joyce8/EMBER2024-capa huggingface dataset:
Function at 0x770f29d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_BCryptEnumContextFunctions___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x770f76b2
mov dword [ebp - 0x40], str.BCryptEnumContextFunctions
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x770f2a30
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_BCryptEnumContexts___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x770f76b2
mov dword [ebp - 0x40], str.BCryptEnumContexts
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x770f2a90
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_BCryptEnumProviders___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x770f76b2
mov dword [ebp - 0x40], str.BCryptEnumProviders
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x770f2af0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_BCryptEnumRegisteredProviders___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x770f76b2
mov dword [ebp - 0x40], str.BCryptEnumRegisteredProviders
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x770f2b50
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_BCryptExportKey___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x770f76b2
mov dword [ebp - 0x40], str.BCryptExportKey
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x770f2bb0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_BCryptFinalizeKeyPair___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x770f76b2
mov dword [ebp - 0x40], str.BCryptFinalizeKeyPair
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4
Function at 0x770f2c10
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_BCryptFreeBuffer___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x770f76b2
mov dword [ebp - 0x40], str.BCryptFreeBuffer
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x770f2c70
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_BCryptGenerateKeyPair___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x770f76b2
mov dword [ebp - 0x40], str.BCryptGenerateKeyPair
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x770f2cd0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_BCryptGenerateSymmetricKey___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x770f76b2
mov dword [ebp - 0x40], str.BCryptGenerateSymmetricKey
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x770f2d30
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_BCryptImportKey___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x770f76b2
mov dword [ebp - 0x40], str.BCryptImportKey
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x770f2d90
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 0x20]
mov dword [esp], str.WARNING:_calling_stub_BCryptImportKeyPair_0x_p_0x_p__ws_0x_p_0x_p_0x_lx_0x_lx__n
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0x1c]
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
call sym._DbgPrint
xor eax, eax
leave
ret 0x1c
Function at 0x770f2de0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_BCryptQueryContextConfiguration___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x770f76b2
mov dword [ebp - 0x40], str.BCryptQueryContextConfiguration
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x770f2e40
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_BCryptQueryContextFunctionConfiguration___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x770f76b2
mov dword [ebp - 0x40], str.BCryptQueryContextFunctionConfiguration
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x770f2ea0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_BCryptQueryContextFunctionProperty___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x770f76b2
mov dword [ebp - 0x40], str.BCryptQueryContextFunctionProperty
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x770f2f00
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_BCryptQueryProviderRegistration___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x770f76b2
mov dword [ebp - 0x40], str.BCryptQueryProviderRegistration
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x770f2f60
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_BCryptRegisterConfigChangeNotify___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x770f76b2
mov dword [ebp - 0x40], str.BCryptRegisterConfigChangeNotify
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4
Function at 0x770f2fc0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_BCryptRegisterProvider___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x770f76b2
mov dword [ebp - 0x40], str.BCryptRegisterProvider
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x770f3020
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_BCryptRemoveContextFunction___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x770f76b2
mov dword [ebp - 0x40], str.BCryptRemoveContextFunction
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x770f3080
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_BCryptRemoveContextFunctionProvider___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x770f76b2
mov dword [ebp - 0x40], str.BCryptRemoveContextFunctionProvider
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x770f30e0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_BCryptResolveProviders___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x770f76b2
mov dword [ebp - 0x40], str.BCryptResolveProviders
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x770f3140
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_BCryptSecretAgreement___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x770f76b2
mov dword [ebp - 0x40], str.BCryptSecretAgreement
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4
Function at 0x770f31a0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_BCryptSetAuditingInterface___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x770f76b2
mov dword [ebp - 0x40], str.BCryptSetAuditingInterface
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x770f3200
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_BCryptSetContextFunctionProperty___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x770f76b2
mov dword [ebp - 0x40], str.BCryptSetContextFunctionProperty
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x770f3260
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_BCryptSetProperty___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x770f76b2
mov dword [ebp - 0x40], str.BCryptSetProperty
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x770f32c0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_BCryptSignHash___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x770f76b2
mov dword [ebp - 0x40], str.BCryptSignHash
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x770f3320
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_BCryptUnregisterConfigChangeNotify___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x770f76b2
mov dword [ebp - 0x40], str.BCryptUnregisterConfigChangeNotify
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4
Function at 0x770f3380
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_BCryptUnregisterProvider___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x770f76b2
mov dword [ebp - 0x40], str.BCryptUnregisterProvider
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x770f33e0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 0x20]
mov dword [esp], str.WARNING:_calling_stub_BCryptVerifySignature_0x_p_0x_p_0x_p_0x_lx_0x_p_0x_lx_0x_lx__n
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0x1c]
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
call sym._DbgPrint
xor eax, eax
leave
ret 0x1c

Function at 0x770f3430
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_GetAsymmetricEncryptionInterface___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x770f76b2
mov dword [ebp - 0x40], str.GetAsymmetricEncryptionInterface
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x770f3490
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_GetCipherInterface___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x770f76b2
mov dword [ebp - 0x40], str.GetCipherInterface
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x770f34f0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_GetHashInterface___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x770f76b2
mov dword [ebp - 0x40], str.GetHashInterface
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4
Function at 0x770f3550
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_GetRngInterface___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x770f76b2
mov dword [ebp - 0x40], str.GetRngInterface
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x770f35b0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_GetSecretAgreementInterface___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x770f76b2
mov dword [ebp - 0x40], str.GetSecretAgreementInterface
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x770f3610
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_GetSignatureInterface___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x770f76b2
mov dword [ebp - 0x40], str.GetSignatureInterface
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4
Function at 0x770f53e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
lea esi, [ebp + 0xc]
sub esp, 0x10
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
lea ebx, [eax + 0x40]
mov dword [esp + 4], 1
mov dword [esp + 0xc], ebx
mov dword [esp], 0x770f8684
call sym._fwrite
mov eax, dword [ebp + 8]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.msvcrt.dll_vfprintf]
call sym._abort
lea esi, [esi]
Function at 0x40c9dd
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41b558]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0040a033
mov dword [ebp - 0x14], eax
cmp dword [0x4b40d8], esi
jne 0x40cad0
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40ca5d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40cbb0
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40cbb0
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40cbb0
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x4b40d8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x4b40dc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4b40e0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4b40e8], eax
test eax, eax
je 0x40cacd
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4b40e4], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40caf5
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40cae8
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40cb0a
push 4
pop eax
jmp 0x40cbb2
cmp dword [ebp - 0x14], esi
je 0x40cb0a
push dword [0x4b40d8]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40caef
mov eax, dword [0x4b40e4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40cb68
cmp dword [0x4b40e8], edi
je 0x40cb68
push eax
call ebx
push dword [0x4b40e8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40cb68
test eax, eax
je 0x40cb68
call ecx
test eax, eax
je 0x40cb5d
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40cb5d
test byte [ebp - 8], 1
jne 0x40cb68
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40cb98
mov eax, dword [0x4b40dc]
cmp eax, edi
je 0x40cb95
push eax
call ebx
test eax, eax
je 0x40cb95
call eax
mov esi, eax
test esi, esi
je 0x40cb95
mov eax, dword [0x4b40e0]
cmp eax, edi
je 0x40cb95
push eax
call ebx
test eax, eax
je 0x40cb95
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4b40d8]
call ebx
test eax, eax
je 0x40cbb0
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40cbb2
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004044c0
mov esp, ebp
pop ebp
ret