joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a4ce9
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x28
mov eax, 0x5596af
call fcn.004e864c
call fcn.004a459e
test al, al
je 0x4a4de6
call fcn.004ff107
test al, al
je 0x4a4de6
call fcn.004a3adf
test al, al
je 0x4a4d1f
mov al, 1
jmp 0x4a4de8
xor ebx, ebx
mov dword [ebp - 0x14], 0xf
push str.bEnableBrowserPlugins
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
call fcn.0045446b
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x4a4da0
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], ebx
push eax
push 0x20019
push ebx
push str.SOFTWAREAdobeAcrobat_ReaderDCRestrictedSecuritySettings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a4da0
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], ebx
push ecx
push ebx
lea eax, [ebp - 0x28]
mov dword [ebp - 0x34], 4
cmovae eax, dword [ebp - 0x28]
push ebx
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a4d97
cmp dword [ebp - 0x30], eax
setne bl
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4a4de2
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], 1
cmp eax, 0x1000
jb 0x4a4dd9
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.004ff107
mov eax, dword [ebp - 0x30]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
push eax
push ecx
call fcn.004ff107
pop ecx
pop ecx
mov al, bl
jmp 0x4a4de8
xor al, al
call fcn.004e85f6
ret
Function at 0x4a4dee
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x28
mov eax, 0x5596af
call fcn.004e864c
call fcn.004a459e
test al, al
je 0x4a4eeb
call fcn.004ff107
test al, al
je 0x4a4eeb
call fcn.004a3adf
test al, al
je 0x4a4e24
mov al, 1
jmp 0x4a4eed
xor ebx, ebx
mov dword [ebp - 0x14], 0xf
push str.bEnableDatabases
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
call fcn.0045446b
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x4a4ea5
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], ebx
push eax
push 0x20019
push ebx
push str.SOFTWAREAdobeAcrobat_ReaderDCRestrictedSecuritySettings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a4ea5
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], ebx
push ecx
push ebx
lea eax, [ebp - 0x28]
mov dword [ebp - 0x34], 4
cmovae eax, dword [ebp - 0x28]
push ebx
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a4e9c
cmp dword [ebp - 0x30], eax
setne bl
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4a4ee7
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], 1
cmp eax, 0x1000
jb 0x4a4ede
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.004ff107
mov eax, dword [ebp - 0x30]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
push eax
push ecx
call fcn.004ff107
pop ecx
pop ecx
mov al, bl
jmp 0x4a4eed
xor al, al
call fcn.004e85f6
ret
Function at 0x4a4ef3
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x28
mov eax, 0x5596af
call fcn.004e864c
call fcn.004a459e
test al, al
je 0x4a4ff0
call fcn.004ff107
test al, al
je 0x4a4ff0
call fcn.004a3adf
test al, al
je 0x4a4f29
mov al, 1
jmp 0x4a4ff2
xor ebx, ebx
mov dword [ebp - 0x14], 0xf
push str.bEnableFileAccessFromFileUrls
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
call fcn.0045446b
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x4a4faa
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], ebx
push eax
push 0x20019
push ebx
push str.SOFTWAREAdobeAcrobat_ReaderDCRestrictedSecuritySettings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a4faa
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], ebx
push ecx
push ebx
lea eax, [ebp - 0x28]
mov dword [ebp - 0x34], 4
cmovae eax, dword [ebp - 0x28]
push ebx
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a4fa1
cmp dword [ebp - 0x30], eax
setne bl
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4a4fec
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], 1
cmp eax, 0x1000
jb 0x4a4fe3
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.004ff107
mov eax, dword [ebp - 0x30]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
push eax
push ecx
call fcn.004ff107
pop ecx
pop ecx
mov al, bl
jmp 0x4a4ff2
xor al, al
call fcn.004e85f6
ret
Function at 0x4a4ff8
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x28
mov eax, 0x5596af
call fcn.004e864c
call fcn.004a459e
test al, al
je 0x4a50f5
call fcn.004ff107
test al, al
je 0x4a50f5
call fcn.004a3adf
test al, al
je 0x4a502e
mov al, 1
jmp 0x4a50f7
xor ebx, ebx
mov dword [ebp - 0x14], 0xf
push str.bEnableGPU
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
call fcn.0045446b
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x4a50af
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], ebx
push eax
push 0x20019
push ebx
push str.SOFTWAREAdobeAcrobat_ReaderDCRestrictedSecuritySettings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a50af
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], ebx
push ecx
push ebx
lea eax, [ebp - 0x28]
mov dword [ebp - 0x34], 4
cmovae eax, dword [ebp - 0x28]
push ebx
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a50a6
cmp dword [ebp - 0x30], eax
setne bl
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4a50f1
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], 1
cmp eax, 0x1000
jb 0x4a50e8
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.004ff107
mov eax, dword [ebp - 0x30]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
push eax
push ecx
call fcn.004ff107
pop ecx
pop ecx
mov al, bl
jmp 0x4a50f7
xor al, al
call fcn.004e85f6
ret
Function at 0x4a50fd
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x28
mov eax, 0x5596af
call fcn.004e864c
call fcn.004a459e
test al, al
je 0x4a51fa
call fcn.004ff107
test al, al
je 0x4a51fa
call fcn.004a3adf
test al, al
je 0x4a5133
mov al, 1
jmp 0x4a51fc
xor ebx, ebx
mov dword [ebp - 0x14], 0xf
push str.bEnableJSAccessClipBoard
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
call fcn.0045446b
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x4a51b4
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], ebx
push eax
push 0x20019
push ebx
push str.SOFTWAREAdobeAcrobat_ReaderDCRestrictedSecuritySettings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a51b4
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], ebx
push ecx
push ebx
lea eax, [ebp - 0x28]
mov dword [ebp - 0x34], 4
cmovae eax, dword [ebp - 0x28]
push ebx
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a51ab
cmp dword [ebp - 0x30], eax
setne bl
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4a51f6
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], 1
cmp eax, 0x1000
jb 0x4a51ed
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.004ff107
mov eax, dword [ebp - 0x30]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
push eax
push ecx
call fcn.004ff107
pop ecx
pop ecx
mov al, bl
jmp 0x4a51fc
xor al, al
call fcn.004e85f6
ret
Function at 0x4a5202
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x28
mov eax, 0x5596af
call fcn.004e864c
call fcn.004a459e
test al, al
je 0x4a52ff
call fcn.004ff107
test al, al
je 0x4a52ff
call fcn.004a3adf
test al, al
je 0x4a5238
mov al, 1
jmp 0x4a5301
xor ebx, ebx
mov dword [ebp - 0x14], 0xf
push str.bEnableJSCloseWindows
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
call fcn.0045446b
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x4a52b9
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], ebx
push eax
push 0x20019
push ebx
push str.SOFTWAREAdobeAcrobat_ReaderDCRestrictedSecuritySettings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a52b9
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], ebx
push ecx
push ebx
lea eax, [ebp - 0x28]
mov dword [ebp - 0x34], 4
cmovae eax, dword [ebp - 0x28]
push ebx
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a52b0
cmp dword [ebp - 0x30], eax
setne bl
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4a52fb
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], 1
cmp eax, 0x1000
jb 0x4a52f2
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.004ff107
mov eax, dword [ebp - 0x30]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
push eax
push ecx
call fcn.004ff107
pop ecx
pop ecx
mov al, bl
jmp 0x4a5301
xor al, al
call fcn.004e85f6
ret
Function at 0x4a5307
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x28
mov eax, 0x5596af
call fcn.004e864c
call fcn.004a459e
test al, al
je 0x4a5404
call fcn.004ff107
test al, al
je 0x4a5404
call fcn.004a3adf
test al, al
je 0x4a533d
mov al, 1
jmp 0x4a5406
xor ebx, ebx
mov dword [ebp - 0x14], 0xf
push str.bEnableJSDomPaste
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
call fcn.0045446b
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x4a53be
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], ebx
push eax
push 0x20019
push ebx
push str.SOFTWAREAdobeAcrobat_ReaderDCRestrictedSecuritySettings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a53be
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], ebx
push ecx
push ebx
lea eax, [ebp - 0x28]
mov dword [ebp - 0x34], 4
cmovae eax, dword [ebp - 0x28]
push ebx
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a53b5
cmp dword [ebp - 0x30], eax
setne bl
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4a5400
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], 1
cmp eax, 0x1000
jb 0x4a53f7
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.004ff107
mov eax, dword [ebp - 0x30]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
push eax
push ecx
call fcn.004ff107
pop ecx
pop ecx
mov al, bl
jmp 0x4a5406
xor al, al
call fcn.004e85f6
ret
Function at 0x4a540c
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x28
mov eax, 0x5596af
call fcn.004e864c
call fcn.004a459e
test al, al
je 0x4a550f
call fcn.004ff107
test al, al
je 0x4a550f
call fcn.004a3adf
test al, al
jne 0x4a550f
xor ebx, ebx
mov dword [ebp - 0x14], 0xf
push str.bEnableLocalStorage
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
call fcn.0045446b
cmp dword [ebp - 0x18], 0
mov dword [ebp - 4], ebx
mov bl, 1
je 0x4a54c9
lea eax, [ebp - 0x2c]
xor esi, esi
push eax
push 0x20019
push esi
push str.SOFTWAREAdobeAcrobat_ReaderDCRestrictedSecuritySettings
push 0x80000001
mov dword [ebp - 0x2c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a54c9
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], 1
push ecx
push esi
lea eax, [ebp - 0x28]
mov dword [ebp - 0x34], 4
cmovae eax, dword [ebp - 0x28]
push esi
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a54c0
cmp dword [ebp - 0x30], esi
setne bl
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4a550b
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], 1
cmp eax, 0x1000
jb 0x4a5502
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.004ff107
mov eax, dword [ebp - 0x30]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
push eax
push ecx
call fcn.004ff107
pop ecx
pop ecx
mov al, bl
jmp 0x4a5511
mov al, 1
call fcn.004e85f6
ret
Function at 0x4a5522
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x28
mov eax, 0x5596af
call fcn.004e864c
call fcn.004a459e
test al, al
je 0x4a561f
call fcn.004ff107
test al, al
je 0x4a561f
call fcn.004a3adf
test al, al
je 0x4a5558
mov al, 1
jmp 0x4a5621
xor ebx, ebx
mov dword [ebp - 0x14], 0xf
push str.bEnableMixedContent
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
call fcn.0045446b
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x4a55d9
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], ebx
push eax
push 0x20019
push ebx
push str.SOFTWAREAdobeAcrobat_ReaderDCRestrictedSecuritySettings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a55d9
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], ebx
push ecx
push ebx
lea eax, [ebp - 0x28]
mov dword [ebp - 0x34], 4
cmovae eax, dword [ebp - 0x28]
push ebx
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a55d0
cmp dword [ebp - 0x30], eax
setne bl
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4a561b
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], 1
cmp eax, 0x1000
jb 0x4a5612
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.004ff107
mov eax, dword [ebp - 0x30]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
push eax
push ecx
call fcn.004ff107
pop ecx
pop ecx
mov al, bl
jmp 0x4a5621
xor al, al
call fcn.004e85f6
ret
Function at 0x4a5627
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x44
mov eax, 0x559786
call fcn.004e864c
call fcn.004a459e
test al, al
jne 0x4a5649
call fcn.004a4738
test al, al
je 0x4a57ae
call fcn.004ff107
test al, al
je 0x4a57ae
call fcn.004a3adf
test al, al
jne 0x4a57aa
push 0xf
pop esi
xor ebx, ebx
mov dword [ebp - 0x2c], esi
mov edi, str.bEnableNetworkAccess
mov dword [ebp - 0x30], ebx
push edi
lea ecx, [ebp - 0x40]
mov byte [ebp - 0x40], bl
call fcn.0045446b
lea eax, [ebp - 0x40]
mov dword [ebp - 4], ebx
push eax
call fcn.004a4835
neg al
pop ecx
mov ecx, dword [ebp - 0x2c]
sbb al, al
or dword [ebp - 4], 0xffffffff
inc al
mov byte [ebp - 0x49], al
cmp ecx, 0x10
jb 0x4a56e0
lea eax, [ecx + 1]
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], ecx
mov dword [ebp - 4], 1
cmp eax, 0x1000
jb 0x4a56d0
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.004ff107
mov eax, dword [ebp - 0x44]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.004ff107
or dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x49]
pop ecx
pop ecx
test al, al
jne 0x4a57aa
push edi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], esi
mov byte [ebp - 0x28], bl
call fcn.0045446b
cmp dword [ebp - 0x18], 0
mov dword [ebp - 4], 2
je 0x4a5764
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], ebx
push eax
push 0x20019
push ebx
push str.SOFTWAREAdobeAcrobat_ReaderDCRestrictedSecuritySettings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a5764
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x50]
push ecx
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x48], ebx
push ecx
push ebx
lea eax, [ebp - 0x28]
mov dword [ebp - 0x50], 4
cmovae eax, dword [ebp - 0x28]
push ebx
push eax
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a575b
cmp dword [ebp - 0x48], eax
setne bl
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4a57a6
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 4], 3
cmp eax, 0x1000
jb 0x4a579d
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.004ff107
mov eax, dword [ebp - 0x48]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x44]
push eax
push ecx
call fcn.004ff107
pop ecx
pop ecx
mov al, bl
jmp 0x4a57b0
mov al, 1
jmp 0x4a57b0
xor al, al
call fcn.004e85f6
ret
Function at 0x4a57b6
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x44
mov eax, 0x559786
call fcn.004e864c
call fcn.004ff107
test al, al
je 0x4a5927
call fcn.004a3adf
test al, al
jne 0x4a5923
push 0xf
pop esi
xor ebx, ebx
mov dword [ebp - 0x2c], esi
mov edi, str.bEnableDebugInterface
mov dword [ebp - 0x30], ebx
push edi
lea ecx, [ebp - 0x40]
mov byte [ebp - 0x40], bl
call fcn.0045446b
lea eax, [ebp - 0x40]
mov dword [ebp - 4], ebx
push eax
call fcn.004a4835
neg al
pop ecx
mov ecx, dword [ebp - 0x2c]
sbb al, al
or dword [ebp - 4], 0xffffffff
inc al
mov byte [ebp - 0x49], al
cmp ecx, 0x10
jb 0x4a5859
lea eax, [ecx + 1]
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], ecx
mov dword [ebp - 4], 1
cmp eax, 0x1000
jb 0x4a5849
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.004ff107
mov eax, dword [ebp - 0x44]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.004ff107
or dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x49]
pop ecx
pop ecx
test al, al
jne 0x4a5923
push edi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], esi
mov byte [ebp - 0x28], bl
call fcn.0045446b
cmp dword [ebp - 0x18], 0
mov dword [ebp - 4], 2
je 0x4a58dd
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], ebx
push eax
push 0x20019
push ebx
push str.SOFTWAREAdobeAcrobat_ReaderDCRestrictedSecuritySettings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a58dd
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x50]
push ecx
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x48], ebx
push ecx
push ebx
lea eax, [ebp - 0x28]
mov dword [ebp - 0x50], 4
cmovae eax, dword [ebp - 0x28]
push ebx
push eax
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a58d4
cmp dword [ebp - 0x48], eax
setne bl
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4a591f
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 4], 3
cmp eax, 0x1000
jb 0x4a5916
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.004ff107
mov eax, dword [ebp - 0x48]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x44]
push eax
push ecx
call fcn.004ff107
pop ecx
pop ecx
mov al, bl
jmp 0x4a5929
mov al, 1
jmp 0x4a5929
xor al, al
call fcn.004e85f6
ret
Function at 0x4a592f
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x28
mov eax, 0x5596af
call fcn.004e864c
call fcn.004a459e
test al, al
je 0x4a5a2c
call fcn.004ff107
test al, al
je 0x4a5a2c
call fcn.004a3adf
test al, al
je 0x4a5965
mov al, 1
jmp 0x4a5a2e
xor ebx, ebx
mov dword [ebp - 0x14], 0xf
push str.bEnableUniAccessFromFileUrls
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
call fcn.0045446b
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x4a59e6
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], ebx
push eax
push 0x20019
push ebx
push str.SOFTWAREAdobeAcrobat_ReaderDCRestrictedSecuritySettings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a59e6
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], ebx
push ecx
push ebx
lea eax, [ebp - 0x28]
mov dword [ebp - 0x34], 4
cmovae eax, dword [ebp - 0x28]
push ebx
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a59dd
cmp dword [ebp - 0x30], eax
setne bl
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4a5a28
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], 1
cmp eax, 0x1000
jb 0x4a5a1f
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.004ff107
mov eax, dword [ebp - 0x30]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
push eax
push ecx
call fcn.004ff107
pop ecx
pop ecx
mov al, bl
jmp 0x4a5a2e
xor al, al
call fcn.004e85f6
ret
Function at 0x4a5a39
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x44
mov eax, 0x559786
call fcn.004e864c
call fcn.004a459e
test al, al
je 0x4a5bb7
call fcn.004ff107
test al, al
je 0x4a5bb7
call fcn.004a3adf
test al, al
jne 0x4a5bb3
push 0xf
pop esi
xor ebx, ebx
mov dword [ebp - 0x2c], esi
mov edi, str.bSetProxyContextManagerTestMode
mov dword [ebp - 0x30], ebx
push edi
lea ecx, [ebp - 0x40]
mov byte [ebp - 0x40], bl
call fcn.0045446b
lea eax, [ebp - 0x40]
mov dword [ebp - 4], ebx
push eax
call fcn.004a4835
neg al
pop ecx
mov ecx, dword [ebp - 0x2c]
sbb al, al
or dword [ebp - 4], 0xffffffff
inc al
mov byte [ebp - 0x49], al
cmp ecx, 0x10
jb 0x4a5ae9
lea eax, [ecx + 1]
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], ecx
mov dword [ebp - 4], 1
cmp eax, 0x1000
jb 0x4a5ad9
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.004ff107
mov eax, dword [ebp - 0x44]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.004ff107
or dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x49]
pop ecx
pop ecx
test al, al
jne 0x4a5bb3
push edi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], esi
mov byte [ebp - 0x28], bl
call fcn.0045446b
cmp dword [ebp - 0x18], 0
mov dword [ebp - 4], 2
je 0x4a5b6d
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], ebx
push eax
push 0x20019
push ebx
push str.SOFTWAREAdobeAcrobat_ReaderDCRestrictedSecuritySettings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a5b6d
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x50]
push ecx
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x48], ebx
push ecx
push ebx
lea eax, [ebp - 0x28]
mov dword [ebp - 0x50], 4
cmovae eax, dword [ebp - 0x28]
push ebx
push eax
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a5b64
cmp dword [ebp - 0x48], eax
setne bl
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4a5baf
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 4], 3
cmp eax, 0x1000
jb 0x4a5ba6
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.004ff107
mov eax, dword [ebp - 0x48]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x44]
push eax
push ecx
call fcn.004ff107
pop ecx
pop ecx
mov al, bl
jmp 0x4a5bb9
mov al, 1
jmp 0x4a5bb9
xor al, al
call fcn.004e85f6
ret