joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400be570
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x14049e048]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov r15, r9
mov rdi, r8
mov rbx, rdx
mov rsi, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0x90]
mov r14, qword [rsp + 0x98]
call sym.ACAD.exe_struct_AcLicenseSettings____ptr64___cdecl_getAcLicenseSettings_void_
lea rdx, [rax + 0x124]
mov rcx, rbx
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XPanel::XPanel]
call qword [sym.imp.acdb24.dll_class_AcDbHostApplicationServices____ptr64___cdecl_acdbHostApplicationServices_void_]
mov rbx, rax
test rax, rax
je 0x1400be5eb
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x188]
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.mfc140u.dll_CMFCControlRendererInfo::CMFCControlRendererInfo]
lea rcx, [rsp + 0x20]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
and qword [rsp + 0x30], 0
mov rax, qword [rbx]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x190]
nop
lea rcx, [rsp + 0x30]
call qword [sym.imp.AcPal.dll_public:_static_int___cdecl_AcLocaleService::getWinLCIDFromLocaleClass_class_AcLocale_const____ptr64_]
mov edi, eax
xor r9d, r9d
lea r8, [rsp + 0x28]
lea edx, [r9 + 3]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ebx, eax
test eax, eax
je 0x1400be679
mov edx, eax
lea rcx, [rsp + 0x20]
call qword [sym.imp.mfc140u.dll_Ordinal_4946]
mov r8, rax
mov r9d, ebx
mov edx, 3
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov r8, qword [rsp + 0x20]
lea rdx, [0x140334d44]
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCZoomKernel::Filter]
or edx, 0xffffffff
lea rcx, [rsp + 0x20]
call qword [sym.imp.mfc140u.dll_CDialogImpl::ProcessMouseClick]
lea rdx, [0x14039b154]
mov rcx, rbp
call qword [sym.imp.mfc140u.dll_CMFCControlRendererInfo::CMFCControlRendererInfo]
or dword [r14], 0xffffffff
mov byte [rsi], 0
lea rcx, [rsp + 0x30]
call qword [sym.imp.AcPal.dll_public:_void___cdecl_AcLocale::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x20]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140088c50
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400c7940
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xb0
mov rax, qword [0x14049e048]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov rbx, r9
mov rsi, r8
mov r14, rdx
mov rdi, rcx
mov qword [rbp - 0x21], rdx
and dword [rbp - 0x39], 0
mov rcx, rdx
call qword [sym.imp.AcWebView.dll_public:_static_class_Autodesk::WebView::CallResult___cdecl_Autodesk::WebView::CallResult::createPendingResult_void_]
mov dword [rbp - 0x39], 1
mov rdx, rbx
lea rcx, [rbp + 0x1f]
call fcn.1400201f0
nop
mov qword [rbp - 0x19], rdi
mov qword [rbp - 0x11], rsi
lea rdx, [rbp + 0x1f]
lea rcx, [rbp - 9]
call fcn.140019b14
nop
and qword [rbp + 0x17], 0
mov r8, r14
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 0x17]
call fcn.1400c03e0
nop
lea rax, [rbp - 0x29]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
mov r9, qword [rbp + 0x17]
lea r8, [0x1400bff74]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x31], rax
test rax, rax
je 0x1400c7a42
lea rcx, [rbp - 0x31]
call fcn.140064174
nop
cmp dword [rbp - 0x29], 0
je 0x1400c7a08
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
nop
lea rcx, [rbp - 9]
call fcn.14001a4b0
nop
lea rcx, [rbp + 0x1f]
call fcn.14001a4b0
mov rax, r14
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.140088c50
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
and dword [rbp - 0x29], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x1400c7aac
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xb0
mov rax, qword [0x14049e048]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov rbx, r9
mov rsi, r8
mov r14, rdx
mov rdi, rcx
mov qword [rbp - 0x21], rdx
and dword [rbp - 0x39], 0
mov rcx, rdx
call qword [sym.imp.AcWebView.dll_public:_static_class_Autodesk::WebView::CallResult___cdecl_Autodesk::WebView::CallResult::createPendingResult_void_]
mov dword [rbp - 0x39], 1
mov rdx, rbx
lea rcx, [rbp + 0x1f]
call fcn.1400201f0
nop
mov qword [rbp - 0x19], rdi
mov qword [rbp - 0x11], rsi
lea rdx, [rbp + 0x1f]
lea rcx, [rbp - 9]
call fcn.140019b14
nop
and qword [rbp + 0x17], 0
mov r8, r14
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 0x17]
call fcn.1400c03e0
nop
lea rax, [rbp - 0x29]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
mov r9, qword [rbp + 0x17]
lea r8, [0x1400bff1c]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x31], rax
test rax, rax
je 0x1400c7bae
lea rcx, [rbp - 0x31]
call fcn.140064174
nop
cmp dword [rbp - 0x29], 0
je 0x1400c7b74
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
nop
lea rcx, [rbp - 9]
call fcn.14001a4b0
nop
lea rcx, [rbp + 0x1f]
call fcn.14001a4b0
mov rax, r14
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.140088c50
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
and dword [rbp - 0x29], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x1400cf154
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x48
mov rax, qword [0x14049e048]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdx, r8
and qword [rsp + 0x30], 0
xor r8d, r8d
lea rcx, [rsp + 0x30]
call qword [sym.imp.ac1st24.dll_public:_void___cdecl_AcString::constructor_char_const____ptr64__enum_AcString::Encoding____ptr64]
nop
call qword [sym.imp.accore.dll_public:_static_class_AcWebServicesUtil____ptr64___cdecl_AcWebServicesUtil::instance_void_]
mov rcx, rax
call qword [sym.imp.accore.dll_public:_bool___cdecl_AcWebServicesUtil::isLoggedIn_void_const___ptr64]
mov dword [rsp + 0x28], 1
xor r9d, r9d
mov r8, qword [rsp + 0x30]
xor edx, edx
xor ecx, ecx
and qword [rsp + 0x20], rcx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rsp + 0x30]
call qword [sym.imp.ac1st24.dll_public:_void___cdecl_AcString::destructor_void____ptr64]
mov al, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140088c50
add rsp, 0x48
ret

Function at 0x1400cf1dc
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x48
mov rax, qword [0x14049e048]
xor rax, rsp
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
lea rcx, [rsp + 0x30]
mov rdx, r8
xor r8d, r8d
call qword [sym.imp.ac1st24.dll_public:_void___cdecl_AcString::constructor_char_const____ptr64__enum_AcString::Encoding____ptr64]
mov r8, qword [rsp + 0x30]
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x28], 1
and qword [rsp + 0x20], 0
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ac1st24.dll_public:_void___cdecl_AcString::destructor_void____ptr64]
mov al, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140088c50
add rsp, 0x48
ret

Function at 0x1400cf2c0
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x48
mov rax, qword [0x14049e048]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rdx, str.https:__360.autodesk.com
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__11]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___2]
mov dword [rsp + 0x28], 1
xor r9d, r9d
and qword [rsp + 0x20], 0
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov al, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140088c50
add rsp, 0x48
ret
Function at 0x1400cf42c
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x48
mov rax, qword [0x14049e048]
xor rax, rsp
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
lea rdx, str.http:__usa.autodesk.com_adsk_servlet_index_siteID123112id1109794
lea rcx, [rsp + 0x30]
call qword [sym.imp.ac1st24.dll_public:_void___cdecl_AcString::constructor_wchar_t_const____ptr64____ptr64]
mov r8, qword [rsp + 0x30]
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x28], 1
and qword [rsp + 0x20], 0
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ac1st24.dll_public:_void___cdecl_AcString::destructor_void____ptr64]
mov al, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140088c50
add rsp, 0x48
ret

Function at 0x1400d0c3c
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rsi, rdx
mov rdi, rcx
lea rax, [rbp - 0x30]
mov qword [rbp + 0x10], rax
lea rdx, [rcx + 8]
lea rcx, [rbp - 0x30]
call fcn.14030e6b8
mov rbx, rax
lea r8, [0x14039b313]
lea rdx, str.productLine
mov rcx, rsi
call fcn.140312d84
nop
mov rdx, rbx
mov rcx, rax
call fcn.1403134e8
mov rcx, rbx
call fcn.1400796f8
lea rax, [rbp - 0x30]
mov qword [rbp + 0x10], rax
lea rdx, [rdi + 0x28]
lea rcx, [rbp - 0x30]
call fcn.14030e6b8
mov rbx, rax
lea r8, [0x14039b326]
lea rdx, str.productRelease
mov rcx, rsi
call fcn.140312d84
nop
mov rdx, rbx
mov rcx, rax
call fcn.1403134e8
mov rcx, rbx
call fcn.1400796f8
lea rax, [rbp - 0x30]
mov qword [rbp + 0x10], rax
lea rdx, [rdi + 0x48]
lea rcx, [rbp - 0x30]
call fcn.14030e6b8
mov rbx, rax
lea r8, [0x14039b333]
lea rdx, str.productLang
mov rcx, rsi
call fcn.140312d84
nop
mov rdx, rbx
mov rcx, rax
call fcn.1403134e8
mov rcx, rbx
call fcn.1400796f8
lea rax, [rbp - 0x30]
mov qword [rbp + 0x10], rax
lea rdx, [rdi + 0x68]
lea rcx, [rbp - 0x30]
call fcn.14030e6b8
mov rbx, rax
lea r8, [0x14039b33f]
lea rdx, str.country
mov rcx, rsi
call fcn.140312d84
nop
mov rdx, rbx
mov rcx, rax
call fcn.1403134e8
mov rcx, rbx
call fcn.1400796f8
lea rax, [rbp - 0x30]
mov qword [rbp + 0x10], rax
mov byte [rbp - 0x28], 1
mov ebx, 0xfffffeff
and dword [rbp - 0x28], ebx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x20], xmm0
and qword [rbp - 0x10], 0
movsxd rax, dword [rdi + 0x88]
mov qword [rbp - 0x30], rax
lea r8, [0x14039b300]
lea rdx, str.daysleft
mov rcx, rsi
call fcn.140312d84
nop
lea rdx, [rbp - 0x30]
mov rcx, rax
call fcn.1403134e8
lea rcx, [rbp - 0x30]
call fcn.1400796f8
lea rax, [rbp - 0x30]
mov qword [rbp + 0x10], rax
mov al, byte [rdi + 0x8c]
mov byte [rbp - 0x28], 5
and dword [rbp - 0x28], ebx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x20], xmm0
and qword [rbp - 0x10], 0
mov byte [rbp - 0x30], al
lea r8, [0x14039b345]
lea rdx, str.trial
mov rcx, rsi
call fcn.140312d84
nop
lea rdx, [rbp - 0x30]
mov rcx, rax
call fcn.1403134e8
lea rcx, [rbp - 0x30]
call fcn.1400796f8
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret
Function at 0x1400d261c
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rax, qword [0x14049e048]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rdi, rdx
mov rsi, rcx
xor ebx, ebx
test rdx, rdx
je 0x1400d26fe
mov rcx, rdx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400d26fe
mov qword [rbp + 0xf], rbx
mov rdx, rdi
lea rcx, [rbp + 0xf]
call qword [sym.imp.ac1st24.dll_public:_void___cdecl_AcString::constructor_wchar_t_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0xf]
call qword [sym.imp.ac1st24.dll_public:_class_AcString____ptr64___cdecl_AcString::makeLower_void____ptr64]
lea r8, [rbp + 0xf]
lea rdx, [rbp - 9]
mov rcx, rsi
call fcn.1400d1a78
lea r8, [rbp + 0xf]
mov r14, qword [rbp + 7]
mov rdx, r14
call fcn.1400d1ae8
test al, al
je 0x1400d26ab
cmp r14, qword [rsi]
jne 0x1400d26f0
lea rdx, [rbp + 0x17]
mov rcx, rdi
call fcn.1400d29e8
test al, al
je 0x1400d26f0
movups xmm0, xmmword [rbp + 0x17]
movups xmmword [rbp - 0x29], xmm0
movups xmm0, xmmword [rbp + 0x27]
movups xmmword [rbp - 0x19], xmm0
lea r8, [rbp + 0xf]
lea rdx, [rbp - 9]
mov rcx, rsi
call fcn.1400d1b10
mov rcx, qword [rax]
movups xmm0, xmmword [rbp - 0x29]
movups xmmword [rcx + 0x28], xmm0
movups xmm1, xmmword [rbp - 0x19]
movups xmmword [rcx + 0x38], xmm1
mov bl, 1
lea rcx, [rbp + 0xf]
call qword [sym.imp.ac1st24.dll_public:_void___cdecl_AcString::destructor_void____ptr64]
mov al, bl
jmp 0x1400d2700
xor al, al
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140088c50
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.1400d2a50
mov rdx, rbx
mov rcx, rax
add rsp, 0x20
pop rbx
jmp 0x1400d261c
Function at 0x1400d27cc
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rax, qword [0x14049e048]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rdi, rdx
mov rsi, rcx
xor ebx, ebx
test rdx, rdx
je 0x1400d26fe
mov rcx, rdx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400d26fe
mov qword [rbp + 0xf], rbx
mov rdx, rdi
lea rcx, [rbp + 0xf]
call qword [sym.imp.ac1st24.dll_public:_void___cdecl_AcString::constructor_wchar_t_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0xf]
call qword [sym.imp.ac1st24.dll_public:_class_AcString____ptr64___cdecl_AcString::makeLower_void____ptr64]
lea r8, [rbp + 0xf]
lea rdx, [rbp - 9]
mov rcx, rsi
call fcn.1400d1a78
lea r8, [rbp + 0xf]
mov r14, qword [rbp + 7]
mov rdx, r14
call fcn.1400d1ae8
test al, al
je 0x1400d26ab
cmp r14, qword [rsi]
jne 0x1400d26f0
lea rdx, [rbp + 0x17]
mov rcx, rdi
call fcn.1400d29e8
test al, al
je 0x1400d26f0
movups xmm0, xmmword [rbp + 0x17]
movups xmmword [rbp - 0x29], xmm0
movups xmm0, xmmword [rbp + 0x27]
movups xmmword [rbp - 0x19], xmm0
lea r8, [rbp + 0xf]
lea rdx, [rbp - 9]
mov rcx, rsi
call fcn.1400d1b10
mov rcx, qword [rax]
movups xmm0, xmmword [rbp - 0x29]
movups xmmword [rcx + 0x28], xmm0
movups xmm1, xmmword [rbp - 0x19]
movups xmmword [rcx + 0x38], xmm1
mov bl, 1
lea rcx, [rbp + 0xf]
call qword [sym.imp.ac1st24.dll_public:_void___cdecl_AcString::destructor_void____ptr64]
mov al, bl
jmp 0x1400d2700
xor al, al
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140088c50
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.1400d2a50
mov rdx, rbx
mov rcx, rax
add rsp, 0x20
pop rbx
jmp 0x1400d261c
Function at 0x1400d27ec
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0xf60]
mov eax, 0x1060
call fcn.140089690
sub rsp, rax
mov rax, qword [0x14049e048]
xor rax, rsp
mov qword [rbp + 0xf50], rax
mov rdi, rdx
mov rbx, rcx
cmp rcx, 0xffffffffffffffff
je 0x1400d2888
and qword [rsp + 0x38], 0
lea rcx, [rsp + 0x38]
and qword [rsp + 0x40], 0
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetElement
xor r8d, r8d
mov dword [rsp + 0x20], 0xf0000000
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1400d2888
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x1400d28ae
mov rcx, qword [rsp + 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor al, al
mov rcx, qword [rbp + 0xf50]
xor rcx, rsp
call fcn.140088c50
lea r11, [rsp + 0x1060]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
and dword [rsp + 0x30], 0
jmp 0x1400d28d6
mov r8d, dword [rsp + 0x30]
test r8d, r8d
je 0x1400d28f9
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0x50]
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x1400d2942
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
mov r8d, reloc.mfc140u.dll_COleChangeIconDialog::DoModal
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400d28b5
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x48]
and dword [rsp + 0x20], 0
mov r8, rdi
mov edx, 2
mov dword [rsp + 0x48], GetActiveObject
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov rcx, qword [rsp + 0x38]
xor edx, edx
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
test ebx, ebx
setne al
jmp 0x1400d288a
mov rcx, qword [rsp + 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
jmp 0x1400d2888
Function at 0x1400d317c
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0x100
mov rax, qword [0x14049e048]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov r9, r8
mov r8, rdx
movsx edx, cx
lea rcx, [rbp - 0x41]
call fcn.1400d3024
nop
lea rcx, [rbp - 0x39]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x69], xmm0
mov qword [rbp - 0x59], rax
lea rcx, [rbp - 0x41]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___2]
mov rdx, rax
lea rax, [rbp - 0x69]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x39]
mov qword [rsp + 0x40], rax
xor ebx, ebx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x1400d32a0
lea rcx, [rbp - 0x49]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea r8d, [rbx + 0x3f]
mov rdx, qword [0x1404b7340]
lea rcx, [rbp - 0x49]
call qword [sym.imp.mfc140u.dll_COccManager::IsDialogMessageW]
lea rcx, [rbp - 0x51]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea r8d, [rbx + 0x40]
mov rdx, qword [0x1404b7340]
lea rcx, [rbp - 0x51]
call qword [sym.imp.mfc140u.dll_COccManager::IsDialogMessageW]
call qword [sym.imp.adhostableui.dll_public:_static_class_AdHostMessageBox____ptr64___cdecl_AdHostMessageBox::simple_void_]
mov rsi, rax
mov rcx, qword [rax]
mov rdi, qword [rcx]
lea rcx, [rbp - 0x49]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___2]
mov rbx, rax
lea rcx, [rbp - 0x51]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___2]
mov r9, rbx
mov r8d, reloc.OLEAUT32.dll_SafeArrayGetDim
mov rdx, rax
mov rcx, rsi
call rdi
nop
lea rcx, [rbp - 0x51]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x49]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x1400d32bf
mov rcx, qword [rbp - 0x69]
test rcx, rcx
je 0x1400d32af
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x61]
test rcx, rcx
je 0x1400d32bf
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp - 0x41]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140088c50
mov rbx, qword [rsp + 0x120]
add rsp, 0x100
pop rdi
pop rsi
pop rbp
ret
jmp 0x1400d317c
Function at 0x1400d8aa0
Capabilities:
Get geographical location

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rdx, [0x1400d92fc]
mov r8, rcx
mov ecx, 0x3e8
call qword [sym.imp.AdDownloaderCore.dll_Ordinal_16]
test eax, eax
js 0x1400d8acf
mov dword [rbx + 8], 1
add rsp, 0x20
pop rbx
ret
mov edx, eax
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.1400d9628
Function at 0x1400d8df4
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x14049e048]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, rcx
cmp byte [0x1404c0438], 0
jne 0x1400d8efc
mov byte [0x1404c0438], 1
and qword [rsp + 0x38], 0
lea rcx, [rsp + 0x38]
call qword [sym.imp.AdApplicationFrame.dll_public:_void___cdecl_AdTaskDialog::constructor_void____ptr64]
nop
and dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.AutoCAD.AutodeskMediumTexDownloadError
lea rdx, str._AcTaskDialogs_component_TaskDialogs.xaml
lea rcx, [rsp + 0x38]
call qword [sym.imp.AdApplicationFrame.dll_public:_int___cdecl_AdTaskDialog::LoadFromFile_wchar_t_const____ptr64__wchar_t_const____ptr64__struct_TASKDIALOG_KEYVALUE_const____ptr64__int____ptr64]
test eax, eax
je 0x1400d8eea
lea rdx, [rbx + 0x68]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__10]
nop
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___2]
mov rdx, rax
lea rcx, [rsp + 0x38]
call qword [sym.imp.AdApplicationFrame.dll_public:_int___cdecl_AdTaskDialog::SetContentText_wchar_t_const____ptr64____ptr64]
nop
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
call fcn.140020e38
test rax, rax
jne 0x1400d8e9e
xor edx, edx
jmp 0x1400d8ea2
mov rdx, qword [rax + 0x40]
lea rcx, [rsp + 0x38]
call qword [sym.imp.AdApplicationFrame.dll_public:_int___cdecl_AdTaskDialog::ShowDialog_struct_HWND______ptr64____ptr64]
sub eax, 0x3e9
je 0x1400d8ee1
sub eax, 1
je 0x1400d8f0f
cmp eax, 1
jne 0x1400d8eea
mov dword [rsp + 0x28], eax
and qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.http:__usa.autodesk.com_adsk_servlet_linkedsumindex_siteID123112id2334430linkID9240618
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x40]
mov byte [0x1404c0438], 0
lea rcx, [rsp + 0x38]
call qword [sym.imp.AdApplicationFrame.dll_public:_void___cdecl_AdTaskDialog::destructor_void____ptr64]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140088c50
add rsp, 0x50
pop rbx
ret
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x48]
jmp 0x1400d8eea