joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b1428
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x38
mov rcx, qword [rcx + 8]
lea rax, [r11 + 8]
lea r9, [r11 + 0x20]
mov qword [r11 - 0x10], rax
mov qword [r11 - 0x18], r8
xor r8d, r8d
mov dword [rsp + 0x40], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor edx, edx
test eax, eax
jne 0x1400b146a
mov ecx, dword [rsp + 0x58]
sub ecx, 4
neg ecx
sbb eax, eax
and eax, 0xd
test eax, eax
sete dl
mov eax, edx
add rsp, 0x38
ret

Function at 0x1400b157c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rdi, r9
mov rbx, r8
mov rsi, rdx
mov rbp, rcx
test rdx, rdx
jne 0x1400b15a7
call fcn.140003d8c
int3
test rbx, rbx
jne 0x1400b15b2
call fcn.140003d8c
int3
test r9, r9
jne 0x1400b15bd
call fcn.140003d8c
int3
and qword [r8], 0
and dword [r9], 0
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x28], r9
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400b1640
cmp dword [rsp + 0x48], 3
jne 0x1400b1640
test eax, eax
jne 0x1400b1640
cmp dword [rdi], eax
je 0x1400b1640
mov ecx, dword [rdi]
call fcn.140002950
lea r9, [rsp + 0x48]
xor r8d, r8d
mov qword [rbx], rax
mov rcx, qword [rbp + 8]
mov rdx, rsi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400b1634
cmp dword [rsp + 0x48], 3
jne 0x1400b1634
test eax, eax
jne 0x1400b1634
mov eax, 1
jmp 0x1400b1642
mov rcx, qword [rbx]
call fcn.140002994
and qword [rbx], 0
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x1400b174c
Capabilities:
Delete registry value

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
add rsp, 0x28
ret
Function at 0x1401207bc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
test byte [rdx + 4], 1
mov esi, r8d
mov rbx, rdx
mov rbp, rcx
je 0x1401207e5
mov rdi, qword [rdx + 0x10]
jmp 0x140120836
mov rdx, qword [rdx + 0x10]
mov rcx, qword [rbx + 8]
mov r8d, 5
call qword [sym.imp.KERNEL32.DLL_FindResourceA]
mov rdi, rax
test rax, rax
jne 0x140120806
call fcn.1400090cc
mov rcx, qword [rbx + 8]
mov rdx, rdi
call qword [sym.imp.KERNEL32.DLL_LoadResource]
mov rdi, rax
test rax, rax
jne 0x140120820
call fcn.1400090cc
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_LockResource]
mov rdi, rax
test rax, rax
jne 0x140120836
call fcn.1400090cc
call fcn.14000d3e4
cmp qword [rax + 0x68], 0
je 0x140120850
mov rdx, rdi
mov rcx, rbp
call fcn.14011ef4c
mov rdi, rax
mov edx, esi
mov rcx, rdi
call fcn.1401205fc
mov rcx, qword [rbp + 0xe8]
mov rsi, rax
test rcx, rcx
je 0x140120877
call qword [sym.imp.KERNEL32.DLL_GlobalFree]
and qword [rbp + 0xe8], 0
test rsi, rsi
je 0x140120886
mov rdi, rsi
mov qword [rbp + 0xe8], rsi
or dword [rbx + 4], 1
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov qword [rbx + 0x10], rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140144110
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, edx
test rcx, rcx
jne 0x14014413a
call fcn.140144c18
and dword [rax], 0
call fcn.140144bf8
mov ebx, 0x16
mov dword [rax], ebx
call fcn.140149a38
mov eax, ebx
jmp 0x14014418a
test edx, 0xfffffff9
jne 0x14014411d
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x140144163
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, eax
call fcn.140144c38
call fcn.140144bf8
mov eax, dword [rax]
jmp 0x14014418a
test al, 0x10
jne 0x140144188
test al, 1
je 0x140144188
test bl, 2
je 0x140144188
call fcn.140144c18
mov dword [rax], 5
call fcn.140144bf8
mov dword [rax], 0xd
jmp 0x14014415a
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x140145018
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.140144e88
Function at 0x14014c9ff
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1401f02d0]
jne 0x14014410a
rol rcx, 0x10
test cx, 0xffff
jne 0x140144106
repz ret
ror rcx, 0x10
jmp 0x14014c958
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1401fc130]
call qword [sym.imp.KERNEL32.DLL_RtlCaptureContext]
mov rax, qword [0x1401fc228]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.DLL_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14014c9dd
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1401fc130]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.DLL_RtlVirtualUnwind
jmp 0x14014c9ff
mov rax, qword [rsp + 0x88]
mov qword [0x1401fc228], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1401fc1c8], rax
mov rax, qword [0x1401fc228]
mov qword [0x1401fc0a0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1401fc1b0], rax
mov dword [0x1401fc090], 0xc0000409
mov dword [0x1401fc094], 1
mov rax, qword [0x1401f02d0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1401f02d8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.DLL_IsDebuggerPresent]
mov dword [0x1401fc128], eax
mov ecx, 1
call fcn.140155ae4
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_SetUnhandledExceptionFilter]
lea rcx, [0x1401b5600]
call qword [sym.imp.KERNEL32.DLL_UnhandledExceptionFilter]
cmp dword [0x1401fc128], 0
jne 0x14014ca86
mov ecx, 1
call fcn.140155ae4
call qword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_TerminateProcess]
add rsp, 0x88
ret
Function at 0x140155d44
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x1401f02d0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.14014b1dc
xor ebx, ebx
cmp qword [0x1401fd150], rbx
mov rdi, rax
jne 0x140155e57
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.DLL_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x140155f2e
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
test rax, rax
je 0x140155f2e
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_EncodePointer]
lea rdx, [0x1401b7098]
mov rcx, rsi
mov qword [0x1401fd150], rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_EncodePointer]
lea rdx, [0x1401b7080]
mov rcx, rsi
mov qword [0x1401fd158], rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x1401fd160], rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_EncodePointer]
mov r11, rax
mov qword [0x1401fd170], rax
test rax, rax
je 0x140155e4e
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_EncodePointer]
mov qword [0x1401fd168], rax
jmp 0x140155e5e
mov rax, qword [0x1401fd168]
jmp 0x140155e65
mov rax, qword [0x1401fd168]
mov r11, qword [0x1401fd170]
cmp rax, rdi
je 0x140155ecc
cmp r11, rdi
je 0x140155ecc
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_DecodePointer]
mov rcx, qword [0x1401fd170]
mov rsi, rax
call qword [sym.imp.KERNEL32.DLL_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x140155ecc
test rax, rax
je 0x140155ecc
call rsi
test rax, rax
je 0x140155ec6
lea rcx, [rsp + 0x30]
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x140155ec6
test byte [rsp + 0x40], 1
jne 0x140155ecc
bts ebp, 0x15
jmp 0x140155f0c
mov rcx, qword [0x1401fd158]
cmp rcx, rdi
je 0x140155f0c
call qword [sym.imp.KERNEL32.DLL_DecodePointer]
test rax, rax
je 0x140155f0c
call rax
mov rbx, rax
test rax, rax
je 0x140155f0c
mov rcx, qword [0x1401fd160]
cmp rcx, rdi
je 0x140155f0c
call qword [sym.imp.KERNEL32.DLL_DecodePointer]
test rax, rax
je 0x140155f0c
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x1401fd150]
call qword [sym.imp.KERNEL32.DLL_DecodePointer]
test rax, rax
je 0x140155f2e
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x140155f30
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401440f0
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14000e120
Capabilities:
Print debug messages

Disassembly:
test rcx, rcx
je 0x14000e1c9
mov r11, rsp
mov qword [r11 + 8], rcx
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
sub rsp, 0x38
mov r8, rcx
or rcx, 0xffffffffffffffff
mov qword [r11 - 0x18], rdi
xor eax, eax
mov rdi, r8
repne scasb al, byte [rdi]
not rcx
cmp rcx, 1
je 0x14000e1c0
mov qword [r11 - 0x10], rsi
lea rsi, [r11 + 0x10]
mov rcx, r8
mov rdx, rsi
call qword [sym.imp.MSVCR90.dll__vscprintf]
test eax, eax
jle 0x14000e1bb
inc eax
mov qword [rsp + 0x30], rbx
movsxd rdi, eax
mov rcx, rdi
call sub.mfc90u.dll_new__
mov r8, qword [rsp + 0x40]
mov r9, rsi
mov rcx, rax
mov rdx, rdi
mov rbx, rax
call qword [sym.imp.MSVCR90.dll_vsprintf_s]
test eax, eax
jle 0x14000e1a9
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
test rbx, rbx
je 0x14000e1b6
mov rcx, rbx
call sub.mfc90u.dll_CStatusBar::CStatusBar
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x20]
add rsp, 0x38
repz ret

Function at 0x14000e1d0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, qword [rcx + 0x10]
lea rax, vtable.CFunctionTimeCost.0
mov rbx, rcx
mov qword [rcx], rax
call qword [sym.imp.MSVCR90.dll_clock]
sub eax, dword [rbx + 8]
cmp eax, 0xa
jle 0x14000e22d
mov rdx, qword [rbx + 0x18]
test rdi, rdi
je 0x14000e21e
lea rcx, str.__s___s._Time_Cost:__d_n
mov r9d, eax
mov r8, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14000e120
lea rcx, str.__s__Time_Cost:__d_n
mov r8d, eax
call fcn.14000e120
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14001af70
Capabilities:
Get memory capacity

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x70
mov edi, dword [rcx + 0x2fc]
mov esi, dword [rcx + 0x4ac]
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x3c]
mov ebp, 0x200
imul edi, dword [rcx + reloc.mfc90u.dll_CRecentFileList::CRecentFileList]
lea rcx, [rsp + 0x24]
call sub.MSVCR90.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov r11, qword [rsp + 0x30]
mov rax, qword [rsp + 0x50]
movsd xmm2, qword [0x14004e2f0]
pxor xmm0, xmm0
cmp rax, r11
cmovb r11, rax
cvtsi2sd xmm0, r11
test r11, r11
jns 0x14001afed
addsd xmm0, xmm2
pxor xmm1, xmm1
xor eax, eax
cvtsi2sd xmm1, rax
jns 0x14001affe
addsd xmm1, xmm2
xorpd xmm2, xmm2
subsd xmm0, xmm1
comisd xmm2, xmm0
jbe 0x14001b010
movapd xmm0, xmm2
mulsd xmm0, qword [0x14004e2e8]
comisd xmm0, xmm2
jbe 0x14001b080
movd xmm1, esi
movd xmm2, edi
cvtdq2pd xmm1, xmm1
cvtdq2pd xmm2, xmm2
divsd xmm0, xmm1
divsd xmm0, xmm2
call sub.MSVCR90.dll_sqrt
addsd xmm0, qword [0x14004d388]
movsd xmm2, xmm0
shufpd xmm2, xmm2, 0
cvttpd2dq xmm0, xmm2
cvtdq2pd xmm1, xmm0
cmpltpd xmm2, xmm1
andpd xmm2, xmmword [0x14004c750]
subpd xmm1, xmm2
cvtpd2dq xmm0, xmm1
movdqa xmmword [rsp + 0x60], xmm0
mov eax, dword [rsp + 0x60]
cmp eax, ebp
cmovl eax, ebp
mov dword [rbx + 0x4a8], eax
jmp 0x14001b086
mov dword [rbx + 0x4a8], ebp
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14001b1b0
Capabilities:
Accept command line arguments

Disassembly:
push rbx
push rbp
push rdi
push r13
sub rsp, 0x38
mov rax, qword [0x140067030]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov r13, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
mov edx, 0x7c
call qword [sym.imp.MSVCR90.dll_wcschr]
mov rbp, rax
test rax, rax
jne 0x14001b1f5
xor ebx, ebx
mov ax, bx
jmp 0x14001b2d5
lea rdx, [0x140046da0]
lea rcx, [rax - 4]
mov r8d, 2
call qword [sym.imp.MSVCR90.dll_wcsncmp]
test eax, eax
jne 0x14001b219
mov dword [rdi + 8], 2
jmp 0x14001b263
lea rdx, [0x140046da8]
lea rcx, [rbp - 4]
mov r8d, 2
call qword [sym.imp.MSVCR90.dll_wcsncmp]
test eax, eax
jne 0x14001b23d
mov dword [rdi + 8], 3
jmp 0x14001b263
lea rdx, [0x140046db0]
lea rcx, [rbp - 4]
mov r8d, 2
call qword [sym.imp.MSVCR90.dll_wcsncmp]
test eax, eax
jne 0x14001b362
mov dword [rdi + 8], 1
cmp dword [rdi + 8], 3
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x30], r12
jne 0x14001b280
cmp byte [rdi + 0xc], 0
jne 0x14001b280
mov dword [rdi + 8], 2
lea rcx, [rbp + 2]
mov edx, 0x7c
call qword [sym.imp.MSVCR90.dll_wcschr]
mov rsi, rax
test rax, rax
je 0x14001b358
mov r8, rax
lea rdx, [rbp + 2]
lea rcx, [rdi + 0x10]
sub r8, rbp
sar r8, 1
dec r8
call qword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::append_wchar_t_const____ptr64__unsigned_long_long_unsigned___int64_____ptr64]
lea rcx, [rdi + 0x10]
mov rdx, r13
call qword [sym.imp.MSVCP90.dll_bool___cdecl_std::operator__wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const____ptr64__wchar_t_const____ptr64_]
test al, al
je 0x14001b2ec
mov eax, 0x6d
mov rsi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400372b0
add rsp, 0x38
pop r13
pop rdi
pop rbp
pop rbx
ret
lea rbp, [rsi + 2]
mov edx, 0x7c
mov rcx, rbp
call qword [sym.imp.MSVCR90.dll_wcschr]
mov rsi, rax
test rax, rax
je 0x14001b358
xor ebx, ebx
lea rdx, [rsp + 0x20]
mov rcx, rbp
lea r8d, [rbx + 0x10]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.MSVCR90.dll_wcstoul]
mov dword [rdi + 0x38], eax
cmp qword [rsp + 0x20], rsi
jne 0x14001b358
lea rcx, [rsi + 2]
lea r8d, [rbx + 0x10]
xor edx, edx
call qword [sym.imp.MSVCR90.dll_wcstoul]
mov ecx, eax
mov qword [rdi + 0x248], rcx
test eax, eax
je 0x14001b358
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x14001b358
mov ax, bx
jmp 0x14001b2cb
mov eax, 0x68
jmp 0x14001b2cb
mov eax, 0x68
jmp 0x14001b2d5
Function at 0x1400226d0
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rbx, rcx
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_class]
nop
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140047348]
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.PECtrl.dll_public:_void___cdecl_PECTRL::CPhotoEditorApp::GetWebsiteUrl_class_ATL::CStringT_wchar_t__class_StrTraitMFC_DLL_wchar_t__class_ATL::ChTraitsCRT_wchar_t_______ptr64__wchar_t_const____ptr64__wchar_t_const____ptr64__wchar_t_const____ptr64_const___ptr64]
mov r8, qword [rsp + 0x60]
test r8, r8
je 0x14002273d
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc90u.dll_CView::CView]
add rsp, 0x40
pop rbx
ret

Function at 0x140022f90
Capabilities:
Create directory

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
mov rsi, rcx
call qword [sym.imp.PECtrl.dll_protected_virtual:_void___cdecl_PECTRL::CPhotoEditorApp::InitWorkingFolders_void____ptr64]
lea rcx, [rsi + 0x1668]
lea rdx, str..sfpreset
call qword [sym.imp.mfc90u.dll_CTreeCtrl::CTreeCtrl]
lea r8, str.presets
lea rdx, [rsi + 0xbd8]
lea rcx, [rsp + 0x40]
call fcn.14000ce00
nop
mov rdx, rax
lea rcx, [rsi + 0x1660]
call qword [sym.imp.mfc90u.dll_CToolBarCtrl::CToolBarCtrl]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc90u.dll_CView::CView]
xor edx, edx
mov rcx, qword [rsi + 0x1660]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor edx, edx
mov rcx, qword [rsi + 0xc38]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov r8, qword [rsi + 0xbd8]
lea rdx, str._s_frdpool
lea rcx, [rsi + 0x1680]
call qword [sym.imp.mfc90u.dll_COleServerDoc::XOleObject::EnumAdvise]
xor edx, edx
mov rcx, qword [rsi + 0x1680]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea r8, str._batch.xml
lea rdx, [rsi + 0xbd8]
lea rcx, [rsp + 0x40]
call fcn.14000ce00
nop
lea rcx, [rsi + 0x1f58]
mov rdx, rax
call qword [sym.imp.mfc90u.dll_CToolBarCtrl::CToolBarCtrl]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc90u.dll_CView::CView]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140030110
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x20
mov rsi, rdx
mov rbx, rcx
test rdx, rdx
jne 0x140030167
cmp byte [rcx + 0x70], dl
jne 0x14003015a
mov byte [rcx + 0x70], 1
mov dword [rcx + 0x74], 2
mov rdx, qword [str.Failed_to_open_file]
add rcx, 0x78
call qword [reloc.MSVCP90.dll___4__basic_string_DU__char_traits_D_std__V__allocator_D_2__std__QEAAAEAV01_PEBD_Z]
mov dword [rbx + 0xa8], 0xffffffff
mov dword [rbx + 0xa4], 0xffffffff
xor al, al
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
mov qword [rsp + 0x30], rbp
call fcn.14002f500
xor edx, edx
lea r8d, [rdx + 2]
mov rcx, rsi
mov dword [rbx + 0xc], 0xffffffff
mov dword [rbx + 8], 0xffffffff
call qword [sym.imp.MSVCR90.dll_fseek]
mov rcx, rsi
call qword [sym.imp.MSVCR90.dll_ftell]
xor r8d, r8d
xor edx, edx
mov rcx, rsi
movsxd rbp, eax
call qword [sym.imp.MSVCR90.dll_fseek]
test ebp, ebp
jg 0x1400301f4
cmp byte [rbx + 0x70], 0
jne 0x1400301e2
mov byte [rbx + 0x70], 1
mov dword [rbx + 0x74], 0xc
mov rdx, qword [str.Error_document_empty.]
lea rcx, [rbx + 0x78]
call qword [reloc.MSVCP90.dll___4__basic_string_DU__char_traits_D_std__V__allocator_D_2__std__QEAAAEAV01_PEBD_Z]
mov dword [rbx + 0xa8], 0xffffffff
mov dword [rbx + 0xa4], 0xffffffff
xor al, al
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
lea eax, [rbp + 1]
mov qword [rsp + 0x38], rdi
movsxd rcx, eax
call sub.mfc90u.dll_new__
mov r9, rsi
mov r8d, 1
mov rcx, rax
mov rdx, rbp
mov rdi, rax
mov byte [rax], 0
call qword [sym.imp.MSVCR90.dll_fread]
cmp rax, 1
je 0x140030267
mov rcx, rdi
call sub.mfc90u.dll_delete__
cmp byte [rbx + 0x70], 0
jne 0x140030263
mov byte [rbx + 0x70], 1
mov dword [rbx + 0x74], 2
mov rdx, qword [str.Failed_to_open_file]
lea rcx, [rbx + 0x78]
call qword [reloc.MSVCP90.dll___4__basic_string_DU__char_traits_D_std__V__allocator_D_2__std__QEAAAEAV01_PEBD_Z]
mov dword [rbx + 0xa8], 0xffffffff
mov dword [rbx + 0xa4], 0xffffffff
xor al, al
jmp 0x1400302c8
mov byte [rdi + rbp], 0
cmp byte [rdi], 0
mov rax, rdi
mov rcx, rdi
je 0x14003029e
movzx edx, byte [rax]
cmp dl, 0xd
jne 0x140030291
mov byte [rcx], 0xa
inc rax
inc rcx
cmp byte [rax], 0xa
jne 0x140030299
inc rax
jmp 0x140030299
mov byte [rcx], dl
inc rcx
inc rax
cmp byte [rax], 0
jne 0x140030276
mov byte [rcx], 0
mov rax, qword [rbx]
mov r9d, 1
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call qword [rax + 0x10]
mov rcx, rdi
call sub.mfc90u.dll_delete__
xor r11d, r11d
cmp byte [rbx + 0x70], r11b
sete al
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
Function at 0x14003783f
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140067030]
jne 0x1400372ca
rol rcx, 0x10
test cx, 0xffff
jne 0x1400372c6
repz ret
ror rcx, 0x10
jmp 0x140037798
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140068b20]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x140068c18]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14003781d
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140068b20]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x14003783f
mov rax, qword [rsp + 0x88]
mov qword [0x140068c18], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140068bb8], rax
mov rax, qword [0x140068c18]
mov qword [0x140068a90], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140068ba0], rax
mov dword [0x140068a80], 0xc0000409
mov dword [0x140068a84], 1
mov rax, qword [0x140067030]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140067038]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140068b18], eax
mov ecx, 1
call sub.MSVCR90.dll___crt_debugger_hook
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140040ef0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140068b18], 0
jne 0x1400378c6
mov ecx, 1
call sub.MSVCR90.dll___crt_debugger_hook
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret