joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100015a0
Capabilities:
Get common file path
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x1000f020]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x103
lea eax, [ebp - 0x107]
push 0
push eax
mov byte [ebp - 0x108], 0
call fcn.10004760
add esp, 0xc
lea ecx, [ebp - 0x108]
push ecx
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
mov edx, dword [0x10010b34]
push edx
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.10002c17
add esp, 0xc
lea ecx, [ebp - 0x108]
push ecx
push str.Apache_Fpath
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea edx, [ebp - 0x10c]
push edx
lea eax, [ebp - 0x108]
mov dword [ebp - 0x10c], 0x10001500
call fcn.10001b90
mov ecx, dword [ebp - 4]
xor ecx, ebp
add esp, 4
call fcn.10002661
mov esp, ebp
pop ebp
ret

Function at 0x10001640
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x450
mov eax, dword [0x1000f020]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x246]
push ecx
mov word [ebp - 0x248], ax
call fcn.10004760
add esp, 0xc
push 0x104
lea edx, [ebp - 0x248]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x100017a8
xor eax, eax
push 0x3a
push eax
lea ecx, [ebp - 0x3e]
push ecx
mov word [ebp - 0x40], ax
call fcn.10004760
lea edx, [ebp - 0x248]
push str.RuntimeSvc.exe
push edx
call fcn.10002927
add esp, 0x14
test eax, eax
jne 0x100016c4
push str.RuntimeSvc.exe
push 0x1e
lea eax, [ebp - 0x40]
push eax
jmp 0x100016eb
lea ecx, [ebp - 0x248]
push str.PerfWatson.exe
push ecx
call fcn.10002927
add esp, 8
test eax, eax
jne 0x100017a8
push str.PerfWatson.exe
push 0x1e
lea edx, [ebp - 0x40]
push edx
call fcn.10002c84
add esp, 0xc
push esi
lea eax, [ebp - 0x248]
push 0x5c
push eax
call fcn.100028f9
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x44e]
push edx
mov esi, eax
mov word [ebp - 0x450], cx
call fcn.10004760
lea eax, [ebp - 0x248]
sub esi, eax
sar esi, 1
push esi
mov ecx, eax
push ecx
lea edx, [ebp - 0x450]
push 0x104
push edx
call fcn.100027f2
push 0x1000d39c
lea eax, [ebp - 0x450]
push 0x104
push eax
call fcn.10002ba2
lea ecx, [ebp - 0x40]
push ecx
lea edx, [ebp - 0x450]
push 0x104
push edx
call fcn.10002ba2
add esp, 0x3c
push 0
lea eax, [ebp - 0x450]
push eax
lea ecx, [ebp - 0x248]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea edx, [ebp - 0x450]
push edx
push 0x104
push edi
call fcn.10002c84
add esp, 0xc
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10002661
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor al, al
call fcn.10002661
mov esp, ebp
pop ebp
ret
Function at 0x100017c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, 4
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 4]
push eax
push 0x101
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push 0x80000002
mov dword [ebp - 8], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10001822
lea ecx, [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x10]
push eax
push 0
push str.ConsentPromptBehaviorAdmin
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x10001828
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 2
sete al
mov esp, ebp
pop ebp
ret

Function at 0x10001840
Capabilities:
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x214
mov eax, dword [0x1000f020]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push esi
push edi
call fcn.100017c0
test al, al
jne 0x100018cb
call fcn.10001380
test eax, eax
jne 0x100018cb
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, 0x1388
lea ebx, [ebx]
lea edi, [esp + 0x10]
sub esi, 0x3e8
call fcn.10001640
test al, al
je 0x100018a7
call fcn.10001210
test eax, eax
je 0x100018a7
mov ecx, edi
call fcn.10001060
test eax, eax
jne 0x100018c3
push esi
call ebx
test esi, esi
jne 0x10001880
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.10002661
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x10010ae8
push 0
push 0
push 0x10001df0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x10010b20], eax
call fcn.100015a0
mov ecx, dword [esp + 0x21c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10002661
mov esp, ebp
pop ebp
ret
Function at 0x100019a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, 0x10010b3a
sub edi, ecx
mov dword [ebp - 4], edi
mov edi, 0x10010b3e
sub edi, ecx
mov dword [ebp - 8], edi
mov edi, dword [0x1000fe0c]
mov esi, 2
mov edx, 0x10010b38
lea eax, [ecx + 2]
lea ebx, [esi - 2]
and ebx, 7
lea ecx, [esi - 2]
xor ecx, dword [ebx*4 + 0x1000d308]
add edx, 0xc
xor ecx, dword [edx - 0xc]
add eax, 0xc
xor ecx, edi
mov ebx, ecx
shr ebx, 0x18
mov byte [eax - 0xe], bl
mov ebx, ecx
shr ebx, 0x10
mov byte [eax - 0xd], bl
mov ebx, ecx
shr ebx, 8
mov byte [eax - 0xc], bl
mov ebx, dword [ebp - 4]
mov byte [eax - 0xb], cl
lea ecx, [esi - 1]
and ecx, 7
mov ecx, dword [ecx*4 + 0x1000d308]
xor ecx, dword [ebx + eax - 0xc]
lea ebx, [esi - 1]
xor ecx, ebx
xor ecx, edi
mov ebx, ecx
shr ebx, 0x18
mov byte [eax - 0xa], bl
mov ebx, ecx
shr ebx, 0x10
mov byte [eax - 9], bl
mov ebx, ecx
mov byte [eax - 7], cl
shr ebx, 8
mov byte [eax - 8], bl
mov ebx, dword [ebp - 8]
mov ecx, esi
and ecx, 7
mov ecx, dword [ecx*4 + 0x1000d308]
xor ecx, dword [ebx + eax - 0xc]
xor ecx, esi
xor ecx, edi
mov ebx, ecx
shr ebx, 0x18
mov byte [eax - 6], bl
mov ebx, ecx
shr ebx, 0x10
mov byte [eax - 5], bl
mov ebx, ecx
shr ebx, 8
add esi, 3
mov byte [eax - 3], cl
mov byte [eax - 4], bl
lea ecx, [esi - 2]
cmp ecx, 0x147
jb 0x100019d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001a90
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1000f020]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x40
push 0x3000
push 0x54c
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea edi, [eax + 0x10]
mov ecx, edi
call fcn.100019a0
mov eax, dword [ebp + 8]
push 0x1000d340
lea ebx, [edi + 0x51c]
push str.kernel32.dll
mov dword [ebp - 0x20], vtable.CAdHookApi.0
mov dword [ebx], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x10001b46
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x24]
push eax
push 4
push 8
push esi
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x18], esi
mov byte [ebp - 0xc], 0xb8
mov dword [ebp - 0xb], edi
mov word [ebp - 7], RtlUnwind
mov dword [ebp - 0x24], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov dword [esi], ecx
mov ecx, dword [ebp - 0x24]
lea eax, [ebp - 0x24]
push eax
push ecx
push 8
push esi
mov dword [esi + 4], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
mov dword [ebx + 0xc], eax
mov dword [ebx + 4], esi
mov dword [ebx + 8], edx
xor eax, eax
cmp dword [eax + edi], 0xaabbaacc
je 0x10001b79
inc eax
cmp eax, 0x64
jl 0x10001b57
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10002661
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov dword [eax + edi], ebx
pop edi
pop esi
xor ecx, ebp
mov al, 1
pop ebx
call fcn.10002661
mov esp, ebp
pop ebp
ret

Function at 0x10001b90
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0
push 0
push 3
push 0
push 0
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x10001be4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push 0
lea ecx, [ebp - 4]
push ecx
push ebx
mov edi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x10001bed
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
mov eax, dword [edx]
test eax, eax
je 0x10001bfd
push ebx
push edi
call eax
add esp, 8
push edi
call fcn.10001a90
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001c10
Capabilities:
Enumerate processes on remote desktop session host

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
push ecx
xor esi, esi
push 1
push esi
push esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call dword [sym.imp.WTSAPI32.dll_WTSEnumerateProcessesA]
test eax, eax
je 0x10001c64
cmp dword [ebp - 8], esi
jbe 0x10001c64
xor edi, edi
lea ecx, [ecx]
mov edx, dword [0x10011054]
mov eax, dword [ebp - 4]
mov ecx, dword [edi + eax + 8]
push edx
push ecx
call fcn.10002e1c
add esp, 8
test eax, eax
je 0x10001c76
inc esi
add edi, 0x10
cmp esi, dword [ebp - 8]
jb 0x10001c40
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10001c90
Capabilities:
Check if file exists
Create process on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x1000f020]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x103
lea eax, [ebp - 0x107]
push 0
push eax
mov byte [ebp - 0x108], 0
call fcn.10004760
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x103
lea edx, [ebp - 0x20b]
push 0
push edx
mov byte [ebp - 0x20c], 0
call fcn.10004760
lea eax, [ebp - 0x108]
push 0x2f5c
push eax
call fcn.10002e70
lea ecx, [ebp - 0x108]
sub eax, ecx
inc eax
push eax
mov edx, ecx
push edx
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.10002987
mov ecx, dword [0x10011054]
push ecx
lea edx, [ebp - 0x20c]
push 0x104
push edx
call fcn.10002c17
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
add esp, 0x30
xor esi, esi
lea esp, [esp]
lea eax, [ebp - 0x20c]
push eax
add esi, 0x3e8
call ebx
cmp eax, 0xffffffff
je 0x10001db2
test al, 0x10
jne 0x10001db2
push 0x38
lea ecx, [ebp - 0x244]
push 0
push ecx
call fcn.10004760
add esp, 0xc
lea eax, [ebp - 0x248]
lea edx, [ebp - 0x20c]
push eax
mov dword [ebp - 0x248], 0x3c
mov dword [ebp - 0x238], edx
mov dword [ebp - 0x23c], str.open
mov dword [ebp - 0x22c], 0
call edi
test eax, eax
jne 0x10001dd4
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, 0x1388
jle 0x10001d50
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10002661
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov al, 1
pop ebx
call fcn.10002661
mov esp, ebp
pop ebp
ret

Function at 0x10002661
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1000f020]
jne 0x1000266b
repz ret
jmp fcn.1000311a
Function at 0x10006fae
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1000f020]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.1000555e
and dword [ebp - 0x14], 0
cmp dword [0x10010a80], 0
mov dword [ebp - 0x18], eax
jne 0x10007061
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x10007109
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x10007109
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x10010a80], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x10010a84], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x10010a88], eax
call edi
push eax
call esi
mov dword [0x10010a90], eax
test eax, eax
je 0x10007061
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x10010a8c], eax
mov eax, dword [0x10010a8c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x100070ba
cmp dword [0x10010a90], ecx
je 0x100070ba
push eax
call esi
push dword [0x10010a90]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x100070ba
test ebx, ebx
je 0x100070ba
call edi
test eax, eax
je 0x100070b1
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x100070b1
test byte [ebp - 8], 1
jne 0x100070ba
or dword [ebp + 0x10], 0x200000
jmp 0x100070ed
mov eax, dword [0x10010a84]
cmp eax, dword [ebp - 0x18]
je 0x100070ed
push eax
call esi
test eax, eax
je 0x100070ed
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100070ed
mov eax, dword [0x10010a88]
cmp eax, dword [ebp - 0x18]
je 0x100070ed
push eax
call esi
test eax, eax
je 0x100070ed
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x10010a80]
call esi
test eax, eax
je 0x10007109
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x1000710b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10002661
leave
ret
Function at 0x770f1160
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
test byte [section..data], 8
jne 0x770f12e5
test ebx, ebx
je 0x770f1334
cmp dword [ebx], 0x414c4730
jne 0x770f1340
cmp dword [ebx + 4], 1
jne 0x770f1340
test esi, esi
je 0x770f134a
mov eax, dword [ebp + 0x14]
and eax, 0xfffffffd
je 0x770f1238
test byte [section..data], 1
jne 0x770f1200
test ebx, ebx
je 0x770f1291
test edi, edi
je 0x770f1285
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._SystemFunction036_8
sub esp, 8
test al, al
jne 0x770f1285
test byte [section..data], 1
jne 0x770f12ac
mov eax, 0xc0000002
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], str.unsupported_flags__08x_n
mov dword [esp + 0x10], 0x13d
mov dword [esp + 0xc], str.BCryptGenRandom
mov dword [esp + 8], 0x770f7095
mov dword [esp + 4], 0x770f6000
mov dword [esp], 0
call sym._ros_dbg_log
test ebx, ebx
je 0x770f1291
test byte [section..data], 1
je 0x770f11c2
mov dword [esp + 0x14], str.ignoring_selected_algorithm_n
mov dword [esp + 0x10], 0x140
mov dword [esp + 0xc], str.BCryptGenRandom
mov dword [esp + 8], 0x770f7095
mov dword [esp + 4], 0x770f6000
mov dword [esp], 0
call sym._ros_dbg_log
test edi, edi
jne 0x770f11ca
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
test edi, edi
je 0x770f1285
test byte [ebp + 0x14], 2
jne 0x770f11ca
test byte [section..data], 1
je 0x770f11ee
mov dword [esp + 0x14], str.called_with_unsupported_parameters__returning_error_n
mov dword [esp + 0x10], 0x14c
mov dword [esp + 0xc], str.BCryptGenRandom
mov dword [esp + 8], 0x770f7095
mov dword [esp + 4], 0x770f6000
mov dword [esp], 0
call sym._ros_dbg_log
jmp 0x770f11ee
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x20], edi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x24], eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], str._p___p___u___08x___semi_stub_n
mov dword [esp + 0x10], 0x12c
mov dword [esp + 0xc], str.BCryptGenRandom
mov dword [esp + 8], 0x770f7095
mov dword [esp + 4], 0x770f6000
mov dword [esp], 3
call sym._ros_dbg_log
test ebx, ebx
jne 0x770f1187
test byte [ebp + 0x14], 2
jne 0x770f119d
nop
mov eax, 0xc0000008
jmp 0x770f11f3
mov eax, 0xc000000d
jmp 0x770f11f3

Function at 0x770f24d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], 0x770f7680
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x770f76b2
mov dword [ebp - 0x40], str.BCryptAddContextFunction
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4
Function at 0x770f2530
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_BCryptAddContextFunctionProvider___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x770f76b2
mov dword [ebp - 0x40], str.BCryptAddContextFunctionProvider
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x770f2590
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_BCryptConfigureContext___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x770f76b2
mov dword [ebp - 0x40], str.BCryptConfigureContext
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x770f25f0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_BCryptConfigureContextFunction___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x770f76b2
mov dword [ebp - 0x40], str.BCryptConfigureContextFunction
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x770f2650
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_BCryptCreateContext___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x770f76b2
mov dword [ebp - 0x40], str.BCryptCreateContext
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x770f26b0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_BCryptDecrypt___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x770f76b2
mov dword [ebp - 0x40], str.BCryptDecrypt
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x770f2710
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_BCryptDeleteContext___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x770f76b2
mov dword [ebp - 0x40], str.BCryptDeleteContext
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4
Function at 0x770f2770
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_BCryptDeriveKey___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x770f76b2
mov dword [ebp - 0x40], str.BCryptDeriveKey
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x770f27f0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_BCryptDestroySecret___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x770f76b2
mov dword [ebp - 0x40], str.BCryptDestroySecret
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x770f2850
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_BCryptDuplicateHash___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x770f76b2
mov dword [ebp - 0x40], str.BCryptDuplicateHash
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x770f28b0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_BCryptDuplicateKey___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x770f76b2
mov dword [ebp - 0x40], str.BCryptDuplicateKey
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x770f2910
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_BCryptEncrypt___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x770f76b2
mov dword [ebp - 0x40], str.BCryptEncrypt
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x770f2970
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_BCryptEnumContextFunctionProviders___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], 0x770f76b2
mov dword [ebp - 0x40], str.BCryptEnumContextFunctionProviders
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4