joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400031c8
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, reloc.mfc90u.dll_CChevronOwnerDrawMenu::CChevronOwnerDrawMenu
mov rax, qword [0x1404f5550]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rdi, rcx
xor edx, edx
mov r8d, 0x3d0
add rcx, 0xa8
call sub.MSVCR90.dll_memset
and dword [rdi + 0x478], 0
and dword [rdi + 0x4f0], 0
and dword [rdi + 0x484], 0
and qword [rdi + reloc.mfc90u.dll_AfxPropPageCallback], 0
and qword [rdi + 0x4e8], 0
and qword [rdi + 0x490], 0
and dword [rdi + 0x4f8], 0
mov ebx, 1
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, ATL::CStringT<wchar_t,class StrTraitMFC_DLL<wchar_t,class ATL::ChTraitsCRT<wchar_t> > >::CStringT<wchar_t,class StrTraitMFC_DLL<wchar_t,class ATL::ChTraitsCRT<wchar_t> > >
mov dword [rdi + reloc.mfc90u.dll_AfxHelpEnabled], ebx
mov dword [rdi + reloc.mfc90u.dll_AfxInitExtensionModule], ebx
mov dword [rdi + AfxW2AHelper], ebx
mov dword [rsp + 0x20], ATL::CStringT<wchar_t,class StrTraitMFC_DLL<wchar_t,class ATL::ChTraitsCRT<wchar_t> > >::CStringT<wchar_t,class StrTraitMFC_DLL<wchar_t,class ATL::ChTraitsCRT<wchar_t> > >
call sub.MSVCR90.dll_memset
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x30], 2
jne 0x14000327c
cmp dword [rsp + 0x24], 5
jae 0x14000327e
xor ebx, ebx
mov dword [rdi + 0x488], ebx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1403c2380
mov rbx, qword [rsp + 0x168]
add rsp, reloc.mfc90u.dll_CChevronOwnerDrawMenu::CChevronOwnerDrawMenu
pop rdi
ret

Function at 0x140004084
Capabilities:
Find taskbar

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
lea rcx, str.Shell_TrayWnd
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowW]
mov rdi, rax
test rax, rax
je 0x1400040cc
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
lea rdx, [0x140003fc0]
mov r8, rbx
mov rcx, rdi
call qword [sym.imp.USER32.dll_EnumChildWindows]
jmp 0x140004161
mov edi, gethostbyname
lea rdx, [rsp + 0x20]
lea ecx, [rdi - 0x2b]
mov dword [rsp + 0x20], edi
call qword [sym.imp.SHELL32.dll_SHAppBarMessage]
test rax, rax
je 0x14000413a
mov eax, dword [rsp + 0x34]
test eax, eax
je 0x14000411b
sub eax, 1
je 0x1400040ff
sub eax, 1
je 0x14000411b
cmp eax, 1
jne 0x140004161
mov eax, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x40]
mov dword [rbx + 4], eax
mov eax, dword [rsp + 0x44]
mov dword [rbx + 0xc], eax
lea eax, [rcx - 0x64]
mov dword [rbx], eax
lea eax, [rcx - 0x10]
jmp 0x140004135
mov ecx, dword [rsp + 0x44]
lea eax, [rcx - 0x64]
mov dword [rbx + 4], eax
lea eax, [rcx - 0x10]
mov dword [rbx + 0xc], eax
mov eax, dword [rsp + 0x38]
mov dword [rbx], eax
mov eax, dword [rsp + 0x40]
mov dword [rbx + 8], eax
jmp 0x140004161
xor r9d, r9d
mov r8, rbx
xor edx, edx
mov ecx, edi
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
mov r11d, dword [rbx + 8]
mov eax, dword [rbx + 0xc]
sub r11d, 0x96
sub eax, 0x1e
mov dword [rbx + 4], eax
mov dword [rbx], r11d
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x14000497c
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp byte [0x1404f58e0], 0
mov rdi, rdx
mov rbx, rcx
jne 0x1400049d0
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400049c0
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1404f58d8], rax
jmp 0x1400049c7
mov rax, qword [0x1404f58d8]
mov byte [0x1404f58e0], 1
jmp 0x1400049d7
mov rax, qword [0x1404f58d8]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x1400049ed
mov r8d, dword [rbx + 8]
xor r9d, r9d
call rax
jmp 0x1400049f3
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140004ce8
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
push rsi
sub rsp, 0x60
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov rbp, r9
mov rsi, r8
and qword [r11 - 0x20], 0
and dword [rsp + 0x50], 0
mov eax, dword [rcx + 8]
or eax, 0x2001f
and qword [r11 - 0x30], 0
and qword [r11 - 0x38], 0
mov dword [rsp + 0x28], eax
and dword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rdx
mov rdx, qword [rcx]
lea rcx, [r11 - 0x20]
call fcn.140004a00
mov ebx, eax
test eax, eax
jne 0x140004d82
test rsi, rsi
setne al
test eax, eax
jne 0x140004d53
lea ebx, [rax + 0xd]
jmp 0x140004d82
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
mov r9d, 1
xor r8d, r8d
mov rdx, rbp
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
cmp qword [rsp + 0x48], 0
je 0x140004d9b
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rsp + 0x48], 0
and dword [rsp + 0x50], 0
mov eax, ebx
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x60
pop rsi
ret
Function at 0x140004db4
Capabilities:
Query or enumerate registry key

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
sub rsp, 0x280
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x1404f5550]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rbp, rdx
mov rsi, rcx
xor eax, eax
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], eax
mov edi, dword [rcx + 8]
or edi, 0x2001f
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, edi
xor r8d, r8d
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x140004f3b
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140004e3a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, eax
and qword [rsp + 0x40], 0
and dword [rsp + 0x48], 0
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x40], rcx
and edi, reloc.mfc90u.dll_CScrollView::CScrollView
mov dword [rsp + 0x48], edi
xor edi, edi
cmp ebx, edi
jne 0x140004f3d
mov dword [rsp + 0x50], SerializeElements<class ATL::CStringT<wchar_t,class StrTraitMFC_DLL<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > >
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x70]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, edi
jne 0x140004efe
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x40]
call fcn.140004db4
mov ebx, eax
cmp eax, edi
jne 0x140004ee7
mov dword [rsp + 0x50], SerializeElements<class ATL::CStringT<wchar_t,class StrTraitMFC_DLL<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > >
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x70]
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, edi
je 0x140004e94
jmp 0x140004efe
mov rcx, qword [rsp + 0x40]
cmp rcx, rdi
je 0x140004f52
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rdi
jmp 0x140004f52
mov rcx, qword [rsp + 0x40]
cmp rcx, rdi
je 0x140004f13
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x48], edi
mov rdx, rbp
mov rcx, rsi
call fcn.14000497c
mov ebx, eax
mov rcx, qword [rsp + 0x40]
cmp rcx, rdi
je 0x140004f52
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rdi
jmp 0x140004f52
xor edi, edi
mov rcx, qword [rsp + 0x40]
cmp rcx, rdi
je 0x140004f52
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x48], edi
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1403c2380
mov rbx, qword [rsp + reloc.mfc90u.dll_CInternetException::CInternetException]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret
Function at 0x140014b80
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x1404f5550]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbp, qword [rsp + 0xb0]
mov r13, qword [rsp + 0xb8]
mov ebx, edx
xor edx, edx
mov r12, r8
mov rsi, rcx
lea r8d, [rdx + 0x10]
lea rcx, [rsp + 0x38]
mov r14, r9
call sub.MSVCR90.dll_memset
mov ecx, DDX_FieldText
call sub.mfc90u.dll_new__
lea rdx, [rsp + 0x38]
xor r8d, r8d
mov ecx, ebx
mov dword [rsp + 0x30], 0x3e8
mov rdi, rax
call qword [sym.imp.SETUPAPI.dll_CM_Enumerate_Classes]
and dword [rbp], 0
cmp eax, 0x1f
jne 0x140014c01
mov eax, 0xfffffffe
jmp 0x140014d51
cmp eax, 0x25
jne 0x140014c0e
or eax, 0xffffffff
jmp 0x140014d51
test eax, eax
je 0x140014c1c
mov eax, 0xfffffffd
jmp 0x140014d51
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
lea rcx, [rsp + 0x38]
mov rdx, rdi
call qword [sym.imp.SETUPAPI.dll_SetupDiClassNameFromGuidW]
or rbx, 0xffffffffffffffff
cmp dword [rsp + 0x30], 0
jbe 0x140014c79
mov rcx, rdi
call sub.mfc90u.dll_delete__
mov r11d, dword [rsp + 0x30]
lea eax, [rbx + 3]
mul r11
cmovo rax, rbx
mov rcx, rax
call sub.mfc90u.dll_new__
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
lea rcx, [rsp + 0x38]
mov rdx, rax
mov rdi, rax
call qword [sym.imp.SETUPAPI.dll_SetupDiClassNameFromGuidW]
lea rcx, [rsi + 0x18]
lea rdx, [rsp + 0x38]
mov r8, r13
call qword [sym.imp.SETUPAPI.dll_SetupDiGetClassImageIndex]
lea rcx, [rsp + 0x38]
mov r9d, 2
xor r8d, r8d
xor edx, edx
call qword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsW]
mov r13, rax
cmp rax, rbx
jne 0x140014cc7
and dword [rbp], 0
lea r8, [0x14040a96c]
mov edx, 0x3e8
mov rcx, r12
call qword [sym.imp.MSVCR90.dll_wcscpy_s]
jmp 0x140014d47
and qword [rsp + 0x20], 0
xor r9d, r9d
lea rcx, [rsp + 0x38]
lea r8d, [r9 + 1]
mov edx, 0x2000000
call qword [sym.imp.SETUPAPI.dll_SetupDiOpenClassRegKeyExW]
mov rsi, rax
cmp rax, rbx
je 0x140014ca9
lea r9, [rsp + 0x34]
mov ebx, 0x3e8
mov r8, r14
xor edx, edx
mov rcx, rax
mov dword [rsp + 0x34], ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
je 0x140014d1f
lea r8, [0x14040a96c]
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.MSVCR90.dll_wcscpy_s]
mov rcx, r13
call qword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
mov r8, rdi
mov rdx, rbx
mov rcx, r12
call qword [sym.imp.MSVCR90.dll_wcscpy_s]
mov rcx, rsi
mov dword [rbp], 1
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rdi
call sub.mfc90u.dll_delete__
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1403c2380
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140014d70
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r14
mov eax, reloc.mfc90u.dll_CDaoTableDef::GetValidationRule
call fcn.1403c3130
sub rsp, rax
mov rax, qword [0x1404f5550]
xor rax, rsp
mov qword [rsp + 0xff0], rax
movdqu xmm0, xmmword [rdx]
mov rsi, rcx
mov ecx, DDX_FieldText
mov rbx, r8
movdqu xmmword [rsp + 0x40], xmm0
call sub.mfc90u.dll_new__
mov r12d, 0x3e8
lea r9, [rsp + 0x30]
lea rcx, [rsp + 0x40]
xor edi, edi
mov r8d, r12d
mov rdx, rax
mov rbp, rax
mov dword [rsp + 0x30], r12d
mov word [rsp + 0x50], di
call qword [sym.imp.SETUPAPI.dll_SetupDiClassNameFromGuidW]
or r14, 0xffffffffffffffff
cmp dword [rsp + 0x30], edi
jbe 0x140014e24
mov rcx, rbp
call sub.mfc90u.dll_delete__
mov r11d, dword [rsp + 0x30]
lea eax, [rdi + 2]
mul r11
cmovo rax, r14
mov rcx, rax
call sub.mfc90u.dll_new__
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
lea rcx, [rsp + 0x40]
mov rdx, rax
mov rbp, rax
call qword [sym.imp.SETUPAPI.dll_SetupDiClassNameFromGuidW]
lea rcx, [rsi + 0x18]
lea r8, [rsp + 0x34]
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x34], edi
call qword [sym.imp.SETUPAPI.dll_SetupDiGetClassImageIndex]
xor r9d, r9d
lea edx, [r9 + 1]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rdi
mov r8d, edx
call qword [sym.imp.SETUPAPI.dll_SetupDiOpenClassRegKeyExW]
mov rsi, rax
cmp rax, r14
jne 0x140014e7b
lea r8, [0x14040a96c]
lea rcx, [rsp + 0x820]
mov rdx, r12
call qword [sym.imp.MSVCR90.dll_wcscpy_s]
jmp 0x140014f09
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x50]
xor edx, edx
mov rcx, rax
mov dword [rsp + 0x38], r12d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
cmp eax, edi
je 0x140014eae
lea r8, [0x14040a96c]
lea rcx, [rsp + 0x50]
mov rdx, r12
call qword [sym.imp.MSVCR90.dll_wcscpy_s]
lea rcx, [rsp + 0x820]
mov r8, rbp
mov rdx, r12
call qword [sym.imp.MSVCR90.dll_wcscpy_s]
lea rdx, [rsp + 0x820]
mov rcx, rbx
call qword [sym.imp.mfc90u.dll_CTreeCtrl::CTreeCtrl]
lea rcx, [rbx + 8]
cmp word [rsp + 0x50], di
je 0x140014eeb
lea rdx, [rsp + 0x50]
call qword [sym.imp.mfc90u.dll_CTreeCtrl::CTreeCtrl]
jmp 0x140014ef4
mov rdx, rbx
call qword [sym.imp.mfc90u.dll_CToolBarCtrl::CToolBarCtrl]
mov eax, dword [rsp + 0x34]
mov rcx, rsi
mov dword [rbx + 0x10], eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, 1
mov rcx, rbp
call sub.mfc90u.dll_delete__
mov eax, edi
mov rcx, qword [rsp + 0xff0]
xor rcx, rsp
call fcn.1403c2380
mov rbx, qword [rsp + 0x1048]
add rsp, reloc.mfc90u.dll_CDaoTableDef::GetValidationRule
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400157fc
Capabilities:
Check http status code
Delete file
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
mov eax, 0x80070
call fcn.1403c3130
sub rsp, rax
mov rax, qword [0x1404f5550]
xor rax, rsp
mov qword [rsp + 0x80060], rax
mov rbp, qword [rsp + 0x800c0]
and dword [rsp + 0x30], 0
mov rbx, rdx
mov r12, rcx
mov rdi, r8
lea rdx, str.Accept:___r_n_r_n
lea rcx, [rsp + 0x80040]
mov r8d, 0x20
mov rsi, r9
call sub.MSVCR90.dll_memcpy
lea rcx, [rsp + 0x80040]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
and qword [rsp + 0x28], 0
lea r8, [rsp + 0x80040]
mov r9d, eax
mov rdx, rdi
mov rcx, rbx
mov dword [rsp + 0x20], 0x20000000
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov rdi, rax
test rax, rax
jne 0x14001589b
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400159a7
lea rdx, [0x1404149e8]
mov rcx, rsi
call qword [sym.imp.MSVCR90.dll__wfopen]
mov rbx, rax
test rax, rax
je 0x1400159a7
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov r8d, 0x10000
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x140015995
and dword [rsp + 0x34], 0
and dword [rsp + 0x38], 0
lea rax, [rsp + 0x38]
lea r9, [rsp + 0x3c]
lea r8, [rsp + 0x34]
mov edx, 0x20000013
mov rcx, rdi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x3c], 4
call qword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x14001591a
cmp dword [rsp + 0x34], reloc.mfc90u.dll_CFile::CFile
je 0x14001595f
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x140015973
lea rcx, [rsp + 0x40]
mov r8, rax
mov r9, rbx
mov edx, 1
call qword [sym.imp.MSVCR90.dll_fwrite]
cmp dword [r12 + 0x98], 0
jne 0x140015956
mov rax, qword [rbp]
mov edx, dword [rsp + 0x30]
mov rcx, rbp
call qword [rax + 0x48]
jmp 0x1400158b7
mov rcx, rbx
call qword [sym.imp.MSVCR90.dll_fflush]
mov rcx, rbx
call qword [sym.imp.MSVCR90.dll_fclose]
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x14001599e
mov rcx, rbx
call qword [sym.imp.MSVCR90.dll_fflush]
mov rcx, rbx
call qword [sym.imp.MSVCR90.dll_fclose]
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, 1
jmp 0x1400159a9
mov rcx, rbx
call qword [sym.imp.MSVCR90.dll_fclose]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
mov rcx, qword [rsp + 0x80060]
xor rcx, rsp
call fcn.1403c2380
add rsp, 0x80070
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400164f4
Capabilities:
Create http request

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
push rdi
sub rsp, 0x60
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov rsi, r8
mov rdi, rdx
call fcn.1400206e0
cmp dword [rax + 0x1050], 0
je 0x1400166ca
call fcn.1400206e0
mov rcx, rax
lea rdx, [rsp + 0x48]
call fcn.1400144c0
nop
call fcn.1400206e0
mov rcx, rax
lea rdx, [rsp + 0x38]
call fcn.140014500
nop
call fcn.1400206e0
mov rcx, rax
lea rdx, [rsp + 0x30]
call fcn.140014540
nop
call fcn.1400206e0
mov ebx, dword [rax + 0x1060]
lea rcx, [rsp + 0x40]
call qword [0x140409500]
nop
mov r8d, ebx
lea rdx, [0x14040eec4]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc90u.dll_COleServerDoc::XOleObject::EnumAdvise]
lea r8, [rsp + 0x48]
lea rdx, str.HTTPhttp:__
lea rcx, [rsp + 0x88]
call fcn.140015c64
nop
lea rdx, [0x140414b30]
lea rcx, [rsp + 0x88]
call qword [sym.imp.mfc90u.dll_COleCurrency::operator_]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x88]
call qword [sym.imp.mfc90u.dll_]
lea rcx, [rsp + 0x88]
call qword [sym.imp.mfc90u.dll_CDumpContext::operator___1]
mov rbx, rax
mov rcx, rdi
call qword [sym.imp.mfc90u.dll_CDumpContext::operator___1]
mov rcx, rax
and dword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rbx
lea edx, [r9 + 3]
call qword [sym.imp.WININET.dll_InternetOpenW]
mov qword [rsi], rax
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc90u.dll_CStatusBar::GetThisMessageMap]
test al, al
jne 0x140016680
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc90u.dll_CStatusBar::GetThisMessageMap]
test al, al
jne 0x140016680
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc90u.dll_CDocObjectServer::XOleObject::GetExtent]
mov ebx, eax
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc90u.dll_CDumpContext::operator___1]
mov r8, rax
mov r9d, ebx
mov edx, 0x2b
mov rcx, qword [rsi]
call qword [sym.imp.WININET.dll_InternetSetOptionW]
test eax, eax
je 0x140016680
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc90u.dll_CDocObjectServer::XOleObject::GetExtent]
mov ebx, eax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc90u.dll_CDumpContext::operator___1]
mov r8, rax
mov r9d, ebx
mov edx, 0x2c
mov rcx, qword [rsi]
call qword [sym.imp.WININET.dll_InternetSetOptionW]
nop
lea rcx, [rsp + 0x88]
call qword [sym.imp.mfc90u.dll_CView::CView]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc90u.dll_CView::CView]
nop
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc90u.dll_CView::CView]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc90u.dll_CView::CView]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc90u.dll_CView::CView]
nop
mov rcx, rdi
call qword [sym.imp.mfc90u.dll_CView::CView]
jmp 0x1400166f5
mov rcx, rdi
call qword [sym.imp.mfc90u.dll_CDumpContext::operator___1]
mov rcx, rax
and dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.WININET.dll_InternetOpenW]
mov qword [rsi], rax
mov rcx, rdi
call qword [sym.imp.mfc90u.dll_CView::CView]
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140016708
Capabilities:
Create directory

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x690
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x20], rsi
mov rax, qword [0x1404f5550]
xor rax, rsp
mov qword [rsp + CComboBox::Create], rax
mov rsi, r8
mov rdi, rdx
lea rcx, [r11 - 0x38]
call qword [0x140409500]
nop
lea rcx, [rsp + reloc.mfc90u.dll_CPropertySheet::ContinueModal]
call qword [0x140409500]
nop
lea rcx, [rsp + 0x670]
call qword [0x140409500]
nop
lea rcx, [rsp + 0x678]
call qword [0x140409500]
nop
call fcn.1400206e0
mov rcx, rax
lea rdx, [rsp + 0x20]
call fcn.140014440
nop
mov rcx, rax
call qword [sym.imp.mfc90u.dll_CDumpContext::operator___1]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
nop
lea rcx, [rsp + 0x20]
call qword [sym.imp.mfc90u.dll_CView::CView]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
jne 0x14001681b
lea rcx, [rsp + 0x20]
call qword [0x140409500]
nop
mov edx, CRecentFileList::~CRecentFileList
lea rcx, [rsp + 0x20]
call qword [sym.imp.mfc90u.dll_CPreviewDC::GrayStringW]
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.140038eb0
nop
lea rcx, [rsp + 0x20]
call qword [sym.imp.mfc90u.dll_CView::CView]
nop
lea rcx, [rsp + 0x678]
call qword [sym.imp.mfc90u.dll_CView::CView]
nop
lea rcx, [rsp + 0x670]
call qword [sym.imp.mfc90u.dll_CView::CView]
nop
lea rcx, [rsp + reloc.mfc90u.dll_CPropertySheet::ContinueModal]
call qword [sym.imp.mfc90u.dll_CView::CView]
nop
xor bl, bl
jmp 0x1400168a5
call fcn.1400206e0
mov rcx, rax
lea rdx, [rsp + 0x20]
call fcn.140014440
nop
mov rdx, rax
lea rcx, [rsp + reloc.mfc90u.dll_COleServerDoc::XOleInPlaceActiveObject::ContextSensitiveHelp]
call qword [sym.imp.mfc90u.dll_CToolBarCtrl::CToolBarCtrl]
nop
lea rcx, [rsp + 0x20]
call qword [sym.imp.mfc90u.dll_CView::CView]
mov r11, qword [rsi]
mov rdx, rdi
mov rcx, rsi
call qword [r11 + 0x58]
lea r8, [rsp + 0x30]
mov rdx, rdi
mov rcx, rdi
call fcn.14001bdb0
mov bl, al
mov r8, qword [rsi]
mov rdx, rdi
mov rcx, rsi
call qword [r8 + 0x60]
nop
lea rcx, [rsp + 0x678]
call qword [sym.imp.mfc90u.dll_CView::CView]
nop
lea rcx, [rsp + 0x670]
call qword [sym.imp.mfc90u.dll_CView::CView]
nop
lea rcx, [rsp + reloc.mfc90u.dll_CPropertySheet::ContinueModal]
call qword [sym.imp.mfc90u.dll_CView::CView]
nop
lea rcx, [rsp + reloc.mfc90u.dll_COleServerDoc::XOleInPlaceActiveObject::ContextSensitiveHelp]
call qword [sym.imp.mfc90u.dll_CView::CView]
mov al, bl
mov rcx, qword [rsp + 0x680]
xor rcx, rsp
call fcn.1403c2380
lea r11, [rsp + 0x690]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14001834c
Capabilities:
Create directory

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov rsi, r8
mov r13, rdx
mov r12, rcx
xor r14b, r14b
and dword [rcx + 0x98], 0
call fcn.1400206e0
mov rcx, rax
lea rdx, [rsp + 0x70]
call fcn.140014440
nop
mov rcx, rax
call qword [sym.imp.mfc90u.dll_CDumpContext::operator___1]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc90u.dll_CView::CView]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
jne 0x1400183f8
lea rcx, [rsp + 0x70]
call qword [0x140409500]
nop
mov edx, CRecentFileList::~CRecentFileList
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc90u.dll_CPreviewDC::GrayStringW]
xor edx, edx
lea rcx, [rsp + 0x70]
call fcn.140038eb0
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc90u.dll_CView::CView]
xor al, al
jmp 0x1400184e0
mov rax, qword [rsi]
mov edx, dword [r13 + 0x38]
mov rcx, rsi
call qword [rax + 0x50]
call fcn.1400206e0
mov rcx, rax
lea rdx, [rsp + 0x70]
call fcn.140014440
mov rbx, rax
call fcn.1400206e0
lea rcx, [rax + 0x1038]
mov rdx, rbx
call qword [sym.imp.mfc90u.dll_CToolBarCtrl::CToolBarCtrl]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc90u.dll_CView::CView]
call fcn.1400206e0
mov rcx, rax
call fcn.14001dd34
mov rax, qword [r13 + 0x30]
mov rcx, qword [rax]
mov qword [rsp + 0x38], rcx
mov rax, qword [r13]
mov qword [rsp + 0x30], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
mov rbp, qword [r13 + 0x30]
mov rbx, qword [rsp + 0x30]
test rbx, rbx
je 0x14001847c
cmp rbx, qword [r13]
je 0x140018482
call qword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
mov rdi, qword [rsp + 0x38]
cmp rdi, rbp
je 0x1400184d4
test rbx, rbx
jne 0x14001849c
call qword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
xor r11d, r11d
jmp 0x14001849f
mov r11, qword [rbx]
cmp rdi, qword [r11 + 0x30]
jne 0x1400184ab
call qword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
cmp dword [r12 + 0x98], 0
jne 0x1400184d4
mov r8, rsi
mov rdx, qword [rdi + 0x20]
mov rcx, r12
call fcn.140016708
mov r14b, al
lea rcx, [rsp + 0x30]
call fcn.140029938
jmp 0x140018468
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x68]
mov al, r14b
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret