Function at 0x6e00acef
Capabilities:
Parse url
Print debug messages

Disassembly:
push 0x438
mov eax, 0x6e04b85c
call fcn.6e04936c
mov edi, ecx
mov dword [ebp - 0x3c0], edi
cmp byte [0x6e07047b], 0
mov ebx, 0x6e06ea68
jne 0x6e00ad1d
cmp byte [0x6e07047a], 0
je 0x6e00ad4c
push edi
push str.CAcroAXDocShim__x_::OnCreate
push ebx
call fcn.6e039537
add esp, 0xc
cmp byte [0x6e07047a], 0
je 0x6e00ad3c
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07047b], 0
je 0x6e00ad4c
push ebx
call fcn.6e003fc0
pop ecx
xor ebx, ebx
cmp dword [edi + 0x2c8], ebx
je 0x6e00b4dc
cmp dword [edi + 0x16c], ebx
je 0x6e00b4dc
lea eax, [edi + 0x174]
mov dword [ebp - 0x3bc], eax
cmp dword [eax], ebx
je 0x6e00b4dc
mov ecx, dword [edi + 0x114]
test ecx, ecx
je 0x6e00b36c
mov dword [ebp - 0x3c4], ebx
mov eax, dword [ecx]
lea edx, [ebp - 0x3c4]
push edx
push ecx
mov dword [ebp - 4], ebx
mov esi, dword [eax + 0x78]
mov ecx, esi
call dword [0x6e050848]
call esi
cmp byte [0x6e07047b], bl
jne 0x6e00adb8
cmp byte [0x6e07047a], bl
je 0x6e00adf1
push dword [ebp - 0x3c4]
mov esi, 0x6e06ea68
push str._AcroAXDocShim_CAcroAXDocShim::OnCreate_call_SendAndLocateURLs_with_URL_S
push esi
call fcn.6e039537
add esp, 0xc
cmp byte [0x6e07047a], 0
je 0x6e00ade1
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07047b], 0
je 0x6e00adf1
push esi
call fcn.6e003fc0
pop ecx
mov eax, dword [ebp - 0x3c4]
cmp dword [edi + 0x16c], ebx
je 0x6e00b2e8
test eax, eax
je 0x6e00b2e8
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x3c8], esi
test esi, esi
je 0x6e00b4e6
mov eax, dword [edi + 0x16c]
mov byte [ebp - 4], 1
push dword [eax + 0x10]
call fcn.6e039537
cmp eax, 2
mov ecx, 0xfde9
cmovge ebx, ecx
push ebx
push dword [edi + 0x174]
mov dword [ebp - 0x3b4], ebx
call fcn.6e039537
add esp, 0xc
mov dword [ebp - 0x3b0], eax
xor eax, eax
push eax
push eax
push eax
push eax
push 0xffffffffffffffff
push esi
push eax
push ebx
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov dword [ebp - 0x3ac], eax
test eax, eax
jle 0x6e00aeb5
push eax
lfence
call fcn.6e039537
mov ebx, eax
pop ecx
test ebx, ebx
je 0x6e00aeb5
xor eax, eax
push eax
push eax
push dword [ebp - 0x3ac]
lfence
push ebx
push 0xffffffffffffffff
push esi
push eax
push dword [ebp - 0x3b4]
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
cmp eax, dword [ebp - 0x3ac]
je 0x6e00aeb7
push ebx
lfence
call fcn.6e039537
pop ecx
xor ebx, ebx
test ebx, ebx
je 0x6e00aefb
mov eax, dword [ebp - 0x3b0]
test eax, eax
je 0x6e00aef4
cmp byte [edi + 0x2ab], 0
jne 0x6e00aef4
push eax
push ebx
call dword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsstr]
pop ecx
pop ecx
test eax, eax
jne 0x6e00aef4
lea eax, [edi + 0x174]
push eax
lea ecx, [ebp - 0x3c8]
call fcn.6e039537
mov esi, dword [ebp - 0x3c8]
push ebx
call fcn.6e039537
pop ecx
mov eax, dword [ebp - 0x3b0]
test eax, eax
je 0x6e00af0c
push eax
call fcn.6e039537
pop ecx
test esi, esi
je 0x6e00af70
xor eax, eax
push eax
push eax
push eax
push eax
push 0xffffffffffffffff
push esi
push eax
push dword [ebp - 0x3b4]
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov dword [ebp - 0x3ac], eax
test eax, eax
jle 0x6e00af70
push eax
lfence
call fcn.6e039537
mov ebx, eax
pop ecx
test ebx, ebx
je 0x6e00af70
xor eax, eax
push eax
push eax
push dword [ebp - 0x3ac]
lfence
push ebx
push 0xffffffffffffffff
push esi
push eax
push dword [ebp - 0x3b4]
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
cmp eax, dword [ebp - 0x3ac]
je 0x6e00af72
push ebx
lfence
call fcn.6e039537
pop ecx
xor ebx, ebx
and dword [ebp - 0x3b8], 0
and dword [ebp - 0x3ac], 0
mov ecx, dword [edi + 0x114]
test ecx, ecx
je 0x6e00b12d
and dword [ebp - 0x3b0], 0
mov eax, dword [ecx]
lea edx, [ebp - 0x3b0]
push edx
push ecx
mov byte [ebp - 4], 2
mov edi, dword [eax + 0x78]
mov ecx, edi
call dword [0x6e050848]
call edi
cmp dword [ebp - 0x3b0], 0
je 0x6e00b083
lea eax, [ebp - 0x3b0]
push eax
call fcn.6e039537
pop ecx
test al, al
je 0x6e00b083
push dword [ebp - 0x3bc]
call fcn.6e039537
pop ecx
test al, al
je 0x6e00b083
mov eax, dword [ebp - 0x3b0]
mov dword [ebp - 0x3cc], eax
test eax, eax
je 0x6e00b061
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push 0xffffffffffffffff
push eax
push ecx
push dword [ebp - 0x3b4]
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov dword [ebp - 0x3ac], eax
test eax, eax
jle 0x6e00b061
push eax
lfence
call fcn.6e039537
mov edi, eax
mov dword [ebp - 0x3b8], edi
pop ecx
test edi, edi
je 0x6e00b061
xor eax, eax
push eax
push eax
push dword [ebp - 0x3ac]
lfence
push edi
push 0xffffffffffffffff
push dword [ebp - 0x3cc]
push eax
push dword [ebp - 0x3b4]
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
cmp eax, dword [ebp - 0x3ac]
je 0x6e00b068
push edi
lfence
call fcn.6e039537
pop ecx
and dword [ebp - 0x3b8], 0
mov eax, dword [ebp - 0x3bc]
push dword [ebp - 0x3b4]
push dword [eax]
call fcn.6e039537
pop ecx
pop ecx
mov dword [ebp - 0x3ac], eax
mov edi, dword [ebp - 0x3c0]
cmp byte [edi + 0x2ab], 0
je 0x6e00b11d
test ebx, ebx
je 0x6e00b0a1
push ebx
call fcn.6e039537
pop ecx
mov eax, dword [ebp - 0x3b0]
mov dword [ebp - 0x3c0], eax
test eax, eax
je 0x6e00b11b
xor eax, eax
push eax
push eax
push eax
push eax
push 0xffffffffffffffff
push dword [ebp - 0x3b0]
push eax
push dword [ebp - 0x3b4]
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov dword [ebp - 0x3bc], eax
test eax, eax
jle 0x6e00b11b
push eax
lfence
call fcn.6e039537
mov ebx, eax
pop ecx
test ebx, ebx
je 0x6e00b11b
xor eax, eax
push eax
push eax
push dword [ebp - 0x3bc]
lfence
push ebx
push 0xffffffffffffffff
push dword [ebp - 0x3c0]
push eax
push dword [ebp - 0x3b4]
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
cmp eax, dword [ebp - 0x3bc]
je 0x6e00b11d
push ebx
lfence
call fcn.6e039537
pop ecx
xor ebx, ebx
push dword [ebp - 0x3b0]
mov byte [ebp - 4], 1
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp byte [edi + 0x13c], 0
jne 0x6e00b2fb
cmp byte [0x6e07047b], 0
jne 0x6e00b14c
cmp byte [0x6e07047a], 0
je 0x6e00b185
push str.CAcroAXDocShim::SendAndLocateURLs_Embedded_case
push 0x6e06ea68
call fcn.6e039537
cmp byte [0x6e07047a], 0
pop ecx
pop ecx
je 0x6e00b171
push 0x6e06ea68
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07047b], 0
je 0x6e00b185
push 0x6e06ea68
call fcn.6e003fc0
pop ecx
push 0x3c
lea eax, [ebp - 0x408]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x408], 0x3c
xor eax, eax
inc eax
mov dword [ebp - 0x3f4], eax
mov dword [ebp - 0x3d8], eax
lea eax, [ebp - 0x408]
push eax
push 0
push 0
push dword [ebp - 0x3b8]
call dword [sym.imp.wininet.dll_InternetCrackUrlA]
cmp byte [0x6e07047b], 0
mov dword [ebp - 0x3c0], eax
jne 0x6e00b1e0
cmp byte [0x6e07047a], 0
je 0x6e00b220
push dword [ebp - 0x3b8]
push str.CAcroAXDocShim::SendAndLocateURLs_Embedded_case_container_URL___s
push 0x6e06ea68
call fcn.6e039537
add esp, 0xc
cmp byte [0x6e07047a], 0
je 0x6e00b20c
push 0x6e06ea68
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07047b], 0
je 0x6e00b220
push 0x6e06ea68
call fcn.6e003fc0
pop ecx
push 0x3c
lea eax, [ebp - 0x444]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x444], 0x3c
xor eax, eax
inc eax
mov dword [ebp - 0x430], eax
mov dword [ebp - 0x414], eax
lea eax, [ebp - 0x444]
push eax
push 0
push 0
push dword [ebp - 0x3ac]
call dword [sym.imp.wininet.dll_InternetCrackUrlA]
cmp dword [ebp - 0x3c0], 0
je 0x6e00b2fb
test eax, eax
je 0x6e00b2fb
cmp dword [ebp - 0x3fc], 3
je 0x6e00b28a
cmp dword [ebp - 0x3fc], 4
jne 0x6e00b2fb
cmp dword [ebp - 0x438], 5
je 0x6e00b29c
cmp dword [ebp - 0x438], 0xffffffff
jne 0x6e00b2fb
push 0
push 0x400f0072
call fcn.6e01e457
pop ecx
pop ecx
test ebx, ebx
je 0x6e00b2b5
push ebx
call fcn.6e039537
pop ecx
mov eax, dword [ebp - 0x3ac]
test eax, eax
je 0x6e00b2c6
push eax
call fcn.6e039537
pop ecx
mov eax, dword [ebp - 0x3b8]
test eax, eax
je 0x6e00b2d7
push eax
call fcn.6e039537
pop ecx
push esi
mov byte [ebp - 4], 0
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x3c4]
or dword [ebp - 4], 0xffffffff
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
or eax, 0xffffffff
jmp 0x6e00b4de
push dword [ebp - 0x3b8]
push ebx
push dword [edi + 0x16c]
call fcn.6e039537
push ebx
push dword [edi + 0x16c]
call fcn.6e039537
add esp, 0x14
test ebx, ebx
je 0x6e00b327
push ebx
call fcn.6e039537
pop ecx
mov eax, dword [ebp - 0x3ac]
test eax, eax
je 0x6e00b338
push eax
call fcn.6e039537
pop ecx
mov eax, dword [ebp - 0x3b8]
test eax, eax
je 0x6e00b349
push eax
call fcn.6e039537
pop ecx
xor ebx, ebx
push esi
mov byte [ebp - 4], bl
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov ecx, edi
call fcn.6e00f987
push dword [ebp - 0x3c4]
or dword [ebp - 4], 0xffffffff
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [edi + 0x4c]
mov ecx, edi
call fcn.6e039537
test al, al
je 0x6e00b4dc
push 0x1cb
lea eax, [ebp - 0x3a8]
push eax
push ebx
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
xor ecx, ecx
mov word [ebp - 0x12], cx
test eax, eax
je 0x6e00b4dc
lea eax, [ebp - 0x3a8]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
pop ecx
test eax, eax
je 0x6e00b4dc
push ebx
lea eax, [ebp - 0x3c0]
push eax
lea eax, [ebp - 0x3a8]
push eax
call fcn.6e039537
mov eax, dword [ebp - 0x3c0]
mov ecx, eax
movzx eax, ax
mov dword [ebp - 0x3bc], eax
lea eax, [ebp - 0x3a8]
shr ecx, 0x10
push 0x5c
push eax
mov dword [ebp - 0x3c8], ecx
call sub.VCRUNTIME140.dll_wcsrchr
lea ebx, [eax + 2]
push ebx
mov dword [ebp - 0x3ac], ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
mov dword [ebp - 0x3cc], eax
add eax, 0xfffffffc
push str..exe
lea esi, [ebx + eax*2]
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
add esp, 0x20
test eax, eax
jne 0x6e00b423
mov word [esi], ax
mov ebx, dword [ebp - 0x3cc]
add ebx, 0xa
push ebx
call fcn.6e039537
mov esi, eax
pop ecx
test esi, esi
je 0x6e00b4d5
push ebx
push 0
push esi
call sub.VCRUNTIME140.dll_memset
push dword [ebp - 0x3bc]
push dword [ebp - 0x3c8]
push dword [ebp - 0x3ac]
push str._S::_lu._lu
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x20
cmp byte [0x6e07047b], 0
jne 0x6e00b479
cmp byte [0x6e07047a], 0
je 0x6e00b4ad
push esi
push str._AcroAXDocShim__Module_name_:__s
mov ebx, 0x6e06ea68
push ebx
call fcn.6e039537
add esp, 0xc
cmp byte [0x6e07047a], 0
je 0x6e00b49d
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07047b], 0
je 0x6e00b4ad
push ebx
call fcn.6e003fc0
pop ecx
push 0
push SysReAllocString
push esi
call fcn.6e039537
push 1
inc eax
push eax
mov eax, dword [edi + 0x16c]
push esi
push str.setUserAgent
push dword [eax + 0x10]
call fcn.6e039537
add esp, 0x20
push esi
call fcn.6e04977e
pop ecx
xor eax, eax
call fcn.6e049316
ret 0x10
push 0x8007000e
call fcn.6e039537
int3