f4bf90
push 0xffffffffffffffff
push ebp
lea ecx, [esp + 0x50]
mov byte [esp + 0x284], 0x17
call fcn.12f4c000
lea edx, [esp + 0x48]
lea ecx, [esp + 0x2c]
push edx
call fcn.12f58e90
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x6e]
mov word [esp + 0x6c], bp
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0x28]
push 0x208
lea ecx, [esp + 0x70]
push eax
lea edx, [esp + 0x50]
push ecx
mov ecx, dword [esp + 0x48]
lea eax, [esp + 0x38]
push edx
push eax
call fcn.12dab7a0
lea ecx, [esp + 0x2c]
call fcn.12f56f40
lea ecx, [esp + 0x48]
mov byte [esp + 0x27c], 0x16
call fcn.12f4bfa0
mov ecx, dword [esp + 0x14]
push 0x2001f
push ecx
push reloc.WS2_32.dll_accept
lea ecx, [esp + 0x38]
call fcn.12f56ef0
test eax, eax
je 0x12daaaec
lea ecx, [esp + 0x48]
call fcn.12f4bf90
push 0xffffffffffffffff
push ebp
lea ecx, [esp + 0x50]
mov byte [esp + 0x284], 0x18
call fcn.12f4c000
lea edx, [esp + 0x48]
lea ecx, [esp + 0x2c]
push edx
call fcn.12f58e90
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x6e]
mov word [esp + 0x6c], bp
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0x28]
push 0x208
lea ecx, [esp + 0x70]
push eax
lea edx, [esp + 0x50]
push ecx
mov ecx, dword [esp + 0x48]
lea eax, [esp + 0x38]
push edx
push eax
call fcn.12dab7a0
cmp eax, 1
jne 0x12daaad2
mov ecx, dword [esp + 0x6e]
mov dx, word [esp + 0x72]
mov word [esp + 0x40], bp
mov dword [esp + 0x42], ebp
mov dword [esp + 0x40], ecx
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x6c]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x4c]
xor esi, esi
cmp eax, ebp
mov word [esp + 0x44], dx
jle 0x12daaad2
mov eax, dword [esp + 0x48]
lea ecx, [esp + 0x6c]
push 0x208
push ecx
mov eax, dword [eax + esi*4]
lea ecx, [esp + 0x34]
push eax
call fcn.12f571d0
cmp eax, ebp
je 0x12daaaaa
mov edx, 3
lea ecx, [esp + 0x6e]
lea eax, [esp + 0x40]
mov di, word [eax]
cmp di, word [ecx]
jne 0x12daaa99
add eax, 2
add ecx, 2
dec edx
je 0x12daaab5
jmp 0x12daaa86
mov dx, word [eax]
cmp dx, word [ecx]
sbb eax, eax
and al, 0xfe
inc eax
mov dword [esp + 0x34], eax
je 0x12daaab5
mov eax, dword [esp + 0x4c]
inc esi
cmp esi, eax
jge 0x12daaad2
jmp 0x12daaa5a
mov ecx, dword [esp + 0x48]
mov eax, dword [ecx + esi*4]
lea ecx, [esp + 0x2c]
push eax
call fcn.12f591f0
push 1
push esi
lea ecx, [esp + 0x50]
call fcn.12f4cb60
lea ecx, [esp + 0x2c]
call fcn.12f56f40
lea ecx, [esp + 0x48]
mov byte [esp + 0x27c], 0x16
call fcn.12f4bfa0
mov esi, 0x2001f
call fcn.12f9c520
test eax, eax
je 0x12daaaff
mov esi, 0x2011f
mov edx, dword [esp + 0x20]
push esi
push edx
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x38]
call fcn.12f56ef0
test eax, eax
je 0x12daab44
push ebp
push str.LoadBehavior
lea ecx, [esp + 0x34]
call fcn.12f57090
cmp eax, 3
je 0x12daab3b
push 3
push str.LoadBehavior
lea ecx, [esp + 0x34]
call fcn.12f58020
lea ecx, [esp + 0x2c]
call fcn.12f56f40
lea ecx, [esp + 0x2c]
mov byte [esp + 0x27c], 7
call fcn.12f56e70
mov edi, dword [esp + 0x3c]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x27c], 6
call fcn.12f41f70
lea ecx, [esp + 0x20]
mov byte [esp + 0x27c], 5
call fcn.12f41f70
lea ecx, [esp + 0x28]
mov byte [esp + 0x27c], 4
call fcn.12f41f70
lea ecx, [esp + 0x58]
mov byte [esp + 0x27c], 3
call fcn.12f41f70
lea ecx, [esp + 0x24]
mov byte [esp + 0x27c], 2
call fcn.12f41f70
lea ecx, [esp + 0x14]
mov byte [esp + 0x27c], 1
call fcn.12f41f70
lea ecx, [esp + 0x18]
mov byte [esp + 0x27c], 0
call fcn.12f41f70
lea ecx, [esp + 0x10]
mov dword [esp + 0x27c], 0xffffffff
call fcn.12f41f70
cmp dword [0x13198dbc], ebp
jne 0x12daabfd
mov ecx, edi
mov dword [0x13198dbc], 1
call fcn.12dab1d0
push 0x13198dc0
lea ecx, [esp + 0x2c]
call fcn.12f41640
push 0x13198dc0
lea ecx, [esp + 0x14]
mov dword [esp + 0x280], 0x19
call fcn.12f41640
push 0x13198dc0
lea ecx, [esp + 0x20]
mov byte [esp + 0x280], 0x1a
call fcn.12f41640
push 0x13198dc0
lea ecx, [esp + 0x24]
mov byte [esp + 0x280], 0x1b
call fcn.12f41640
push 0x13198dc0
lea ecx, [esp + 0x28]
mov byte [esp + 0x280], 0x1c
call fcn.12f41640
push 0x13198dc0
lea ecx, [esp + 0x18]
mov byte [esp + 0x280], 0x1d
call fcn.12f41640
push 0x13198dc0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x280], 0x1e
call fcn.12f41640
mov esi, dword [0x13196dcc]
mov bl, 0x1f
cmp esi, ebp
mov byte [esp + 0x27c], bl
je 0x12daafde
mov ebp, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
call ebp
push str.et.exe
push esi
mov edi, eax
call fcn.12f5e2a4
add esp, 8
test eax, eax
je 0x12daae65
test edi, edi
je 0x12daacee
call fcn.12d92e30
test eax, eax
je 0x12daacee
push str.__et_
call ebp
push eax
call fcn.12f513e0
add esp, 8
test eax, eax
jne 0x12daae65
push str.wpp.exe
push esi
call fcn.12f5e2a4
add esp, 8
test eax, eax
je 0x12daadd2
test edi, edi
je 0x12daad29
call fcn.12d92e30
test eax, eax
je 0x12daad29
push str.__wpp_
call ebp
push eax
call fcn.12f513e0
add esp, 8
test eax, eax
jne 0x12daadd2
push 0x130c68f0
push esi
call fcn.12f5e2a4
add esp, 8
test eax, eax
jne 0x12daaefa
push str.SoftwarekingsoftOfficeWPSAddinsCL
lea ecx, [esp + 0x2c]
call fcn.12f421d0
push str.TSafeWordAddin.Addin
lea ecx, [esp + 0x14]
call fcn.12f421d0
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push 0x130cc1fc
call fcn.12f41640
mov esi, dword [esp + 0x40]
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x18]
push eax
lea edx, [esp + 0x2c]
push ecx
lea eax, [esp + 0x2c]
push edx
lea ecx, [esp + 0x2c]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x294], bl
call fcn.12dac290
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push str.Word
call fcn.12f41640
lea edx, [esp + 0x14]
lea eax, [esp + 0x1c]
push edx
lea ecx, [esp + 0x1c]
push eax
lea edx, [esp + 0x30]
push ecx
lea eax, [esp + 0x30]
push edx
lea ecx, [esp + 0x30]
push eax
mov byte [esp + 0x294], bl
push ecx
jmp 0x12daaef3
push str.SoftwarekingsoftOfficeWPPAddinsCL
lea ecx, [esp + 0x2c]
call fcn.12f421d0
push str.TSafePPTAddin.Addin
lea ecx, [esp + 0x14]
call fcn.12f421d0
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push 0x130cc1d0
call fcn.12f41640
mov esi, dword [esp + 0x40]
lea edx, [esp + 0x1c]
lea eax, [esp + 0x18]
push edx
lea ecx, [esp + 0x2c]
push eax
lea edx, [esp + 0x2c]
push ecx
lea eax, [esp + 0x2c]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x294], bl
call fcn.12dac290
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push str.PowerPoint
call fcn.12f41640
lea ecx, [esp + 0x14]
lea edx, [esp + 0x1c]
push ecx
lea eax, [esp + 0x1c]
push edx
lea ecx, [esp + 0x30]
push eax
lea edx, [esp + 0x30]
push ecx
lea eax, [esp + 0x30]
push edx
mov byte [esp + 0x294], bl
push eax
jmp 0x12daaef3
push str.SoftwarekingsoftOfficeETAddinsCL
lea ecx, [esp + 0x2c]
call fcn.12f421d0
push str.TSafeExcelAddin.Addin
lea ecx, [esp + 0x14]
call fcn.12f421d0
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push 0x130cc1a4
call fcn.12f41640
mov esi, dword [esp + 0x40]
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x18]
push ecx
lea eax, [esp + 0x2c]
push edx
lea ecx, [esp + 0x2c]
push eax
lea edx, [esp + 0x2c]
push ecx
push edx
mov ecx, esi
mov byte [esp + 0x294], bl
call fcn.12dac290
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push str.Excel
call fcn.12f41640
lea eax, [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
lea edx, [esp + 0x1c]
push ecx
lea eax, [esp + 0x30]
push edx
lea ecx, [esp + 0x30]
push eax
lea edx, [esp + 0x30]
push ecx
mov byte [esp + 0x294], bl
push edx
mov ecx, esi
call fcn.12dab890
mov eax, dword [esp + 0x28]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x12daafde
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx - 8]
test eax, eax
je 0x12daafde
lea ecx, [esp + 0x34]
call fcn.12f56d80
mov edx, dword [esp + 0x28]
push 0x2001f
push edx
push reloc.WS2_32.dll_accept
lea ecx, [esp + 0x40]
mov byte [esp + 0x288], 0x26
call fcn.12f56ef0
test eax, eax
je 0x12daafce
lea ecx, [esp + 0x48]
call fcn.12f4bf90
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0x50]
mov byte [esp + 0x284], 0x27
call fcn.12f4c000
lea eax, [esp + 0x48]
lea ecx, [esp + 0x34]
push eax
call fcn.12f58e90
mov eax, dword [esp + 0x4c]
xor esi, esi
test eax, eax
jle 0x12daafb4
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x10]
mov eax, dword [ecx + esi*4]
push eax
push edx
call fcn.12f5de16
add esp, 8
test eax, eax
je 0x12daafa3
mov eax, dword [esp + 0x4c]
inc esi
cmp esi, eax
jl 0x12daaf7f
jmp 0x12daafb4
mov eax, dword [esp + 0x48]
lea ecx, [esp + 0x34]
mov esi, dword [eax + esi*4]
push esi
call fcn.12f591f0
lea ecx, [esp + 0x34]
call fcn.12f56f40
lea ecx, [esp + 0x48]
mov byte [esp + 0x27c], 0x26
call fcn.12f4bfa0
lea ecx, [esp + 0x34]
mov byte [esp + 0x27c], bl
call fcn.12f56e70
lea ecx, [esp + 0x18]
mov byte [esp + 0x27c], 0x1e
call fcn.12f41f70
lea ecx, [esp + 0x14]
mov byte [esp + 0x27c], 0x1d
call fcn.12f41f70
lea ecx, [esp + 0x24]
mov byte [esp + 0x27c], 0x1c
call fcn.12f41f70
lea ecx, [esp + 0x20]
mov byte [esp + 0x27c], 0x1b
call fcn.12f41f70
lea ecx, [esp + 0x1c]
mov byte [esp + 0x27c], 0x1a
call fcn.12f41f70
lea ecx, [esp + 0x10]
mov byte [esp + 0x27c], 0x19
call fcn.12f41f70
lea ecx, [esp + 0x28]
mov dword [esp + 0x27c], 0xffffffff
call fcn.12f41f70
mov ecx, dword [esp + 0x274]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x270
ret