Function at 0x41e8a0
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
lea ebp, [esp - 0x1014]
mov eax, 0x1014
call fcn.00461df0
push 0xffffffffffffffff
push 0x484c58
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4b7b70]
xor eax, ebp
mov dword [ebp + 0x1010], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0x101c]
push str.ShellOpenDoc_Start_
mov esi, ecx
call fcn.00424900
push 0x402
xor edi, edi
push edi
push 0x4bc3d8
mov dword [0x4bc3d4], esi
call fcn.00460000
add esp, 0x10
push 0x200
push ebx
push 0x4bc3d8
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0x4bc3d8
call fcn.00462b56
push 0x400
lea ecx, [ebp + 0x606]
xor eax, eax
push edi
push ecx
mov word [ebp + 0x604], ax
call fcn.00460000
push 0x400
lea eax, [ebp + 0xa0a]
xor edx, edx
push edi
push eax
mov word [ebp + 0xa08], dx
call fcn.00460000
add esp, 0x18
mov ecx, esp
mov dword [ebp - 0x2c], esp
push ebx
call fcn.00411f70
lea ecx, [ebp - 0x24]
call fcn.00421ed0
xor ecx, ecx
push 0x200
push ecx
lea edx, [ebp + 0xe0e]
push edx
mov dword [ebp - 4], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x10], edi
mov word [ebp + 0xe0c], cx
call fcn.00460000
push 0x100
lea eax, [ebp + 0xe0c]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
push ebx
call fcn.00462142
add esp, 0x30
cmp byte [esi + 0xac3], 1
jne 0x41e9ed
push str..doc
lea ecx, [ebp + 0xe0c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x41e9e5
push str..docx
lea edx, [ebp + 0xe0c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x41e9ed
mov edi, 1
mov dword [ebp - 0x10], edi
movzx eax, byte [esi + 0xac3]
push eax
push edi
push str.ShellOpenDoc_bDocSpecified:_d_m_ODMFileHeader.Authority.ExtVersion:_d
call fcn.00424900
xor ecx, ecx
push 0x3fe
push ecx
lea edx, [ebp + 2]
push edx
mov word [ebp], cx
call fcn.00460000
add esp, 0x18
cmp byte [esi + 0x94e], 0
je 0x41ebc0
test edi, edi
jne 0x41ebc0
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str..docx
lea eax, [ebp + 0xe0c]
push eax
call edi
test eax, eax
je 0x41ea8e
push str..xlsx
lea ecx, [ebp + 0xe0c]
push ecx
call edi
test eax, eax
je 0x41ea8e
push str..pptx
lea edx, [ebp + 0xe0c]
push edx
call edi
test eax, eax
je 0x41ea8e
push str..dwg
lea eax, [ebp + 0xe0c]
push eax
call edi
test eax, eax
jne 0x41eb96
call fcn.004248c0
test eax, eax
je 0x41eb96
jmp 0x41eb01
lea edx, [ebp + 0xe0c]
push edx
mov ecx, esi
call fcn.0041bf90
test eax, eax
je 0x41eb96
lea eax, [ebp + 0xa08]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x41eabd
xor eax, eax
jmp 0x41ead9
lea edi, [eax + eax]
mov eax, edi
call fcn.00460c90
mov eax, esp
push 3
push edi
lea ecx, [ebp + 0xa08]
push ecx
push eax
call fcn.0040f420
push eax
push str.IsCanInject_SvcHost_:_s
call fcn.00424900
add esp, 8
push 0x48ab60
lea edx, [ebp]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp]
push eax
mov ecx, esi
call fcn.0041ac00
mov eax, dword [esi + 0x11d0]
test eax, eax
je 0x41eb12
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [esi + 0x11d8]
test eax, eax
je 0x41eb58
push 0x2710
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esi + 0x11d0]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x41eb45
push eax
call edi
mov dword [esi + 0x11d0], 0
mov ecx, dword [esi + 0x11d8]
push ecx
call edi
mov dword [esi + 0x11d8], 0
cmp dword [esi + 0x11d0], 0
jne 0x41eb75
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x11d0], eax
push 0
push 4
push esi
push 0x41ab80
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
mov dword [esi + 0x11d8], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
push 0
call fcn.0041e740
xor edx, edx
add esp, 8
test eax, eax
setg dl
mov esi, edx
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.004203c0
mov eax, esi
jmp 0x41f1ee
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
test ebx, ebx
jne 0x41ebce
xor eax, eax
jmp 0x41ebf9
push ebx
call edi
inc eax
cmp eax, 0x3fffffff
jle 0x41ebdd
xor eax, eax
jmp 0x41ebf9
lea edi, [eax + eax]
mov eax, edi
call fcn.00460c90
mov eax, esp
push 3
push edi
push ebx
push eax
call fcn.0040f420
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push str.ShellOpenDoc:_pszFileName_s
call fcn.00424900
add esp, 8
lea eax, [ebp - 0x28]
push eax
push 0
lea ecx, [ebp + 0x604]
push ecx
lea edx, [ebp + 0xa08]
push edx
lea ecx, [ebp - 0x24]
call fcn.00421320
test eax, eax
jne 0x41ee96
lea eax, [ebp + 0x604]
push eax
call edi
inc eax
cmp eax, 0x3fffffff
jle 0x41ec40
xor eax, eax
jmp 0x41ec62
lea edi, [eax + eax]
mov eax, edi
call fcn.00460c90
mov eax, esp
push 3
push edi
lea ecx, [ebp + 0x604]
push ecx
push eax
call fcn.0040f420
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push str.ShellOpenDoc:_GetOpenAppFileEx_szCmdLine_s
call fcn.00424900
add esp, 8
cmp dword [ebp - 0x10], 0
jne 0x41ee55
push str..docx
lea edx, [ebp + 0xe0c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x41ecc0
push str..xlsx
lea eax, [ebp + 0xe0c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x41ecc0
push str..pptx
lea ecx, [ebp + 0xe0c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x41ed80
lea edx, [ebp + 0xe0c]
push edx
mov ecx, esi
call fcn.0041bf90
test eax, eax
je 0x41ed80
lea eax, [ebp + 0xa08]
push eax
call edi
inc eax
cmp eax, 0x3fffffff
jle 0x41eceb
xor eax, eax
jmp 0x41ed07
lea edi, [eax + eax]
mov eax, edi
call fcn.00460c90
mov eax, esp
push 3
push edi
lea ecx, [ebp + 0xa08]
push ecx
push eax
call fcn.0040f420
push eax
push str.GetOpenAppFileEx_IsCanInject_SvcHost_:_s
call fcn.00424900
add esp, 8
push 0x48ab60
lea edx, [ebp]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp]
push eax
mov ecx, esi
call fcn.0041ac00
mov eax, dword [esi + 0x11d0]
test eax, eax
je 0x41ed40
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [esi + 0x11d8]
test eax, eax
je 0x41edfe
push 0x2710
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esi + 0x11d0]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x41ed77
push eax
call edi
mov dword [esi + 0x11d0], 0
mov ecx, dword [esi + 0x11d8]
push ecx
jmp 0x41edf2
push str..dwg
lea edx, [ebp + 0xe0c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x41ee3c
call fcn.004248c0
test eax, eax
je 0x41ee3c
mov eax, dword [esi + 0x11d0]
test eax, eax
je 0x41edb8
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [esi + 0x11d8]
test eax, eax
je 0x41edfe
push 0x2710
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esi + 0x11d0]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x41edeb
push eax
call edi
mov dword [esi + 0x11d0], 0
mov eax, dword [esi + 0x11d8]
push eax
call edi
mov dword [esi + 0x11d8], 0
cmp dword [esi + 0x11d0], 0
jne 0x41ee1b
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x11d0], eax
push 0
push 4
push esi
push 0x41ab80
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
mov dword [esi + 0x11d8], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
push 0
call fcn.0041e740
xor ecx, ecx
add esp, 8
test eax, eax
setg cl
mov esi, ecx
jmp 0x41ebaa
test ebx, ebx
jne 0x41ee5d
xor eax, eax
jmp 0x41ee88
push ebx
call edi
inc eax
cmp eax, 0x3fffffff
jle 0x41ee6c
xor eax, eax
jmp 0x41ee88
lea edi, [eax + eax]
mov eax, edi
call fcn.00460c90
mov eax, esp
push 3
push edi
push ebx
push eax
call fcn.0040f420
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push str.ShellOpenDoc:_OpenAs_pszFileName_s
call fcn.00424900
add esp, 8
cmp dword [ebp - 0x10], 0
je 0x41ef7d
xor edx, edx
push 0x200
push edx
lea eax, [ebp + 0x402]
push eax
mov word [ebp + 0x400], dx
call fcn.00460000
push 0
push 0
push 0x100
lea ecx, [ebp + 0x400]
push ecx
push 0
push 0
push 0
lea edx, [ebp + 0xa08]
push 0
push edx
call fcn.00462142
add esp, 0x30
push str.winword
lea eax, [ebp + 0x400]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x41ef7d
push 1
lea ecx, [ebp - 0x10]
push ecx
mov ecx, 0x4bc81c
call fcn.0042d450
mov esi, eax
push 0x36
lea edx, [ebp - 0x14]
push edx
mov ecx, 0x4bc81c
mov byte [ebp - 4], 1
call fcn.0042d450
mov esi, dword [esi]
mov eax, dword [eax]
push 0x10
push esi
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41ef51
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41f1dd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x41f1dd
lea ecx, [ebp + 0xa08]
push ecx
mov ecx, esi
call fcn.0041a650
test eax, eax
jne 0x41f024
push 1
lea edx, [ebp - 0x10]
push edx
mov ecx, 0x4bc81c
call fcn.0042d450
mov esi, eax
push 0x31
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x4bc81c
mov byte [ebp - 4], 2
call fcn.0042d450
mov esi, dword [esi]
mov eax, dword [eax]
push 0x10
push esi
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41efe8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41f00b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp + 0xa08]
push ecx
push 0x48bb74
call fcn.00424900
add esp, 8
jmp 0x41f1dd
test ebx, ebx
jne 0x41f02d
mov dword [ebp - 0x10], ebx
jmp 0x41f060
push ebx
call edi
inc eax
cmp eax, 0x3fffffff
jle 0x41f041
mov dword [ebp - 0x10], 0
jmp 0x41f060
lea edi, [eax + eax]
mov eax, edi
call fcn.00460c90
mov eax, esp
push 3
push edi
push ebx
push eax
call fcn.0040f420
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x10], eax
lea edx, [ebp + 0x604]
push edx
call edi
inc eax
cmp eax, 0x3fffffff
jle 0x41f07a
mov dword [ebp - 0x14], 0
jmp 0x41f09f
lea edi, [eax + eax]
mov eax, edi
call fcn.00460c90
mov eax, esp
push 3
push edi
lea ecx, [ebp + 0x604]
push ecx
push eax
call fcn.0040f420
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x14], eax
lea edx, [ebp + 0xa08]
push edx
call edi
inc eax
cmp eax, 0x3fffffff
jle 0x41f0b4
xor eax, eax
jmp 0x41f0d6
lea edi, [eax + eax]
mov eax, edi
call fcn.00460c90
mov eax, esp
push 3
push edi
lea ecx, [ebp + 0xa08]
push ecx
push eax
call fcn.0040f420
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
push edx
push ecx
push eax
push str.ShellOpenDoc:_before_OpenDoc_szDocProcess__s_szCmdLine_s_pszFileName:_s
call fcn.00424900
mov edx, dword [ebp + 0x1020]
add esp, 0x10
push 1
push edx
push ebx
lea eax, [ebp + 0x604]
push eax
lea ecx, [ebp + 0xa08]
push ecx
mov ecx, esi
call fcn.0041c3e0
test eax, eax
je 0x41f128
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.004203c0
mov eax, 1
jmp 0x41f1ee
xor esi, esi
cmp ebx, esi
jne 0x41f133
mov dword [ebp - 0x10], esi
jmp 0x41f15c
push ebx
call edi
inc eax
cmp eax, 0x3fffffff
jle 0x41f143
mov dword [ebp - 0x10], esi
jmp 0x41f15c
lea esi, [eax + eax]
mov eax, esi
call fcn.00460c90
mov eax, esp
push 3
push esi
push ebx
push eax
call fcn.0040f420
mov dword [ebp - 0x10], eax
lea edx, [ebp + 0x604]
push edx
call edi
inc eax
cmp eax, 0x3fffffff
jle 0x41f171
xor ebx, ebx
jmp 0x41f18f
lea esi, [eax + eax]
mov eax, esi
call fcn.00460c90
mov eax, esp
push 3
push esi
lea ecx, [ebp + 0x604]
push ecx
push eax
call fcn.0040f420
mov ebx, eax
lea edx, [ebp + 0xa08]
push edx
call edi
inc eax
cmp eax, 0x3fffffff
jle 0x41f1a4
xor eax, eax
jmp 0x41f1c0
lea esi, [eax + eax]
mov eax, esi
call fcn.00460c90
mov eax, esp
push 3
push esi
lea ecx, [ebp + 0xa08]
push ecx
push eax
call fcn.0040f420
mov edx, dword [ebp - 0x10]
push edx
push ebx
push eax
push str.ShellOpenDoc:_after_OpenDoc_szDocProcess__s_szCmdLine_s_pszFileName:_s
call fcn.00424900
push str.ShellOpenDoc_Finish_
call fcn.00424900
add esp, 0x14
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.004203c0
xor eax, eax
lea esp, [ebp - 0x3c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1010]
xor ecx, ebp
call fcn.00460c80
add ebp, 0x1014
mov esp, ebp
pop ebp
ret 8