Function at 0x40b01c
Capabilities:
Delete file

Disassembly:
push ebp
sub esp, 0x800
lea ebp, [esp - 4]
mov eax, dword [0x46aff0]
xor eax, ebp
mov dword [ebp + 0x800], eax
push 0x14
mov eax, 0x44b0ab
call fcn.00434843
mov dword [ebp - 0x18], ecx
mov esi, 0x46caa0
mov ecx, esi
call fcn.00403407
mov edi, dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push eax
call edi
mov ecx, dword [ebp - 0x18]
push eax
call fcn.0040adb1
test eax, eax
je 0x40b0be
push 0x44ea68
mov ecx, esi
call fcn.00403407
push eax
call fcn.00435593
push eax
mov dword [ebp - 0x14], eax
call fcn.00435451
add esp, 0xc
mov ecx, esi
call fcn.00403407
push eax
call edi
push str.SOMAuthNormal::CheckOfficeException_..
mov ebx, 0x44e95c
push ebx
mov edi, 0x46e8a8
push edi
mov dword [ebp - 0x10], eax
call fcn.00401ae2
add esp, 0xc
cmp dword [ebp - 0x14], 0
jne 0x40b0e3
push str.SOMAuthNormal::CheckOfficeException_File_Pointer_is_NULL__
push ebx
push edi
call fcn.00401ae2
add esp, 0xc
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x800]
xor ecx, ebp
call fcn.00434834
add ebp, 0x804
leave
ret
xor eax, eax
push 0x7fe
push eax
mov word [ebp], ax
lea eax, [ebp + 2]
push eax
call fcn.00434950
add esp, 0xc
push 0x400
lea eax, [ebp]
push eax
mov ecx, esi
call fcn.00403407
push eax
call fcn.00410fb0
add esp, 0xc
mov ecx, esi
mov dword [ebp - 0x14], eax
call fcn.00403407
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor esi, esi
cmp dword [ebp - 0x14], esi
jne 0x40b133
push str.SOMAuthNormal::CheckOfficeException_FindExecutable_Error__
jmp 0x40b0b4
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp]
push eax
mov dword [ebp - 0x1c], esi
call fcn.004107b0
pop ecx
pop ecx
test eax, eax
jne 0x40b153
push str.SOMAuthNormal::CheckOfficeException_GetFileMajorVersion_Error__
jmp 0x40b0b4
push dword [ebp - 0x1c]
lea eax, [ebp]
push eax
push str.CheckOfficeException_File__s__Version__d_
push ebx
push edi
call fcn.00401ae2
mov eax, dword [ebp - 0x1c]
add esp, 0x14
cmp eax, 0xe
jne 0x40b1cc
push str.SOMWT001
lea eax, [ebp - 0x10]
mov esi, 0x46ee00
push eax
mov ecx, esi
call fcn.00412790
mov edi, eax
and dword [ebp - 4], 0
push str.SOMER052
lea eax, [ebp - 0x14]
push eax
mov ecx, esi
call fcn.00412790
push 0x10
push dword [edi]
push dword [eax]
mov eax, dword [ebp - 0x18]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.004026da
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004026da
xor eax, eax
inc eax
jmp 0x40b0c0
cmp eax, 0xf
jne 0x40b221
push str.SOMWT001
lea eax, [ebp - 0x14]
mov esi, 0x46ee00
push eax
mov ecx, esi
call fcn.00412790
mov edi, eax
push str.SOMER063
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
mov dword [ebp - 4], 1
call fcn.00412790
push 0x10
push dword [edi]
push dword [eax]
mov eax, dword [ebp - 0x18]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004026da
mov ecx, dword [ebp - 0x14]
jmp 0x40b1bc
cmp eax, 0xc
jne 0x40b323
cmp dword [0x46ca20], 2
jne 0x40b2f0
lea eax, [ebp - 0x14]
push eax
push 0x20019
push esi
push str.SOFTWAREMicrosoftOfficeWordAddInsMSO07EHW.Connect
mov dword [ebp - 0x14], esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
je 0x40b2d5
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftOfficeWordAddIns_MSO07EHW.Connect
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
je 0x40b2d5
push dword [ebp - 0x14]
push str._RegOpenKeyEx__MSO07EHW.Connect___x_
push ebx
push edi
call fcn.00401ae2
add esp, 0x10
push 0xe
mov ecx, 0x46e5a0
call fcn.0040967d
cmp eax, 1
push str.SOMWT001
lea eax, [ebp - 0x10]
mov ecx, 0x46ee00
push eax
jne 0x40b2b6
call fcn.00412790
push 0x10
push dword [eax]
push str.This_Version_of_Document_Security_Agent_doesnt_support_Office_2007.
jmp 0x40b2c4
call fcn.00412790
push 0x10
push dword [eax]
push str.This_document_doesnt_support_the_version_of_Office_2007.
mov eax, dword [ebp - 0x18]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x40b1b9
push dword [ebp - 0x14]
push str._RegOpenKeyEx_in___x_
push 0x44f1c8
push edi
call fcn.00403d65
add esp, 0x10
jmp 0x40b0be
push 0xe
mov ecx, 0x46e5a0
call fcn.0040967d
test eax, eax
jne 0x40b0be
push str._RegOpenKeyEx_Not_DS_ACL_OFFICEX_0
push ebx
push edi
call fcn.00401ae2
add esp, 0xc
push str.SOMWT001
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x46ee00
jmp 0x40b2b6
cmp eax, 0xb
jne 0x40b0be
mov edi, 0x46e5a0
push 0xe
mov ecx, edi
call fcn.0040967d
test eax, eax
je 0x40b0be
push str..csv
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x40b0be
push 0xd
mov ecx, edi
call fcn.0040967d
test eax, eax
jne 0x40b0be
push str.SOMWT001
mov ecx, 0x46ee00
cmp dword [0x46ca1c], esi
jne 0x40b392
lea eax, [ebp - 0x10]
push eax
call fcn.00412790
push 0x10
push dword [eax]
push 0x452c40
jmp 0x40b2c4
lea eax, [ebp - 0x20]
push eax
call fcn.00412790
push 0x10
push dword [eax]
mov eax, dword [ebp - 0x18]
push str.This_document_can_be_accessed_with_Office_2007.
push dword [eax + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 0x20]
jmp 0x40b1bc