Function at 0x100029f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100270e9
mov eax, dword fs:[0]
push eax
mov eax, 0x1270
call fcn.10012e60
mov eax, dword [0x100351e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0x28]
mov ebx, dword [ebp + 0x2c]
mov dword [ebp - 0x1244], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1240], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x125c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1258], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x1254], eax
mov eax, dword [ebp + 0x30]
push 0x1002a838
mov dword [ebp - 0x1270], esi
mov dword [ebp - 0x124c], edi
mov dword [ebp - 0x126c], ebx
mov dword [ebp - 0x1250], eax
call fcn.1000e820
push dword [ebp - 0x1240]
push str.lpApplicationName_s._r_n
call fcn.1000e820
push esi
push str.lpCommandLine_s._r_n
call fcn.1000e820
push dword [ebp - 0x125c]
push str.lpProcessAttributes_p._r_n
call fcn.1000e820
push dword [ebp - 0x1258]
push str.lpThreadAttributes_p._r_n
call fcn.1000e820
push dword [ebp + 0x1c]
push str.bInheritHandles_d._r_n
call fcn.1000e820
push dword [ebp + 0x20]
push str.dwCreationFlags_d._r_n
call fcn.1000e820
push dword [ebp - 0x1254]
push str.lpEnvironment_d._r_n
call fcn.1000e820
push edi
push str.lpCurrentDirectory_s._r_n
call fcn.1000e820
add esp, 0x44
push dword [ebx + 8]
push str.lpStartupInfo.lpDesktop_s._r_n
call fcn.1000e820
push dword [ebx + 0xc]
push str.lpStartupInfo.lpTitle_s._r_n
call fcn.1000e820
push dword [ebx + 0x2c]
push str.lpStartupInfo.dwFlags_u._r_n
call fcn.1000e820
movzx eax, word [ebx + 0x30]
push eax
push str.lpStartupInfo.wShowWindow_u._r_n
call fcn.1000e820
push str._r_n
call fcn.1000e820
push str._r_n
call fcn.1000e820
push str._r_n
call fcn.1000e820
add esp, 0x2c
cmp dword [ebp - 0x1244], 0
je 0x10002fff
test esi, esi
je 0x10002fff
test edi, edi
je 0x10002fff
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x10002fff
call fcn.1000e920
test eax, eax
jne 0x10002b8d
push str.Create_IsAutoDetectPdfAssoc_is_False
call fcn.1000e820
add esp, 4
jmp 0x10002fff
call fcn.1000eb00
test eax, eax
jne 0x10002ba8
push str.Create_IsShellPdfAssoc_is_False
call fcn.1000e820
add esp, 4
jmp 0x10002fff
lea eax, [ebp - 0x122c]
push eax
call fcn.10002940
push dword [ebp - 0x122c]
mov dword [ebp - 4], 0
push str.strApp_s._r_n
call fcn.1000e820
mov eax, dword [ebp - 0x122c]
add esp, 8
cmp dword [eax - 0xc], 0
jne 0x10002c02
lea edx, [eax - 0x10]
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10002fff
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x10002fff
push str..exe
lea ecx, [ebp - 0x1224]
call fcn.10001cd0
mov byte [ebp - 0x1238], 0
lea eax, [ebp - 0x1220]
push dword [ebp - 0x1238]
lea ecx, [ebp - 0x1268]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x1224]
mov dword [ebp - 0x1268], 0
push eax
mov dword [ebp - 0x1264], 0
mov dword [ebp - 0x1260], 0
call fcn.100018e0
push fcn.10001e00
push 1
push 4
lea eax, [ebp - 0x1224]
mov byte [ebp - 4], 3
push eax
call fcn.100129d8
mov ecx, dword [ebp - 0x1240]
lea eax, [ebp - 0x1268]
push eax
test ecx, ecx
mov eax, esi
cmovne eax, ecx
push eax
lea eax, [ebp - 0x1230]
push eax
call fcn.10002570
push dword [ebp - 0x122c]
mov byte [ebp - 4], 4
push dword [ebp - 0x1230]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x10002dc6
push dword [ebp - 0x1230]
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea ecx, [ebp - 0x1228]
call fcn.10001cd0
mov eax, dword [ebp - 0x1228]
mov byte [ebp - 4], 5
cmp dword [eax - 4], 1
jle 0x10002cee
push dword [eax - 0xc]
lea ecx, [ebp - 0x1228]
call fcn.100027e0
mov eax, dword [ebp - 0x1228]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
mov eax, dword [ebp - 0x1228]
cmp dword [eax - 0xc], 0
je 0x10002fe1
push ecx
lea eax, [ebp - 0x1228]
mov ecx, esp
push eax
call fcn.10001ca0
call fcn.10003e70
test eax, eax
je 0x10002fe1
push str..pdf
lea ecx, [ebp - 0x1224]
call fcn.10001cd0
lea eax, [ebp - 0x1239]
mov byte [ebp - 4], 6
push eax
lea ecx, [ebp - 0x1220]
push ecx
lea edx, [ebp - 0x1224]
push edx
lea ecx, [ebp - 0x127c]
call fcn.10001dc0
push fcn.10001e00
push 1
push 4
lea eax, [ebp - 0x1224]
mov byte [ebp - 4], 8
push eax
call fcn.100129d8
lea eax, [ebp - 0x127c]
push eax
push esi
lea eax, [ebp - 0x1234]
push eax
call fcn.10002570
push dword [ebp - 0x1234]
mov byte [ebp - 4], 9
push str.FindPathInParameters_strPicPath_s_
call fcn.1000e820
mov eax, dword [ebp - 0x1234]
add esp, 8
cmp dword [eax - 0xc], 0
jne 0x10002df3
lea ecx, [ebp - 0x1234]
call fcn.10001e00
lea ecx, [ebp - 0x127c]
call fcn.10001e90
lea ecx, [ebp - 0x1228]
call fcn.10001e00
lea ecx, [ebp - 0x1230]
call fcn.10001e00
lea ecx, [ebp - 0x1268]
call fcn.10001e90
lea ecx, [ebp - 0x122c]
mov dword [ebp - 4], 0xffffffff
call fcn.10001e00
jmp 0x10002fff
xor edi, edi
lea eax, [ebp - 0x1220]
push 0x1000
push edi
push eax
xor esi, esi
mov dword [ebp - 0x1224], edi
call fcn.10015970
add esp, 0xc
lea eax, [ebp - 0x1220]
push edi
push eax
push 0x400
push edi
call dword [sym.imp.KERNEL32.dll_RtlCaptureStackBackTrace]
movzx eax, ax
mov ecx, 1
cmp cx, ax
jae 0x10002f17
dec eax
lea edi, [ebp - 0x121c]
movzx eax, ax
mov dword [ebp - 0x1238], eax
nop word [eax + eax]
lea eax, [ebp - 0x1248]
mov dword [ebp - 0x1248], 0
push eax
push dword [edi]
push 6
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
mov ebx, dword [ebp - 0x1248]
test ebx, ebx
je 0x10002efb
push 0x210
lea eax, [ebp - 0x220]
push 0
push eax
call fcn.10015970
add esp, 0xc
lea eax, [ebp - 0x220]
push 0x108
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x220]
push eax
call fcn.10003c30
mov ecx, dword [ebp - 0x1224]
test eax, eax
mov eax, 1
cmove ecx, eax
lea eax, [ebp - 0x220]
push eax
mov dword [ebp - 0x1224], ecx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov ebx, eax
test ebx, ebx
je 0x10002efb
push ebx
push str.CallStack_pszModule_s_
call fcn.1000e820
add esp, 8
push str.user32.dll
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
mov eax, 1
cmove esi, eax
add edi, 4
sub dword [ebp - 0x1238], 1
jne 0x10002e50
mov edi, dword [ebp - 0x1224]
mov ebx, dword [ebp - 0x126c]
push edi
push esi
push str.CheckModule_bUsedUser32___d__bUsedThridModule___d_
call fcn.1000e820
add esp, 0xc
test esi, esi
jne 0x10002f88
lea ecx, [ebp - 0x1224]
call fcn.10001d90
push dword [ebp - 0x1234]
lea eax, [ebp - 0x1224]
mov byte [ebp - 4], 0xa
push dword [ebp - 0x122c]
push str.__s____s_
push eax
call fcn.10002870
mov edi, dword [ebp - 0x124c]
add esp, 0x10
push dword [ebp - 0x1250]
push ebx
push edi
push esi
push esi
push esi
push esi
push esi
push dword [ebp - 0x1224]
push esi
call dword [ebp - 0x1244]
lea ecx, [ebp - 0x1224]
mov esi, eax
call fcn.10001e00
jmp 0x10002f90
mov edi, dword [ebp - 0x124c]
xor esi, esi
lea ecx, [ebp - 0x1234]
call fcn.10001e00
lea ecx, [ebp - 0x127c]
call fcn.10001e90
lea ecx, [ebp - 0x1228]
call fcn.10001e00
lea ecx, [ebp - 0x1230]
call fcn.10001e00
lea ecx, [ebp - 0x1268]
call fcn.10001e90
lea ecx, [ebp - 0x122c]
mov dword [ebp - 4], 0xffffffff
call fcn.10001e00
test esi, esi
je 0x10002ff9
mov eax, esi
jmp 0x1000302c
push dword [ebp - 0x1230]
push str._NeedHook.__s__r_n
call fcn.1000e820
add esp, 8
jmp 0x10002dbb
mov esi, dword [ebp - 0x1270]
push dword [ebp - 0x1250]
push ebx
push edi
push dword [ebp - 0x1254]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp - 0x1258]
push dword [ebp - 0x125c]
push esi
push dword [ebp - 0x1240]
call dword [ebp - 0x1244]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10012e1a
mov esp, ebp
pop ebp
ret 0x2c