joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c6144
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1402708c0]
xor rax, rsp
mov qword [rbp - 8], rax
xor ebx, ebx
mov edi, ebx
mov dword [rbp - 0x3c], ebx
mov ecx, dword [0x1402829b0]
mov rax, qword gs:[0x58]
mov edx, 0x14
mov rax, qword [rax + rcx*8]
mov eax, dword [rdx + rax]
cmp dword [0x1402814ec], eax
jg 0x1400c61c9
mov al, byte [0x1402814e8]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140173230
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
lea rcx, [0x1402814ec]
call fcn.140173034
jmp 0x1400c6193
lea rcx, [0x1402814ec]
call fcn.1401730a0
cmp dword [0x1402814ec], 0xffffffff
jne 0x1400c6193
call fcn.1400c7cbc
test al, al
je 0x1400c62b8
call fcn.1400c82c4
test al, al
je 0x1400c62b8
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
mov qword [rbp - 0x18], rbx
mov qword [rbp - 0x10], rbx
mov r8d, 0x1c
lea rdx, str.bEnableAllRestrictedFeatures
lea rcx, [rbp - 0x28]
call fcn.14004ea74
nop
mov edi, 1
mov dword [rbp - 0x3c], edi
mov sil, bl
cmp qword [rbp - 0x18], rbx
je 0x1400c62b8
mov qword [rbp - 0x30], rbx
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c62b8
mov dword [rbp - 0x40], ebx
mov dword [rbp - 0x38], 4
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 0xf
cmova rdx, qword [rbp - 0x28]
lea rax, [rbp - 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c62a6
cmp dword [rbp - 0x40], ebx
setne sil
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test sil, sil
je 0x1400c62b8
mov bl, dil
mov byte [0x1402814e8], bl
test dil, 1
je 0x1400c61bb
mov rdx, qword [rbp - 0x10]
cmp rdx, 0xf
jbe 0x1400c61bb
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c6304
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400c6304
call fcn.14017a8e4
int3
call fcn.140172db0
nop
jmp 0x1400c61bb
Function at 0x1400c69ec
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], rbx
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x10], 0
mov rbx, rcx
movzx edi, dl
je 0x1400c6a8c
and qword [r11 + 0x18], 0
lea rax, [r11 + 0x18]
mov r9d, 0x20019
mov qword [r11 - 0x18], rax
xor r8d, r8d
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCCEF
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c6a8c
cmp qword [rbx + 0x18], 0xf
mov dword [rsp + 0x48], edi
mov dword [rsp + 0x40], 4
jbe 0x1400c6a4d
mov rbx, qword [rbx]
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rsp + 0x48]
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c6a81
cmp dword [rsp + 0x48], eax
setne dil
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x58]
mov al, dil
add rsp, 0x30
pop rdi
ret

Function at 0x1400c6a9c
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], rbx
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x10], 0
mov rbx, rcx
movzx edi, dl
je 0x1400c6b3c
and qword [r11 + 0x18], 0
lea rax, [r11 + 0x18]
mov r9d, 0x20019
mov qword [r11 - 0x18], rax
xor r8d, r8d
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c6b3c
cmp qword [rbx + 0x18], 0xf
mov dword [rsp + 0x48], edi
mov dword [rsp + 0x40], 4
jbe 0x1400c6afd
mov rbx, qword [rbx]
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rsp + 0x48]
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c6b31
cmp dword [rsp + 0x48], eax
setne dil
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x58]
mov al, dil
add rsp, 0x30
pop rdi
ret

Function at 0x1400c70fc
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
mov rdx, qword [str.SoftwareAdobeAdobe_AcrobatDCWebResource]
lea rax, [rsp + 0x58]
xor ebx, ebx
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, 0xffffffff80000002
lea r9d, [rbx + 1]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c7180
mov rdx, qword [str.iUpsellStage]
lea rax, [rsp + 0x40]
mov rcx, qword [rsp + 0x58]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x28], rax
xor r8d, r8d
lea rax, [rsp + 0x50]
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400c7175
cmp dword [rsp + 0x48], 4
jne 0x1400c7175
cmp dword [rsp + 0x50], ebx
setne bl
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
add rsp, 0x30
pop rbx
ret
Function at 0x1400c7188
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x1402708c0]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rsi, rdx
mov edi, ecx
mov edx, dword [0x1402829b0]
mov rax, qword gs:[0x58]
mov ecx, 0x14
mov rax, qword [rax + rdx*8]
mov edx, dword [rcx + rax]
cmp dword [0x1402814e0], edx
jg 0x1400c72e0
mov rdx, qword [0x1402814d0]
mov rax, qword [rdx + 8]
mov rcx, rdx
xor ebx, ebx
jmp 0x1400c7200
cmp dword [rax + 0x1c], edi
jge 0x1400c71fa
mov rax, qword [rax + 0x10]
jmp 0x1400c7200
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], bl
je 0x1400c71ef
cmp byte [rcx + 0x19], bl
jne 0x1400c720f
cmp edi, dword [rcx + 0x1c]
jge 0x1400c7212
mov rcx, rdx
cmp rcx, rdx
jne 0x1400c721e
xor al, al
jmp 0x1400c72b7
mov ebp, dword [rcx + 0x20]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
call fcn.1400f4c98
test al, al
je 0x1400c7276
cmp edi, 1
jne 0x1400c7276
mov qword [rsp + 0x30], rbx
lea r9, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
lea rcx, [0x1401f80d0]
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
js 0x1400c72b5
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x1400c72b5
mov rcx, rsi
call fcn.1400c99fc
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x1400c72b3
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x40]
call fcn.1401e0c20
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, ebp
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x1400c72b5
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.1400c99fc
mov bl, 1
mov al, bl
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140173230
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
lea rcx, [0x1402814e0]
call fcn.1401730a0
cmp dword [0x1402814e0], 0xffffffff
jne 0x1400c71dd
lea r8, str.cep_plugins_PIPViewer_index.html
lea rdx, [0x1401ff020]
lea rcx, [0x1402814d0]
call fcn.1400c4f0c
lea rcx, [0x1401ecfd0]
call fcn.140172fe0
nop
lea rcx, [0x1402814e0]
call fcn.140173034
jmp 0x1400c71dd

Function at 0x1400c751c
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
mov rdx, qword [str.SoftwareAdobeAdobe_AcrobatDCWebResource]
lea rax, [rsp + 0x58]
or ebx, 0xffffffff
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, 0xffffffff80000002
lea r9d, [rbx + 2]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c759d
mov rdx, qword [str.irandom]
lea rax, [rsp + 0x40]
mov rcx, qword [rsp + 0x58]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x28], rax
xor r8d, r8d
lea rax, [rsp + 0x50]
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400c7592
cmp dword [rsp + 0x48], 4
cmove ebx, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x30
pop rbx
ret
Function at 0x1400c7b08
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
lea rax, [rsp + 0x50]
xor ebx, ebx
mov r9d, 0x20019
mov qword [rsp + 0x50], rbx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCCEF
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c7b8e
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rdx, str.bEnableCrashReporterForCEF
lea rax, [rsp + 0x40]
mov dword [rsp + 0x40], ebx
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x48], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c7b83
cmp dword [rsp + 0x40], ebx
setne bl
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
add rsp, 0x30
pop rbx
ret

Function at 0x1400c7b98
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1402708c0]
xor rax, rsp
mov qword [rbp - 0x10], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
and qword [rbp - 0x20], 0
and qword [rbp - 0x18], 0
mov r8d, 0x20
lea rdx, str.bDisableDropboxOauthWhitelisting
lea rcx, [rbp - 0x30]
call fcn.14004ea74
nop
mov bl, 1
cmp qword [rbp - 0x20], 0
je 0x1400c7c62
and qword [rbp - 0x38], 0
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c7c62
and dword [rbp - 0x40], eax
mov dword [rbp - 0x3c], 4
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0xf
cmova rdx, qword [rbp - 0x30]
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c7c57
cmp dword [rbp - 0x40], eax
sete bl
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x1400c7c9a
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c7c94
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c7cb6
call fcn.140172db0
nop
mov al, bl
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140173230
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
call fcn.14017a8e4
nop
Function at 0x1400c7cbc
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1402708c0]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor ebx, ebx
cmp dword [0x1402814e4], ebx
jne 0x1400c7dca
mov dword [0x1402814e4], 2
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x18], 7
mov qword [rbp - 0x20], rbx
mov word [rbp - 0x30], bx
lea rcx, [rbp - 0x30]
call fcn.1400c702c
cmp qword [rbp - 0x20], rbx
je 0x1400c7d8d
lea r8d, [rbx + 1]
lea rdx, [0x1401feda0]
lea rcx, [rbp - 0x30]
call fcn.140054e80
lea r8d, [rbx + 0x16]
lea rdx, str...plug_insTest_Tools
lea rcx, [rbp - 0x30]
call fcn.140054e80
cmp qword [rbp - 0x20], rbx
je 0x1400c7d8d
lea r8d, [rbx + 1]
lea rdx, [0x1401feda0]
lea rcx, [rbp - 0x30]
call fcn.140054e80
lea r8d, [rbx + 0xa]
lea rdx, str.aaFEAT.api
lea rcx, [rbp - 0x30]
call fcn.140054e80
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 7
cmova rcx, qword [rbp - 0x30]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400c7d8d
mov dword [0x1402814e4], 1
mov rdx, qword [rbp - 0x18]
cmp rdx, 7
jbe 0x1400c7dca
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c7dc4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c7deb
call fcn.140172db0
nop
cmp dword [0x1402814e4], 1
sete al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140173230
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
call fcn.14017a8e4
nop
int3

Function at 0x1400c7df4
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
lea rax, [rsp + 0x50]
xor ebx, ebx
mov r9d, 0x20019
mov qword [rsp + 0x50], rbx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCProcessTerminationFix
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c7e7a
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rdx, str.bDisableProcessTerminationFix
lea rax, [rsp + 0x40]
mov dword [rsp + 0x40], ebx
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x48], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c7e6f
cmp dword [rsp + 0x40], ebx
setne bl
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
add rsp, 0x30
pop rbx
ret
Function at 0x1400c819c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1402708c0]
xor rax, rsp
mov qword [rbp - 8], rax
mov rdi, rcx
xor ebx, ebx
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
mov qword [rbp - 0x18], rbx
mov qword [rbp - 0x10], rbx
lea r8d, [rbx + 0x3a]
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
lea rcx, [rbp - 0x28]
call fcn.14004eb54
nop
cmp qword [rbp - 0x18], rbx
je 0x1400c825f
cmp qword [rdi + 0x10], rbx
je 0x1400c825f
mov qword [rbp - 0x30], rbx
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 7
cmova rdx, qword [rbp - 0x28]
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c825f
cmp qword [rdi + 0x18], 0xf
jbe 0x1400c8230
mov rdi, qword [rdi]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, eax
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, 2
setne bl
mov rdx, qword [rbp - 0x10]
cmp rdx, 7
jbe 0x1400c829c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c8296
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c82bc
call fcn.140172db0
nop
mov al, bl
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140173230
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.14017a8e4
nop
int3

Function at 0x1400c82c4
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
lea rax, [rsp + 0x50]
xor ebx, ebx
mov r9d, 0x20019
mov qword [rsp + 0x50], rbx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c834a
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rdx, str.CEFSecurityMK
lea rax, [rsp + 0x40]
mov dword [rsp + 0x40], ebx
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x48], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c833f
cmp dword [rsp + 0x40], ebx
setne bl
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
add rsp, 0x30
pop rbx
ret
Function at 0x1400c8354
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1402708c0]
xor rax, rsp
mov qword [rbp - 0x10], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
and qword [rbp - 0x20], 0
and qword [rbp - 0x18], 0
mov r8d, 0x1f
lea rdx, str.bDisableSignInOauthWhitelisting
lea rcx, [rbp - 0x30]
call fcn.14004ea74
nop
mov bl, 1
cmp qword [rbp - 0x20], 0
je 0x1400c841e
and qword [rbp - 0x38], 0
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c841e
and dword [rbp - 0x40], eax
mov dword [rbp - 0x3c], 4
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0xf
cmova rdx, qword [rbp - 0x30]
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c8413
cmp dword [rbp - 0x40], eax
sete bl
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x1400c8456
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c8450
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c8472
call fcn.140172db0
nop
mov al, bl
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140173230
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
call fcn.14017a8e4
nop
Function at 0x1400c8478
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1402708c0]
xor rax, rsp
mov qword [rbp - 0x10], rax
call fcn.1400c7cbc
xor ebx, ebx
test al, al
je 0x1400c8592
call fcn.1400c82c4
test al, al
je 0x1400c8592
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], rbx
lea r8d, [rbx + 0x17]
lea rdx, str.bEnableUnsafeHTTPScheme
lea rcx, [rbp - 0x30]
call fcn.14004ea74
nop
cmp qword [rbp - 0x20], rbx
je 0x1400c8556
mov qword [rbp - 0x38], rbx
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c8556
mov dword [rbp - 0x40], ebx
mov dword [rbp - 0x3c], 4
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0xf
cmova rdx, qword [rbp - 0x30]
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c854b
cmp dword [rbp - 0x40], ebx
setne bl
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x1400c858e
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c8588
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c85ae
call fcn.140172db0
nop
mov al, bl
jmp 0x1400c8594
xor al, al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140173230
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
call fcn.14017a8e4
nop

Function at 0x1400c85b4
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rax, qword [0x1402708c0]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rdi, rcx
mov qword [rsp + 0x20], rcx
mov r8d, 0xb
lea rdx, [0x1401feea8]
call fcn.140054e80
mov rcx, rdi
cmp qword [rdi + 0x18], 7
jbe 0x1400c85f4
mov rcx, qword [rdi]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
setne bl
mov rcx, rdi
call fcn.140054cd8
mov al, bl
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140173230
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1400c8700
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
call fcn.1400c7b08
and qword [rsp + 0x50], 0
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCCEF
mov bl, al
mov r9d, 0x20019
lea rax, [rsp + 0x50]
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c878c
and dword [rsp + 0x40], eax
lea rdx, str.bEnableCrashReporterForCEF
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rsp + 0x40]
mov dword [rsp + 0x48], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c8781
cmp dword [rsp + 0x40], eax
setne bl
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
add rsp, 0x30
pop rbx
ret

Function at 0x1400c8794
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1402708c0]
xor rax, rsp
mov qword [rbp - 0x10], rax
call fcn.1400c7cbc
xor ebx, ebx
test al, al
je 0x1400c88c0
call fcn.1400c82c4
test al, al
je 0x1400c88c0
call fcn.1400c6144
test al, al
je 0x1400c87db
mov al, 1
jmp 0x1400c88c2
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], rbx
mov r8d, 0x10
lea rdx, str.bEnableDatabases
lea rcx, [rbp - 0x30]
call fcn.14004ea74
nop
cmp qword [rbp - 0x20], rbx
je 0x1400c8884
mov qword [rbp - 0x38], rbx
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c8884
mov dword [rbp - 0x40], ebx
mov dword [rbp - 0x3c], 4
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0xf
cmova rdx, qword [rbp - 0x30]
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c8879
cmp dword [rbp - 0x40], ebx
setne bl
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x1400c88bc
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c88b6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c88dc
call fcn.140172db0
nop
mov al, bl
jmp 0x1400c88c2
xor al, al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140173230
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
call fcn.14017a8e4
nop
int3