joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c3eb8
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140222818]
xor rax, rsp
mov qword [rbp - 0x10], rax
call fcn.1400c3824
xor ebx, ebx
test al, al
je 0x1400c3fce
call fcn.1400c3d08
test al, al
je 0x1400c3fce
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], bl
lea rdx, str.bEnableUnsafeHTTPScheme
lea rcx, [rbp - 0x30]
call fcn.140055860
nop
cmp qword [rbp - 0x20], rbx
je 0x1400c3f92
mov qword [rbp - 0x38], rbx
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c3f92
mov dword [rbp - 0x40], ebx
mov dword [rbp - 0x3c], 4
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c3f87
cmp dword [rbp - 0x40], ebx
setne bl
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400c3fca
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c3fc4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c3fea
call fcn.140139cc4
nop
mov al, bl
jmp 0x1400c3fd0
xor al, al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14013a2d0
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
call fcn.140140ecc
nop
Function at 0x1400c3ff0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140222818]
xor rax, rsp
mov qword [rbp - 0x10], rax
call fcn.1400c3824
xor ebx, ebx
test al, al
je 0x1400c4116
call fcn.1400c3d08
test al, al
je 0x1400c4116
call fcn.1400c28c0
test al, al
je 0x1400c4037
mov al, 1
jmp 0x1400c4118
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], bl
lea rdx, str.bEnableDatabases
lea rcx, [rbp - 0x30]
call fcn.140055860
nop
cmp qword [rbp - 0x20], rbx
je 0x1400c40da
mov qword [rbp - 0x38], rbx
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c40da
mov dword [rbp - 0x40], ebx
mov dword [rbp - 0x3c], 4
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c40cf
cmp dword [rbp - 0x40], ebx
setne bl
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400c4112
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c410c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c4132
call fcn.140139cc4
nop
mov al, bl
jmp 0x1400c4118
xor al, al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14013a2d0
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
call fcn.140140ecc
nop
Function at 0x1400c4138
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140222818]
xor rax, rsp
mov qword [rbp - 0x10], rax
call fcn.1400c3824
test al, al
je 0x1400c4261
call fcn.1400c3d08
test al, al
je 0x1400c4261
call fcn.1400c28c0
test al, al
jne 0x1400c4261
and qword [rbp - 0x20], 0
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], al
lea rdx, str.bEnableGPU
lea rcx, [rbp - 0x30]
call fcn.140055860
nop
mov ebx, 1
cmp qword [rbp - 0x20], 0
je 0x1400c4225
and qword [rbp - 0x38], 0
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c4225
mov dword [rbp - 0x40], ebx
mov dword [rbp - 0x3c], 4
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c421a
cmp dword [rbp - 0x40], eax
setne bl
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400c425d
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c4257
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c4280
call fcn.140139cc4
nop
mov al, bl
jmp 0x1400c4266
mov eax, 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14013a2d0
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
call fcn.140140ecc
nop
int3
Function at 0x1400c4288
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140222818]
xor rax, rsp
mov qword [rbp - 0x10], rax
call fcn.1400c3824
xor ebx, ebx
test al, al
je 0x1400c43ae
call fcn.1400c3d08
test al, al
je 0x1400c43ae
call fcn.1400c28c0
test al, al
je 0x1400c42cf
mov al, 1
jmp 0x1400c43b0
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], bl
lea rdx, str.bEnableJSAccessClipBoard
lea rcx, [rbp - 0x30]
call fcn.140055860
nop
cmp qword [rbp - 0x20], rbx
je 0x1400c4372
mov qword [rbp - 0x38], rbx
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c4372
mov dword [rbp - 0x40], ebx
mov dword [rbp - 0x3c], 4
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c4367
cmp dword [rbp - 0x40], ebx
setne bl
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400c43aa
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c43a4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c43ca
call fcn.140139cc4
nop
mov al, bl
jmp 0x1400c43b0
xor al, al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14013a2d0
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
call fcn.140140ecc
nop
Function at 0x1400c43d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140222818]
xor rax, rsp
mov qword [rbp - 0x10], rax
call fcn.1400c3824
xor ebx, ebx
test al, al
je 0x1400c44f6
call fcn.1400c3d08
test al, al
je 0x1400c44f6
call fcn.1400c28c0
test al, al
je 0x1400c4417
mov al, 1
jmp 0x1400c44f8
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], bl
lea rdx, str.bEnableJSCloseWindows
lea rcx, [rbp - 0x30]
call fcn.140055860
nop
cmp qword [rbp - 0x20], rbx
je 0x1400c44ba
mov qword [rbp - 0x38], rbx
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c44ba
mov dword [rbp - 0x40], ebx
mov dword [rbp - 0x3c], 4
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c44af
cmp dword [rbp - 0x40], ebx
setne bl
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400c44f2
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c44ec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c4512
call fcn.140139cc4
nop
mov al, bl
jmp 0x1400c44f8
xor al, al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14013a2d0
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
call fcn.140140ecc
nop
Function at 0x1400c4518
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140222818]
xor rax, rsp
mov qword [rbp - 0x10], rax
call fcn.1400c3824
xor ebx, ebx
test al, al
je 0x1400c463e
call fcn.1400c3d08
test al, al
je 0x1400c463e
call fcn.1400c28c0
test al, al
je 0x1400c455f
mov al, 1
jmp 0x1400c4640
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], bl
lea rdx, str.bEnableJSDomPaste
lea rcx, [rbp - 0x30]
call fcn.140055860
nop
cmp qword [rbp - 0x20], rbx
je 0x1400c4602
mov qword [rbp - 0x38], rbx
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c4602
mov dword [rbp - 0x40], ebx
mov dword [rbp - 0x3c], 4
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c45f7
cmp dword [rbp - 0x40], ebx
setne bl
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400c463a
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c4634
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c465a
call fcn.140139cc4
nop
mov al, bl
jmp 0x1400c4640
xor al, al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14013a2d0
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
call fcn.140140ecc
nop
Function at 0x1400c4660
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140222818]
xor rax, rsp
mov qword [rbp - 0x10], rax
call fcn.1400c3824
test al, al
je 0x1400c4789
call fcn.1400c3d08
test al, al
je 0x1400c4789
call fcn.1400c28c0
test al, al
jne 0x1400c4789
and qword [rbp - 0x20], 0
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], al
lea rdx, str.bEnableLocalStorage
lea rcx, [rbp - 0x30]
call fcn.140055860
nop
mov ebx, 1
cmp qword [rbp - 0x20], 0
je 0x1400c474d
and qword [rbp - 0x38], 0
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c474d
mov dword [rbp - 0x40], ebx
mov dword [rbp - 0x3c], 4
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c4742
cmp dword [rbp - 0x40], eax
setne bl
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400c4785
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c477f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c47a8
call fcn.140139cc4
nop
mov al, bl
jmp 0x1400c478e
mov eax, 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14013a2d0
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
call fcn.140140ecc
nop
int3
Function at 0x1400c47c4
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140222818]
xor rax, rsp
mov qword [rbp - 0x10], rax
call fcn.1400c3824
xor ebx, ebx
test al, al
je 0x1400c48ea
call fcn.1400c3d08
test al, al
je 0x1400c48ea
call fcn.1400c28c0
test al, al
je 0x1400c480b
mov al, 1
jmp 0x1400c48ec
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], bl
lea rdx, str.bEnableMixedContent
lea rcx, [rbp - 0x30]
call fcn.140055860
nop
cmp qword [rbp - 0x20], rbx
je 0x1400c48ae
mov qword [rbp - 0x38], rbx
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c48ae
mov dword [rbp - 0x40], ebx
mov dword [rbp - 0x3c], 4
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c48a3
cmp dword [rbp - 0x40], ebx
setne bl
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400c48e6
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c48e0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c4906
call fcn.140139cc4
nop
mov al, bl
jmp 0x1400c48ec
xor al, al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14013a2d0
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
call fcn.140140ecc
nop
Function at 0x1400c490c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140222818]
xor rax, rsp
mov qword [rbp - 0x10], rax
call fcn.1400c3824
xor ebx, ebx
test al, al
jne 0x1400c4944
call fcn.1400c3a2c
test al, al
je 0x1400c4ab5
call fcn.1400c3d08
test al, al
je 0x1400c4ab5
call fcn.1400c28c0
test al, al
jne 0x1400c4ab1
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], bl
lea rdx, str.bEnableNetworkAccess
lea rcx, [rbp - 0x30]
call fcn.140055860
nop
lea rcx, [rbp - 0x30]
call fcn.1400c3bcc
test al, al
sete dil
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400c49c9
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c49c3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c4adb
call fcn.140139cc4
nop
test dil, dil
jne 0x1400c4ab1
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], bl
lea rdx, str.bEnableNetworkAccess
lea rcx, [rbp - 0x30]
call fcn.140055860
nop
cmp qword [rbp - 0x20], rbx
je 0x1400c4a75
mov qword [rbp - 0x38], rbx
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c4a75
mov dword [rbp - 0x40], ebx
mov dword [rbp - 0x3c], 4
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c4a6a
cmp dword [rbp - 0x40], ebx
setne bl
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400c4aad
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c4aa7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c4ad5
call fcn.140139cc4
nop
mov al, bl
jmp 0x1400c4ab7
mov al, 1
jmp 0x1400c4ab7
xor al, al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14013a2d0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
call fcn.140140ecc
nop
call fcn.140140ecc
int3
Function at 0x1400c4ae4
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140222818]
xor rax, rsp
mov qword [rbp - 0x10], rax
call fcn.1400c3d08
xor ebx, ebx
test al, al
je 0x1400c4c77
call fcn.1400c28c0
test al, al
jne 0x1400c4c73
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], bl
lea rdx, str.bEnableDebugInterface
lea rcx, [rbp - 0x30]
call fcn.140055860
nop
lea rcx, [rbp - 0x30]
call fcn.1400c3bcc
test al, al
sete dil
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400c4b8b
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c4b85
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c4c9d
call fcn.140139cc4
nop
test dil, dil
jne 0x1400c4c73
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], bl
lea rdx, str.bEnableDebugInterface
lea rcx, [rbp - 0x30]
call fcn.140055860
nop
cmp qword [rbp - 0x20], rbx
je 0x1400c4c37
mov qword [rbp - 0x38], rbx
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c4c37
mov dword [rbp - 0x40], ebx
mov dword [rbp - 0x3c], 4
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c4c2c
cmp dword [rbp - 0x40], ebx
setne bl
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400c4c6f
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c4c69
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c4c97
call fcn.140139cc4
nop
mov al, bl
jmp 0x1400c4c79
mov al, 1
jmp 0x1400c4c79
xor al, al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14013a2d0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
call fcn.140140ecc
nop
call fcn.140140ecc
int3
Function at 0x1400c4ca4
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140222818]
xor rax, rsp
mov qword [rbp - 0x10], rax
call fcn.1400c4138
xor ebx, ebx
test al, al
je 0x1400c4dd7
call fcn.1400c3824
test al, al
je 0x1400c4dd7
call fcn.1400c3d08
test al, al
je 0x1400c4dd7
call fcn.1400c28c0
test al, al
je 0x1400c4cf8
mov al, 1
jmp 0x1400c4dd9
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], bl
lea rdx, str.bEnableWebGL
lea rcx, [rbp - 0x30]
call fcn.140055860
nop
cmp qword [rbp - 0x20], rbx
je 0x1400c4d9b
mov qword [rbp - 0x38], rbx
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c4d9b
mov dword [rbp - 0x40], ebx
mov dword [rbp - 0x3c], 4
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c4d90
cmp dword [rbp - 0x40], ebx
setne bl
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400c4dd3
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c4dcd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c4df3
call fcn.140139cc4
nop
mov al, bl
jmp 0x1400c4dd9
xor al, al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14013a2d0
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
call fcn.140140ecc
nop
int3
Function at 0x1400c4dfc
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140222818]
xor rax, rsp
mov qword [rbp - 0x10], rax
call fcn.1400c3824
xor ebx, ebx
test al, al
je 0x1400c4f9c
call fcn.1400c3d08
test al, al
je 0x1400c4f9c
call fcn.1400c28c0
test al, al
jne 0x1400c4f98
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], bl
lea rdx, str.bSetProxyContextManagerTestMode
lea rcx, [rbp - 0x30]
call fcn.140055860
nop
lea rcx, [rbp - 0x30]
call fcn.1400c3bcc
test al, al
sete dil
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400c4eb0
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c4eaa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c4fc2
call fcn.140139cc4
nop
test dil, dil
jne 0x1400c4f98
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], bl
lea rdx, str.bSetProxyContextManagerTestMode
lea rcx, [rbp - 0x30]
call fcn.140055860
nop
cmp qword [rbp - 0x20], rbx
je 0x1400c4f5c
mov qword [rbp - 0x38], rbx
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c4f5c
mov dword [rbp - 0x40], ebx
mov dword [rbp - 0x3c], 4
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c4f51
cmp dword [rbp - 0x40], ebx
setne bl
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400c4f94
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c4f8e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c4fbc
call fcn.140139cc4
nop
mov al, bl
jmp 0x1400c4f9e
mov al, 1
jmp 0x1400c4f9e
xor al, al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14013a2d0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
call fcn.140140ecc
nop
call fcn.140140ecc
int3