Function at 0x41ea90
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
lea ebp, [esp - 0x1014]
mov eax, 0x1014
call fcn.00462080
push 0xffffffffffffffff
push 0x484f70
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x4b7b70]
xor eax, ebp
mov dword [ebp + 0x1010], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0x101c]
push str.ShellOpenDoc_Start_
mov esi, ecx
call fcn.00424af0
push 0x402
xor edi, edi
push edi
push 0x4bc3d8
mov dword [0x4bc3d4], esi
call fcn.00460290
add esp, 0x10
push 0x200
push ebx
push 0x4bc3d8
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0x4bc3d8
call fcn.00462de6
push 0x400
lea ecx, [ebp + 0x606]
xor eax, eax
push edi
push ecx
mov word [ebp + 0x604], ax
call fcn.00460290
push 0x400
lea eax, [ebp + 0xa0a]
xor edx, edx
push edi
push eax
mov word [ebp + 0xa08], dx
call fcn.00460290
add esp, 0x18
mov ecx, esp
mov dword [ebp - 0x2c], esp
push ebx
call fcn.00411f10
lea ecx, [ebp - 0x28]
call fcn.004220c0
push 0x200
lea edx, [ebp + 0xe0e]
xor ecx, ecx
push edi
push edx
mov dword [ebp - 4], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x10], edi
mov word [ebp + 0xe0c], cx
call fcn.00460290
push 0x100
lea eax, [ebp + 0xe0c]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
push ebx
call fcn.004623d2
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
add esp, 0x30
cmp byte [esi + 0xac3], 1
jne 0x41ebda
push str..doc
lea ecx, [ebp + 0xe0c]
push ecx
call edi
test eax, eax
je 0x41ebd3
push str..docx
lea edx, [ebp + 0xe0c]
push edx
call edi
test eax, eax
jne 0x41ebda
mov dword [ebp - 0x10], 1
movzx eax, byte [esi + 0xac3]
mov ecx, dword [ebp - 0x10]
push eax
push ecx
push str.ShellOpenDoc_bDocSpecified:_d_m_ODMFileHeader.Authority.ExtVersion:_d
call fcn.00424af0
xor edx, edx
push 0x3fe
push edx
lea eax, [ebp + 2]
push eax
mov word [ebp], dx
call fcn.00460290
add esp, 0x18
cmp byte [esi + 0x94e], 0
je 0x41edac
cmp dword [ebp - 0x10], 0
jne 0x41edac
push str..docx
lea ecx, [ebp + 0xe0c]
push ecx
call edi
test eax, eax
je 0x41ec7a
push str..xlsx
lea edx, [ebp + 0xe0c]
push edx
call edi
test eax, eax
je 0x41ec7a
push str..pptx
lea eax, [ebp + 0xe0c]
push eax
call edi
test eax, eax
je 0x41ec7a
push str..dwg
lea ecx, [ebp + 0xe0c]
push ecx
call edi
test eax, eax
jne 0x41ed82
call fcn.00424ab0
test eax, eax
je 0x41ed82
jmp 0x41eced
lea eax, [ebp + 0xe0c]
push eax
mov ecx, esi
call fcn.0041c1a0
test eax, eax
je 0x41ed82
lea ecx, [ebp + 0xa08]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x41eca9
xor eax, eax
jmp 0x41ecc5
lea edi, [eax + eax]
mov eax, edi
call fcn.00460f20
mov eax, esp
push 3
push edi
lea edx, [ebp + 0xa08]
push edx
push eax
call fcn.0040f410
push eax
push str.IsCanInject_SvcHost_:_s
call fcn.00424af0
add esp, 8
push str.ODMHook.dll
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea ecx, [ebp]
push ecx
mov ecx, esi
call fcn.0041ad80
mov eax, dword [esi + 0x11d0]
test eax, eax
je 0x41ecfe
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [esi + 0x11d8]
test eax, eax
je 0x41ed44
push 0x2710
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esi + 0x11d0]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x41ed31
push eax
call edi
mov dword [esi + 0x11d0], 0
mov edx, dword [esi + 0x11d8]
push edx
call edi
mov dword [esi + 0x11d8], 0
cmp dword [esi + 0x11d0], 0
jne 0x41ed61
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x11d0], eax
push 0
push 4
push esi
push 0x41ad00
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
mov dword [esi + 0x11d8], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
push 0
call fcn.0041e910
xor ecx, ecx
add esp, 8
test eax, eax
setg cl
mov dword [ebp - 4], 0xffffffff
mov esi, ecx
lea ecx, [ebp - 0x28]
call fcn.004205b0
mov eax, esi
jmp 0x41f3de
test ebx, ebx
jne 0x41edb4
xor eax, eax
jmp 0x41ede3
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x41edc7
xor eax, eax
jmp 0x41ede3
lea edi, [eax + eax]
mov eax, edi
call fcn.00460f20
mov eax, esp
push 3
push edi
push ebx
push eax
call fcn.0040f410
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push eax
push str.ShellOpenDoc:_pszFileName_s
call fcn.00424af0
add esp, 8
lea edx, [ebp - 0x18]
push edx
push 0
lea eax, [ebp + 0x604]
push eax
lea ecx, [ebp + 0xa08]
push ecx
lea ecx, [ebp - 0x28]
call fcn.00421510
test eax, eax
jne 0x41f092
lea edx, [ebp + 0x604]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x41ee2e
xor eax, eax
jmp 0x41ee50
lea edi, [eax + eax]
mov eax, edi
call fcn.00460f20
mov eax, esp
push 3
push edi
lea ecx, [ebp + 0x604]
push ecx
push eax
call fcn.0040f410
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push eax
push str.ShellOpenDoc:_GetOpenAppFileEx_szCmdLine_s
call fcn.00424af0
add esp, 8
cmp dword [ebp - 0x10], 0
jne 0x41f04d
push str..docx
lea edx, [ebp + 0xe0c]
push edx
call edi
test eax, eax
je 0x41eea2
push str..xlsx
lea eax, [ebp + 0xe0c]
push eax
call edi
test eax, eax
je 0x41eea2
push str..pptx
lea ecx, [ebp + 0xe0c]
push ecx
call edi
test eax, eax
jne 0x41ef6c
lea edx, [ebp + 0xe0c]
push edx
mov ecx, esi
call fcn.0041c1a0
test eax, eax
je 0x41ef6c
lea eax, [ebp + 0xa08]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x41eed1
xor eax, eax
jmp 0x41eef3
lea edi, [eax + eax]
mov eax, edi
call fcn.00460f20
mov eax, esp
push 3
push edi
lea ecx, [ebp + 0xa08]
push ecx
push eax
call fcn.0040f410
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push eax
push str.GetOpenAppFileEx_IsCanInject_SvcHost_:_s
call fcn.00424af0
add esp, 8
push str.ODMHook.dll
lea edx, [ebp]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp]
push eax
mov ecx, esi
call fcn.0041ad80
mov eax, dword [esi + 0x11d0]
test eax, eax
je 0x41ef2c
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [esi + 0x11d8]
test eax, eax
je 0x41efec
push 0x2710
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esi + 0x11d0]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x41ef63
push eax
call edi
mov dword [esi + 0x11d0], 0
mov ecx, dword [esi + 0x11d8]
push ecx
jmp 0x41efda
push str..dwg
lea edx, [ebp + 0xe0c]
push edx
call edi
test eax, eax
jne 0x41f02a
call fcn.00424ab0
test eax, eax
je 0x41f02a
mov eax, dword [esi + 0x11d0]
test eax, eax
je 0x41efa0
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [esi + 0x11d8]
test eax, eax
je 0x41efec
push 0x2710
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esi + 0x11d0]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x41efd3
push eax
call edi
mov dword [esi + 0x11d0], 0
mov eax, dword [esi + 0x11d8]
push eax
call edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov dword [esi + 0x11d8], 0
cmp dword [esi + 0x11d0], 0
jne 0x41f009
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x11d0], eax
push 0
push 4
push esi
push 0x41ad00
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
mov dword [esi + 0x11d8], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea ecx, [ebp - 0x3c]
call fcn.00415820
push ebx
push 0
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 1
call fcn.0041c5a0
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0
call fcn.004158d0
test ebx, ebx
jne 0x41f055
xor eax, eax
jmp 0x41f084
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x41f068
xor eax, eax
jmp 0x41f084
lea edi, [eax + eax]
mov eax, edi
call fcn.00460f20
mov eax, esp
push 3
push edi
push ebx
push eax
call fcn.0040f410
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push eax
push str.ShellOpenDoc:_OpenAs_pszFileName_s
call fcn.00424af0
add esp, 8
cmp dword [ebp - 0x10], 0
je 0x41f175
xor ecx, ecx
push 0x200
push ecx
lea edx, [ebp + 0x402]
push edx
mov word [ebp + 0x400], cx
call fcn.00460290
push 0
push 0
push 0x100
lea eax, [ebp + 0x400]
push eax
push 0
push 0
push 0
lea ecx, [ebp + 0xa08]
push 0
push ecx
call fcn.004623d2
add esp, 0x30
push str.winword
lea edx, [ebp + 0x400]
push edx
call edi
test eax, eax
je 0x41f175
push 1
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x4bc81c
call fcn.0042d910
mov esi, eax
push 0x36
lea ecx, [ebp - 0x14]
push ecx
mov ecx, 0x4bc81c
mov byte [ebp - 4], 2
call fcn.0042d910
mov esi, dword [esi]
mov eax, dword [eax]
push 0x10
push esi
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41f149
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41f3cd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x41f3cd
lea ecx, [ebp + 0xa08]
push ecx
mov ecx, esi
call fcn.0041a7d0
test eax, eax
jne 0x41f21c
push 1
lea edx, [ebp - 0x10]
push edx
mov ecx, 0x4bc81c
call fcn.0042d910
mov esi, eax
push 0x31
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x4bc81c
mov byte [ebp - 4], 3
call fcn.0042d910
mov esi, dword [esi]
mov eax, dword [eax]
push 0x10
push esi
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41f1e0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41f203
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp + 0xa08]
push ecx
push 0x48bbd4
call fcn.00424af0
add esp, 8
jmp 0x41f3cd
xor edi, edi
cmp ebx, edi
jne 0x41f227
mov dword [ebp - 0x10], edi
jmp 0x41f254
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x41f23b
mov dword [ebp - 0x10], edi
jmp 0x41f254
lea edi, [eax + eax]
mov eax, edi
call fcn.00460f20
mov eax, esp
push 3
push edi
push ebx
push eax
call fcn.0040f410
mov dword [ebp - 0x10], eax
lea edx, [ebp + 0x604]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x41f272
mov dword [ebp - 0x14], 0
jmp 0x41f291
lea edi, [eax + eax]
mov eax, edi
call fcn.00460f20
mov eax, esp
push 3
push edi
lea ecx, [ebp + 0x604]
push ecx
push eax
call fcn.0040f410
mov dword [ebp - 0x14], eax
lea edx, [ebp + 0xa08]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x41f2aa
xor eax, eax
jmp 0x41f2c6
lea edi, [eax + eax]
mov eax, edi
call fcn.00460f20
mov eax, esp
push 3
push edi
lea ecx, [ebp + 0xa08]
push ecx
push eax
call fcn.0040f410
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
push edx
push ecx
push eax
push str.ShellOpenDoc:_before_OpenDoc_szDocProcess__s_szCmdLine_s_pszFileName:_s
call fcn.00424af0
mov edx, dword [ebp + 0x1020]
add esp, 0x10
push 1
push edx
push ebx
lea eax, [ebp + 0x604]
push eax
lea ecx, [ebp + 0xa08]
push ecx
mov ecx, esi
call fcn.0041c5f0
test eax, eax
je 0x41f318
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0xffffffff
call fcn.004205b0
mov eax, 1
jmp 0x41f3de
test ebx, ebx
je 0x41f347
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x41f32f
xor ebx, ebx
jmp 0x41f347
lea esi, [eax + eax]
mov eax, esi
call fcn.00460f20
mov eax, esp
push 3
push esi
push ebx
push eax
call fcn.0040f410
mov ebx, eax
lea edx, [ebp + 0x604]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x41f360
xor edi, edi
jmp 0x41f37e
lea esi, [eax + eax]
mov eax, esi
call fcn.00460f20
mov eax, esp
push 3
push esi
lea ecx, [ebp + 0x604]
push ecx
push eax
call fcn.0040f410
mov edi, eax
lea edx, [ebp + 0xa08]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x41f397
xor eax, eax
jmp 0x41f3b3
lea esi, [eax + eax]
mov eax, esi
call fcn.00460f20
mov eax, esp
push 3
push esi
lea ecx, [ebp + 0xa08]
push ecx
push eax
call fcn.0040f410
push ebx
push edi
push eax
push str.ShellOpenDoc:_after_OpenDoc_szDocProcess__s_szCmdLine_s_pszFileName:_s
call fcn.00424af0
push str.ShellOpenDoc_Finish_
call fcn.00424af0
add esp, 0x14
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0xffffffff
call fcn.004205b0
xor eax, eax
lea esp, [ebp - 0x4c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1010]
xor ecx, ebp
call fcn.00460f10
add ebp, 0x1014
mov esp, ebp
pop ebp
ret 8