joyce8/EMBER2024-capa huggingface dataset:
Function at 0x445e60
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], ecx
mov esi, dword [eax + 0x10]
cmp dword [eax + 0x14], 0xf
mov dword [ebp - 0x10], eax
jbe 0x445e80
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov edi, 0x811c9dc5
test esi, esi
je 0x445e9f
mov ecx, dword [ebp - 0x10]
mov eax, esi
nop
movzx edx, byte [ecx]
inc ecx
xor edx, edi
imul edi, edx, 0x1000193
dec eax
jne 0x445e90
mov eax, dword [ebp - 0x14]
mov ebx, dword [eax + 4]
and edi, dword [eax + 0x18]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + edi*8]
add edi, edi
mov dword [ebp - 0x1c], ebx
cmp edx, ebx
je 0x445ec6
lea ecx, [edi*4]
or ecx, 4
mov eax, dword [eax + ecx]
mov ebx, dword [eax]
cmp edx, ebx
mov dword [ebp - 0x18], edx
je 0x445f0f
nop dword [eax]
mov ebx, dword [ebx + 4]
cmp esi, dword [ebx + 0x18]
jne 0x445f0b
cmp dword [ebx + 0x1c], 0xf
jbe 0x445ef0
mov eax, dword [ebx + 8]
jmp 0x445ef3
lea eax, [ebx + 8]
push esi
push eax
push dword [ebp - 0x10]
call fcn.004ff107
add esp, 0xc
mov edx, dword [ebp - 0x18]
test eax, eax
je 0x445fae
cmp edx, ebx
jne 0x445ed0
mov esi, dword [ebp - 0x14]
lea ebx, [esi + 4]
mov ecx, ebx
push dword [ebp + 0xc]
mov eax, dword [ebp - 0x1c]
push dword [eax]
call fcn.004460c0
mov ecx, dword [ebx]
mov edx, dword [ebp - 0x18]
mov ebx, dword [ecx]
mov eax, dword [ebx]
cmp eax, edx
je 0x445f5d
mov ecx, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], edx
mov ecx, dword [edx + 4]
mov dword [ecx], ebx
mov ecx, dword [edx + 4]
mov dword [ebp - 0x10], ecx
mov ecx, edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebx + 4]
mov dword [eax + 4], edx
mov dword [ebx + 4], ecx
mov ecx, dword [esi + 4]
mov edx, dword [esi + 0xc]
mov esi, dword [edx + edi*4]
lea eax, [edx + edi*4]
cmp esi, ecx
je 0x445f91
cmp esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov esi, ebx
je 0x445fa3
or edi, 1
mov eax, dword [edx + edi*4]
mov eax, dword [eax]
cmp ebx, eax
mov dword [edx + edi*4], eax
je 0x445fa5
mov edx, dword [ecx + 0xc]
lea eax, [edx + edi*4]
mov edx, dword [edx + edi*4]
mov esi, dword [edx + 4]
jmp 0x445fa3
mov ecx, dword [ebp - 0x14]
shl edi, 2
mov dword [eax], ebx
mov esi, ebx
or edi, 4
add edi, dword [ecx + 0xc]
mov eax, edi
mov dword [eax], esi
call fcn.00445fd0
mov cl, 1
jmp 0x445fb0
xor ecx, ecx
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [eax + 4], cl
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x4461d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov edi, dword [ebp + 0xc]
mov esi, dword [edi + 0x10]
cmp dword [edi + 0x14], 0xf
jbe 0x4461e7
mov edi, dword [edi]
test esi, esi
mov ebx, 0x811c9dc5
mov dword [ebp - 0x10], edi
je 0x44620f
mov eax, esi
nop word cs:[eax + eax]
nop
movzx edx, byte [edi]
inc edi
xor edx, ebx
imul ebx, edx, 0x1000193
dec eax
jne 0x446200
mov edi, dword [ecx + 4]
and ebx, dword [ecx + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ecx + 0xc]
mov edx, dword [ecx + ebx*8]
add ebx, ebx
mov dword [ebp - 0x18], edi
cmp edx, edi
je 0x446236
lea eax, [ebx*4]
or eax, 4
mov eax, dword [ecx + eax]
mov edi, dword [eax]
cmp edx, edi
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], edx
je 0x446280
mov edi, dword [edi + 4]
cmp esi, dword [edi + 0x18]
jne 0x44627c
cmp dword [edi + 0x1c], 0xf
jbe 0x446260
mov eax, dword [edi + 8]
jmp 0x446263
lea eax, [edi + 8]
mov ecx, dword [ebp - 0x10]
push esi
push eax
push ecx
call fcn.004ff107
add esp, 0xc
mov edx, dword [ebp - 0x1c]
test eax, eax
je 0x446317
cmp edx, edi
jne 0x446240
mov edi, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x14]
mov eax, dword [edi]
mov edi, dword [ebp - 0x20]
cmp eax, edx
je 0x4462c4
mov edi, dword [ebp + 0x10]
mov esi, edx
mov edx, dword [edi + 4]
mov dword [edx], eax
mov edx, dword [eax + 4]
mov dword [edx], esi
mov edx, dword [esi + 4]
mov dword [edx], edi
mov edx, dword [esi + 4]
mov dword [ebp - 0x10], edx
mov edx, dword [eax + 4]
mov dword [esi + 4], edx
mov edx, dword [edi + 4]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x10]
mov dword [edi + 4], eax
mov eax, dword [ecx + 4]
mov edi, dword [ecx + 0xc]
mov dword [ebp - 0x18], eax
mov edx, dword [edi + ebx*4]
mov esi, ecx
mov ecx, dword [ebp + 0x10]
lea eax, [edi + ebx*4]
cmp edx, dword [ebp - 0x18]
je 0x446302
cmp edx, dword [ebp - 0x1c]
je 0x446375
or ebx, 1
mov eax, dword [edi + ebx*4]
mov eax, dword [eax]
mov dword [edi + ebx*4], eax
mov edi, ecx
cmp eax, ecx
mov ecx, esi
je 0x44637d
mov edx, dword [ecx + 0xc]
lea eax, [edx + ebx*4]
mov edx, dword [edx + ebx*4]
mov edx, dword [edx + 4]
jmp 0x44637b
shl ebx, 2
mov dword [eax], ecx
mov edi, ecx
mov ecx, esi
or ebx, 4
mov edx, edi
add ebx, dword [esi + 0xc]
mov eax, ebx
jmp 0x44637b
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
mov ecx, dword [edx + 4]
mov dword [ecx], eax
mov eax, dword [edx]
mov ecx, dword [edx + 4]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 0x14]
dec dword [eax + 8]
mov eax, dword [edx + 0x1c]
cmp eax, 0x10
jb 0x446366
mov ecx, dword [edx + 8]
lea esi, [eax + 1]
cmp esi, 0x1000
jb 0x446359
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x446396
add eax, 0x24
mov ecx, edx
mov esi, eax
push esi
push ecx
call fcn.004ff107
add esp, 8
mov edx, dword [ebp + 0x10]
push 0x20
push edx
call fcn.004ff107
add esp, 8
xor ecx, ecx
jmp 0x446384
mov edi, ecx
mov edx, ecx
mov ecx, esi
mov dword [eax], edx
call fcn.00445fd0
mov cl, 1
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], cl
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
call fcn.004ee4e5
int3
Function at 0x448630
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov ebx, dword [ebp + 0xc]
mov edx, dword [ebx + 0x10]
cmp dword [ebx + 0x14], 0xf
jbe 0x448647
mov ebx, dword [ebx]
test edx, edx
mov eax, 0x811c9dc5
mov dword [ebp - 0x10], edx
je 0x44866f
mov esi, ebx
nop word cs:[eax + eax]
nop
movzx edi, byte [esi]
inc esi
xor edi, eax
imul eax, edi, 0x1000193
dec edx
jne 0x448660
and eax, dword [ecx + 0x18]
mov edi, dword [ecx + 4]
mov ecx, dword [ecx + 0xc]
mov esi, dword [ecx + eax*8]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x10]
lea eax, [eax + eax + 1]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x1c], edi
jne 0x4486a7
jmp 0x4486d0
mov esi, dword [esi]
cmp dword [ebp - 0x1c], edi
je 0x4486d0
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov eax, dword [eax + edx*4]
mov eax, dword [eax]
cmp eax, esi
je 0x44876a
cmp dword [esi + 0x18], ecx
jne 0x4486a0
cmp dword [esi + 0x1c], 0xf
jbe 0x4486e0
mov eax, dword [esi + 8]
jmp 0x4486e3
mov eax, edi
cmp eax, esi
jne 0x4486ba
jmp 0x44876a
lea eax, [esi + 8]
push ecx
push ebx
push eax
call fcn.004ff107
mov ecx, dword [ebp - 0x10]
add esp, 0xc
test eax, eax
jne 0x4486a0
mov dword [ebp - 0x20], ebx
mov ebx, esi
cmp dword [ebp - 0x1c], edi
jne 0x448717
jmp 0x448760
mov ebx, dword [ebx]
cmp dword [ebp - 0x1c], edi
je 0x448760
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov eax, dword [eax + edx*4]
mov eax, dword [eax]
cmp eax, ebx
je 0x448766
cmp ecx, dword [ebx + 0x18]
jne 0x448766
cmp dword [ebx + 0x1c], 0xf
jbe 0x448740
mov eax, dword [ebx + 8]
jmp 0x448743
lea eax, [ebx + 8]
push ecx
push eax
push dword [ebp - 0x20]
call fcn.004ff107
mov ecx, dword [ebp - 0x10]
add esp, 0xc
test eax, eax
je 0x448710
jmp 0x448766
mov eax, edi
cmp eax, ebx
jne 0x448726
cmp esi, ebx
jne 0x44876e
mov esi, edi
mov ebx, edi
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov dword [eax + 4], ebx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x44b50c
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
xor ebx, ebx
mov edi, edx
mov esi, ecx
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
push ebx
push edx
push ebx
push 0x8000004
push ebx
push 0xffffffffffffffff
call dword [sym.imp.kernel32.dll_CreateFileMappingW]
mov ecx, esi
push eax
call fcn.00401e06
mov eax, dword [esi]
lea ecx, [eax + 1]
cmp ecx, 2
jb 0x44b54f
push edi
push ebx
push ebx
push 6
push eax
call dword [sym.imp.kernel32.dll_MapViewOfFile]
mov dword [esi + 4], eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x44d030
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov eax, dword [0x5d32a4]
xor eax, ebp
mov dword [esp + 0x20], eax
mov edi, dword [ecx + 0x30]
test edi, edi
jne 0x44d0f9
mov esi, ecx
mov dword [esp + 0x1c], 0xf
mov dword [esp + 0x18], 9
mov dword [esp + 0xc], 0x65647261
mov dword [esp + 8], 0x63736964
mov word [esp + 0x10], 0x64
push 0x48
call fcn.004ff107
add esp, 4
mov ebx, eax
lea eax, [esp + 8]
mov edi, esp
mov ecx, esi
push eax
push edi
call fcn.0044cee0
mov ecx, ebx
push edi
push dword [esi + 0x20]
lea eax, [esp + 0x10]
push eax
call fcn.0044df30
mov edi, dword [esi + 0x30]
mov dword [esi + 0x30], ebx
test edi, edi
je 0x44d0c0
mov ecx, edi
call fcn.0044e020
push edi
call fcn.004e898a
add esp, 4
mov eax, dword [esp + 0x1c]
cmp eax, 0x10
jb 0x44d0f6
mov ecx, dword [esp + 8]
lea edi, [eax + 1]
cmp edi, 0x1000
jb 0x44d0ec
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x44d10e
add eax, 0x24
mov ecx, edx
mov edi, eax
push edi
push ecx
call fcn.004ff107
add esp, 8
mov edi, dword [esi + 0x30]
mov ecx, dword [esp + 0x20]
xor ecx, ebp
call fcn.004e85d0
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.004ee4e5
int3
Function at 0x4a3adf
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x30
mov eax, 0x55955f
call fcn.004e864c
xor ebx, ebx
mov dword [ebp - 0x38], ebx
mov eax, dword fs:[0x2c]
mov ecx, dword [0x5e04e8]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x5dfc74]
cmp eax, dword [ecx + 4]
jg 0x4a3b17
mov al, byte [0x5dfc70]
call fcn.004e85f6
ret
mov esi, 0x5dfc74
push esi
call fcn.004ff107
cmp dword [0x5dfc74], 0xffffffff
pop ecx
jne 0x4a3b0c
and dword [ebp - 4], 0
call fcn.004a459e
test al, al
je 0x4a3be7
call fcn.004ff107
test al, al
je 0x4a3be7
and dword [ebp - 0x18], 0
lea ecx, [ebp - 0x28]
push str.bEnableAllRestrictedFeatures
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.0045446b
xor ebx, ebx
mov byte [ebp - 0x29], 0
inc ebx
cmp dword [ebp - 0x18], 0
mov byte [ebp - 4], bl
mov dword [ebp - 0x38], ebx
je 0x4a3be7
and dword [ebp - 0x30], 0
lea eax, [ebp - 0x30]
push eax
push 0x20019
push 0
push str.SOFTWAREAdobeAcrobat_ReaderDCRestrictedSecuritySettings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a3be7
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x3c], 4
push ecx
xor edx, edx
lea ecx, [ebp - 0x34]
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push ecx
cmovae eax, dword [ebp - 0x28]
push edx
push edx
push eax
push dword [ebp - 0x30]
mov dword [ebp - 0x34], edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a3bd4
cmp dword [ebp - 0x34], eax
setne byte [ebp - 0x29]
jmp 0x4a3bd4
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x29], 0
je 0x4a3be7
mov al, bl
jmp 0x4a3beb
xor al, al
jmp 0x4a3beb
and dword [ebp - 4], 0
mov byte [0x5dfc70], al
test bl, 1
je 0x4a3c38
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4a3c38
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], ecx
mov byte [ebp - 4], 2
cmp eax, 0x1000
jb 0x4a3c2d
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.004ff107
mov eax, dword [ebp - 0x34]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x30]
jmp 0x4a3c2d
push eax
push ecx
call fcn.004ff107
pop ecx
pop ecx
jmp 0x4a3c38
push esi
call fcn.004ff107
pop ecx
jmp 0x4a3b0c
Function at 0x4a42f9
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x230
mov eax, 0x55967f
call fcn.004e864c
mov esi, dword [ebp + 8]
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
lea eax, [ebp - 0x230]
mov dword [ebp - 4], ebx
push eax
call fcn.004ff107
pop ecx
cmp dword [ebp - 0x220], ebx
je 0x4a444d
push 0x58a640
lea ecx, [ebp - 0x230]
call fcn.004a5ce5
push 0x58a5f4
lea ecx, [ebp - 0x230]
call fcn.004a5ce5
push str.WebResources
lea ecx, [ebp - 0x230]
call fcn.004a5ce5
lea eax, [ebp - 0x234]
push eax
push 1
push ebx
push dword [0x5d3054]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a441a
mov edi, 0x208
lea eax, [ebp - 0x218]
push edi
push ebx
push eax
call fcn.004eb600
add esp, 0xc
mov dword [ebp - 0x238], edi
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x23c]
push eax
push ebx
push dword [0x5d3058]
push dword [ebp - 0x234]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4a440a
cmp dword [ebp - 0x23c], 1
jne 0x4a440a
push 0x58a5f4
lea ecx, [ebp - 0x230]
mov bl, 1
call fcn.004a5ce5
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.004a5ce5
push dword [ebp - 0x234]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
jne 0x4a443a
push 0x58a5f4
lea ecx, [ebp - 0x230]
call fcn.004a5ce5
push str.Resource0
lea ecx, [ebp - 0x230]
call fcn.004a5ce5
lea eax, [ebp - 0x230]
push esi
push eax
call fcn.004a3c44
pop ecx
pop ecx
mov bl, al
jmp 0x4a445a
mov dword [esi + 0x10], ebx
cmp dword [esi + 0x14], 0x10
jb 0x4a4458
mov esi, dword [esi]
mov byte [esi], bl
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x21c]
cmp eax, 8
jb 0x4a44ba
mov ecx, dword [ebp - 0x230]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x238], ecx
mov dword [ebp - 4], 3
cmp eax, 0x1000
jb 0x4a44b1
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x238]
push eax
call fcn.004ff107
mov eax, dword [ebp - 0x234]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x238]
push eax
push ecx
call fcn.004ff107
pop ecx
pop ecx
mov al, bl
call fcn.004e85f6
ret
Function at 0x4a44c2
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x28
mov eax, 0x5596af
call fcn.004e864c
xor ebx, ebx
mov dword [ebp - 0x14], 0xf
push str.bDisableDropboxOauthWhitelisting
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
call fcn.0045446b
cmp dword [ebp - 0x18], 0
mov dword [ebp - 4], ebx
mov bl, 1
je 0x4a4554
lea eax, [ebp - 0x2c]
xor esi, esi
push eax
push 0x20019
push esi
push str.SOFTWAREAdobeAcrobat_ReaderDCRestrictedSecuritySettings
push 0x80000001
mov dword [ebp - 0x2c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a4554
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], esi
push ecx
push esi
lea eax, [ebp - 0x28]
mov dword [ebp - 0x34], 4
cmovae eax, dword [ebp - 0x28]
push esi
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a454b
cmp dword [ebp - 0x30], esi
sete bl
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4a4596
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], 1
cmp eax, 0x1000
jb 0x4a458d
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.004ff107
mov eax, dword [ebp - 0x30]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
push eax
push ecx
call fcn.004ff107
pop ecx
pop ecx
mov al, bl
call fcn.004e85f6
ret

Function at 0x4a459e
Capabilities:
Check if file exists

Disassembly:
push 0x24
mov eax, 0x5596dc
call fcn.004e864c
xor esi, esi
inc esi
cmp dword [0x5dfc6c], 0
jne 0x4a4687
mov dword [0x5dfc6c], 2
mov dword [ebp - 0x14], 7
and dword [ebp - 4], 0
xor eax, eax
and dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x28]
push eax
call fcn.004ff107
cmp dword [ebp - 0x18], 0
pop ecx
je 0x4a4643
mov edi, 0x58a5f4
lea ecx, [ebp - 0x28]
push edi
call fcn.004a5ce5
push 0x58a5f8
lea ecx, [ebp - 0x28]
call fcn.004a5ce5
cmp dword [ebp - 0x18], 0
je 0x4a4643
push edi
lea ecx, [ebp - 0x28]
call fcn.004a5ce5
push str.aaFEAT.api
lea ecx, [ebp - 0x28]
call fcn.004a5ce5
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [0x5dfc6c]
test eax, eax
cmovne ecx, esi
mov dword [0x5dfc6c], ecx
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x4a4687
mov ecx, dword [ebp - 0x28]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 4], esi
cmp eax, 0x1000
jb 0x4a467e
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.004ff107
mov eax, dword [ebp - 0x2c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x30]
push eax
push ecx
call fcn.004ff107
pop ecx
pop ecx
cmp dword [0x5dfc6c], esi
sete al
call fcn.004e85f6
ret
Function at 0x4a4835
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x24
mov eax, 0x5596dc
call fcn.004e864c
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x28]
xor eax, eax
mov dword [ebp - 0x14], 7
xor ebx, ebx
mov word [ebp - 0x28], ax
push str.SOFTWAREAdobeAcrobat_ReaderDCRestrictedSecuritySettings
mov dword [ebp - 0x18], ebx
call fcn.0045452f
xor edi, edi
mov dword [ebp - 4], ebx
inc edi
cmp dword [ebp - 0x18], ebx
je 0x4a48c3
cmp dword [esi + 0x10], ebx
je 0x4a48c3
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x2c]
push ecx
push 0x20019
lea eax, [ebp - 0x28]
mov dword [ebp - 0x2c], ebx
cmovae eax, dword [ebp - 0x28]
push ebx
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a48c3
cmp dword [esi + 0x14], 0x10
jb 0x4a48a3
mov esi, dword [esi]
push ebx
push ebx
push ebx
push ebx
push esi
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x2c]
cmp eax, 2
movzx ebx, bl
cmovne ebx, edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x4a4907
mov ecx, dword [ebp - 0x28]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 4], edi
cmp eax, 0x1000
jb 0x4a48fe
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.004ff107
mov eax, dword [ebp - 0x2c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x30]
push eax
push ecx
call fcn.004ff107
pop ecx
pop ecx
mov al, bl
call fcn.004e85f6
ret

Function at 0x4a4973
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x28
mov eax, 0x5596af
call fcn.004e864c
call fcn.004a459e
test al, al
je 0x4a4a60
call fcn.004ff107
test al, al
je 0x4a4a60
xor ebx, ebx
mov dword [ebp - 0x14], 0xf
push str.bEnableUnsafeHTTPScheme
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
call fcn.0045446b
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x4a4a1a
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], ebx
push eax
push 0x20019
push ebx
push str.SOFTWAREAdobeAcrobat_ReaderDCRestrictedSecuritySettings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a4a1a
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], ebx
push ecx
push ebx
lea eax, [ebp - 0x28]
mov dword [ebp - 0x34], 4
cmovae eax, dword [ebp - 0x28]
push ebx
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a4a11
cmp dword [ebp - 0x30], eax
setne bl
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4a4a5c
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], 1
cmp eax, 0x1000
jb 0x4a4a53
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.004ff107
mov eax, dword [ebp - 0x30]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
push eax
push ecx
call fcn.004ff107
pop ecx
pop ecx
mov al, bl
jmp 0x4a4a62
xor al, al
call fcn.004e85f6
ret
Function at 0x4a4a68
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x40
mov eax, 0x559751
call fcn.004e864c
call fcn.004ff107
test al, al
je 0x4a4bdc
call fcn.004a3adf
test al, al
jne 0x4a4bd8
push 0xf
pop esi
xor ebx, ebx
mov dword [ebp - 0x2c], esi
mov edi, str.bDisablePackLoading
mov dword [ebp - 0x30], ebx
push edi
lea ecx, [ebp - 0x40]
mov byte [ebp - 0x40], bl
call fcn.0045446b
lea eax, [ebp - 0x40]
mov dword [ebp - 4], ebx
push eax
call fcn.004a4835
mov bl, al
mov eax, dword [ebp - 0x2c]
neg bl
pop ecx
sbb bl, bl
or dword [ebp - 4], 0xffffffff
inc bl
cmp eax, 0x10
jb 0x4a4b05
mov ecx, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], ecx
mov dword [ebp - 4], 1
cmp eax, 0x1000
jb 0x4a4af8
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.004ff107
mov eax, dword [ebp - 0x44]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.004ff107
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
test bl, bl
jne 0x4a4bd8
xor ebx, ebx
mov dword [ebp - 0x14], esi
push edi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
call fcn.0045446b
mov dword [ebp - 4], 2
cmp dword [ebp - 0x18], ebx
je 0x4a4b8f
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], ebx
push eax
push 0x20019
push ebx
push str.SOFTWAREAdobeAcrobat_ReaderDCRestrictedSecuritySettings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
inc ebx
test eax, eax
jne 0x4a4b92
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x4c]
push ecx
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x48], ebx
push ecx
push 0
lea eax, [ebp - 0x28]
mov dword [ebp - 0x4c], 4
cmovae eax, dword [ebp - 0x28]
push 0
push eax
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a4b84
cmp dword [ebp - 0x48], eax
setne bl
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4a4b92
xor ebx, ebx
inc ebx
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4a4bd4
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 4], 3
cmp eax, 0x1000
jb 0x4a4bcb
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.004ff107
mov eax, dword [ebp - 0x48]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x44]
push eax
push ecx
call fcn.004ff107
pop ecx
pop ecx
mov al, bl
jmp 0x4a4bde
xor al, al
jmp 0x4a4bde
mov al, 1
call fcn.004e85f6
ret
Function at 0x4a4be4
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x28
mov eax, 0x5596af
call fcn.004e864c
call fcn.004a459e
test al, al
je 0x4a4ce1
call fcn.004ff107
test al, al
je 0x4a4ce1
call fcn.004a3adf
test al, al
je 0x4a4c1a
mov al, 1
jmp 0x4a4ce3
xor ebx, ebx
mov dword [ebp - 0x14], 0xf
push str.bDisableWebSecurity
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
call fcn.0045446b
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x4a4c9b
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], ebx
push eax
push 0x20019
push ebx
push str.SOFTWAREAdobeAcrobat_ReaderDCRestrictedSecuritySettings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a4c9b
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], ebx
push ecx
push ebx
lea eax, [ebp - 0x28]
mov dword [ebp - 0x34], 4
cmovae eax, dword [ebp - 0x28]
push ebx
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a4c92
cmp dword [ebp - 0x30], eax
setne bl
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4a4cdd
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], 1
cmp eax, 0x1000
jb 0x4a4cd4
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.004ff107
mov eax, dword [ebp - 0x30]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
push eax
push ecx
call fcn.004ff107
pop ecx
pop ecx
mov al, bl
jmp 0x4a4ce3
xor al, al
call fcn.004e85f6
ret