Function at 0x427ac0
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
lea ebp, [esp - 0x1014]
mov eax, 0x1014
call fcn.00467cb0
push 0xffffffffffffffff
push 0x48a798
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4bcb20]
xor eax, ebp
mov dword [ebp + 0x1010], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0x101c]
push str.ShellOpenDoc_Start_
mov esi, ecx
call fcn.0042d9e0
push 0x402
xor edi, edi
push edi
push 0x4c1398
call fcn.00465ec0
add esp, 0x10
push 0x200
push ebx
push 0x4c1398
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0x400
lea ecx, [ebp + 0x606]
xor eax, eax
push edi
push ecx
mov word [ebp + 0x604], ax
call fcn.00465ec0
push 0x400
lea eax, [ebp + 0xa0a]
xor edx, edx
push edi
push eax
mov word [ebp + 0xa08], dx
call fcn.00465ec0
add esp, 0x14
mov ecx, esp
mov dword [ebp - 0x2c], esp
push ebx
call fcn.0041afa0
lea ecx, [ebp - 0x24]
call fcn.0042ace0
xor ecx, ecx
push 0x200
push ecx
lea edx, [ebp + 0xe0e]
push edx
mov dword [ebp - 4], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x10], edi
mov word [ebp + 0xe0c], cx
call fcn.00465ec0
push 0x100
lea eax, [ebp + 0xe0c]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
push ebx
call fcn.00468002
add esp, 0x30
cmp byte [esi + 0xacf], 1
jne 0x427bfd
push str..doc
lea ecx, [ebp + 0xe0c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x427bf5
push str..docx
lea edx, [ebp + 0xe0c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x427bfd
mov edi, 1
mov dword [ebp - 0x10], edi
movzx eax, byte [esi + 0xacf]
push eax
push edi
push str.ShellOpenDoc_bDocSpecified:_d_m_ODMFileHeader.Authority.ExtVersion:_d
call fcn.0042d9e0
xor ecx, ecx
push 0x3fe
push ecx
lea edx, [ebp + 2]
push edx
mov word [ebp], cx
call fcn.00465ec0
add esp, 0x18
cmp byte [esi + 0x95a], 0
je 0x427dd0
test edi, edi
jne 0x427dd0
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str..docx
lea eax, [ebp + 0xe0c]
push eax
call edi
test eax, eax
je 0x427c9e
push str..xlsx
lea ecx, [ebp + 0xe0c]
push ecx
call edi
test eax, eax
je 0x427c9e
push str..pptx
lea edx, [ebp + 0xe0c]
push edx
call edi
test eax, eax
je 0x427c9e
push str..dwg
lea eax, [ebp + 0xe0c]
push eax
call edi
test eax, eax
jne 0x427da6
call fcn.0042d990
test eax, eax
je 0x427da6
jmp 0x427d11
lea edx, [ebp + 0xe0c]
push edx
mov ecx, esi
call fcn.00426070
test eax, eax
je 0x427da6
lea eax, [ebp + 0xa08]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x427ccd
xor eax, eax
jmp 0x427ce9
lea edi, [eax + eax]
mov eax, edi
call fcn.00466b50
mov eax, esp
push 3
push edi
lea ecx, [ebp + 0xa08]
push ecx
push eax
call fcn.004185d0
push eax
push str.IsCanInject_SvcHost_:_s
call fcn.0042d9e0
add esp, 8
push 0x490838
lea edx, [ebp]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp]
push eax
mov ecx, esi
call fcn.004240d0
mov eax, dword [esi + 0x11dc]
test eax, eax
je 0x427d22
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [esi + 0x11e4]
test eax, eax
je 0x427d68
push 0x2710
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esi + 0x11dc]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x427d55
push eax
call edi
mov dword [esi + 0x11dc], 0
mov ecx, dword [esi + 0x11e4]
push ecx
call edi
mov dword [esi + 0x11e4], 0
cmp dword [esi + 0x11dc], 0
jne 0x427d85
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x11dc], eax
push 0
push 4
push esi
push 0x424050
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
mov dword [esi + 0x11e4], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
push 0
call fcn.00427960
xor edx, edx
add esp, 8
test eax, eax
setg dl
mov esi, edx
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.004291d0
mov eax, esi
jmp 0x4283f5
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
test ebx, ebx
jne 0x427dde
xor eax, eax
jmp 0x427e09
push ebx
call edi
inc eax
cmp eax, 0x3fffffff
jle 0x427ded
xor eax, eax
jmp 0x427e09
lea edi, [eax + eax]
mov eax, edi
call fcn.00466b50
mov eax, esp
push 3
push edi
push ebx
push eax
call fcn.004185d0
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push str.ShellOpenDoc:_pszFileName_s
call fcn.0042d9e0
add esp, 8
lea eax, [ebp - 0x28]
push eax
push 0
lea ecx, [ebp + 0x604]
push ecx
lea edx, [ebp + 0xa08]
push edx
lea ecx, [ebp - 0x24]
call fcn.0042a130
test eax, eax
jne 0x4280a6
lea eax, [ebp + 0x604]
push eax
call edi
inc eax
cmp eax, 0x3fffffff
jle 0x427e50
xor eax, eax
jmp 0x427e72
lea edi, [eax + eax]
mov eax, edi
call fcn.00466b50
mov eax, esp
push 3
push edi
lea ecx, [ebp + 0x604]
push ecx
push eax
call fcn.004185d0
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push str.ShellOpenDoc:_GetOpenAppFileEx_szCmdLine_s
call fcn.0042d9e0
add esp, 8
cmp dword [ebp - 0x10], 0
jne 0x428065
push str..docx
lea edx, [ebp + 0xe0c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x427ed0
push str..xlsx
lea eax, [ebp + 0xe0c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x427ed0
push str..pptx
lea ecx, [ebp + 0xe0c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x427f90
lea edx, [ebp + 0xe0c]
push edx
mov ecx, esi
call fcn.00426070
test eax, eax
je 0x427f90
lea eax, [ebp + 0xa08]
push eax
call edi
inc eax
cmp eax, 0x3fffffff
jle 0x427efb
xor eax, eax
jmp 0x427f17
lea edi, [eax + eax]
mov eax, edi
call fcn.00466b50
mov eax, esp
push 3
push edi
lea ecx, [ebp + 0xa08]
push ecx
push eax
call fcn.004185d0
push eax
push str.GetOpenAppFileEx_IsCanInject_SvcHost_:_s
call fcn.0042d9e0
add esp, 8
push 0x490838
lea edx, [ebp]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp]
push eax
mov ecx, esi
call fcn.004240d0
mov eax, dword [esi + 0x11dc]
test eax, eax
je 0x427f50
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [esi + 0x11e4]
test eax, eax
je 0x42800e
push 0x2710
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esi + 0x11dc]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x427f87
push eax
call edi
mov dword [esi + 0x11dc], 0
mov ecx, dword [esi + 0x11e4]
push ecx
jmp 0x428002
push str..dwg
lea edx, [ebp + 0xe0c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x42804c
call fcn.0042d990
test eax, eax
je 0x42804c
mov eax, dword [esi + 0x11dc]
test eax, eax
je 0x427fc8
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [esi + 0x11e4]
test eax, eax
je 0x42800e
push 0x2710
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esi + 0x11dc]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x427ffb
push eax
call edi
mov dword [esi + 0x11dc], 0
mov eax, dword [esi + 0x11e4]
push eax
call edi
mov dword [esi + 0x11e4], 0
cmp dword [esi + 0x11dc], 0
jne 0x42802b
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x11dc], eax
push 0
push 4
push esi
push 0x424050
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
mov dword [esi + 0x11e4], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
push 0
call fcn.00427960
xor ecx, ecx
add esp, 8
test eax, eax
setg cl
mov esi, ecx
jmp 0x427dba
test ebx, ebx
jne 0x42806d
xor eax, eax
jmp 0x428098
push ebx
call edi
inc eax
cmp eax, 0x3fffffff
jle 0x42807c
xor eax, eax
jmp 0x428098
lea edi, [eax + eax]
mov eax, edi
call fcn.00466b50
mov eax, esp
push 3
push edi
push ebx
push eax
call fcn.004185d0
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push str.ShellOpenDoc:_OpenAs_pszFileName_s
call fcn.0042d9e0
add esp, 8
cmp dword [ebp - 0x10], 0
je 0x42818d
xor edx, edx
push 0x200
push edx
lea eax, [ebp + 0x402]
push eax
mov word [ebp + 0x400], dx
call fcn.00465ec0
push 0
push 0
push 0x100
lea ecx, [ebp + 0x400]
push ecx
push 0
push 0
push 0
lea edx, [ebp + 0xa08]
push 0
push edx
call fcn.00468002
add esp, 0x30
push str.winword
lea eax, [ebp + 0x400]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x42818d
push 1
lea ecx, [ebp - 0x10]
push ecx
mov ecx, 0x4c17cc
call fcn.00435810
mov esi, eax
push 0x36
lea edx, [ebp - 0x14]
push edx
mov ecx, 0x4c17cc
mov byte [ebp - 4], 1
call fcn.00435810
mov esi, dword [esi]
mov eax, dword [eax]
push 0x10
push esi
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x428161
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4283e4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x4283e4
lea ecx, [ebp + 0xa08]
push ecx
mov ecx, esi
call fcn.00423b30
test eax, eax
jne 0x428234
push 1
lea edx, [ebp - 0x10]
push edx
mov ecx, 0x4c17cc
call fcn.00435810
mov esi, eax
push 0x31
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x4c17cc
mov byte [ebp - 4], 2
call fcn.00435810
mov esi, dword [esi]
mov eax, dword [eax]
push 0x10
push esi
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4281f8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42821b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp + 0xa08]
push ecx
push 0x4917d0
call fcn.0042d9e0
add esp, 8
jmp 0x4283e4
test ebx, ebx
jne 0x42823d
mov dword [ebp - 0x10], ebx
jmp 0x428270
push ebx
call edi
inc eax
cmp eax, 0x3fffffff
jle 0x428251
mov dword [ebp - 0x10], 0
jmp 0x428270
lea edi, [eax + eax]
mov eax, edi
call fcn.00466b50
mov eax, esp
push 3
push edi
push ebx
push eax
call fcn.004185d0
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x10], eax
lea edx, [ebp + 0x604]
push edx
call edi
inc eax
cmp eax, 0x3fffffff
jle 0x42828a
mov dword [ebp - 0x14], 0
jmp 0x4282af
lea edi, [eax + eax]
mov eax, edi
call fcn.00466b50
mov eax, esp
push 3
push edi
lea ecx, [ebp + 0x604]
push ecx
push eax
call fcn.004185d0
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x14], eax
lea edx, [ebp + 0xa08]
push edx
call edi
inc eax
cmp eax, 0x3fffffff
jle 0x4282c4
xor eax, eax
jmp 0x4282e6
lea edi, [eax + eax]
mov eax, edi
call fcn.00466b50
mov eax, esp
push 3
push edi
lea ecx, [ebp + 0xa08]
push ecx
push eax
call fcn.004185d0
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
push edx
push ecx
push eax
push str.ShellOpenDoc:_before_OpenDoc_szDocProcess__s_szCmdLine_s_pszFileName:_s
call fcn.0042d9e0
add esp, 0x10
push ebx
lea edx, [ebp + 0x604]
push edx
lea eax, [ebp + 0xa08]
push eax
mov ecx, esi
call fcn.004242d0
test eax, eax
je 0x42832f
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.004291d0
mov eax, 1
jmp 0x4283f5
xor esi, esi
cmp ebx, esi
jne 0x42833a
mov dword [ebp - 0x10], esi
jmp 0x428363
push ebx
call edi
inc eax
cmp eax, 0x3fffffff
jle 0x42834a
mov dword [ebp - 0x10], esi
jmp 0x428363
lea esi, [eax + eax]
mov eax, esi
call fcn.00466b50
mov eax, esp
push 3
push esi
push ebx
push eax
call fcn.004185d0
mov dword [ebp - 0x10], eax
lea ecx, [ebp + 0x604]
push ecx
call edi
inc eax
cmp eax, 0x3fffffff
jle 0x428378
xor ebx, ebx
jmp 0x428396
lea esi, [eax + eax]
mov eax, esi
call fcn.00466b50
mov eax, esp
push 3
push esi
lea edx, [ebp + 0x604]
push edx
push eax
call fcn.004185d0
mov ebx, eax
lea eax, [ebp + 0xa08]
push eax
call edi
inc eax
cmp eax, 0x3fffffff
jle 0x4283ab
xor eax, eax
jmp 0x4283c7
lea esi, [eax + eax]
mov eax, esi
call fcn.00466b50
mov eax, esp
push 3
push esi
lea ecx, [ebp + 0xa08]
push ecx
push eax
call fcn.004185d0
mov edx, dword [ebp - 0x10]
push edx
push ebx
push eax
push str.ShellOpenDoc:_after_OpenDoc_szDocProcess__s_szCmdLine_s_pszFileName:_s
call fcn.0042d9e0
push str.ShellOpenFunction_Finish_
call fcn.0042d9e0
add esp, 0x14
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.004291d0
xor eax, eax
lea esp, [ebp - 0x3c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1010]
xor ecx, ebp
call fcn.00466b40
add ebp, 0x1014
mov esp, ebp
pop ebp
ret 4