Function at 0x6e00c5bf
Capabilities:
Parse url
Print debug messages
Query or enumerate registry value

Disassembly:
push 0xb4
mov eax, 0x6e04d0ff
call fcn.6e04ac78
cmp byte [0x6e07289b], 0
mov ebx, 0x6e070a80
mov edi, dword [ebp + 8]
jne 0x6e00c5e8
cmp byte [0x6e07289a], 0
je 0x6e00c617
push edi
push str.CAcroAXDocShim__x_::OnRefresh
push ebx
call fcn.6e01daf9
add esp, 0xc
cmp byte [0x6e07289a], 0
je 0x6e00c607
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07289b], 0
je 0x6e00c617
push ebx
call fcn.6e004210
pop ecx
xor ebx, ebx
cmp byte [edi + 0x13c], bl
je 0x6e00c63a
lea eax, [edi + 0x90]
mov ecx, dword [eax]
push ebx
push eax
mov esi, dword [ecx + 0x28]
mov ecx, esi
call dword [0x6e052870]
call esi
jmp 0x6e00c650
lea eax, [edi + 0x84]
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 0x18]
mov ecx, esi
call dword [0x6e052870]
call esi
mov dword [ebp - 0x18], ebx
cmp byte [edi + 0x2ab], 0
mov dword [ebp - 4], ebx
jne 0x6e00c683
mov ecx, dword [edi + 0x114]
test ecx, ecx
je 0x6e00c683
mov eax, dword [ecx]
lea edx, [ebp - 0x18]
push edx
push ecx
mov esi, dword [eax + 0x78]
mov ecx, esi
call dword [0x6e052870]
call esi
cmp dword [ebp - 0x18], 0
jne 0x6e00c69c
lea eax, [edi + 0x174]
push eax
lea ecx, [ebp - 0x18]
call fcn.6e01daf9
cmp dword [ebp - 0x18], 0
je 0x6e00cd62
movzx eax, word [edi + 0x2a8]
mov ecx, edi
push ebx
mov dword [ebp - 0x2c], eax
call fcn.6e00ee42
push dword [ebp - 0x18]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
mov esi, eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x34], eax
pop ecx
test eax, eax
je 0x6e00c6f9
test esi, esi
je 0x6e00c6f9
cmp dword [edi + 0x16c], ebx
jne 0x6e00c6f9
call fcn.6e01daf9
test al, al
je 0x6e00c6f9
call fcn.6e030929
push ebx
push esi
push dword [ebp - 0x34]
call fcn.6e0308a2
movzx eax, ax
add esp, 0xc
test ax, ax
jne 0x6e00c6f9
mov byte [edi + 0x2fc], bl
push 1
mov ecx, edi
call fcn.6e008cdb
test eax, eax
jne 0x6e00cd62
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x34], ebx
push eax
push 0x20019
push ebx
push str.SOFTWAREMicrosoftInternet_ExplorerMainFeatureControlFEATURE_URLMON_DECOMPRESSION_USES_WININET_URL_KB918692
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x44], 4
mov byte [ebp - 0x28], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6e00c7ed
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x48]
push eax
push ebx
push str.iexplore.exe
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x6e00c76d
mov ecx, dword [ebp - 0x28]
cmp dword [ebp - 0x38], eax
push 1
movzx ecx, cl
pop eax
cmovne ecx, eax
mov dword [ebp - 0x28], ecx
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x28]
xor eax, eax
inc eax
cmp cl, al
jne 0x6e00c7e7
cmp byte [edi + 0x2ab], al
je 0x6e00c7f8
cmp byte [edi + 0x2eb], al
je 0x6e00c7f8
push dword [ebp - 0x18]
mov ecx, edi
call fcn.6e00dd1b
mov esi, eax
mov dword [ebp - 0x34], esi
test esi, esi
je 0x6e00cd62
push dword [edi + 0x4c]
mov ecx, edi
call fcn.6e01daf9
test al, al
je 0x6e00cd62
cmp dword [edi + 0x16c], ebx
je 0x6e00cc23
cmp dword [ebp - 0x18], 0
je 0x6e00cc23
push dword [ebp - 0x18]
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x40], esi
test esi, esi
je 0x6e00cd80
jmp 0x6e00c82b
test cl, cl
jne 0x6e00c790
jmp 0x6e00c7f0
xor eax, eax
inc eax
cmp byte [edi + 0x2ab], al
jne 0x6e00c790
lea eax, [ebp - 0x18]
push eax
lea ecx, [edi + 0x174]
call fcn.6e01daf9
mov eax, dword [ebp - 0x2c]
mov ecx, edi
push ebx
push dword [edi + 0x2b0]
mov word [edi + 0x2a8], ax
call fcn.6e0099f0
test al, al
jne 0x6e00c7a7
xor eax, eax
inc eax
jmp 0x6e00cd67
xor eax, eax
inc eax
mov byte [ebp - 4], al
mov eax, dword [edi + 0x16c]
push dword [eax + 0x10]
call fcn.6e01daf9
cmp eax, 2
mov edx, 0xfde9
mov ecx, ebx
lea eax, [edi + 0x174]
cmovge ecx, edx
mov dword [ebp - 0x2c], eax
push ecx
push dword [eax]
mov dword [ebp - 0x24], ecx
call fcn.6e01daf9
add esp, 0xc
mov dword [ebp - 0x1c], eax
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push esi
push ebx
push dword [ebp - 0x24]
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov dword [ebp - 0x20], eax
test eax, eax
jle 0x6e00c8ea
push eax
lfence
call fcn.6e01daf9
mov dword [ebp - 0x10], eax
pop ecx
test eax, eax
je 0x6e00c8ea
push ebx
push ebx
lfence
push dword [ebp - 0x20]
push eax
push 0xffffffffffffffff
push esi
push ebx
push dword [ebp - 0x24]
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
cmp eax, dword [ebp - 0x20]
jne 0x6e00c8de
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x6e00c8e1
cmp byte [edi + 0x2ab], 0
jne 0x6e00c8e1
push eax
push dword [ebp - 0x10]
call dword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsstr]
pop ecx
pop ecx
test eax, eax
jne 0x6e00c8e1
lea eax, [edi + 0x174]
push eax
lea ecx, [ebp - 0x40]
call fcn.6e01daf9
mov esi, dword [ebp - 0x40]
jmp 0x6e00c8e1
lfence
push dword [ebp - 0x10]
call fcn.6e01daf9
pop ecx
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x6e00c8f8
push eax
call fcn.6e01daf9
pop ecx
test esi, esi
je 0x6e00c94c
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push esi
push ebx
push dword [ebp - 0x24]
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov dword [ebp - 0x10], eax
test eax, eax
jle 0x6e00c94c
push eax
lfence
call fcn.6e01daf9
mov dword [ebp - 0x14], eax
pop ecx
test eax, eax
je 0x6e00c94c
push ebx
push ebx
push dword [ebp - 0x10]
lfence
push eax
push 0xffffffffffffffff
push esi
push ebx
push dword [ebp - 0x24]
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
cmp eax, dword [ebp - 0x10]
je 0x6e00c94f
push dword [ebp - 0x14]
lfence
call fcn.6e01daf9
pop ecx
mov dword [ebp - 0x14], ebx
mov ecx, dword [edi + 0x114]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x10], ebx
test ecx, ecx
je 0x6e00ca9a
mov dword [ebp - 0x20], ebx
mov eax, dword [ecx]
lea edx, [ebp - 0x20]
push edx
push ecx
mov byte [ebp - 4], 2
mov edi, dword [eax + 0x78]
mov ecx, edi
call dword [0x6e052870]
call edi
cmp dword [ebp - 0x20], 0
je 0x6e00ca14
lea eax, [ebp - 0x20]
push eax
call fcn.6e01daf9
pop ecx
test al, al
je 0x6e00ca14
push dword [ebp - 0x2c]
call fcn.6e01daf9
pop ecx
test al, al
je 0x6e00ca14
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
test eax, eax
je 0x6e00c9ff
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push eax
push ebx
push dword [ebp - 0x24]
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov dword [ebp - 0x10], eax
test eax, eax
jle 0x6e00c9ff
push eax
lfence
call fcn.6e01daf9
mov edi, eax
mov dword [ebp - 0x1c], edi
pop ecx
test edi, edi
je 0x6e00c9ff
push ebx
push ebx
push dword [ebp - 0x10]
lfence
push edi
push 0xffffffffffffffff
push dword [ebp - 0x30]
push ebx
push dword [ebp - 0x24]
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
cmp eax, dword [ebp - 0x10]
je 0x6e00ca02
push edi
lfence
call fcn.6e01daf9
pop ecx
mov dword [ebp - 0x1c], ebx
mov eax, dword [ebp - 0x2c]
push dword [ebp - 0x24]
push dword [eax]
call fcn.6e01daf9
pop ecx
pop ecx
mov dword [ebp - 0x10], eax
mov edi, dword [ebp + 8]
cmp byte [edi + 0x2ab], 0
je 0x6e00ca8d
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x6e00ca2e
push eax
call fcn.6e01daf9
pop ecx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
test eax, eax
je 0x6e00ca8a
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push eax
push ebx
push dword [ebp - 0x24]
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov dword [ebp - 0x2c], eax
test eax, eax
jle 0x6e00ca8a
push eax
lfence
call fcn.6e01daf9
mov dword [ebp - 0x14], eax
pop ecx
test eax, eax
je 0x6e00ca8a
push ebx
push ebx
push dword [ebp - 0x2c]
lfence
push eax
push 0xffffffffffffffff
push dword [ebp - 0x30]
push ebx
push dword [ebp - 0x24]
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
cmp eax, dword [ebp - 0x2c]
je 0x6e00ca8d
push dword [ebp - 0x14]
lfence
call fcn.6e01daf9
pop ecx
mov dword [ebp - 0x14], ebx
push dword [ebp - 0x20]
mov byte [ebp - 4], 1
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp byte [edi + 0x13c], 0
jne 0x6e00cc2d
cmp byte [0x6e07289b], 0
jne 0x6e00cab9
cmp byte [0x6e07289a], 0
je 0x6e00caf2
push str.CAcroAXDocShim::SendAndLocateURLs_Embedded_case
push 0x6e070a80
call fcn.6e01daf9
cmp byte [0x6e07289a], 0
pop ecx
pop ecx
je 0x6e00cade
push 0x6e070a80
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07289b], 0
je 0x6e00caf2
push 0x6e070a80
call fcn.6e004210
pop ecx
push 0x3c
lea eax, [ebp - 0x84]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x84], 0x3c
xor eax, eax
inc eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x84]
push eax
push ebx
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.wininet.dll_InternetCrackUrlA]
cmp byte [0x6e07289b], 0
mov dword [ebp - 0x30], eax
jne 0x6e00cb3e
cmp byte [0x6e07289a], 0
je 0x6e00cb7b
push dword [ebp - 0x1c]
push str.CAcroAXDocShim::SendAndLocateURLs_Embedded_case_container_URL___s
push 0x6e070a80
call fcn.6e01daf9
add esp, 0xc
cmp byte [0x6e07289a], 0
je 0x6e00cb67
push 0x6e070a80
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07289b], 0
je 0x6e00cb7b
push 0x6e070a80
call fcn.6e004210
pop ecx
push 0x3c
lea eax, [ebp - 0xc0]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0xc0], 0x3c
xor eax, eax
inc eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0x90], eax
lea eax, [ebp - 0xc0]
push eax
push ebx
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.wininet.dll_InternetCrackUrlA]
cmp dword [ebp - 0x30], 0
je 0x6e00cc2d
test eax, eax
je 0x6e00cc2d
cmp dword [ebp - 0x78], 3
je 0x6e00cbce
cmp dword [ebp - 0x78], 4
jne 0x6e00cc2d
cmp dword [ebp - 0xb4], 5
je 0x6e00cbe0
cmp dword [ebp - 0xb4], 0xffffffff
jne 0x6e00cc2d
push ebx
push ebx
push 0x400f0000
call fcn.6e01eaa6
mov eax, dword [ebp - 0x14]
add esp, 0xc
test eax, eax
je 0x6e00cbfd
push eax
call fcn.6e01daf9
pop ecx
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x6e00cc0b
push eax
call fcn.6e01daf9
pop ecx
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x6e00cc19
push eax
call fcn.6e01daf9
pop ecx
push esi
mov byte [ebp - 4], bl
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov ebx, 0x80004005
jmp 0x6e00cd69
push dword [ebp - 0x1c]
push dword [ebp - 0x14]
push dword [edi + 0x16c]
call fcn.6e01daf9
push dword [ebp - 0x14]
push dword [edi + 0x16c]
call fcn.6e01daf9
mov eax, dword [ebp - 0x14]
add esp, 0x14
test eax, eax
je 0x6e00cc5d
push eax
call fcn.6e01daf9
pop ecx
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x6e00cc6b
push eax
call fcn.6e01daf9
pop ecx
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x6e00cc79
push eax
call fcn.6e01daf9
pop ecx
push esi
mov byte [ebp - 4], bl
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x28]
xor edx, edx
inc edx
cmp al, dl
jne 0x6e00cca1
cmp byte [edi + 0x2ab], 0
jne 0x6e00ccbb
cmp byte [edi + 0x2eb], 0
je 0x6e00ccad
jmp 0x6e00ccbb
test al, al
jne 0x6e00ccbb
cmp byte [edi + 0x2ab], al
jne 0x6e00ccbb
push edx
push dword [ebp - 0x34]
mov ecx, edi
call fcn.6e01daf9
xor edx, edx
inc edx
cmp byte [edi + 0x13c], 0
je 0x6e00cce0
lea eax, [edi + 0x90]
mov ecx, dword [eax]
push edx
push eax
mov esi, dword [ecx + 0x28]
mov ecx, esi
call dword [0x6e052870]
call esi
jmp 0x6e00cd69
mov dword [ebp - 0x28], ebx
mov eax, dword [edi + 0x10]
mov byte [ebp - 4], 3
test eax, eax
je 0x6e00cd1d
mov esi, dword [eax]
lea ecx, [ebp - 0x28]
push ecx
push 0x6e053834
push eax
mov ecx, dword [esi]
call dword [0x6e052870]
call dword [esi]
test eax, eax
js 0x6e00cd1d
mov eax, dword [ebp - 0x28]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x44]
mov ecx, esi
call dword [0x6e052870]
call esi
jmp 0x6e00cd46
lea eax, [edi + 0x144]
push eax
push dword [edi + 0x140]
lea ecx, [edi + 0x80]
mov esi, dword [ecx]
push ebx
push dword [edi + 0x10]
push ebx
push 0xfffffffffffffffc
push ecx
mov ecx, dword [esi + 0x2c]
call dword [0x6e052870]
call dword [esi + 0x2c]
mov eax, dword [ebp - 0x28]
mov byte [ebp - 4], bl
test eax, eax
je 0x6e00cd69
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x6e052870]
call esi
jmp 0x6e00cd69
mov eax, 0x80004005
mov ebx, eax
push dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, ebx
call fcn.6e04ac41
ret 4
push 0x8007000e
call fcn.6e01daf9
int3