Function at 0x40afe6
Capabilities:
Delete file

Disassembly:
push ebp
sub esp, 0x800
lea ebp, [esp - 4]
mov eax, dword [0x46aff0]
xor eax, ebp
mov dword [ebp + 0x800], eax
push 0x14
mov eax, 0x44aefe
call fcn.00434673
mov dword [ebp - 0x18], ecx
mov esi, 0x46caa0
mov ecx, esi
call fcn.004033c7
mov edi, dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push eax
call edi
mov ecx, dword [ebp - 0x18]
push eax
call fcn.0040ae25
test eax, eax
je 0x40b088
push 0x44ea68
mov ecx, esi
call fcn.004033c7
push eax
call fcn.004353c3
push eax
mov dword [ebp - 0x14], eax
call fcn.00435281
add esp, 0xc
mov ecx, esi
call fcn.004033c7
push eax
call edi
push str.SOMAuthNormal::CheckOfficeException_..
mov ebx, 0x44e95c
push ebx
mov edi, 0x46e8a8
push edi
mov dword [ebp - 0x10], eax
call fcn.00401ae2
add esp, 0xc
cmp dword [ebp - 0x14], 0
jne 0x40b0ad
push str.SOMAuthNormal::CheckOfficeException_File_Pointer_is_NULL__
push ebx
push edi
call fcn.00401ae2
add esp, 0xc
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x800]
xor ecx, ebp
call fcn.00434664
add ebp, 0x804
leave
ret
xor eax, eax
push 0x7fe
push eax
mov word [ebp], ax
lea eax, [ebp + 2]
push eax
call fcn.00434780
add esp, 0xc
push 0x400
lea eax, [ebp]
push eax
mov ecx, esi
call fcn.004033c7
push eax
call fcn.00410d70
add esp, 0xc
mov ecx, esi
mov dword [ebp - 0x14], eax
call fcn.004033c7
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor esi, esi
cmp dword [ebp - 0x14], esi
jne 0x40b0fd
push str.SOMAuthNormal::CheckOfficeException_FindExecutable_Error__
jmp 0x40b07e
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp]
push eax
mov dword [ebp - 0x1c], esi
call fcn.004105b0
pop ecx
pop ecx
test eax, eax
jne 0x40b11d
push str.SOMAuthNormal::CheckOfficeException_GetFileMajorVersion_Error__
jmp 0x40b07e
push dword [ebp - 0x1c]
lea eax, [ebp]
push eax
push str.CheckOfficeException_File__s__Version__d_
push ebx
push edi
call fcn.00401ae2
mov eax, dword [ebp - 0x1c]
add esp, 0x14
cmp eax, 0xe
jne 0x40b196
push str.SOMWT001
lea eax, [ebp - 0x10]
mov esi, 0x46ee00
push eax
mov ecx, esi
call fcn.00412590
mov edi, eax
and dword [ebp - 4], 0
push str.SOMER052
lea eax, [ebp - 0x14]
push eax
mov ecx, esi
call fcn.00412590
push 0x10
push dword [edi]
push dword [eax]
mov eax, dword [ebp - 0x18]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.004026da
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004026da
xor eax, eax
inc eax
jmp 0x40b08a
cmp eax, 0xf
jne 0x40b1eb
push str.SOMWT001
lea eax, [ebp - 0x14]
mov esi, 0x46ee00
push eax
mov ecx, esi
call fcn.00412590
mov edi, eax
push str.SOMER063
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
mov dword [ebp - 4], 1
call fcn.00412590
push 0x10
push dword [edi]
push dword [eax]
mov eax, dword [ebp - 0x18]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004026da
mov ecx, dword [ebp - 0x14]
jmp 0x40b186
cmp eax, 0xc
jne 0x40b2ed
cmp dword [0x46ca20], 2
jne 0x40b2ba
lea eax, [ebp - 0x14]
push eax
push 0x20019
push esi
push str.SOFTWAREMicrosoftOfficeWordAddInsMSO07EHW.Connect
mov dword [ebp - 0x14], esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
je 0x40b29f
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftOfficeWordAddIns_MSO07EHW.Connect
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
je 0x40b29f
push dword [ebp - 0x14]
push str._RegOpenKeyEx__MSO07EHW.Connect___x_
push ebx
push edi
call fcn.00401ae2
add esp, 0x10
push 0xe
mov ecx, 0x46e5a0
call fcn.004096e7
cmp eax, 1
push str.SOMWT001
lea eax, [ebp - 0x10]
mov ecx, 0x46ee00
push eax
jne 0x40b280
call fcn.00412590
push 0x10
push dword [eax]
push str.This_Version_of_Document_Security_Agent_doesnt_support_Office_2007.
jmp 0x40b28e
call fcn.00412590
push 0x10
push dword [eax]
push str.This_document_doesnt_support_the_version_of_Office_2007.
mov eax, dword [ebp - 0x18]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x40b183
push dword [ebp - 0x14]
push str._RegOpenKeyEx_in___x_
push 0x44f1c8
push edi
call fcn.00403d25
add esp, 0x10
jmp 0x40b088
push 0xe
mov ecx, 0x46e5a0
call fcn.004096e7
test eax, eax
jne 0x40b088
push str._RegOpenKeyEx_Not_DS_ACL_OFFICEX_0
push ebx
push edi
call fcn.00401ae2
add esp, 0xc
push str.SOMWT001
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x46ee00
jmp 0x40b280
cmp eax, 0xb
jne 0x40b088
mov edi, 0x46e5a0
push 0xe
mov ecx, edi
call fcn.004096e7
test eax, eax
je 0x40b088
push str..csv
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x40b088
push 0xd
mov ecx, edi
call fcn.004096e7
test eax, eax
jne 0x40b088
push str.SOMWT001
mov ecx, 0x46ee00
cmp dword [0x46ca1c], esi
jne 0x40b35c
lea eax, [ebp - 0x10]
push eax
call fcn.00412590
push 0x10
push dword [eax]
push 0x452c40
jmp 0x40b28e
lea eax, [ebp - 0x20]
push eax
call fcn.00412590
push 0x10
push dword [eax]
mov eax, dword [ebp - 0x18]
push str.This_document_can_be_accessed_with_Office_2007.
push dword [eax + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 0x20]
jmp 0x40b186