joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c89b8
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1402708c0]
xor rax, rsp
mov qword [rbp - 0x10], rax
call fcn.1400c7cbc
xor ebx, ebx
test al, al
je 0x1400c8ae4
call fcn.1400c82c4
test al, al
je 0x1400c8ae4
call fcn.1400c6144
test al, al
je 0x1400c89ff
mov al, 1
jmp 0x1400c8ae6
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], rbx
mov r8d, 0x18
lea rdx, str.bEnableJSAccessClipBoard
lea rcx, [rbp - 0x30]
call fcn.14004ea74
nop
cmp qword [rbp - 0x20], rbx
je 0x1400c8aa8
mov qword [rbp - 0x38], rbx
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c8aa8
mov dword [rbp - 0x40], ebx
mov dword [rbp - 0x3c], 4
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0xf
cmova rdx, qword [rbp - 0x30]
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c8a9d
cmp dword [rbp - 0x40], ebx
setne bl
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x1400c8ae0
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c8ada
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c8b00
call fcn.140172db0
nop
mov al, bl
jmp 0x1400c8ae6
xor al, al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140173230
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
call fcn.14017a8e4
nop
int3
Function at 0x1400c8b08
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1402708c0]
xor rax, rsp
mov qword [rbp - 0x10], rax
call fcn.1400c7cbc
xor ebx, ebx
test al, al
je 0x1400c8c34
call fcn.1400c82c4
test al, al
je 0x1400c8c34
call fcn.1400c6144
test al, al
je 0x1400c8b4f
mov al, 1
jmp 0x1400c8c36
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], rbx
mov r8d, 0x15
lea rdx, str.bEnableJSCloseWindows
lea rcx, [rbp - 0x30]
call fcn.14004ea74
nop
cmp qword [rbp - 0x20], rbx
je 0x1400c8bf8
mov qword [rbp - 0x38], rbx
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c8bf8
mov dword [rbp - 0x40], ebx
mov dword [rbp - 0x3c], 4
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0xf
cmova rdx, qword [rbp - 0x30]
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c8bed
cmp dword [rbp - 0x40], ebx
setne bl
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x1400c8c30
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c8c2a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c8c50
call fcn.140172db0
nop
mov al, bl
jmp 0x1400c8c36
xor al, al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140173230
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
call fcn.14017a8e4
nop
int3
Function at 0x1400c8c58
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1402708c0]
xor rax, rsp
mov qword [rbp - 0x10], rax
call fcn.1400c7cbc
xor ebx, ebx
test al, al
je 0x1400c8d84
call fcn.1400c82c4
test al, al
je 0x1400c8d84
call fcn.1400c6144
test al, al
je 0x1400c8c9f
mov al, 1
jmp 0x1400c8d86
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], rbx
mov r8d, 0x11
lea rdx, str.bEnableJSDomPaste
lea rcx, [rbp - 0x30]
call fcn.14004ea74
nop
cmp qword [rbp - 0x20], rbx
je 0x1400c8d48
mov qword [rbp - 0x38], rbx
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c8d48
mov dword [rbp - 0x40], ebx
mov dword [rbp - 0x3c], 4
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0xf
cmova rdx, qword [rbp - 0x30]
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c8d3d
cmp dword [rbp - 0x40], ebx
setne bl
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x1400c8d80
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c8d7a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c8da0
call fcn.140172db0
nop
mov al, bl
jmp 0x1400c8d86
xor al, al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140173230
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
call fcn.14017a8e4
nop
int3
Function at 0x1400c8da8
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1402708c0]
xor rax, rsp
mov qword [rbp - 0x10], rax
call fcn.1400c7cbc
test al, al
je 0x1400c8ed8
call fcn.1400c82c4
test al, al
je 0x1400c8ed8
call fcn.1400c6144
test al, al
jne 0x1400c8ed8
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
and qword [rbp - 0x20], 0
and qword [rbp - 0x18], 0
mov r8d, 0x13
lea rdx, str.bEnableLocalStorage
lea rcx, [rbp - 0x30]
call fcn.14004ea74
nop
mov ebx, 1
cmp qword [rbp - 0x20], 0
je 0x1400c8e9c
and qword [rbp - 0x38], 0
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c8e9c
mov dword [rbp - 0x40], ebx
mov dword [rbp - 0x3c], 4
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0xf
cmova rdx, qword [rbp - 0x30]
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c8e91
cmp dword [rbp - 0x40], eax
setne bl
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x1400c8ed4
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c8ece
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c8ef7
call fcn.140172db0
nop
mov al, bl
jmp 0x1400c8edd
mov eax, 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140173230
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
call fcn.14017a8e4
nop
int3
Function at 0x1400c8f14
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1402708c0]
xor rax, rsp
mov qword [rbp - 0x10], rax
call fcn.1400c7cbc
xor ebx, ebx
test al, al
je 0x1400c9040
call fcn.1400c82c4
test al, al
je 0x1400c9040
call fcn.1400c6144
test al, al
je 0x1400c8f5b
mov al, 1
jmp 0x1400c9042
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], rbx
mov r8d, 0x13
lea rdx, str.bEnableMixedContent
lea rcx, [rbp - 0x30]
call fcn.14004ea74
nop
cmp qword [rbp - 0x20], rbx
je 0x1400c9004
mov qword [rbp - 0x38], rbx
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c9004
mov dword [rbp - 0x40], ebx
mov dword [rbp - 0x3c], 4
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0xf
cmova rdx, qword [rbp - 0x30]
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c8ff9
cmp dword [rbp - 0x40], ebx
setne bl
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x1400c903c
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c9036
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c905c
call fcn.140172db0
nop
mov al, bl
jmp 0x1400c9042
xor al, al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140173230
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
call fcn.14017a8e4
nop
int3
Function at 0x1400c9064
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1402708c0]
xor rax, rsp
mov qword [rbp - 0x10], rax
call fcn.1400c7cbc
xor ebx, ebx
test al, al
jne 0x1400c909c
call fcn.1400c7e84
test al, al
je 0x1400c9216
call fcn.1400c82c4
test al, al
je 0x1400c9216
call fcn.1400c6144
test al, al
jne 0x1400c9212
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x20], xmm1
mov r8d, 0x14
lea rdx, str.bEnableNetworkAccess
lea rcx, [rbp - 0x30]
call fcn.14004ea74
nop
lea rcx, [rbp - 0x30]
call fcn.1400c819c
mov dil, al
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x1400c9124
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c911e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c923c
call fcn.140172db0
nop
test dil, dil
je 0x1400c9212
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], rbx
mov r8d, 0x14
lea rdx, str.bEnableNetworkAccess
lea rcx, [rbp - 0x30]
call fcn.14004ea74
nop
cmp qword [rbp - 0x20], rbx
je 0x1400c91d6
mov qword [rbp - 0x38], rbx
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c91d6
mov dword [rbp - 0x40], ebx
mov dword [rbp - 0x3c], 4
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0xf
cmova rdx, qword [rbp - 0x30]
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c91cb
cmp dword [rbp - 0x40], ebx
setne bl
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x1400c920e
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c9208
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c9236
call fcn.140172db0
nop
mov al, bl
jmp 0x1400c9218
mov al, 1
jmp 0x1400c9218
xor al, al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140173230
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
call fcn.14017a8e4
nop
call fcn.14017a8e4
int3
Function at 0x1400c9244
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1402708c0]
xor rax, rsp
mov qword [rbp - 0x10], rax
call fcn.1400c82c4
xor ebx, ebx
test al, al
je 0x1400c93de
call fcn.1400c6144
test al, al
jne 0x1400c93da
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x20], xmm1
lea r8d, [rbx + 0x15]
lea rdx, str.bEnableDebugInterface
lea rcx, [rbp - 0x30]
call fcn.14004ea74
nop
lea rcx, [rbp - 0x30]
call fcn.1400c819c
mov dil, al
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x1400c92ec
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c92e6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c9404
call fcn.140172db0
nop
test dil, dil
je 0x1400c93da
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], rbx
mov r8d, 0x15
lea rdx, str.bEnableDebugInterface
lea rcx, [rbp - 0x30]
call fcn.14004ea74
nop
cmp qword [rbp - 0x20], rbx
je 0x1400c939e
mov qword [rbp - 0x38], rbx
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c939e
mov dword [rbp - 0x40], ebx
mov dword [rbp - 0x3c], 4
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0xf
cmova rdx, qword [rbp - 0x30]
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c9393
cmp dword [rbp - 0x40], ebx
setne bl
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x1400c93d6
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c93d0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c93fe
call fcn.140172db0
nop
mov al, bl
jmp 0x1400c93e0
mov al, 1
jmp 0x1400c93e0
xor al, al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140173230
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
call fcn.14017a8e4
nop
call fcn.14017a8e4
int3
Function at 0x1400c94f4
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1402708c0]
xor rax, rsp
mov qword [rbp - 0x10], rax
call fcn.1400c7cbc
xor ebx, ebx
test al, al
je 0x1400c969b
call fcn.1400c82c4
test al, al
je 0x1400c969b
call fcn.1400c6144
test al, al
jne 0x1400c9697
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x20], xmm1
lea r8d, [rbx + 0x1f]
lea rdx, str.bSetProxyContextManagerTestMode
lea rcx, [rbp - 0x30]
call fcn.14004ea74
nop
lea rcx, [rbp - 0x30]
call fcn.1400c819c
mov dil, al
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x1400c95a9
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c95a3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c96c1
call fcn.140172db0
nop
test dil, dil
je 0x1400c9697
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], rbx
mov r8d, 0x1f
lea rdx, str.bSetProxyContextManagerTestMode
lea rcx, [rbp - 0x30]
call fcn.14004ea74
nop
cmp qword [rbp - 0x20], rbx
je 0x1400c965b
mov qword [rbp - 0x38], rbx
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCRestrictedSecuritySettings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c965b
mov dword [rbp - 0x40], ebx
mov dword [rbp - 0x3c], 4
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0xf
cmova rdx, qword [rbp - 0x30]
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400c9650
cmp dword [rbp - 0x40], ebx
setne bl
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x1400c9693
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c968d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c96bb
call fcn.140172db0
nop
mov al, bl
jmp 0x1400c969d
mov al, 1
jmp 0x1400c969d
xor al, al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140173230
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
call fcn.14017a8e4
nop
call fcn.14017a8e4
int3
Function at 0x1400cdabc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
movzx edx, dx
xor ecx, ecx
mov rsi, r9
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
je 0x1400cdb19
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
je 0x1400cdb19
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, qword [rsp + 0x50]
mov edx, eax
mov qword [rcx], rdx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsi], rax
mov al, 1
jmp 0x1400cdb1b
xor al, al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1400cdc50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub rsp, 0x38
mov r10, r9
cmp r8d, 1
jne 0x1400cdc71
lea r8, str.CSR1
add rcx, 0xfffffffffffffff0
add rsp, 0x38
jmp fcn.1400cdabc
cmp r8d, 7
jne 0x1400cdc80
lea r8, str.CSR2
jmp 0x1400cdc64
mov rax, qword [rcx]
mov r8, r10
mov r9, qword [rsp + 0x60]
mov rax, qword [rax + 8]
call qword [case.0x1401ad3ca.0]
add rsp, 0x38
ret
Function at 0x1400e4cc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
xor r10d, r10d
movzx r14d, cx
mov edi, r14d
mov r15, r9
shr edi, 8
mov rbp, r8
mov r12, rdx
mov esi, r14d
mov ebx, r10d
mov r11d, r10d
test r8, r8
je 0x1400e4d47
movzx eax, word [r12 + r11*2]
mov edx, eax
movzx ecx, al
shr edx, 8
add edx, ebx
cmp edi, ecx
jb 0x1400e4d47
jne 0x1400e4d3d
movsxd rcx, ebx
movsxd r9, edx
cmp rcx, r9
jge 0x1400e4d3d
mov eax, 0xff
movzx r8d, r14w
and r8w, ax
movzx eax, byte [rcx + r15]
cmp ax, r8w
je 0x1400e4d70
inc rcx
cmp rcx, r9
jl 0x1400e4d2a
inc r11
mov ebx, edx
cmp r11, rbp
jb 0x1400e4cfd
mov cl, 1
cmp qword [rsp + 0x48], r10
jbe 0x1400e4d87
mov r8, qword [rsp + 0x40]
movzx eax, byte [r10 + r8]
test al, al
jns 0x1400e4d74
inc r10
and eax, 0x7f
shl eax, 8
movzx edx, byte [r10 + r8]
or edx, eax
jmp 0x1400e4d76
xor al, al
jmp 0x1400e4d89
mov edx, eax
sub esi, edx
js 0x1400e4d87
xor cl, 1
inc r10
cmp r10, qword [rsp + 0x48]
jb 0x1400e4d55
mov al, cl
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret
Function at 0x1400f3220
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1402708c0]
xor rax, rsp
mov qword [rbp - 0x10], rax
cmp byte [0x140281735], 0
jne 0x1400f32ed
cmp byte [0x140281736], 0
mov byte [0x140281735], 1
je 0x1400f32ed
movups xmm0, xmmword [0x140204ce0]
lea rax, [rbp - 0x48]
mov r9d, 1
movups xmm1, xmmword [0x140204cf0]
xor r8d, r8d
lea rdx, [rbp - 0x40]
movups xmmword [rbp - 0x40], xmm0
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
movups xmm0, xmmword [0x140204d00]
movups xmmword [rbp - 0x30], xmm1
movups xmmword [rbp - 0x20], xmm0
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x1400f32ed
and dword [rbp - 0x50], 0
lea rax, [rbp - 0x4c]
mov qword [rsp + 0x28], rax
lea rdx, str.bLaunchTiming
lea rax, [rbp - 0x50]
mov dword [rbp - 0x4c], 4
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [rbp - 0x50], 0
mov rcx, qword [rbp - 0x48]
setne byte [0x140281734]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [0x140281734]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140173230
add rsp, 0x80
pop rbp
ret
Function at 0x1400f4d08
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
cmp byte [0x140281897], 0
je 0x1400f4d22
test cl, cl
je 0x1400f4e8b
lea rax, [rbp - 0x10]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCInstaller_
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400f4e84
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x1400f4e84
and dword [rbp + 0x20], eax
and dword [rbp + 0x18], eax
cmp byte [0x140281897], al
mov dword [rbp + 0x28], 4
jne 0x1400f4dac
lea rax, [rbp + 0x28]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x20]
lea rax, [rbp + 0x18]
lea rdx, str.bIsSingleClientApp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400f4dac
cmp dword [rbp + 0x20], 4
jne 0x1400f4dac
cmp dword [rbp + 0x18], eax
setne byte [0x140281895]
cmp byte [0x140281895], 0
je 0x1400f4e7a
mov rcx, qword [rbp - 0x10]
lea rax, [rbp + 0x28]
and dword [rbp + 0x18], 0
lea r9, [rbp + 0x20]
mov qword [rsp + 0x28], rax
lea rdx, str.bIsSCAcroAppInstalled
lea rax, [rbp + 0x18]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400f4dfb
cmp dword [rbp + 0x20], 4
jne 0x1400f4dfb
cmp dword [rbp + 0x18], eax
setne byte [0x140281894]
mov rcx, qword [rbp - 0x10]
lea rax, [rbp + 0x28]
and dword [rbp + 0x18], 0
lea r9, [rbp + 0x20]
mov qword [rsp + 0x28], rax
lea rdx, str.SCAPackageLevel
lea rax, [rbp + 0x18]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400f4e3c
cmp dword [rbp + 0x20], 4
jne 0x1400f4e3c
mov eax, dword [rbp + 0x18]
mov dword [0x140270488], eax
mov rcx, qword [rbp - 0x10]
lea rax, [rbp + 0x28]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x20]
lea rax, [rbp + 0x18]
xor r8d, r8d
lea rdx, str.IsAcrInstalledInRdrMode
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400f4e7a
cmp dword [rbp + 0x20], 4
jne 0x1400f4e7a
cmp dword [rbp + 0x18], eax
setne byte [0x140281896]
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [0x140281897], 1
add rsp, 0x40
pop rbp
ret