Function at 0x427490
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
lea ebp, [esp - 0x1014]
mov eax, 0x1014
call fcn.0046a1a0
push 0xffffffffffffffff
push 0x48b128
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4bcb20]
xor eax, ebp
mov dword [ebp + 0x1010], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0x101c]
push str.ShellOpenDoc_Start_
mov esi, ecx
call fcn.0041c3c0
push 0x402
xor edi, edi
push edi
push 0x4c1398
call fcn.004683b0
add esp, 0x10
push 0x200
push ebx
push 0x4c1398
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0x400
lea ecx, [ebp + 0x606]
xor eax, eax
push edi
push ecx
mov word [ebp + 0x604], ax
call fcn.004683b0
push 0x400
lea eax, [ebp + 0xa0a]
xor edx, edx
push edi
push eax
mov word [ebp + 0xa08], dx
call fcn.004683b0
add esp, 0x14
mov ecx, esp
mov dword [ebp - 0x2c], esp
push ebx
call fcn.0041afa0
lea ecx, [ebp - 0x24]
call fcn.0042a560
xor ecx, ecx
push 0x200
push ecx
lea edx, [ebp + 0xe0e]
push edx
mov dword [ebp - 4], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x10], edi
mov word [ebp + 0xe0c], cx
call fcn.004683b0
push 0x100
lea eax, [ebp + 0xe0c]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
push ebx
call fcn.0046a4f2
add esp, 0x30
cmp byte [esi + 0xacf], 1
jne 0x4275cd
push str..doc
lea ecx, [ebp + 0xe0c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4275c5
push str..docx
lea edx, [ebp + 0xe0c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4275cd
mov edi, 1
mov dword [ebp - 0x10], edi
movzx eax, byte [esi + 0xacf]
push eax
push edi
push str.ShellOpenDoc_bDocSpecified:_d_m_ODMFileHeader.Authority.ExtVersion:_d
call fcn.0041c3c0
xor ecx, ecx
push 0x3fe
push ecx
lea edx, [ebp + 2]
push edx
mov word [ebp], cx
call fcn.004683b0
add esp, 0x18
cmp byte [esi + 0x95a], 0
je 0x4277a0
test edi, edi
jne 0x4277a0
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str..docx
lea eax, [ebp + 0xe0c]
push eax
call edi
test eax, eax
je 0x42766e
push str..xlsx
lea ecx, [ebp + 0xe0c]
push ecx
call edi
test eax, eax
je 0x42766e
push str..pptx
lea edx, [ebp + 0xe0c]
push edx
call edi
test eax, eax
je 0x42766e
push str..dwg
lea eax, [ebp + 0xe0c]
push eax
call edi
test eax, eax
jne 0x427776
call fcn.0042d210
test eax, eax
je 0x427776
jmp 0x4276e1
lea edx, [ebp + 0xe0c]
push edx
mov ecx, esi
call fcn.00425ad0
test eax, eax
je 0x427776
lea eax, [ebp + 0xa08]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x42769d
xor eax, eax
jmp 0x4276b9
lea edi, [eax + eax]
mov eax, edi
call fcn.00469040
mov eax, esp
push 3
push edi
lea ecx, [ebp + 0xa08]
push ecx
push eax
call fcn.004185e0
push eax
push str.IsCanInject_SvcHost_:_s
call fcn.0041c3c0
add esp, 8
push 0x490828
lea edx, [ebp]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp]
push eax
mov ecx, esi
call fcn.00423b40
mov eax, dword [esi + 0x11dc]
test eax, eax
je 0x4276f2
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [esi + 0x11e4]
test eax, eax
je 0x427738
push 0x2710
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esi + 0x11dc]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x427725
push eax
call edi
mov dword [esi + 0x11dc], 0
mov ecx, dword [esi + 0x11e4]
push ecx
call edi
mov dword [esi + 0x11e4], 0
cmp dword [esi + 0x11dc], 0
jne 0x427755
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x11dc], eax
push 0
push 4
push esi
push 0x423ac0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
mov dword [esi + 0x11e4], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
push 0
call fcn.004273a0
xor edx, edx
add esp, 8
test eax, eax
setg dl
mov esi, edx
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.00428d50
mov eax, esi
jmp 0x427dc5
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
test ebx, ebx
jne 0x4277ae
xor eax, eax
jmp 0x4277d9
push ebx
call edi
inc eax
cmp eax, 0x3fffffff
jle 0x4277bd
xor eax, eax
jmp 0x4277d9
lea edi, [eax + eax]
mov eax, edi
call fcn.00469040
mov eax, esp
push 3
push edi
push ebx
push eax
call fcn.004185e0
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push str.ShellOpenDoc:_pszFileName_s
call fcn.0041c3c0
add esp, 8
lea eax, [ebp - 0x28]
push eax
push 0
lea ecx, [ebp + 0x604]
push ecx
lea edx, [ebp + 0xa08]
push edx
lea ecx, [ebp - 0x24]
call fcn.00429a30
test eax, eax
jne 0x427a76
lea eax, [ebp + 0x604]
push eax
call edi
inc eax
cmp eax, 0x3fffffff
jle 0x427820
xor eax, eax
jmp 0x427842
lea edi, [eax + eax]
mov eax, edi
call fcn.00469040
mov eax, esp
push 3
push edi
lea ecx, [ebp + 0x604]
push ecx
push eax
call fcn.004185e0
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push str.ShellOpenDoc:_GetOpenAppFileEx_szCmdLine_s
call fcn.0041c3c0
add esp, 8
cmp dword [ebp - 0x10], 0
jne 0x427a35
push str..docx
lea edx, [ebp + 0xe0c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4278a0
push str..xlsx
lea eax, [ebp + 0xe0c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4278a0
push str..pptx
lea ecx, [ebp + 0xe0c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x427960
lea edx, [ebp + 0xe0c]
push edx
mov ecx, esi
call fcn.00425ad0
test eax, eax
je 0x427960
lea eax, [ebp + 0xa08]
push eax
call edi
inc eax
cmp eax, 0x3fffffff
jle 0x4278cb
xor eax, eax
jmp 0x4278e7
lea edi, [eax + eax]
mov eax, edi
call fcn.00469040
mov eax, esp
push 3
push edi
lea ecx, [ebp + 0xa08]
push ecx
push eax
call fcn.004185e0
push eax
push str.GetOpenAppFileEx_IsCanInject_SvcHost_:_s
call fcn.0041c3c0
add esp, 8
push 0x490828
lea edx, [ebp]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp]
push eax
mov ecx, esi
call fcn.00423b40
mov eax, dword [esi + 0x11dc]
test eax, eax
je 0x427920
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [esi + 0x11e4]
test eax, eax
je 0x4279de
push 0x2710
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esi + 0x11dc]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x427957
push eax
call edi
mov dword [esi + 0x11dc], 0
mov ecx, dword [esi + 0x11e4]
push ecx
jmp 0x4279d2
push str..dwg
lea edx, [ebp + 0xe0c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x427a1c
call fcn.0042d210
test eax, eax
je 0x427a1c
mov eax, dword [esi + 0x11dc]
test eax, eax
je 0x427998
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [esi + 0x11e4]
test eax, eax
je 0x4279de
push 0x2710
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esi + 0x11dc]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x4279cb
push eax
call edi
mov dword [esi + 0x11dc], 0
mov eax, dword [esi + 0x11e4]
push eax
call edi
mov dword [esi + 0x11e4], 0
cmp dword [esi + 0x11dc], 0
jne 0x4279fb
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x11dc], eax
push 0
push 4
push esi
push 0x423ac0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
mov dword [esi + 0x11e4], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
push 0
call fcn.004273a0
xor ecx, ecx
add esp, 8
test eax, eax
setg cl
mov esi, ecx
jmp 0x42778a
test ebx, ebx
jne 0x427a3d
xor eax, eax
jmp 0x427a68
push ebx
call edi
inc eax
cmp eax, 0x3fffffff
jle 0x427a4c
xor eax, eax
jmp 0x427a68
lea edi, [eax + eax]
mov eax, edi
call fcn.00469040
mov eax, esp
push 3
push edi
push ebx
push eax
call fcn.004185e0
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push str.ShellOpenDoc:_OpenAs_pszFileName_s
call fcn.0041c3c0
add esp, 8
cmp dword [ebp - 0x10], 0
je 0x427b5d
xor edx, edx
push 0x200
push edx
lea eax, [ebp + 0x402]
push eax
mov word [ebp + 0x400], dx
call fcn.004683b0
push 0
push 0
push 0x100
lea ecx, [ebp + 0x400]
push ecx
push 0
push 0
push 0
lea edx, [ebp + 0xa08]
push 0
push edx
call fcn.0046a4f2
add esp, 0x30
push str.winword
lea eax, [ebp + 0x400]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x427b5d
push 1
lea ecx, [ebp - 0x10]
push ecx
mov ecx, 0x4c1874
call fcn.00435490
mov esi, eax
push 0x36
lea edx, [ebp - 0x14]
push edx
mov ecx, 0x4c1874
mov byte [ebp - 4], 1
call fcn.00435490
mov esi, dword [esi]
mov eax, dword [eax]
push 0x10
push esi
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x427b31
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x427db4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x427db4
lea ecx, [ebp + 0xa08]
push ecx
mov ecx, esi
call fcn.004235a0
test eax, eax
jne 0x427c04
push 1
lea edx, [ebp - 0x10]
push edx
mov ecx, 0x4c1874
call fcn.00435490
mov esi, eax
push 0x31
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x4c1874
mov byte [ebp - 4], 2
call fcn.00435490
mov esi, dword [esi]
mov eax, dword [eax]
push 0x10
push esi
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x427bc8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x427beb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp + 0xa08]
push ecx
push 0x491618
call fcn.0041c3c0
add esp, 8
jmp 0x427db4
test ebx, ebx
jne 0x427c0d
mov dword [ebp - 0x10], ebx
jmp 0x427c40
push ebx
call edi
inc eax
cmp eax, 0x3fffffff
jle 0x427c21
mov dword [ebp - 0x10], 0
jmp 0x427c40
lea edi, [eax + eax]
mov eax, edi
call fcn.00469040
mov eax, esp
push 3
push edi
push ebx
push eax
call fcn.004185e0
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x10], eax
lea edx, [ebp + 0x604]
push edx
call edi
inc eax
cmp eax, 0x3fffffff
jle 0x427c5a
mov dword [ebp - 0x14], 0
jmp 0x427c7f
lea edi, [eax + eax]
mov eax, edi
call fcn.00469040
mov eax, esp
push 3
push edi
lea ecx, [ebp + 0x604]
push ecx
push eax
call fcn.004185e0
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x14], eax
lea edx, [ebp + 0xa08]
push edx
call edi
inc eax
cmp eax, 0x3fffffff
jle 0x427c94
xor eax, eax
jmp 0x427cb6
lea edi, [eax + eax]
mov eax, edi
call fcn.00469040
mov eax, esp
push 3
push edi
lea ecx, [ebp + 0xa08]
push ecx
push eax
call fcn.004185e0
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
push edx
push ecx
push eax
push str.ShellOpenDoc:_before_OpenDoc_szDocProcess__s_szCmdLine_s_pszFileName:_s
call fcn.0041c3c0
add esp, 0x10
push ebx
lea edx, [ebp + 0x604]
push edx
lea eax, [ebp + 0xa08]
push eax
mov ecx, esi
call fcn.00423d40
test eax, eax
je 0x427cff
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.00428d50
mov eax, 1
jmp 0x427dc5
xor esi, esi
cmp ebx, esi
jne 0x427d0a
mov dword [ebp - 0x10], esi
jmp 0x427d33
push ebx
call edi
inc eax
cmp eax, 0x3fffffff
jle 0x427d1a
mov dword [ebp - 0x10], esi
jmp 0x427d33
lea esi, [eax + eax]
mov eax, esi
call fcn.00469040
mov eax, esp
push 3
push esi
push ebx
push eax
call fcn.004185e0
mov dword [ebp - 0x10], eax
lea ecx, [ebp + 0x604]
push ecx
call edi
inc eax
cmp eax, 0x3fffffff
jle 0x427d48
xor ebx, ebx
jmp 0x427d66
lea esi, [eax + eax]
mov eax, esi
call fcn.00469040
mov eax, esp
push 3
push esi
lea edx, [ebp + 0x604]
push edx
push eax
call fcn.004185e0
mov ebx, eax
lea eax, [ebp + 0xa08]
push eax
call edi
inc eax
cmp eax, 0x3fffffff
jle 0x427d7b
xor eax, eax
jmp 0x427d97
lea esi, [eax + eax]
mov eax, esi
call fcn.00469040
mov eax, esp
push 3
push esi
lea ecx, [ebp + 0xa08]
push ecx
push eax
call fcn.004185e0
mov edx, dword [ebp - 0x10]
push edx
push ebx
push eax
push str.ShellOpenDoc:_after_OpenDoc_szDocProcess__s_szCmdLine_s_pszFileName:_s
call fcn.0041c3c0
push str.ShellOpenFunction_Finish_
call fcn.0041c3c0
add esp, 0x14
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.00428d50
xor eax, eax
lea esp, [ebp - 0x3c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1010]
xor ecx, ebp
call fcn.00469030
add ebp, 0x1014
mov esp, ebp
pop ebp
ret 4