joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51d0f0
Capabilities:
Encode data using xor

Disassembly:
mov al, 0xb5
mov r8, rcx
xor edx, edx
mov ecx, edx
and ecx, 0x3f
mov r9, r8
shr r9, cl
and r9b, 0xff
xor al, r9b
add edx, 1
cmp edx, 8
jne 0x51d0f7
nop
ret

Function at 0x54c770
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r8, rcx
xor eax, eax
xor r9, r9
sub edx, 1
mov ecx, r9d
cmp ecx, edx
jg 0x54c7b0
sub edx, r9d
add edx, 1
mov ecx, eax
and cx, 0xf800
movzx ecx, cx
shr ecx, 0xb
shl eax, 5
or cx, ax
mov eax, ecx
movzx cx, byte [r8]
xor ax, cx
add r8, 1
sub edx, 1
test edx, edx
jne 0x54c788
nop
ret

Function at 0x6bfb40
Capabilities:
Create thread

Disassembly:
sub rsp, 0x48
mov rax, qword [0x007e9df8]
cmp byte [rax + 0x159], 0
jne 0x6bfbde
cmp qword [0x007e9e30], 0
jne 0x6bfb85
call sub.kernel32.dll_GetCurrentThreadId
mov ecx, 3
mov rdx, qword [0x007cc168]
xor r8, r8
mov r9d, eax
call sub.user32.dll_SetWindowsHookExW
mov qword [0x007e9e30], rax
cmp qword [0x007e9e28], 0
jne 0x6bfba5
xor ecx, ecx
xor edx, edx
xor r8, r8
xor r9, r9
call sub.kernel32.dll_CreateEventW
mov qword [0x007e9e28], rax
cmp qword [0x007e9e38], 0
jne 0x6bfbde
xor ecx, ecx
mov edx, 0x3e8
mov r8, qword [0x007cc160]
xor r9, r9
mov dword [rsp + 0x20], 0
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
call sub.kernel32.dll_CreateThread
mov qword [0x007e9e38], rax
add rsp, 0x48
ret

Function at 0x6c0d40
Capabilities:
Enumerate gui resources

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x50
mov rbp, rsp
mov rbx, rcx
mov rax, qword [rbx + 0x2d0]
test rax, rax
je 0x6c0e1f
cmp dword [rbx + 0x128], 0
jne 0x6c0e15
mov qword [rbp + 0x40], rax
mov byte [rbp + 0x48], dl
lea rcx, [0x006c0c40]
lea rdx, [rbp + 0x40]
call sub.user32.dll_EnumWindows
mov rax, qword [rbx + 0x120]
cmp dword [rax + 0x10], 0
je 0x6c0e15
mov rcx, qword [rbp + 0x40]
mov edx, 3
call sub.user32.dll_GetWindow
mov qword [rbp + 0x40], rax
mov rcx, qword [rbp + 0x40]
mov edx, 0xffffffec
call sub.user32.dll_GetWindowLongPtrW
test rax, 8
je 0x6c0dc3
mov qword [rbp + 0x40], 0xfffffffffffffffe
mov rax, qword [rbx + 0x120]
mov esi, dword [rax + 0x10]
sub esi, 1
test esi, esi
jl 0x6c0e14
mov rcx, qword [rbx + 0x120]
mov edx, esi
call fcn.0048a200
mov rcx, rax
mov rdx, qword [rbp + 0x40]
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x30], 0x213
call sub.user32.dll_SetWindowPos
sub esi, 1
cmp esi, 0xffffffff
jne 0x6c0dd4
nop
lea rax, [rbx + 0x128]
add dword [rax], 1
lea rsp, [rbp + 0x50]
pop rbx
pop rsi
pop rbp
ret
Function at 0x14002a188
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
call fcn.14002ada4
add rsp, 0x28
jmp 0x14002a188
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push r14
sub rsp, 0xb0
and dword [rsp + 0x20], 0
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor edi, edi
xor eax, eax
lock cmpxchg qword [0x1400dbd38], rbx
je 0x14002a1d2
cmp rax, rbx
jne 0x14002a1e7
mov edi, 1
mov eax, dword [0x1400dbd40]
cmp eax, 1
jne 0x14002a1f4
lea ecx, [rax + 0x1e]
call fcn.140178000
jmp 0x14002a261
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14002a1bb
mov eax, dword [0x1400dbd40]
test eax, eax
jne 0x14002a257
mov dword [0x1400dbd40], 1
lea r14, [0x1400a3d10]
lea rbx, [0x1400a3cf8]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x24], eax
cmp rbx, r14
jae 0x14002a249
test eax, eax
jne 0x14002a24d
cmp qword [rbx], 0
je 0x14002a23e
mov rax, qword [rbx]
mov rcx, qword [case.0x140024555.0]
call rcx
mov dword [rsp + 0x24], eax
add rbx, 8
mov qword [rsp + 0x30], rbx
jmp 0x14002a21f
test eax, eax
je 0x14002a261
mov eax, 0xff
jmp 0x14002a3b4
mov dword [0x1400db430], 1
mov eax, dword [0x1400dbd40]
cmp eax, 1
jne 0x14002a289
lea rdx, [0x1400a3cf0]
lea rcx, [0x1400a3b08]
call sub.msvcrt.dll__initterm
mov dword [0x1400dbd40], 2
test edi, edi
jne 0x14002a296
xor eax, eax
xchg qword [0x1400dbd38], rax
cmp qword [0x1400dbd58], 0
je 0x14002a2ca
lea rcx, [0x1400dbd58]
call fcn.14002ad10
test eax, eax
je 0x14002a2ca
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x1400dbd58]
mov r9, qword [case.0x140024555.0]
call r9
mov rax, qword [sym.imp.msvcrt.dll__acmdln]
mov rbx, qword [rax]
mov qword [rsp + 0x28], rbx
mov edi, dword [rsp + 0x20]
movzx ecx, byte [rbx]
cmp cl, 0x20
ja 0x14002a356
test cl, cl
je 0x14002a2ed
test edi, edi
jne 0x14002a356
dec cl
cmp cl, 0x1f
ja 0x14002a300
inc rbx
mov qword [rsp + 0x28], rbx
mov cl, byte [rbx]
jmp 0x14002a2ed
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rbx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140006738
mov dword [0x1400db42c], eax
cmp dword [0x1400db450], 0
jne 0x14002a33f
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x1400db430], 0
jne 0x14002a354
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x1400db42c]
jmp 0x14002a3b4
cmp cl, 0x22
jne 0x14002a368
xor eax, eax
test edi, edi
sete al
mov edi, eax
mov dword [rsp + 0x20], eax
call qword [sym.imp.msvcrt.dll__ismbblead]
test eax, eax
je 0x14002a37a
inc rbx
mov qword [rsp + 0x28], rbx
inc rbx
mov qword [rsp + 0x28], rbx
jmp 0x14002a2dd
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop r14
ret
Function at 0x140059960
Capabilities:
Delete registry key

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x3a0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1400db348]
xor rax, rsp
mov qword [rsp + 0x390], rax
mov rdi, rdx
mov rsi, rcx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
or r9, 0xffffffffffffffff
xor ebx, ebx
inc r9
cmp word [rdi + r9*2], bx
jne 0x1400599a8
mov dword [rsp + 0x3c], r9d
mov dword [rsp + 0x38], r9d
mov qword [rsp + 0x30], rdi
lea rax, [0x14009cc50]
mov qword [rsp + 0x28], rax
lea r8d, [r9 - 1]
movsxd rdx, r8d
test r8d, r8d
js 0x1400599ef
movzx ecx, word [rdi + rdx*2]
call fcn.140016854
test eax, eax
jne 0x1400599ef
dec r8d
sub rdx, 1
jns 0x1400599d9
inc r8d
sub r9d, r8d
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x28]
call fcn.140015fd4
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x78]
mov edx, 0x21
lea rcx, [rsp + 0x60]
call fcn.14000bfec
lea rax, [0x14009b078]
mov qword [rsp + 0x60], rax
mov r9d, 0xf003f
mov r8, qword [rsp + 0x68]
mov rdx, rsi
lea rcx, [rsp + 0xc0]
call fcn.1400596dc
nop
mov dword [rsp + 0x20], 0x104
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x180]
xor edx, edx
lea rcx, [rsp + 0xc0]
call fcn.140059b9c
test eax, eax
jne 0x140059adb
lea rcx, [rsp + 0xc0]
call fcn.1400142e0
nop
mov rcx, qword [rsi + 0xb0]
test rcx, rcx
jne 0x140059a9a
mov ecx, 6
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
jmp 0x140059acc
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x68]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteKeyExW]
nop dword [rax + rax]
test eax, eax
je 0x140059ab9
mov ecx, eax
jmp 0x140059a8c
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
mov ebx, 1
lea rcx, [rsp + 0x60]
call fcn.140008154
nop
mov eax, ebx
jmp 0x140059b2e
lea rdx, [rsp + 0x180]
lea rcx, [rsp + 0xc0]
call fcn.140059960
test eax, eax
jne 0x140059a45
lea rcx, [rsp + 0xc0]
call fcn.1400142e0
nop
lea rcx, [rsp + 0x60]
call fcn.140008154
nop
lea rax, method.__hqW4__s.virtual_8
mov qword [rsp + 0x28], rax
xor eax, eax
jmp 0x140059b2e
mov rcx, qword [rsp + 0x390]
xor rcx, rsp
call fcn.14002a3f0
lea r11, [rsp + 0x3a0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400080c0
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov dword [rcx + 0xc], 0x67452301
mov dword [rcx + 0x10], 0xefcdab89
mov dword [rcx + 0x20], eax
mov dword [rcx + 0x1c], eax
mov dword [rcx + 8], eax
lea rax, [0x1400078a0]
mov dword [rcx + 0x14], 0x98badcfe
mov dword [rcx + 0x18], 0x10325476
mov qword [rcx], rax
ret

Function at 0x140008100
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, 0x70
call fcn.140039680
sub rsp, rax
mov eax, dword [rcx + 0x1c]
mov rsi, rdx
mov rbx, rcx
shr eax, 3
mov edi, 0x38
and eax, 0x3f
cmp eax, 0x38
jb 0x140008136
mov edi, 0x78
sub edi, eax
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, edi
call fcn.14002f6f0
mov byte [rsp + 0x20], 0x80
lea rcx, [rsp + rdi + 0x21]
lea rdx, [rbx + 0x1e]
mov r8d, 2
nop
nop
movzx eax, byte [rdx - 2]
add rcx, 4
add rdx, 4
sub r8, 1
mov byte [rcx - 5], al
movzx eax, byte [rdx - 5]
mov byte [rcx - 4], al
movzx eax, byte [rdx - 4]
mov byte [rcx - 3], al
movzx eax, byte [rdx - 3]
mov byte [rcx - 2], al
jne 0x140008160
lea r8d, [rdi + 8]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140007760
lea rcx, [rsi + 1]
lea rdx, [rbx + 0xe]
mov r8d, 4
nop
nop
movzx eax, byte [rdx - 2]
add rcx, 4
add rdx, 4
sub r8, 1
mov byte [rcx - 5], al
movzx eax, byte [rdx - 5]
mov byte [rcx - 4], al
movzx eax, byte [rdx - 4]
mov byte [rcx - 3], al
movzx eax, byte [rdx - 3]
mov byte [rcx - 2], al
jne 0x1400081b0
xor eax, eax
xor edx, edx
lea rcx, [rbx + 0x64]
mov dword [rbx + 0x20], eax
mov dword [rbx + 0x1c], eax
mov dword [rbx + 8], eax
lea rax, [0x1400078a0]
lea r8d, [rdx + 0x40]
mov dword [rbx + 0xc], 0x67452301
mov dword [rbx + 0x10], 0xefcdab89
mov dword [rbx + 0x14], 0x98badcfe
mov dword [rbx + 0x18], 0x10325476
mov qword [rbx], rax
call fcn.14002f6f0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x14000d210
Capabilities:
Hash data using sha1

Disassembly:
mov eax, 0x28
call fcn.140039680
sub rsp, rax
add rsp, 0x28
jmp 0x140018d70
lea rax, [0x140018d40]
mov dword [rcx], 0x67452301
mov dword [rcx + 4], 0xefcdab89
mov qword [rcx + 0x60], rax
xor eax, eax
mov dword [rcx + 8], 0x98badcfe
mov dword [rcx + 0xc], 0x10325476
mov dword [rcx + 0x10], 0xc3d2e1f0
mov dword [rcx + 0x18], eax
mov dword [rcx + 0x14], eax
ret
Function at 0x14000d250
Capabilities:
Enumerate pe sections
Hash data using sha1

Disassembly:
mov eax, 0x28
call fcn.140039680
sub rsp, rax
mov r8, qword [rcx + 0x60]
add rsp, 0x28
jmp 0x140018db0
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x70
call fcn.140039680
sub rsp, rax
mov eax, 8
lea r9, [rsp + 0x20]
mov rsi, rdx
and r9d, 7
xor edx, edx
mov rbp, r8
sub eax, r9d
mov rbx, rcx
lea r8d, [rdx + 0x48]
lea rdi, [rsp + rax + 0x20]
mov rcx, rdi
call fcn.14002f6f0
mov r9d, dword [rbx + 0x18]
mov r8d, 0x40
mov eax, r9d
and eax, 0x3f
sub r8d, eax
cmp r8d, 8
ja 0x140018e17
add r8d, 0x40
mov eax, dword [rbx + 0x14]
mov byte [rdi], 0x80
mov ecx, r9d
shl eax, 3
shl r9d, 3
shr ecx, 0x1d
or ecx, eax
mov dword [rsp + 0x84], r9d
mov rdx, rdi
mov eax, ecx
mov dword [rsp + 0x80], ecx
shr eax, 0x18
mov byte [r8 + rdi - 8], al
mov eax, ecx
shr ecx, 8
shr eax, 0x10
mov byte [r8 + rdi - 6], cl
mov rcx, rbx
mov byte [r8 + rdi - 7], al
movzx eax, byte [rsp + 0x80]
mov byte [r8 + rdi - 5], al
mov eax, r9d
shr eax, 0x18
mov byte [r8 + rdi - 4], al
mov eax, r9d
shr r9d, 8
shr eax, 0x10
mov byte [r8 + rdi - 2], r9b
mov r9, rbp
mov byte [r8 + rdi - 3], al
movzx eax, byte [rsp + 0x84]
mov byte [r8 + rdi - 1], al
call fcn.140018c20
movzx r11d, byte [rbx + 3]
mov byte [rsi], r11b
movzx eax, byte [rbx + 2]
mov byte [rsi + 1], al
mov eax, dword [rbx]
shr eax, 8
mov byte [rsi + 2], al
movzx eax, byte [rbx]
mov byte [rsi + 3], al
movzx eax, byte [rbx + 7]
mov byte [rsi + 4], al
movzx eax, byte [rbx + 6]
mov byte [rsi + 5], al
mov eax, dword [rbx + 4]
shr eax, 8
mov byte [rsi + 6], al
movzx eax, byte [rbx + 4]
mov byte [rsi + 7], al
movzx eax, byte [rbx + 0xb]
mov byte [rsi + 8], al
movzx eax, byte [rbx + 0xa]
mov byte [rsi + 9], al
mov eax, dword [rbx + 8]
shr eax, 8
mov byte [rsi + 0xa], al
movzx eax, byte [rbx + 8]
mov byte [rsi + 0xb], al
movzx eax, byte [rbx + 0xf]
mov byte [rsi + 0xc], al
movzx eax, byte [rbx + 0xe]
mov byte [rsi + 0xd], al
mov eax, dword [rbx + 0xc]
shr eax, 8
mov byte [rsi + 0xe], al
movzx eax, byte [rbx + 0xc]
mov byte [rsi + 0xf], al
movzx eax, byte [rbx + 0x13]
mov byte [rsi + 0x10], al
movzx eax, byte [rbx + 0x12]
mov byte [rsi + 0x11], al
mov eax, dword [rbx + 0x10]
shr eax, 8
mov byte [rsi + 0x12], al
movzx eax, byte [rbx + 0x10]
mov byte [rsi + 0x13], al
lea rax, [0x140018d40]
mov qword [rbx + 0x60], rax
xor eax, eax
lea r11, [rsp + 0x70]
mov dword [rbx + 0x18], eax
mov dword [rbx + 0x14], eax
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov dword [rbx], 0x67452301
mov dword [rbx + 4], 0xefcdab89
mov dword [rbx + 8], 0x98badcfe
mov dword [rbx + 0xc], 0x10325476
mov dword [rbx + 0x10], 0xc3d2e1f0
mov rbx, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x140018db0
Capabilities:
Enumerate pe sections
Hash data using sha1

Disassembly:
mov eax, 0x28
call fcn.140039680
sub rsp, rax
mov r8, qword [rcx + 0x60]
add rsp, 0x28
jmp 0x140018db0
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x70
call fcn.140039680
sub rsp, rax
mov eax, 8
lea r9, [rsp + 0x20]
mov rsi, rdx
and r9d, 7
xor edx, edx
mov rbp, r8
sub eax, r9d
mov rbx, rcx
lea r8d, [rdx + 0x48]
lea rdi, [rsp + rax + 0x20]
mov rcx, rdi
call fcn.14002f6f0
mov r9d, dword [rbx + 0x18]
mov r8d, 0x40
mov eax, r9d
and eax, 0x3f
sub r8d, eax
cmp r8d, 8
ja 0x140018e17
add r8d, 0x40
mov eax, dword [rbx + 0x14]
mov byte [rdi], 0x80
mov ecx, r9d
shl eax, 3
shl r9d, 3
shr ecx, 0x1d
or ecx, eax
mov dword [rsp + 0x84], r9d
mov rdx, rdi
mov eax, ecx
mov dword [rsp + 0x80], ecx
shr eax, 0x18
mov byte [r8 + rdi - 8], al
mov eax, ecx
shr ecx, 8
shr eax, 0x10
mov byte [r8 + rdi - 6], cl
mov rcx, rbx
mov byte [r8 + rdi - 7], al
movzx eax, byte [rsp + 0x80]
mov byte [r8 + rdi - 5], al
mov eax, r9d
shr eax, 0x18
mov byte [r8 + rdi - 4], al
mov eax, r9d
shr r9d, 8
shr eax, 0x10
mov byte [r8 + rdi - 2], r9b
mov r9, rbp
mov byte [r8 + rdi - 3], al
movzx eax, byte [rsp + 0x84]
mov byte [r8 + rdi - 1], al
call fcn.140018c20
movzx r11d, byte [rbx + 3]
mov byte [rsi], r11b
movzx eax, byte [rbx + 2]
mov byte [rsi + 1], al
mov eax, dword [rbx]
shr eax, 8
mov byte [rsi + 2], al
movzx eax, byte [rbx]
mov byte [rsi + 3], al
movzx eax, byte [rbx + 7]
mov byte [rsi + 4], al
movzx eax, byte [rbx + 6]
mov byte [rsi + 5], al
mov eax, dword [rbx + 4]
shr eax, 8
mov byte [rsi + 6], al
movzx eax, byte [rbx + 4]
mov byte [rsi + 7], al
movzx eax, byte [rbx + 0xb]
mov byte [rsi + 8], al
movzx eax, byte [rbx + 0xa]
mov byte [rsi + 9], al
mov eax, dword [rbx + 8]
shr eax, 8
mov byte [rsi + 0xa], al
movzx eax, byte [rbx + 8]
mov byte [rsi + 0xb], al
movzx eax, byte [rbx + 0xf]
mov byte [rsi + 0xc], al
movzx eax, byte [rbx + 0xe]
mov byte [rsi + 0xd], al
mov eax, dword [rbx + 0xc]
shr eax, 8
mov byte [rsi + 0xe], al
movzx eax, byte [rbx + 0xc]
mov byte [rsi + 0xf], al
movzx eax, byte [rbx + 0x13]
mov byte [rsi + 0x10], al
movzx eax, byte [rbx + 0x12]
mov byte [rsi + 0x11], al
mov eax, dword [rbx + 0x10]
shr eax, 8
mov byte [rsi + 0x12], al
movzx eax, byte [rbx + 0x10]
mov byte [rsi + 0x13], al
lea rax, [0x140018d40]
mov qword [rbx + 0x60], rax
xor eax, eax
lea r11, [rsp + 0x70]
mov dword [rbx + 0x18], eax
mov dword [rbx + 0x14], eax
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov dword [rbx], 0x67452301
mov dword [rbx + 4], 0xefcdab89
mov dword [rbx + 8], 0x98badcfe
mov dword [rbx + 0xc], 0x10325476
mov dword [rbx + 0x10], 0xc3d2e1f0
mov rbx, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x14001e870
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
cmp byte [0x14004ba53], 0
je 0x14001e88a
test cl, cl
je 0x14001ea01
lea rax, [rbp - 0x10]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatDCInstaller_
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001e9fa
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x14001e9fa
mov qword [rsp + 0x50], rbx
xor ebx, ebx
cmp byte [0x14004ba53], bl
mov dword [rbp + 0x20], ebx
mov dword [rbp + 0x18], ebx
mov dword [rbp + 0x28], 4
jne 0x14001e91b
lea rax, [rbp + 0x28]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x20]
lea rax, [rbp + 0x18]
lea rdx, str.bIsSingleClientApp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001e91b
cmp dword [rbp + 0x20], 4
jne 0x14001e91b
cmp dword [rbp + 0x18], ebx
setne byte [0x14004ba51]
cmp byte [0x14004ba51], bl
je 0x14001e9eb
mov rcx, qword [rbp - 0x10]
lea rax, [rbp + 0x28]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x20]
lea rax, [rbp + 0x18]
mov dword [rbp + 0x18], ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.bIsSCAcroAppInstalled
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001e968
cmp dword [rbp + 0x20], 4
jne 0x14001e968
cmp dword [rbp + 0x18], ebx
setne byte [0x14004ba50]
mov rcx, qword [rbp - 0x10]
lea rax, [rbp + 0x28]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x20]
lea rax, [rbp + 0x18]
mov dword [rbp + 0x18], ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SCAPackageLevel
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001e9ad
mov eax, dword [0x140046008]
cmp dword [rbp + 0x20], 4
cmove eax, dword [rbp + 0x18]
mov dword [0x140046008], eax
mov rcx, qword [rbp - 0x10]
lea rax, [rbp + 0x28]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x20]
lea rax, [rbp + 0x18]
xor r8d, r8d
lea rdx, str.IsAcrInstalledInRdrMode
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001e9eb
cmp dword [rbp + 0x20], 4
jne 0x14001e9eb
cmp dword [rbp + 0x18], ebx
setne byte [0x14004ba52]
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x50]
mov byte [0x14004ba53], 1
add rsp, 0x40
pop rbp
ret
Function at 0x14001eee0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push r14
sub rsp, 0x868
mov rax, qword [0x14004b2a8]
xor rax, rsp
mov qword [rsp + 0x850], rax
mov r14, qword [rsp + 0x8b0]
mov rbp, rcx
mov rsi, qword [rsp + 0x8b8]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x20], r9
xor bl, bl
mov r9, r8
mov r8, rdx
mov edx, 0x400
call fcn.14001f880
test eax, eax
js 0x14001efec
lea rax, [rsp + 0x40]
mov qword [rsp + 0x860], rdi
xor edi, edi
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x40], rdi
lea rdx, [rsp + 0x50]
mov rcx, rbp
lea r9d, [rdi + 1]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001efc4
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
lea rax, [rsp + 0x34]
mov dword [rsp + 0x30], edi
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, r14
mov dword [rsp + 0x34], edi
mov dword [rsp + 0x38], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001efb9
cmp dword [rsp + 0x30], 4
jne 0x14001efb9
cmp dword [rsp + 0x34], edi
mov bl, 1
setne dil
mov dword [rsi], edi
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rsp + 0x860]
movzx eax, bl
mov rcx, qword [rsp + 0x850]
xor rcx, rsp
call fcn.140039070
add rsp, 0x868
pop r14
pop rsi
pop rbp
pop rbx
ret
movzx eax, bl
jmp 0x14001efcf
Function at 0x140021240
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov rax, qword [0x14004b2a8]
xor rax, rsp
mov qword [rbp + 0x160], rax
mov ebx, edx
mov r15, rcx
xor r12d, r12d
lea rcx, [rsp + 0x50]
xor edx, edx
mov qword [rsp + 0x40], r12
mov r8d, 0x208
movzx r14d, r12w
call fcn.14003a050
test ebx, ebx
mov dword [rsp + 0x30], r12d
mov esi, r12d
mov dword [rsp + 0x34], r12d
lea r8, str.SoftwareAdobeAcrobat_ReaderDCFeatureState
mov dword [rsp + 0x38], 4
mov edx, 0x104
lea rcx, [rsp + 0x50]
sete sil
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea rax, [rsp + 0x40]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x50]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ebx, [r12 + 1]
test eax, eax
jne 0x14002135a
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
lea rax, [rsp + 0x34]
xor r8d, r8d
mov rdx, r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14002133b
cmp dword [rsp + 0x30], 4
jne 0x14002133b
cmp dword [rsp + 0x34], r12d
je 0x140021336
movzx edi, bx
jmp 0x140021341
mov edi, r12d
jmp 0x140021341
mov r14d, ebx
movzx edi, si
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r14w, r14w
jne 0x14002135a
movzx eax, di
jmp 0x140021426
xor edx, edx
mov qword [rsp + 0x40], r12
mov r8d, 0x208
lea rcx, [rsp + 0x50]
call fcn.14003a050
lea r8, str.SoftwareAdobeAdobe_AcrobatDCFeatureState
mov dword [rsp + 0x34], r12d
mov edx, 0x104
mov dword [rsp + 0x30], r12d
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x38], 4
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea rax, [rsp + 0x40]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x50]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140021420
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x30]
xor r8d, r8d
mov rdx, r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140021410
cmp dword [rsp + 0x34], 4
jne 0x140021410
cmp dword [rsp + 0x30], r12d
jne 0x140021413
mov rcx, qword [rsp + 0x40]
movzx ebx, r12w
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140021423
movzx ebx, si
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140021423
movzx ebx, si
movzx eax, bx
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.140039070
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret