joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6e010f0d
Capabilities:
Print debug messages

Disassembly:
push 0x10
mov eax, 0x6e04bc13
call fcn.6e049338
mov esi, ecx
cmp byte [0x6e07047b], 0
jne 0x6e010f2d
cmp byte [0x6e07047a], 0
je 0x6e010f5f
push str.CAcroAXDocShim::makeJScriptObject
mov edi, 0x6e06ea68
push edi
call fcn.6e0184f0
cmp byte [0x6e07047a], 0
pop ecx
pop ecx
je 0x6e010f4f
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07047b], 0
je 0x6e010f5f
push edi
call fcn.6e003fc0
pop ecx
mov ecx, dword [esi + 0x11c]
mov edi, 0x80004005
test ecx, ecx
je 0x6e0110a8
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov eax, dword [ecx]
lea edx, [ebp - 0x1c]
push edx
push ecx
mov dword [ebp - 4], ebx
mov esi, dword [eax + 0x14]
mov ecx, esi
call dword [0x6e050848]
call esi
mov edi, eax
test edi, edi
js 0x6e01108d
mov dword [ebp - 0x18], ebx
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x18]
push ecx
push 0x6e05a824
push eax
mov esi, dword [eax]
mov byte [ebp - 4], 1
mov ecx, dword [esi]
call dword [0x6e050848]
call dword [esi]
mov edi, eax
test edi, edi
js 0x6e011073
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
push edx
push eax
mov byte [ebp - 4], 2
mov ecx, dword [eax]
mov esi, dword [ecx + 0x1c]
mov ecx, esi
call dword [0x6e050848]
call esi
mov edi, eax
test edi, edi
js 0x6e011058
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x10]
push ecx
push 0x6e05a814
push eax
mov esi, dword [eax]
mov byte [ebp - 4], 3
mov ecx, dword [esi]
call dword [0x6e050848]
call dword [esi]
mov edi, eax
test edi, edi
js 0x6e01103d
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x6e011040
mov esi, dword [ebp + 0x10]
push ebx
push ebx
push ebx
push esi
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
push eax
call fcn.6e0184f0
mov edi, eax
add esp, 0x20
test edi, edi
js 0x6e01103d
cmp word [esi], 9
mov eax, 0x80004005
cmovne edi, eax
mov eax, dword [ebp - 0x10]
mov byte [ebp - 4], 2
test eax, eax
je 0x6e011058
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x6e050848]
call esi
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 1
test eax, eax
je 0x6e011073
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x6e050848]
call esi
mov eax, dword [ebp - 0x18]
mov byte [ebp - 4], bl
test eax, eax
je 0x6e01108d
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x6e050848]
call esi
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x6e0110a8
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x6e050848]
call esi
mov eax, edi
call fcn.6e049301
ret 0xc
Function at 0x6e0110b2
Capabilities:
Print debug messages

Disassembly:
push 0x14
mov eax, 0x6e04bc3e
call fcn.6e049338
mov edi, ecx
cmp byte [0x6e07047b], 0
jne 0x6e0110d2
cmp byte [0x6e07047a], 0
je 0x6e011104
push str.CAcroAXDocShim::makeJScriptStringArray
mov esi, 0x6e06ea68
push esi
call fcn.6e0184f0
cmp byte [0x6e07047a], 0
pop ecx
pop ecx
je 0x6e0110f4
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07047b], 0
je 0x6e011104
push esi
call fcn.6e003fc0
pop ecx
mov esi, dword [ebp + 0x14]
mov ecx, edi
mov ebx, dword [ebp + 0x10]
push esi
push ebx
push str.Array
call fcn.6e010f0d
mov edi, eax
test edi, edi
js 0x6e0111c4
lfence
and dword [ebp - 0x10], 0
mov eax, dword [esi + 8]
lea ecx, [ebp - 0x10]
and dword [ebp - 4], 0
push ecx
push 0x6e05a814
mov esi, dword [eax]
push eax
mov ecx, dword [esi]
call dword [0x6e050848]
call dword [esi]
mov edi, eax
mov eax, dword [ebp - 0x10]
test edi, edi
js 0x6e0111ac
test eax, eax
je 0x6e0111ac
xor esi, esi
cmp dword [ebp + 0xc], esi
jbe 0x6e0111ac
xor eax, eax
lea ecx, [ebp - 0x20]
mov word [ebp - 0x20], ax
mov eax, dword [ebp + 8]
push dword [eax + esi*4]
call fcn.6e0184f0
push 0
push 1
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 1
push eax
push 0
push ebx
push 1
push str.push
push dword [ebp - 0x10]
call fcn.6e0184f0
add esp, 0x20
mov byte [ebp - 4], 0
mov edi, eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
test edi, edi
js 0x6e0111a9
inc esi
cmp esi, dword [ebp + 0xc]
jb 0x6e01115a
mov eax, dword [ebp - 0x10]
or dword [ebp - 4], 0xffffffff
test eax, eax
je 0x6e0111c4
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x6e050848]
call esi
mov eax, edi
call fcn.6e049301
ret 0x10

Function at 0x6e012313
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
push str.GlobalARM_Update_Mutex
push 0
push 0x100000
call dword [sym.imp.kernel32.dll_OpenMutexW]
test eax, eax
je 0x6e012334
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
xor eax, eax
inc eax
ret
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 2
jne 0x6e012330
xor eax, eax
ret

Function at 0x6e012342
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
push str.GlobalAcro_Update_Mutex
push 0
push 0x100000
call dword [sym.imp.kernel32.dll_OpenMutexW]
test eax, eax
je 0x6e012363
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
xor eax, eax
inc eax
ret
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 2
jne 0x6e01235f
xor eax, eax
ret
Function at 0x6e015280
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 0x18]
test edi, edi
jne 0x6e015296
mov eax, 0x80004003
jmp 0x6e01535e
push esi
mov esi, dword [ebp + 8]
test esi, esi
push 4
pop ecx
lea eax, [esi - 0x88]
cmove eax, ecx
cmp dword [eax], 0
je 0x6e0152b7
mov eax, 0x80004005
jmp 0x6e01535d
cmp byte [0x6e07047b], 0
jne 0x6e0152c9
cmp byte [0x6e07047a], 0
je 0x6e0152fd
push ebx
push str._OleDocument__IOleDocumentImpl_CreateView
mov ebx, 0x6e06ee88
push ebx
call fcn.6e0184f0
cmp byte [0x6e07047a], 0
pop ecx
pop ecx
je 0x6e0152ec
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07047b], 0
je 0x6e0152fc
push ebx
call fcn.6e003fc0
pop ecx
pop ebx
push 0x78
pop ecx
test esi, esi
lea eax, [esi - 0x14]
cmove eax, ecx
lea ecx, [ebp - 4]
push ecx
push 0x6e05a864
push eax
mov esi, dword [eax]
mov ecx, dword [esi]
call dword [0x6e050848]
call dword [esi]
cmp dword [ebp + 0xc], 0
je 0x6e01533a
mov eax, dword [ebp - 4]
push dword [ebp + 0xc]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0xc]
mov ecx, esi
call dword [0x6e050848]
call esi
cmp dword [ebp + 0x10], 0
je 0x6e015356
mov eax, dword [ebp - 4]
push dword [ebp + 0x10]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x38]
mov ecx, esi
call dword [0x6e050848]
call esi
mov eax, dword [ebp - 4]
mov dword [edi], eax
xor eax, eax
pop esi
pop edi
leave
ret 0x14

Function at 0x6e0153d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp byte [0x6e07047b], 0
push ebx
push esi
jne 0x6e0153e9
cmp byte [0x6e07047a], 0
je 0x6e01541b
push 0x6e054f2c
mov esi, 0x6e06ee88
push esi
call fcn.6e0184f0
cmp byte [0x6e07047a], 0
pop ecx
pop ecx
je 0x6e01540b
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07047b], 0
je 0x6e01541b
push esi
call fcn.6e003fc0
pop ecx
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
lea eax, [esi - 0x8c]
neg esi
sbb esi, esi
and esi, eax
test ebx, ebx
jne 0x6e01543b
mov eax, 0x80004003
jmp 0x6e0154cb
test esi, esi
je 0x6e0154c9
push edi
push 0x6e05a864
call fcn.6e0184f0
test eax, eax
je 0x6e015457
lea edi, [esi + 0x78]
jmp 0x6e0154b6
mov edi, 0x6e054b58
mov eax, dword [edi - 8]
mov dword [ebp - 8], eax
test eax, eax
je 0x6e015477
push 0x6e05a864
push eax
call fcn.6e0184f0
pop ecx
pop ecx
test eax, eax
je 0x6e0154a4
mov eax, dword [edi]
mov dword [ebp - 4], eax
cmp eax, 1
je 0x6e0154b1
push dword [edi - 4]
mov ecx, eax
push ebx
push 0x6e05a864
push esi
call dword [0x6e050848]
call dword [ebp - 4]
test eax, eax
je 0x6e0154c8
cmp dword [ebp - 8], 0
je 0x6e0154a4
test eax, eax
js 0x6e0154ac
add edi, 0xc
cmp dword [edi], 0
jne 0x6e01545c
and dword [ebx], 0
jmp 0x6e0154c8
mov edi, dword [edi - 4]
add edi, esi
mov eax, dword [edi]
push edi
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x6e050848]
call esi
mov dword [ebx], edi
pop edi
xor eax, eax
pop esi
pop ebx
leave
ret 0xc
Function at 0x6e0154e0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x6e06c64c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 4
lea esi, [ebx - 0x8c]
pop eax
cmove esi, eax
mov dword [ebp - 0x2c], esi
cmp dword [esi], edi
je 0x6e0156b6
cmp byte [0x6e07047b], 0
jne 0x6e015524
cmp byte [0x6e07047a], 0
je 0x6e01555d
push str._OleDocument__IOleDocumentViewImpl_SetInPlaceSite
push 0x6e06ee88
call fcn.6e0184f0
cmp byte [0x6e07047a], 0
pop ecx
pop ecx
je 0x6e015549
push 0x6e06ee88
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07047b], 0
je 0x6e01555d
push 0x6e06ee88
call fcn.6e003fc0
pop ecx
cmp dword [esi], 0
je 0x6e0155a0
mov eax, dword [ebx]
push 0
push ebx
mov esi, dword [eax + 0x28]
mov ecx, esi
call dword [0x6e050848]
call esi
mov eax, 0x84
lea ecx, [ebx - 0xc]
test ebx, ebx
cmove ecx, eax
push ecx
mov eax, dword [ecx]
mov esi, dword [eax + 0x14]
mov ecx, esi
call dword [0x6e050848]
call esi
test eax, eax
jns 0x6e01559d
lfence
jmp 0x6e0156b8
mov esi, dword [ebp - 0x2c]
test edi, edi
je 0x6e0156b6
push edi
mov ecx, esi
call fcn.6e0184f0
xor edi, edi
lea eax, [ebx + 0xc4]
mov ecx, 0x154
mov dword [ebp - 0x34], edi
test ebx, ebx
lea edx, [ebp - 0x30]
push edx
cmove eax, ecx
mov dword [ebp - 0x28], eax
mov dword [eax], 0x14
mov eax, dword [esi]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0xc]
mov ecx, esi
call dword [0x6e050848]
call esi
test eax, eax
jne 0x6e015637
mov eax, 0x104
lea edi, [ebx + 0x74]
test ebx, ebx
cmove edi, eax
mov ecx, edi
call fcn.6e00e29a
mov ecx, dword [ebp - 0x2c]
push dword [ebp - 0x28]
mov eax, dword [ecx]
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x14]
push ecx
mov esi, dword [eax]
lea ecx, [ebp - 0x34]
push ecx
push edi
push eax
mov ecx, dword [esi + 0x20]
call dword [0x6e050848]
call dword [esi + 0x20]
test ebx, ebx
lea ecx, [ebx + 0xb0]
mov eax, 0x140
cmove ecx, eax
mov eax, dword [ebp - 0x30]
xor edi, edi
mov dword [ecx], eax
push edi
push ecx
mov eax, esp
test ebx, ebx
push edi
push edi
push edi
push ecx
mov dword [eax], edi
lea ecx, [ebp - 0x14]
mov eax, esp
mov dword [eax], ecx
lea ecx, [ebx - 0x48]
push dword [ebp - 0x30]
push 0x48
pop eax
cmove ecx, eax
call fcn.6e0184f0
push 0x4c
pop ecx
test ebx, ebx
lea esi, [ebx - 0x44]
push edi
cmove esi, ecx
push edi
push str.bADC4294624
mov dword [esi], eax
call fcn.6e0184f0
add esp, 0xc
lea ecx, [ebx + 0x259]
test ebx, ebx
mov edx, 0x2e9
cmove ecx, edx
cmp byte [ecx], 0
jne 0x6e015690
test eax, eax
je 0x6e01569f
push edi
push edi
push 0x1500
push dword [esi]
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x6e0156b6
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x6e050848]
call esi
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6e0492f0
leave
ret 8
Function at 0x6e0157d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x6e07047b], 0
push esi
mov esi, dword [ebp + 8]
jne 0x6e0157e9
cmp byte [0x6e07047a], 0
je 0x6e015831
cmp dword [ebp + 0xc], 0
mov ecx, 0x6e051944
push ebx
mov eax, str.true
mov ebx, 0x6e06ee88
cmove eax, ecx
push eax
push esi
push str.IOleDocumentViewImpl__x_::Show_show_s_
push ebx
call fcn.6e0184f0
add esp, 0x10
cmp byte [0x6e07047a], 0
je 0x6e015820
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07047b], 0
je 0x6e015830
push ebx
call fcn.6e003fc0
pop ecx
pop ebx
xor ecx, ecx
lea eax, [esi - 0x4c]
push 0x44
test esi, esi
pop edx
cmove eax, edx
mov eax, dword [eax]
cmp dword [ebp + 0xc], ecx
je 0x6e01585c
test al, 8
jne 0x6e01587d
test esi, esi
lea eax, [edx + 0x4c]
push 0xfffffffffffffffb
cmove esi, eax
mov ecx, esi
call fcn.6e0172cc
jmp 0x6e01587b
test al, 8
je 0x6e01587d
test esi, esi
mov eax, 0x90
push ecx
cmove esi, eax
push esi
mov eax, dword [esi]
mov esi, dword [eax + 0x28]
mov ecx, esi
call dword [0x6e050848]
call esi
mov ecx, eax
mov eax, ecx
pop esi
pop ebp
ret 8

Function at 0x6e015890
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x6e07047b], 0
push esi
mov esi, dword [ebp + 8]
push edi
jne 0x6e0158aa
cmp byte [0x6e07047a], 0
je 0x6e0158f0
cmp dword [ebp + 0xc], 0
mov ecx, 0x6e051944
mov eax, str.true
mov edi, 0x6e06ee88
cmove eax, ecx
push eax
push esi
push str.IOleDocumentViewImpl__x_::UIActivate_activate_s___FOCUS_
push edi
call fcn.6e0184f0
add esp, 0x10
cmp byte [0x6e07047a], 0
je 0x6e0158e0
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07047b], 0
je 0x6e0158f0
push edi
call fcn.6e003fc0
pop ecx
lea eax, [esi - 0x90]
neg esi
sbb esi, esi
xor edi, edi
and esi, eax
cmp dword [ebp + 0xc], edi
je 0x6e015936
test byte [esi + 0x44], 8
jne 0x6e01595b
cmp dword [esi + 4], edi
jne 0x6e015915
mov eax, 0x8000ffff
jmp 0x6e01595d
push 0xfffffffffffffffc
lea ecx, [esi + 0x90]
call fcn.6e0172cc
mov ecx, esi
mov edi, eax
call fcn.6e003b85
push 1
mov ecx, esi
call fcn.6e0184f0
jmp 0x6e01595b
test byte [esi + 0x44], 8
je 0x6e01595b
mov ecx, esi
call fcn.6e003cf4
lea eax, [esi + 0x84]
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 0x18]
mov ecx, esi
call dword [0x6e050848]
call esi
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebp
ret 8

Function at 0x6e015970
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x6e07047b], 0
push esi
push edi
mov edi, dword [ebp + 8]
jne 0x6e01598a
cmp byte [0x6e07047a], 0
je 0x6e0159be
push edi
push str.IOleDocumentViewImpl__x_::CloseView
mov esi, 0x6e06ee88
push esi
call fcn.6e0184f0
add esp, 0xc
cmp byte [0x6e07047a], 0
je 0x6e0159ae
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07047b], 0
je 0x6e0159be
push esi
call fcn.6e003fc0
pop ecx
mov eax, 0x90
test edi, edi
push 0
cmove edi, eax
push edi
mov eax, dword [edi]
mov esi, dword [eax + 0x24]
mov ecx, esi
call dword [0x6e050848]
call esi
mov eax, dword [edi]
push 0
push edi
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x6e050848]
call esi
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
Function at 0x6e0184f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x6e0184ff
pop dword [ebp - 0x18]
mov eax, 0x8b0c132
sub eax, 0x9aaf3c33
sub dword [ebp - 0x18], eax
push 0x40
push 0x1000
push 0x49a81
push 0
mov eax, 0x3578dba2
sub eax, 0xc773d916
add eax, dword [ebp - 0x18]
call dword [eax]
mov ecx, 0x4850
xor esi, esi
add esi, eax
mov edx, 0x58f6eb08
add edx, 0x1515baf8
add edx, dword [ebp - 0x18]
mov edi, 0x2c54faf6
sub edi, 0xb8f58368
add dword [ebp - 0x10], 0x49af7554
mov ebx, dword [edx]
mov dword [ebp - 0x14], 0xef8869d7
xor ebx, edi
add dword [ebp - 0x10], 0x2ee65a49
mov dword [esi], ebx
sub dword [ebp - 4], 0x4caba53f
add esi, 0xa60d43ae
add esi, 0x59f2bc56
add edx, 4
loop 0x6e01855a
add eax, 0x11413
xor ebx, ebx
add ebx, eax
add eax, 0x77be1103
add eax, 0x8841ef02
mov ecx, 0x45da31dd
add ecx, 0x2825ce23
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x6e019afa
Capabilities:
Print debug messages

Disassembly:
push 8
mov eax, 0x6e04be97
call fcn.6e049338
mov ebx, 0x6e06f2fc
push ebx
mov dword [ebp - 0x14], ebx
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov byte [ebp - 0x10], 1
mov edi, dword [0x6e06ea58]
xor esi, esi
mov dword [ebp - 4], esi
mov eax, dword [edi]
jmp 0x6e019b3c
mov ecx, dword [eax + 8]
lea edx, [esi + 1]
mov eax, dword [eax]
cmp byte [ecx + 0x168], 0
cmove edx, esi
mov esi, edx
cmp eax, edi
jne 0x6e019b28
mov edi, dword [0x6e06ea60]
mov eax, dword [edi]
jmp 0x6e019b5e
mov ecx, dword [eax + 8]
lea edx, [esi + 1]
mov eax, dword [eax]
cmp byte [ecx + 0x168], 0
cmove edx, esi
mov esi, edx
cmp eax, edi
jne 0x6e019b4a
cmp byte [0x6e07047b], 0
jne 0x6e019b74
cmp byte [0x6e07047a], 0
je 0x6e019ba8
push esi
push str._AcroPDFImpl__CAcroPDFModule::GetOpenCountDocShimList_count___d
mov edi, 0x6e06ee88
push edi
call fcn.6e0184f0
add esp, 0xc
cmp byte [0x6e07047a], 0
je 0x6e019b98
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07047b], 0
je 0x6e019ba8
push edi
call fcn.6e003fc0
pop ecx
or dword [ebp - 4], 0xffffffff
push ebx
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov eax, esi
call fcn.6e049301
ret

Function at 0x6e019ce2
Capabilities:
Print debug messages

Disassembly:
push 8
mov eax, 0x6e04be97
call fcn.6e049338
mov edi, 0x6e06f2a0
push edi
mov dword [ebp - 0x14], edi
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov byte [ebp - 0x10], 1
and dword [ebp - 4], 0
cmp byte [0x6e07047b], 0
jne 0x6e019d17
cmp byte [0x6e07047a], 0
je 0x6e019d50
push dword [0x6e06f2ec]
mov esi, 0x6e06ee88
push str._AcroPDFImpl__GetPerProcessObjectCount_Object_count___d
push esi
call fcn.6e0184f0
add esp, 0xc
cmp byte [0x6e07047a], 0
je 0x6e019d40
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07047b], 0
je 0x6e019d50
push esi
call fcn.6e003fc0
pop ecx
mov esi, dword [0x6e06f2ec]
or dword [ebp - 4], 0xffffffff
push edi
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov eax, esi
call fcn.6e049301
ret
Function at 0x6e01ec9f
Capabilities:
Print debug messages

Disassembly:
push 8
mov eax, 0x6e04be97
call fcn.6e049338
mov edi, 0x6e06f2a0
push edi
mov dword [ebp - 0x14], edi
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov byte [ebp - 0x10], 1
mov ax, word [ebp + 8]
and dword [ebp - 4], 0
mov esi, dword [0x6e06f2ec]
test ax, ax
je 0x6e01ecd4
inc esi
jmp 0x6e01ecda
cmp esi, 1
jl 0x6e01ece0
dec esi
mov dword [0x6e06f2ec], esi
cmp byte [0x6e07047b], 0
jne 0x6e01ecf2
cmp byte [0x6e07047a], 0
je 0x6e01ed30
push esi
movzx eax, ax
mov esi, 0x6e06ee88
push eax
push str._AcroPDFImpl__UpdatePerProcessObjectCount_inc___d_Object_count___d
push esi
call fcn.6e0184f0
add esp, 0x10
cmp byte [0x6e07047a], 0
je 0x6e01ed1a
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07047b], 0
je 0x6e01ed2a
push esi
call fcn.6e003fc0
pop ecx
mov esi, dword [0x6e06f2ec]
or dword [ebp - 4], 0xffffffff
push edi
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov eax, esi
call fcn.6e049301
ret
Function at 0x6e021030
Capabilities:
Print debug messages

Disassembly:
push esi
push edi
mov edi, ecx
mov eax, dword [edi]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x6e050848]
mov ecx, edi
call esi
neg eax
pop edi
sbb eax, eax
neg eax
pop esi
ret
cmp byte [0x6e07047b], 0
push esi
push edi
mov edi, 0x6e06ee88
jne 0x6e021049
cmp byte [0x6e07047a], 0
je 0x6e021076
push str._AcroPDFImpl__DllCanUnloadNow
push edi
call fcn.6e0184f0
cmp byte [0x6e07047a], 0
pop ecx
pop ecx
je 0x6e021066
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07047b], 0
je 0x6e021076
push edi
call fcn.6e003fc0
pop ecx
call fcn.6e01fa4c
test al, al
jne 0x6e02119c
call fcn.6e0184f0
test al, al
jne 0x6e02119c
call fcn.6e019ce2
test eax, eax
jne 0x6e02115b
cmp byte [0x6e07047b], al
jne 0x6e0210ad
cmp byte [0x6e07047a], al
je 0x6e0210da
push str._AcroPDFImpl__DllCanUnloadNow_no_open_docs
push edi
call fcn.6e0184f0
cmp byte [0x6e07047a], 0
pop ecx
pop ecx
je 0x6e0210ca
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07047b], 0
je 0x6e0210da
push edi
call fcn.6e003fc0
pop ecx
call fcn.6e026f24
mov esi, eax
test esi, esi
je 0x6e02112b
cmp byte [0x6e07047b], 0
jne 0x6e0210f7
cmp byte [0x6e07047a], 0
je 0x6e021124
push str._AcroPDFImpl__DllCanUnloadNow_PrxDllCanUnloadNow_returned_S_FALSE__we_wont_unload
push edi
call fcn.6e0184f0
cmp byte [0x6e07047a], 0
pop ecx
pop ecx
je 0x6e021114
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07047b], 0
je 0x6e021124
push edi
call fcn.6e003fc0
pop ecx
mov eax, esi
jmp 0x6e0211e5
call fcn.6e01eb11
test al, al
jne 0x6e02114f
cmp byte [0x6e07047b], al
jne 0x6e021148
cmp byte [0x6e07047a], al
je 0x6e0211e2
push str._AcroPDFImpl__DllCanUnloadNow_UnloadAcrobatIfWarranted_returned_false__we_wont_unload
jmp 0x6e021172
pop edi
mov ecx, 0x6e06f2b8
pop esi
jmp 0x6e01953b
cmp byte [0x6e07047b], 0
jne 0x6e02116d
cmp byte [0x6e07047a], 0
je 0x6e0211e2
push str._AcroPDFImpl__DllCanUnloadNow_docs_are_open_return_S_FALSE___
push edi
call fcn.6e0184f0
cmp byte [0x6e07047a], 0
pop ecx
pop ecx
je 0x6e02118a
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07047b], 0
je 0x6e0211e2
push edi
call fcn.6e003fc0
pop ecx
jmp 0x6e0211e2
cmp byte [0x6e07047b], 0
jne 0x6e0211ae
cmp byte [0x6e07047a], 0
je 0x6e0211db
push str._AcroPDFImpl__DllCanUnloadNow_return_false
push edi
call fcn.6e0184f0
cmp byte [0x6e07047a], 0
pop ecx
pop ecx
je 0x6e0211cb
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07047b], 0
je 0x6e0211db
push edi
call fcn.6e003fc0
pop ecx
mov byte [0x6e06f28c], 0
xor eax, eax
inc eax
pop edi
pop esi
ret
Function at 0x6e021214
Capabilities:
Print debug messages

Disassembly:
push 0x20
mov eax, 0x6e04c477
call fcn.6e049338
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
sub eax, 0
je 0x6e021323
sub eax, 1
jne 0x6e02137d
mov edi, str.DllMain_Process_Attach
lea ecx, [ebp - 0x2c]
push edi
mov ebx, 0x6e06f290
push ebx
call fcn.6e0184f0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x24]
push edi
push ebx
call fcn.6e0184f0
push edi
push ebx
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.6e0184f0
push str.DllMain_Process_Attach_2
push ebx
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.6e0184f0
mov byte [ebp - 4], 3
call fcn.6e0184f0
test al, al
jne 0x6e0212ff
push 1
call fcn.6e0184f0
pop ecx
test eax, eax
jne 0x6e0212ff
xor ebx, ebx
push ebx
push 0x9d7f6
push ebx
call dword [sym.imp.kernel32.dll_HeapCreate]
mov dword [0x6e06f2e8], eax
test eax, eax
je 0x6e0212ff
push 0x6e0599a8
push esi
push 0x6e06c1a0
mov ecx, 0x6e06f2b8
mov dword [0x6e06f2ec], ebx
mov dword [0x6e06f2f0], ebx
mov dword [0x6e06f2f4], ebx
call fcn.6e0184f0
push esi
call dword [sym.imp.kernel32.dll_DisableThreadLibraryCalls]
lea ecx, [ebp - 0x14]
call fcn.6e0184f0
lea ecx, [ebp - 0x1c]
call fcn.6e0184f0
lea ecx, [ebp - 0x24]
call fcn.6e0184f0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.6e0184f0
jmp 0x6e02137d
lea ecx, [ebp - 0x14]
call fcn.6e0184f0
lea ecx, [ebp - 0x1c]
call fcn.6e0184f0
lea ecx, [ebp - 0x24]
call fcn.6e0184f0
lea ecx, [ebp - 0x2c]
call fcn.6e0184f0
xor eax, eax
jmp 0x6e021395
cmp byte [0x6e07047b], 0
jne 0x6e021335
cmp byte [0x6e07047a], 0
je 0x6e021367
push str._AcroPDFImpl__DllMain_DLL_PROCESS_DETACH_DLL_unloading
mov edi, 0x6e06ee88
push edi
call fcn.6e0184f0
cmp byte [0x6e07047a], 0
pop ecx
pop ecx
je 0x6e021357
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07047b], 0
je 0x6e021367
push edi
call fcn.6e003fc0
pop ecx
push dword [0x6e06f2e8]
call dword [sym.imp.kernel32.dll_HeapDestroy]
mov ecx, 0x6e06f2b8
call fcn.6e01ea8e
push dword [ebp + 0x10]
mov dword [0x6e06f288], esi
push dword [ebp + 0xc]
push esi
call fcn.6e0184f0
neg eax
sbb eax, eax
neg eax
call fcn.6e049301
ret 0xc