Function at 0x429200
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
lea ebp, [esp - 0x1014]
mov eax, 0x1014
call fcn.0046c720
push 0xffffffffffffffff
push 0x48f500
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x4c2b20]
xor eax, ebp
mov dword [ebp + 0x1010], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0x101c]
push str.ShellOpenDoc_Start_
mov esi, ecx
call fcn.0042fa80
push 0x402
xor edi, edi
push edi
push 0x4c7398
call fcn.0046a930
add esp, 0x10
push 0x200
push ebx
push 0x4c7398
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0x400
lea ecx, [ebp + 0x606]
xor eax, eax
push edi
push ecx
mov word [ebp + 0x604], ax
call fcn.0046a930
push 0x400
lea eax, [ebp + 0xa0a]
xor edx, edx
push edi
push eax
mov word [ebp + 0xa08], dx
call fcn.0046a930
add esp, 0x14
mov ecx, esp
mov dword [ebp - 0x20], esp
push ebx
call fcn.0041af70
lea ecx, [ebp - 0x38]
call fcn.0042cd80
xor ecx, ecx
push 0x200
push ecx
lea edx, [ebp + 0xe0e]
push edx
mov dword [ebp - 4], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x10], edi
mov word [ebp + 0xe0c], cx
call fcn.0046a930
push 0x100
lea eax, [ebp + 0xe0c]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
push ebx
call fcn.0046ca72
add esp, 0x30
cmp byte [esi + 0xacf], 1
jne 0x42933d
push str..doc
lea ecx, [ebp + 0xe0c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x429335
push str..docx
lea edx, [ebp + 0xe0c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x42933d
mov edi, 1
mov dword [ebp - 0x10], edi
movzx eax, byte [esi + 0xacf]
push eax
push edi
push str.ShellOpenDoc_bDocSpecified:_d_m_ODMFileHeader.Authority.ExtVersion:_d
call fcn.0042fa80
xor ecx, ecx
push 0x3fe
push ecx
lea edx, [ebp + 2]
push edx
mov word [ebp], cx
call fcn.0046a930
add esp, 0x18
cmp byte [esi + 0x95a], 0
je 0x429692
test edi, edi
jne 0x429692
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str..docx
lea eax, [ebp + 0xe0c]
push eax
call edi
test eax, eax
je 0x4293de
push str..xlsx
lea ecx, [ebp + 0xe0c]
push ecx
call edi
test eax, eax
je 0x4293de
push str..pptx
lea edx, [ebp + 0xe0c]
push edx
call edi
test eax, eax
je 0x4293de
push str..dwg
lea eax, [ebp + 0xe0c]
push eax
call edi
test eax, eax
jne 0x4294f2
call fcn.0042fa30
test eax, eax
je 0x4294f2
jmp 0x429457
lea edx, [ebp + 0xe0c]
push edx
mov ecx, esi
call fcn.00426170
test eax, eax
je 0x4294f2
lea eax, [ebp + 0xa08]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x42940d
xor eax, eax
jmp 0x42942f
lea edi, [eax + eax]
mov eax, edi
call fcn.0046b5c0
mov eax, esp
push 3
push edi
lea ecx, [ebp + 0xa08]
push ecx
push eax
call fcn.004185d0
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push eax
push str.IsCanInject_SvcHost_:_s
call fcn.0042fa80
add esp, 8
push 0x495830
lea edx, [ebp]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp]
push eax
mov ecx, esi
call fcn.004241d0
mov eax, dword [esi + 0x11dc]
test eax, eax
je 0x429468
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [esi + 0x11e4]
test eax, eax
je 0x4294b4
push 0x2710
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esi + 0x11dc]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x42949b
push eax
call edi
mov dword [esi + 0x11dc], 0
mov ecx, dword [esi + 0x11e4]
push ecx
call edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov dword [esi + 0x11e4], 0
cmp dword [esi + 0x11dc], 0
jne 0x4294d1
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x11dc], eax
push 0
push 4
push esi
push 0x424150
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
mov dword [esi + 0x11e4], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
push 0
call fcn.004290a0
add esp, 8
push str..docx
lea edx, [ebp + 0xe0c]
push edx
mov dword [ebp - 0x18], eax
call edi
test eax, eax
je 0x429528
push str..doc
lea eax, [ebp + 0xe0c]
push eax
call edi
test eax, eax
jne 0x429672
push ecx
lea edx, [ebp + 0xe0c]
mov ecx, esp
mov dword [ebp - 0x14], esp
push edx
call fcn.0041af70
lea eax, [ebp - 0x10]
push eax
call fcn.004264b0
add esp, 8
push 0x496dd0
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.0041acd0
mov bl, 2
push 0x496dd0
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], bl
call fcn.0041acd0
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x24]
push edx
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 3
call fcn.0041c610
lea ecx, [ebp - 0x1c]
push ecx
push eax
lea edx, [ebp - 0x20]
push edx
mov byte [ebp - 4], 4
call fcn.0041c610
add esp, 0x18
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 5
call fcn.0041a940
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
mov byte [ebp - 4], 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4295c3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
mov byte [ebp - 4], 3
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4295e6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x24]
add eax, 0xfffffff0
mov byte [ebp - 4], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x429608
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
mov byte [ebp - 4], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42962b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x10]
push 1
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x14], esp
mov esi, esp
push eax
call fcn.0041a0b0
add eax, 0x10
add esp, 4
mov dword [esi], eax
call fcn.0042b970
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x429672
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor ecx, ecx
cmp dword [ebp - 0x18], ecx
mov dword [ebp - 4], 0xffffffff
setg cl
mov esi, ecx
lea ecx, [ebp - 0x38]
call fcn.0042aab0
mov eax, esi
jmp 0x429cc8
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
test ebx, ebx
jne 0x4296a0
xor eax, eax
jmp 0x4296cb
push ebx
call edi
inc eax
cmp eax, 0x3fffffff
jle 0x4296af
xor eax, eax
jmp 0x4296cb
lea edi, [eax + eax]
mov eax, edi
call fcn.0046b5c0
mov eax, esp
push 3
push edi
push ebx
push eax
call fcn.004185d0
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push str.ShellOpenDoc:_pszFileName_s
call fcn.0042fa80
add esp, 8
lea edx, [ebp - 0x28]
push edx
push 0
lea eax, [ebp + 0x604]
push eax
lea ecx, [ebp + 0xa08]
push ecx
lea ecx, [ebp - 0x38]
call fcn.0042c000
test eax, eax
jne 0x429979
lea edx, [ebp + 0x604]
push edx
call edi
inc eax
cmp eax, 0x3fffffff
jle 0x429712
xor eax, eax
jmp 0x429734
lea edi, [eax + eax]
mov eax, edi
call fcn.0046b5c0
mov eax, esp
push 3
push edi
lea ecx, [ebp + 0x604]
push ecx
push eax
call fcn.004185d0
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push str.ShellOpenDoc:_GetOpenAppFileEx_szCmdLine_s
call fcn.0042fa80
add esp, 8
cmp dword [ebp - 0x10], 0
jne 0x429938
push str..docx
lea edx, [ebp + 0xe0c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x429792
push str..xlsx
lea eax, [ebp + 0xe0c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x429792
push str..pptx
lea ecx, [ebp + 0xe0c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x429852
lea edx, [ebp + 0xe0c]
push edx
mov ecx, esi
call fcn.00426170
test eax, eax
je 0x429852
lea eax, [ebp + 0xa08]
push eax
call edi
inc eax
cmp eax, 0x3fffffff
jle 0x4297bd
xor eax, eax
jmp 0x4297d9
lea edi, [eax + eax]
mov eax, edi
call fcn.0046b5c0
mov eax, esp
push 3
push edi
lea ecx, [ebp + 0xa08]
push ecx
push eax
call fcn.004185d0
push eax
push str.GetOpenAppFileEx_IsCanInject_SvcHost_:_s
call fcn.0042fa80
add esp, 8
push 0x495830
lea edx, [ebp]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp]
push eax
mov ecx, esi
call fcn.004241d0
mov eax, dword [esi + 0x11dc]
test eax, eax
je 0x429812
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [esi + 0x11e4]
test eax, eax
je 0x4298d0
push 0x2710
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esi + 0x11dc]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x429849
push eax
call edi
mov dword [esi + 0x11dc], 0
mov ecx, dword [esi + 0x11e4]
push ecx
jmp 0x4298c4
push str..dwg
lea edx, [ebp + 0xe0c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x42990e
call fcn.0042fa30
test eax, eax
je 0x42990e
mov eax, dword [esi + 0x11dc]
test eax, eax
je 0x42988a
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [esi + 0x11e4]
test eax, eax
je 0x4298d0
push 0x2710
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esi + 0x11dc]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x4298bd
push eax
call edi
mov dword [esi + 0x11dc], 0
mov eax, dword [esi + 0x11e4]
push eax
call edi
mov dword [esi + 0x11e4], 0
cmp dword [esi + 0x11dc], 0
jne 0x4298ed
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x11dc], eax
push 0
push 4
push esi
push 0x424150
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
mov dword [esi + 0x11e4], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
push 0
call fcn.004290a0
xor ecx, ecx
add esp, 8
test eax, eax
setg cl
mov dword [ebp - 4], 0xffffffff
mov esi, ecx
lea ecx, [ebp - 0x38]
call fcn.0042aab0
mov eax, esi
jmp 0x429cc8
test ebx, ebx
jne 0x429940
xor eax, eax
jmp 0x42996b
push ebx
call edi
inc eax
cmp eax, 0x3fffffff
jle 0x42994f
xor eax, eax
jmp 0x42996b
lea edi, [eax + eax]
mov eax, edi
call fcn.0046b5c0
mov eax, esp
push 3
push edi
push ebx
push eax
call fcn.004185d0
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push str.ShellOpenDoc:_OpenAs_pszFileName_s
call fcn.0042fa80
add esp, 8
cmp dword [ebp - 0x10], 0
je 0x429a60
xor edx, edx
push 0x200
push edx
lea eax, [ebp + 0x402]
push eax
mov word [ebp + 0x400], dx
call fcn.0046a930
push 0
push 0
push 0x100
lea ecx, [ebp + 0x400]
push ecx
push 0
push 0
push 0
lea edx, [ebp + 0xa08]
push 0
push edx
call fcn.0046ca72
add esp, 0x30
push str.winword
lea eax, [ebp + 0x400]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x429a60
push 1
lea ecx, [ebp - 0x14]
push ecx
mov ecx, 0x4c77cc
call fcn.00437870
mov esi, eax
push 0x36
lea edx, [ebp - 0x18]
push edx
mov ecx, 0x4c77cc
mov byte [ebp - 4], 6
call fcn.00437870
mov esi, dword [esi]
mov eax, dword [eax]
push 0x10
push esi
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x429a34
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x429cb7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x429cb7
lea ecx, [ebp + 0xa08]
push ecx
mov ecx, esi
call fcn.00423bd0
test eax, eax
jne 0x429b07
push 1
lea edx, [ebp - 0x14]
push edx
mov ecx, 0x4c77cc
call fcn.00437870
mov esi, eax
push 0x31
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x4c77cc
mov byte [ebp - 4], 7
call fcn.00437870
mov esi, dword [esi]
mov eax, dword [eax]
push 0x10
push esi
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x429acb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x429aee
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp + 0xa08]
push ecx
push 0x4967e8
call fcn.0042fa80
add esp, 8
jmp 0x429cb7
test ebx, ebx
jne 0x429b10
mov dword [ebp - 0x10], ebx
jmp 0x429b43
push ebx
call edi
inc eax
cmp eax, 0x3fffffff
jle 0x429b24
mov dword [ebp - 0x10], 0
jmp 0x429b43
lea edi, [eax + eax]
mov eax, edi
call fcn.0046b5c0
mov eax, esp
push 3
push edi
push ebx
push eax
call fcn.004185d0
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x10], eax
lea edx, [ebp + 0x604]
push edx
call edi
inc eax
cmp eax, 0x3fffffff
jle 0x429b5d
mov dword [ebp - 0x1c], 0
jmp 0x429b82
lea edi, [eax + eax]
mov eax, edi
call fcn.0046b5c0
mov eax, esp
push 3
push edi
lea ecx, [ebp + 0x604]
push ecx
push eax
call fcn.004185d0
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x1c], eax
lea edx, [ebp + 0xa08]
push edx
call edi
inc eax
cmp eax, 0x3fffffff
jle 0x429b97
xor eax, eax
jmp 0x429bb9
lea edi, [eax + eax]
mov eax, edi
call fcn.0046b5c0
mov eax, esp
push 3
push edi
lea ecx, [ebp + 0xa08]
push ecx
push eax
call fcn.004185d0
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
push edx
push ecx
push eax
push str.ShellOpenDoc:_before_OpenDoc_szDocProcess__s_szCmdLine_s_pszFileName:_s
call fcn.0042fa80
add esp, 0x10
push ebx
lea edx, [ebp + 0x604]
push edx
lea eax, [ebp + 0xa08]
push eax
mov ecx, esi
call fcn.004243d0
test eax, eax
je 0x429c02
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0xffffffff
call fcn.0042aab0
mov eax, 1
jmp 0x429cc8
xor esi, esi
cmp ebx, esi
jne 0x429c0d
mov dword [ebp - 0x10], esi
jmp 0x429c36
push ebx
call edi
inc eax
cmp eax, 0x3fffffff
jle 0x429c1d
mov dword [ebp - 0x10], esi
jmp 0x429c36
lea esi, [eax + eax]
mov eax, esi
call fcn.0046b5c0
mov eax, esp
push 3
push esi
push ebx
push eax
call fcn.004185d0
mov dword [ebp - 0x10], eax
lea ecx, [ebp + 0x604]
push ecx
call edi
inc eax
cmp eax, 0x3fffffff
jle 0x429c4b
xor ebx, ebx
jmp 0x429c69
lea esi, [eax + eax]
mov eax, esi
call fcn.0046b5c0
mov eax, esp
push 3
push esi
lea edx, [ebp + 0x604]
push edx
push eax
call fcn.004185d0
mov ebx, eax
lea eax, [ebp + 0xa08]
push eax
call edi
inc eax
cmp eax, 0x3fffffff
jle 0x429c7e
xor eax, eax
jmp 0x429c9a
lea esi, [eax + eax]
mov eax, esi
call fcn.0046b5c0
mov eax, esp
push 3
push esi
lea ecx, [ebp + 0xa08]
push ecx
push eax
call fcn.004185d0
mov edx, dword [ebp - 0x10]
push edx
push ebx
push eax
push str.ShellOpenDoc:_after_OpenDoc_szDocProcess__s_szCmdLine_s_pszFileName:_s
call fcn.0042fa80
push str.ShellOpenFunction_Finish_
call fcn.0042fa80
add esp, 0x14
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0xffffffff
call fcn.0042aab0
xor eax, eax
lea esp, [ebp - 0x48]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1010]
xor ecx, ebp
call fcn.0046b5b0
add ebp, 0x1014
mov esp, ebp
pop ebp
ret 4