joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c3054
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140233818]
xor rax, rsp
mov qword [rbp - 8], rax
xor ebx, ebx
mov edi, ebx
mov dword [rbp - 0x3c], ebx
mov ecx, dword [0x140242758]
mov rax, qword gs:[0x58]
mov edx, 4
mov rcx, qword [rax + rcx*8]
mov eax, dword [rdx + rcx]
cmp dword [0x140241994], eax
jg 0x1400c30d9
mov al, byte [0x140241990]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140149000
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
lea rcx, [0x140241994]
call fcn.140148d78
jmp 0x1400c30a3
lea rcx, [0x140241994]
call fcn.140148dd8
cmp dword [0x140241994], 0xffffffff
jne 0x1400c30a3
call fcn.1400c40cc
test al, al
je 0x1400c31c2
call fcn.1400c4628
test al, al
je 0x1400c31c2
mov qword [rbp - 0x18], rbx
mov qword [rbp - 0x10], 0xf
mov byte [rbp - 0x28], bl
lea rdx, str.bEnableAllRestrictedFeatures
lea rcx, [rbp - 0x28]
call fcn.140054bec
nop
mov edi, 1
mov dword [rbp - 0x3c], edi
mov sil, bl
cmp qword [rbp - 0x18], rbx
je 0x1400c31c2
mov qword [rbp - 0x30], rbx
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c31c2
mov dword [rbp - 0x40], ebx
mov dword [rbp - 0x38], 4
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 0x10
cmovae rdx, qword [rbp - 0x28]
lea rax, [rbp - 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c31b0
cmp dword [rbp - 0x40], ebx
setne sil
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test sil, sil
je 0x1400c31c2
mov bl, dil
mov byte [0x140241990], bl
test dil, 1
je 0x1400c30cb
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x1400c30cb
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c320e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400c320e
call fcn.14014fc7c
int3
call fcn.1401489f0
nop
jmp 0x1400c30cb
Function at 0x1400c3454
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], rbx
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x10], 0
mov rbx, rcx
movzx edi, dl
je 0x1400c34f4
and qword [r11 + 0x18], 0
lea rax, [r11 + 0x18]
mov r9d, 0x20019
mov qword [r11 - 0x18], rax
xor r8d, r8d
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c34f4
cmp qword [rbx + 0x18], 0x10
mov dword [rsp + 0x48], edi
mov dword [rsp + 0x40], 4
jb 0x1400c34b5
mov rbx, qword [rbx]
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rsp + 0x48]
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c34e9
cmp dword [rsp + 0x48], eax
setne dil
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x58]
mov al, dil
add rsp, 0x30
pop rdi
ret

Function at 0x1400c39e4
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
mov rdx, qword [str.SoftwareAdobeAdobe_AcrobatDCWebResource]
lea rax, [rsp + 0x58]
xor ebx, ebx
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, 0xffffffff80000002
lea r9d, [rbx + 1]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c3a68
mov rdx, qword [str.iUpsellStage]
lea rax, [rsp + 0x40]
mov rcx, qword [rsp + 0x58]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x28], rax
xor r8d, r8d
lea rax, [rsp + 0x50]
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400c3a5d
cmp dword [rsp + 0x48], 4
jne 0x1400c3a5d
cmp dword [rsp + 0x50], ebx
setne bl
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
add rsp, 0x30
pop rbx
ret
Function at 0x1400c3a70
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x140233818]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rbp, rdx
mov edi, ecx
mov edx, dword [0x140242758]
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + rdx*8]
mov edx, dword [rcx + rax]
cmp dword [0x140241988], edx
jg 0x1400c3be5
mov rdx, qword [0x140241978]
mov rax, qword [rdx + 8]
mov rcx, rdx
xor ebx, ebx
jmp 0x1400c3ae8
cmp dword [rax + 0x1c], edi
jge 0x1400c3ae2
mov rax, qword [rax + 0x10]
jmp 0x1400c3ae8
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], bl
je 0x1400c3ad7
cmp byte [rcx + 0x19], bl
jne 0x1400c3af7
cmp edi, dword [rcx + 0x1c]
jge 0x1400c3afa
mov rcx, rdx
cmp rcx, rdx
jne 0x1400c3b06
xor al, al
jmp 0x1400c3bbc
mov esi, dword [rcx + 0x20]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
call fcn.1400e2b78
test al, al
je 0x1400c3b6d
cmp edi, 1
jne 0x1400c3b6d
mov qword [rsp + 0x30], rbx
lea r9, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
lea rcx, [0x1401c9d20]
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
js 0x1400c3bba
mov rdi, qword [rsp + 0x30]
test rdi, rdi
je 0x1400c3bba
mov rcx, rdi
call fcn.14014ff50
nop
mov r8, rax
mov rdx, rdi
mov rcx, rbp
call fcn.140054c6c
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x1400c3bb8
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x40]
call fcn.14014a5b0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, esi
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x1400c3bba
lea rcx, [rsp + 0x40]
call fcn.14014ff50
nop
mov r8, rax
lea rdx, [rsp + 0x40]
mov rcx, rbp
call fcn.140054c6c
mov bl, 1
mov al, bl
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140149000
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
lea rcx, [0x140241988]
call fcn.140148dd8
cmp dword [0x140241988], 0xffffffff
jne 0x1400c3ac5
lea r8, str.cep_plugins_PIPViewer_index.html
lea rdx, [0x1401d0aa8]
lea rcx, [0x140241978]
call fcn.1400c216c
lea rcx, [0x1401bf7d0]
call fcn.140148c30
nop
lea rcx, [0x140241988]
call fcn.140148d78
jmp 0x1400c3ac5

Function at 0x1400c3c38
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
mov rdx, qword [str.SoftwareAdobeAdobe_AcrobatDCWebResource]
lea rax, [rsp + 0x58]
or ebx, 0xffffffff
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, 0xffffffff80000002
lea r9d, [rbx + 2]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c3cb9
mov rdx, qword [str.irandom]
lea rax, [rsp + 0x40]
mov rcx, qword [rsp + 0x58]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x28], rax
xor r8d, r8d
lea rax, [rsp + 0x50]
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400c3cae
cmp dword [rsp + 0x48], 4
cmove ebx, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x30
pop rbx
ret
Function at 0x1400c3cc4
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x140233818]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov rdi, rcx
xor ebx, ebx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], bx
lea rcx, [rsp + 0x40]
call fcn.1400c3910
mov sil, bl
cmp qword [rsp + 0x50], rbx
je 0x1400c3e9c
lea rcx, [0x1401d08e0]
call fcn.14014ff50
nop
mov r8, rax
lea rdx, [0x1401d08e0]
lea rcx, [rsp + 0x40]
call fcn.140054b70
nop
lea r15, [0x1401d0890]
mov rcx, r15
call fcn.14014ff50
nop
mov r8, rax
mov rdx, r15
lea rcx, [rsp + 0x40]
call fcn.140054b70
nop
lea rcx, str.WebResources
call fcn.14014ff50
nop
mov r8, rax
lea rdx, str.WebResources
lea rcx, [rsp + 0x40]
call fcn.140054b70
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9d, [rbx + 1]
xor r8d, r8d
mov rdx, qword [str.SoftwareAdobeAdobe_AcrobatDCWebResource]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c3e50
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x60]
call fcn.14014a5b0
mov dword [rsp + 0x30], 0x208
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rdx, qword [str.tWebResourceInstallPath]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400c3e40
cmp dword [rsp + 0x34], 1
jne 0x1400c3e40
mov sil, 1
mov rcx, r15
call fcn.14014ff50
nop
mov r8, rax
mov rdx, r15
lea rcx, [rsp + 0x40]
call fcn.140054b70
nop
lea rcx, [rsp + 0x60]
call fcn.14014ff50
nop
mov r8, rax
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.140054b70
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test sil, sil
jne 0x1400c3e8b
mov rcx, r15
call fcn.14014ff50
nop
mov r8, rax
mov rdx, r15
lea rcx, [rsp + 0x40]
call fcn.140054b70
nop
lea rcx, str.Resource0
call fcn.14014ff50
nop
mov r8, rax
lea rdx, str.Resource0
lea rcx, [rsp + 0x40]
call fcn.140054b70
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.1400c32a0
mov bl, al
jmp 0x1400c3eac
mov qword [rdi + 0x10], rbx
cmp qword [rdi + 0x18], 0x10
jb 0x1400c3eaa
mov rdi, qword [rdi]
mov byte [rdi], bl
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x1400c3eeb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c3ee5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c3f14
call fcn.1401489f0
nop
mov al, bl
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.140149000
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop rdi
pop rbp
ret
call fcn.14014fc7c
nop
int3
Function at 0x1400c3f1c
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
lea rax, [rsp + 0x50]
xor ebx, ebx
mov r9d, 0x20019
mov qword [rsp + 0x50], rbx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCCEF
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c3fa2
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rdx, str.bEnableCrashReporterForCEF
lea rax, [rsp + 0x40]
mov dword [rsp + 0x40], ebx
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x48], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c3f97
cmp dword [rsp + 0x40], ebx
setne bl
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
add rsp, 0x30
pop rbx
ret

Function at 0x1400c3fac
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140233818]
xor rax, rsp
mov qword [rbp - 0x10], rax
and qword [rbp - 0x20], 0
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], 0
lea rdx, str.bDisableDropboxOauthWhitelisting
lea rcx, [rbp - 0x30]
call fcn.140054bec
nop
mov bl, 1
cmp qword [rbp - 0x20], 0
je 0x1400c4070
and qword [rbp - 0x38], 0
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c4070
and dword [rbp - 0x40], eax
mov dword [rbp - 0x3c], 4
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c4065
cmp dword [rbp - 0x40], eax
sete bl
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400c40a8
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c40a2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c40c4
call fcn.1401489f0
nop
mov al, bl
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140149000
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
call fcn.14014fc7c
nop
int3
Function at 0x1400c40cc
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140233818]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov edi, 1
xor ebx, ebx
cmp dword [0x14024198c], ebx
jne 0x1400c4216
mov dword [0x14024198c], 2
mov qword [rbp - 0x18], 7
mov qword [rbp - 0x20], rbx
mov word [rbp - 0x30], bx
lea rcx, [rbp - 0x30]
call fcn.1400c3910
cmp qword [rbp - 0x20], rbx
je 0x1400c41d9
lea rcx, [0x1401d0890]
call fcn.14014ff50
nop
mov r8, rax
lea rdx, [0x1401d0890]
lea rcx, [rbp - 0x30]
call fcn.140054b70
nop
lea rcx, str...plug_insTest_Tools
call fcn.14014ff50
nop
mov r8, rax
lea rdx, str...plug_insTest_Tools
lea rcx, [rbp - 0x30]
call fcn.140054b70
cmp qword [rbp - 0x20], rbx
je 0x1400c41d9
lea rcx, [0x1401d0890]
call fcn.14014ff50
nop
mov r8, rax
lea rdx, [0x1401d0890]
lea rcx, [rbp - 0x30]
call fcn.140054b70
nop
lea rcx, str.aaFEAT.api
call fcn.14014ff50
nop
mov r8, rax
lea rdx, str.aaFEAT.api
lea rcx, [rbp - 0x30]
call fcn.140054b70
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rcx, qword [rbp - 0x30]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [0x14024198c]
test eax, eax
cmovne ecx, edi
mov dword [0x14024198c], ecx
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x1400c4216
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c4210
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c423b
call fcn.1401489f0
nop
cmp dword [0x14024198c], edi
sete al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140149000
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
call fcn.14014fc7c
nop
int3

Function at 0x1400c4244
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
lea rax, [rsp + 0x50]
xor ebx, ebx
mov r9d, 0x20019
mov qword [rsp + 0x50], rbx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCProcessTerminationFix
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c42ca
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rdx, str.bDisableProcessTerminationFix
lea rax, [rsp + 0x40]
mov dword [rsp + 0x40], ebx
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x48], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c42bf
cmp dword [rsp + 0x40], ebx
setne bl
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
add rsp, 0x30
pop rbx
ret
Function at 0x1400c44ec
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x140233818]
xor rax, rsp
mov qword [rbp - 8], rax
mov rdi, rcx
xor ebx, ebx
mov qword [rbp - 0x18], rbx
mov qword [rbp - 0x10], 7
mov word [rbp - 0x28], bx
lea rcx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
call fcn.14014ff50
nop
mov r8, rax
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
lea rcx, [rbp - 0x28]
call fcn.140054c6c
nop
cmp qword [rbp - 0x18], rbx
je 0x1400c45c3
cmp qword [rdi + 0x10], rbx
je 0x1400c45c3
mov qword [rbp - 0x30], rbx
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rdx, qword [rbp - 0x28]
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c45c3
cmp qword [rdi + 0x18], 0x10
jb 0x1400c458d
mov rdi, qword [rdi]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
movzx ebx, bl
mov edx, 1
cmp eax, 2
cmovne ebx, edx
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, 8
jb 0x1400c4600
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c45fa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c4620
call fcn.1401489f0
nop
mov al, bl
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140149000
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.14014fc7c
nop
int3

Function at 0x1400c4628
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
lea rax, [rsp + 0x50]
xor ebx, ebx
mov r9d, 0x20019
mov qword [rsp + 0x50], rbx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c46ae
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rdx, str.CEFSecurityMK
lea rax, [rsp + 0x40]
mov dword [rsp + 0x40], ebx
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x48], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c46a3
cmp dword [rsp + 0x40], ebx
setne bl
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
add rsp, 0x30
pop rbx
ret
Function at 0x1400c46b8
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140233818]
xor rax, rsp
mov qword [rbp - 0x10], rax
and qword [rbp - 0x20], 0
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], 0
lea rdx, str.bDisableSignInOauthWhitelisting
lea rcx, [rbp - 0x30]
call fcn.140054bec
nop
mov bl, 1
cmp qword [rbp - 0x20], 0
je 0x1400c477c
and qword [rbp - 0x38], 0
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c477c
and dword [rbp - 0x40], eax
mov dword [rbp - 0x3c], 4
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c4771
cmp dword [rbp - 0x40], eax
sete bl
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400c47b4
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c47ae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c47d0
call fcn.1401489f0
nop
mov al, bl
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140149000
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
call fcn.14014fc7c
nop
int3
Function at 0x1400c47d8
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140233818]
xor rax, rsp
mov qword [rbp - 0x10], rax
call fcn.1400c40cc
xor ebx, ebx
test al, al
je 0x1400c48ee
call fcn.1400c4628
test al, al
je 0x1400c48ee
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], bl
lea rdx, str.bEnableUnsafeHTTPScheme
lea rcx, [rbp - 0x30]
call fcn.140054bec
nop
cmp qword [rbp - 0x20], rbx
je 0x1400c48b2
mov qword [rbp - 0x38], rbx
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c48b2
mov dword [rbp - 0x40], ebx
mov dword [rbp - 0x3c], 4
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c48a7
cmp dword [rbp - 0x40], ebx
setne bl
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400c48ea
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c48e4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c490a
call fcn.1401489f0
nop
mov al, bl
jmp 0x1400c48f0
xor al, al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140149000
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
call fcn.14014fc7c
nop

Function at 0x1400c4910
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
call fcn.1400c3f1c
and qword [rsp + 0x50], 0
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCCEF
mov bl, al
mov r9d, 0x20019
lea rax, [rsp + 0x50]
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c499c
and dword [rsp + 0x40], eax
lea rdx, str.bEnableCrashReporterForCEF
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rsp + 0x40]
mov dword [rsp + 0x48], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c4991
cmp dword [rsp + 0x40], eax
setne bl
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
add rsp, 0x30
pop rbx
ret
Function at 0x1400c49a4
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140233818]
xor rax, rsp
mov qword [rbp - 0x10], rax
call fcn.1400c40cc
xor ebx, ebx
test al, al
je 0x1400c4aca
call fcn.1400c4628
test al, al
je 0x1400c4aca
call fcn.1400c3054
test al, al
je 0x1400c49eb
mov al, 1
jmp 0x1400c4acc
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], bl
lea rdx, str.bEnableDatabases
lea rcx, [rbp - 0x30]
call fcn.140054bec
nop
cmp qword [rbp - 0x20], rbx
je 0x1400c4a8e
mov qword [rbp - 0x38], rbx
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c4a8e
mov dword [rbp - 0x40], ebx
mov dword [rbp - 0x3c], 4
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c4a83
cmp dword [rbp - 0x40], ebx
setne bl
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400c4ac6
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c4ac0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c4ae6
call fcn.1401489f0
nop
mov al, bl
jmp 0x1400c4acc
xor al, al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140149000
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
call fcn.14014fc7c
nop