joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a4ea9
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x24
mov eax, 0x54cc6d
call fcn.004f2a0c
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x28]
xor eax, eax
mov dword [ebp - 0x14], 7
xor ebx, ebx
mov word [ebp - 0x28], ax
push str.SOFTWAREAdobeAcrobat_ReaderDCRestrictedSecuritySettings
mov dword [ebp - 0x18], ebx
call fcn.0044d71b
xor edi, edi
mov dword [ebp - 4], ebx
inc edi
cmp dword [ebp - 0x18], ebx
je 0x4a4f37
cmp dword [esi + 0x10], ebx
je 0x4a4f37
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x2c]
push ecx
push 0x20019
lea eax, [ebp - 0x28]
mov dword [ebp - 0x2c], ebx
cmovae eax, dword [ebp - 0x28]
push ebx
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a4f37
cmp dword [esi + 0x14], 0x10
jb 0x4a4f17
mov esi, dword [esi]
push ebx
push ebx
push ebx
push ebx
push esi
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x2c]
cmp eax, 2
movzx ebx, bl
cmovne ebx, edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x4a4f7b
mov ecx, dword [ebp - 0x28]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 4], edi
cmp eax, 0x1000
jb 0x4a4f72
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.004dfcf2
mov eax, dword [ebp - 0x2c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x30]
push eax
push ecx
call fcn.004dfcf2
pop ecx
pop ecx
mov al, bl
call fcn.004f29b6
ret

Function at 0x4a4fea
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x28
mov eax, 0x54cc39
call fcn.004f2a0c
xor ebx, ebx
mov dword [ebp - 0x14], 0xf
push str.bDisableSignInOauthWhitelisting
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
call fcn.0044d64d
cmp dword [ebp - 0x18], 0
mov dword [ebp - 4], ebx
mov bl, 1
je 0x4a507c
lea eax, [ebp - 0x2c]
xor esi, esi
push eax
push 0x20019
push esi
push str.SOFTWAREAdobeAcrobat_ReaderDCRestrictedSecuritySettings
push 0x80000001
mov dword [ebp - 0x2c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a507c
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], esi
push ecx
push esi
lea eax, [ebp - 0x28]
mov dword [ebp - 0x34], 4
cmovae eax, dword [ebp - 0x28]
push esi
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a5073
cmp dword [ebp - 0x30], esi
sete bl
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4a50be
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], 1
cmp eax, 0x1000
jb 0x4a50b5
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.004dfcf2
mov eax, dword [ebp - 0x30]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
push eax
push ecx
call fcn.004dfcf2
pop ecx
pop ecx
mov al, bl
call fcn.004f29b6
ret
Function at 0x4a50c6
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x28
mov eax, 0x54cc39
call fcn.004f2a0c
call fcn.004a4bae
test al, al
je 0x4a51b3
call fcn.004dfcf2
test al, al
je 0x4a51b3
xor ebx, ebx
mov dword [ebp - 0x14], 0xf
push str.bEnableUnsafeHTTPScheme
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
call fcn.0044d64d
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x4a516d
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], ebx
push eax
push 0x20019
push ebx
push str.SOFTWAREAdobeAcrobat_ReaderDCRestrictedSecuritySettings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a516d
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], ebx
push ecx
push ebx
lea eax, [ebp - 0x28]
mov dword [ebp - 0x34], 4
cmovae eax, dword [ebp - 0x28]
push ebx
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a5164
cmp dword [ebp - 0x30], eax
setne bl
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4a51af
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], 1
cmp eax, 0x1000
jb 0x4a51a6
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.004dfcf2
mov eax, dword [ebp - 0x30]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
push eax
push ecx
call fcn.004dfcf2
pop ecx
pop ecx
mov al, bl
jmp 0x4a51b5
xor al, al
call fcn.004f29b6
ret
Function at 0x4a51bb
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x44
mov eax, 0x54cd01
call fcn.004f2a0c
and dword [ebp - 0x44], 0
call fcn.004dfcf2
test al, al
je 0x4a5339
call fcn.004a40c3
xor ebx, ebx
mov edi, str.bDisablePackLoading
push 0xf
inc ebx
pop esi
test al, al
je 0x4a5218
and dword [ebp - 0x30], 0
lea ecx, [ebp - 0x40]
push edi
mov dword [ebp - 0x2c], esi
mov byte [ebp - 0x40], 0
call fcn.0044d64d
and dword [ebp - 4], 0
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x44], ebx
call fcn.004a4ea9
mov byte [ebp - 0x45], bl
pop ecx
test al, al
je 0x4a521c
mov byte [ebp - 0x45], 0
or dword [ebp - 4], 0xffffffff
test byte [ebp - 0x44], 1
je 0x4a5264
mov eax, dword [ebp - 0x2c]
cmp eax, 0x10
jb 0x4a5264
mov ecx, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 4], ebx
cmp eax, 0x1000
jb 0x4a5257
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x4c]
push eax
call fcn.004dfcf2
mov eax, dword [ebp - 0x44]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x4c]
push eax
push ecx
call fcn.004dfcf2
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
cmp byte [ebp - 0x45], 0
je 0x4a5271
xor al, al
jmp 0x4a533b
and dword [ebp - 0x18], 0
lea ecx, [ebp - 0x28]
push edi
mov dword [ebp - 0x14], esi
mov byte [ebp - 0x28], 0
call fcn.0044d64d
cmp dword [ebp - 0x18], 0
mov dword [ebp - 4], 2
je 0x4a52f3
and dword [ebp - 0x44], 0
lea eax, [ebp - 0x44]
push eax
push 0x20019
push 0
push str.SOFTWAREAdobeAcrobat_ReaderDCRestrictedSecuritySettings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a52f3
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x50]
push ecx
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x4c], ebx
push ecx
push 0
lea eax, [ebp - 0x28]
mov dword [ebp - 0x50], 4
cmovae eax, dword [ebp - 0x28]
push 0
push eax
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a52ea
cmp dword [ebp - 0x4c], eax
setne bl
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4a5335
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 4], 3
cmp eax, 0x1000
jb 0x4a532c
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.004dfcf2
mov eax, dword [ebp - 0x4c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x44]
push eax
push ecx
call fcn.004dfcf2
pop ecx
pop ecx
mov al, bl
jmp 0x4a533b
mov al, 1
call fcn.004f29b6
ret
Function at 0x4a5341
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x28
mov eax, 0x54cc39
call fcn.004f2a0c
call fcn.004a4bae
test al, al
je 0x4a543e
call fcn.004dfcf2
test al, al
je 0x4a543e
call fcn.004a40c3
test al, al
je 0x4a5377
mov al, 1
jmp 0x4a5440
xor ebx, ebx
mov dword [ebp - 0x14], 0xf
push str.bDisableWebSecurity
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
call fcn.0044d64d
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x4a53f8
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], ebx
push eax
push 0x20019
push ebx
push str.SOFTWAREAdobeAcrobat_ReaderDCRestrictedSecuritySettings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a53f8
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], ebx
push ecx
push ebx
lea eax, [ebp - 0x28]
mov dword [ebp - 0x34], 4
cmovae eax, dword [ebp - 0x28]
push ebx
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a53ef
cmp dword [ebp - 0x30], eax
setne bl
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4a543a
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], 1
cmp eax, 0x1000
jb 0x4a5431
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.004dfcf2
mov eax, dword [ebp - 0x30]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
push eax
push ecx
call fcn.004dfcf2
pop ecx
pop ecx
mov al, bl
jmp 0x4a5440
xor al, al
call fcn.004f29b6
ret
Function at 0x4a5446
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x28
mov eax, 0x54cc39
call fcn.004f2a0c
call fcn.004a4bae
test al, al
je 0x4a5543
call fcn.004dfcf2
test al, al
je 0x4a5543
call fcn.004a40c3
test al, al
je 0x4a547c
mov al, 1
jmp 0x4a5545
xor ebx, ebx
mov dword [ebp - 0x14], 0xf
push str.bEnableBrowserPlugins
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
call fcn.0044d64d
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x4a54fd
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], ebx
push eax
push 0x20019
push ebx
push str.SOFTWAREAdobeAcrobat_ReaderDCRestrictedSecuritySettings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a54fd
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], ebx
push ecx
push ebx
lea eax, [ebp - 0x28]
mov dword [ebp - 0x34], 4
cmovae eax, dword [ebp - 0x28]
push ebx
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a54f4
cmp dword [ebp - 0x30], eax
setne bl
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4a553f
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], 1
cmp eax, 0x1000
jb 0x4a5536
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.004dfcf2
mov eax, dword [ebp - 0x30]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
push eax
push ecx
call fcn.004dfcf2
pop ecx
pop ecx
mov al, bl
jmp 0x4a5545
xor al, al
call fcn.004f29b6
ret
Function at 0x4a554b
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x28
mov eax, 0x54cc39
call fcn.004f2a0c
call fcn.004a4bae
test al, al
je 0x4a5648
call fcn.004dfcf2
test al, al
je 0x4a5648
call fcn.004a40c3
test al, al
je 0x4a5581
mov al, 1
jmp 0x4a564a
xor ebx, ebx
mov dword [ebp - 0x14], 0xf
push str.bEnableDatabases
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
call fcn.0044d64d
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x4a5602
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], ebx
push eax
push 0x20019
push ebx
push str.SOFTWAREAdobeAcrobat_ReaderDCRestrictedSecuritySettings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a5602
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], ebx
push ecx
push ebx
lea eax, [ebp - 0x28]
mov dword [ebp - 0x34], 4
cmovae eax, dword [ebp - 0x28]
push ebx
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a55f9
cmp dword [ebp - 0x30], eax
setne bl
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4a5644
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], 1
cmp eax, 0x1000
jb 0x4a563b
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.004dfcf2
mov eax, dword [ebp - 0x30]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
push eax
push ecx
call fcn.004dfcf2
pop ecx
pop ecx
mov al, bl
jmp 0x4a564a
xor al, al
call fcn.004f29b6
ret
Function at 0x4a5650
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x28
mov eax, 0x54cc39
call fcn.004f2a0c
call fcn.004a4bae
test al, al
je 0x4a574d
call fcn.004dfcf2
test al, al
je 0x4a574d
call fcn.004a40c3
test al, al
je 0x4a5686
mov al, 1
jmp 0x4a574f
xor ebx, ebx
mov dword [ebp - 0x14], 0xf
push str.bEnableFileAccessFromFileUrls
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
call fcn.0044d64d
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x4a5707
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], ebx
push eax
push 0x20019
push ebx
push str.SOFTWAREAdobeAcrobat_ReaderDCRestrictedSecuritySettings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a5707
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], ebx
push ecx
push ebx
lea eax, [ebp - 0x28]
mov dword [ebp - 0x34], 4
cmovae eax, dword [ebp - 0x28]
push ebx
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a56fe
cmp dword [ebp - 0x30], eax
setne bl
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4a5749
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], 1
cmp eax, 0x1000
jb 0x4a5740
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.004dfcf2
mov eax, dword [ebp - 0x30]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
push eax
push ecx
call fcn.004dfcf2
pop ecx
pop ecx
mov al, bl
jmp 0x4a574f
xor al, al
call fcn.004f29b6
ret
Function at 0x4a5755
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x28
mov eax, 0x54cc39
call fcn.004f2a0c
call fcn.004a4bae
test al, al
je 0x4a5858
call fcn.004dfcf2
test al, al
je 0x4a5858
call fcn.004a40c3
test al, al
jne 0x4a5858
xor ebx, ebx
mov dword [ebp - 0x14], 0xf
push str.bEnableGPU
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
call fcn.0044d64d
cmp dword [ebp - 0x18], 0
mov dword [ebp - 4], ebx
mov bl, 1
je 0x4a5812
lea eax, [ebp - 0x2c]
xor esi, esi
push eax
push 0x20019
push esi
push str.SOFTWAREAdobeAcrobat_ReaderDCRestrictedSecuritySettings
push 0x80000001
mov dword [ebp - 0x2c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a5812
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], 1
push ecx
push esi
lea eax, [ebp - 0x28]
mov dword [ebp - 0x34], 4
cmovae eax, dword [ebp - 0x28]
push esi
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a5809
cmp dword [ebp - 0x30], esi
setne bl
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4a5854
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], 1
cmp eax, 0x1000
jb 0x4a584b
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.004dfcf2
mov eax, dword [ebp - 0x30]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
push eax
push ecx
call fcn.004dfcf2
pop ecx
pop ecx
mov al, bl
jmp 0x4a585a
mov al, 1
call fcn.004f29b6
ret
Function at 0x4a5860
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x28
mov eax, 0x54cc39
call fcn.004f2a0c
call fcn.004a4bae
test al, al
je 0x4a595d
call fcn.004dfcf2
test al, al
je 0x4a595d
call fcn.004a40c3
test al, al
je 0x4a5896
mov al, 1
jmp 0x4a595f
xor ebx, ebx
mov dword [ebp - 0x14], 0xf
push str.bEnableJSAccessClipBoard
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
call fcn.0044d64d
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x4a5917
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], ebx
push eax
push 0x20019
push ebx
push str.SOFTWAREAdobeAcrobat_ReaderDCRestrictedSecuritySettings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a5917
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], ebx
push ecx
push ebx
lea eax, [ebp - 0x28]
mov dword [ebp - 0x34], 4
cmovae eax, dword [ebp - 0x28]
push ebx
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a590e
cmp dword [ebp - 0x30], eax
setne bl
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4a5959
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], 1
cmp eax, 0x1000
jb 0x4a5950
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.004dfcf2
mov eax, dword [ebp - 0x30]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
push eax
push ecx
call fcn.004dfcf2
pop ecx
pop ecx
mov al, bl
jmp 0x4a595f
xor al, al
call fcn.004f29b6
ret
Function at 0x4a5965
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x28
mov eax, 0x54cc39
call fcn.004f2a0c
call fcn.004a4bae
test al, al
je 0x4a5a62
call fcn.004dfcf2
test al, al
je 0x4a5a62
call fcn.004a40c3
test al, al
je 0x4a599b
mov al, 1
jmp 0x4a5a64
xor ebx, ebx
mov dword [ebp - 0x14], 0xf
push str.bEnableJSCloseWindows
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
call fcn.0044d64d
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x4a5a1c
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], ebx
push eax
push 0x20019
push ebx
push str.SOFTWAREAdobeAcrobat_ReaderDCRestrictedSecuritySettings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a5a1c
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], ebx
push ecx
push ebx
lea eax, [ebp - 0x28]
mov dword [ebp - 0x34], 4
cmovae eax, dword [ebp - 0x28]
push ebx
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a5a13
cmp dword [ebp - 0x30], eax
setne bl
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4a5a5e
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], 1
cmp eax, 0x1000
jb 0x4a5a55
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.004dfcf2
mov eax, dword [ebp - 0x30]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
push eax
push ecx
call fcn.004dfcf2
pop ecx
pop ecx
mov al, bl
jmp 0x4a5a64
xor al, al
call fcn.004f29b6
ret
Function at 0x4a5a6a
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x28
mov eax, 0x54cc39
call fcn.004f2a0c
call fcn.004a4bae
test al, al
je 0x4a5b67
call fcn.004dfcf2
test al, al
je 0x4a5b67
call fcn.004a40c3
test al, al
je 0x4a5aa0
mov al, 1
jmp 0x4a5b69
xor ebx, ebx
mov dword [ebp - 0x14], 0xf
push str.bEnableJSDomPaste
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
call fcn.0044d64d
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x4a5b21
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], ebx
push eax
push 0x20019
push ebx
push str.SOFTWAREAdobeAcrobat_ReaderDCRestrictedSecuritySettings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a5b21
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], ebx
push ecx
push ebx
lea eax, [ebp - 0x28]
mov dword [ebp - 0x34], 4
cmovae eax, dword [ebp - 0x28]
push ebx
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a5b18
cmp dword [ebp - 0x30], eax
setne bl
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4a5b63
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], 1
cmp eax, 0x1000
jb 0x4a5b5a
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.004dfcf2
mov eax, dword [ebp - 0x30]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
push eax
push ecx
call fcn.004dfcf2
pop ecx
pop ecx
mov al, bl
jmp 0x4a5b69
xor al, al
call fcn.004f29b6
ret
Function at 0x4a5b6f
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x28
mov eax, 0x54cc39
call fcn.004f2a0c
call fcn.004a4bae
test al, al
je 0x4a5c72
call fcn.004dfcf2
test al, al
je 0x4a5c72
call fcn.004a40c3
test al, al
jne 0x4a5c72
xor ebx, ebx
mov dword [ebp - 0x14], 0xf
push str.bEnableLocalStorage
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
call fcn.0044d64d
cmp dword [ebp - 0x18], 0
mov dword [ebp - 4], ebx
mov bl, 1
je 0x4a5c2c
lea eax, [ebp - 0x2c]
xor esi, esi
push eax
push 0x20019
push esi
push str.SOFTWAREAdobeAcrobat_ReaderDCRestrictedSecuritySettings
push 0x80000001
mov dword [ebp - 0x2c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a5c2c
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], 1
push ecx
push esi
lea eax, [ebp - 0x28]
mov dword [ebp - 0x34], 4
cmovae eax, dword [ebp - 0x28]
push esi
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a5c23
cmp dword [ebp - 0x30], esi
setne bl
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4a5c6e
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], 1
cmp eax, 0x1000
jb 0x4a5c65
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.004dfcf2
mov eax, dword [ebp - 0x30]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
push eax
push ecx
call fcn.004dfcf2
pop ecx
pop ecx
mov al, bl
jmp 0x4a5c74
mov al, 1
call fcn.004f29b6
ret
Function at 0x4a5c85
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x28
mov eax, 0x54cc39
call fcn.004f2a0c
call fcn.004a4bae
test al, al
je 0x4a5d82
call fcn.004dfcf2
test al, al
je 0x4a5d82
call fcn.004a40c3
test al, al
je 0x4a5cbb
mov al, 1
jmp 0x4a5d84
xor ebx, ebx
mov dword [ebp - 0x14], 0xf
push str.bEnableMixedContent
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
call fcn.0044d64d
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x4a5d3c
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], ebx
push eax
push 0x20019
push ebx
push str.SOFTWAREAdobeAcrobat_ReaderDCRestrictedSecuritySettings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a5d3c
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], ebx
push ecx
push ebx
lea eax, [ebp - 0x28]
mov dword [ebp - 0x34], 4
cmovae eax, dword [ebp - 0x28]
push ebx
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a5d33
cmp dword [ebp - 0x30], eax
setne bl
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4a5d7e
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], 1
cmp eax, 0x1000
jb 0x4a5d75
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.004dfcf2
mov eax, dword [ebp - 0x30]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
push eax
push ecx
call fcn.004dfcf2
pop ecx
pop ecx
mov al, bl
jmp 0x4a5d84
xor al, al
call fcn.004f29b6
ret