Function at 0x409ad3
Capabilities:
Delete file

Disassembly:
push ebp
sub esp, 0x800
lea ebp, [esp - 4]
mov eax, dword [0x467fd0]
xor eax, ebp
mov dword [ebp + 0x800], eax
push 0x14
mov eax, 0x44902e
call fcn.004329a3
mov dword [ebp - 0x18], ecx
mov esi, 0x469a80
mov ecx, esi
call fcn.004033fd
mov edi, dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push eax
call edi
mov ecx, dword [ebp - 0x18]
push eax
call fcn.00409868
test eax, eax
je 0x409b75
push 0x44ca68
mov ecx, esi
call fcn.004033fd
push eax
call fcn.004336f3
push eax
mov dword [ebp - 0x14], eax
call fcn.004335b1
add esp, 0xc
mov ecx, esi
call fcn.004033fd
push eax
call edi
push str.SOMAuthNormal::CheckOfficeException_..
mov ebx, 0x44c95c
push ebx
mov edi, 0x46b378
push edi
mov dword [ebp - 0x10], eax
call fcn.00401ac3
add esp, 0xc
cmp dword [ebp - 0x14], 0
jne 0x409b9a
push str.SOMAuthNormal::CheckOfficeException_File_Pointer_is_NULL__
push ebx
push edi
call fcn.00401ac3
add esp, 0xc
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x800]
xor ecx, ebp
call fcn.00432994
add ebp, 0x804
leave
ret
xor eax, eax
push 0x7fe
push eax
mov word [ebp], ax
lea eax, [ebp + 2]
push eax
call fcn.00432ab0
add esp, 0xc
push 0x400
lea eax, [ebp]
push eax
mov ecx, esi
call fcn.004033fd
push eax
call fcn.0040f050
add esp, 0xc
mov ecx, esi
mov dword [ebp - 0x14], eax
call fcn.004033fd
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor esi, esi
cmp dword [ebp - 0x14], esi
jne 0x409bea
push str.SOMAuthNormal::CheckOfficeException_FindExecutable_Error__
jmp 0x409b6b
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp]
push eax
mov dword [ebp - 0x1c], esi
call fcn.0040e970
pop ecx
pop ecx
test eax, eax
jne 0x409c0a
push str.SOMAuthNormal::CheckOfficeException_GetFileMajorVersion_Error__
jmp 0x409b6b
push dword [ebp - 0x1c]
lea eax, [ebp]
push eax
push str.CheckOfficeException_File__s__Version__d_
push ebx
push edi
call fcn.00401ac3
add esp, 0x14
cmp dword [ebp - 0x1c], 0xe
jne 0x409c80
push str.SOMWT001
lea eax, [ebp - 0x10]
mov edi, 0x46b8a0
push eax
mov ecx, edi
call fcn.004108e0
mov ebx, eax
push str.SOMER052
lea eax, [ebp - 0x14]
push eax
mov ecx, edi
mov dword [ebp - 4], esi
call fcn.004108e0
push 0x10
push dword [ebx]
push dword [eax]
mov eax, dword [ebp - 0x18]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.004026b1
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004026b1
xor eax, eax
inc eax
jmp 0x409b77
cmp dword [ebp - 0x1c], 0xc
jne 0x409d83
cmp dword [0x469a00], 2
jne 0x409d50
lea eax, [ebp - 0x14]
push eax
push 0x20019
push esi
push str.SOFTWAREMicrosoftOfficeWordAddInsMSO07EHW.Connect
mov dword [ebp - 0x14], esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
je 0x409d35
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftOfficeWordAddIns_MSO07EHW.Connect
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
je 0x409d35
push dword [ebp - 0x14]
push str._RegOpenKeyEx__MSO07EHW.Connect___x_
push ebx
push edi
call fcn.00401ac3
add esp, 0x10
push 0xe
mov ecx, 0x46b070
call fcn.0040819f
cmp eax, 1
push str.SOMWT001
lea eax, [ebp - 0x10]
mov ecx, 0x46b8a0
push eax
jne 0x409d16
call fcn.004108e0
push 0x10
push dword [eax]
push str.This_Version_of_Document_Security_Agent_doesnt_support_Office_2007.
jmp 0x409d24
call fcn.004108e0
push 0x10
push dword [eax]
push str.This_document_doesnt_support_the_version_of_Office_2007.
mov eax, dword [ebp - 0x18]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x409c6d
push dword [ebp - 0x14]
push str._RegOpenKeyEx_in___x_
push 0x44d1c8
push edi
call fcn.00403970
add esp, 0x10
jmp 0x409b75
push 0xe
mov ecx, 0x46b070
call fcn.0040819f
test eax, eax
jne 0x409b75
push str._RegOpenKeyEx_Not_DS_ACL_OFFICEX_0
push ebx
push edi
call fcn.00401ac3
add esp, 0xc
push str.SOMWT001
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x46b8a0
jmp 0x409d16
cmp dword [ebp - 0x1c], 0xb
jne 0x409b75
mov edi, 0x46b070
push 0xe
mov ecx, edi
call fcn.0040819f
test eax, eax
je 0x409b75
push str..csv
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x409b75
push 0xd
mov ecx, edi
call fcn.0040819f
test eax, eax
jne 0x409b75
push str.SOMWT001
mov ecx, 0x46b8a0
cmp dword [0x4699fc], esi
jne 0x409df3
lea eax, [ebp - 0x10]
push eax
call fcn.004108e0
push 0x10
push dword [eax]
push 0x4506d0
jmp 0x409d24
lea eax, [ebp - 0x20]
push eax
call fcn.004108e0
push 0x10
push dword [eax]
mov eax, dword [ebp - 0x18]
push str.This_document_can_be_accessed_with_Office_2007.
push dword [eax + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 0x20]
jmp 0x409c70