joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a5755
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x28
mov eax, 0x54cc39
call fcn.004f2a0c
call fcn.004a4bae
test al, al
je 0x4a5858
call fcn.004f351c
test al, al
je 0x4a5858
call fcn.004a40c3
test al, al
jne 0x4a5858
xor ebx, ebx
mov dword [ebp - 0x14], 0xf
push str.bEnableGPU
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
call fcn.0044d64d
cmp dword [ebp - 0x18], 0
mov dword [ebp - 4], ebx
mov bl, 1
je 0x4a5812
lea eax, [ebp - 0x2c]
xor esi, esi
push eax
push 0x20019
push esi
push str.SOFTWAREAdobeAcrobat_ReaderDCRestrictedSecuritySettings
push 0x80000001
mov dword [ebp - 0x2c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a5812
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], 1
push ecx
push esi
lea eax, [ebp - 0x28]
mov dword [ebp - 0x34], 4
cmovae eax, dword [ebp - 0x28]
push esi
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a5809
cmp dword [ebp - 0x30], esi
setne bl
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4a5854
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], 1
cmp eax, 0x1000
jb 0x4a584b
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.004f351c
mov eax, dword [ebp - 0x30]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
push eax
push ecx
call fcn.004f351c
pop ecx
pop ecx
mov al, bl
jmp 0x4a585a
mov al, 1
call fcn.004f29b6
ret
Function at 0x4a5860
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x28
mov eax, 0x54cc39
call fcn.004f2a0c
call fcn.004a4bae
test al, al
je 0x4a595d
call fcn.004f351c
test al, al
je 0x4a595d
call fcn.004a40c3
test al, al
je 0x4a5896
mov al, 1
jmp 0x4a595f
xor ebx, ebx
mov dword [ebp - 0x14], 0xf
push str.bEnableJSAccessClipBoard
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
call fcn.0044d64d
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x4a5917
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], ebx
push eax
push 0x20019
push ebx
push str.SOFTWAREAdobeAcrobat_ReaderDCRestrictedSecuritySettings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a5917
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], ebx
push ecx
push ebx
lea eax, [ebp - 0x28]
mov dword [ebp - 0x34], 4
cmovae eax, dword [ebp - 0x28]
push ebx
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a590e
cmp dword [ebp - 0x30], eax
setne bl
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4a5959
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], 1
cmp eax, 0x1000
jb 0x4a5950
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.004f351c
mov eax, dword [ebp - 0x30]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
push eax
push ecx
call fcn.004f351c
pop ecx
pop ecx
mov al, bl
jmp 0x4a595f
xor al, al
call fcn.004f29b6
ret
Function at 0x4a5965
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x28
mov eax, 0x54cc39
call fcn.004f2a0c
call fcn.004a4bae
test al, al
je 0x4a5a62
call fcn.004f351c
test al, al
je 0x4a5a62
call fcn.004a40c3
test al, al
je 0x4a599b
mov al, 1
jmp 0x4a5a64
xor ebx, ebx
mov dword [ebp - 0x14], 0xf
push str.bEnableJSCloseWindows
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
call fcn.0044d64d
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x4a5a1c
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], ebx
push eax
push 0x20019
push ebx
push str.SOFTWAREAdobeAcrobat_ReaderDCRestrictedSecuritySettings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a5a1c
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], ebx
push ecx
push ebx
lea eax, [ebp - 0x28]
mov dword [ebp - 0x34], 4
cmovae eax, dword [ebp - 0x28]
push ebx
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a5a13
cmp dword [ebp - 0x30], eax
setne bl
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4a5a5e
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], 1
cmp eax, 0x1000
jb 0x4a5a55
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.004f351c
mov eax, dword [ebp - 0x30]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
push eax
push ecx
call fcn.004f351c
pop ecx
pop ecx
mov al, bl
jmp 0x4a5a64
xor al, al
call fcn.004f29b6
ret
Function at 0x4a5a6a
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x28
mov eax, 0x54cc39
call fcn.004f2a0c
call fcn.004a4bae
test al, al
je 0x4a5b67
call fcn.004f351c
test al, al
je 0x4a5b67
call fcn.004a40c3
test al, al
je 0x4a5aa0
mov al, 1
jmp 0x4a5b69
xor ebx, ebx
mov dword [ebp - 0x14], 0xf
push str.bEnableJSDomPaste
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
call fcn.0044d64d
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x4a5b21
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], ebx
push eax
push 0x20019
push ebx
push str.SOFTWAREAdobeAcrobat_ReaderDCRestrictedSecuritySettings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a5b21
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], ebx
push ecx
push ebx
lea eax, [ebp - 0x28]
mov dword [ebp - 0x34], 4
cmovae eax, dword [ebp - 0x28]
push ebx
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a5b18
cmp dword [ebp - 0x30], eax
setne bl
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4a5b63
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], 1
cmp eax, 0x1000
jb 0x4a5b5a
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.004f351c
mov eax, dword [ebp - 0x30]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
push eax
push ecx
call fcn.004f351c
pop ecx
pop ecx
mov al, bl
jmp 0x4a5b69
xor al, al
call fcn.004f29b6
ret
Function at 0x4a5b6f
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x28
mov eax, 0x54cc39
call fcn.004f2a0c
call fcn.004a4bae
test al, al
je 0x4a5c72
call fcn.004f351c
test al, al
je 0x4a5c72
call fcn.004a40c3
test al, al
jne 0x4a5c72
xor ebx, ebx
mov dword [ebp - 0x14], 0xf
push str.bEnableLocalStorage
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
call fcn.0044d64d
cmp dword [ebp - 0x18], 0
mov dword [ebp - 4], ebx
mov bl, 1
je 0x4a5c2c
lea eax, [ebp - 0x2c]
xor esi, esi
push eax
push 0x20019
push esi
push str.SOFTWAREAdobeAcrobat_ReaderDCRestrictedSecuritySettings
push 0x80000001
mov dword [ebp - 0x2c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a5c2c
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], 1
push ecx
push esi
lea eax, [ebp - 0x28]
mov dword [ebp - 0x34], 4
cmovae eax, dword [ebp - 0x28]
push esi
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a5c23
cmp dword [ebp - 0x30], esi
setne bl
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4a5c6e
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], 1
cmp eax, 0x1000
jb 0x4a5c65
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.004f351c
mov eax, dword [ebp - 0x30]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
push eax
push ecx
call fcn.004f351c
pop ecx
pop ecx
mov al, bl
jmp 0x4a5c74
mov al, 1
call fcn.004f29b6
ret
Function at 0x4a5c85
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x28
mov eax, 0x54cc39
call fcn.004f2a0c
call fcn.004a4bae
test al, al
je 0x4a5d82
call fcn.004f351c
test al, al
je 0x4a5d82
call fcn.004a40c3
test al, al
je 0x4a5cbb
mov al, 1
jmp 0x4a5d84
xor ebx, ebx
mov dword [ebp - 0x14], 0xf
push str.bEnableMixedContent
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
call fcn.0044d64d
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x4a5d3c
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], ebx
push eax
push 0x20019
push ebx
push str.SOFTWAREAdobeAcrobat_ReaderDCRestrictedSecuritySettings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a5d3c
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], ebx
push ecx
push ebx
lea eax, [ebp - 0x28]
mov dword [ebp - 0x34], 4
cmovae eax, dword [ebp - 0x28]
push ebx
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a5d33
cmp dword [ebp - 0x30], eax
setne bl
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4a5d7e
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], 1
cmp eax, 0x1000
jb 0x4a5d75
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.004f351c
mov eax, dword [ebp - 0x30]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
push eax
push ecx
call fcn.004f351c
pop ecx
pop ecx
mov al, bl
jmp 0x4a5d84
xor al, al
call fcn.004f29b6
ret
Function at 0x4a5d8a
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x44
mov eax, 0x54cd3d
call fcn.004f2a0c
call fcn.004a4bae
test al, al
jne 0x4a5dac
call fcn.004a4dac
test al, al
je 0x4a5f11
call fcn.004f351c
test al, al
je 0x4a5f11
call fcn.004a40c3
test al, al
jne 0x4a5f0d
push 0xf
pop esi
xor ebx, ebx
mov dword [ebp - 0x2c], esi
mov edi, str.bEnableNetworkAccess
mov dword [ebp - 0x30], ebx
push edi
lea ecx, [ebp - 0x40]
mov byte [ebp - 0x40], bl
call fcn.0044d64d
lea eax, [ebp - 0x40]
mov dword [ebp - 4], ebx
push eax
call fcn.004a4ea9
neg al
pop ecx
mov ecx, dword [ebp - 0x2c]
sbb al, al
or dword [ebp - 4], 0xffffffff
inc al
mov byte [ebp - 0x49], al
cmp ecx, 0x10
jb 0x4a5e43
lea eax, [ecx + 1]
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], ecx
mov dword [ebp - 4], 1
cmp eax, 0x1000
jb 0x4a5e33
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.004f351c
mov eax, dword [ebp - 0x44]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.004f351c
or dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x49]
pop ecx
pop ecx
test al, al
jne 0x4a5f0d
push edi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], esi
mov byte [ebp - 0x28], bl
call fcn.0044d64d
cmp dword [ebp - 0x18], 0
mov dword [ebp - 4], 2
je 0x4a5ec7
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], ebx
push eax
push 0x20019
push ebx
push str.SOFTWAREAdobeAcrobat_ReaderDCRestrictedSecuritySettings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a5ec7
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x50]
push ecx
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x48], ebx
push ecx
push ebx
lea eax, [ebp - 0x28]
mov dword [ebp - 0x50], 4
cmovae eax, dword [ebp - 0x28]
push ebx
push eax
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a5ebe
cmp dword [ebp - 0x48], eax
setne bl
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4a5f09
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 4], 3
cmp eax, 0x1000
jb 0x4a5f00
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.004f351c
mov eax, dword [ebp - 0x48]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x44]
push eax
push ecx
call fcn.004f351c
pop ecx
pop ecx
mov al, bl
jmp 0x4a5f13
mov al, 1
jmp 0x4a5f13
xor al, al
call fcn.004f29b6
ret
Function at 0x4a5f19
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x44
mov eax, 0x54cd3d
call fcn.004f2a0c
call fcn.004f351c
test al, al
je 0x4a608a
call fcn.004a40c3
test al, al
jne 0x4a6086
push 0xf
pop esi
xor ebx, ebx
mov dword [ebp - 0x2c], esi
mov edi, str.bEnableDebugInterface
mov dword [ebp - 0x30], ebx
push edi
lea ecx, [ebp - 0x40]
mov byte [ebp - 0x40], bl
call fcn.0044d64d
lea eax, [ebp - 0x40]
mov dword [ebp - 4], ebx
push eax
call fcn.004a4ea9
neg al
pop ecx
mov ecx, dword [ebp - 0x2c]
sbb al, al
or dword [ebp - 4], 0xffffffff
inc al
mov byte [ebp - 0x49], al
cmp ecx, 0x10
jb 0x4a5fbc
lea eax, [ecx + 1]
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], ecx
mov dword [ebp - 4], 1
cmp eax, 0x1000
jb 0x4a5fac
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.004f351c
mov eax, dword [ebp - 0x44]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.004f351c
or dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x49]
pop ecx
pop ecx
test al, al
jne 0x4a6086
push edi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], esi
mov byte [ebp - 0x28], bl
call fcn.0044d64d
cmp dword [ebp - 0x18], 0
mov dword [ebp - 4], 2
je 0x4a6040
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], ebx
push eax
push 0x20019
push ebx
push str.SOFTWAREAdobeAcrobat_ReaderDCRestrictedSecuritySettings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a6040
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x50]
push ecx
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x48], ebx
push ecx
push ebx
lea eax, [ebp - 0x28]
mov dword [ebp - 0x50], 4
cmovae eax, dword [ebp - 0x28]
push ebx
push eax
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a6037
cmp dword [ebp - 0x48], eax
setne bl
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4a6082
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 4], 3
cmp eax, 0x1000
jb 0x4a6079
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.004f351c
mov eax, dword [ebp - 0x48]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x44]
push eax
push ecx
call fcn.004f351c
pop ecx
pop ecx
mov al, bl
jmp 0x4a608c
mov al, 1
jmp 0x4a608c
xor al, al
call fcn.004f29b6
ret
Function at 0x4a6092
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x28
mov eax, 0x54cc39
call fcn.004f2a0c
call fcn.004a4bae
test al, al
je 0x4a618f
call fcn.004f351c
test al, al
je 0x4a618f
call fcn.004a40c3
test al, al
je 0x4a60c8
mov al, 1
jmp 0x4a6191
xor ebx, ebx
mov dword [ebp - 0x14], 0xf
push str.bEnableUniAccessFromFileUrls
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
call fcn.0044d64d
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x4a6149
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], ebx
push eax
push 0x20019
push ebx
push str.SOFTWAREAdobeAcrobat_ReaderDCRestrictedSecuritySettings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a6149
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], ebx
push ecx
push ebx
lea eax, [ebp - 0x28]
mov dword [ebp - 0x34], 4
cmovae eax, dword [ebp - 0x28]
push ebx
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a6140
cmp dword [ebp - 0x30], eax
setne bl
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4a618b
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], 1
cmp eax, 0x1000
jb 0x4a6182
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.004f351c
mov eax, dword [ebp - 0x30]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
push eax
push ecx
call fcn.004f351c
pop ecx
pop ecx
mov al, bl
jmp 0x4a6191
xor al, al
call fcn.004f29b6
ret
Function at 0x4a6197
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x28
mov eax, 0x54cc39
call fcn.004f2a0c
call fcn.004a5755
test al, al
je 0x4a62a1
call fcn.004a4bae
test al, al
je 0x4a62a1
call fcn.004f351c
test al, al
je 0x4a62a1
call fcn.004a40c3
test al, al
je 0x4a61da
mov al, 1
jmp 0x4a62a3
xor ebx, ebx
mov dword [ebp - 0x14], 0xf
push str.bEnableWebGL
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
call fcn.0044d64d
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x4a625b
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], ebx
push eax
push 0x20019
push ebx
push str.SOFTWAREAdobeAcrobat_ReaderDCRestrictedSecuritySettings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a625b
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], ebx
push ecx
push ebx
lea eax, [ebp - 0x28]
mov dword [ebp - 0x34], 4
cmovae eax, dword [ebp - 0x28]
push ebx
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a6252
cmp dword [ebp - 0x30], eax
setne bl
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4a629d
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], 1
cmp eax, 0x1000
jb 0x4a6294
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.004f351c
mov eax, dword [ebp - 0x30]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
push eax
push ecx
call fcn.004f351c
pop ecx
pop ecx
mov al, bl
jmp 0x4a62a3
xor al, al
call fcn.004f29b6
ret
Function at 0x4a62a9
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x44
mov eax, 0x54cd3d
call fcn.004f2a0c
call fcn.004a4bae
test al, al
je 0x4a6427
call fcn.004f351c
test al, al
je 0x4a6427
call fcn.004a40c3
test al, al
jne 0x4a6423
push 0xf
pop esi
xor ebx, ebx
mov dword [ebp - 0x2c], esi
mov edi, str.bSetProxyContextManagerTestMode
mov dword [ebp - 0x30], ebx
push edi
lea ecx, [ebp - 0x40]
mov byte [ebp - 0x40], bl
call fcn.0044d64d
lea eax, [ebp - 0x40]
mov dword [ebp - 4], ebx
push eax
call fcn.004a4ea9
neg al
pop ecx
mov ecx, dword [ebp - 0x2c]
sbb al, al
or dword [ebp - 4], 0xffffffff
inc al
mov byte [ebp - 0x49], al
cmp ecx, 0x10
jb 0x4a6359
lea eax, [ecx + 1]
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], ecx
mov dword [ebp - 4], 1
cmp eax, 0x1000
jb 0x4a6349
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.004f351c
mov eax, dword [ebp - 0x44]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.004f351c
or dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x49]
pop ecx
pop ecx
test al, al
jne 0x4a6423
push edi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], esi
mov byte [ebp - 0x28], bl
call fcn.0044d64d
cmp dword [ebp - 0x18], 0
mov dword [ebp - 4], 2
je 0x4a63dd
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], ebx
push eax
push 0x20019
push ebx
push str.SOFTWAREAdobeAcrobat_ReaderDCRestrictedSecuritySettings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a63dd
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x50]
push ecx
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x48], ebx
push ecx
push ebx
lea eax, [ebp - 0x28]
mov dword [ebp - 0x50], 4
cmovae eax, dword [ebp - 0x28]
push ebx
push eax
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a63d4
cmp dword [ebp - 0x48], eax
setne bl
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4a641f
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 4], 3
cmp eax, 0x1000
jb 0x4a6416
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.004f351c
mov eax, dword [ebp - 0x48]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x44]
push eax
push ecx
call fcn.004f351c
pop ecx
pop ecx
mov al, bl
jmp 0x4a6429
mov al, 1
jmp 0x4a6429
xor al, al
call fcn.004f29b6
ret
Function at 0x4bab9d
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x98
mov eax, 0x54f6b8
call fcn.004f2a0c
call fcn.004f351c
test al, al
je 0x4badc4
xor ebx, ebx
mov esi, 0x5ce6f8
cmp byte [0x5ce6f7], bl
jne 0x4bac17
lea eax, [ebp - 0x9c]
mov byte [0x5ce6f7], 1
push eax
push str.SOFTWAREAdobeAcroPerf
push 0x80000001
mov dword [ebp - 0x9c], ebx
mov dword [ebp - 0xa0], 0x400
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea eax, [ebp - 0xa0]
push eax
push esi
lea eax, [ebp - 0xa4]
push eax
push ebx
push str.tOutputDir
push dword [ebp - 0x9c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp byte [0x5ce6f6], bl
lea ecx, [ebp - 0x38]
mov eax, 0x580538
mov dword [ebp - 0x28], ebx
mov edi, 0x58053c
mov dword [ebp - 0x24], 0xf
push str.AcroCEF_TimeInfo
cmove edi, eax
mov byte [ebp - 0x38], bl
call fcn.0044d64d
lea eax, [ebp - 0x38]
mov dword [ebp - 4], ebx
push eax
lea eax, [ebp - 0x98]
mov byte [ebp - 0x20], bl
push esi
push eax
call fcn.004ba95c
add esp, 0xc
mov esi, eax
push 0xa
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 1
push eax
call dword [sym.imp.kernel32.dll_GetCurrentProcessId]
push eax
call fcn.004f351c
push eax
lea eax, [ebp - 0x80]
push esi
push eax
call fcn.004f351c
push edi
push eax
lea eax, [ebp - 0x68]
mov byte [ebp - 4], 2
push eax
call fcn.004f351c
push str..log
push eax
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 3
push eax
call fcn.004f351c
lea ecx, [ebp - 0x38]
add esp, 0x30
cmp ecx, eax
je 0x4bacbf
mov byte [ebp - 0xa0], bl
push dword [ebp - 0xa0]
push eax
call fcn.004f351c
lea ecx, [ebp - 0x50]
call fcn.0044d3fa
lea ecx, [ebp - 0x68]
call fcn.0044d3fa
lea ecx, [ebp - 0x80]
call fcn.0044d3fa
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], bl
call fcn.0044d3fa
cmp dword [ebp - 0x24], 0x10
lea eax, [ebp - 0x38]
push 0x58055c
cmovae eax, dword [ebp - 0x38]
push eax
call fcn.004f351c
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x4bad70
call fcn.004baf19
mov edi, eax
mov edx, dword [edi]
mov ecx, dword [edx]
mov dword [ebp - 0x9c], ecx
cmp ecx, edx
je 0x4bad69
movsd xmm0, qword [ecx + 0x28]
add ecx, 0x10
ucomisd xmm0, qword [0x580568]
lahf
test ah, 0x44
jnp 0x4bad54
cmp dword [ecx + 0x14], 0x10
jb 0x4bad36
mov ecx, dword [ecx]
divsd xmm0, qword [0x57c6c0]
push ecx
push ecx
push ecx
movsd qword [esp], xmm0
push str._lf_t_s_n
push esi
call fcn.004f351c
add esp, 0x14
lea ecx, [ebp - 0x9c]
call fcn.0044c162
mov ecx, dword [ebp - 0x9c]
cmp ecx, dword [edi]
jne 0x4bad18
push esi
call fcn.00500a23
pop ecx
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x24]
cmp eax, 0x10
jb 0x4badc4
mov ecx, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0xa0], ecx
mov dword [ebp - 4], 4
cmp eax, 0x1000
jb 0x4badbb
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0xa0]
push eax
call fcn.004f351c
mov eax, dword [ebp - 0x9c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0xa0]
push eax
push ecx
call fcn.004f351c
pop ecx
pop ecx
call fcn.004f29b6
ret