joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c5884
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140268998]
xor rax, rsp
mov qword [rbp - 0x10], rax
call fcn.1400c4f94
test al, al
je 0x1400c59b1
call fcn.1400c54f0
test al, al
je 0x1400c59b1
call fcn.1400c35d4
test al, al
je 0x1400c58c9
xor al, al
jmp 0x1400c59b6
and qword [rbp - 0x20], 0
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], 0
lea rdx, str.bEnableCSP
lea rcx, [rbp - 0x30]
call fcn.140054efc
nop
mov ebx, 1
cmp qword [rbp - 0x20], 0
je 0x1400c5975
and qword [rbp - 0x38], 0
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c5975
mov dword [rbp - 0x40], ebx
mov dword [rbp - 0x3c], 4
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c596a
cmp dword [rbp - 0x40], eax
setne bl
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400c59ad
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c59a7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c59d0
call fcn.14016f250
nop
mov al, bl
jmp 0x1400c59b6
mov eax, 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14016f860
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
call fcn.1401767ac
nop
int3

Function at 0x1400c59d8
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
call fcn.1400c4de4
and qword [rsp + 0x50], 0
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCCEF
mov bl, al
mov r9d, 0x20019
lea rax, [rsp + 0x50]
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c5a64
and dword [rsp + 0x40], eax
lea rdx, str.bEnableCrashReporterForCEF
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rsp + 0x40]
mov dword [rsp + 0x48], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c5a59
cmp dword [rsp + 0x40], eax
setne bl
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
add rsp, 0x30
pop rbx
ret
Function at 0x1400c5a6c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140268998]
xor rax, rsp
mov qword [rbp - 0x10], rax
call fcn.1400c4f94
xor ebx, ebx
test al, al
je 0x1400c5b92
call fcn.1400c54f0
test al, al
je 0x1400c5b92
call fcn.1400c35d4
test al, al
je 0x1400c5ab3
mov al, 1
jmp 0x1400c5b94
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], bl
lea rdx, str.bEnableDatabases
lea rcx, [rbp - 0x30]
call fcn.140054efc
nop
cmp qword [rbp - 0x20], rbx
je 0x1400c5b56
mov qword [rbp - 0x38], rbx
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c5b56
mov dword [rbp - 0x40], ebx
mov dword [rbp - 0x3c], 4
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c5b4b
cmp dword [rbp - 0x40], ebx
setne bl
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400c5b8e
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c5b88
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c5bae
call fcn.14016f250
nop
mov al, bl
jmp 0x1400c5b94
xor al, al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14016f860
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
call fcn.1401767ac
nop
Function at 0x1400c5bb4
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140268998]
xor rax, rsp
mov qword [rbp - 0x10], rax
call fcn.1400c4f94
test al, al
je 0x1400c5cdd
call fcn.1400c54f0
test al, al
je 0x1400c5cdd
call fcn.1400c35d4
test al, al
jne 0x1400c5cdd
and qword [rbp - 0x20], 0
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], al
lea rdx, str.bEnableGPU
lea rcx, [rbp - 0x30]
call fcn.140054efc
nop
mov ebx, 1
cmp qword [rbp - 0x20], 0
je 0x1400c5ca1
and qword [rbp - 0x38], 0
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c5ca1
mov dword [rbp - 0x40], ebx
mov dword [rbp - 0x3c], 4
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c5c96
cmp dword [rbp - 0x40], eax
setne bl
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400c5cd9
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c5cd3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c5cfc
call fcn.14016f250
nop
mov al, bl
jmp 0x1400c5ce2
mov eax, 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14016f860
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
call fcn.1401767ac
nop
int3
Function at 0x1400c5d04
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140268998]
xor rax, rsp
mov qword [rbp - 0x10], rax
call fcn.1400c4f94
xor ebx, ebx
test al, al
je 0x1400c5e2a
call fcn.1400c54f0
test al, al
je 0x1400c5e2a
call fcn.1400c35d4
test al, al
je 0x1400c5d4b
mov al, 1
jmp 0x1400c5e2c
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], bl
lea rdx, str.bEnableJSAccessClipBoard
lea rcx, [rbp - 0x30]
call fcn.140054efc
nop
cmp qword [rbp - 0x20], rbx
je 0x1400c5dee
mov qword [rbp - 0x38], rbx
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c5dee
mov dword [rbp - 0x40], ebx
mov dword [rbp - 0x3c], 4
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c5de3
cmp dword [rbp - 0x40], ebx
setne bl
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400c5e26
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c5e20
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c5e46
call fcn.14016f250
nop
mov al, bl
jmp 0x1400c5e2c
xor al, al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14016f860
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
call fcn.1401767ac
nop
Function at 0x1400c5e4c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140268998]
xor rax, rsp
mov qword [rbp - 0x10], rax
call fcn.1400c4f94
xor ebx, ebx
test al, al
je 0x1400c5f72
call fcn.1400c54f0
test al, al
je 0x1400c5f72
call fcn.1400c35d4
test al, al
je 0x1400c5e93
mov al, 1
jmp 0x1400c5f74
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], bl
lea rdx, str.bEnableJSCloseWindows
lea rcx, [rbp - 0x30]
call fcn.140054efc
nop
cmp qword [rbp - 0x20], rbx
je 0x1400c5f36
mov qword [rbp - 0x38], rbx
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c5f36
mov dword [rbp - 0x40], ebx
mov dword [rbp - 0x3c], 4
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c5f2b
cmp dword [rbp - 0x40], ebx
setne bl
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400c5f6e
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c5f68
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c5f8e
call fcn.14016f250
nop
mov al, bl
jmp 0x1400c5f74
xor al, al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14016f860
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
call fcn.1401767ac
nop
Function at 0x1400c5f94
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140268998]
xor rax, rsp
mov qword [rbp - 0x10], rax
call fcn.1400c4f94
xor ebx, ebx
test al, al
je 0x1400c60ba
call fcn.1400c54f0
test al, al
je 0x1400c60ba
call fcn.1400c35d4
test al, al
je 0x1400c5fdb
mov al, 1
jmp 0x1400c60bc
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], bl
lea rdx, str.bEnableJSDomPaste
lea rcx, [rbp - 0x30]
call fcn.140054efc
nop
cmp qword [rbp - 0x20], rbx
je 0x1400c607e
mov qword [rbp - 0x38], rbx
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c607e
mov dword [rbp - 0x40], ebx
mov dword [rbp - 0x3c], 4
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c6073
cmp dword [rbp - 0x40], ebx
setne bl
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400c60b6
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c60b0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c60d6
call fcn.14016f250
nop
mov al, bl
jmp 0x1400c60bc
xor al, al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14016f860
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
call fcn.1401767ac
nop
Function at 0x1400c60dc
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140268998]
xor rax, rsp
mov qword [rbp - 0x10], rax
call fcn.1400c4f94
test al, al
je 0x1400c6205
call fcn.1400c54f0
test al, al
je 0x1400c6205
call fcn.1400c35d4
test al, al
jne 0x1400c6205
and qword [rbp - 0x20], 0
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], al
lea rdx, str.bEnableLocalStorage
lea rcx, [rbp - 0x30]
call fcn.140054efc
nop
mov ebx, 1
cmp qword [rbp - 0x20], 0
je 0x1400c61c9
and qword [rbp - 0x38], 0
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c61c9
mov dword [rbp - 0x40], ebx
mov dword [rbp - 0x3c], 4
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c61be
cmp dword [rbp - 0x40], eax
setne bl
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400c6201
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c61fb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c6224
call fcn.14016f250
nop
mov al, bl
jmp 0x1400c620a
mov eax, 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14016f860
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
call fcn.1401767ac
nop
int3
Function at 0x1400c6240
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140268998]
xor rax, rsp
mov qword [rbp - 0x10], rax
call fcn.1400c4f94
xor ebx, ebx
test al, al
je 0x1400c6366
call fcn.1400c54f0
test al, al
je 0x1400c6366
call fcn.1400c35d4
test al, al
je 0x1400c6287
mov al, 1
jmp 0x1400c6368
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], bl
lea rdx, str.bEnableMixedContent
lea rcx, [rbp - 0x30]
call fcn.140054efc
nop
cmp qword [rbp - 0x20], rbx
je 0x1400c632a
mov qword [rbp - 0x38], rbx
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c632a
mov dword [rbp - 0x40], ebx
mov dword [rbp - 0x3c], 4
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c631f
cmp dword [rbp - 0x40], ebx
setne bl
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400c6362
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c635c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c6382
call fcn.14016f250
nop
mov al, bl
jmp 0x1400c6368
xor al, al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14016f860
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
call fcn.1401767ac
nop
Function at 0x1400c6388
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140268998]
xor rax, rsp
mov qword [rbp - 0x10], rax
call fcn.1400c4f94
xor ebx, ebx
test al, al
jne 0x1400c63c0
call fcn.1400c519c
test al, al
je 0x1400c6531
call fcn.1400c54f0
test al, al
je 0x1400c6531
call fcn.1400c35d4
test al, al
jne 0x1400c652d
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], bl
lea rdx, str.bEnableNetworkAccess
lea rcx, [rbp - 0x30]
call fcn.140054efc
nop
lea rcx, [rbp - 0x30]
call fcn.1400c53b4
test al, al
sete dil
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400c6445
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c643f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c6557
call fcn.14016f250
nop
test dil, dil
jne 0x1400c652d
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], bl
lea rdx, str.bEnableNetworkAccess
lea rcx, [rbp - 0x30]
call fcn.140054efc
nop
cmp qword [rbp - 0x20], rbx
je 0x1400c64f1
mov qword [rbp - 0x38], rbx
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c64f1
mov dword [rbp - 0x40], ebx
mov dword [rbp - 0x3c], 4
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c64e6
cmp dword [rbp - 0x40], ebx
setne bl
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400c6529
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c6523
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c6551
call fcn.14016f250
nop
mov al, bl
jmp 0x1400c6533
mov al, 1
jmp 0x1400c6533
xor al, al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14016f860
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
call fcn.1401767ac
nop
call fcn.1401767ac
int3
Function at 0x1400c6560
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140268998]
xor rax, rsp
mov qword [rbp - 0x10], rax
call fcn.1400c54f0
xor ebx, ebx
test al, al
je 0x1400c66f3
call fcn.1400c35d4
test al, al
jne 0x1400c66ef
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], bl
lea rdx, str.bEnableDebugInterface
lea rcx, [rbp - 0x30]
call fcn.140054efc
nop
lea rcx, [rbp - 0x30]
call fcn.1400c53b4
test al, al
sete dil
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400c6607
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c6601
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c6719
call fcn.14016f250
nop
test dil, dil
jne 0x1400c66ef
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], bl
lea rdx, str.bEnableDebugInterface
lea rcx, [rbp - 0x30]
call fcn.140054efc
nop
cmp qword [rbp - 0x20], rbx
je 0x1400c66b3
mov qword [rbp - 0x38], rbx
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c66b3
mov dword [rbp - 0x40], ebx
mov dword [rbp - 0x3c], 4
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c66a8
cmp dword [rbp - 0x40], ebx
setne bl
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400c66eb
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c66e5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c6713
call fcn.14016f250
nop
mov al, bl
jmp 0x1400c66f5
mov al, 1
jmp 0x1400c66f5
xor al, al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14016f860
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
call fcn.1401767ac
nop
call fcn.1401767ac
int3
Function at 0x1400c6720
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140268998]
xor rax, rsp
mov qword [rbp - 0x10], rax
call fcn.1400c5bb4
xor ebx, ebx
test al, al
je 0x1400c6853
call fcn.1400c4f94
test al, al
je 0x1400c6853
call fcn.1400c54f0
test al, al
je 0x1400c6853
call fcn.1400c35d4
test al, al
je 0x1400c6774
mov al, 1
jmp 0x1400c6855
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], bl
lea rdx, str.bEnableWebGL
lea rcx, [rbp - 0x30]
call fcn.140054efc
nop
cmp qword [rbp - 0x20], rbx
je 0x1400c6817
mov qword [rbp - 0x38], rbx
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c6817
mov dword [rbp - 0x40], ebx
mov dword [rbp - 0x3c], 4
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c680c
cmp dword [rbp - 0x40], ebx
setne bl
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400c684f
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c6849
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c686f
call fcn.14016f250
nop
mov al, bl
jmp 0x1400c6855
xor al, al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14016f860
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
call fcn.1401767ac
nop
int3
Function at 0x1400c6878
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140268998]
xor rax, rsp
mov qword [rbp - 0x10], rax
call fcn.1400c4f94
xor ebx, ebx
test al, al
je 0x1400c6a18
call fcn.1400c54f0
test al, al
je 0x1400c6a18
call fcn.1400c35d4
test al, al
jne 0x1400c6a14
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], bl
lea rdx, str.bSetProxyContextManagerTestMode
lea rcx, [rbp - 0x30]
call fcn.140054efc
nop
lea rcx, [rbp - 0x30]
call fcn.1400c53b4
test al, al
sete dil
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400c692c
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c6926
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c6a3e
call fcn.14016f250
nop
test dil, dil
jne 0x1400c6a14
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], bl
lea rdx, str.bSetProxyContextManagerTestMode
lea rcx, [rbp - 0x30]
call fcn.140054efc
nop
cmp qword [rbp - 0x20], rbx
je 0x1400c69d8
mov qword [rbp - 0x38], rbx
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c69d8
mov dword [rbp - 0x40], ebx
mov dword [rbp - 0x3c], 4
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c69cd
cmp dword [rbp - 0x40], ebx
setne bl
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400c6a10
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c6a0a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c6a38
call fcn.14016f250
nop
mov al, bl
jmp 0x1400c6a1a
mov al, 1
jmp 0x1400c6a1a
xor al, al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14016f860
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
call fcn.1401767ac
nop
call fcn.1401767ac
int3