Function at 0x427a80
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
lea ebp, [esp - 0x1014]
mov eax, 0x1014
call fcn.0046a620
push 0xffffffffffffffff
push 0x48d1a8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4beb20]
xor eax, ebp
mov dword [ebp + 0x1010], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0x101c]
push str.ShellOpenDoc_Start_
mov esi, ecx
call fcn.0042d9a0
push 0x402
xor edi, edi
push edi
push 0x4c3398
call fcn.00468830
add esp, 0x10
push 0x200
push ebx
push 0x4c3398
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0x400
lea ecx, [ebp + 0x606]
xor eax, eax
push edi
push ecx
mov word [ebp + 0x604], ax
call fcn.00468830
push 0x400
lea eax, [ebp + 0xa0a]
xor edx, edx
push edi
push eax
mov word [ebp + 0xa08], dx
call fcn.00468830
add esp, 0x14
mov ecx, esp
mov dword [ebp - 0x2c], esp
push ebx
call fcn.0041afb0
lea ecx, [ebp - 0x24]
call fcn.0042aca0
xor ecx, ecx
push 0x200
push ecx
lea edx, [ebp + 0xe0e]
push edx
mov dword [ebp - 4], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x10], edi
mov word [ebp + 0xe0c], cx
call fcn.00468830
push 0x100
lea eax, [ebp + 0xe0c]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
push ebx
call fcn.0046a972
add esp, 0x30
cmp byte [esi + 0xacf], 1
jne 0x427bbd
push str..doc
lea ecx, [ebp + 0xe0c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x427bb5
push str..docx
lea edx, [ebp + 0xe0c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x427bbd
mov edi, 1
mov dword [ebp - 0x10], edi
movzx eax, byte [esi + 0xacf]
push eax
push edi
push str.ShellOpenDoc_bDocSpecified:_d_m_ODMFileHeader.Authority.ExtVersion:_d
call fcn.0042d9a0
xor ecx, ecx
push 0x3fe
push ecx
lea edx, [ebp + 2]
push edx
mov word [ebp], cx
call fcn.00468830
add esp, 0x18
cmp byte [esi + 0x95a], 0
je 0x427d90
test edi, edi
jne 0x427d90
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str..docx
lea eax, [ebp + 0xe0c]
push eax
call edi
test eax, eax
je 0x427c5e
push str..xlsx
lea ecx, [ebp + 0xe0c]
push ecx
call edi
test eax, eax
je 0x427c5e
push str..pptx
lea edx, [ebp + 0xe0c]
push edx
call edi
test eax, eax
je 0x427c5e
push str..dwg
lea eax, [ebp + 0xe0c]
push eax
call edi
test eax, eax
jne 0x427d66
call fcn.0042d950
test eax, eax
je 0x427d66
jmp 0x427cd1
lea edx, [ebp + 0xe0c]
push edx
mov ecx, esi
call fcn.00426030
test eax, eax
je 0x427d66
lea eax, [ebp + 0xa08]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x427c8d
xor eax, eax
jmp 0x427ca9
lea edi, [eax + eax]
mov eax, edi
call fcn.004694c0
mov eax, esp
push 3
push edi
lea ecx, [ebp + 0xa08]
push ecx
push eax
call fcn.004185d0
push eax
push str.IsCanInject_SvcHost_:_s
call fcn.0042d9a0
add esp, 8
push 0x492830
lea edx, [ebp]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp]
push eax
mov ecx, esi
call fcn.00424090
mov eax, dword [esi + 0x11dc]
test eax, eax
je 0x427ce2
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [esi + 0x11e4]
test eax, eax
je 0x427d28
push 0x2710
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esi + 0x11dc]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x427d15
push eax
call edi
mov dword [esi + 0x11dc], 0
mov ecx, dword [esi + 0x11e4]
push ecx
call edi
mov dword [esi + 0x11e4], 0
cmp dword [esi + 0x11dc], 0
jne 0x427d45
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x11dc], eax
push 0
push 4
push esi
push 0x424010
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
mov dword [esi + 0x11e4], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
push 0
call fcn.00427920
xor edx, edx
add esp, 8
test eax, eax
setg dl
mov esi, edx
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.00429190
mov eax, esi
jmp 0x4283b5
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
test ebx, ebx
jne 0x427d9e
xor eax, eax
jmp 0x427dc9
push ebx
call edi
inc eax
cmp eax, 0x3fffffff
jle 0x427dad
xor eax, eax
jmp 0x427dc9
lea edi, [eax + eax]
mov eax, edi
call fcn.004694c0
mov eax, esp
push 3
push edi
push ebx
push eax
call fcn.004185d0
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push str.ShellOpenDoc:_pszFileName_s
call fcn.0042d9a0
add esp, 8
lea eax, [ebp - 0x28]
push eax
push 0
lea ecx, [ebp + 0x604]
push ecx
lea edx, [ebp + 0xa08]
push edx
lea ecx, [ebp - 0x24]
call fcn.0042a0f0
test eax, eax
jne 0x428066
lea eax, [ebp + 0x604]
push eax
call edi
inc eax
cmp eax, 0x3fffffff
jle 0x427e10
xor eax, eax
jmp 0x427e32
lea edi, [eax + eax]
mov eax, edi
call fcn.004694c0
mov eax, esp
push 3
push edi
lea ecx, [ebp + 0x604]
push ecx
push eax
call fcn.004185d0
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push str.ShellOpenDoc:_GetOpenAppFileEx_szCmdLine_s
call fcn.0042d9a0
add esp, 8
cmp dword [ebp - 0x10], 0
jne 0x428025
push str..docx
lea edx, [ebp + 0xe0c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x427e90
push str..xlsx
lea eax, [ebp + 0xe0c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x427e90
push str..pptx
lea ecx, [ebp + 0xe0c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x427f50
lea edx, [ebp + 0xe0c]
push edx
mov ecx, esi
call fcn.00426030
test eax, eax
je 0x427f50
lea eax, [ebp + 0xa08]
push eax
call edi
inc eax
cmp eax, 0x3fffffff
jle 0x427ebb
xor eax, eax
jmp 0x427ed7
lea edi, [eax + eax]
mov eax, edi
call fcn.004694c0
mov eax, esp
push 3
push edi
lea ecx, [ebp + 0xa08]
push ecx
push eax
call fcn.004185d0
push eax
push str.GetOpenAppFileEx_IsCanInject_SvcHost_:_s
call fcn.0042d9a0
add esp, 8
push 0x492830
lea edx, [ebp]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp]
push eax
mov ecx, esi
call fcn.00424090
mov eax, dword [esi + 0x11dc]
test eax, eax
je 0x427f10
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [esi + 0x11e4]
test eax, eax
je 0x427fce
push 0x2710
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esi + 0x11dc]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x427f47
push eax
call edi
mov dword [esi + 0x11dc], 0
mov ecx, dword [esi + 0x11e4]
push ecx
jmp 0x427fc2
push str..dwg
lea edx, [ebp + 0xe0c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x42800c
call fcn.0042d950
test eax, eax
je 0x42800c
mov eax, dword [esi + 0x11dc]
test eax, eax
je 0x427f88
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [esi + 0x11e4]
test eax, eax
je 0x427fce
push 0x2710
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esi + 0x11dc]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x427fbb
push eax
call edi
mov dword [esi + 0x11dc], 0
mov eax, dword [esi + 0x11e4]
push eax
call edi
mov dword [esi + 0x11e4], 0
cmp dword [esi + 0x11dc], 0
jne 0x427feb
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x11dc], eax
push 0
push 4
push esi
push 0x424010
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
mov dword [esi + 0x11e4], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
push 0
call fcn.00427920
xor ecx, ecx
add esp, 8
test eax, eax
setg cl
mov esi, ecx
jmp 0x427d7a
test ebx, ebx
jne 0x42802d
xor eax, eax
jmp 0x428058
push ebx
call edi
inc eax
cmp eax, 0x3fffffff
jle 0x42803c
xor eax, eax
jmp 0x428058
lea edi, [eax + eax]
mov eax, edi
call fcn.004694c0
mov eax, esp
push 3
push edi
push ebx
push eax
call fcn.004185d0
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push str.ShellOpenDoc:_OpenAs_pszFileName_s
call fcn.0042d9a0
add esp, 8
cmp dword [ebp - 0x10], 0
je 0x42814d
xor edx, edx
push 0x200
push edx
lea eax, [ebp + 0x402]
push eax
mov word [ebp + 0x400], dx
call fcn.00468830
push 0
push 0
push 0x100
lea ecx, [ebp + 0x400]
push ecx
push 0
push 0
push 0
lea edx, [ebp + 0xa08]
push 0
push edx
call fcn.0046a972
add esp, 0x30
push str.winword
lea eax, [ebp + 0x400]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x42814d
push 1
lea ecx, [ebp - 0x10]
push ecx
mov ecx, 0x4c3874
call fcn.00435760
mov esi, eax
push 0x36
lea edx, [ebp - 0x14]
push edx
mov ecx, 0x4c3874
mov byte [ebp - 4], 1
call fcn.00435760
mov esi, dword [esi]
mov eax, dword [eax]
push 0x10
push esi
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x428121
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4283a4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x4283a4
lea ecx, [ebp + 0xa08]
push ecx
mov ecx, esi
call fcn.00423af0
test eax, eax
jne 0x4281f4
push 1
lea edx, [ebp - 0x10]
push edx
mov ecx, 0x4c3874
call fcn.00435760
mov esi, eax
push 0x31
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x4c3874
mov byte [ebp - 4], 2
call fcn.00435760
mov esi, dword [esi]
mov eax, dword [eax]
push 0x10
push esi
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4281b8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4281db
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp + 0xa08]
push ecx
push 0x4937c8
call fcn.0042d9a0
add esp, 8
jmp 0x4283a4
test ebx, ebx
jne 0x4281fd
mov dword [ebp - 0x10], ebx
jmp 0x428230
push ebx
call edi
inc eax
cmp eax, 0x3fffffff
jle 0x428211
mov dword [ebp - 0x10], 0
jmp 0x428230
lea edi, [eax + eax]
mov eax, edi
call fcn.004694c0
mov eax, esp
push 3
push edi
push ebx
push eax
call fcn.004185d0
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x10], eax
lea edx, [ebp + 0x604]
push edx
call edi
inc eax
cmp eax, 0x3fffffff
jle 0x42824a
mov dword [ebp - 0x14], 0
jmp 0x42826f
lea edi, [eax + eax]
mov eax, edi
call fcn.004694c0
mov eax, esp
push 3
push edi
lea ecx, [ebp + 0x604]
push ecx
push eax
call fcn.004185d0
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x14], eax
lea edx, [ebp + 0xa08]
push edx
call edi
inc eax
cmp eax, 0x3fffffff
jle 0x428284
xor eax, eax
jmp 0x4282a6
lea edi, [eax + eax]
mov eax, edi
call fcn.004694c0
mov eax, esp
push 3
push edi
lea ecx, [ebp + 0xa08]
push ecx
push eax
call fcn.004185d0
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
push edx
push ecx
push eax
push str.ShellOpenDoc:_before_OpenDoc_szDocProcess__s_szCmdLine_s_pszFileName:_s
call fcn.0042d9a0
add esp, 0x10
push ebx
lea edx, [ebp + 0x604]
push edx
lea eax, [ebp + 0xa08]
push eax
mov ecx, esi
call fcn.00424290
test eax, eax
je 0x4282ef
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.00429190
mov eax, 1
jmp 0x4283b5
xor esi, esi
cmp ebx, esi
jne 0x4282fa
mov dword [ebp - 0x10], esi
jmp 0x428323
push ebx
call edi
inc eax
cmp eax, 0x3fffffff
jle 0x42830a
mov dword [ebp - 0x10], esi
jmp 0x428323
lea esi, [eax + eax]
mov eax, esi
call fcn.004694c0
mov eax, esp
push 3
push esi
push ebx
push eax
call fcn.004185d0
mov dword [ebp - 0x10], eax
lea ecx, [ebp + 0x604]
push ecx
call edi
inc eax
cmp eax, 0x3fffffff
jle 0x428338
xor ebx, ebx
jmp 0x428356
lea esi, [eax + eax]
mov eax, esi
call fcn.004694c0
mov eax, esp
push 3
push esi
lea edx, [ebp + 0x604]
push edx
push eax
call fcn.004185d0
mov ebx, eax
lea eax, [ebp + 0xa08]
push eax
call edi
inc eax
cmp eax, 0x3fffffff
jle 0x42836b
xor eax, eax
jmp 0x428387
lea esi, [eax + eax]
mov eax, esi
call fcn.004694c0
mov eax, esp
push 3
push esi
lea ecx, [ebp + 0xa08]
push ecx
push eax
call fcn.004185d0
mov edx, dword [ebp - 0x10]
push edx
push ebx
push eax
push str.ShellOpenDoc:_after_OpenDoc_szDocProcess__s_szCmdLine_s_pszFileName:_s
call fcn.0042d9a0
push str.ShellOpenFunction_Finish_
call fcn.0042d9a0
add esp, 0x14
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.00429190
xor eax, eax
lea esp, [ebp - 0x3c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1010]
xor ecx, ebp
call fcn.004694b0
add ebp, 0x1014
mov esp, ebp
pop ebp
ret 4