Function at 0x10001700
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x10020007
push eax
mov eax, 0x4824
mov dword fs:[0], esp
call fcn.10018670
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x4848]
cmp edi, 0x80
jne 0x10001768
mov eax, dword [esp + 0x485c]
mov ecx, dword [esp + 0x4858]
mov edx, dword [esp + 0x4854]
push eax
mov eax, dword [esp + 0x4854]
push ecx
mov ecx, dword [esp + 0x4854]
push edx
mov edx, dword [esp + 0x4850]
push eax
push ecx
push edi
push edx
jmp 0x10003967
mov ebp, dword [esp + 0x4844]
test ebp, ebp
jne 0x100017a2
mov eax, dword [esp + 0x485c]
mov ecx, dword [esp + 0x4858]
mov edx, dword [esp + 0x4854]
push eax
mov eax, dword [esp + 0x4854]
push ecx
mov ecx, dword [esp + 0x4854]
push edx
push eax
push ecx
push edi
push ebp
jmp 0x10003967
push 0x5c
push ebp
call fcn.100182c0
add esp, 8
test eax, eax
jne 0x100017de
mov edx, dword [esp + 0x485c]
mov eax, dword [esp + 0x4858]
mov ecx, dword [esp + 0x4854]
push edx
mov edx, dword [esp + 0x4854]
push eax
mov eax, dword [esp + 0x4854]
push ecx
push edx
push eax
jmp 0x10003965
push ebp
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x1000393d
cmp byte [eax + ebp - 1], 0x3a
jne 0x10001821
mov eax, dword [esp + 0x485c]
mov ecx, dword [esp + 0x4858]
mov edx, dword [esp + 0x4854]
push eax
mov eax, dword [esp + 0x4854]
push ecx
mov ecx, dword [esp + 0x4854]
push edx
push eax
push ecx
jmp 0x10003965
cmp byte [ebp], 0x5c
jne 0x10001876
cmp byte [ebp + 1], 0x5c
jne 0x10001876
push str.PIPE_
push ebp
call fcn.10018230
add esp, 8
test eax, eax
je 0x1000186c
mov edx, dword [esp + 0x485c]
mov eax, dword [esp + 0x4858]
mov ecx, dword [esp + 0x4854]
push edx
mov edx, dword [esp + 0x4854]
push eax
mov eax, dword [esp + 0x4854]
push ecx
push edx
push eax
jmp 0x10003965
cmp byte [ebp + 2], 0x2e
je 0x1000393d
push str.TemplatesNormal.dot
push ebp
call fcn.10011350
add esp, 8
test eax, eax
je 0x100018b5
mov eax, dword [esp + 0x485c]
mov ecx, dword [esp + 0x4858]
mov edx, dword [esp + 0x4854]
push eax
mov eax, dword [esp + 0x4854]
push ecx
mov ecx, dword [esp + 0x4854]
push edx
push eax
push ecx
jmp 0x10003965
push ebp
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionA]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov esi, eax
push str..exe
push esi
mov dword [esp + 0x18], esi
call ebx
test eax, eax
je 0x1000393d
push str..dll
push esi
call ebx
test eax, eax
je 0x1000393d
push str..lnk
push esi
call ebx
test eax, eax
je 0x1000393d
push str..dic
push esi
call ebx
test eax, eax
je 0x1000393d
push str..hhd
push esi
call ebx
test eax, eax
je 0x1000393d
push str..ocx
push esi
call ebx
test eax, eax
je 0x1000393d
push str..exd
push esi
call ebx
test eax, eax
je 0x1000393d
push str..lex
push esi
call ebx
test eax, eax
je 0x1000393d
push ebp
call fcn.1000ba80
add esp, 4
cmp eax, 1
jne 0x10001983
mov edx, dword [esp + 0x485c]
mov eax, dword [esp + 0x4858]
mov ecx, dword [esp + 0x4854]
push edx
mov edx, dword [esp + 0x4854]
push eax
mov eax, dword [esp + 0x4854]
push ecx
push edx
push eax
jmp 0x10003965
mov eax, dword [esp + 0x4854]
cmp eax, 1
je 0x10001998
cmp eax, 2
jne 0x10001bdd
push esi
push str..xar
call ebx
test eax, eax
jne 0x10001bdd
push 0x1008
call fcn.1001821f
mov ecx, dword [esp + 0x4860]
mov edx, dword [esp + 0x485c]
add esp, 4
mov dword [esp + 0x10], eax
push ecx
mov ecx, dword [esp + 0x4858]
push edx
mov edx, dword [esp + 0x4858]
push ecx
mov ecx, dword [esp + 0x4858]
push edx
mov edx, dword [esp + 0x4858]
push ecx
push edx
push ebp
push 0x10034eac
mov ecx, eax
call fcn.1000c0d0
mov edi, eax
cmp edi, 0xffffffff
mov dword [esp + 0x1c], edi
jne 0x10001a15
mov eax, dword [esp + 0x10]
push eax
call fcn.10014af4
add esp, 4
or eax, edi
jmp 0x1000396d
mov eax, dword [0x10031404]
mov ecx, dword [0x10031408]
sub ecx, eax
mov esi, eax
sar ecx, 2
cmp ecx, 1
jae 0x10001b1e
mov edx, dword [0x10031400]
test edx, edx
je 0x10001a4f
mov ecx, eax
sub ecx, edx
sar ecx, 2
cmp ecx, 1
jbe 0x10001a4f
mov ecx, eax
sub ecx, edx
sar ecx, 2
jmp 0x10001a54
mov ecx, 1
test edx, edx
jne 0x10001a5c
xor eax, eax
jmp 0x10001a61
sub eax, edx
sar eax, 2
add eax, ecx
test eax, eax
mov dword [esp + 0x14], eax
jge 0x10001a6d
xor eax, eax
lea edx, [eax*4]
push edx
call fcn.1001821f
mov edi, dword [0x10031400]
add esp, 4
mov ebx, eax
cmp edi, esi
mov ebp, ebx
je 0x10001a9f
push edi
push ebp
call fcn.10008e80
add edi, 4
add esp, 8
add ebp, 4
cmp edi, esi
jne 0x10001a8b
lea eax, [esp + 0x10]
mov ecx, 0x100313fc
push eax
push 1
push ebp
call fcn.10008e00
mov ecx, dword [0x10031404]
add ebp, 4
push ebp
push ecx
push esi
mov ecx, 0x100313fc
call fcn.10008e50
mov edx, dword [0x10031404]
mov eax, dword [0x10031400]
push edx
push eax
mov ecx, 0x100313fc
call fcn.10008df0
mov ecx, dword [0x10031400]
push ecx
call fcn.10014af4
mov edx, dword [esp + 0x18]
add esp, 4
mov ecx, 0x100313fc
lea eax, [ebx + edx*4]
mov dword [0x10031408], eax
call fcn.10008e30
mov edi, dword [esp + 0x1c]
lea ecx, [ebx + eax*4 + 4]
mov dword [0x10031404], ecx
mov dword [0x10031400], ebx
mov eax, edi
jmp 0x1000396d
mov edx, eax
sub edx, esi
sar edx, 2
cmp edx, 1
jae 0x10001b88
lea ecx, [esi + 4]
push ecx
push eax
push esi
mov ecx, 0x100313fc
call fcn.10008e50
mov eax, dword [0x10031404]
lea edx, [esp + 0x10]
mov ecx, eax
push edx
sub ecx, esi
mov edx, 1
sar ecx, 2
sub edx, ecx
mov ecx, 0x100313fc
push edx
push eax
call fcn.10008e00
mov eax, dword [0x10031404]
cmp esi, eax
je 0x10001bc9
mov ecx, dword [esp + 0x10]
mov dword [esi], ecx
add esi, 4
cmp esi, eax
jne 0x10001b67
mov eax, dword [0x10031404]
add eax, 4
mov dword [0x10031404], eax
mov eax, edi
jmp 0x1000396d
push eax
push eax
add eax, 0xfffffffc
mov ecx, 0x100313fc
push eax
call fcn.10008e50
mov eax, dword [0x10031404]
mov ecx, eax
add eax, 0xfffffffc
cmp esi, eax
je 0x10001bb5
mov edx, dword [eax - 4]
sub eax, 4
sub ecx, 4
cmp eax, esi
mov dword [ecx], edx
jne 0x10001ba6
lea eax, [esi + 4]
cmp esi, eax
je 0x10001bc9
mov ecx, dword [esp + 0x10]
mov dword [esi], ecx
add esi, 4
cmp esi, eax
jne 0x10001bbc
mov eax, dword [0x10031404]
add eax, 4
mov dword [0x10031404], eax
mov eax, edi
jmp 0x1000396d
mov ecx, 0x3ff
xor eax, eax
lea edi, [esp + 0x3835]
mov byte [esp + 0x3834], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [esp + 0x3834]
push 0
push edx
stosb byte es:[edi], al
call fcn.10011400
mov dword [esp + 0x1c], eax
mov ecx, 0x3ff
xor eax, eax
lea edi, [esp + 0x183d]
mov byte [esp + 0x183c], 0
push ebp
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.10010e10
add esp, 0xc
test eax, eax
jne 0x10001c44
push ebp
call fcn.10010e80
add esp, 4
test eax, eax
je 0x10002554
push ebp
call fcn.1000bc30
mov edi, 1
add esp, 4
cmp eax, edi
jne 0x10001d3d
push str.Offline_
push ebp
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x10001d3d
push ebp
push str.OnCreateFileA:_OFFLINE_FOLDER__s_
push 0x10027760
call fcn.1000b440
add esp, 0xc
push ebp
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
cmp eax, edi
jne 0x10001d08
mov ecx, 0x3ff
xor eax, eax
lea edi, [esp + 0x435]
mov byte [esp + 0x434], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x434]
push eax
call fcn.1000cca0
mov ecx, 0x3ff
xor eax, eax
lea edi, [esp + 0x2839]
mov byte [esp + 0x2838], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x2838]
push 0
push ecx
stosb byte es:[edi], al
call fcn.10011400
add esp, 0xc
lea edx, [esp + 0x434]
lea eax, [esp + 0x2834]
push 0x10034eac
push edx
push eax
push str.OnCreateFileA:___s___s___s_
push 0x10027760
call fcn.1000b440
add esp, 0x14
mov ecx, dword [esp + 0x485c]
mov edx, dword [esp + 0x4858]
mov eax, dword [esp + 0x4854]
push ecx
mov ecx, dword [esp + 0x4854]
push edx
mov edx, dword [esp + 0x4854]
push eax
mov eax, dword [esp + 0x4854]
push ecx
push edx
push eax
jmp 0x10003966
mov eax, dword [0x10033e2c]
push ebp
test eax, eax
jne 0x10001d9e
call fcn.1000caa0
add esp, 4
cmp eax, edi
jne 0x10002554
push str.OnCreateFileA:_DO_NOT_SUPPORT_VERSION...__
push str.DSCOXLSX
call fcn.1000b440
mov ecx, dword [esp + 0x4864]
mov edx, dword [esp + 0x4860]
mov eax, dword [esp + 0x485c]
add esp, 8
push ecx
mov ecx, dword [esp + 0x4854]
push edx
mov edx, dword [esp + 0x4854]
push eax
mov eax, dword [esp + 0x4854]
push ecx
push edx
push eax
jmp 0x10003966
call fcn.1000caa0
add esp, 4
cmp eax, edi
mov dword [esp + 0x18], eax
jne 0x10001ddf
push 0x10030b80
push esi
call ebx
test eax, eax
jne 0x10001ddf
test dword [esp + 0x4848], 0x80000000
je 0x10001ddf
cmp dword [esp + 0x4854], 3
jne 0x10001ddf
mov dword [0x10034e94], edi
or eax, 0xffffffff
jmp 0x1000396d
cmp dword [0x10031444], edi
jne 0x10002007
xor esi, esi
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov edx, eax
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x35]
mov byte [esp + 0x34], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
test edx, edx
stosb byte es:[edi], al
jne 0x10001e16
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edx, eax
lea ecx, [esp + 0x34]
push 0x400
push ecx
push edx
call dword [sym.imp.USER32.dll_GetClassNameA]
lea edx, [esp + 0x34]
push str.bosa_sdm_Microsoft_Office_Word_12.0
push edx
call ebx
test eax, eax
je 0x10001e47
lea eax, [esp + 0x34]
push str.NUIDialog
push eax
call ebx
test eax, eax
jne 0x10001e4c
mov esi, 1
mov edi, dword [esp + 0x10]
push str..docx
push edi
call ebx
test eax, eax
je 0x10001e6c
push str..doc
push edi
call ebx
test eax, eax
jne 0x10001f74
push ebp
call fcn.1000bc30
add esp, 4
test eax, eax
jne 0x10001f74
cmp esi, 1
jne 0x10001ee2
push ebp
call fcn.100103c0
add esp, 4
cmp eax, esi
jne 0x10001ed3
call fcn.10010f70
cmp eax, esi
jne 0x10001ea8
push 0
call fcn.10010fa0
add esp, 4
mov dword [0x10034e9c], esi
push ebp
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
cmp eax, esi
mov dword [0x10034e9c], 0
jne 0x10001ec3
mov dword [0x10034e98], esi
push 3
push 0
push 0
call fcn.100112d0
add esp, 0xc
jmp 0x10001f03
mov dword [0x10034e9c], 0
jmp 0x10001f79
call fcn.10010f70
cmp eax, 1
je 0x10001ef5
cmp dword [0x10034e9c], 1
jne 0x10001f74
push ebp
call fcn.100103c0
add esp, 4
cmp eax, 1
jne 0x10001f74
call dword [sym.imp.DSCOPipe.dll_Ordinal_1]
test eax, eax
je 0x10001f37
lea ecx, [esp + 0x1834]
push ecx
mov ecx, eax
call dword [sym.imp.DSCOPipe.dll_public:_void___thiscall_CSDSCOPipe::GetLastOpenedDocumentFile_char__]
lea edx, [esp + 0x1834]
push edx
push str.OnCreateFileA_:_GetLastOpenedDocumentFile___s_
push 0x10027760
call fcn.1000b440
add esp, 0xc
mov eax, dword [esp + 0x485c]
mov ecx, dword [esp + 0x4858]
mov edx, dword [esp + 0x4854]
push eax
mov eax, dword [esp + 0x4854]
push ecx
mov ecx, dword [esp + 0x4854]
push edx
mov edx, dword [esp + 0x4854]
push eax
push ecx
lea eax, [esp + 0x1848]
push edx
push eax
jmp 0x10003967
mov esi, 1
push str..tmp
push edi
call ebx
test eax, eax
jne 0x10001fbe
push ebp
call fcn.1000bb70
add esp, 4
test eax, eax
jne 0x10001fbe
push ebp
call fcn.100103c0
add esp, 4
cmp eax, esi
jne 0x10001fbe
call fcn.10010f70
cmp eax, esi
jne 0x10001fbe
push 5
mov dword [0x10034e9c], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
or eax, 0xffffffff
jmp 0x1000396d
call fcn.10010f70
cmp eax, esi
jne 0x1000200c
push 0
push ebp
call fcn.10011220
add esp, 8
cmp eax, esi
jne 0x1000200c
push ebp
call fcn.10010e10
add esp, 4
cmp eax, esi
je 0x10001fef
push str..tmp
push edi
call ebx
test eax, eax
jne 0x1000200c
push 0
call fcn.10010fa0
add esp, 4
mov dword [0x10034e9c], esi
or eax, 0xffffffff
jmp 0x1000396d
mov esi, 1
cmp dword [0x10031448], esi
jne 0x10002040
push ebp
push 0x10034eac
call fcn.10010f70
push eax
push str.OnCreateFileA:_SAVEAS_CONTROL__d___s___s_
push 0x10027760
call fcn.1000b440
push ebp
call fcn.10011210
add esp, 0x18
cmp eax, esi
je 0x1000271e
cmp dword [0x10031454], esi
jne 0x10002062
mov eax, dword [esp + 0x18]
test eax, eax
je 0x10002062
mov ecx, 0x10033e40
call fcn.10013c90
test eax, eax
jne 0x1000271e
cmp dword [esp + 0x18], 3
jne 0x1000208c
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
and ecx, esi
cmp cl, 1
jne 0x10002083
and al, 0xfe
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push ebp
call fcn.1000a7d0
add esp, 4
push ebp
call fcn.10010e10
mov ebx, dword [sym.imp.KERNEL32.dll_GetLongPathNameA]
add esp, 4
cmp eax, 1
jne 0x1000216c
mov edx, dword [esp + 0x10]
push edx
push str..tmp
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1000216c
mov eax, dword [0x10034e9c]
test eax, eax
jne 0x1000216c
call dword [sym.imp.DSCOPipe.dll_Ordinal_1]
mov esi, eax
test esi, esi
je 0x1000216c
mov ecx, 0x3ff
xor eax, eax
lea edi, [esp + 0x435]
mov byte [esp + 0x434], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x434]
push 0x1000
push eax
push ebp
mov dword [esp + 0x28], 0
call ebx
test eax, eax
jne 0x1000213c
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x434]
push ecx
push edx
push 0x1000
push ebp
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
jne 0x1000213c
lea eax, [esp + 0x434]
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x434]
push ecx
push ebp
push edx
push str.OnCreateFileA_:_SetLastOpenedDocumentFile___s___s___s_
push 0x10027760
call fcn.1000b440
add esp, 0x14
lea eax, [esp + 0x434]
mov ecx, esi
push eax
call dword [sym.imp.DSCOPipe.dll_public:_void___thiscall_CSDSCOPipe::SetLastOpenedDocumentFile_char__]
mov eax, dword [esp + 0x18]
cmp eax, 4
ja case.default.0x10002179
jmp dword [eax*4 + 0x10003988]
push ebp
call fcn.10010e10
add esp, 4
test eax, eax
je 0x10002554
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov edx, eax
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x35]
mov byte [esp + 0x34], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
test edx, edx
stosb byte es:[edi], al
jne 0x100021ba
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edx, eax
lea ecx, [esp + 0x34]
push 0x400
push ecx
push edx
call dword [sym.imp.USER32.dll_GetClassNameA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea edx, [esp + 0x34]
push str.bosa_sdm_Microsoft_Office_Word_12.0
push edx
call esi
test eax, eax
je 0x100022f1
lea eax, [esp + 0x34]
push str.NUIDialog
push eax
call esi
test eax, eax
je 0x100022f1
cmp dword [esp + 0x14], 1
jne 0x1000223f
call fcn.10010f70
cmp eax, 1
jne 0x1000223f
mov ecx, dword [esp + 0x485c]
mov edx, dword [esp + 0x4858]
mov eax, dword [esp + 0x4854]
push ecx
mov ecx, dword [esp + 0x4854]
push edx
mov edx, dword [esp + 0x4854]
push eax
mov eax, dword [esp + 0x4854]
push ecx
push edx
push eax
jmp 0x10003966
call dword [sym.imp.DSIpcAg.dll_class_IDSIpcAg____cdecl_SCAPI_GetIDSIpcAgent_void_]
mov esi, eax
test esi, esi
je 0x10002554
mov ecx, 0x3ff
xor eax, eax
lea edi, [esp + 0x435]
mov byte [esp + 0x434], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x434]
push 0x1000
push ecx
push ebp
stosb byte es:[edi], al
call ebx
test eax, eax
jne 0x1000228d
lea edx, [esp + 0x434]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x434]
push eax
call fcn.1000bc30
add esp, 4
cmp eax, 1
je 0x10002554
mov edx, dword [esi]
push 0
push 0
push 0
push 0
push 0
push 1
lea eax, [esp + 0x44c]
push 0
push eax
push 0x3e8
mov ecx, esi
call dword [edx]
lea ecx, [esp + 0x434]
push 0
push ecx
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
mov ecx, 0x100313c8
call fcn.1000cd10
jmp 0x10002554
call fcn.1000bce0
cmp eax, 1
jne 0x10002326
mov edx, dword [esp + 0x485c]
mov eax, dword [esp + 0x4858]
mov ecx, dword [esp + 0x4854]
push edx
mov edx, dword [esp + 0x4854]
push eax
mov eax, dword [esp + 0x4854]
push ecx
mov ecx, dword [esp + 0x4854]
push edx
push eax
push ecx
jmp 0x10003966
push ebp
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x10002554
push ebp
call fcn.10010e10
add esp, 4
cmp eax, 1
jne case.default.0x10002179
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov edx, eax
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x35]
mov byte [esp + 0x34], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
test edx, edx
stosb byte es:[edi], al
jne 0x10002370
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edx, eax
lea eax, [esp + 0x34]
push 0x400
push eax
push edx
call dword [sym.imp.USER32.dll_GetClassNameA]
lea ecx, [esp + 0x34]
push str.bosa_sdm_Microsoft_Office_Word_12.0
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x10002554
lea edx, [esp + 0x34]
push str.NUIDialog
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x10002554
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x1000240c
call fcn.10010f70
cmp eax, 1
jne 0x1000240c
mov eax, dword [esp + 0x10]
push eax
push str..doc
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je case.default.0x10002179
mov ecx, dword [esp + 0x485c]
mov edx, dword [esp + 0x4858]
mov eax, dword [esp + 0x4854]
push ecx
mov ecx, dword [esp + 0x4854]
push edx
mov edx, dword [esp + 0x4854]
push eax
mov eax, dword [esp + 0x4854]
push ecx
push edx
push eax
jmp 0x10003966
lea ecx, [esp + 0x2834]
push 0x1000
push ecx
push ebp
call ebx
test eax, eax
jne 0x1000242f
lea edx, [esp + 0x2834]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 1
lea eax, [esp + 0x2838]
push eax
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
mov ecx, 0x100313c8
call fcn.1000cd10
mov eax, dword [esp + 0x4854]
mov edi, dword [esp + 0x485c]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 3
jne 0x100024a6
mov edx, dword [esp + 0x4858]
mov eax, dword [esp + 0x4850]
mov ecx, dword [esp + 0x484c]
push edi
push edx
mov edx, dword [esp + 0x4850]
push 3
push eax
push ecx
push edx
push ebp
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x1000249f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x1000271e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x10]
push esi
push str..csv
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x100024ce
push esi
push str..txt
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x1000350f
call dword [sym.imp.DSIpcAg.dll_class_IDSIpcAg____cdecl_SCAPI_GetIDSIpcAgent_void_]
test eax, eax
je 0x1000350f
mov edx, dword [eax]
push 0
push 0
push 0
push 0
push 0
push 3
push 0
push ebp
push 0x3fa
mov ecx, eax
call dword [edx]
cmp eax, 0x23
jne 0x1000350f
mov dword [0x10034e90], 1
or eax, 0xffffffff
jmp 0x1000396d
push ebp
call fcn.10010e10
add esp, 4
cmp eax, 1
jne case.default.0x10002179
call dword [sym.imp.DSIpcAg.dll_class_IDSIpcAg____cdecl_SCAPI_GetIDSIpcAgent_void_]
test eax, eax
je 0x10003070
mov edx, dword [eax]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebp
push 0x3fb
mov ecx, eax
call dword [edx]
cmp eax, 9
jne 0x10003070
push ebp
call fcn.10010f20
mov ebx, dword [esp + 0x4858]
mov esi, dword [esp + 0x484c]
push eax
mov eax, dword [0x10033e1c]
push eax
push ebx
push esi
push str.OnCreateFileA:_CREATE_FILE:___x___x___d___d___s_
push 0x10027760
call fcn.1000b440
add esp, 0x1c
cmp esi, 0x80000000
jne 0x100025b7
cmp ebx, 3
jne 0x100025b7
mov ecx, dword [esp + 0x485c]
mov edx, dword [esp + 0x4858]
mov eax, dword [esp + 0x4850]
push ecx
mov ecx, dword [esp + 0x4850]
push edx
push ebx
push eax
push ecx
push esi
jmp 0x10003966
push ebp
call fcn.1000bc30
add esp, 4
cmp eax, 1
jne 0x100025ec
mov edx, dword [esp + 0x485c]
mov eax, dword [esp + 0x4858]
mov ecx, dword [esp + 0x4850]
push edx
mov edx, dword [esp + 0x4850]
push eax
push ebx
push ecx
push edx
push esi
jmp 0x10003966
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x1435]
mov byte [esp + 0x1434], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x3834]
push 0
push eax
call fcn.10011400
mov esi, eax
add esp, 8
cmp esi, 1
jne 0x100026b4
mov ecx, dword [0x10033e7c]
mov edx, dword [0x10034e90]
push ebp
push ecx
push edx
push str.OnCreateFileA:_DT_SDS_SECURITY________________d___d___s_
push 0x10027760
call fcn.1000b440
push ebp
call fcn.100110d0
mov edi, esi
add esp, 0x18
cmp eax, edi
jne 0x1000265d
cmp dword [0x10033e7c], edi
je 0x100026f4
mov edi, dword [esp + 0x10]
push str..tmp
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x10002685
push str..htm
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x100027b9
cmp dword [0x10034e90], 1
jne 0x100027b9
push str.OnCreateFileA:______________GLOBAL.m_bSkipMessage
push 0x10027760
call fcn.1000b440
add esp, 8
push 5
call dword [sym.imp.KERNEL32.dll_SetLastError]
or eax, 0xffffffff
jmp 0x1000396d
cmp esi, 4
jne 0x100027b9
mov eax, dword [0x10033e7c]
mov ecx, dword [0x10034e90]
push ebp
push eax
push ecx
push str.OnCreateFileA:_DT_SWFS_SECURITY_T1________________d___d___s_
push 0x10027760
call fcn.1000b440
push ebp
call fcn.100110d0
mov edi, 1
add esp, 0x18
cmp eax, edi
jne 0x10002726
cmp dword [0x10033e7c], edi
jne 0x10002726
push str.OnCreateFileA:______________GLOBAL.m_bFileDialogClosed
push 0x10027760
call fcn.1000b440
add esp, 8
mov dword [0x10034e90], edi
mov dword [0x10033e7c], 0
push 5
call dword [sym.imp.KERNEL32.dll_SetLastError]
or eax, 0xffffffff
jmp 0x1000396d
mov edi, dword [esp + 0x10]
push str..tmp
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1000274a
push str..htm
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x10002775
cmp dword [0x10034e90], 1
jne 0x10002775
push str.OnCreateFileA:______________GLOBAL.m_bSkipMessage
push 0x10027760
call fcn.1000b440
add esp, 8
push 5
call dword [sym.imp.KERNEL32.dll_SetLastError]
or eax, 0xffffffff
jmp 0x1000396d
cmp dword [0x10033e7c], 1
jne 0x100027b9
push str..tmp
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x100027b9
push ebp
call fcn.1000bb70
add esp, 4
test eax, eax
jne 0x100027b9
push ebp
call fcn.100103c0
add esp, 4
cmp eax, 1
jne 0x100027b9
push 5
call dword [sym.imp.KERNEL32.dll_SetLastError]
or eax, 0xffffffff
jmp 0x1000396d
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 0x3834]
lea eax, [esp + 0x1434]
push edx
push eax
mov dword [0x10033e7c], 0
call edi
cmp esi, 1
je 0x10002822
cmp esi, 4
je 0x10002822
lea ecx, [esp + 0x1434]
push ecx
push 0x10034eac
call edi
mov edx, dword [esp + 0x485c]
mov eax, dword [esp + 0x4858]
mov ecx, dword [esp + 0x4850]
push edx
mov edx, dword [esp + 0x4850]
push eax
mov eax, dword [esp + 0x4850]
push ebx
push ecx
push edx
push eax
jmp 0x10003966
lea ecx, [esp + 0x1434]
push ecx
push 0x10034eac
call edi
cmp ebx, 1
je 0x10002c4a
cmp ebx, 2
je 0x10002c4a
mov dl, byte [esp + 0x33]
mov edi, ebp
mov byte [esp + 0x20], dl
or ecx, 0xffffffff
xor eax, eax
xor esi, esi
xor edx, edx
mov dword [esp + 0x28], esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x24], edx
mov ebx, ecx
mov dword [esp + 0x2c], esi
cmp ebx, 0xfffffffd
jbe 0x100028a5
call fcn.10014aff
mov edx, dword [esp + 0x24]
xor ecx, ecx
cmp edx, ecx
je 0x100028a1
mov al, byte [edx - 1]
test al, al
je 0x100028a1
cmp al, 0xff
je 0x100028a1
cmp ebx, ecx
jne 0x100028ca
dec al
mov byte [edx - 1], al
xor edx, edx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], ecx
jmp 0x100028fc
mov esi, dword [esp + 0x2c]
test ebx, ebx
jne 0x100028b6
push 1
lea ecx, [esp + 0x24]
call fcn.10008c90
jmp 0x100028f8
cmp esi, 0x1f
ja 0x100028bf
cmp esi, ebx
jae 0x100028d8
push 1
lea ecx, [esp + 0x24]
call fcn.10008c90
push ebx
lea ecx, [esp + 0x24]
call fcn.10008ce0
mov edx, dword [esp + 0x24]
mov ecx, ebx
mov esi, ebp
mov eax, ecx
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x28], ebx
mov byte [ebx + ecx], 0
mov edx, dword [esp + 0x28]
mov eax, dword [0x100313f0]
mov ecx, dword [0x10030b7c]
mov dword [esp + 0x483c], 2
mov dword [esp + 0x18], eax
mov esi, dword [eax + 4]
mov edi, eax
cmp esi, ecx
je 0x1000294a
lea edx, [esp + 0x20]
lea ecx, [esi + 0xc]
push edx
call fcn.10008ea0
test eax, eax
jge 0x10002935
mov esi, dword [esi + 8]
jmp 0x10002939
mov edi, esi
mov esi, dword [esi]
cmp esi, dword [0x10030b7c]
jne 0x1000291f
mov edx, dword [esp + 0x28]
mov eax, dword [0x100313f0]
cmp edi, eax
mov dword [esp + 0x14], edi
je 0x10002994
mov ebx, dword [edi + 0x14]
mov edi, dword [edi + 0x10]
test edi, edi
jne 0x10002961
mov edi, 0x100213c4
cmp edx, ebx
mov ecx, edx
jb 0x10002969
mov ecx, ebx
mov esi, dword [esp + 0x24]
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x10002978
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x10002987
cmp edx, ebx
jb 0x1000298f
cmp edx, ebx
setne al
test eax, eax
jl 0x1000298f
lea eax, [esp + 0x14]
jmp 0x1000299c
mov eax, dword [0x100313f0]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov edx, dword [eax]
cmp edx, ecx
mov ecx, dword [esp + 0x24]
setne bl
xor edi, edi
mov dword [esp + 0x483c], 0xffffffff
cmp ecx, edi
je 0x100029d7
mov al, byte [ecx - 1]
dec ecx
test al, al
je 0x100029ce
cmp al, 0xff
je 0x100029ce
dec al
mov byte [ecx], al
jmp 0x100029d7
push ecx
call fcn.10014af4
add esp, 4
test bl, bl
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
je 0x10002c15
push 0x1008
call fcn.1001821f
mov edx, dword [esp + 0x4860]
mov ecx, dword [esp + 0x4858]
add esp, 4
mov ebx, eax
mov eax, dword [esp + 0x4858]
push edx
mov edx, dword [esp + 0x4854]
push eax
mov eax, dword [esp + 0x4854]
push ecx
mov ecx, dword [esp + 0x4854]
push edx
push eax
push ecx
push ebp
push 0x10034eac
mov ecx, ebx
call fcn.1000c0d0
cmp eax, 0xffffffff
mov dword [esp + 0x14], eax
jne 0x10002a51
push ebx
call fcn.10014af4
add esp, 4
or eax, 0xffffffff
jmp 0x1000396d
mov eax, dword [0x10031404]
mov edx, dword [0x10031408]
sub edx, eax
mov esi, eax
sar edx, 2
cmp edx, 1
jae 0x10002b4d
mov edx, dword [0x10031400]
cmp edx, edi
je 0x10002a8b
mov ecx, eax
sub ecx, edx
sar ecx, 2
cmp ecx, 1
jbe 0x10002a8b
mov ecx, eax
sub ecx, edx
sar ecx, 2
jmp 0x10002a90
mov ecx, 1
cmp edx, edi
jne 0x10002a98
xor eax, eax
jmp 0x10002a9d
sub eax, edx
sar eax, 2
lea edi, [eax + ecx]
test edi, edi
mov eax, edi
jge 0x10002aa8
xor eax, eax
lea edx, [eax*4]
push edx
call fcn.1001821f
mov ecx, dword [0x10031400]
add esp, 4
cmp ecx, esi
mov ebp, eax
je 0x10002ad6
test eax, eax
je 0x10002acc
mov edx, dword [ecx]
mov dword [eax], edx
add ecx, 4
add eax, 4
cmp ecx, esi
jne 0x10002ac4
test eax, eax
je 0x10002adc
mov dword [eax], ebx
mov edx, dword [0x10031404]
lea ecx, [eax + 4]
cmp esi, edx
je 0x10002b01
sub esi, eax
lea eax, [esi + ecx - 4]
test ecx, ecx
je 0x10002af7
mov esi, dword [eax]
mov dword [ecx], esi
add eax, 4
add ecx, 4
cmp eax, edx
jne 0x10002aef
mov eax, dword [0x10031400]
push eax
mov dword [esp + 0x20], eax
call fcn.10014af4
mov ecx, dword [0x10031400]
add esp, 4
lea eax, [ebp + edi*4]
test ecx, ecx
mov dword [0x10031408], eax
jne 0x10002b2a
xor eax, eax
jmp 0x10002b34
mov eax, dword [0x10031404]
sub eax, ecx
sar eax, 2
lea ecx, [ebp + eax*4 + 4]
mov eax, dword [esp + 0x14]
mov dword [0x10031404], ecx
mov dword [0x10031400], ebp
jmp 0x1000396d
mov edx, eax
sub edx, esi
sar edx, 2
cmp edx, 1
jae 0x10002bb0
mov edi, eax
lea ecx, [esi + 4]
cmp esi, edi
je 0x10002b7c
lea edx, [ecx - 4]
test ecx, ecx
je 0x10002b72
mov eax, dword [edx]
mov dword [ecx], eax
mov eax, dword [0x10031404]
add edx, 4
add ecx, 4
cmp edx, edi
jne 0x10002b65
mov ecx, eax
mov edx, 1
sub ecx, esi
sar ecx, 2
sub edx, ecx
mov ecx, eax
je 0x10002b9f
test ecx, ecx
je 0x10002b99
mov dword [ecx], ebx
mov eax, dword [0x10031404]
add ecx, 4
dec edx
jne 0x10002b8e
cmp esi, eax
mov ecx, esi
je 0x10002c04
mov dword [ecx], ebx
add ecx, 4
cmp ecx, eax
jne 0x10002ba5
jmp 0x10002bff
mov edi, eax
lea ecx, [eax - 4]
cmp ecx, edi
mov edx, eax
je 0x10002bd2
test edx, edx
je 0x10002bc8
mov eax, dword [ecx]
mov dword [edx], eax
mov eax, dword [0x10031404]
add ecx, 4
add edx, 4
cmp ecx, edi
jne 0x10002bbb
lea ecx, [eax - 4]
cmp esi, ecx
je 0x10002bed
mov edx, dword [ecx - 4]
sub ecx, 4
sub eax, 4
cmp ecx, esi
mov dword [eax], edx
jne 0x10002bd9
mov eax, dword [0x10031404]
lea edx, [esi + 4]
mov ecx, esi
cmp esi, edx
je 0x10002c04
mov dword [ecx], ebx
add ecx, 4
cmp ecx, edx
jne 0x10002bf6
mov eax, dword [0x10031404]
add eax, 4
mov dword [0x10031404], eax
mov eax, dword [esp + 0x14]
jmp 0x1000396d
mov eax, dword [esp + 0x485c]
mov ecx, dword [esp + 0x4858]
mov edx, dword [esp + 0x4854]
push eax
mov eax, dword [esp + 0x4854]
push ecx
mov ecx, dword [esp + 0x4854]
push edx
mov edx, dword [esp + 0x4854]
push eax
push ecx
push edx
jmp 0x10003966
mov eax, dword [0x10033e20]
mov edi, dword [esp + 0x4848]
cmp eax, 0xc
jne 0x10002d99
test edi, 0x40000000
je 0x10002d99
cmp ebx, 2
je 0x10002c79
cmp ebx, 1
jne 0x10002d99
cmp esi, 1
je 0x10002c87
cmp esi, 4
jne 0x10002d2c
push ebp
call fcn.100110d0
add esp, 4
cmp eax, 1
jne 0x10002d2c
call fcn.10010f70
cmp eax, 1
jne 0x10002d2c
call fcn.10010f70
push eax
push str.OnCreateFileA:____IsBlackList___d_
push 0x10027760
call fcn.1000b440
mov esi, dword [sym.imp.dsLang.dll_char____cdecl_GetDSString_char__]
add esp, 0xc
mov dword [0x10034e90], 1
push 0xa
push 0x40
push str.STR_BOXCAPTION_TITLE
call esi
add esp, 4
push eax
push str.STR_NO_SUPPORT_EXT
call esi
add esp, 4
push eax
push 0
call sub.SCMsgBox.dll_SCMessageBoxModaless
add esp, 0x14
push 5
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
call fcn.10010fa0
push 0
call fcn.10010ff0
add esp, 8
call fcn.10010f70
push eax
push str.OnCreateFileA:____in_GetSaveAsCommand___d_
push 0x10027760
call fcn.1000b440
add esp, 0xc
or eax, 0xffffffff
jmp 0x1000396d
push ebp
call fcn.1000ffd0
add esp, 4
test eax, eax
jne 0x10002d46
push ebp
call fcn.100103c0
add esp, 4
test eax, eax
je 0x10002d99
push ebp
call fcn.1000bb70
add esp, 4
test eax, eax
jne 0x10002d99
push ebp
call fcn.10010e80
add esp, 4
cmp eax, 1
jne 0x10002d87
mov eax, dword [esp + 0x485c]
mov ecx, dword [esp + 0x4858]
mov edx, dword [esp + 0x4850]
push eax
mov eax, dword [esp + 0x4850]
push ecx
push ebx
push edx
push eax
jmp 0x10003965
mov dword [0x10034e9c], 1
or eax, 0xffffffff
jmp 0x1000396d
push ebp
call fcn.10011150
add esp, 4
cmp eax, 1
jne 0x10002d61
mov esi, dword [esp + 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push esi
push str..csv
call edi
test eax, eax
je 0x10002dc9
push esi
push str..txt
call edi
test eax, eax
jne 0x10002e04
call dword [sym.imp.DSIpcAg.dll_class_IDSIpcAg____cdecl_SCAPI_GetIDSIpcAgent_void_]
test eax, eax
je 0x10002e04
mov edx, dword [eax]
push 0
push 0
push 0
push 0
push 0
push 3
push 0
push ebp
push 0x3fa
mov ecx, eax
call dword [edx]
cmp eax, 0x23
jne 0x10002e04
mov dword [0x10034e90], 1
or eax, 0xffffffff
jmp 0x1000396d
push ebp
push 0x10034eac
call fcn.10010f70
push eax
push str.OnCreateFileA:_CSaveFile__d___s___s_
push 0x10027760
call fcn.1000b440
push 0x1008
call fcn.1001821f
mov ecx, dword [esp + 0x4874]
mov edx, dword [esp + 0x4870]
add esp, 0x18
mov dword [esp + 0x10], eax
push ecx
mov ecx, dword [esp + 0x4854]
push edx
mov edx, dword [esp + 0x4854]
push ebx
push ecx
mov ecx, dword [esp + 0x4858]
push edx
push ecx
push ebp
push 0x10034eac
mov ecx, eax
call fcn.1000c0d0
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x10002e7f
push str.OnCreateFileA:_CSaveFile_Create_Fail..__
push 0x10027760
call fcn.1000b440
add esp, 8
mov eax, dword [0x10031404]
mov edx, dword [0x10031408]
sub edx, eax
mov esi, eax
sar edx, 2
cmp edx, 1
jae 0x10002f90
mov edx, dword [0x10031400]
test edx, edx
je 0x10002eb9
mov ecx, eax
sub ecx, edx
sar ecx, 2
cmp ecx, 1
jbe 0x10002eb9
mov ecx, eax
sub ecx, edx
sar ecx, 2
jmp 0x10002ebe
mov ecx, 1
test edx, edx
jne 0x10002ec6
xor eax, eax
jmp 0x10002ecb
sub eax, edx
sar eax, 2
lea ebp, [eax + ecx]
test ebp, ebp
mov eax, ebp
jge 0x10002ed6
xor eax, eax
lea edx, [eax*4]
push edx
call fcn.1001821f
mov ecx, dword [0x10031400]
add esp, 4
cmp ecx, esi
mov edi, eax
je 0x10002f04
test eax, eax
je 0x10002efa
mov edx, dword [ecx]
mov dword [eax], edx
add ecx, 4
add eax, 4
cmp ecx, esi
jne 0x10002ef2
test eax, eax
je 0x10002f0e
mov ecx, dword [esp + 0x10]
mov dword [eax], ecx
mov edx, dword [0x10031404]
lea ecx, [eax + 4]
cmp esi, edx
je 0x10002f33
sub esi, eax
lea eax, [esi + ecx - 4]
test ecx, ecx
je 0x10002f29
mov esi, dword [eax]
mov dword [ecx], esi
add eax, 4
add ecx, 4
cmp eax, edx
jne 0x10002f21
mov eax, dword [0x10031400]
push eax
mov dword [esp + 0x18], eax
call fcn.10014af4
mov ecx, dword [0x10031400]
add esp, 4
lea edx, [edi + ebp*4]
test ecx, ecx
mov dword [0x10031408], edx
jne 0x10002f70
xor eax, eax
mov dword [0x10031400], edi
lea eax, [edi + eax*4 + 4]
mov dword [0x10031404], eax
mov eax, ebx
jmp 0x1000396d
mov eax, dword [0x10031404]
mov dword [0x10031400], edi
sub eax, ecx
sar eax, 2
lea eax, [edi + eax*4 + 4]
mov dword [0x10031404], eax
mov eax, ebx
jmp 0x1000396d
mov ecx, eax
sub ecx, esi
sar ecx, 2
cmp ecx, 1
jae 0x10003009
mov edi, eax
lea ecx, [esi + 4]
cmp esi, edi
je 0x10002fbf
lea edx, [ecx - 4]
test ecx, ecx
je 0x10002fb5
mov eax, dword [edx]
mov dword [ecx], eax
mov eax, dword [0x10031404]
add edx, 4
add ecx, 4
cmp edx, edi
jne 0x10002fa8
mov edi, dword [esp + 0x10]
mov ecx, eax
sub ecx, esi
mov edx, 1
sar ecx, 2
sub edx, ecx
mov ecx, eax
je 0x10002fe6
test ecx, ecx
je 0x10002fe0
mov dword [ecx], edi
mov eax, dword [0x10031404]
add ecx, 4
dec edx
jne 0x10002fd5
cmp esi, eax
mov ecx, esi
je 0x10003061
mov dword [ecx], edi
add ecx, 4
cmp ecx, eax
jne 0x10002fec
mov eax, dword [0x10031404]
add eax, 4
mov dword [0x10031404], eax
mov eax, ebx
jmp 0x1000396d
mov edi, eax
lea ecx, [eax - 4]
cmp ecx, edi
mov edx, eax
je 0x1000302b
test edx, edx
je 0x10003021
mov eax, dword [ecx]
mov dword [edx], eax
mov eax, dword [0x10031404]
add ecx, 4
add edx, 4
cmp ecx, edi
jne 0x10003014
lea ecx, [eax - 4]
cmp esi, ecx
je 0x10003046
mov edx, dword [ecx - 4]
sub ecx, 4
sub eax, 4
cmp ecx, esi
mov dword [eax], edx
jne 0x10003032
mov eax, dword [0x10031404]
lea edx, [esi + 4]
mov ecx, esi
cmp esi, edx
je 0x10003061
mov eax, dword [esp + 0x10]
mov dword [ecx], eax
add ecx, 4
cmp ecx, edx
jne 0x10003053
mov eax, dword [0x10031404]
add eax, 4
mov dword [0x10031404], eax
mov eax, ebx
jmp 0x1000396d
lea ecx, [esp + 0x2834]
push 0x1000
push ecx
push ebp
call ebx
test eax, eax
jne 0x10003093
lea edx, [esp + 0x2834]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 2
lea eax, [esp + 0x2838]
jmp 0x10002438
push ebp
push str.OnCreateFileA_:_case_DT_SWFS_SECURITY_T1:___s_
push 0x10027760
call fcn.1000b440
push ebp
call fcn.10010e10
add esp, 0x10
test eax, eax
jne 0x100030f3
mov ecx, dword [esp + 0x485c]
mov edx, dword [esp + 0x4858]
mov eax, dword [esp + 0x4854]
push ecx
mov ecx, dword [esp + 0x4854]
push edx
mov edx, dword [esp + 0x4854]
push eax
mov eax, dword [esp + 0x4854]
push ecx
push edx
push eax
jmp 0x10003966
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov edx, eax
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x35]
mov byte [esp + 0x34], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
test edx, edx
stosb byte es:[edi], al
jne 0x1000311c
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edx, eax
lea ecx, [esp + 0x34]
push 0x400
push ecx
push edx
call dword [sym.imp.USER32.dll_GetClassNameA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea edx, [esp + 0x34]
push str.bosa_sdm_Microsoft_Office_Word_12.0
push edx
call esi
test eax, eax
je 0x100022f1
lea eax, [esp + 0x34]
push str.NUIDialog
push eax
call esi
test eax, eax
je 0x100022f1
mov ecx, 0x3ff
xor eax, eax
lea edi, [esp + 0x435]
mov byte [esp + 0x434], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x434]
push 0x1000
push ecx
push ebp
stosb byte es:[edi], al
call ebx
test eax, eax
jne 0x10003199
lea edx, [esp + 0x434]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x434]
push eax
call fcn.1000bc30
add esp, 4
cmp eax, 1
jne 0x100031e3
mov ecx, dword [esp + 0x485c]
mov edx, dword [esp + 0x4858]
mov eax, dword [esp + 0x4854]
push ecx
mov ecx, dword [esp + 0x4854]
push edx
mov edx, dword [esp + 0x4854]
push eax
mov eax, dword [esp + 0x4854]
push ecx
push edx
push eax
jmp 0x10003966
mov ebx, dword [esp + 0x10]
push str..docx
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
mov edi, dword [esp + 0x4858]
mov esi, dword [esp + 0x484c]
je 0x10003215
push str..doc
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x1000326b
push ebp
call fcn.10010410
add esp, 4
cmp eax, 1
jne 0x1000326b
push ebp
call fcn.100103c0
add esp, 4
cmp eax, 1
jne 0x1000326b
cmp dword [esp + 0x4848], 0xc0000000
jne 0x1000326b
cmp esi, 1
jne 0x1000326b
cmp dword [esp + 0x4854], 4
jne 0x1000326b
cmp edi, 0x100080
jne 0x1000326b
push 5
mov dword [0x10034e9c], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
or eax, 0xffffffff
jmp 0x1000396d
call dword [sym.imp.DSIpcAg.dll_class_IDSIpcAg____cdecl_SCAPI_GetIDSIpcAgent_void_]
mov edx, dword [eax]
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x44c]
push 0
push ecx
push 0x403
mov ecx, eax
call dword [edx]
test eax, eax
jne 0x10002716
mov ebx, 4
lea edx, [esp + 0x434]
push ebx
push edx
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
mov ecx, 0x100313c8
call fcn.1000cd10
mov eax, dword [esp + 0x485c]
mov ecx, dword [esp + 0x4854]
mov edx, dword [esp + 0x4850]
push eax
mov eax, dword [esp + 0x484c]
push edi
push ecx
push edx
push esi
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
push 0x804
mov dword [esp + 0x20], edi
call fcn.1001821f
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x483c], 0
je 0x1000331c
lea ecx, [esp + 0x434]
push edi
push ecx
mov ecx, eax
call fcn.1000c210
mov esi, eax
jmp 0x1000331e
xor esi, esi
cmp edi, 0xffffffff
mov dword [esp + 0x483c], 0xffffffff
mov dword [esp + 0x18], esi
jne 0x10003351
test esi, esi
je 0x1000271e
mov ecx, esi
call fcn.100111e0
push esi
call fcn.10014af4
add esp, 4
or eax, edi
jmp 0x1000396d
mov eax, dword [0x10031434]
mov edx, dword [0x10031438]
sub edx, eax
mov esi, eax
sar edx, 2
cmp edx, 1
jae 0x10003457
mov edx, dword [0x10031430]
test edx, edx
je 0x1000338b
mov ecx, eax
sub ecx, edx
sar ecx, 2
cmp ecx, 1
jbe 0x1000338b
mov ecx, eax
sub ecx, edx
sar ecx, 2
jmp 0x10003390
mov ecx, 1
test edx, edx
jne 0x10003398
xor eax, eax
jmp 0x1000339d
sub eax, edx
sar eax, 2
add eax, ecx
test eax, eax
mov dword [esp + 0x14], eax
jge 0x100033a9
xor eax, eax
lea edx, [eax*4]
push edx
call fcn.1001821f
mov edi, dword [0x10031430]
add esp, 4
mov ebp, eax
cmp edi, esi
mov ebx, ebp
je 0x100033db
push edi
push ebx
call fcn.10008e80
add edi, 4
add esp, 8
add ebx, 4
cmp edi, esi
jne 0x100033c7
lea eax, [esp + 0x18]
push eax
push ebx
call fcn.10008e80
mov ecx, dword [0x10031434]
add esp, 8
add ebx, 4
push ebx
push ecx
push esi
mov ecx, 0x1003142c
call fcn.10008e50
mov edx, dword [0x10031434]
mov eax, dword [0x10031430]
push edx
push eax
mov ecx, 0x1003142c
call fcn.10008df0
mov ecx, dword [0x10031430]
push ecx
call fcn.10014af4
mov edx, dword [esp + 0x18]
add esp, 4
mov ecx, 0x1003142c
lea eax, [ebp + edx*4]
mov dword [0x10031438], eax
call fcn.10008e30
mov edi, dword [esp + 0x1c]
lea ecx, [ebp + eax*4 + 4]
mov dword [0x10031434], ecx
mov dword [0x10031430], ebp
mov eax, edi
jmp 0x1000396d
mov edx, eax
sub edx, esi
sar edx, 2
cmp edx, 1
jae 0x100034bf
lea ecx, [esi + 4]
push ecx
push eax
push esi
mov ecx, 0x1003142c
call fcn.10008e50
mov eax, dword [0x10031434]
lea edx, [esp + 0x18]
mov ecx, eax
push edx
sub ecx, esi
mov edx, 1
sar ecx, 2
sub edx, ecx
mov ecx, 0x1003142c
push edx
push eax
call fcn.10008e00
mov eax, dword [0x10031434]
cmp esi, eax
je 0x100034fc
mov ecx, dword [esp + 0x18]
mov dword [esi], ecx
add esi, ebx
cmp esi, eax
jne 0x100034a0
mov eax, dword [0x10031434]
add eax, ebx
mov dword [0x10031434], eax
mov eax, edi
jmp 0x1000396d
push eax
push eax
add eax, 0xfffffffc
mov ecx, 0x1003142c
push eax
call fcn.10008e50
mov eax, dword [0x10031434]
mov ecx, eax
add eax, 0xfffffffc
cmp esi, eax
je 0x100034e9
sub eax, ebx
sub ecx, ebx
cmp eax, esi
mov edx, dword [eax]
mov dword [ecx], edx
jne 0x100034dd
lea eax, [esi + 4]
cmp esi, eax
je 0x100034fc
mov ecx, dword [esp + 0x18]
mov dword [esi], ecx
add esi, ebx
cmp esi, eax
jne 0x100034f0
mov eax, dword [0x10031434]
add eax, ebx
mov dword [0x10031434], eax
mov eax, edi
jmp 0x1000396d
cmp dword [0x10031454], 1
jne 0x10003522
mov ecx, 0x10033e40
call fcn.10013c40
mov eax, dword [0x10033e74]
test eax, eax
jne 0x1000390f
mov ecx, 0x3ff
xor eax, eax
lea edi, [esp + 0x435]
mov byte [esp + 0x434], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x434]
push 0x1000
push eax
push ebp
mov dword [0x10033e74], 1
call dword [sym.imp.KERNEL32.dll_GetLongPathNameA]
test eax, eax
jne 0x1000357b
lea ecx, [esp + 0x434]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 0x434]
mov ecx, 0x100313c8
push edx
call fcn.1000c690
mov esi, eax
test esi, esi
je 0x100036ec
call dword [sym.imp.DSCOPipe.dll_Ordinal_1]
test eax, eax
je 0x100035cb
lea ecx, [esp + 0x1834]
push ecx
mov ecx, eax
call dword [sym.imp.DSCOPipe.dll_public:_void___thiscall_CSDSCOPipe::GetLastOpenedDocumentFile_char__]
lea edx, [esp + 0x1834]
push edx
push str.OnCreateFileA_:_GetLastOpenedDocumentFile___s_
push str.DSCOXLSX
call fcn.1000b440
add esp, 0xc
lea eax, [esp + 0x1834]
push eax
call fcn.10010410
add esp, 4
test eax, eax
jne 0x100036a6
mov edi, dword [esp + 0x10]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push str..docx
push edi
call ebp
test eax, eax
je 0x10003615
push str..doc
push edi
call ebp
test eax, eax
je 0x10003615
push str..tmp
push edi
call ebp
test eax, eax
jne 0x100036a6
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
lea ecx, [esp + 0x434]
push str.Temporary_Internet_Files
push ecx
call edi
test eax, eax
je 0x100036a6
lea edx, [esp + 0x434]
push str.content.mso
push edx
call edi
test eax, eax
je 0x100036a6
cmp dword [esp + 0x4858], 0x8100100
jne 0x100036a6
push str.OnCreateFileA:_SPS_Connected_File...BYPASS..__
push 0x10027760
call fcn.1000b440
mov eax, dword [esp + 0x4864]
mov ecx, dword [esp + 0x485c]
mov edx, dword [esp + 0x4858]
add esp, 8
mov dword [0x10033e74], 0
push eax
mov eax, dword [esp + 0x4850]
push 0x8100100
push ecx
mov ecx, dword [esp + 0x4854]
push edx
push eax
lea edx, [esp + 0x448]
push ecx
push edx
call ebx
jmp 0x1000396d
mov eax, dword [esp + 0x485c]
mov ecx, dword [esp + 0x4858]
mov edx, dword [esp + 0x4854]
push eax
mov eax, dword [esp + 0x4854]
push ecx
mov ecx, dword [esp + 0x4854]
push edx
mov edx, dword [esp + 0x4854]
push eax
push ecx
push edx
mov ecx, esi
call fcn.100145c0
mov dword [0x10033e74], 0
jmp 0x1000396d
push 0x34
call fcn.1001821f
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0x483c], 1
je 0x1000371a
lea ecx, [esp + 0x434]
push ecx
mov ecx, eax
call fcn.100141a0
jmp 0x1000371c
xor eax, eax
mov edx, dword [0x100313d8]
mov dword [esp + 0x10], eax
mov eax, dword [0x100313d4]
mov dword [esp + 0x483c], 0xffffffff
sub edx, eax
mov esi, eax
sar edx, 2
cmp edx, 1
jae 0x1000382a
mov edx, dword [0x100313d0]
test edx, edx
je 0x10003765
mov ecx, eax
sub ecx, edx
sar ecx, 2
cmp ecx, 1
jbe 0x10003765
mov ecx, eax
sub ecx, edx
sar ecx, 2
jmp 0x1000376a
mov ecx, 1
test edx, edx
jne 0x10003772
xor eax, eax
jmp 0x10003777
sub eax, edx
sar eax, 2
add eax, ecx
test eax, eax
mov dword [esp + 0x14], eax
jge 0x10003783
xor eax, eax
lea edx, [eax*4]
push edx
call fcn.1001821f
mov edi, dword [0x100313d0]
add esp, 4
mov ebx, eax
cmp edi, esi
mov ebp, ebx
je 0x100037b5
push edi
push ebp
call fcn.10008e80
add edi, 4
add esp, 8
add ebp, 4
cmp edi, esi
jne 0x100037a1
lea eax, [esp + 0x10]
push eax
push ebp
call fcn.10008e80
mov ecx, dword [0x100313d4]
add esp, 8
add ebp, 4
push ebp
push ecx
push esi
mov ecx, 0x100313cc
call fcn.10008e50
mov edx, dword [0x100313d4]
mov eax, dword [0x100313d0]
push edx
push eax
mov ecx, 0x100313cc
call fcn.10008df0
mov ecx, dword [0x100313d0]
push ecx
call fcn.10014af4
mov edx, dword [esp + 0x18]
add esp, 4
mov ecx, 0x100313cc
lea eax, [ebx + edx*4]
mov dword [0x100313d8], eax
call fcn.10008e30
lea ecx, [ebx + eax*4 + 4]
mov dword [0x100313d0], ebx
mov dword [0x100313d4], ecx
jmp 0x100038ca
mov edx, eax
sub edx, esi
sar edx, 2
cmp edx, 1
jae 0x10003882
lea ecx, [esi + 4]
push ecx
push eax
push esi
mov ecx, 0x100313cc
call fcn.10008e50
mov eax, dword [0x100313d4]
lea edx, [esp + 0x10]
mov ecx, eax
push edx
sub ecx, esi
mov edx, 1
sar ecx, 2
sub edx, ecx
mov ecx, 0x100313cc
push edx
push eax
call fcn.10008e00
mov eax, dword [0x100313d4]
cmp esi, eax
je 0x100038c3
mov ecx, dword [esp + 0x10]
mov dword [esi], ecx
add esi, 4
cmp esi, eax
jne 0x10003873
jmp 0x100038c3
push eax
push eax
add eax, 0xfffffffc
mov ecx, 0x100313cc
push eax
call fcn.10008e50
mov eax, dword [0x100313d4]
mov ecx, eax
add eax, 0xfffffffc
cmp esi, eax
je 0x100038af
mov edx, dword [eax - 4]
sub eax, 4
sub ecx, 4
cmp eax, esi
mov dword [ecx], edx
jne 0x100038a0
lea eax, [esi + 4]
cmp esi, eax
je 0x100038c3
mov ecx, dword [esp + 0x10]
mov dword [esi], ecx
add esi, 4
cmp esi, eax
jne 0x100038b6
add dword [0x100313d4], 4
mov edx, dword [esp + 0x485c]
mov eax, dword [esp + 0x4858]
mov ecx, dword [esp + 0x4854]
push edx
mov edx, dword [esp + 0x4854]
push eax
mov eax, dword [esp + 0x4854]
push ecx
mov ecx, dword [esp + 0x4854]
push edx
push eax
push ecx
mov ecx, dword [esp + 0x28]
call fcn.10014350
mov dword [0x10033e74], 0
jmp 0x1000396d
mov edx, dword [esp + 0x4858]
mov eax, dword [esp + 0x4854]
mov ecx, dword [esp + 0x4850]
push edi
push edx
mov edx, dword [esp + 0x4854]
push eax
mov eax, dword [esp + 0x4854]
push ecx
push edx
push eax
push ebp
call ebx
jmp 0x1000396d
mov ecx, dword [esp + 0x485c]
mov edx, dword [esp + 0x4858]
mov eax, dword [esp + 0x4854]
push ecx
mov ecx, dword [esp + 0x4854]
push edx
mov edx, dword [esp + 0x4854]
push eax
push ecx
push edx
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, dword [esp + 0x4834]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x4830
ret 0x1c