Function at 0x40a4a1
Capabilities:
Delete file

Disassembly:
push ebp
sub esp, 0x800
lea ebp, [esp - 4]
mov eax, dword [0x467fd0]
xor eax, ebp
mov dword [ebp + 0x800], eax
push 0x14
mov eax, 0x4499fc
call fcn.00433313
mov dword [ebp - 0x18], ecx
mov esi, 0x469a80
mov ecx, esi
call fcn.004033d9
mov edi, dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push eax
call edi
mov ecx, dword [ebp - 0x18]
push eax
call fcn.0040a236
test eax, eax
je 0x40a543
push 0x44ca58
mov ecx, esi
call fcn.004033d9
push eax
call fcn.00434063
push eax
mov dword [ebp - 0x14], eax
call fcn.00433f21
add esp, 0xc
mov ecx, esi
call fcn.004033d9
push eax
call edi
push str.SOMAuthNormal::CheckOfficeException_..
mov ebx, 0x44c94c
push ebx
mov edi, 0x46b378
push edi
mov dword [ebp - 0x10], eax
call fcn.00401ae2
add esp, 0xc
cmp dword [ebp - 0x14], 0
jne 0x40a568
push str.SOMAuthNormal::CheckOfficeException_File_Pointer_is_NULL__
push ebx
push edi
call fcn.00401ae2
add esp, 0xc
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x800]
xor ecx, ebp
call fcn.00433304
add ebp, 0x804
leave
ret
xor eax, eax
push 0x7fe
push eax
mov word [ebp], ax
lea eax, [ebp + 2]
push eax
call fcn.00433420
add esp, 0xc
push 0x400
lea eax, [ebp]
push eax
mov ecx, esi
call fcn.004033d9
push eax
call fcn.0040fa20
add esp, 0xc
mov ecx, esi
mov dword [ebp - 0x14], eax
call fcn.004033d9
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor esi, esi
cmp dword [ebp - 0x14], esi
jne 0x40a5b8
push str.SOMAuthNormal::CheckOfficeException_FindExecutable_Error__
jmp 0x40a539
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp]
push eax
mov dword [ebp - 0x1c], esi
call fcn.0040f340
pop ecx
pop ecx
test eax, eax
jne 0x40a5d8
push str.SOMAuthNormal::CheckOfficeException_GetFileMajorVersion_Error__
jmp 0x40a539
push dword [ebp - 0x1c]
lea eax, [ebp]
push eax
push str.CheckOfficeException_File__s__Version__d_
push ebx
push edi
call fcn.00401ae2
add esp, 0x14
cmp dword [ebp - 0x1c], 0xe
jne 0x40a64e
push str.SOMWT001
lea eax, [ebp - 0x10]
mov edi, 0x46b8a0
push eax
mov ecx, edi
call fcn.004112d0
mov ebx, eax
push str.SOMER052
lea eax, [ebp - 0x14]
push eax
mov ecx, edi
mov dword [ebp - 4], esi
call fcn.004112d0
push 0x10
push dword [ebx]
push dword [eax]
mov eax, dword [ebp - 0x18]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.004026da
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004026da
xor eax, eax
inc eax
jmp 0x40a545
cmp dword [ebp - 0x1c], 0xc
jne 0x40a751
cmp dword [0x469a00], 2
jne 0x40a71e
lea eax, [ebp - 0x14]
push eax
push 0x20019
push esi
push str.SOFTWAREMicrosoftOfficeWordAddInsMSO07EHW.Connect
mov dword [ebp - 0x14], esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
je 0x40a703
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftOfficeWordAddIns_MSO07EHW.Connect
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
je 0x40a703
push dword [ebp - 0x14]
push str._RegOpenKeyEx__MSO07EHW.Connect___x_
push ebx
push edi
call fcn.00401ae2
add esp, 0x10
push 0xe
mov ecx, 0x46b070
call fcn.00408aa4
cmp eax, 1
push str.SOMWT001
lea eax, [ebp - 0x10]
mov ecx, 0x46b8a0
push eax
jne 0x40a6e4
call fcn.004112d0
push 0x10
push dword [eax]
push str.This_Version_of_Document_Security_Agent_doesnt_support_Office_2007.
jmp 0x40a6f2
call fcn.004112d0
push 0x10
push dword [eax]
push str.This_document_doesnt_support_the_version_of_Office_2007.
mov eax, dword [ebp - 0x18]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x40a63b
push dword [ebp - 0x14]
push str._RegOpenKeyEx_in___x_
push 0x44d1b8
push edi
call fcn.00403c50
add esp, 0x10
jmp 0x40a543
push 0xe
mov ecx, 0x46b070
call fcn.00408aa4
test eax, eax
jne 0x40a543
push str._RegOpenKeyEx_Not_DS_ACL_OFFICEX_0
push ebx
push edi
call fcn.00401ae2
add esp, 0xc
push str.SOMWT001
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x46b8a0
jmp 0x40a6e4
cmp dword [ebp - 0x1c], 0xb
jne 0x40a543
mov edi, 0x46b070
push 0xe
mov ecx, edi
call fcn.00408aa4
test eax, eax
je 0x40a543
push str..csv
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x40a543
push 0xd
mov ecx, edi
call fcn.00408aa4
test eax, eax
jne 0x40a543
push str.SOMWT001
mov ecx, 0x46b8a0
cmp dword [0x4699fc], esi
jne 0x40a7c1
lea eax, [ebp - 0x10]
push eax
call fcn.004112d0
push 0x10
push dword [eax]
push 0x4506c8
jmp 0x40a6f2
lea eax, [ebp - 0x20]
push eax
call fcn.004112d0
push 0x10
push dword [eax]
mov eax, dword [ebp - 0x18]
push str.This_document_can_be_accessed_with_Office_2007.
push dword [eax + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 0x20]
jmp 0x40a63e