joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140029937
Capabilities:
Enumerate processes

Disassembly:
jmp 0x14004e290
push rbp
push rdi
sub rsp, 0x468
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xb2
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1400a1040]
xor rax, rbp
mov qword [rbp + 0x438], rax
lea rcx, [0x1400ae242]
call fcn.140029789
mov dword [rbp + 0x284], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rbp + 0x2a4], eax
xor edx, edx
mov ecx, 2
call fcn.140028b5e
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0xffffffffffffffff
jne 0x14004e2fc
jmp 0x14004e34e
mov r8d, 0x238
xor edx, edx
lea rcx, [rbp + 0x30]
call fcn.1400291a3
mov dword [rbp + 0x30], 0x238
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.140028e6f
test eax, eax
jne 0x14004e327
jmp 0x14004e34e
mov eax, dword [rbp + 0x2a4]
cmp dword [rbp + 0x38], eax
jne 0x14004e33d
mov eax, dword [rbp + 0x50]
mov dword [rbp + 0x284], eax
jmp 0x14004e34e
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.140029400
test eax, eax
jne 0x14004e327
cmp qword [rbp + 8], 0xffffffffffffffff
je 0x14004e35f
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 0x284]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x140091f00]
call fcn.14002935b
mov rax, rdi
mov rcx, qword [rbp + 0x438]
xor rcx, rbp
call fcn.140028b9a
lea rsp, [rbp + 0x448]
pop rdi
pop rbp
ret
Function at 0x14000101e
Capabilities:
Terminate process

Disassembly:
jmp 0x14001de8c
push rbx
sub rsp, 0x20
test rcx, rcx
lea rbx, str.corrupt_pack_file_or_internal_error
mov rax, rdx
cmovne rbx, rcx
test rdx, rdx
jne 0x14001ded4
call fcn.14000102d
test rax, rax
jne 0x14001ded4
lea ecx, [rax + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, rbx
lea rdx, str.Error:_unpacker:__s_n
mov rcx, rax
call fcn.140001384
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
mov rdx, rbx
mov rcx, rax
add rsp, 0x20
pop rbx
jmp fcn.1400012c1

Function at 0x140001073
Capabilities:
Terminate process

Disassembly:
jmp 0x140014fc0
push rbx
sub rsp, 0x20
mov ebx, edx
mov edx, 2
call fcn.1400010b9
movzx ecx, bx
mov rdx, rax
cmp ebx, ecx
je 0x140014fef
xor edx, edx
lea rcx, str.Internal_buffer_overflow
add rsp, 0x20
pop rbx
jmp fcn.14000101e
mov eax, ebx
mov byte [rdx + 1], bl
sar eax, 8
mov byte [rdx], al
add rsp, 0x20
pop rbx
ret

Function at 0x140001195
Capabilities:
Terminate process

Disassembly:
jmp 0x14001f210
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]

Function at 0x140001226
Capabilities:
Terminate process

Disassembly:
jmp 0x14001e888
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp qword [rcx], 0
mov rdi, rdx
mov rbx, rcx
jne 0x14001e8dc
lea rdx, [0x14002e3b4]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov qword [rbx], rax
test rax, rax
jne 0x14001e8dc
mov rcx, qword [rbx + 0x50]
lea rdx, str.Error:_Could_not_open_jar_file:__s_n
mov r8, rdi
mov rcx, qword [rcx + 0xc0]
call fcn.140001384
mov ecx, 3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14000124e
Capabilities:
Create directory

Disassembly:
jmp 0x14001dd64
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x140
mov rax, qword [0x140031e48]
xor rax, rsp
mov qword [rsp + 0x130], rax
movsxd rbx, ecx
mov rdi, rdx
mov rcx, rdx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
cmp rax, rbx
jbe 0x14001ddd1
mov rdx, rdi
lea rcx, [rsp + 0x20]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy
mov edx, 0x2f
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll_strrchr
test rax, rax
je 0x14001ddd1
lea rdx, [rsp + 0x20]
mov byte [rax], 0
mov ecx, ebx
call fcn.14000124e
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.140001203
mov rbx, qword [rsp + 0x160]
add rsp, 0x140
pop rdi
ret
Function at 0x140001456
Capabilities:
Terminate process
Write file on windows

Disassembly:
jmp 0x14001ee44
test r8d, r8d
jle 0x14001ee97
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov ebx, r8d
mov rsi, rdx
mov rdi, rcx
mov r9, qword [rdi]
mov edx, 1
movsxd r8, ebx
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
test eax, eax
jle 0x14001ee98
add dword [rdi + 0x34], eax
sub ebx, eax
movsxd rcx, eax
add rsi, rcx
test ebx, ebx
jg 0x14001ee61
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rcx, qword [rdi + 0x50]
lea rdx, str.Error:_write_on_output_file_failed_err_d_n
mov r8d, dword [rax]
mov rcx, qword [rcx + 0xc0]
call fcn.140001384
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x1400014d3
Capabilities:
Terminate process

Disassembly:
jmp 0x14001e690
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140031e48]
xor rax, rsp
mov qword [rsp + 0x70], rax
movsxd rdi, edx
mov rbx, rcx
test edx, edx
je 0x14001e6cc
cmp edi, dword [rcx + 0xc]
jne 0x14001e6c3
mov eax, dword [rcx + 0x10]
jmp 0x14001e778
cmp dword [rcx + 8], 0
jne 0x14001e6cc
mov dword [rcx + 8], edi
xor edx, edx
mov qword [rsp + 0x40], rdi
lea rcx, [rsp + 0x48]
lea r8d, [rdx + 0x24]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__gmtime64]
mov rdx, rax
test rax, rax
jne 0x14001e715
mov rcx, qword [rbx + 0x50]
lea rdx, str.Error:_gmtime_failure__invalid_input_archive_n
mov rcx, qword [rcx + 0xc0]
call fcn.140001384
or ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov dword [rbx + 0xc], edi
mov ecx, 0x7bc
mov eax, dword [rax + 0x14]
add eax, 0x76c
cmp eax, ecx
jge 0x14001e74d
and dword [rsp + 0x30], 0
mov r9d, 1
and dword [rsp + 0x28], 0
mov edx, ecx
and dword [rsp + 0x20], 0
mov r8d, r9d
mov rcx, rbx
call fcn.14000118b
jmp 0x14001e775
mov ecx, dword [rdx + 0x10]
add eax, 0xffffffc4
shl eax, 9
inc ecx
or eax, dword [rdx + 0xc]
shl eax, 5
or eax, dword [rdx + 8]
shl eax, 6
or eax, dword [rdx + 4]
shl ecx, 0x15
shl eax, 5
or eax, ecx
mov ecx, dword [rdx]
shr ecx, 1
or eax, ecx
mov dword [rbx + 0x10], eax
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140001203
mov rbx, qword [rsp + 0xa0]
add rsp, 0x80
pop rdi
ret
Function at 0x140001578
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
jmp 0x14001ff2c
sub rsp, 0x18
mov r8, rcx
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x14001ffba
movsxd rax, dword [0x14000003c]
lea rdx, [0x140000000]
lea rcx, [rax + rdx]
cmp dword [rcx], 0x4550
jne 0x14001ffba
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001ffba
sub r8, rdx
movzx eax, word [rcx + 0x14]
lea rdx, [rcx + 0x18]
add rdx, rax
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmp rdx, r9
je 0x14001ffa1
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x14001ff9b
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x14001ffa3
add rdx, 0x28
jmp 0x14001ff80
xor edx, edx
test rdx, rdx
jne 0x14001ffac
xor al, al
jmp 0x14001ffc0
cmp dword [rdx + 0x24], 0
jge 0x14001ffb6
xor al, al
jmp 0x14001ffc0
mov al, 1
jmp 0x14001ffc0
xor al, al
jmp 0x14001ffc0
add rsp, 0x18
ret
Function at 0x1400016f4
Capabilities:
Parse pe header

Disassembly:
jmp 0x14002051c
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140020567
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140020567
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140020567
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140020567
cmp dword [rcx + 0x84], 0xe
jbe 0x140020567
cmp dword [rcx + 0xf8], 0
je 0x140020567
mov al, 1
jmp 0x140020569
xor al, al
add rsp, 0x28
ret

Function at 0x14000180c
Capabilities:
Terminate process

Disassembly:
jmp 0x14000f764
push rbx
movsxd r11, r9d
mov rbx, r8
mov r10, rcx
test edx, edx
jns 0x14000f77c
lea rcx, str.bad_value_count
jmp 0x14000f7ea
mov r9, qword [rcx]
cmp r11d, 1
je 0x14000f7be
mov ecx, 0x100
cmp dword [rsp + 0x30], ecx
je 0x14000f7be
sub ecx, dword [rsp + 0x30]
mov r8d, r11d
jmp 0x14000f7b5
inc r9
sub r8d, 1
je 0x14000f7ab
movzx eax, byte [r9 - 1]
cmp eax, ecx
jge 0x14000f7b5
dec edx
mov r8d, r11d
cmp r9, rbx
ja 0x14000f7e3
test edx, edx
jg 0x14000f799
mov qword [r10], r9
pop rbx
ret
movsxd r8, edx
mov rcx, r11
imul r11, r8
xor edx, edx
mov rax, r11
div rcx
cmp rax, r8
jne 0x14000f7e3
lea rax, [r11 + r9]
cmp rax, rbx
ja 0x14000f7e3
mov qword [r10], rax
pop rbx
ret
lea rcx, str.EOF_reading_band
xor edx, edx
pop rbx
jmp fcn.14000101e
Function at 0x14001e888
Capabilities:
Terminate process

Disassembly:
jmp 0x14001e888
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp qword [rcx], 0
mov rdi, rdx
mov rbx, rcx
jne 0x14001e8dc
lea rdx, [0x14002e3b4]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov qword [rbx], rax
test rax, rax
jne 0x14001e8dc
mov rcx, qword [rbx + 0x50]
lea rdx, str.Error:_Could_not_open_jar_file:__s_n
mov r8, rdi
mov rcx, qword [rcx + 0xc0]
call fcn.140001384
mov ecx, 3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14001ee44
Capabilities:
Terminate process
Write file on windows

Disassembly:
jmp 0x14001ee44
test r8d, r8d
jle 0x14001ee97
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov ebx, r8d
mov rsi, rdx
mov rdi, rcx
mov r9, qword [rdi]
mov edx, 1
movsxd r8, ebx
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
test eax, eax
jle 0x14001ee98
add dword [rdi + 0x34], eax
sub ebx, eax
movsxd rcx, eax
add rsi, rcx
test ebx, ebx
jg 0x14001ee61
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rcx, qword [rdi + 0x50]
lea rdx, str.Error:_write_on_output_file_failed_err_d_n
mov r8d, dword [rax]
mov rcx, qword [rcx + 0xc0]
call fcn.140001384
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x1400087a0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140014010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, r9
mov rbx, r8
mov rsi, rdx
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], r9
mov eax, dword [r9 + 0x10]
lea ecx, [rax*2 + 2]
mov rax, r9
cmp qword [r9 + 0x18], 8
jb 0x1400087eb
mov rax, qword [r9]
xor ebp, ebp
cmp qword [r8 + 0x10], rbp
jne 0x1400087f8
mov r8d, ebp
jmp 0x140008802
cmp qword [r8 + 0x18], 8
jb 0x140008802
mov r8, qword [r8]
cmp qword [rdx + 0x18], 8
jb 0x14000880c
mov rdx, qword [rdx]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000001
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
test eax, eax
js 0x140008945
mov rdx, qword [rsi + 0x18]
cmp rdx, 8
jb 0x14000886f
mov rcx, qword [rsi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14000886a
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140008930
mov rcx, r8
call fcn.14000bc78
mov qword [rsi + 0x10], rbp
mov qword [rsi + 0x18], 7
mov word [rsi], bp
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x1400088bd
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x1400088b8
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140008937
mov rcx, r8
call fcn.14000bc78
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], 7
mov word [rbx], bp
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x140008907
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140008902
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000893e
mov rcx, r8
call fcn.14000bc78
mov qword [rdi + 0x10], rbp
mov qword [rdi + 0x18], 7
mov word [rdi], bp
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14000b8b0
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov ecx, eax
call fcn.140001d90
int3
Function at 0x14000a690
Capabilities:
Enumerate process modules
Get process image filename

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1250
call fcn.14000c880
sub rsp, rax
mov rax, qword [0x140014010]
xor rax, rsp
mov qword [rsp + 0x1240], rax
lea r8, [rsp + 0x28]
mov edx, 0x1000
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x14000a86c
mov r12d, dword [rsp + 0x28]
xor r14d, r14d
shr r12d, 2
test r12d, r12d
je 0x14000a86c
lea r15, [rsp + 0x30]
lea r13d, [r14 + 1]
mov ebp, dword [r15]
test ebp, ebp
je 0x14000a85c
movups xmm0, xmmword [str._unknown_]
mov eax, dword [0x14000ed50]
lea rcx, [rsp + 0x1044]
xor edx, edx
mov dword [rsp + 0x1040], eax
mov r8d, 0x1f6
movaps xmmword [rsp + 0x1030], xmm0
xor edi, edi
call sub.VCRUNTIME140.dll_memset
lea ecx, [rdi + 0x28]
call fcn.14000be28
lea r8, str.AdobeCollabSync.exe
mov rcx, rax
lea edx, [rdi + 0x14]
mov rbx, rax
xor esi, esi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
mov r8d, ebp
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbp, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x14000a850
lea r9, [rsp + 0x2c]
mov rcx, rax
lea r8d, [rdi + 8]
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
mov rcx, rbp
test eax, eax
je 0x14000a7ba
mov rdx, qword [rsp + 0x20]
lea r8, [rsp + 0x1030]
mov r9d, 0x105
call qword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameW]
jmp 0x14000a7d4
mov r8d, 0x105
lea rdx, [rsp + 0x1030]
call qword [sym.imp.KERNEL32.dll_K32GetProcessImageFileNameW]
test eax, eax
cmovne esi, r13d
lea rdx, [rsp + 0x1030]
lea rcx, str.AdobeCollabSync.exe
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x14000a7f2
mov edi, r13d
jmp 0x14000a847
test esi, esi
je 0x14000a847
mov edx, 0x105
lea rcx, [rsp + 0x1030]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcslwr_s]
mov edx, 0x14
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcslwr_s]
mov rdx, rbx
lea rcx, [rsp + 0x1030]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x14000a847
mov rcx, 0xffffffffffffffff
cmp word [rbx + rcx*2 + 2], di
lea rcx, [rcx + 1]
jne 0x14000a834
cmp word [rax + rcx*2], di
cmove edi, r13d
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call fcn.14000bc78
test edi, edi
jne 0x14000a89f
inc r14d
add r15, 4
cmp r14d, r12d
jb 0x14000a702
xor eax, eax
mov rcx, qword [rsp + 0x1240]
xor rcx, rsp
call fcn.14000b8b0
lea r11, [rsp + 0x1250]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov eax, r13d
jmp 0x14000a86e
Function at 0x14000ab70
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x280
mov rax, qword [0x140014010]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov ebx, ecx
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea r8, str.SoftwareAdobeAdobe_SynchronizerDCADNotificationManager
mov edx, 0x104
lea rcx, [rsp + 0x60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
xor ecx, ecx
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x40], rcx
mov eax, ecx
test ebx, ebx
setne al
xor r9d, r9d
mov dword [rsp + 0x58], eax
xor r8d, r8d
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ecx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x50]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x60]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000ac67
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
mov dword [rsp + 0x28], 4
lea rdx, str.iCollabSyncFileWatcher
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14000b8b0
add rsp, 0x280
pop rbx
ret
Function at 0x14000ac80
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x470
mov rax, qword [0x140014010]
xor rax, rsp
mov qword [rsp + 0x460], rax
xor edx, edx
lea rcx, [rsp + 0x250]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea r8, str.SOFTWAREAdobeAdobe_Acrobat_
mov edx, 0x104
lea rcx, [rsp + 0x250]
xor esi, esi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, str.DCInstaller
mov edx, 0x104
lea rcx, [rsp + 0x250]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov ecx, 0x208
call fcn.14000be28
xor edx, edx
mov r8d, 0x208
mov rcx, rax
mov rdi, rax
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x30]
mov dword [rsp + 0x38], 0x208
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rsp + 0x250]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea rbx, [rsi - 1]
test eax, eax
jne 0x14000ada5
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x3c]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea rdx, str.ProductCode
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000ada5
mov rax, rbx
inc rax
cmp word [rdi + rax*2], si
jne 0x14000ad86
cmp rax, 0x206
jae 0x14000ada5
mov rdx, rdi
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rdi
call fcn.14000bc78
lea rcx, [rsp + 0x40]
mov rax, rbx
inc rax
cmp word [rcx + rax*2], si
jne 0x14000adc0
test rax, rax
jne 0x14000ae83
mov ecx, 0x208
call fcn.14000be28
xor edx, edx
mov r8d, 0x208
mov rcx, rax
mov rdi, rax
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x30]
mov dword [rsp + 0x38], 0x208
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rsp + 0x250]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000ae70
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x3c]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea rdx, str.ENU_GUID
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000ae70
inc rbx
cmp word [rdi + rbx*2], si
jne 0x14000ae50
cmp rbx, 0x206
jae 0x14000ae70
mov rdx, rdi
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rdi
call fcn.14000bc78
cmp word [rsp + 0x72], 0x42
jne 0x14000aea8
lea rdx, str._1033_FF00_7760_
lea rcx, [rsp + 0x40]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
mov ecx, 1
cmovne esi, ecx
mov eax, esi
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.14000b8b0
lea r11, [rsp + 0x470]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x14000af40
Capabilities:
Download url
Receive data

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x470
mov rax, qword [0x140014010]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov ebx, ecx
call fcn.14000aed0
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x208
mov edi, eax
call sub.VCRUNTIME140.dll_memset
lea r8, str.http:__acroipm2.adobe.com_assets_Owner_arm_
mov edx, 0x104
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
xor eax, eax
lea rdx, [rsp + 0x30]
mov ecx, ebx
mov qword [rsp + 0x30], rax
mov word [rsp + 0x38], ax
lea r9d, [rax + 0xa]
lea r8d, [rax + 5]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__itow_s]
xor edx, edx
lea rcx, [rsp + 0x250]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
mov r9d, 0xa
lea rdx, [rsp + 0x250]
mov r8d, 0x104
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__itow_s]
lea r8, [rsp + 0x250]
mov edx, 0x104
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, [0x14000f148]
mov edx, 0x104
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, str.adnme
mov edx, 0x104
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, [0x14000f148]
mov edx, 0x104
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, [rsp + 0x30]
mov edx, 0x104
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, str..zip
mov edx, 0x104
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
xor r9d, r9d
mov qword [rsp + 0x20], 0
xor r8d, r8d
lea rdx, [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.14000b8b0
mov rbx, qword [rsp + 0x488]
add rsp, 0x470
pop rdi
ret