Function at 0x6e00c17f
Capabilities:
Parse url
Print debug messages
Query or enumerate registry value

Disassembly:
push 0xb4
mov eax, 0x6e04b92d
call fcn.6e049338
cmp byte [0x6e07047b], 0
mov ebx, 0x6e06ea68
mov edi, dword [ebp + 8]
jne 0x6e00c1a8
cmp byte [0x6e07047a], 0
je 0x6e00c1d7
push edi
push str.CAcroAXDocShim__x_::OnRefresh
push ebx
call fcn.6e018049
add esp, 0xc
cmp byte [0x6e07047a], 0
je 0x6e00c1c7
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07047b], 0
je 0x6e00c1d7
push ebx
call fcn.6e003fc0
pop ecx
xor ebx, ebx
cmp byte [edi + 0x13c], bl
je 0x6e00c1fa
lea eax, [edi + 0x90]
mov ecx, dword [eax]
push ebx
push eax
mov esi, dword [ecx + 0x28]
mov ecx, esi
call dword [0x6e050848]
call esi
jmp 0x6e00c210
lea eax, [edi + 0x84]
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 0x18]
mov ecx, esi
call dword [0x6e050848]
call esi
mov dword [ebp - 0x1c], ebx
cmp byte [edi + 0x2ab], 0
mov dword [ebp - 4], ebx
jne 0x6e00c243
mov ecx, dword [edi + 0x114]
test ecx, ecx
je 0x6e00c243
mov eax, dword [ecx]
lea edx, [ebp - 0x1c]
push edx
push ecx
mov esi, dword [eax + 0x78]
mov ecx, esi
call dword [0x6e050848]
call esi
cmp dword [ebp - 0x1c], 0
jne 0x6e00c25c
lea eax, [edi + 0x174]
push eax
lea ecx, [ebp - 0x1c]
call fcn.6e018049
cmp dword [ebp - 0x1c], 0
je 0x6e00c930
movzx eax, word [edi + 0x2a8]
mov ecx, edi
push ebx
mov dword [ebp - 0x2c], eax
call fcn.6e00ea22
push dword [ebp - 0x1c]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
mov esi, eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x34], eax
pop ecx
test eax, eax
je 0x6e00c2b9
test esi, esi
je 0x6e00c2b9
cmp dword [edi + 0x16c], ebx
jne 0x6e00c2b9
call fcn.6e018049
test al, al
je 0x6e00c2b9
call fcn.6e02f76d
push ebx
push esi
push dword [ebp - 0x34]
call fcn.6e02f6e6
movzx eax, ax
add esp, 0xc
test ax, ax
jne 0x6e00c2b9
mov byte [edi + 0x2fc], bl
push 1
mov ecx, edi
call fcn.6e00894b
test eax, eax
jne 0x6e00c930
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x34], ebx
push eax
push 0x20019
push ebx
push str.SOFTWAREMicrosoftInternet_ExplorerMainFeatureControlFEATURE_URLMON_DECOMPRESSION_USES_WININET_URL_KB918692
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x44], 4
mov byte [ebp - 0x28], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6e00c3ab
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x48]
push eax
push ebx
push str.iexplore.exe
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x6e00c32d
mov ecx, dword [ebp - 0x28]
cmp dword [ebp - 0x38], eax
push 1
movzx ecx, cl
pop eax
cmovne ecx, eax
mov dword [ebp - 0x28], ecx
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x28]
xor eax, eax
inc eax
cmp cl, al
jne 0x6e00c350
cmp byte [edi + 0x2ab], al
je 0x6e00c3b6
cmp byte [edi + 0x2eb], al
je 0x6e00c3b6
test cl, cl
je 0x6e00c3ae
push dword [ebp - 0x1c]
mov ecx, edi
call fcn.6e00d929
mov esi, eax
mov dword [ebp - 0x34], esi
test esi, esi
je 0x6e00c930
push dword [edi + 0x4c]
mov ecx, edi
call fcn.6e018049
test al, al
je 0x6e00c930
cmp dword [edi + 0x16c], ebx
je 0x6e00c7f3
cmp dword [ebp - 0x1c], 0
je 0x6e00c7f3
push dword [ebp - 0x1c]
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x40], esi
test esi, esi
je 0x6e00c94e
jmp 0x6e00c3e9
xor eax, eax
inc eax
cmp byte [edi + 0x2ab], al
jne 0x6e00c354
lea eax, [ebp - 0x1c]
push eax
lea ecx, [edi + 0x174]
call fcn.6e018049
mov eax, dword [ebp - 0x2c]
mov ecx, edi
push ebx
push dword [edi + 0x2b0]
mov word [edi + 0x2a8], ax
call fcn.6e00965e
test al, al
jne 0x6e00c36b
xor eax, eax
inc eax
jmp 0x6e00c935
xor eax, eax
inc eax
mov byte [ebp - 4], al
mov eax, dword [edi + 0x16c]
push dword [eax + 0x10]
call fcn.6e018049
cmp eax, 2
mov edx, 0xfde9
mov ecx, ebx
lea eax, [edi + 0x174]
cmovge ecx, edx
mov dword [ebp - 0x2c], eax
push ecx
push dword [eax]
mov dword [ebp - 0x24], ecx
call fcn.6e018049
add esp, 0xc
mov dword [ebp - 0x20], eax
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push esi
push ebx
push dword [ebp - 0x24]
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov dword [ebp - 0x14], eax
test eax, eax
jle 0x6e00c479
push eax
lfence
call fcn.6e018049
mov dword [ebp - 0x10], eax
pop ecx
test eax, eax
je 0x6e00c479
push ebx
push ebx
push dword [ebp - 0x14]
lfence
push eax
push 0xffffffffffffffff
push esi
push ebx
push dword [ebp - 0x24]
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
cmp eax, dword [ebp - 0x14]
jne 0x6e00c46d
mov eax, dword [ebp - 0x10]
jmp 0x6e00c47e
lfence
push dword [ebp - 0x10]
call fcn.6e018049
pop ecx
mov eax, ebx
mov dword [ebp - 0x10], ebx
test eax, eax
je 0x6e00c4bc
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x6e00c4b5
cmp byte [edi + 0x2ab], 0
jne 0x6e00c4b5
push ecx
push eax
call dword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsstr]
pop ecx
pop ecx
test eax, eax
jne 0x6e00c4b2
lea eax, [edi + 0x174]
push eax
lea ecx, [ebp - 0x40]
call fcn.6e018049
mov esi, dword [ebp - 0x40]
mov eax, dword [ebp - 0x10]
push eax
call fcn.6e018049
pop ecx
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x6e00c4ca
push eax
call fcn.6e018049
pop ecx
test esi, esi
je 0x6e00c51e
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push esi
push ebx
push dword [ebp - 0x24]
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov dword [ebp - 0x14], eax
test eax, eax
jle 0x6e00c51e
push eax
lfence
call fcn.6e018049
mov dword [ebp - 0x18], eax
pop ecx
test eax, eax
je 0x6e00c51e
push ebx
push ebx
push dword [ebp - 0x14]
lfence
push eax
push 0xffffffffffffffff
push esi
push ebx
push dword [ebp - 0x24]
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
cmp eax, dword [ebp - 0x14]
je 0x6e00c521
push dword [ebp - 0x18]
lfence
call fcn.6e018049
pop ecx
mov dword [ebp - 0x18], ebx
mov ecx, dword [edi + 0x114]
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x14], ebx
test ecx, ecx
je 0x6e00c66c
mov dword [ebp - 0x10], ebx
mov eax, dword [ecx]
lea edx, [ebp - 0x10]
push edx
push ecx
mov byte [ebp - 4], 2
mov edi, dword [eax + 0x78]
mov ecx, edi
call dword [0x6e050848]
call edi
cmp dword [ebp - 0x10], 0
je 0x6e00c5e6
lea eax, [ebp - 0x10]
push eax
call fcn.6e018049
pop ecx
test al, al
je 0x6e00c5e6
push dword [ebp - 0x2c]
call fcn.6e018049
pop ecx
test al, al
je 0x6e00c5e6
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x30], eax
test eax, eax
je 0x6e00c5d1
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push eax
push ebx
push dword [ebp - 0x24]
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov dword [ebp - 0x14], eax
test eax, eax
jle 0x6e00c5d1
push eax
lfence
call fcn.6e018049
mov edi, eax
mov dword [ebp - 0x20], edi
pop ecx
test edi, edi
je 0x6e00c5d1
push ebx
push ebx
push dword [ebp - 0x14]
lfence
push edi
push 0xffffffffffffffff
push dword [ebp - 0x30]
push ebx
push dword [ebp - 0x24]
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
cmp eax, dword [ebp - 0x14]
je 0x6e00c5d4
push edi
lfence
call fcn.6e018049
pop ecx
mov dword [ebp - 0x20], ebx
mov eax, dword [ebp - 0x2c]
push dword [ebp - 0x24]
push dword [eax]
call fcn.6e018049
pop ecx
pop ecx
mov dword [ebp - 0x14], eax
mov edi, dword [ebp + 8]
cmp byte [edi + 0x2ab], 0
je 0x6e00c65f
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x6e00c600
push eax
call fcn.6e018049
pop ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x30], eax
test eax, eax
je 0x6e00c65c
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push eax
push ebx
push dword [ebp - 0x24]
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov dword [ebp - 0x2c], eax
test eax, eax
jle 0x6e00c65c
push eax
lfence
call fcn.6e018049
mov dword [ebp - 0x18], eax
pop ecx
test eax, eax
je 0x6e00c65c
push ebx
push ebx
push dword [ebp - 0x2c]
lfence
push eax
push 0xffffffffffffffff
push dword [ebp - 0x30]
push ebx
push dword [ebp - 0x24]
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
cmp eax, dword [ebp - 0x2c]
je 0x6e00c65f
push dword [ebp - 0x18]
lfence
call fcn.6e018049
pop ecx
mov dword [ebp - 0x18], ebx
push dword [ebp - 0x10]
mov byte [ebp - 4], 1
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp byte [edi + 0x13c], 0
jne 0x6e00c7fd
cmp byte [0x6e07047b], 0
jne 0x6e00c68b
cmp byte [0x6e07047a], 0
je 0x6e00c6c4
push str.CAcroAXDocShim::SendAndLocateURLs_Embedded_case
push 0x6e06ea68
call fcn.6e018049
cmp byte [0x6e07047a], 0
pop ecx
pop ecx
je 0x6e00c6b0
push 0x6e06ea68
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07047b], 0
je 0x6e00c6c4
push 0x6e06ea68
call fcn.6e003fc0
pop ecx
push 0x3c
lea eax, [ebp - 0x84]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x84], 0x3c
xor eax, eax
inc eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x84]
push eax
push ebx
push ebx
push dword [ebp - 0x20]
call dword [sym.imp.wininet.dll_InternetCrackUrlA]
cmp byte [0x6e07047b], 0
mov dword [ebp - 0x30], eax
jne 0x6e00c710
cmp byte [0x6e07047a], 0
je 0x6e00c74d
push dword [ebp - 0x20]
push str.CAcroAXDocShim::SendAndLocateURLs_Embedded_case_container_URL___s
push 0x6e06ea68
call fcn.6e018049
add esp, 0xc
cmp byte [0x6e07047a], 0
je 0x6e00c739
push 0x6e06ea68
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07047b], 0
je 0x6e00c74d
push 0x6e06ea68
call fcn.6e003fc0
pop ecx
push 0x3c
lea eax, [ebp - 0xc0]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0xc0], 0x3c
xor eax, eax
inc eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0x90], eax
lea eax, [ebp - 0xc0]
push eax
push ebx
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.wininet.dll_InternetCrackUrlA]
cmp dword [ebp - 0x30], 0
je 0x6e00c7fd
test eax, eax
je 0x6e00c7fd
cmp dword [ebp - 0x78], 3
je 0x6e00c7a0
cmp dword [ebp - 0x78], 4
jne 0x6e00c7fd
cmp dword [ebp - 0xb4], 5
je 0x6e00c7b2
cmp dword [ebp - 0xb4], 0xffffffff
jne 0x6e00c7fd
push ebx
push 0x400f0072
call fcn.6e01e457
mov eax, dword [ebp - 0x18]
pop ecx
pop ecx
test eax, eax
je 0x6e00c7cd
push eax
call fcn.6e018049
pop ecx
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x6e00c7db
push eax
call fcn.6e018049
pop ecx
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x6e00c7e9
push eax
call fcn.6e018049
pop ecx
push esi
mov byte [ebp - 4], bl
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov ebx, 0x80004005
jmp 0x6e00c937
push dword [ebp - 0x20]
push dword [ebp - 0x18]
push dword [edi + 0x16c]
call fcn.6e018049
push dword [ebp - 0x18]
push dword [edi + 0x16c]
call fcn.6e018049
mov eax, dword [ebp - 0x18]
add esp, 0x14
test eax, eax
je 0x6e00c82d
push eax
call fcn.6e018049
pop ecx
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x6e00c83b
push eax
call fcn.6e018049
pop ecx
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x6e00c849
push eax
call fcn.6e018049
pop ecx
push esi
mov byte [ebp - 4], bl
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x28]
xor edx, edx
inc edx
cmp al, dl
jne 0x6e00c86f
cmp byte [edi + 0x2ab], 0
jne 0x6e00c889
cmp byte [edi + 0x2eb], 0
je 0x6e00c87b
test al, al
jne 0x6e00c889
cmp byte [edi + 0x2ab], al
jne 0x6e00c889
push edx
push dword [ebp - 0x34]
mov ecx, edi
call fcn.6e018049
xor edx, edx
inc edx
cmp byte [edi + 0x13c], 0
je 0x6e00c8ae
lea eax, [edi + 0x90]
mov ecx, dword [eax]
push edx
push eax
mov esi, dword [ecx + 0x28]
mov ecx, esi
call dword [0x6e050848]
call esi
jmp 0x6e00c937
mov dword [ebp - 0x28], ebx
mov eax, dword [edi + 0x10]
mov byte [ebp - 4], 3
test eax, eax
je 0x6e00c8eb
mov esi, dword [eax]
lea ecx, [ebp - 0x28]
push ecx
push 0x6e0517c4
push eax
mov ecx, dword [esi]
call dword [0x6e050848]
call dword [esi]
test eax, eax
js 0x6e00c8eb
mov eax, dword [ebp - 0x28]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x44]
mov ecx, esi
call dword [0x6e050848]
call esi
jmp 0x6e00c914
lea eax, [edi + 0x144]
push eax
push dword [edi + 0x140]
lea ecx, [edi + 0x80]
mov esi, dword [ecx]
push ebx
push dword [edi + 0x10]
push ebx
push 0xfffffffffffffffc
push ecx
mov ecx, dword [esi + 0x2c]
call dword [0x6e050848]
call dword [esi + 0x2c]
mov eax, dword [ebp - 0x28]
mov byte [ebp - 4], bl
test eax, eax
je 0x6e00c937
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x6e050848]
call esi
jmp 0x6e00c937
mov eax, 0x80004005
mov ebx, eax
push dword [ebp - 0x1c]
or dword [ebp - 4], 0xffffffff
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, ebx
call fcn.6e049301
ret 4
push 0x8007000e
call fcn.6e018049
int3