Function at 0x1400798b0
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x1f0]
sub rsp, 0x2f0
mov rax, qword [0x140174940]
xor rax, rsp
mov qword [rbp + reloc.mfc140u.dll_CDocTemplate::CDocTemplate], rax
mov rdi, rcx
mov dword [rsp + 0x30], 0
mov dword [rcx + 0x28], edx
mov rax, qword [rcx + 0x10]
test rax, rax
jne 0x14007992b
mov ecx, 0x4008
call sub.mfc140u.dll_operator_2
mov qword [rdi + 0x10], rax
test rax, rax
jne 0x14007992b
lea r9, str.DBbase::Initialize__Unable_to_allocate_ubuf
mov r8d, dword [rdi + 0x28]
lea edx, [rax + 1]
mov rcx, qword [0x1401776d0]
call fcn.1400a5ff0
xor eax, eax
jmp 0x140079ccc
mov dword [rdi + 0x2c], 0
xor esi, esi
mov rax, qword [0x1401776e0]
cmp qword [rax + 0x60], rsi
jle 0x1400799c6
xor ebx, ebx
test rbx, rbx
js 0x140079cf4
cmp rbx, qword [rax + 0x60]
jge 0x140079cf4
mov rcx, qword [rax + 0x58]
mov rdx, qword [rcx + rbx*8]
mov rcx, qword [rdx + 0x90]
cmp dword [rcx - 0x10], 0
je 0x14007997d
mov dword [rdi + 0x2c], 1
mov rax, qword [0x1401776e0]
mov rcx, qword [rdx + 0xa8]
cmp dword [rcx - 0x10], 0
je 0x1400799b8
mov rcx, qword [rdx + 0xb0]
cmp dword [rcx - 0x10], 0
je 0x1400799b8
cmp rbx, qword [rax + 0x60]
jge 0x140079cf4
mov rcx, qword [rax + 0x58]
mov rdx, qword [rcx + rbx*8]
mov rcx, rdi
call fcn.140079d70
mov rax, qword [0x1401776e0]
inc esi
inc rbx
movsxd rcx, esi
cmp rcx, qword [rax + 0x60]
jl 0x140079947
xor r9d, r9d
cmp dword [rdi + 0x2c], r9d
jne 0x140079a21
mov r10, qword [rax + 0x88]
xor r8d, r8d
nop dword [rax]
movsxd rcx, r9d
cmp rcx, r10
jge 0x140079a21
test r8, r8
js 0x140079cf4
cmp r8, r10
jge 0x140079cf4
mov rcx, qword [rax + 0x80]
mov rdx, qword [rcx + r8*8]
mov rcx, qword [rdx + 0x90]
cmp dword [rcx - 0x10], 0
jne 0x140079a1a
inc r9d
inc r8
jmp 0x1400799e0
mov dword [rdi + 0x2c], 1
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
mov rcx, qword [0x1401776e0]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantTimeToSystemTime]
mov r8, rax
lea r9, str.LoginServicewindex_q
lea rdx, str._s_s
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCZoomKernel::Filter]
mov rbx, qword [rsp + 0x40]
lea rcx, [rbp + 0x1b8]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rbp + 0x1c8]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
mov qword [rsp + 0x60], 0xffffffffffffffff
mov qword [rsp + 0x60], 0xffffffffffffffff
mov dword [rbp + 0x1d8], UnRegisterTypeLib
mov rdx, rbx
lea rcx, [rbp + 0x1b8]
call qword [sym.imp.mfc140u.dll_CMFCControlRendererInfo::CMFCControlRendererInfo]
mov r8d, 1
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x1b8]
call qword [sym.imp.mfc140u.dll_Ordinal_12600]
nop
lea rdx, [0x1400f6ad4]
mov rcx, rax
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
je 0x140079b1c
lea rdx, [0x1400f6ad4]
lea rcx, [rbp + 0x1b8]
call qword [sym.imp.mfc140u.dll_COleCurrency::operator__1]
lea rdx, [0x140122bd8]
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.mfc140u.dll_CMFCControlRendererInfo::CMFCControlRendererInfo]
nop
lea rcx, [rbp + 0x1b8]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov dword [rsp + 0x30], 1
mov r9, qword [rbp + 0x1c0]
mov eax, dword [r9 - 0x10]
mov rdx, qword [rbp + 0x1b8]
mov dword [rsp + 0x20], eax
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0x1c8]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
mov eax, 1
and eax, 0xfffffffe
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov dword [rbp + 0x1dc], 0
nop dword [rax]
mov rax, qword [rsp + 0x60]
lea rdx, [rsp + 0x68]
cmp rax, 0xffffffffffffffff
jne 0x140079be6
mov rcx, qword [rbp + 0x1c8]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x60], rax
cmp rax, 0xffffffffffffffff
jne 0x140079bf8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x1dc], eax
jmp 0x140079c5e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x140079c38
mov rax, qword [rsp + 0x60]
mov ecx, dword [rsp + 0x68]
test dword [rbp + 0x1d8], ecx
je 0x140079bb5
test cl, 0x10
jne 0x140079bb5
lea rcx, [rbp - 0x6c]
lea rax, [rbp + 0x19c]
cmp word [rbp - 0x6c], 0
cmove rcx, rax
xor edx, edx
lea r8d, [rdx + 0x10]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstoul]
cmp ax, word [rdi + 8]
jbe 0x140079bb0
mov word [rdi + 8], ax
jmp 0x140079bb0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x1dc], eax
mov rcx, qword [rsp + 0x60]
cmp rcx, 0xffffffffffffffff
je 0x140079c55
call qword [sym.imp.KERNEL32.dll_FindClose]
mov qword [rsp + 0x60], 0xffffffffffffffff
mov rcx, qword [rsp + 0x60]
cmp rcx, 0xffffffffffffffff
je 0x140079c6f
call qword [sym.imp.KERNEL32.dll_FindClose]
mov qword [rsp + 0x60], 0xffffffffffffffff
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp + 0x1c8]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp + 0x1b8]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov eax, 1
mov rcx, qword [rbp + reloc.mfc140u.dll_CDocTemplate::CDocTemplate]
xor rcx, rsp
call fcn.1400c7c30
lea r11, [rsp + 0x2f0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call sub.mfc140u.dll_AfxRegDeleteKey
int3