joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6e013ac0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 0x18]
test edi, edi
jne 0x6e013ad6
mov eax, 0x80004003
jmp 0x6e013b9e
push esi
mov esi, dword [ebp + 8]
test esi, esi
push 4
pop ecx
lea eax, [esi - 0x88]
cmove eax, ecx
cmp dword [eax], 0
je 0x6e013af7
mov eax, 0x80004005
jmp 0x6e013b9d
cmp byte [0x6e07289b], 0
jne 0x6e013b09
cmp byte [0x6e07289a], 0
je 0x6e013b3d
push ebx
push str._OleDocument__IOleDocumentImpl_CreateView
mov ebx, 0x6e070e88
push ebx
call fcn.6e01daf9
cmp byte [0x6e07289a], 0
pop ecx
pop ecx
je 0x6e013b2c
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07289b], 0
je 0x6e013b3c
push ebx
call fcn.6e004210
pop ecx
pop ebx
push 0x78
pop ecx
test esi, esi
lea eax, [esi - 0x14]
cmove eax, ecx
lea ecx, [ebp - 4]
push ecx
push 0x6e05cadc
push eax
mov esi, dword [eax]
mov ecx, dword [esi]
call dword [0x6e052870]
call dword [esi]
cmp dword [ebp + 0xc], 0
je 0x6e013b7a
mov eax, dword [ebp - 4]
push dword [ebp + 0xc]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0xc]
mov ecx, esi
call dword [0x6e052870]
call esi
cmp dword [ebp + 0x10], 0
je 0x6e013b96
mov eax, dword [ebp - 4]
push dword [ebp + 0x10]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x38]
mov ecx, esi
call dword [0x6e052870]
call esi
mov eax, dword [ebp - 4]
mov dword [edi], eax
xor eax, eax
pop esi
pop edi
leave
ret 0x14

Function at 0x6e013c10
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp byte [0x6e07289b], 0
push ebx
push esi
jne 0x6e013c29
cmp byte [0x6e07289a], 0
je 0x6e013c5b
push str.IOleDocument::EnumViews
mov esi, 0x6e070e88
push esi
call fcn.6e01daf9
cmp byte [0x6e07289a], 0
pop ecx
pop ecx
je 0x6e013c4b
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07289b], 0
je 0x6e013c5b
push esi
call fcn.6e004210
pop ecx
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
lea eax, [esi - 0x8c]
neg esi
sbb esi, esi
and esi, eax
test ebx, ebx
jne 0x6e013c7b
mov eax, 0x80004003
jmp 0x6e013d0b
test esi, esi
je 0x6e013d09
push edi
push 0x6e05cadc
call fcn.6e01daf9
test eax, eax
je 0x6e013c97
lea edi, [esi + 0x78]
jmp 0x6e013cf6
mov edi, 0x6e0578d8
mov eax, dword [edi - 8]
mov dword [ebp - 8], eax
test eax, eax
je 0x6e013cb7
push 0x6e05cadc
push eax
call fcn.6e01daf9
pop ecx
pop ecx
test eax, eax
je 0x6e013ce4
mov eax, dword [edi]
mov dword [ebp - 4], eax
cmp eax, 1
je 0x6e013cf1
push dword [edi - 4]
mov ecx, eax
push ebx
push 0x6e05cadc
push esi
call dword [0x6e052870]
call dword [ebp - 4]
test eax, eax
je 0x6e013d08
cmp dword [ebp - 8], 0
je 0x6e013ce4
test eax, eax
js 0x6e013cec
add edi, 0xc
cmp dword [edi], 0
jne 0x6e013c9c
and dword [ebx], 0
jmp 0x6e013d08
mov edi, dword [edi - 4]
add edi, esi
mov eax, dword [edi]
push edi
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x6e052870]
call esi
mov dword [ebx], edi
pop edi
xor eax, eax
pop esi
pop ebx
leave
ret 0xc
Function at 0x6e013d20
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x6e06e64c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 4
lea esi, [ebx - 0x8c]
pop eax
cmove esi, eax
mov dword [ebp - 0x2c], esi
cmp dword [esi], edi
je 0x6e013ef6
cmp byte [0x6e07289b], 0
jne 0x6e013d64
cmp byte [0x6e07289a], 0
je 0x6e013d9d
push str._OleDocument__IOleDocumentViewImpl_SetInPlaceSite
push 0x6e070e88
call fcn.6e01daf9
cmp byte [0x6e07289a], 0
pop ecx
pop ecx
je 0x6e013d89
push 0x6e070e88
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07289b], 0
je 0x6e013d9d
push 0x6e070e88
call fcn.6e004210
pop ecx
cmp dword [esi], 0
je 0x6e013de0
mov eax, dword [ebx]
push 0
push ebx
mov esi, dword [eax + 0x28]
mov ecx, esi
call dword [0x6e052870]
call esi
mov eax, 0x84
lea ecx, [ebx - 0xc]
test ebx, ebx
cmove ecx, eax
push ecx
mov eax, dword [ecx]
mov esi, dword [eax + 0x14]
mov ecx, esi
call dword [0x6e052870]
call esi
test eax, eax
jns 0x6e013ddd
lfence
jmp 0x6e013ef8
mov esi, dword [ebp - 0x2c]
test edi, edi
je 0x6e013ef6
push edi
mov ecx, esi
call fcn.6e01daf9
xor edi, edi
lea eax, [ebx + 0xc4]
mov ecx, 0x154
mov dword [ebp - 0x34], edi
test ebx, ebx
lea edx, [ebp - 0x30]
push edx
cmove eax, ecx
mov dword [ebp - 0x28], eax
mov dword [eax], 0x14
mov eax, dword [esi]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0xc]
mov ecx, esi
call dword [0x6e052870]
call esi
test eax, eax
jne 0x6e013e77
mov eax, 0x104
lea edi, [ebx + 0x74]
test ebx, ebx
cmove edi, eax
mov ecx, edi
call fcn.6e00e6ba
mov ecx, dword [ebp - 0x2c]
push dword [ebp - 0x28]
mov eax, dword [ecx]
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x14]
push ecx
mov esi, dword [eax]
lea ecx, [ebp - 0x34]
push ecx
push edi
push eax
mov ecx, dword [esi + 0x20]
call dword [0x6e052870]
call dword [esi + 0x20]
test ebx, ebx
lea ecx, [ebx + 0xb0]
mov eax, 0x140
cmove ecx, eax
mov eax, dword [ebp - 0x30]
xor edi, edi
mov dword [ecx], eax
push edi
push ecx
mov eax, esp
test ebx, ebx
push edi
push edi
push edi
push ecx
mov dword [eax], edi
lea ecx, [ebp - 0x14]
mov eax, esp
mov dword [eax], ecx
lea ecx, [ebx - 0x48]
push dword [ebp - 0x30]
push 0x48
pop eax
cmove ecx, eax
call fcn.6e01daf9
push 0x4c
pop ecx
test ebx, ebx
lea esi, [ebx - 0x44]
push edi
cmove esi, ecx
push edi
push str.bADC4294624
mov dword [esi], eax
call fcn.6e01daf9
add esp, 0xc
lea ecx, [ebx + 0x259]
test ebx, ebx
mov edx, 0x2e9
cmove ecx, edx
cmp byte [ecx], 0
jne 0x6e013ed0
test eax, eax
je 0x6e013edf
push edi
push edi
push 0x1500
push dword [esi]
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x6e013ef6
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x6e052870]
call esi
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6e04ac30
leave
ret 8
Function at 0x6e014020
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x6e07289b], 0
push esi
mov esi, dword [ebp + 8]
jne 0x6e014039
cmp byte [0x6e07289a], 0
je 0x6e014081
cmp dword [ebp + 0xc], 0
mov ecx, 0x6e0539c4
push ebx
mov eax, str.true
mov ebx, 0x6e070e88
cmove eax, ecx
push eax
push esi
push str.IOleDocumentViewImpl__x_::Show_show_s_
push ebx
call fcn.6e01daf9
add esp, 0x10
cmp byte [0x6e07289a], 0
je 0x6e014070
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07289b], 0
je 0x6e014080
push ebx
call fcn.6e004210
pop ecx
pop ebx
xor ecx, ecx
lea eax, [esi - 0x4c]
push 0x44
test esi, esi
pop edx
cmove eax, edx
mov eax, dword [eax]
cmp dword [ebp + 0xc], ecx
je 0x6e0140ac
test al, 8
jne 0x6e0140cd
test esi, esi
lea eax, [edx + 0x4c]
push 0xfffffffffffffffb
cmove esi, eax
mov ecx, esi
call fcn.6e0178d0
jmp 0x6e0140cb
test al, 8
je 0x6e0140cd
test esi, esi
mov eax, 0x90
push ecx
cmove esi, eax
push esi
mov eax, dword [esi]
mov esi, dword [eax + 0x28]
mov ecx, esi
call dword [0x6e052870]
call esi
mov ecx, eax
mov eax, ecx
pop esi
pop ebp
ret 8

Function at 0x6e0140e0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x6e07289b], 0
push esi
mov esi, dword [ebp + 8]
push edi
jne 0x6e0140fa
cmp byte [0x6e07289a], 0
je 0x6e014140
cmp dword [ebp + 0xc], 0
mov ecx, 0x6e0539c4
mov eax, str.true
mov edi, 0x6e070e88
cmove eax, ecx
push eax
push esi
push str.IOleDocumentViewImpl__x_::UIActivate_activate_s___FOCUS_
push edi
call fcn.6e01daf9
add esp, 0x10
cmp byte [0x6e07289a], 0
je 0x6e014130
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07289b], 0
je 0x6e014140
push edi
call fcn.6e004210
pop ecx
lea eax, [esi - 0x90]
neg esi
sbb esi, esi
xor edi, edi
and esi, eax
cmp dword [ebp + 0xc], edi
je 0x6e014186
test byte [esi + 0x44], 8
jne 0x6e0141ab
cmp dword [esi + 4], edi
jne 0x6e014165
mov eax, 0x8000ffff
jmp 0x6e0141ad
push 0xfffffffffffffffc
lea ecx, [esi + 0x90]
call fcn.6e0178d0
mov ecx, esi
mov edi, eax
call fcn.6e003dd5
push 1
mov ecx, esi
call fcn.6e01daf9
jmp 0x6e0141ab
test byte [esi + 0x44], 8
je 0x6e0141ab
mov ecx, esi
call fcn.6e003f44
lea eax, [esi + 0x84]
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 0x18]
mov ecx, esi
call dword [0x6e052870]
call esi
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebp
ret 8

Function at 0x6e0141c0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x6e07289b], 0
push esi
push edi
mov edi, dword [ebp + 8]
jne 0x6e0141da
cmp byte [0x6e07289a], 0
je 0x6e01420e
push edi
push str.IOleDocumentViewImpl__x_::CloseView
mov esi, 0x6e070e88
push esi
call fcn.6e01daf9
add esp, 0xc
cmp byte [0x6e07289a], 0
je 0x6e0141fe
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07289b], 0
je 0x6e01420e
push esi
call fcn.6e004210
pop ecx
mov eax, 0x90
test edi, edi
push 0
cmove edi, eax
push edi
mov eax, dword [edi]
mov esi, dword [eax + 0x24]
mov ecx, esi
call dword [0x6e052870]
call esi
mov eax, dword [edi]
push 0
push edi
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x6e052870]
call esi
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
Function at 0x6e01a142
Capabilities:
Print debug messages

Disassembly:
push 8
mov eax, 0x6e04d720
call fcn.6e04ac78
mov ebx, 0x6e0712fc
push ebx
mov dword [ebp - 0x14], ebx
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov byte [ebp - 0x10], 1
mov edi, dword [0x6e070a70]
xor esi, esi
mov dword [ebp - 4], esi
mov eax, dword [edi]
cmp eax, edi
je 0x6e01a18c
mov ecx, dword [eax + 8]
lea edx, [esi + 1]
cmp byte [ecx + 0x168], 0
mov ecx, dword [eax]
mov eax, ecx
cmove edx, esi
mov esi, edx
cmp ecx, edi
jne 0x6e01a172
mov edi, dword [0x6e070a78]
mov eax, dword [edi]
cmp eax, edi
je 0x6e01a1b2
mov ecx, dword [eax + 8]
lea edx, [esi + 1]
cmp byte [ecx + 0x168], 0
mov ecx, dword [eax]
mov eax, ecx
cmove edx, esi
mov esi, edx
cmp ecx, edi
jne 0x6e01a198
cmp byte [0x6e07289b], 0
jne 0x6e01a1c4
cmp byte [0x6e07289a], 0
je 0x6e01a1f8
push esi
push str._AcroPDFImpl__CAcroPDFModule::GetOpenCountDocShimList_count___d
mov edi, 0x6e070e88
push edi
call fcn.6e01daf9
add esp, 0xc
cmp byte [0x6e07289a], 0
je 0x6e01a1e8
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07289b], 0
je 0x6e01a1f8
push edi
call fcn.6e004210
pop ecx
or dword [ebp - 4], 0xffffffff
push ebx
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov eax, esi
call fcn.6e04ac41
ret

Function at 0x6e01a332
Capabilities:
Print debug messages

Disassembly:
push 8
mov eax, 0x6e04d720
call fcn.6e04ac78
mov edi, 0x6e0712a0
push edi
mov dword [ebp - 0x14], edi
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov byte [ebp - 0x10], 1
and dword [ebp - 4], 0
cmp byte [0x6e07289b], 0
jne 0x6e01a367
cmp byte [0x6e07289a], 0
je 0x6e01a3a0
push dword [0x6e0712ec]
mov esi, 0x6e070e88
push str._AcroPDFImpl__GetPerProcessObjectCount_Object_count___d
push esi
call fcn.6e01daf9
add esp, 0xc
cmp byte [0x6e07289a], 0
je 0x6e01a390
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07289b], 0
je 0x6e01a3a0
push esi
call fcn.6e004210
pop ecx
mov esi, dword [0x6e0712ec]
or dword [ebp - 4], 0xffffffff
push edi
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov eax, esi
call fcn.6e04ac41
ret
Function at 0x6e01daf9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x6e01db08
pop dword [ebp - 0x14]
mov eax, 0x30a01b7f
add eax, 0x3d61bf89
sub dword [ebp - 0x14], eax
push 0x40
push 0x1000
push 0x4e0cd
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x14]
call dword [eax]
mov ecx, 0x21321041
add ecx, 0xdece4651
xor esi, esi
add esi, eax
mov edx, 0x5ea62051
sub edx, 0xf0995a51
add edx, dword [ebp - 0x14]
mov ebx, 0x31147888
add ebx, 0xf55eb39d
sub dword [ebp - 0x10], eax
mov edi, dword [edx]
xor dword [ebp - 4], ecx
xor edi, ebx
xor dword [ebp - 0xc], esi
mov dword [esi], edi
mov dword [ebp - 0x10], 0xd62d4ee1
add esi, 0xb6e4dfb9
sub esi, 0xb6e4dfb5
add edx, 0xb44fdddc
sub edx, 0xb44fddd8
loop 0x6e01db64
add eax, 0x617383d0
sub eax, 0x617236b5
mov ebx, eax
add eax, 0xa6ed4116
sub eax, 0xa6ed4111
mov ecx, 0x6e000000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x6e01f326
Capabilities:
Print debug messages

Disassembly:
push 8
mov eax, 0x6e04d720
call fcn.6e04ac78
mov edi, 0x6e0712a0
push edi
mov dword [ebp - 0x14], edi
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov byte [ebp - 0x10], 1
mov ax, word [ebp + 8]
and dword [ebp - 4], 0
mov esi, dword [0x6e0712ec]
test ax, ax
je 0x6e01f35b
inc esi
jmp 0x6e01f361
cmp esi, 1
jl 0x6e01f367
dec esi
mov dword [0x6e0712ec], esi
cmp byte [0x6e07289b], 0
jne 0x6e01f379
cmp byte [0x6e07289a], 0
je 0x6e01f3b7
push esi
movzx eax, ax
mov esi, 0x6e070e88
push eax
push str._AcroPDFImpl__UpdatePerProcessObjectCount_inc___d_Object_count___d
push esi
call fcn.6e01daf9
add esp, 0x10
cmp byte [0x6e07289a], 0
je 0x6e01f3a1
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07289b], 0
je 0x6e01f3b1
push esi
call fcn.6e004210
pop ecx
mov esi, dword [0x6e0712ec]
or dword [ebp - 4], 0xffffffff
push edi
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov eax, esi
call fcn.6e04ac41
ret
Function at 0x6e0216c0
Capabilities:
Print debug messages

Disassembly:
push esi
push edi
mov edi, ecx
mov eax, dword [edi]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x6e052870]
mov ecx, edi
call esi
neg eax
pop edi
sbb eax, eax
neg eax
pop esi
ret
cmp byte [0x6e07289b], 0
push esi
push edi
mov edi, 0x6e070e88
jne 0x6e0216d9
cmp byte [0x6e07289a], 0
je 0x6e021706
push str._AcroPDFImpl__DllCanUnloadNow
push edi
call fcn.6e01daf9
cmp byte [0x6e07289a], 0
pop ecx
pop ecx
je 0x6e0216f6
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07289b], 0
je 0x6e021706
push edi
call fcn.6e004210
pop ecx
call fcn.6e0200ed
test al, al
jne 0x6e02182c
call fcn.6e01daf9
test al, al
jne 0x6e02182c
call fcn.6e01a332
test eax, eax
jne 0x6e0217eb
cmp byte [0x6e07289b], al
jne 0x6e02173d
cmp byte [0x6e07289a], al
je 0x6e02176a
push str._AcroPDFImpl__DllCanUnloadNow_no_open_docs
push edi
call fcn.6e01daf9
cmp byte [0x6e07289a], 0
pop ecx
pop ecx
je 0x6e02175a
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07289b], 0
je 0x6e02176a
push edi
call fcn.6e004210
pop ecx
call fcn.6e0277c4
mov esi, eax
test esi, esi
je 0x6e0217bb
cmp byte [0x6e07289b], 0
jne 0x6e021787
cmp byte [0x6e07289a], 0
je 0x6e0217b4
push str._AcroPDFImpl__DllCanUnloadNow_PrxDllCanUnloadNow_returned_S_FALSE__we_wont_unload
push edi
call fcn.6e01daf9
cmp byte [0x6e07289a], 0
pop ecx
pop ecx
je 0x6e0217a4
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07289b], 0
je 0x6e0217b4
push edi
call fcn.6e004210
pop ecx
mov eax, esi
jmp 0x6e021875
call fcn.6e01f198
test al, al
jne 0x6e0217df
cmp byte [0x6e07289b], al
jne 0x6e0217d8
cmp byte [0x6e07289a], al
je 0x6e021872
push str._AcroPDFImpl__DllCanUnloadNow_UnloadAcrobatIfWarranted_returned_false__we_wont_unload
jmp 0x6e021802
pop edi
mov ecx, 0x6e0712b8
pop esi
jmp 0x6e019b8b
cmp byte [0x6e07289b], 0
jne 0x6e0217fd
cmp byte [0x6e07289a], 0
je 0x6e021872
push str._AcroPDFImpl__DllCanUnloadNow_docs_are_open_return_S_FALSE___
push edi
call fcn.6e01daf9
cmp byte [0x6e07289a], 0
pop ecx
pop ecx
je 0x6e02181a
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07289b], 0
je 0x6e021872
push edi
call fcn.6e004210
pop ecx
jmp 0x6e021872
cmp byte [0x6e07289b], 0
jne 0x6e02183e
cmp byte [0x6e07289a], 0
je 0x6e02186b
push str._AcroPDFImpl__DllCanUnloadNow_return_false
push edi
call fcn.6e01daf9
cmp byte [0x6e07289a], 0
pop ecx
pop ecx
je 0x6e02185b
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07289b], 0
je 0x6e02186b
push edi
call fcn.6e004210
pop ecx
mov byte [0x6e07128c], 0
xor eax, eax
inc eax
pop edi
pop esi
ret
Function at 0x6e0218a4
Capabilities:
Print debug messages

Disassembly:
push 0x20
mov eax, 0x6e04ddcd
call fcn.6e04ac78
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
sub eax, 0
je 0x6e0219b3
sub eax, 1
jne 0x6e021a0d
mov edi, str.DllMain_Process_Attach
lea ecx, [ebp - 0x2c]
push edi
mov ebx, 0x6e071290
push ebx
call fcn.6e01daf9
and dword [ebp - 4], 0
lea ecx, [ebp - 0x24]
push edi
push ebx
call fcn.6e01daf9
push edi
push ebx
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.6e01daf9
push str.DllMain_Process_Attach_2
push ebx
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.6e01daf9
mov byte [ebp - 4], 3
call fcn.6e01daf9
test al, al
jne 0x6e02198f
push 1
call fcn.6e01daf9
pop ecx
test eax, eax
jne 0x6e02198f
xor ebx, ebx
push ebx
push 0x9d7f6
push ebx
call dword [sym.imp.kernel32.dll_HeapCreate]
mov dword [0x6e0712e8], eax
test eax, eax
je 0x6e02198f
push 0x6e05ba28
push esi
push 0x6e06e098
mov ecx, 0x6e0712b8
mov dword [0x6e0712ec], ebx
mov dword [0x6e0712f0], ebx
mov dword [0x6e0712f4], ebx
call fcn.6e01daf9
push esi
call dword [sym.imp.kernel32.dll_DisableThreadLibraryCalls]
lea ecx, [ebp - 0x14]
call fcn.6e01daf9
lea ecx, [ebp - 0x1c]
call fcn.6e01daf9
lea ecx, [ebp - 0x24]
call fcn.6e01daf9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.6e01daf9
jmp 0x6e021a0d
lea ecx, [ebp - 0x14]
call fcn.6e01daf9
lea ecx, [ebp - 0x1c]
call fcn.6e01daf9
lea ecx, [ebp - 0x24]
call fcn.6e01daf9
lea ecx, [ebp - 0x2c]
call fcn.6e01daf9
xor eax, eax
jmp 0x6e021a25
cmp byte [0x6e07289b], 0
jne 0x6e0219c5
cmp byte [0x6e07289a], 0
je 0x6e0219f7
push str._AcroPDFImpl__DllMain_DLL_PROCESS_DETACH_DLL_unloading
mov edi, 0x6e070e88
push edi
call fcn.6e01daf9
cmp byte [0x6e07289a], 0
pop ecx
pop ecx
je 0x6e0219e7
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07289b], 0
je 0x6e0219f7
push edi
call fcn.6e004210
pop ecx
push dword [0x6e0712e8]
call dword [sym.imp.kernel32.dll_HeapDestroy]
mov ecx, 0x6e0712b8
call fcn.6e01f115
push dword [ebp + 0x10]
mov dword [0x6e071288], esi
push dword [ebp + 0xc]
push esi
call fcn.6e01daf9
neg eax
sbb eax, eax
neg eax
call fcn.6e04ac41
ret 0xc
Function at 0x6e024efa
Capabilities:
Hide graphical window

Disassembly:
push 0x28
mov eax, 0x6e04df89
call fcn.6e04ac78
mov edi, ecx
lea esi, [edi + 0x30]
mov dword [ebp - 0x18], esi
push esi
call dword [sym.imp.kernel32.dll_TryEnterCriticalSection]
xor ebx, ebx
test eax, eax
setne bl
mov dword [ebp - 0x14], ebx
xor ecx, ecx
mov dword [ebp - 4], ecx
test eax, eax
jne 0x6e024f56
push ecx
push ecx
push ecx
push ecx
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
push 0xa
call dword [sym.imp.kernel32.dll_Sleep]
mov dword [ebp - 4], 1
test ebx, ebx
je 0x6e024f50
push esi
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
or dword [ebp - 4], 0xffffffff
jmp 0x6e024f0e
mov eax, dword [edi + 0x24]
xor ecx, ecx
cmp dword [ebp + 8], ecx
sete cl
inc ecx
mov dword [eax + 0x18], ecx
mov eax, dword [edi + 0x2c]
push eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x6e024f7f
mov dword [ebp - 4], 2
jmp 0x6e024fa7
mov eax, dword [ebp + 8]
neg eax
sbb eax, eax
and eax, 5
push eax
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [ebp + 8], 0
jne 0x6e024fa0
mov ecx, edi
call fcn.6e0252d7
mov dword [ebp - 4], 3
test ebx, ebx
je 0x6e024fb2
push esi
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
call fcn.6e04ac41
ret 4

Function at 0x6e0250a3
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x6e04dfdd
call fcn.6e04ac78
mov esi, ecx
lea edi, [esi + 0x30]
push edi
mov dword [ebp - 0x14], edi
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
xor edx, edx
inc edx
mov dword [ebp - 0x10], edx
mov eax, dword [esi + 0x24]
xor ebx, ebx
mov ecx, dword [ebp + 8]
mov dword [esi + 0x28], ecx
mov dword [ebp - 4], ebx
mov dword [eax + 4], ecx
mov eax, dword [esi + 0x24]
cmp dword [eax + 0xc], ebx
jne 0x6e02510e
cmp dword [eax + 4], ebx
je 0x6e02510e
push ebx
push ebx
push edx
push ebx
call dword [sym.imp.kernel32.dll_CreateEventA]
mov ecx, dword [esi + 0x24]
mov dword [ecx + 0x1c], eax
mov ecx, dword [esi + 0x24]
lea eax, [ecx + 0xc]
push eax
push ebx
push ecx
push 0x6e024fc0
push ebx
push ebx
call dword [sym.imp.kernel32.dll_CreateThread]
mov ecx, dword [esi + 0x24]
mov dword [ecx + 8], eax
push edi
mov dword [ebp - 4], 3
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
call fcn.6e04ac41
ret 4
Function at 0x6e0252d7
Capabilities:
Resume thread
Terminate thread

Disassembly:
push 0x24
mov eax, 0x6e04e007
call fcn.6e04ac78
mov esi, ecx
mov eax, dword [esi + 0x24]
test eax, eax
je 0x6e0253f5
cmp dword [eax + 8], 0
je 0x6e0253f5
lea edi, [esi + 0x30]
mov dword [ebp - 0x14], edi
push edi
call dword [sym.imp.kernel32.dll_TryEnterCriticalSection]
xor ebx, ebx
test eax, eax
setne bl
mov dword [ebp - 0x10], ebx
xor edx, edx
mov dword [ebp - 4], edx
test eax, eax
jne 0x6e025348
push edx
push edx
push edx
push edx
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
push 0xa
call dword [sym.imp.kernel32.dll_Sleep]
mov dword [ebp - 4], 1
test ebx, ebx
je 0x6e025342
push edi
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
or dword [ebp - 4], 0xffffffff
jmp 0x6e025300
mov eax, dword [esi + 0x24]
test eax, eax
je 0x6e025391
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x6e025391
cmp dword [esi + 0x2c], edx
jne 0x6e025391
push edx
push ecx
call dword [sym.imp.kernel32.dll_TerminateThread]
mov eax, dword [esi + 0x24]
mov dword [esi + 0x20], 1
push dword [eax + 8]
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [esi + 0x24]
and dword [eax + 8], 0
mov dword [ebp - 4], 2
test ebx, ebx
je 0x6e0253f5
push edi
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
jmp 0x6e0253f5
mov dword [ebp - 4], 3
test ebx, ebx
je 0x6e0253a8
push edi
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov eax, dword [esi + 0x24]
xor edx, edx
or dword [ebp - 4], 0xffffffff
mov dword [esi + 0x2c], edx
push dword [eax + 0x1c]
call dword [sym.imp.kernel32.dll_SetEvent]
mov eax, dword [esi + 0x24]
push dword [eax + 8]
call dword [sym.imp.kernel32.dll_ResumeThread]
mov eax, dword [esi + 0x24]
push 0x3e8
mov edi, dword [eax + 8]
and dword [eax + 8], 0
push edi
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x6e0253e7
and dword [esi + 0x20], 0
jmp 0x6e0253f5
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [esi + 0x20], 1
call fcn.6e04ac41
ret