joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004ae50
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x14004ae78
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14004ae9e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14004aea0
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x14004aef9
test ecx, ecx
jle 0x14004aed9
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x14004aef9
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14004aef9
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x14004af20
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x14004af42
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x14004af58
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14004af74
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14004af76
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14004afb2
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14004b04e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14004afed
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14004b02e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14004b04e
cmp rbx, rax
ja 0x14004b000
test rbx, rbx
je 0x14004b04e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x14004b480
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140060010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14004b4ad
xor eax, eax
jmp 0x14004b619
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x14004b4e7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x14004b4e7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x14004b619
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14004b60c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14004b52a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14004b555
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14004b611
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14004b5c4
sub eax, 1
je 0x14004b5c4
cmp eax, 2
jne 0x14004b60c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14004b611
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x14004b5f2
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14004b60c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x14004b611
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14004de60
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x14004c340
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140060010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14004c413
cmp byte [rcx + 0x71], 0
je 0x14004c413
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14004c40f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14004c3d4
sub eax, 1
je 0x14004c3d8
cmp eax, 2
jne 0x14004c40f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14004de60
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x14004c406
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14004c40f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14004c3bc
xor al, al
jmp 0x14004c3bc
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14004de60
add rsp, 0x60
pop rbx
ret

Function at 0x14004eb68
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14004ebb2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14004ebb2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14004ebb2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14004ebb2
cmp dword [rcx + 0x84], 0xe
jbe 0x14004ebb2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14004ebb4
xor al, al
add rsp, 0x28
ret
Function at 0x140001570
Capabilities:
Create directory

Disassembly:
push rbx
sub rsp, 0x70
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x14007d008]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rbx, rdx
mov rcx, rdx
call qword [sym.imp.mfc140u.dll_CMFCToolBar::DrawButton]
call qword [sym.imp.acdb21.dll_class_AcDbHostApplicationServices____ptr64___cdecl_acdbHostApplicationServices_void_]
mov rcx, qword [rax]
mov r8, qword [rcx + 0x40]
lea rdx, [rsp + 0x28]
mov rcx, rax
call r8
test eax, eax
je 0x1400015bd
xor eax, eax
jmp 0x140001655
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__2]
nop
lea rdx, str.Recent
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_COleCurrency::operator_]
lea rcx, [rsp + 0x38]
call qword [sym.imp.ac1st21.dll_public:_void___cdecl_CAdUiPathname::constructor_void____ptr64]
nop
xor r8d, r8d
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x38]
call qword [sym.imp.ac1st21.dll_public_virtual:_enum_PathErr___cdecl_CAdUiPathname::Parse_wchar_t_const____ptr64__bool____ptr64]
lea rcx, [rsp + 0x38]
call qword [sym.imp.ac1st21.dll_public:_bool___cdecl_CAdUiPathname::Exists_void____ptr64]
test al, al
jne 0x140001623
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140001623
xor ebx, ebx
jmp 0x14000163c
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
mov rax, qword [rbx]
xor ebx, ebx
cmp dword [rax - 0x10], ebx
setne bl
lea rcx, [rsp + 0x38]
call qword [sym.imp.ac1st21.dll_public_virtual:_void___cdecl_CAdUiPathname::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov eax, ebx
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400489c0
add rsp, 0x70
pop rbx
ret
Function at 0x140002fc0
Capabilities:
Get file version info

Disassembly:
push rdi
mov eax, 0xfa70
call fcn.14004a590
sub rsp, rax
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0xfa90], rbx
mov rax, qword [0x14007d008]
xor rax, rsp
mov qword [rsp + 0xfa60], rax
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x30], 0
call qword [sym.imp.mfc140u.dll_Ordinal_296]
mov dword [rsp + 0x30], 1
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
test eax, eax
je 0x140003096
lea r9, [rsp + 0x60]
xor edx, edx
mov r8d, 0xfa00
mov rcx, rdi
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x140003096
lea r9, [rsp + 0x54]
lea r8, [rsp + 0x48]
lea rdx, [0x140053370]
lea rcx, [rsp + 0x60]
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x140003096
mov rcx, qword [rsp + 0x48]
mov r8d, dword [rcx + 0x10]
movzx edx, word [rcx + 0x16]
movzx r9d, r8w
shr r8d, 0x10
mov dword [rsp + 0x20], edx
lea rdx, str._d._d_d
mov rcx, rbx
call qword [sym.imp.mfc140u.dll_CMFCZoomKernel::Filter]
mov rax, rbx
mov rcx, qword [rsp + 0xfa60]
xor rcx, rsp
call fcn.1400489c0
mov rbx, qword [rsp + 0xfa90]
add rsp, 0xfa70
pop rdi
ret

Function at 0x14000be60
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x14007d008]
xor rax, rsp
mov qword [rsp + 0x38], rax
movzx eax, word [rdx]
mov rdi, rdx
mov rsi, rcx
test ax, ax
je 0x14000bf49
mov ebp, 0xd
mov edx, dword [rsi + 8]
lea ecx, [rdx - 1]
cmp ecx, 1
jbe 0x14000bef1
lea ecx, [rdx - 3]
cmp ecx, 1
jbe 0x14000bea9
xor ebx, ebx
jmp 0x14000bf1e
cmp edx, 3
lea rcx, [rsp + 0x30]
mov ebx, 2
sete dl
cmp ax, 0xa
jne 0x14000bedf
cmp byte [rsi + 0xd], 0
je 0x14000bedf
mov ecx, 0xd00
test dl, dl
mov ebx, 4
cmovne cx, bp
mov word [rsp + 0x30], cx
lea rcx, [rsp + 0x32]
test dl, dl
je 0x14000bee8
mov word [rcx], ax
jmp 0x14000bf1e
rol ax, 8
mov word [rcx], ax
jmp 0x14000bf1e
movzx ecx, byte [rsi + 0xd]
cmp edx, 1
mov byte [rsp + 0x28], cl
lea rdx, [rsp + 0x30]
movzx ecx, byte [rsi + 0xc]
sete r9b
mov byte [rsp + 0x20], cl
mov r8d, 8
movzx ecx, ax
call qword [sym.imp.AcPal.dll_public:_static_unsigned_int___cdecl_AdCharFormatter::wcharToAnsiOrUtf8_wchar_t__char____ptr64__unsigned_int__bool__bool__bool_]
mov ebx, eax
mov r9, qword [rsi]
lea rcx, [rsp + 0x30]
mov r8d, ebx
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp eax, ebx
jne 0x14000bf65
movzx eax, word [rdi + 2]
add rdi, 2
test ax, ax
jne 0x14000be92
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400489c0
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
or eax, 0xffffffff
jmp 0x14000bf4b
Function at 0x14000c620
Capabilities:
Delete file

Disassembly:
push rdi
sub rsp, 0x60
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x80], rbx
mov rax, qword [0x14007d008]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rdi, rdx
mov rbx, rcx
mov byte [rsp + 0x20], 0
lea rcx, [rsp + 0x30]
call qword [sym.imp.acdb21.dll_public:_void___cdecl_AdXREFString::constructor_void____ptr64]
nop
lea rcx, [rsp + 0x30]
call fcn.140011100
test al, al
jne 0x14000c680
mov byte [rsp + 0x22], al
lea rdx, [0x140073540]
lea rcx, [rsp + 0x22]
call sub.VCRUNTIME140.dll__CxxThrowException
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14000c710
test al, al
jne 0x14000c6a6
mov byte [rsp + 0x23], al
lea rdx, [0x140073540]
lea rcx, [rsp + 0x23]
call sub.VCRUNTIME140.dll__CxxThrowException
mov byte [rsp + 0x20], 1
mov r8, rdi
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140010860
movzx ebx, al
jmp 0x14000c6cc
lea rcx, [rsp + 0x30]
call qword [sym.imp.acdb21.dll_public:_wchar_t_const____ptr64___cdecl_AdXREFString::operator_wchar_t_const____ptr64_void_const___ptr64]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
lea rcx, [rsp + 0x30]
call qword [sym.imp.acdb21.dll_public_virtual:_void___cdecl_AdXREFString::destructor_void____ptr64]
movzx eax, bl
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400489c0
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret

Function at 0x140010770
Capabilities:
Get geographical location

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x60
mov qword [r11 - 0x48], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [0x14007d008]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rsi, rcx
xor r9d, r9d
lea r8, [r11 - 0x18]
lea edx, [r9 + 0xc]
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ebx, eax
lea ecx, [rax + 1]
movsxd r8, ecx
mov eax, 2
mul r8
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
mov r9d, ebx
mov r8, rax
mov edx, 0xc
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x1400107fe
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor al, al
jmp 0x140010835
mov rdx, rdi
lea rcx, [rsp + 0x28]
call qword [sym.imp.acdb21.dll_public:_void___cdecl_AdXREFString::constructor_wchar_t_const____ptr64____ptr64]
nop
mov rax, qword [rsi]
lea rdx, [rsp + 0x28]
mov rcx, rsi
call qword [rax + 0xd8]
nop
lea rcx, [rsp + 0x28]
call qword [sym.imp.acdb21.dll_public_virtual:_void___cdecl_AdXREFString::destructor_void____ptr64]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400489c0
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x140011100
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, reloc.mfc140u.dll_CDockingManager::CDockingManager
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x14007d008]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rbx, rcx
mov byte [rsp + 0x20], 0
lea rdx, [rsp + 0x30]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x14001117a
lea r9, [rsp + 0x240]
xor r8d, r8d
lea rdx, [0x1400549c8]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x14001117a
lea rdx, [rsp + 0x240]
mov rcx, rbx
call qword [sym.imp.acdb21.dll_public:_class_AdXREFString_const____ptr64___cdecl_AdXREFString::operator_wchar_t_const____ptr64____ptr64]
mov al, 1
mov byte [rsp + 0x20], al
jmp 0x140011196
mov byte [rsp + 0x21], 0
lea rdx, [0x140073540]
lea rcx, [rsp + 0x21]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
movzx eax, byte [rsp + 0x20]
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.1400489c0
add rsp, reloc.mfc140u.dll_CDockingManager::CDockingManager
pop rbx
ret
Function at 0x14001ab60
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x14007d008]
xor rax, rsp
mov qword [rsp + 0x68], rax
lea rax, [r11 - 0x18]
mov dword [r11 - 0x20], r9d
mov qword [r11 - 0x38], rax
xor edi, edi
lea rax, [r11 - 0x28]
mov rbx, r8
mov qword [r11 - 0x40], rax
xor r9d, r9d
mov qword [r11 - 0x48], rdi
xor r8d, r8d
mov dword [rsp + 0x28], 0x20006
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x20], edi
call fcn.140049ca0
test eax, eax
je 0x14001abbe
xor eax, eax
jmp 0x14001abfa
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
mov dword [rsp + 0x28], 4
mov r9d, 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rbx
call sub.ADVAPI32.dll_RegSetValueExW
mov rcx, qword [rsp + 0x50]
mov ebx, eax
call sub.ADVAPI32.dll_RegCloseKey
test ebx, ebx
sete dil
mov eax, edi
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400489c0
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret

Function at 0x14001ac20
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push rsi
sub rsp, 0x20
mov rcx, rdx
mov rsi, rdx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 5
cmp eax, 5
jg 0x14001ac45
mov eax, 1
add rsp, 0x20
pop rsi
ret
mov qword [rsp + 0x30], rbx
mov ecx, CDaoRecordset::IsFieldNullable
movsxd rbx, eax
mov qword [rsp + 0x38], rdi
lea rdx, [rbx + rbx]
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
test rax, rax
jne 0x14001ac79
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
mov ebx, eax
and ebx, 1
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rdx, rdi
mov ecx, 0xd
and ebx, eax
call qword [sym.imp.USER32.dll_SetClipboardData]
xor ecx, ecx
test rax, rax
setne cl
and ebx, ecx
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rdi, qword [rsp + 0x38]
and eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rsi
ret
Function at 0x14001c190
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x250
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x14007d008]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rsi, rcx
xor edx, edx
lea r8d, [rdx + 1]
add rcx, 0x5d0
call qword [sym.imp.mfc140u.dll_Ordinal_6044]
mov rdx, rax
lea rcx, str.CAdRefManList
call qword [sym.imp.mfc140u.dll_AfxCancelModes]
mov rcx, rax
call fcn.140004080
mov edi, eax
xor r8d, r8d
xor edx, edx
lea rcx, [rsi + 0x5d0]
call qword [sym.imp.mfc140u.dll_Ordinal_6044]
mov rdx, rax
lea rcx, str.CAdRefManTree
call qword [sym.imp.mfc140u.dll_AfxCancelModes]
mov rcx, rax
call fcn.1400076a0
and edi, eax
cmp dword [0x14007f5e8], 0
setne dl
mov rcx, rsi
call fcn.14001d7d0
cmp dword [0x14007f5dc], 0
setne al
mov byte [rsi + 0x8bb], al
lea rdx, [rsp + 0x20]
lea rcx, [0x14007f5d0]
call fcn.14001b700
nop
lea rcx, [rsi + 0x8c8]
mov rdx, rax
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x20]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, [rsp + 0x30]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rcx, [rsi + 0x8d0]
lea rdx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCControlRendererInfo::CMFCControlRendererInfo]
cmp dword [0x14007f5e0], 0
setne al
mov byte [rsi + 0x436], al
cmp dword [0x14007f5ec], 0
setne al
mov byte [rsi + 0x8ba], al
mov dword [rsi + 0x8b4], 1
mov rcx, rsi
call fcn.14001c300
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call fcn.14001c450
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call fcn.14001c500
mov eax, edi
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400489c0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14001f0c0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push rbp
push rsi
push rdi
mov eax, reloc.mfc140u.dll_CPaneDivider::FindPaneContainer
call fcn.14004a590
sub rsp, rax
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + reloc.mfc140u.dll_CInternetFile::Flush], rbx
mov rax, qword [0x14007d008]
xor rax, rsp
mov qword [rsp + 0x1280], rax
mov rdi, r9
mov rbp, rdx
mov rsi, rcx
xor r9d, r9d
mov r8, rdx
mov rdx, rcx
lea rcx, [rsp + 0x30]
call fcn.140001e70
lea rdx, [rsp + 0x1030]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001f1a4
nop dword [rax]
cmp word [rsp + 0x105c], 0x2e
je 0x14001f186
xor r9d, r9d
lea r8, [rsp + 0x105c]
mov rdx, rsi
lea rcx, [rsp + 0x830]
call fcn.140001e70
lea rdx, [rsp + 0x830]
lea rcx, [rsp + 0x20]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__2]
nop
mov r8, rax
mov rdx, qword [rdi + 0x10]
mov rcx, rdi
call qword [sym.imp.mfc140u.dll_CWnd::RunModalLoop]
nop
lea rcx, [rsp + 0x20]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, [rsp + 0x1030]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14001f130
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
xor r9d, r9d
lea r8, [0x140057ca0]
mov rdx, rsi
lea rcx, [rsp + 0x830]
call fcn.140001e70
lea rdx, [rsp + 0x1030]
lea rcx, [rsp + 0x830]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001f23e
nop dword [rax]
test byte [rsp + 0x1030], 0x10
je 0x14001f220
cmp word [rsp + 0x105c], 0x2e
je 0x14001f220
xor r9d, r9d
lea r8, [rsp + 0x105c]
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.140001e70
mov r9, rdi
mov r8b, 1
mov rdx, rbp
lea rcx, [rsp + 0x30]
call fcn.14001f0c0
lea rdx, [rsp + 0x1030]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14001f1e0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rsp + 0x1280]
xor rcx, rsp
call fcn.1400489c0
mov rbx, qword [rsp + reloc.mfc140u.dll_CInternetFile::Flush]
add rsp, reloc.mfc140u.dll_CPaneDivider::FindPaneContainer
pop rdi
pop rsi
pop rbp
ret