joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10008340
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.100252c0

Function at 0x1001b631
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x1001b640
pop dword [ebp - 0x38]
mov eax, 0x817794e1
sub eax, 0x7175dea1
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x49b6f3a6
sub dword [ebp - 0x48], 0xfb64ae5b
mov dword [ebp - 0x44], 0x20546264
sub dword [ebp - 0x44], 0xee21161f
mov dword [ebp - 0x40], 0xbd01b15d
sub dword [ebp - 0x40], 0x70b56d2f
mov dword [ebp - 0x3c], 0xfc024562
add dword [ebp - 0x3c], 0x3fdba9e
lea eax, [ebp - 0x48]
push eax
mov eax, 0xada30ac7
add eax, 0x6263f645
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x8fea45db
sub dword [ebp - 0x48], 0x1b77dc85
mov dword [ebp - 0x44], 0x4589dcf1
add dword [ebp - 0x44], 0xfbe28484
mov dword [ebp - 0x40], 0x6ac312b8
sub dword [ebp - 0x40], 0x753a64c
mov dword [ebp - 0x3c], 0x985939d0
add dword [ebp - 0x3c], 0x67a6c630
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x63b61
push 0
call eax
mov ecx, 0xc2827c70
add ecx, 0x3d7dbd82
xor edi, edi
add edi, eax
mov ebx, 0xf7e31cc4
add ebx, 0x18252f3c
add ebx, dword [ebp - 0x38]
mov esi, 0x36c0de1e
add esi, 0x20ed7366
mov edx, dword [ebx]
add dword [ebp - 0x20], ecx
xor edx, esi
sub dword [ebp - 0x20], 0xa3f7be26
mov dword [edi], edx
mov dword [ebp - 0x24], 0x1b3a997c
add edi, 0x6a4d12c8
sub edi, 0x6a4d12c4
add ebx, 0x8f77058b
sub ebx, 0x8f770587
loop 0x1001b75f
add eax, 0xda9b
mov ebx, eax
add eax, 0x509622c9
add eax, 0xaf69dd3c
mov ecx, 0x10000000
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x6e002644
Capabilities:
Print debug messages

Disassembly:
push 4
mov eax, 0x6e04b032
call fcn.6e049338
mov esi, ecx
mov dword [ebp - 0x10], esi
xor ebx, ebx
mov dword [esi + 0xfc], ebx
call fcn.6e018049
mov dword [ebp - 4], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x6c], vtable.CProxy_IAcroAXDocShimEvents_class_CAcroAXDocShim_.0
lea ecx, [esi + 0xc8]
call fcn.6e002b0e
mov dword [esi + 0xf8], ebx
mov dword [esi + 0x100], ebx
mov dword [esi + 0x104], ebx
lea ecx, [esi + 0x108]
mov byte [ebp - 4], 3
call fcn.6e018049
lea ecx, [esi + 0x110]
mov byte [ebp - 4], 4
call fcn.6e018049
lea ecx, [esi + 0x118]
mov byte [ebp - 4], 5
call fcn.6e018049
mov dword [esi + 0x120], ebx
mov dword [esi + 0x124], ebx
lea ecx, [esi + 0x128]
mov byte [ebp - 4], 8
call fcn.6e018049
lea ecx, [esi + 0x130]
mov byte [ebp - 4], 9
call fcn.6e018049
mov dword [esi + 0x138], ebx
mov dword [esi + 0x174], ebx
mov dword [esi + 0x19c], ebx
mov dword [esi + 0x1a0], 0xf
mov byte [esi + 0x18c], bl
mov dword [esi + 0x2b8], ebx
mov dword [esi + 0x310], ebx
mov dword [esi + 0x314], ebx
mov dword [esi + 0x318], ebx
mov word [esi + 0x31e], bx
mov dword [esi + 0x2cf], ebx
mov byte [esi + 0x2d3], bl
mov byte [ebp - 4], 0x10
cmp byte [0x6e07047b], bl
jne 0x6e002747
cmp byte [0x6e07047a], bl
je 0x6e00277b
push esi
push 0x6e051a0c
mov edi, 0x6e06ea68
push edi
call fcn.6e018049
add esp, 0xc
cmp byte [0x6e07047a], 0
je 0x6e00276b
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07047b], 0
je 0x6e00277b
push edi
call fcn.6e003fc0
pop ecx
or dword [esi + 0x44], 0x40
xor eax, eax
inc eax
mov dword [esi + 0x2c0], ebx
push eax
mov ecx, esi
mov word [esi + 0x31c], bx
mov dword [esi + 0x2c8], eax
mov word [esi + 0x2ab], bx
mov word [esi + 0x2ea], bx
mov dword [esi + 0x2b0], ebx
mov dword [esi + 0x178], ebx
mov dword [esi + 0x17c], ebx
mov dword [esi + 0x320], ebx
mov dword [esi + 0x324], ebx
mov dword [esi + 0x2ec], ebx
mov byte [esi + 0x2f5], bl
mov dword [esi + 0x2f8], ebx
mov byte [esi + 0x2fc], al
call fcn.6e00ea22
mov eax, esi
call fcn.6e049301
ret

Function at 0x6e0040b5
Capabilities:
Print debug messages

Disassembly:
push 8
mov eax, 0x6e04b27c
call fcn.6e0493a3
mov dword [ebp - 0x14], ecx
cmp byte [0x6e07047b], 0
jne 0x6e0040d6
cmp byte [0x6e07047a], 0
je 0x6e00410b
push str._AcroAXDocShim__CAcroAXDocShim::AddRangesToRangeTree
mov esi, 0x6e06ea68
push esi
call fcn.6e018049
cmp byte [0x6e07047a], 0
pop ecx
pop ecx
je 0x6e0040f8
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07047b], 0
je 0x6e004108
push esi
call fcn.6e003fc0
pop ecx
mov ecx, dword [ebp - 0x14]
mov ebx, dword [ebp + 0xc]
xor esi, esi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], esi
mov eax, ebx
dec ebx
test eax, eax
je 0x6e004145
push dword [edi + 4]
mov ecx, dword [ecx + 0x2b8]
push dword [edi]
call fcn.6e018049
mov ecx, dword [ebp - 0x14]
add edi, 8
jmp 0x6e004116
test esi, esi
setne al
call fcn.6e049301
ret 8
Function at 0x6e0049f4
Capabilities:
Print debug messages

Disassembly:
cmp byte [0x6e07047b], 0
push esi
mov esi, ecx
jne 0x6e004a09
cmp byte [0x6e07047a], 0
je 0x6e004a3f
push edi
push esi
push str.CAcroAXDocShim__x_::CloseStream
mov edi, 0x6e06ea68
push edi
call fcn.6e018049
add esp, 0xc
cmp byte [0x6e07047a], 0
je 0x6e004a2e
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07047b], 0
je 0x6e004a3e
push edi
call fcn.6e003fc0
pop ecx
pop edi
cmp byte [esi + 0x170], 0
je 0x6e004a70
mov eax, dword [esi + 0x16c]
push 1
mov eax, dword [eax + 4]
mov eax, dword [eax]
push dword [eax + 4]
call fcn.6e018049
pop ecx
pop ecx
test eax, eax
jne 0x6e004a69
mov byte [esi + 0x170], al
cmp byte [esi + 0x170], 0
sete al
pop esi
ret
Function at 0x6e0052c3
Capabilities:
Hide graphical window

Disassembly:
push esi
push edi
mov edi, ecx
mov eax, 0x84
test edi, edi
lea edx, [edi + 4]
cmove edx, eax
push edx
mov eax, dword [edx]
mov esi, dword [eax + 0x18]
mov ecx, esi
call dword [0x6e050848]
call esi
push 0x4c
test edi, edi
lea eax, [edi - 0x34]
pop ecx
cmove eax, ecx
pop edi
pop esi
cmp dword [eax], 0
je 0x6e005300
push 0
push dword [eax]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
ret 8

Function at 0x6e005a76
Capabilities:
Print debug messages

Disassembly:
cmp byte [0x6e07047b], 0
push esi
mov esi, ecx
jne 0x6e005a8b
cmp byte [0x6e07047a], 0
je 0x6e005abf
push edi
push str.CAcroAXDocShim::EraseRefsToThisBinding__REF_
mov edi, 0x6e06ea68
push edi
call fcn.6e018049
cmp byte [0x6e07047a], 0
pop ecx
pop ecx
je 0x6e005aae
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07047b], 0
je 0x6e005abe
push edi
call fcn.6e003fc0
pop ecx
pop edi
mov eax, dword [esi + 0x310]
jmp 0x6e005ad5
mov ecx, dword [eax]
cmp dword [ecx + 0x2c], esi
jne 0x6e005ad2
and dword [ecx + 0x2c], 0
add eax, 4
cmp eax, dword [esi + 0x314]
jne 0x6e005ac7
pop esi
ret
Function at 0x6e005e2a
Capabilities:
Print debug messages

Disassembly:
cmp byte [0x6e07047b], 0
push esi
push edi
mov esi, ecx
jne 0x6e005e40
cmp byte [0x6e07047a], 0
je 0x6e005e74
push esi
push str.CAcroAXDocShim__x_::FinalRelease
mov edi, 0x6e06ea68
push edi
call fcn.6e018049
add esp, 0xc
cmp byte [0x6e07047a], 0
je 0x6e005e64
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07047b], 0
je 0x6e005e74
push edi
call fcn.6e003fc0
pop ecx
mov eax, dword [esi + 0x2b0]
xor edi, edi
test eax, eax
je 0x6e005e8d
push eax
call fcn.6e018049
pop ecx
mov dword [esi + 0x2b0], edi
push edi
mov ecx, esi
call fcn.6e00ea22
mov eax, dword [esi + 0x2c0]
test eax, eax
je 0x6e005ea6
push eax
call dword [sym.imp.USER32.dll_DestroyMenu]
lea ecx, [esi + 0x100]
call fcn.6e00e29a
lea ecx, [esi + 0x104]
call fcn.6e00e29a
lea ecx, [esi + 4]
call fcn.6e00e29a
lea ecx, [esi + 0x124]
cmp dword [ecx], edi
je 0x6e005ed3
call fcn.6e00e29a
lea ecx, [esi + 0x138]
cmp dword [ecx], edi
je 0x6e005ee2
call fcn.6e00e29a
mov eax, dword [esi + 0x2f0]
test eax, eax
je 0x6e005ef9
push eax
call fcn.6e018049
pop ecx
mov dword [esi + 0x2f0], edi
pop edi
pop esi
ret

Function at 0x6e005f2a
Capabilities:
Print debug messages

Disassembly:
push 0x20
mov eax, 0x6e04b36e
call fcn.6e049338
mov edi, ecx
cmp byte [0x6e07047b], 0
jne 0x6e005f4a
cmp byte [0x6e07047a], 0
je 0x6e005f7e
push edi
push str.CAcroAXDocShim__x_::FireOnBlur
mov esi, 0x6e06ea68
push esi
call fcn.6e018049
add esp, 0xc
cmp byte [0x6e07047a], 0
je 0x6e005f6e
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07047b], 0
je 0x6e005f7e
push esi
call fcn.6e003fc0
pop ecx
xor ebx, ebx
cmp dword [edi + 0x138], ebx
je 0x6e005fea
push 0x10
lea eax, [ebp - 0x2c]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
push dword [edi + 0x120]
mov eax, dword [edi + 0x138]
lea ecx, [ebp - 0x2c]
push ebx
push ecx
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], ebx
push ecx
push 1
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov esi, dword [eax]
push 0x400
push ebx
push eax
mov ecx, dword [esi + 0x20]
mov dword [ebp - 4], ebx
call dword [0x6e050848]
call dword [esi + 0x20]
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
call fcn.6e049301
ret
Function at 0x6e006693
Capabilities:
Print debug messages

Disassembly:
cmp dword [ecx + 0x10c], 0
push esi
je 0x6e0066ac
add ecx, 0x108
call fcn.6e018049
mov esi, eax
jmp 0x6e0066de
push 5
push dword [ecx + 0x4c]
call dword [sym.imp.USER32.dll_GetWindow]
push eax
mov esi, eax
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
jne 0x6e0066b7
push 0xffffffffffffffec
push esi
call dword [sym.imp.USER32.dll_GetWindowLongA]
test al, 8
jne 0x6e0066de
push 4
push esi
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
jne 0x6e0066b7
test esi, esi
jne 0x6e006728
cmp byte [0x6e07047b], 0
jne 0x6e0066f4
cmp byte [0x6e07047a], 0
je 0x6e006728
push edi
push str.CAcroAXDocShim::GetHostWnd___NULL_Window____SAP_
mov edi, 0x6e06ea68
push edi
call fcn.6e018049
cmp byte [0x6e07047a], 0
pop ecx
pop ecx
je 0x6e006717
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07047b], 0
je 0x6e006727
push edi
call fcn.6e003fc0
pop ecx
pop edi
mov eax, esi
pop esi
ret
Function at 0x6e00745a
Capabilities:
Print debug messages

Disassembly:
push 0x20
mov eax, 0x6e04b50b
call fcn.6e049338
mov edi, ecx
xor esi, esi
cmp dword [edi + 0x12c], esi
jne 0x6e0075ae
cmp dword [edi + 0x2ec], esi
je 0x6e0075ae
cmp dword [edi + 0x114], esi
je 0x6e0075ae
lea eax, [edi + 0x110]
push eax
lea ecx, [ebp - 0x14]
call fcn.6e018049
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], esi
push eax
lea ecx, [ebp - 0x14]
call fcn.6e026059
mov byte [ebp - 4], 1
jmp 0x6e00750e
cmp dword [ebp - 0x18], 0
jne 0x6e007514
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x14]
call fcn.6e026902
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
cmp ecx, eax
je 0x6e0074d7
push dword [eax + 4]
call fcn.6e018049
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 1
call fcn.6e018049
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x14]
call fcn.6e026059
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 3
cmp ecx, eax
je 0x6e007502
push dword [eax + 4]
call fcn.6e018049
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.6e018049
cmp dword [ebp - 0x10], 0
jne 0x6e0074b2
cmp byte [0x6e07047b], 0
jne 0x6e007526
cmp byte [0x6e07047a], 0
je 0x6e007558
push str._AcroAXDocShim__CAcroAXDocShim::GetParentDocument_EMBED_IFRAME_parent_document_found
mov ebx, 0x6e06ea68
push ebx
call fcn.6e018049
cmp byte [0x6e07047a], 0
pop ecx
pop ecx
je 0x6e007548
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07047b], 0
je 0x6e007558
push ebx
call fcn.6e003fc0
pop ecx
push esi
push esi
push str.bADC4297641
call fcn.6e018049
add esp, 0xc
test eax, eax
je 0x6e007585
mov ecx, dword [edi + 0x12c]
test ecx, ecx
je 0x6e007585
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x6e050848]
call esi
lea ecx, [edi + 0x128]
lea eax, [ebp - 0x1c]
cmp ecx, eax
je 0x6e00759a
push dword [ebp - 0x18]
call fcn.6e018049
lea ecx, [ebp - 0x1c]
call fcn.6e018049
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.6e018049
mov ecx, dword [ebp + 8]
lea eax, [edi + 0x128]
push eax
call fcn.6e018049
mov eax, dword [ebp + 8]
call fcn.6e049301
ret 4
Function at 0x6e007622
Capabilities:
Print debug messages

Disassembly:
push 0x14
mov eax, 0x6e04b52e
call fcn.6e049338
mov dword [ebp - 0x10], ecx
push dword [ebp + 0xc]
mov esi, 0x80004005
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov edi, dword [ebp + 0x10]
mov ecx, edi
push 0
call fcn.6e018049
mov ecx, dword [ebp - 0x10]
xor eax, eax
mov ebx, dword [ebp + 0x14]
add ecx, 0x124
mov word [ebx], ax
cmp dword [ecx], eax
je 0x6e00770e
mov eax, dword [ebp + 0xc]
push 9
pop edx
mov word [eax], dx
add eax, 8
push eax
call fcn.6e018049
mov ecx, dword [ebp - 0x10]
push edi
push 0x6e05a814
mov eax, dword [ecx + 0x124]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx]
mov ecx, esi
call dword [0x6e050848]
call esi
mov esi, eax
test esi, esi
js 0x6e00770e
cmp dword [edi], 0
je 0x6e00770e
push 0x10
xor esi, esi
lea eax, [ebp - 0x20]
push esi
push eax
lfence
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
push esi
push esi
push esi
lea eax, [ebp - 0x20]
mov dword [ebp - 4], esi
push eax
mov eax, dword [ebp - 0x10]
add eax, 0x120
push eax
push 2
push dword [ebp + 8]
push dword [edi]
call fcn.6e018049
mov esi, eax
add esp, 0x20
cmp esi, 0x80020006
jne 0x6e0076ed
xor esi, esi
jmp 0x6e007700
test esi, esi
js 0x6e007700
push 9
pop eax
cmp word [ebp - 0x20], ax
jne 0x6e007700
xor eax, eax
inc eax
mov word [ebx], ax
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
cmp byte [0x6e07047b], 0
jne 0x6e007720
cmp byte [0x6e07047a], 0
je 0x6e007763
mov ecx, str.ERROR__not_found_
test esi, esi
mov eax, str._suceeded_
mov edi, 0x6e06ea68
cmovne eax, ecx
push eax
push str.CAcroAXDocShim::GetScriptEventHandlerFunc__s
push edi
call fcn.6e018049
add esp, 0xc
cmp byte [0x6e07047a], 0
je 0x6e007753
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07047b], 0
je 0x6e007763
push edi
call fcn.6e003fc0
pop ecx
mov eax, esi
call fcn.6e049301
ret 0x10
Function at 0x6e0087c0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x6e07047b], 0
push ebx
push esi
push edi
mov ebx, 0x6e06ea68
jne 0x6e0087e8
mov al, byte [0x6e07047a]
test al, al
jne 0x6e0087e8
mov esi, dword [ebp + 8]
lea edi, [esi - 0x84]
jmp 0x6e008805
mov esi, dword [ebp + 8]
lea edi, [esi - 0x84]
push edi
push str.CAcroAXDocShim__x_::InPlaceDeactivate__FOCUS_
push ebx
call fcn.6e018049
mov al, byte [0x6e07047a]
add esp, 0xc
test al, al
je 0x6e008810
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07047b], 0
je 0x6e008820
push ebx
call fcn.6e003fc0
pop ecx
test byte [esi - 0x40], 4
je 0x6e008836
cmp dword [esi + 0x244], 0
je 0x6e008836
mov ecx, edi
call fcn.6e008f95
mov ecx, edi
call fcn.6e0077dd
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x6e00894b
Capabilities:
Print debug messages

Disassembly:
push 4
mov eax, 0x6e04b6db
call fcn.6e049338
mov esi, ecx
cmp byte [0x6e07047b], 0
jne 0x6e00896b
cmp byte [0x6e07047a], 0
je 0x6e00899f
push esi
push str._AcroAXDocShim__CAcroAXDocShim__x_::InitObject
mov edi, 0x6e06ea68
push edi
call fcn.6e018049
add esp, 0xc
cmp byte [0x6e07047a], 0
je 0x6e00898f
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07047b], 0
je 0x6e00899f
push edi
call fcn.6e003fc0
pop ecx
xor ebx, ebx
mov edi, 0x500000
cmp dword [esi + 0x178], ebx
jne 0x6e0089c7
push edi
push esi
push 0x6e06c00c
call fcn.6e02dddd
add esp, 0xc
mov dword [esi + 0x178], eax
test eax, eax
je 0x6e0089e8
cmp dword [esi + 0x17c], ebx
jne 0x6e0089f0
push edi
push esi
push 0x6e06c00c
call fcn.6e02dddd
add esp, 0xc
mov dword [esi + 0x17c], eax
test eax, eax
jne 0x6e0089f0
push 2
pop eax
jmp 0x6e008b57
lea edi, [esi + 0x2b8]
or dword [ebp - 4], 0xffffffff
cmp dword [edi], ebx
jne 0x6e008a6b
push 0x20
call fcn.6e018049
pop ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 2
test eax, eax
je 0x6e008a1d
mov ecx, eax
call fcn.6e02be32
jmp 0x6e008a1f
mov eax, ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], eax
call fcn.6e010cd6
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 3
push eax
mov ecx, edi
call fcn.6e018049
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], 4
test ecx, ecx
je 0x6e008a53
call fcn.6e02cde0
mov ecx, dword [edi]
or dword [ebp - 4], 0xffffffff
call fcn.6e02cdd8
mov ecx, esi
call fcn.6e018049
mov byte [esi + 0x328], al
call fcn.6e019707
test eax, eax
jne 0x6e008a86
cmp byte [esi + 0x2f5], al
je 0x6e008a86
mov eax, 0x400f0068
jmp 0x6e008b57
lea eax, [esi + 0x1a4]
push eax
push ebx
push ebx
mov dword [eax], ebx
call fcn.6e018049
add esp, 0xc
cmp dword [esi + 0x2f8], ebx
jne 0x6e008b14
call fcn.6e018049
test al, al
je 0x6e008b14
cmp word [esi + 0x1a6], 0xa
jb 0x6e008b14
cmp dword [0x6e06f77c], 0
jne 0x6e008ad5
push 0x6e06f77c
push 0xc8
call fcn.6e018049
push eax
call fcn.6e018049
add esp, 0xc
push 0x48
call fcn.6e018049
mov edi, eax
pop ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 5
test edi, edi
je 0x6e008b08
push 0x384
push ebx
push dword [0x6e06f77c]
call fcn.6e018049
push eax
mov ecx, edi
call fcn.6e023f3d
jmp 0x6e008b0a
mov eax, ebx
or dword [ebp - 4], 0xffffffff
mov dword [esi + 0x2f8], eax
mov bl, byte [ebp + 8]
test bl, bl
je 0x6e008b3f
movzx eax, byte [esi + 0x2fc]
push eax
call fcn.6e016e20
pop ecx
mov edi, eax
call fcn.6e019707
test edi, edi
je 0x6e008b3f
mov byte [esi + 0x2f5], 1
mov eax, edi
jmp 0x6e008b57
push 0
mov ecx, esi
call fcn.6e018049
test bl, bl
je 0x6e008b55
mov ecx, esi
call fcn.6e018049
jmp 0x6e008b57
xor eax, eax
call fcn.6e049301
ret 4
Function at 0x6e009200
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x6e07047b], 0
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
jne 0x6e00921b
cmp byte [0x6e07047a], 0
je 0x6e00924f
push esi
push str._AcroAXDocShim__IPersistFileShimImpl_CAcroAXDocShim___x_::Load
mov edi, 0x6e06ea68
push edi
call fcn.6e018049
add esp, 0xc
cmp byte [0x6e07047a], 0
je 0x6e00923f
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07047b], 0
je 0x6e00924f
push edi
call fcn.6e003fc0
pop ecx
mov edi, dword [ebp + 0xc]
lea eax, [esi - 0xc4]
neg esi
sbb esi, esi
and esi, eax
test edi, edi
je 0x6e009275
push 1
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
pop ecx
push eax
push edi
mov ecx, esi
call fcn.6e018049
xor ebx, ebx
mov ecx, esi
cmp dword [esi + 0x16c], ebx
sete al
movzx eax, al
push eax
call fcn.6e00894b
test eax, eax
je 0x6e009296
mov eax, 0x80004005
jmp 0x6e009305
test edi, edi
je 0x6e0092f6
mov eax, dword [esi + 0x16c]
push dword [eax + 0x10]
call fcn.6e018049
cmp eax, 2
mov edx, 0xfde9
mov ecx, ebx
cmovge ecx, edx
push ecx
push edi
call fcn.6e018049
add esp, 0xc
mov dword [esi + 0x2b0], eax
test eax, eax
je 0x6e009302
cmp word [esi + 0x2a8], bx
jne 0x6e0092e9
push 1
push eax
mov ecx, esi
call fcn.6e018049
mov word [esi + 0x2a8], ax
mov eax, dword [esi + 0x2b0]
push edi
push eax
mov ecx, esi
call fcn.6e00965e
test al, al
jne 0x6e0092fe
cmp byte [esi + 0x2e9], bl
je 0x6e009302
xor eax, eax
jmp 0x6e009305
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x6e009533
Capabilities:
Print debug messages

Disassembly:
cmp byte [0x6e07047b], 0
push esi
push edi
mov esi, ecx
jne 0x6e009549
cmp byte [0x6e07047a], 0
je 0x6e00957d
push esi
push str._AcroAXDocShim__CAcroAXDocShim__x_::LoadAcrobatDone
mov edi, 0x6e06ea68
push edi
call fcn.6e018049
add esp, 0xc
cmp byte [0x6e07047a], 0
je 0x6e00956d
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07047b], 0
je 0x6e00957d
push edi
call fcn.6e003fc0
pop ecx
mov eax, dword [esi + 0x16c]
test eax, eax
je 0x6e009600
xor edi, edi
cmp dword [eax + 0x10], edi
je 0x6e009600
call fcn.6e03be07
push edi
test eax, eax
jne 0x6e0095b7
mov eax, dword [esi + 0x16c]
push dword [eax + 0x10]
call fcn.6e018049
pop ecx
pop ecx
test eax, eax
je 0x6e0095be
push 1
push eax
call fcn.6e01e457
pop ecx
pop ecx
push edi
mov ecx, esi
call fcn.6e00ea22
cmp dword [esi + 0x19c], edi
jbe 0x6e009600
push ebx
lea ebx, [esi + 0x18c]
push ebx
call fcn.6e018049
mov edi, eax
pop ecx
test edi, edi
je 0x6e0095ff
push edi
call fcn.6e018049
mov edx, dword [edi]
pop ecx
push 1
mov esi, dword [edx]
mov ecx, esi
call dword [0x6e050848]
mov ecx, edi
call esi
push 0x6e051790
mov ecx, ebx
call fcn.6e010a4f
pop ebx
pop edi
xor eax, eax
pop esi
ret
Function at 0x6e00a7dd
Capabilities:
Print debug messages

Disassembly:
push esi
push edi
mov edi, ecx
xor esi, esi
mov eax, dword [edi + 0x310]
mov edx, dword [edi + 0x314]
jmp 0x6e00a809
mov ecx, dword [eax]
cmp dword [ecx + 0x28], 4
je 0x6e00a805
cmp dword [ecx + 0x28], 3
je 0x6e00a805
cmp dword [ecx + 0x28], 1
jne 0x6e00a806
inc esi
add eax, 4
cmp eax, edx
jne 0x6e00a7f1
cmp byte [0x6e07047b], 0
jne 0x6e00a81f
cmp byte [0x6e07047a], 0
je 0x6e00a854
push esi
push edi
push str._AcroAXDocShim__CAcroAXDocShim__x_::NumRunning___d
mov edi, 0x6e06ea68
push edi
call fcn.6e018049
add esp, 0x10
cmp byte [0x6e07047a], 0
je 0x6e00a844
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07047b], 0
je 0x6e00a854
push edi
call fcn.6e003fc0
pop ecx
pop edi
mov eax, esi
pop esi
ret

Function at 0x6e00a97b
Capabilities:
Print debug messages

Disassembly:
push 8
mov eax, 0x6e04b76c
call fcn.6e049338
mov esi, ecx
cmp byte [0x6e07047b], 0
mov edi, 0x6e06ea68
jne 0x6e00a9a0
cmp byte [0x6e07047a], 0
je 0x6e00a9cf
push esi
push str.CAcroAXDocShim__x_::OnAcroShiftTab__n
push edi
call fcn.6e018049
add esp, 0xc
cmp byte [0x6e07047a], 0
je 0x6e00a9bf
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07047b], 0
je 0x6e00a9cf
push edi
call fcn.6e003fc0
pop ecx
cmp byte [esi + 0x2d1], 0
jne 0x6e00aafb
cmp byte [esi + 0x2d2], 0
jne 0x6e00aafb
cmp byte [esi + 0x2d3], 0
jne 0x6e00aafb
mov ecx, esi
call fcn.6e006693
test eax, eax
je 0x6e00aa08
push eax
call dword [sym.imp.USER32.dll_SetFocus]
xor ebx, ebx
lea eax, [ebp - 0x14]
push ebx
push eax
mov ecx, esi
call fcn.6e006d7d
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x10], ebx
je 0x6e00aa67
cmp byte [0x6e07047b], bl
jne 0x6e00aa2e
cmp byte [0x6e07047a], bl
je 0x6e00aa5d
push esi
push str.CAcroAXDocShim__x_::OnAcroShiftTab___focus_on_previous_element__FOCUS_
push edi
call fcn.6e018049
add esp, 0xc
cmp byte [0x6e07047a], 0
je 0x6e00aa4d
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07047b], 0
je 0x6e00aa5d
push edi
call fcn.6e003fc0
pop ecx
lea ecx, [ebp - 0x14]
call fcn.6e025a4d
jmp 0x6e00aae6
cmp byte [0x6e07047b], 0
jne 0x6e00aa79
cmp byte [0x6e07047a], 0
je 0x6e00aaa8
push esi
push str.CAcroAXDocShim__x_::OnAcroShiftTab___send_virtual_shift_tab__FOCUS_
push edi
call fcn.6e018049
add esp, 0xc
cmp byte [0x6e07047a], 0
je 0x6e00aa98
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07047b], 0
je 0x6e00aaa8
push edi
call fcn.6e003fc0
pop ecx
push ebx
push ebx
push ebx
push 0x10
mov dword [esi + 0x2cf], 0x1000100
mov byte [esi + 0x2d3], bl
call dword [sym.imp.USER32.dll_keybd_event]
push ebx
push ebx
push ebx
push 9
call dword [sym.imp.USER32.dll_keybd_event]
push ebx
push 2
push ebx
push 9
call dword [sym.imp.USER32.dll_keybd_event]
push ebx
push 2
push ebx
push 0x10
call dword [sym.imp.USER32.dll_keybd_event]
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 0x14]
mov dword [eax], 1
call fcn.6e018049
xor eax, eax
jmp 0x6e00ab04
mov eax, dword [ebp + 0x14]
and dword [eax], 0
xor eax, eax
inc eax
call fcn.6e049301
ret 0x10