Function at 0x6e00b12f
Capabilities:
Parse url
Print debug messages

Disassembly:
push 0x438
mov eax, 0x6e04d012
call fcn.6e04acac
mov edi, ecx
mov dword [ebp - 0x3c0], edi
cmp byte [0x6e07289b], 0
mov ebx, 0x6e070a80
jne 0x6e00b15d
cmp byte [0x6e07289a], 0
je 0x6e00b18c
push edi
push str.CAcroAXDocShim__x_::OnCreate
push ebx
call fcn.6e01daf9
add esp, 0xc
cmp byte [0x6e07289a], 0
je 0x6e00b17c
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07289b], 0
je 0x6e00b18c
push ebx
call fcn.6e004210
pop ecx
xor ebx, ebx
cmp dword [edi + 0x2c8], ebx
je 0x6e00b919
cmp dword [edi + 0x16c], ebx
je 0x6e00b919
lea eax, [edi + 0x174]
mov dword [ebp - 0x3bc], eax
cmp dword [eax], ebx
je 0x6e00b919
mov ecx, dword [edi + 0x114]
test ecx, ecx
je 0x6e00b7a9
mov dword [ebp - 0x3c4], ebx
mov eax, dword [ecx]
lea edx, [ebp - 0x3c4]
push edx
push ecx
mov dword [ebp - 4], ebx
mov esi, dword [eax + 0x78]
mov ecx, esi
call dword [0x6e052870]
call esi
cmp byte [0x6e07289b], bl
jne 0x6e00b1f8
cmp byte [0x6e07289a], bl
je 0x6e00b231
push dword [ebp - 0x3c4]
mov esi, 0x6e070a80
push str._AcroAXDocShim_CAcroAXDocShim::OnCreate_call_SendAndLocateURLs_with_URL_S
push esi
call fcn.6e01daf9
add esp, 0xc
cmp byte [0x6e07289a], 0
je 0x6e00b221
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07289b], 0
je 0x6e00b231
push esi
call fcn.6e004210
pop ecx
mov eax, dword [ebp - 0x3c4]
cmp dword [edi + 0x16c], ebx
je 0x6e00b725
test eax, eax
je 0x6e00b725
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x3c8], esi
test esi, esi
je 0x6e00b923
mov eax, dword [edi + 0x16c]
mov byte [ebp - 4], 1
push dword [eax + 0x10]
call fcn.6e01daf9
cmp eax, 2
mov ecx, 0xfde9
cmovge ebx, ecx
push ebx
push dword [edi + 0x174]
mov dword [ebp - 0x3b0], ebx
call fcn.6e01daf9
add esp, 0xc
mov dword [ebp - 0x3b4], eax
xor eax, eax
push eax
push eax
push eax
push eax
push 0xffffffffffffffff
push esi
push eax
push ebx
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov dword [ebp - 0x3ac], eax
test eax, eax
jle 0x6e00b33a
push eax
lfence
call fcn.6e01daf9
mov ebx, eax
pop ecx
test ebx, ebx
je 0x6e00b334
xor eax, eax
push eax
push eax
push dword [ebp - 0x3ac]
lfence
push ebx
push 0xffffffffffffffff
push esi
push eax
push dword [ebp - 0x3b0]
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
cmp eax, dword [ebp - 0x3ac]
jne 0x6e00b32a
mov eax, dword [ebp - 0x3b4]
test eax, eax
je 0x6e00b32d
cmp byte [edi + 0x2ab], 0
jne 0x6e00b32d
push eax
push ebx
call dword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsstr]
pop ecx
pop ecx
test eax, eax
jne 0x6e00b32d
lea eax, [edi + 0x174]
push eax
lea ecx, [ebp - 0x3c8]
call fcn.6e01daf9
mov esi, dword [ebp - 0x3c8]
jmp 0x6e00b32d
lfence
push ebx
call fcn.6e01daf9
pop ecx
mov ebx, dword [ebp - 0x3b0]
mov eax, dword [ebp - 0x3b4]
test eax, eax
je 0x6e00b34b
push eax
call fcn.6e01daf9
pop ecx
test esi, esi
je 0x6e00b3aa
xor eax, eax
push eax
push eax
push eax
push eax
push 0xffffffffffffffff
push esi
push eax
push ebx
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov dword [ebp - 0x3ac], eax
test eax, eax
jle 0x6e00b3aa
push eax
lfence
call fcn.6e01daf9
mov ebx, eax
pop ecx
test ebx, ebx
je 0x6e00b3aa
xor eax, eax
push eax
push eax
push dword [ebp - 0x3ac]
lfence
push ebx
push 0xffffffffffffffff
push esi
push eax
push dword [ebp - 0x3b0]
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
cmp eax, dword [ebp - 0x3ac]
je 0x6e00b3ac
push ebx
lfence
call fcn.6e01daf9
pop ecx
xor ebx, ebx
and dword [ebp - 0x3b8], 0
and dword [ebp - 0x3ac], 0
mov ecx, dword [edi + 0x114]
test ecx, ecx
je 0x6e00b567
and dword [ebp - 0x3b4], 0
mov eax, dword [ecx]
lea edx, [ebp - 0x3b4]
push edx
push ecx
mov byte [ebp - 4], 2
mov edi, dword [eax + 0x78]
mov ecx, edi
call dword [0x6e052870]
call edi
cmp dword [ebp - 0x3b4], 0
je 0x6e00b4bd
lea eax, [ebp - 0x3b4]
push eax
call fcn.6e01daf9
pop ecx
test al, al
je 0x6e00b4bd
push dword [ebp - 0x3bc]
call fcn.6e01daf9
pop ecx
test al, al
je 0x6e00b4bd
mov eax, dword [ebp - 0x3b4]
mov dword [ebp - 0x3cc], eax
test eax, eax
je 0x6e00b49b
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push 0xffffffffffffffff
push eax
push ecx
push dword [ebp - 0x3b0]
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov dword [ebp - 0x3ac], eax
test eax, eax
jle 0x6e00b49b
push eax
lfence
call fcn.6e01daf9
mov edi, eax
mov dword [ebp - 0x3b8], edi
pop ecx
test edi, edi
je 0x6e00b49b
xor eax, eax
push eax
push eax
push dword [ebp - 0x3ac]
lfence
push edi
push 0xffffffffffffffff
push dword [ebp - 0x3cc]
push eax
push dword [ebp - 0x3b0]
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
cmp eax, dword [ebp - 0x3ac]
je 0x6e00b4a2
push edi
lfence
call fcn.6e01daf9
pop ecx
and dword [ebp - 0x3b8], 0
mov eax, dword [ebp - 0x3bc]
push dword [ebp - 0x3b0]
push dword [eax]
call fcn.6e01daf9
pop ecx
pop ecx
mov dword [ebp - 0x3ac], eax
mov edi, dword [ebp - 0x3c0]
cmp byte [edi + 0x2ab], 0
je 0x6e00b557
test ebx, ebx
je 0x6e00b4db
push ebx
call fcn.6e01daf9
pop ecx
mov eax, dword [ebp - 0x3b4]
mov dword [ebp - 0x3c0], eax
test eax, eax
je 0x6e00b555
xor eax, eax
push eax
push eax
push eax
push eax
push 0xffffffffffffffff
push dword [ebp - 0x3b4]
push eax
push dword [ebp - 0x3b0]
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov dword [ebp - 0x3bc], eax
test eax, eax
jle 0x6e00b555
push eax
lfence
call fcn.6e01daf9
mov ebx, eax
pop ecx
test ebx, ebx
je 0x6e00b555
xor eax, eax
push eax
push eax
push dword [ebp - 0x3bc]
lfence
push ebx
push 0xffffffffffffffff
push dword [ebp - 0x3c0]
push eax
push dword [ebp - 0x3b0]
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
cmp eax, dword [ebp - 0x3bc]
je 0x6e00b557
push ebx
lfence
call fcn.6e01daf9
pop ecx
xor ebx, ebx
push dword [ebp - 0x3b4]
mov byte [ebp - 4], 1
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp byte [edi + 0x13c], 0
jne 0x6e00b738
cmp byte [0x6e07289b], 0
jne 0x6e00b586
cmp byte [0x6e07289a], 0
je 0x6e00b5bf
push str.CAcroAXDocShim::SendAndLocateURLs_Embedded_case
push 0x6e070a80
call fcn.6e01daf9
cmp byte [0x6e07289a], 0
pop ecx
pop ecx
je 0x6e00b5ab
push 0x6e070a80
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07289b], 0
je 0x6e00b5bf
push 0x6e070a80
call fcn.6e004210
pop ecx
push 0x3c
lea eax, [ebp - 0x408]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x408], 0x3c
xor eax, eax
inc eax
mov dword [ebp - 0x3f4], eax
mov dword [ebp - 0x3d8], eax
lea eax, [ebp - 0x408]
push eax
push 0
push 0
push dword [ebp - 0x3b8]
call dword [sym.imp.wininet.dll_InternetCrackUrlA]
cmp byte [0x6e07289b], 0
mov dword [ebp - 0x3c0], eax
jne 0x6e00b61a
cmp byte [0x6e07289a], 0
je 0x6e00b65a
push dword [ebp - 0x3b8]
push str.CAcroAXDocShim::SendAndLocateURLs_Embedded_case_container_URL___s
push 0x6e070a80
call fcn.6e01daf9
add esp, 0xc
cmp byte [0x6e07289a], 0
je 0x6e00b646
push 0x6e070a80
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07289b], 0
je 0x6e00b65a
push 0x6e070a80
call fcn.6e004210
pop ecx
push 0x3c
lea eax, [ebp - 0x444]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x444], 0x3c
xor eax, eax
inc eax
mov dword [ebp - 0x430], eax
mov dword [ebp - 0x414], eax
lea eax, [ebp - 0x444]
push eax
push 0
push 0
push dword [ebp - 0x3ac]
call dword [sym.imp.wininet.dll_InternetCrackUrlA]
cmp dword [ebp - 0x3c0], 0
je 0x6e00b738
test eax, eax
je 0x6e00b738
cmp dword [ebp - 0x3fc], 3
je 0x6e00b6c4
cmp dword [ebp - 0x3fc], 4
jne 0x6e00b738
cmp dword [ebp - 0x438], 5
je 0x6e00b6d6
cmp dword [ebp - 0x438], 0xffffffff
jne 0x6e00b738
push 0
push 0
push 0x400f0000
call fcn.6e01eaa6
add esp, 0xc
test ebx, ebx
je 0x6e00b6f2
push ebx
call fcn.6e01daf9
pop ecx
mov eax, dword [ebp - 0x3ac]
test eax, eax
je 0x6e00b703
push eax
call fcn.6e01daf9
pop ecx
mov eax, dword [ebp - 0x3b8]
test eax, eax
je 0x6e00b714
push eax
call fcn.6e01daf9
pop ecx
push esi
mov byte [ebp - 4], 0
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x3c4]
or dword [ebp - 4], 0xffffffff
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
or eax, 0xffffffff
jmp 0x6e00b91b
push dword [ebp - 0x3b8]
push ebx
push dword [edi + 0x16c]
call fcn.6e01daf9
push ebx
push dword [edi + 0x16c]
call fcn.6e01daf9
add esp, 0x14
test ebx, ebx
je 0x6e00b764
push ebx
call fcn.6e01daf9
pop ecx
mov eax, dword [ebp - 0x3ac]
test eax, eax
je 0x6e00b775
push eax
call fcn.6e01daf9
pop ecx
mov eax, dword [ebp - 0x3b8]
test eax, eax
je 0x6e00b786
push eax
call fcn.6e01daf9
pop ecx
xor ebx, ebx
push esi
mov byte [ebp - 4], bl
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov ecx, edi
call fcn.6e00fd87
push dword [ebp - 0x3c4]
or dword [ebp - 4], 0xffffffff
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [edi + 0x4c]
mov ecx, edi
call fcn.6e01daf9
test al, al
je 0x6e00b919
push 0x1cb
lea eax, [ebp - 0x3a8]
push eax
push ebx
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
xor ecx, ecx
mov word [ebp - 0x12], cx
test eax, eax
je 0x6e00b919
lea eax, [ebp - 0x3a8]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
pop ecx
test eax, eax
je 0x6e00b919
push ebx
lea eax, [ebp - 0x3c0]
push eax
lea eax, [ebp - 0x3a8]
push eax
call fcn.6e01daf9
mov eax, dword [ebp - 0x3c0]
mov ecx, eax
movzx eax, ax
mov dword [ebp - 0x3bc], eax
lea eax, [ebp - 0x3a8]
shr ecx, 0x10
push 0x5c
push eax
mov dword [ebp - 0x3c8], ecx
call sub.VCRUNTIME140.dll_wcsrchr
lea ebx, [eax + 2]
push ebx
mov dword [ebp - 0x3ac], ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
mov dword [ebp - 0x3cc], eax
add eax, 0xfffffffc
push str..exe
lea esi, [ebx + eax*2]
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
add esp, 0x20
test eax, eax
jne 0x6e00b860
mov word [esi], ax
mov ebx, dword [ebp - 0x3cc]
add ebx, 0xa
push ebx
call fcn.6e01daf9
mov esi, eax
pop ecx
test esi, esi
je 0x6e00b912
push ebx
push 0
push esi
call sub.VCRUNTIME140.dll_memset
push dword [ebp - 0x3bc]
push dword [ebp - 0x3c8]
push dword [ebp - 0x3ac]
push str._S::_lu._lu
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x20
cmp byte [0x6e07289b], 0
jne 0x6e00b8b6
cmp byte [0x6e07289a], 0
je 0x6e00b8ea
push esi
push str._AcroAXDocShim__Module_name_:__s
mov ebx, 0x6e070a80
push ebx
call fcn.6e01daf9
add esp, 0xc
cmp byte [0x6e07289a], 0
je 0x6e00b8da
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07289b], 0
je 0x6e00b8ea
push ebx
call fcn.6e004210
pop ecx
push 0
push SysReAllocString
push esi
call fcn.6e01daf9
push 1
inc eax
push eax
mov eax, dword [edi + 0x16c]
push esi
push str.setUserAgent
push dword [eax + 0x10]
call fcn.6e01daf9
add esp, 0x20
push esi
call fcn.6e04b0be
pop ecx
xor eax, eax
call fcn.6e04ac56
ret 0x10
push 0x8007000e
call fcn.6e01daf9
int3