While I open exe file in ida I can see lot of calls to mfc140_6153 or mfc140_8718.

What are those functions ? what they do ?


  • You can find the dll in System32 folder.
    – Biswapriyo
    Nov 7, 2019 at 17:37
  • @Biswapriyo I know, but I looking for documentation what the function mfc140_6153 or mfc140_8718 do please
    – joif doi
    Nov 10, 2019 at 8:15
  • Obviously, those are undocumented. The numbers 6153 and 8718 looks like ordinal numbers. When there is no name for the exported function programs tends to use ordinal numbers.
    – Biswapriyo
    Nov 10, 2019 at 8:38

1 Answer 1


These are functions exported by ordinal rather than by name.

This being a C++ library the actual (mangled) function names are long (up to 200 characters with an average of over 50.) Dynamic linking using names in this case would involve lots of long string comparisons that would slow down the loading of applications using this library.

public: class CList<struct HWND__ * __ptr64,struct HWND__ * __ptr64> & __ptr64 __cdecl CRecentDockSiteInfo::GetRecentListOfPanes(int) __ptr64

protected: void __cdecl CPane::OnCancelMode(void) __ptr64

You can find lists of these in several reverse engineering tools. e.g. Ghidra

  • , thanks, is that dll depend at windows version? or in all mfc dll function 8718 is OnCancelMode ?
    – joif doi
    Nov 17, 2019 at 7:29
  • One downside of exporting by ordinal is that the ordinal numbers cannot change if there are any updates to the DLL. Otherwise applications linked against one version will fail if run against a different version. The MFC DLLs do not depend on windows version. They do depend on the version of MFC that app uses though. See en.wikipedia.org/wiki/…
    – Ian Cook
    Nov 17, 2019 at 21:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.