joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10048e10
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Initialize winsock library
Set socket configuration

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1016c178
push eax
mov dword fs:[0], esp
sub esp, 0x24
push esi
mov esi, ecx
push edi
lea eax, [esi + 0x20]
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
test eax, eax
je 0x10048e68
push eax
add esi, 8
push str._socketlib__fncWSAStartup_code0x_x
push esi
call fcn.101552a0
add esp, 0xc
mov eax, 1
pop edi
pop esi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
add esp, 0x30
ret 8
lea ecx, [esp + 0x18]
call fcn.10154190
mov edx, dword [esp + 0x3c]
lea ecx, [esp + 0x18]
push ecx
push edx
mov ecx, esi
mov dword [esp + 0x3c], 0
call fcn.10049510
test eax, eax
jle 0x10048eb7
lea ecx, [esp + 0x18]
mov dword [esp + 0x34], 0xffffffff
call fcn.10154250
pop edi
mov eax, 2
pop esi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
add esp, 0x30
ret 8
lea ecx, [esp + 0x18]
call fcn.10154a90
push 0
push 1
push 2
mov edi, eax
call sub.WSOCK32.dll_socket
cmp eax, 0xffffffff
mov dword [esi + 4], eax
jne 0x10048f15
call sub.WSOCK32.dll_WSAGetLastError
push eax
add esi, 8
push str._socketlib__fncsocket_code0x_x
push esi
call fcn.101552a0
add esp, 0xc
lea ecx, [esp + 0x18]
mov dword [esp + 0x34], 0xffffffff
call fcn.10154250
pop edi
mov eax, 3
pop esi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
add esp, 0x30
ret 8
xor eax, eax
push edi
mov dword [esp + 0xc], eax
mov word [esp + 0xc], 2
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
call sub.WSOCK32.dll_inet_addr
mov ecx, dword [esp + 0x40]
mov dword [esp + 0xc], eax
push ecx
call sub.WSOCK32.dll_htons
mov word [esp + 0xa], ax
mov eax, dword [esi + 4]
lea edx, [esp + 8]
push 0x10
push edx
push eax
call sub.WSOCK32.dll_connect
cmp eax, 0xffffffff
jne 0x10048f9c
call sub.WSOCK32.dll_WSAGetLastError
push eax
add esi, 8
push str._socketlib__fncconnect_code0x_x
push esi
call fcn.101552a0
add esp, 0xc
lea ecx, [esp + 0x18]
mov dword [esp + 0x34], 0xffffffff
call fcn.10154250
pop edi
mov eax, 4
pop esi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
add esp, 0x30
ret 8
lea ecx, [esp + 0x18]
mov dword [esp + 0x34], 0xffffffff
call fcn.10154250
mov ecx, dword [esp + 0x2c]
pop edi
xor eax, eax
pop esi
mov dword fs:[0], ecx
add esp, 0x30
ret 8

Function at 0x10049020
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
xor esi, esi
test edi, edi
mov ebx, ecx
jle 0x10049053
mov ebp, dword [esp + 0x14]
mov edx, dword [ebx + 4]
mov eax, edi
sub eax, esi
push 0
lea ecx, [esi + ebp]
push eax
push ecx
push edx
call sub.WSOCK32.dll_send
cmp eax, 0xffffffff
je 0x1004905c
add esi, eax
cmp esi, edi
jl 0x10049034
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8
call sub.WSOCK32.dll_WSAGetLastError
push eax
add ebx, 8
push str._socketlib__fncsend_code0x_x
push ebx
call fcn.101552a0
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x10049080
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x104
push ebx
push ebp
push esi
mov esi, ecx
mov ecx, dword [esp + 0x118]
push edi
test ecx, ecx
je 0x10049229
call fcn.10154ad0
mov ebp, dword [esp + 0x118]
lea edi, [ebp + 1]
push edi
call fcn.10158bf6
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x10049229
mov ecx, edi
xor eax, eax
mov edx, ecx
mov edi, ebx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
xor edi, edi
test ebp, ebp
jle 0x10049167
mov ecx, dword [esi + 0x1c]
mov eax, dword [esi + 4]
mov dword [0x101d1900], ecx
push 0x101d1900
push 0
lea ecx, [esp + 0x18]
inc eax
mov dword [0x101d1904], 0
mov edx, dword [esi + 4]
push 0
push ecx
push eax
mov dword [esp + 0x28], edx
mov dword [esp + 0x24], 1
call sub.WSOCK32.dll_select
cmp eax, 0xffffffff
je 0x1004918d
test eax, eax
je 0x100491bc
mov eax, dword [esi + 4]
lea edx, [esp + 0x10]
push edx
push eax
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x1004923b
mov eax, dword [esi + 4]
mov ecx, ebp
sub ecx, edi
push 0
lea edx, [edi + ebx]
push ecx
push edx
push eax
call sub.WSOCK32.dll_recv
cmp eax, 0xffffffff
je 0x100491e4
test eax, eax
je 0x10049213
add edi, eax
cmp edi, ebp
jl 0x100490db
mov ecx, dword [esp + 0x11c]
push ebp
push ebx
call fcn.101545a0
push ebx
call fcn.10158e44
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret 8
call sub.WSOCK32.dll_WSAGetLastError
push eax
add esi, 8
push str._socketlib__fncselect_code0x_x
push esi
call fcn.101552a0
push ebx
call fcn.10158e44
add esp, 0x10
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret 8
push str.Receive_Body_TimeOut__
lea ecx, [esi + 8]
call fcn.10154630
push ebx
call fcn.10158e44
add esp, 4
mov eax, 0x100
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret 8
call sub.WSOCK32.dll_WSAGetLastError
push eax
add esi, 8
push str._socketlib__fncrecv_code0x_x
push esi
call fcn.101552a0
push ebx
call fcn.10158e44
add esp, 0x10
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret 8
push str.The_connection_closed..
lea ecx, [esi + 8]
call fcn.10154630
push ebx
call fcn.10158e44
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x104
ret 8
push str.FD_ISSET_failed__
jmp 0x10049218
Function at 0x10049250
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1016c1a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
push esi
push edi
mov edi, dword [esp + 0x58]
mov esi, ecx
mov ecx, edi
call fcn.10154280
inc eax
push eax
call sub.WSOCK32.dll_htonl
mov dword [esp + 0x58], eax
lea eax, [esp + 0x58]
push 4
push eax
lea ecx, [esp + 0x38]
call fcn.101541f0
lea ecx, [esp + 0x54]
push 1
push ecx
lea ecx, [esp + 0x24]
mov dword [esp + 0x54], 0
call fcn.101541f0
lea edx, [esp + 0x30]
lea ecx, [esp + 8]
push edx
mov byte [esp + 0x50], 1
call fcn.10154220
lea eax, [esp + 0x1c]
lea ecx, [esp + 8]
push eax
mov byte [esp + 0x50], 2
call fcn.10154880
push edi
lea ecx, [esp + 0xc]
call fcn.10154880
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call fcn.10048ff0
lea ecx, [esp + 8]
mov esi, eax
mov byte [esp + 0x4c], 1
call fcn.10154250
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4c], 0
call fcn.10154250
lea ecx, [esp + 0x30]
mov dword [esp + 0x4c], 0xffffffff
call fcn.10154250
mov ecx, dword [esp + 0x44]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x48
ret 8
Function at 0x10049330
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push 0xffffffffffffffff
push 0x1016c1cb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x118
push ebp
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0xc]
call fcn.10154190
lea eax, [esp + 0xc]
mov ecx, esi
push eax
push 4
mov dword [esp + 0x134], 0
call fcn.10049080
mov edi, eax
test edi, edi
jle 0x10049393
lea ecx, [esp + 0xc]
mov dword [esp + 0x12c], 0xffffffff
call fcn.10154250
mov eax, edi
jmp 0x100494ed
lea ecx, [esp + 0xc]
call fcn.10154a90
mov eax, dword [eax]
push eax
call sub.WSOCK32.dll_ntohl
mov ecx, dword [esi + 0x1c]
mov edi, eax
mov eax, dword [esi + 4]
mov dword [0x101d1908], ecx
push 0x101d1908
dec edi
push 0
lea ecx, [esp + 0x28]
inc eax
mov dword [0x101d190c], 0
mov edx, dword [esi + 4]
push 0
push ecx
push eax
mov dword [esp + 0x38], edx
mov dword [esp + 0x34], 1
call sub.WSOCK32.dll_select
or ebp, 0xffffffff
cmp eax, ebp
jne 0x10049404
call sub.WSOCK32.dll_WSAGetLastError
push eax
add esi, 8
push str._socketlib__fncselect_code0x_x
push esi
call fcn.101552a0
add esp, 0xc
jmp 0x100494d8
test eax, eax
jne 0x1004942f
push str.Receive_Body_TimeOut__
lea ecx, [esi + 8]
call fcn.10154630
lea ecx, [esp + 0xc]
mov dword [esp + 0x12c], ebp
call fcn.10154250
mov eax, 0x100
jmp 0x100494ed
mov eax, dword [esi + 4]
lea edx, [esp + 0x20]
push edx
push eax
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x100494cb
mov ecx, dword [esp + 0x134]
mov edx, dword [esi + 4]
push 0
push 1
push ecx
push edx
call sub.WSOCK32.dll_recv
cmp eax, ebp
jne 0x1004948c
call sub.WSOCK32.dll_WSAGetLastError
push eax
add esi, 8
push str._socketlib__fncrecv_code0x_x
push esi
call fcn.101552a0
add esp, 0xc
lea ecx, [esp + 0xc]
mov dword [esp + 0x12c], ebp
call fcn.10154250
mov eax, 2
jmp 0x100494ed
test eax, eax
jne 0x10049497
push str.The_connection_closed..
jmp 0x100494d0
mov eax, dword [esp + 0x138]
mov ecx, esi
push eax
push edi
call fcn.10049080
test eax, eax
mov dword [esp + 0x12c], ebp
lea ecx, [esp + 0xc]
jle 0x100494c2
call fcn.10154250
mov eax, 3
jmp 0x100494ed
call fcn.10154250
xor eax, eax
jmp 0x100494ed
push str.FD_ISSET_failed__
lea ecx, [esi + 8]
call fcn.10154630
lea ecx, [esp + 0xc]
mov dword [esp + 0x12c], ebp
call fcn.10154250
mov eax, 1
mov ecx, dword [esp + 0x124]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x124
ret 8
Function at 0x10049510
Capabilities:
Resolve dns

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
mov ebx, ecx
push edi
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x10049549
mov al, byte [edx + esi]
cmp al, 0x2e
je 0x10049538
cmp al, 0x30
jl 0x1004955b
cmp al, 0x39
jg 0x1004955b
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
inc edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp edx, ecx
jb 0x10049529
mov ecx, dword [esp + 0x14]
push esi
call fcn.10154630
pop edi
pop esi
xor eax, eax
pop ebx
ret 8
push esi
call sub.WSOCK32.dll_gethostbyname
test eax, eax
je 0x100495b9
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x100495b9
mov ecx, dword [ecx]
test ecx, ecx
je 0x100495b9
cmp word [eax + 0xa], 4
jb 0x100495b9
mov ecx, dword [ecx]
push ecx
call sub.WSOCK32.dll_inet_ntoa
test eax, eax
jne 0x100495a7
call sub.WSOCK32.dll_WSAGetLastError
push eax
add ebx, 8
push str._socketlib__fncinet_ntoa_code0x_x
push ebx
call fcn.101552a0
add esp, 0xc
mov eax, 2
pop edi
pop esi
pop ebx
ret 8
mov ecx, dword [esp + 0x14]
push eax
call fcn.10154630
pop edi
pop esi
xor eax, eax
pop ebx
ret 8
call sub.WSOCK32.dll_WSAGetLastError
push eax
push esi
add ebx, 8
push str.Host_Name__s_
push ebx
call fcn.101552a0
add esp, 0x10
mov eax, 1
pop edi
pop esi
pop ebx
ret 8

Function at 0x10049710
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x104
push ebx
mov ebx, dword [esp + 0x10c]
push esi
push edi
xor edi, edi
mov esi, ecx
test ebx, ebx
jle 0x100497b3
mov ecx, dword [esi + 0x1c]
mov eax, dword [esi + 4]
mov dword [0x101d1910], ecx
push 0x101d1910
push 0
lea ecx, [esp + 0x14]
inc eax
mov dword [0x101d1914], 0
mov edx, dword [esi + 4]
push 0
push ecx
push eax
mov dword [esp + 0x24], edx
mov dword [esp + 0x20], 1
call sub.WSOCK32.dll_select
cmp eax, 0xffffffff
je 0x100497c1
test eax, eax
je 0x100497ce
mov eax, dword [esi + 4]
lea edx, [esp + 0xc]
push edx
push eax
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x10049832
mov edx, dword [esp + 0x118]
mov ecx, ebx
sub ecx, edi
push 0
push ecx
mov ecx, dword [esi + 4]
lea eax, [edi + edx]
push eax
push ecx
call sub.WSOCK32.dll_recv
cmp eax, 0xffffffff
je 0x100497ec
test eax, eax
je 0x10049814
add edi, eax
cmp edi, ebx
jl 0x1004972c
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x104
ret 8
call sub.WSOCK32.dll_WSAGetLastError
push eax
push str._socketlib__fncselect_code0x_x
jmp 0x100497f7
push str.Receive_Body_TimeOut__
lea ecx, [esi + 8]
call fcn.10154630
pop edi
pop esi
mov eax, 0x100
pop ebx
add esp, 0x104
ret 8
call sub.WSOCK32.dll_WSAGetLastError
push eax
push str._socketlib__fncrecv_code0x_x
add esi, 8
push esi
call fcn.101552a0
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x104
ret 8
push str.The_connection_closed..
lea ecx, [esi + 8]
call fcn.10154630
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x104
ret 8
push str.FD_ISSET_failed__
lea ecx, [esi + 8]
call fcn.10154630
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x104
ret 8
Function at 0x100502c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1016c538
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [esp + 0x2c]
push edi
mov ecx, esi
call fcn.10154a90
mov ecx, esi
mov ebx, eax
call fcn.10154280
lea ecx, [esp + 0xc]
mov edi, eax
call fcn.10154190
xor esi, esi
cmp edi, esi
mov dword [esp + 0x28], esi
mov word [esp + 0x30], si
jle 0x1005036a
push ebp
mov ebp, dword [esp + 0x3c]
mov eax, esi
and eax, reloc.WSOCK32.dll_closesocket
jns 0x1005031c
dec eax
or eax, 0xfffffffc
inc eax
jne 0x10050330
test esi, esi
je 0x10050330
push 0x1019fe88
lea ecx, [esp + 0x14]
call fcn.101547f0
test ebp, ebp
jle 0x1005034f
mov eax, esi
cdq
idiv ebp
test edx, edx
jne 0x1005034f
test esi, esi
je 0x1005034f
push 0x1019c360
lea ecx, [esp + 0x14]
call fcn.101547f0
mov cl, byte [esi + ebx]
lea edx, [esp + 0x34]
mov byte [esp + 0x34], cl
push edx
lea ecx, [esp + 0x14]
call fcn.101547f0
inc esi
cmp esi, edi
jl 0x1005030e
pop ebp
mov ecx, dword [esp + 0x34]
lea eax, [esp + 0xc]
push eax
call fcn.101546c0
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.10154250
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret

Function at 0x1005c900
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x1016d097
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.10053ae0
lea edi, [esi + 0x48]
xor ebx, ebx
mov ecx, edi
mov dword [esp + 0x18], ebx
call fcn.10154190
lea ecx, [esi + 0x5c]
mov byte [esp + 0x18], 1
call fcn.10154190
lea ecx, [esi + 0x70]
mov byte [esp + 0x18], 2
call fcn.10154190
lea ecx, [esi + 0x84]
mov byte [esp + 0x18], 3
call fcn.10154190
push str.1_2_840_113549_1_7_1
mov ecx, edi
mov byte [esp + 0x1c], 4
mov dword [esi], 0x1017b498
mov byte [esi + 0x98], bl
mov byte [esi + 0x9a], bl
mov byte [esi + 0x99], bl
mov dword [esi + 0x9c], 1
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0xa0], ebx
mov dword [esi + 0xa4], ebx
call fcn.10154630
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x1005cb00
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1016d108
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
push edi
mov edi, dword [esp + 0x2c]
mov esi, ecx
cmp edi, 1
jne 0x1005cb40
mov dword [esi + 0x9c], edi
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret 4
cmp edi, 2
jne 0x1005cb60
mov dword [esi + 0x9c], edi
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret 4
lea ecx, [esp + 8]
call fcn.10154190
push edi
lea eax, [esp + 0xc]
push str.mode__d__is_unknown_signer_identifier_method.
push eax
mov dword [esp + 0x30], 0
call fcn.101552a0
add esp, 0xc
lea ecx, [esp + 8]
call fcn.10154a90
push eax
push 1
push str.mode
push str.setSignerIdentifierMethod
push str.PSignedData
push 0x84
push str.H:00.project01.MagicAPICAOSLib_srcDSProcessPSignedData.cpp
mov ecx, esi
call fcn.10053bb0
lea ecx, [esp + 8]
mov dword [esp + 0x24], 0xffffffff
call fcn.10154250
mov ecx, dword [esp + 0x1c]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret 4

Function at 0x10061cf0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1016d586
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.10053ae0
xor edi, edi
lea ecx, [esi + 0x30]
mov dword [esp + 0x14], edi
call fcn.10154190
lea ecx, [esi + 0x44]
mov byte [esp + 0x14], 1
call fcn.10154190
lea ecx, [esi + 0x58]
mov byte [esp + 0x14], 2
call fcn.10154190
lea ecx, [esi + 0x6c]
mov byte [esp + 0x14], 3
call fcn.10154190
lea ecx, [esi + 0x80]
mov byte [esp + 0x14], 4
call fcn.10154190
lea ecx, [esi + 0x94]
mov byte [esp + 0x14], 5
call fcn.10154190
lea ecx, [esi + 0xa8]
mov byte [esp + 0x14], 6
call fcn.10154190
lea ecx, [esi + 0xbc]
mov byte [esp + 0x14], 7
call fcn.10154190
lea ecx, [esi + 0xd0]
mov byte [esp + 0x14], 8
call fcn.10154190
lea ecx, [esi + 0xe4]
mov byte [esp + 0x14], 9
call fcn.10154190
lea ecx, [esi + 0x100]
mov byte [esp + 0x14], 0xa
call fcn.10154190
lea ecx, [esi + 0x114]
mov byte [esp + 0x14], 0xb
call fcn.10154190
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x128], edi
mov dword [esi + 0x12c], edi
mov dword [esi + 0xf8], edi
mov dword [esi + 0xfc], edi
mov dword [esi], 0x1017b49c
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x10064990
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x1016d862
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.10053ae0
xor ebx, ebx
lea ecx, [esi + 0x3c]
mov dword [esp + 0x18], ebx
call fcn.10154190
lea ecx, [esi + 0x50]
mov byte [esp + 0x18], 1
call fcn.10154190
lea ecx, [esi + 0x64]
mov byte [esp + 0x18], 2
call fcn.10154190
lea ecx, [esi + 0x78]
mov byte [esp + 0x18], 3
call fcn.10154190
lea edi, [esi + 0x8c]
mov byte [esp + 0x18], 4
mov ecx, edi
call fcn.10154190
push str.1_2_840_113549_1_7_1
mov ecx, edi
mov byte [esp + 0x1c], 5
mov dword [esi], 0x1017b4a0
mov byte [esi + 0x30], bl
mov dword [esi + 0x34], 0xbcc
mov dword [esi + 0x38], 4
call fcn.10154630
mov ecx, dword [esp + 0x10]
mov dword [esi + 0xa0], ebx
mov dword [esi + 0xa4], ebx
mov dword [esi + 0xa8], ebx
mov dword [esi + 0xac], ebx
mov dword [esi + 0xb0], ebx
mov dword [esi + 0xb4], ebx
mov dword [esi + 0xb8], ebx
mov dword [esi + 0xbc], ebx
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x100661b0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x1016da08
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.10154190
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
push eax
lea edx, [esp + 8]
push ecx
push edx
mov ecx, esi
mov dword [esp + 0x2c], 0
call fcn.10064d00
test eax, eax
jle 0x1006624f
mov ecx, esi
call fcn.10053cc0
mov ecx, eax
call fcn.10154a90
push eax
push 1
push str.this
push str.getTBSData
push str.PSignedAndEnvelopedData
push 0x180
push str.H:00.project01.MagicAPICAOSLib_srcDSProcessPSignedAndEnvelopedData.cpp
mov ecx, esi
call fcn.10053bb0
lea ecx, [esp + 4]
mov dword [esp + 0x20], 0xffffffff
call fcn.10154250
mov eax, 1
pop esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
mov ecx, dword [esp + 0x2c]
add esi, 0x64
push esi
call fcn.101546c0
lea ecx, [esp + 4]
mov dword [esp + 0x20], 0xffffffff
call fcn.10154250
mov ecx, dword [esp + 0x18]
xor eax, eax
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
Function at 0x10069710
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1016dc82
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.10053ae0
xor edi, edi
lea ecx, [esi + 0x34]
mov dword [esp + 0x14], edi
call fcn.10154190
lea ecx, [esi + 0x48]
mov byte [esp + 0x14], 1
call fcn.10154190
lea ecx, [esi + 0x5c]
mov byte [esp + 0x14], 2
call fcn.10154190
lea ecx, [esi + 0x70]
mov byte [esp + 0x14], 3
call fcn.10154190
lea ecx, [esi + 0x8c]
mov byte [esp + 0x14], 4
call fcn.10154190
lea ecx, [esi + 0xa0]
mov byte [esp + 0x14], 5
call fcn.10154190
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x84], edi
mov dword [esi + 0x88], edi
mov dword [esi + 0xb8], edi
mov dword [esi + 0xb4], edi
mov dword [esi + 0x30], edi
mov dword [esi], 0x1017b4a4
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x1006a030
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1016dd48
push eax
mov eax, dword [esp + 0x10]
mov dword fs:[0], esp
sub esp, 0x14
push esi
mov esi, ecx
push edi
push eax
lea ecx, [esi + 0x8c]
call fcn.101546c0
mov ecx, dword [esi + 0x30]
call fcn.1010d940
mov edi, eax
cmp edi, 1
jle 0x1006a0e4
lea ecx, [esp + 8]
call fcn.10154190
push edi
lea ecx, [esp + 0xc]
push str.The_version__d__is_not_supported.
push ecx
mov dword [esp + 0x30], 0
call fcn.101552a0
add esp, 0xc
lea ecx, [esp + 8]
call fcn.10154a90
push eax
push 1
push str.nVersion
push str.parseSignAndEnvDataByKey
push str.PSignedAndEnvelopedDataProcess
push 0xa7
push str.H:00.project01.MagicAPICAOSLib_srcDSProcessPSignedAndEnvelopedDataProcess.cpp
mov ecx, esi
call fcn.10053bb0
lea ecx, [esp + 8]
mov dword [esp + 0x24], 0xffffffff
call fcn.10154250
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret 4
mov ecx, dword [esi + 0x30]
call fcn.100efa80
push eax
mov ecx, esi
call fcn.1006b440
test eax, eax
jle 0x1006a141
mov ecx, esi
call fcn.10053cc0
mov ecx, eax
call fcn.10154a90
push eax
push 2
push str.this
push str.parseSignAndEnvDataByKey
push str.PSignedAndEnvelopedDataProcess
push 0xaf
push str.H:00.project01.MagicAPICAOSLib_srcDSProcessPSignedAndEnvelopedDataProcess.cpp
mov ecx, esi
call fcn.10053bb0
pop edi
mov eax, 2
pop esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret 4
mov ecx, dword [esi + 0x30]
call fcn.10106510
test al, 1
je 0x1006a220
mov ecx, dword [esi + 0x30]
call fcn.100efa90
push eax
mov ecx, esi
call fcn.1006bb10
test eax, eax
jle 0x1006a1ae
mov ecx, esi
call fcn.10053cc0
mov ecx, eax
call fcn.10154a90
push eax
push 3
push str.this
push str.parseSignAndEnvDataByKey
push str.PSignedAndEnvelopedDataProcess
push 0xb5
push str.H:00.project01.MagicAPICAOSLib_srcDSProcessPSignedAndEnvelopedDataProcess.cpp
mov ecx, esi
call fcn.10053bb0
pop edi
mov eax, 3
pop esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret 4
mov ecx, dword [esi + 0x30]
call fcn.100efaa0
push eax
mov ecx, esi
call fcn.1006bf20
test eax, eax
jle 0x1006a20b
mov ecx, esi
call fcn.10053cc0
mov ecx, eax
call fcn.10154a90
push eax
push 5
push str.this
push str.parseSignAndEnvDataByKey
push str.PSignedAndEnvelopedDataProcess
push 0xbc
push str.H:00.project01.MagicAPICAOSLib_srcDSProcessPSignedAndEnvelopedDataProcess.cpp
mov ecx, esi
call fcn.10053bb0
pop edi
mov eax, 5
pop esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret 4
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret 4
push str.Signer_Certificate_does_not_exist._so__You_cant_verify_signature.
push 4
push str.ucBitMask
push str.parseSignAndEnvDataByKey
push str.PSignedAndEnvelopedDataProcess
push 0xb8
push str.H:00.project01.MagicAPICAOSLib_srcDSProcessPSignedAndEnvelopedDataProcess.cpp
mov ecx, esi
call fcn.10053bb0
mov ecx, dword [esp + 0x1c]
pop edi
mov eax, 4
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret 4