joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c4aec
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140233818]
xor rax, rsp
mov qword [rbp - 0x10], rax
call fcn.1400c40cc
test al, al
je 0x1400c4c15
call fcn.1400c4628
test al, al
je 0x1400c4c15
call fcn.1400c3054
test al, al
jne 0x1400c4c15
and qword [rbp - 0x20], 0
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], al
lea rdx, str.bEnableGPU
lea rcx, [rbp - 0x30]
call fcn.140054bec
nop
mov ebx, 1
cmp qword [rbp - 0x20], 0
je 0x1400c4bd9
and qword [rbp - 0x38], 0
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c4bd9
mov dword [rbp - 0x40], ebx
mov dword [rbp - 0x3c], 4
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c4bce
cmp dword [rbp - 0x40], eax
setne bl
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400c4c11
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c4c0b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c4c34
call fcn.1401489f0
nop
mov al, bl
jmp 0x1400c4c1a
mov eax, 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140149000
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
call fcn.14014fc7c
nop
int3
Function at 0x1400c4c3c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140233818]
xor rax, rsp
mov qword [rbp - 0x10], rax
call fcn.1400c40cc
xor ebx, ebx
test al, al
je 0x1400c4d62
call fcn.1400c4628
test al, al
je 0x1400c4d62
call fcn.1400c3054
test al, al
je 0x1400c4c83
mov al, 1
jmp 0x1400c4d64
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], bl
lea rdx, str.bEnableJSAccessClipBoard
lea rcx, [rbp - 0x30]
call fcn.140054bec
nop
cmp qword [rbp - 0x20], rbx
je 0x1400c4d26
mov qword [rbp - 0x38], rbx
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c4d26
mov dword [rbp - 0x40], ebx
mov dword [rbp - 0x3c], 4
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c4d1b
cmp dword [rbp - 0x40], ebx
setne bl
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400c4d5e
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c4d58
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c4d7e
call fcn.1401489f0
nop
mov al, bl
jmp 0x1400c4d64
xor al, al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140149000
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
call fcn.14014fc7c
nop
Function at 0x1400c4d84
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140233818]
xor rax, rsp
mov qword [rbp - 0x10], rax
call fcn.1400c40cc
xor ebx, ebx
test al, al
je 0x1400c4eaa
call fcn.1400c4628
test al, al
je 0x1400c4eaa
call fcn.1400c3054
test al, al
je 0x1400c4dcb
mov al, 1
jmp 0x1400c4eac
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], bl
lea rdx, str.bEnableJSCloseWindows
lea rcx, [rbp - 0x30]
call fcn.140054bec
nop
cmp qword [rbp - 0x20], rbx
je 0x1400c4e6e
mov qword [rbp - 0x38], rbx
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c4e6e
mov dword [rbp - 0x40], ebx
mov dword [rbp - 0x3c], 4
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c4e63
cmp dword [rbp - 0x40], ebx
setne bl
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400c4ea6
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c4ea0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c4ec6
call fcn.1401489f0
nop
mov al, bl
jmp 0x1400c4eac
xor al, al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140149000
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
call fcn.14014fc7c
nop
Function at 0x1400c4ecc
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140233818]
xor rax, rsp
mov qword [rbp - 0x10], rax
call fcn.1400c40cc
xor ebx, ebx
test al, al
je 0x1400c4ff2
call fcn.1400c4628
test al, al
je 0x1400c4ff2
call fcn.1400c3054
test al, al
je 0x1400c4f13
mov al, 1
jmp 0x1400c4ff4
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], bl
lea rdx, str.bEnableJSDomPaste
lea rcx, [rbp - 0x30]
call fcn.140054bec
nop
cmp qword [rbp - 0x20], rbx
je 0x1400c4fb6
mov qword [rbp - 0x38], rbx
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c4fb6
mov dword [rbp - 0x40], ebx
mov dword [rbp - 0x3c], 4
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c4fab
cmp dword [rbp - 0x40], ebx
setne bl
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400c4fee
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c4fe8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c500e
call fcn.1401489f0
nop
mov al, bl
jmp 0x1400c4ff4
xor al, al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140149000
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
call fcn.14014fc7c
nop
Function at 0x1400c5014
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140233818]
xor rax, rsp
mov qword [rbp - 0x10], rax
call fcn.1400c40cc
test al, al
je 0x1400c513d
call fcn.1400c4628
test al, al
je 0x1400c513d
call fcn.1400c3054
test al, al
jne 0x1400c513d
and qword [rbp - 0x20], 0
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], al
lea rdx, str.bEnableLocalStorage
lea rcx, [rbp - 0x30]
call fcn.140054bec
nop
mov ebx, 1
cmp qword [rbp - 0x20], 0
je 0x1400c5101
and qword [rbp - 0x38], 0
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c5101
mov dword [rbp - 0x40], ebx
mov dword [rbp - 0x3c], 4
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c50f6
cmp dword [rbp - 0x40], eax
setne bl
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400c5139
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c5133
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c515c
call fcn.1401489f0
nop
mov al, bl
jmp 0x1400c5142
mov eax, 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140149000
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
call fcn.14014fc7c
nop
int3
Function at 0x1400c5178
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140233818]
xor rax, rsp
mov qword [rbp - 0x10], rax
call fcn.1400c40cc
xor ebx, ebx
test al, al
je 0x1400c529e
call fcn.1400c4628
test al, al
je 0x1400c529e
call fcn.1400c3054
test al, al
je 0x1400c51bf
mov al, 1
jmp 0x1400c52a0
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], bl
lea rdx, str.bEnableMixedContent
lea rcx, [rbp - 0x30]
call fcn.140054bec
nop
cmp qword [rbp - 0x20], rbx
je 0x1400c5262
mov qword [rbp - 0x38], rbx
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c5262
mov dword [rbp - 0x40], ebx
mov dword [rbp - 0x3c], 4
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c5257
cmp dword [rbp - 0x40], ebx
setne bl
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400c529a
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c5294
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c52ba
call fcn.1401489f0
nop
mov al, bl
jmp 0x1400c52a0
xor al, al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140149000
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
call fcn.14014fc7c
nop
Function at 0x1400c52c0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140233818]
xor rax, rsp
mov qword [rbp - 0x10], rax
call fcn.1400c40cc
xor ebx, ebx
test al, al
jne 0x1400c52f8
call fcn.1400c42d4
test al, al
je 0x1400c5469
call fcn.1400c4628
test al, al
je 0x1400c5469
call fcn.1400c3054
test al, al
jne 0x1400c5465
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], bl
lea rdx, str.bEnableNetworkAccess
lea rcx, [rbp - 0x30]
call fcn.140054bec
nop
lea rcx, [rbp - 0x30]
call fcn.1400c44ec
test al, al
sete dil
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400c537d
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c5377
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c548f
call fcn.1401489f0
nop
test dil, dil
jne 0x1400c5465
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], bl
lea rdx, str.bEnableNetworkAccess
lea rcx, [rbp - 0x30]
call fcn.140054bec
nop
cmp qword [rbp - 0x20], rbx
je 0x1400c5429
mov qword [rbp - 0x38], rbx
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c5429
mov dword [rbp - 0x40], ebx
mov dword [rbp - 0x3c], 4
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c541e
cmp dword [rbp - 0x40], ebx
setne bl
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400c5461
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c545b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c5489
call fcn.1401489f0
nop
mov al, bl
jmp 0x1400c546b
mov al, 1
jmp 0x1400c546b
xor al, al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140149000
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
call fcn.14014fc7c
nop
call fcn.14014fc7c
int3
Function at 0x1400c5498
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140233818]
xor rax, rsp
mov qword [rbp - 0x10], rax
call fcn.1400c4628
xor ebx, ebx
test al, al
je 0x1400c562b
call fcn.1400c3054
test al, al
jne 0x1400c5627
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], bl
lea rdx, str.bEnableDebugInterface
lea rcx, [rbp - 0x30]
call fcn.140054bec
nop
lea rcx, [rbp - 0x30]
call fcn.1400c44ec
test al, al
sete dil
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400c553f
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c5539
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c5651
call fcn.1401489f0
nop
test dil, dil
jne 0x1400c5627
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], bl
lea rdx, str.bEnableDebugInterface
lea rcx, [rbp - 0x30]
call fcn.140054bec
nop
cmp qword [rbp - 0x20], rbx
je 0x1400c55eb
mov qword [rbp - 0x38], rbx
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c55eb
mov dword [rbp - 0x40], ebx
mov dword [rbp - 0x3c], 4
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c55e0
cmp dword [rbp - 0x40], ebx
setne bl
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400c5623
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c561d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c564b
call fcn.1401489f0
nop
mov al, bl
jmp 0x1400c562d
mov al, 1
jmp 0x1400c562d
xor al, al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140149000
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
call fcn.14014fc7c
nop
call fcn.14014fc7c
int3
Function at 0x1400c5658
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140233818]
xor rax, rsp
mov qword [rbp - 0x10], rax
call fcn.1400c4aec
xor ebx, ebx
test al, al
je 0x1400c578b
call fcn.1400c40cc
test al, al
je 0x1400c578b
call fcn.1400c4628
test al, al
je 0x1400c578b
call fcn.1400c3054
test al, al
je 0x1400c56ac
mov al, 1
jmp 0x1400c578d
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], bl
lea rdx, str.bEnableWebGL
lea rcx, [rbp - 0x30]
call fcn.140054bec
nop
cmp qword [rbp - 0x20], rbx
je 0x1400c574f
mov qword [rbp - 0x38], rbx
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c574f
mov dword [rbp - 0x40], ebx
mov dword [rbp - 0x3c], 4
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c5744
cmp dword [rbp - 0x40], ebx
setne bl
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400c5787
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c5781
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c57a7
call fcn.1401489f0
nop
mov al, bl
jmp 0x1400c578d
xor al, al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140149000
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
call fcn.14014fc7c
nop
int3
Function at 0x1400c57b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140233818]
xor rax, rsp
mov qword [rbp - 0x10], rax
call fcn.1400c40cc
xor ebx, ebx
test al, al
je 0x1400c5950
call fcn.1400c4628
test al, al
je 0x1400c5950
call fcn.1400c3054
test al, al
jne 0x1400c594c
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], bl
lea rdx, str.bSetProxyContextManagerTestMode
lea rcx, [rbp - 0x30]
call fcn.140054bec
nop
lea rcx, [rbp - 0x30]
call fcn.1400c44ec
test al, al
sete dil
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400c5864
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c585e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c5976
call fcn.1401489f0
nop
test dil, dil
jne 0x1400c594c
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], bl
lea rdx, str.bSetProxyContextManagerTestMode
lea rcx, [rbp - 0x30]
call fcn.140054bec
nop
cmp qword [rbp - 0x20], rbx
je 0x1400c5910
mov qword [rbp - 0x38], rbx
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c5910
mov dword [rbp - 0x40], ebx
mov dword [rbp - 0x3c], 4
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c5905
cmp dword [rbp - 0x40], ebx
setne bl
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400c5948
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c5942
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c5970
call fcn.1401489f0
nop
mov al, bl
jmp 0x1400c5952
mov al, 1
jmp 0x1400c5952
xor al, al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140149000
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
call fcn.14014fc7c
nop
call fcn.14014fc7c
int3
Function at 0x1400c9a68
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
movzx edx, dx
xor ecx, ecx
mov rsi, r9
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
je 0x1400c9ac5
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
je 0x1400c9ac5
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, qword [rsp + 0x50]
mov edx, eax
mov qword [rcx], rdx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsi], rax
mov al, 1
jmp 0x1400c9ac7
xor al, al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1400c9c00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub rsp, 0x38
mov r10, r9
cmp r8d, 1
jne 0x1400c9c21
lea r8, str.CSR1
add rcx, 0xfffffffffffffff0
add rsp, 0x38
jmp fcn.1400c9a68
cmp r8d, 7
jne 0x1400c9c30
lea r8, str.CSR2
jmp 0x1400c9c14
mov rax, qword [rcx]
mov r8, r10
mov r9, qword [rsp + 0x60]
mov rax, qword [rax + 8]
call qword [str.PLe_]
add rsp, 0x38
ret
Function at 0x1400e13dc
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x140233818]
xor rax, rsp
mov qword [rbp - 0x10], rax
cmp byte [0x140241b6d], 0
jne 0x1400e14a9
cmp byte [0x140241b6e], 0
mov byte [0x140241b6d], 1
je 0x1400e14a9
movups xmm0, xmmword [0x1401d5198]
lea rax, [rbp - 0x48]
mov r9d, 1
movups xmm1, xmmword [0x1401d51a8]
xor r8d, r8d
lea rdx, [rbp - 0x40]
movups xmmword [rbp - 0x40], xmm0
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
movups xmm0, xmmword [0x1401d51b8]
movups xmmword [rbp - 0x30], xmm1
movups xmmword [rbp - 0x20], xmm0
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x1400e14a9
and dword [rbp - 0x50], 0
lea rax, [rbp - 0x4c]
mov qword [rsp + 0x28], rax
lea rdx, str.bLaunchTiming
lea rax, [rbp - 0x50]
mov dword [rbp - 0x4c], 4
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [rbp - 0x50], 0
mov rcx, qword [rbp - 0x48]
setne byte [0x140241b6c]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [0x140241b6c]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140149000
add rsp, 0x80
pop rbp
ret