joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c47cc
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x140262958]
xor rax, rsp
mov qword [rbp - 8], rax
mov rdi, rcx
xor ebx, ebx
mov qword [rbp - 0x18], rbx
mov qword [rbp - 0x10], 7
mov word [rbp - 0x28], bx
lea rcx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
call fcn.140172940
nop
mov r8, rax
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
lea rcx, [rbp - 0x28]
call fcn.140054f4c
nop
cmp qword [rbp - 0x18], rbx
je 0x1400c48a3
cmp qword [rdi + 0x10], rbx
je 0x1400c48a3
mov qword [rbp - 0x30], rbx
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rdx, qword [rbp - 0x28]
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c48a3
cmp qword [rdi + 0x18], 0x10
jb 0x1400c486d
mov rdi, qword [rdi]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
movzx ebx, bl
mov edx, 1
cmp eax, 2
cmovne ebx, edx
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, 8
jb 0x1400c48e0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c48da
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c4900
call fcn.14016b110
nop
mov al, bl
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14016b720
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.14017266c
nop
int3

Function at 0x1400c4908
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
lea rax, [rsp + 0x50]
xor ebx, ebx
mov r9d, 0x20019
mov qword [rsp + 0x50], rbx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c498e
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rdx, str.CEFSecurityMK
lea rax, [rsp + 0x40]
mov dword [rsp + 0x40], ebx
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x48], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c4983
cmp dword [rsp + 0x40], ebx
setne bl
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
add rsp, 0x30
pop rbx
ret
Function at 0x1400c4998
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140262958]
xor rax, rsp
mov qword [rbp - 0x10], rax
and qword [rbp - 0x20], 0
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], 0
lea rdx, str.bDisableSignInOauthWhitelisting
lea rcx, [rbp - 0x30]
call fcn.140054ecc
nop
mov bl, 1
cmp qword [rbp - 0x20], 0
je 0x1400c4a5c
and qword [rbp - 0x38], 0
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c4a5c
and dword [rbp - 0x40], eax
mov dword [rbp - 0x3c], 4
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c4a51
cmp dword [rbp - 0x40], eax
sete bl
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400c4a94
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c4a8e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c4ab0
call fcn.14016b110
nop
mov al, bl
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14016b720
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
call fcn.14017266c
nop
int3
Function at 0x1400c4ab8
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140262958]
xor rax, rsp
mov qword [rbp - 0x10], rax
call fcn.1400c43ac
xor ebx, ebx
test al, al
je 0x1400c4bce
call fcn.1400c4908
test al, al
je 0x1400c4bce
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], bl
lea rdx, str.bEnableUnsafeHTTPScheme
lea rcx, [rbp - 0x30]
call fcn.140054ecc
nop
cmp qword [rbp - 0x20], rbx
je 0x1400c4b92
mov qword [rbp - 0x38], rbx
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c4b92
mov dword [rbp - 0x40], ebx
mov dword [rbp - 0x3c], 4
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c4b87
cmp dword [rbp - 0x40], ebx
setne bl
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400c4bca
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c4bc4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c4bea
call fcn.14016b110
nop
mov al, bl
jmp 0x1400c4bd0
xor al, al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14016b720
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
call fcn.14017266c
nop

Function at 0x1400c4bf0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
call fcn.1400c41fc
and qword [rsp + 0x50], 0
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCCEF
mov bl, al
mov r9d, 0x20019
lea rax, [rsp + 0x50]
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c4c7c
and dword [rsp + 0x40], eax
lea rdx, str.bEnableCrashReporterForCEF
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rsp + 0x40]
mov dword [rsp + 0x48], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c4c71
cmp dword [rsp + 0x40], eax
setne bl
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
add rsp, 0x30
pop rbx
ret
Function at 0x1400c4c84
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140262958]
xor rax, rsp
mov qword [rbp - 0x10], rax
call fcn.1400c43ac
xor ebx, ebx
test al, al
je 0x1400c4daa
call fcn.1400c4908
test al, al
je 0x1400c4daa
call fcn.1400c3334
test al, al
je 0x1400c4ccb
mov al, 1
jmp 0x1400c4dac
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], bl
lea rdx, str.bEnableDatabases
lea rcx, [rbp - 0x30]
call fcn.140054ecc
nop
cmp qword [rbp - 0x20], rbx
je 0x1400c4d6e
mov qword [rbp - 0x38], rbx
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c4d6e
mov dword [rbp - 0x40], ebx
mov dword [rbp - 0x3c], 4
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c4d63
cmp dword [rbp - 0x40], ebx
setne bl
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400c4da6
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c4da0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c4dc6
call fcn.14016b110
nop
mov al, bl
jmp 0x1400c4dac
xor al, al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14016b720
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
call fcn.14017266c
nop
Function at 0x1400c4dcc
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140262958]
xor rax, rsp
mov qword [rbp - 0x10], rax
call fcn.1400c43ac
test al, al
je 0x1400c4ef5
call fcn.1400c4908
test al, al
je 0x1400c4ef5
call fcn.1400c3334
test al, al
jne 0x1400c4ef5
and qword [rbp - 0x20], 0
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], al
lea rdx, str.bEnableGPU
lea rcx, [rbp - 0x30]
call fcn.140054ecc
nop
mov ebx, 1
cmp qword [rbp - 0x20], 0
je 0x1400c4eb9
and qword [rbp - 0x38], 0
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c4eb9
mov dword [rbp - 0x40], ebx
mov dword [rbp - 0x3c], 4
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c4eae
cmp dword [rbp - 0x40], eax
setne bl
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400c4ef1
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c4eeb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c4f14
call fcn.14016b110
nop
mov al, bl
jmp 0x1400c4efa
mov eax, 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14016b720
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
call fcn.14017266c
nop
int3
Function at 0x1400c4f1c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140262958]
xor rax, rsp
mov qword [rbp - 0x10], rax
call fcn.1400c43ac
xor ebx, ebx
test al, al
je 0x1400c5042
call fcn.1400c4908
test al, al
je 0x1400c5042
call fcn.1400c3334
test al, al
je 0x1400c4f63
mov al, 1
jmp 0x1400c5044
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], bl
lea rdx, str.bEnableJSAccessClipBoard
lea rcx, [rbp - 0x30]
call fcn.140054ecc
nop
cmp qword [rbp - 0x20], rbx
je 0x1400c5006
mov qword [rbp - 0x38], rbx
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c5006
mov dword [rbp - 0x40], ebx
mov dword [rbp - 0x3c], 4
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c4ffb
cmp dword [rbp - 0x40], ebx
setne bl
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400c503e
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c5038
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c505e
call fcn.14016b110
nop
mov al, bl
jmp 0x1400c5044
xor al, al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14016b720
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
call fcn.14017266c
nop
Function at 0x1400c5064
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140262958]
xor rax, rsp
mov qword [rbp - 0x10], rax
call fcn.1400c43ac
xor ebx, ebx
test al, al
je 0x1400c518a
call fcn.1400c4908
test al, al
je 0x1400c518a
call fcn.1400c3334
test al, al
je 0x1400c50ab
mov al, 1
jmp 0x1400c518c
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], bl
lea rdx, str.bEnableJSCloseWindows
lea rcx, [rbp - 0x30]
call fcn.140054ecc
nop
cmp qword [rbp - 0x20], rbx
je 0x1400c514e
mov qword [rbp - 0x38], rbx
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c514e
mov dword [rbp - 0x40], ebx
mov dword [rbp - 0x3c], 4
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c5143
cmp dword [rbp - 0x40], ebx
setne bl
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400c5186
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c5180
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c51a6
call fcn.14016b110
nop
mov al, bl
jmp 0x1400c518c
xor al, al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14016b720
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
call fcn.14017266c
nop
Function at 0x1400c51ac
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140262958]
xor rax, rsp
mov qword [rbp - 0x10], rax
call fcn.1400c43ac
xor ebx, ebx
test al, al
je 0x1400c52d2
call fcn.1400c4908
test al, al
je 0x1400c52d2
call fcn.1400c3334
test al, al
je 0x1400c51f3
mov al, 1
jmp 0x1400c52d4
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], bl
lea rdx, str.bEnableJSDomPaste
lea rcx, [rbp - 0x30]
call fcn.140054ecc
nop
cmp qword [rbp - 0x20], rbx
je 0x1400c5296
mov qword [rbp - 0x38], rbx
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c5296
mov dword [rbp - 0x40], ebx
mov dword [rbp - 0x3c], 4
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c528b
cmp dword [rbp - 0x40], ebx
setne bl
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400c52ce
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c52c8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c52ee
call fcn.14016b110
nop
mov al, bl
jmp 0x1400c52d4
xor al, al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14016b720
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
call fcn.14017266c
nop
Function at 0x1400c52f4
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140262958]
xor rax, rsp
mov qword [rbp - 0x10], rax
call fcn.1400c43ac
test al, al
je 0x1400c541d
call fcn.1400c4908
test al, al
je 0x1400c541d
call fcn.1400c3334
test al, al
jne 0x1400c541d
and qword [rbp - 0x20], 0
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], al
lea rdx, str.bEnableLocalStorage
lea rcx, [rbp - 0x30]
call fcn.140054ecc
nop
mov ebx, 1
cmp qword [rbp - 0x20], 0
je 0x1400c53e1
and qword [rbp - 0x38], 0
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c53e1
mov dword [rbp - 0x40], ebx
mov dword [rbp - 0x3c], 4
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c53d6
cmp dword [rbp - 0x40], eax
setne bl
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400c5419
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c5413
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c543c
call fcn.14016b110
nop
mov al, bl
jmp 0x1400c5422
mov eax, 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14016b720
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
call fcn.14017266c
nop
int3
Function at 0x1400c5458
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140262958]
xor rax, rsp
mov qword [rbp - 0x10], rax
call fcn.1400c43ac
xor ebx, ebx
test al, al
je 0x1400c557e
call fcn.1400c4908
test al, al
je 0x1400c557e
call fcn.1400c3334
test al, al
je 0x1400c549f
mov al, 1
jmp 0x1400c5580
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], bl
lea rdx, str.bEnableMixedContent
lea rcx, [rbp - 0x30]
call fcn.140054ecc
nop
cmp qword [rbp - 0x20], rbx
je 0x1400c5542
mov qword [rbp - 0x38], rbx
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c5542
mov dword [rbp - 0x40], ebx
mov dword [rbp - 0x3c], 4
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c5537
cmp dword [rbp - 0x40], ebx
setne bl
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400c557a
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c5574
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c559a
call fcn.14016b110
nop
mov al, bl
jmp 0x1400c5580
xor al, al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14016b720
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
call fcn.14017266c
nop
Function at 0x1400c55a0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140262958]
xor rax, rsp
mov qword [rbp - 0x10], rax
call fcn.1400c43ac
xor ebx, ebx
test al, al
jne 0x1400c55d8
call fcn.1400c45b4
test al, al
je 0x1400c5749
call fcn.1400c4908
test al, al
je 0x1400c5749
call fcn.1400c3334
test al, al
jne 0x1400c5745
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], bl
lea rdx, str.bEnableNetworkAccess
lea rcx, [rbp - 0x30]
call fcn.140054ecc
nop
lea rcx, [rbp - 0x30]
call fcn.1400c47cc
test al, al
sete dil
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400c565d
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c5657
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c576f
call fcn.14016b110
nop
test dil, dil
jne 0x1400c5745
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], bl
lea rdx, str.bEnableNetworkAccess
lea rcx, [rbp - 0x30]
call fcn.140054ecc
nop
cmp qword [rbp - 0x20], rbx
je 0x1400c5709
mov qword [rbp - 0x38], rbx
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c5709
mov dword [rbp - 0x40], ebx
mov dword [rbp - 0x3c], 4
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c56fe
cmp dword [rbp - 0x40], ebx
setne bl
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400c5741
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c573b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c5769
call fcn.14016b110
nop
mov al, bl
jmp 0x1400c574b
mov al, 1
jmp 0x1400c574b
xor al, al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14016b720
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
call fcn.14017266c
nop
call fcn.14017266c
int3
Function at 0x1400c5778
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140262958]
xor rax, rsp
mov qword [rbp - 0x10], rax
call fcn.1400c4908
xor ebx, ebx
test al, al
je 0x1400c590b
call fcn.1400c3334
test al, al
jne 0x1400c5907
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], bl
lea rdx, str.bEnableDebugInterface
lea rcx, [rbp - 0x30]
call fcn.140054ecc
nop
lea rcx, [rbp - 0x30]
call fcn.1400c47cc
test al, al
sete dil
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400c581f
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c5819
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c5931
call fcn.14016b110
nop
test dil, dil
jne 0x1400c5907
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], bl
lea rdx, str.bEnableDebugInterface
lea rcx, [rbp - 0x30]
call fcn.140054ecc
nop
cmp qword [rbp - 0x20], rbx
je 0x1400c58cb
mov qword [rbp - 0x38], rbx
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c58cb
mov dword [rbp - 0x40], ebx
mov dword [rbp - 0x3c], 4
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c58c0
cmp dword [rbp - 0x40], ebx
setne bl
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400c5903
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c58fd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c592b
call fcn.14016b110
nop
mov al, bl
jmp 0x1400c590d
mov al, 1
jmp 0x1400c590d
xor al, al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14016b720
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
call fcn.14017266c
nop
call fcn.14017266c
int3