Function at 0x460c70
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
lea ebp, [esp - 0x1014]
mov eax, 0x1014
call fcn.004d7c90
push 0xffffffffffffffff
push 0x516f28
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x56c3c0]
xor eax, ebp
mov dword [ebp + 0x1010], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0x101c]
push str.ShellOpenDoc_Start_
mov esi, ecx
call fcn.00468970
push 0x402
xor edi, edi
push edi
push 0x571020
mov dword [0x57101c], esi
call fcn.004d5720
add esp, 0x10
push 0x200
push ebx
push 0x571020
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0x571020
call fcn.004d8d80
push 0x400
lea ecx, [ebp + 0x606]
xor eax, eax
push edi
push ecx
mov word [ebp + 0x604], ax
call fcn.004d5720
push 0x400
lea eax, [ebp + 0xa0a]
xor edx, edx
push edi
push eax
mov word [ebp + 0xa08], dx
call fcn.004d5720
add esp, 0x18
mov ecx, esp
mov dword [ebp - 0x2c], esp
push ebx
call fcn.0044d470
lea ecx, [ebp - 0x24]
call fcn.00464f40
xor ecx, ecx
push 0x200
push ecx
lea edx, [ebp + 0xe0e]
push edx
mov dword [ebp - 4], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x10], edi
mov word [ebp + 0xe0c], cx
call fcn.004d5720
push 0x100
lea eax, [ebp + 0xe0c]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
push ebx
call fcn.004d8112
add esp, 0x30
cmp byte [esi + 0xac3], 1
jne 0x460dbd
push 0x523cc4
lea ecx, [ebp + 0xe0c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x460db5
push 0x523cb8
lea edx, [ebp + 0xe0c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x460dbd
mov edi, 1
mov dword [ebp - 0x10], edi
movzx eax, byte [esi + 0xac3]
push eax
push edi
push str.ShellOpenDoc_bDocSpecified:_d_m_ODMFileHeader.Authority.ExtVersion:_d
call fcn.00468970
xor ecx, ecx
push 0x3fe
push ecx
lea edx, [ebp + 2]
push edx
mov word [ebp], cx
call fcn.004d5720
add esp, 0x18
cmp byte [esi + 0x94e], 0
je 0x460f90
test edi, edi
jne 0x460f90
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push 0x523cb8
lea eax, [ebp + 0xe0c]
push eax
call edi
test eax, eax
je 0x460e5e
push 0x523c64
lea ecx, [ebp + 0xe0c]
push ecx
call edi
test eax, eax
je 0x460e5e
push str..pptx
lea edx, [ebp + 0xe0c]
push edx
call edi
test eax, eax
je 0x460e5e
push str..dwg
lea eax, [ebp + 0xe0c]
push eax
call edi
test eax, eax
jne 0x460f66
call fcn.00468930
test eax, eax
je 0x460f66
jmp 0x460ed1
lea edx, [ebp + 0xe0c]
push edx
mov ecx, esi
call fcn.0045d980
test eax, eax
je 0x460f66
lea eax, [ebp + 0xa08]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x460e8d
xor eax, eax
jmp 0x460ea9
lea edi, [eax + eax]
mov eax, edi
call fcn.004d6570
mov eax, esp
push 3
push edi
lea ecx, [ebp + 0xa08]
push ecx
push eax
call fcn.0044a300
push eax
push str.IsCanInject_SvcHost_:_s
call fcn.00468970
add esp, 8
push 0x522ac0
lea edx, [ebp]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp]
push eax
mov ecx, esi
call fcn.0045c1b0
mov eax, dword [esi + 0x11d0]
test eax, eax
je 0x460ee2
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [esi + 0x11d8]
test eax, eax
je 0x460f28
push 0x2710
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esi + 0x11d0]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x460f15
push eax
call edi
mov dword [esi + 0x11d0], 0
mov ecx, dword [esi + 0x11d8]
push ecx
call edi
mov dword [esi + 0x11d8], 0
cmp dword [esi + 0x11d0], 0
jne 0x460f45
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x11d0], eax
push 0
push 4
push esi
push 0x45c130
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
mov dword [esi + 0x11d8], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
push 0
call fcn.00460b10
xor edx, edx
add esp, 8
test eax, eax
setg dl
mov esi, edx
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.00462810
mov eax, esi
jmp 0x4615be
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
test ebx, ebx
jne 0x460f9e
xor eax, eax
jmp 0x460fc9
push ebx
call edi
inc eax
cmp eax, 0x3fffffff
jle 0x460fad
xor eax, eax
jmp 0x460fc9
lea edi, [eax + eax]
mov eax, edi
call fcn.004d6570
mov eax, esp
push 3
push edi
push ebx
push eax
call fcn.0044a300
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push str.ShellOpenDoc:_pszFileName_s
call fcn.00468970
add esp, 8
lea eax, [ebp - 0x28]
push eax
push 0
lea ecx, [ebp + 0x604]
push ecx
lea edx, [ebp + 0xa08]
push edx
lea ecx, [ebp - 0x24]
call fcn.00464390
test eax, eax
jne 0x461266
lea eax, [ebp + 0x604]
push eax
call edi
inc eax
cmp eax, 0x3fffffff
jle 0x461010
xor eax, eax
jmp 0x461032
lea edi, [eax + eax]
mov eax, edi
call fcn.004d6570
mov eax, esp
push 3
push edi
lea ecx, [ebp + 0x604]
push ecx
push eax
call fcn.0044a300
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push str.ShellOpenDoc:_GetOpenAppFileEx_szCmdLine_s
call fcn.00468970
add esp, 8
cmp dword [ebp - 0x10], 0
jne 0x461225
push 0x523cb8
lea edx, [ebp + 0xe0c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x461090
push 0x523c64
lea eax, [ebp + 0xe0c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x461090
push str..pptx
lea ecx, [ebp + 0xe0c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x461150
lea edx, [ebp + 0xe0c]
push edx
mov ecx, esi
call fcn.0045d980
test eax, eax
je 0x461150
lea eax, [ebp + 0xa08]
push eax
call edi
inc eax
cmp eax, 0x3fffffff
jle 0x4610bb
xor eax, eax
jmp 0x4610d7
lea edi, [eax + eax]
mov eax, edi
call fcn.004d6570
mov eax, esp
push 3
push edi
lea ecx, [ebp + 0xa08]
push ecx
push eax
call fcn.0044a300
push eax
push str.GetOpenAppFileEx_IsCanInject_SvcHost_:_s
call fcn.00468970
add esp, 8
push 0x522ac0
lea edx, [ebp]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp]
push eax
mov ecx, esi
call fcn.0045c1b0
mov eax, dword [esi + 0x11d0]
test eax, eax
je 0x461110
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [esi + 0x11d8]
test eax, eax
je 0x4611ce
push 0x2710
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esi + 0x11d0]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x461147
push eax
call edi
mov dword [esi + 0x11d0], 0
mov ecx, dword [esi + 0x11d8]
push ecx
jmp 0x4611c2
push str..dwg
lea edx, [ebp + 0xe0c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x46120c
call fcn.00468930
test eax, eax
je 0x46120c
mov eax, dword [esi + 0x11d0]
test eax, eax
je 0x461188
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [esi + 0x11d8]
test eax, eax
je 0x4611ce
push 0x2710
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esi + 0x11d0]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x4611bb
push eax
call edi
mov dword [esi + 0x11d0], 0
mov eax, dword [esi + 0x11d8]
push eax
call edi
mov dword [esi + 0x11d8], 0
cmp dword [esi + 0x11d0], 0
jne 0x4611eb
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x11d0], eax
push 0
push 4
push esi
push 0x45c130
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
mov dword [esi + 0x11d8], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
push 0
call fcn.00460b10
xor ecx, ecx
add esp, 8
test eax, eax
setg cl
mov esi, ecx
jmp 0x460f7a
test ebx, ebx
jne 0x46122d
xor eax, eax
jmp 0x461258
push ebx
call edi
inc eax
cmp eax, 0x3fffffff
jle 0x46123c
xor eax, eax
jmp 0x461258
lea edi, [eax + eax]
mov eax, edi
call fcn.004d6570
mov eax, esp
push 3
push edi
push ebx
push eax
call fcn.0044a300
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push str.ShellOpenDoc:_OpenAs_pszFileName_s
call fcn.00468970
add esp, 8
cmp dword [ebp - 0x10], 0
je 0x46134d
xor edx, edx
push 0x200
push edx
lea eax, [ebp + 0x402]
push eax
mov word [ebp + 0x400], dx
call fcn.004d5720
push 0
push 0
push 0x100
lea ecx, [ebp + 0x400]
push ecx
push 0
push 0
push 0
lea edx, [ebp + 0xa08]
push 0
push edx
call fcn.004d8112
add esp, 0x30
push str.winword
lea eax, [ebp + 0x400]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x46134d
push 1
lea ecx, [ebp - 0x10]
push ecx
mov ecx, 0x57148c
call fcn.0047c420
mov esi, eax
push 0x36
lea edx, [ebp - 0x14]
push edx
mov ecx, 0x57148c
mov byte [ebp - 4], 1
call fcn.0047c420
mov esi, dword [esi]
mov eax, dword [eax]
push 0x10
push esi
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x461321
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4615ad
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x4615ad
lea ecx, [ebp + 0xa08]
push ecx
mov ecx, esi
call fcn.0045bc00
test eax, eax
jne 0x4613f4
push 1
lea edx, [ebp - 0x10]
push edx
mov ecx, 0x57148c
call fcn.0047c420
mov esi, eax
push 0x31
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x57148c
mov byte [ebp - 4], 2
call fcn.0047c420
mov esi, dword [esi]
mov eax, dword [eax]
push 0x10
push esi
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4613b8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4613db
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp + 0xa08]
push ecx
push 0x523b7c
call fcn.00468970
add esp, 8
jmp 0x4615ad
test ebx, ebx
jne 0x4613fd
mov dword [ebp - 0x10], ebx
jmp 0x461430
push ebx
call edi
inc eax
cmp eax, 0x3fffffff
jle 0x461411
mov dword [ebp - 0x10], 0
jmp 0x461430
lea edi, [eax + eax]
mov eax, edi
call fcn.004d6570
mov eax, esp
push 3
push edi
push ebx
push eax
call fcn.0044a300
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x10], eax
lea edx, [ebp + 0x604]
push edx
call edi
inc eax
cmp eax, 0x3fffffff
jle 0x46144a
mov dword [ebp - 0x14], 0
jmp 0x46146f
lea edi, [eax + eax]
mov eax, edi
call fcn.004d6570
mov eax, esp
push 3
push edi
lea ecx, [ebp + 0x604]
push ecx
push eax
call fcn.0044a300
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x14], eax
lea edx, [ebp + 0xa08]
push edx
call edi
inc eax
cmp eax, 0x3fffffff
jle 0x461484
xor eax, eax
jmp 0x4614a6
lea edi, [eax + eax]
mov eax, edi
call fcn.004d6570
mov eax, esp
push 3
push edi
lea ecx, [ebp + 0xa08]
push ecx
push eax
call fcn.0044a300
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
push edx
push ecx
push eax
push str.ShellOpenDoc:_before_OpenDoc_szDocProcess__s_szCmdLine_s_pszFileName:_s
call fcn.00468970
mov edx, dword [ebp + 0x1020]
add esp, 0x10
push 1
push edx
push ebx
lea eax, [ebp + 0x604]
push eax
lea ecx, [ebp + 0xa08]
push ecx
mov ecx, esi
call fcn.0045de70
test eax, eax
je 0x4614f8
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.00462810
mov eax, 1
jmp 0x4615be
xor esi, esi
cmp ebx, esi
jne 0x461503
mov dword [ebp - 0x10], esi
jmp 0x46152c
push ebx
call edi
inc eax
cmp eax, 0x3fffffff
jle 0x461513
mov dword [ebp - 0x10], esi
jmp 0x46152c
lea esi, [eax + eax]
mov eax, esi
call fcn.004d6570
mov eax, esp
push 3
push esi
push ebx
push eax
call fcn.0044a300
mov dword [ebp - 0x10], eax
lea edx, [ebp + 0x604]
push edx
call edi
inc eax
cmp eax, 0x3fffffff
jle 0x461541
xor ebx, ebx
jmp 0x46155f
lea esi, [eax + eax]
mov eax, esi
call fcn.004d6570
mov eax, esp
push 3
push esi
lea ecx, [ebp + 0x604]
push ecx
push eax
call fcn.0044a300
mov ebx, eax
lea edx, [ebp + 0xa08]
push edx
call edi
inc eax
cmp eax, 0x3fffffff
jle 0x461574
xor eax, eax
jmp 0x461590
lea esi, [eax + eax]
mov eax, esi
call fcn.004d6570
mov eax, esp
push 3
push esi
lea ecx, [ebp + 0xa08]
push ecx
push eax
call fcn.0044a300
mov edx, dword [ebp - 0x10]
push edx
push ebx
push eax
push str.ShellOpenDoc:_after_OpenDoc_szDocProcess__s_szCmdLine_s_pszFileName:_s
call fcn.00468970
push str.ShellOpenDoc_Finish_
call fcn.00468970
add esp, 0x14
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.00462810
xor eax, eax
lea esp, [ebp - 0x3c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1010]
xor ecx, ebp
call fcn.004d6555
add ebp, 0x1014
mov esp, ebp
pop ebp
ret 8