joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6f5096c0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_VariantToDosDateTime___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.propsys.dll
mov dword [ebp - 0x40], str.VariantToDosDateTime
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6f509720
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_VariantToDouble___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.propsys.dll
mov dword [ebp - 0x40], str.VariantToDouble
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6f509780
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_VariantToDoubleArray___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.propsys.dll
mov dword [ebp - 0x40], str.VariantToDoubleArray
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6f5097e0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_VariantToDoubleArrayAlloc___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.propsys.dll
mov dword [ebp - 0x40], str.VariantToDoubleArrayAlloc
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6f509840
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_VariantToDoubleWithDefault___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.propsys.dll
mov dword [ebp - 0x40], str.VariantToDoubleWithDefault
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4
Function at 0x6f5098a0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_VariantToFileTime___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.propsys.dll
mov dword [ebp - 0x40], str.VariantToFileTime
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6f509900
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_VariantToInt16___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.propsys.dll
mov dword [ebp - 0x40], str.VariantToInt16
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6f509960
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_VariantToInt16Array___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.propsys.dll
mov dword [ebp - 0x40], str.VariantToInt16Array
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6f5099c0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_VariantToInt16ArrayAlloc___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.propsys.dll
mov dword [ebp - 0x40], str.VariantToInt16ArrayAlloc
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6f509a20
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_VariantToInt16WithDefault___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.propsys.dll
mov dword [ebp - 0x40], str.VariantToInt16WithDefault
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6f509a80
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_VariantToInt32___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.propsys.dll
mov dword [ebp - 0x40], str.VariantToInt32
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4
Function at 0x6f509ae0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_VariantToInt32Array___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.propsys.dll
mov dword [ebp - 0x40], str.VariantToInt32Array
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6f509b40
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_VariantToInt32ArrayAlloc___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.propsys.dll
mov dword [ebp - 0x40], str.VariantToInt32ArrayAlloc
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6f509ba0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_VariantToInt32WithDefault___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.propsys.dll
mov dword [ebp - 0x40], str.VariantToInt32WithDefault
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6f509c00
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_VariantToInt64___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.propsys.dll
mov dword [ebp - 0x40], str.VariantToInt64
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6f509c60
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_VariantToInt64Array___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.propsys.dll
mov dword [ebp - 0x40], str.VariantToInt64Array
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4
Function at 0x6f509cc0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_VariantToInt64ArrayAlloc___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.propsys.dll
mov dword [ebp - 0x40], str.VariantToInt64ArrayAlloc
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6f509d20
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_VariantToInt64WithDefault___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.propsys.dll
mov dword [ebp - 0x40], str.VariantToInt64WithDefault
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6f509d80
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_VariantToPropVariant___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.propsys.dll
mov dword [ebp - 0x40], str.VariantToPropVariant
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6f509de0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_VariantToStrRet___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.propsys.dll
mov dword [ebp - 0x40], str.VariantToStrRet
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6f509e40
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_VariantToString___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.propsys.dll
mov dword [ebp - 0x40], str.VariantToString
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6f509ea0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_VariantToStringAlloc___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.propsys.dll
mov dword [ebp - 0x40], str.VariantToStringAlloc
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4
Function at 0x6f509f00
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_VariantToStringArray___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.propsys.dll
mov dword [ebp - 0x40], str.VariantToStringArray
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6f509f60
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_VariantToStringArrayAlloc___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.propsys.dll
mov dword [ebp - 0x40], str.VariantToStringArrayAlloc
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6f509fc0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_VariantToStringWithDefault___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.propsys.dll
mov dword [ebp - 0x40], str.VariantToStringWithDefault
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6f50a020
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_VariantToUInt16___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.propsys.dll
mov dword [ebp - 0x40], str.VariantToUInt16
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6f50a080
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_VariantToUInt16Array___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.propsys.dll
mov dword [ebp - 0x40], str.VariantToUInt16Array
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4
Function at 0x6f50a0e0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_VariantToUInt16ArrayAlloc___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.propsys.dll
mov dword [ebp - 0x40], str.VariantToUInt16ArrayAlloc
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6f50a140
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_VariantToUInt16WithDefault___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.propsys.dll
mov dword [ebp - 0x40], str.VariantToUInt16WithDefault
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6f50a1a0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_VariantToUInt32___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.propsys.dll
mov dword [ebp - 0x40], str.VariantToUInt32
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6f50a200
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_VariantToUInt32Array___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.propsys.dll
mov dword [ebp - 0x40], str.VariantToUInt32Array
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6f50a260
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_VariantToUInt32ArrayAlloc___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.propsys.dll
mov dword [ebp - 0x40], str.VariantToUInt32ArrayAlloc
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4
Function at 0x6f50a2c0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_VariantToUInt32WithDefault___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.propsys.dll
mov dword [ebp - 0x40], str.VariantToUInt32WithDefault
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6f50a320
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_VariantToUInt64___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.propsys.dll
mov dword [ebp - 0x40], str.VariantToUInt64
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6f50a380
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_VariantToUInt64Array___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.propsys.dll
mov dword [ebp - 0x40], str.VariantToUInt64Array
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6f50a3e0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_VariantToUInt64ArrayAlloc___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.propsys.dll
mov dword [ebp - 0x40], str.VariantToUInt64ArrayAlloc
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6f50a440
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_VariantToUInt64WithDefault___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.propsys.dll
mov dword [ebp - 0x40], str.VariantToUInt64WithDefault
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4
Function at 0x6f50b630
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], esi
mov dword [esp + 4], eax
call sym._FindResourceW_12
sub esp, 0xc
mov dword [ebp - 0x14], eax
mov dword [esp + 4], eax
mov dword [esp], esi
call sym._LoadResource_8
mov edx, dword [ebp - 0x14]
sub esp, 8
mov edi, eax
mov dword [esp + 4], edx
mov dword [esp], esi
call sym._SizeofResource_8
sub esp, 8
test edi, edi
je 0x6f50b797
mov ecx, eax
mov eax, dword [ebx]
test eax, eax
je 0x6f50b7a3
mov dword [esp + 0xc], ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
mov dword [ebp - 0x18], ecx
call sym._MultiByteToWideChar_24
lea edx, [eax + 1]
sub esp, 0x18
lea eax, [edx + edx]
mov dword [ebp - 0x14], edx
mov esi, eax
mov dword [ebp - 0x1c], eax
call sym._GetProcessHeap_0
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._HeapAlloc_12
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
sub esp, 0xc
test eax, eax
mov esi, eax
je 0x6f50b790
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call sym._MultiByteToWideChar_24
mov eax, dword [ebp - 0x1c]
xor edx, edx
sub esp, 0x18
mov word [esi + eax - 2], dx
mov ecx, dword [ebx + 4]
mov eax, dword [ebx]
test ecx, ecx
mov ecx, dword [eax]
mov dword [esp + 4], esi
mov dword [esp], eax
jne 0x6f50b780
call dword [ecx + 0x28]
mov dword [ebx + 8], eax
sub esp, 8
call sym._GetProcessHeap_0
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._HeapFree_12
mov eax, dword [ebx + 8]
sub esp, 0xc
lea esp, [ebp - 0xc]
not eax
pop ebx
pop esi
shr eax, 0x1f
pop edi
pop ebp
ret 0x10
call dword [ecx + 0x24]
sub esp, 8
mov dword [ebx + 8], eax
jmp 0x6f50b74a
mov dword [ebx + 8], 0x8007000e
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
mov edx, ebx
mov eax, esi
mov dword [ebp - 0x14], ecx
call sym._create_registrar
mov ecx, dword [ebp - 0x14]
test eax, eax
jne 0x6f50b692
xor eax, eax
jmp 0x6f50b799

Function at 0x6f50c4a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
lea esi, [ebp + 0xc]
sub esp, 0x10
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
lea ebx, [eax + 0x40]
mov dword [esp + 4], 1
mov dword [esp + 0xc], ebx
mov dword [esp], 0x6f5136dc
call sym._fwrite
mov eax, dword [ebp + 8]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.msvcrt.dll_vfprintf]
call sym._abort
lea esi, [esi]