joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10079820
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x1016f35e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.10053ae0
xor ebx, ebx
lea ecx, [esi + 0x64]
mov dword [esp + 0x1c], ebx
call fcn.10154190
lea edi, [esi + 0x78]
mov byte [esp + 0x1c], 1
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.10154190
lea ecx, [edi + 0x14]
mov byte [esp + 0x1c], 2
call fcn.10154190
lea ecx, [edi + 0x28]
mov byte [esp + 0x1c], 3
call fcn.10154190
lea ecx, [edi + 0x3c]
mov byte [esp + 0x1c], 4
call fcn.10154190
lea ecx, [edi + 0x50]
mov byte [esp + 0x1c], 5
call fcn.10154190
lea edi, [esi + 0xdc]
mov byte [esp + 0x1c], 6
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.10154190
lea ecx, [edi + 0x14]
mov byte [esp + 0x1c], 7
call fcn.10154190
lea ecx, [edi + 0x28]
mov byte [esp + 0x1c], 8
call fcn.10154190
lea ecx, [edi + 0x3c]
mov byte [esp + 0x1c], 9
call fcn.10154190
lea ecx, [edi + 0x50]
mov byte [esp + 0x1c], 0xa
call fcn.10154190
lea ecx, [esi + 0x14c]
mov byte [esp + 0x1c], 0xb
call fcn.10154190
or eax, 0xffffffff
mov dword [esi], 0x1017b4d8
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], eax
mov dword [esi + 0x58], eax
mov dword [esi + 0x5c], eax
mov byte [esi + 0x30], bl
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x140], ebx
mov dword [esi + 0x144], ebx
mov dword [esi + 0x148], ebx
mov dword [esi + 0x160], ebx
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0xc]
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x100891d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10170088
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
call fcn.10053ae0
xor ebx, ebx
lea ecx, [esi + 0x30]
mov dword [esp + 0x14], ebx
call fcn.10154190
mov ecx, dword [esp + 0xc]
mov dword [esi], 0x1017b4dc
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x44], ebx
mov byte [esi + 0x49], bl
mov byte [esi + 0x48], bl
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x10090e00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x101709c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.10053ae0
xor edi, edi
lea ecx, [esi + 0x34]
mov dword [esp + 0x14], edi
call fcn.10154190
lea ecx, [esi + 0x48]
mov byte [esp + 0x14], 1
call fcn.10154190
lea ecx, [esi + 0x5c]
mov byte [esp + 0x14], 2
call fcn.10154190
lea ecx, [esi + 0x70]
mov byte [esp + 0x14], 3
call fcn.10154190
lea ecx, [esi + 0x84]
mov byte [esp + 0x14], 4
call fcn.10154190
lea ecx, [esi + 0x98]
mov byte [esp + 0x14], 5
call fcn.10154190
lea ecx, [esi + 0xac]
mov byte [esp + 0x14], 6
call fcn.10154190
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x30], edi
mov dword [esi + 0xcc], edi
mov dword [esi + 0xc8], edi
mov dword [esi + 0xd0], edi
mov dword [esi], 0x1017b4e4
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x10092180
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10170b43
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
call fcn.10053ae0
xor ebx, ebx
lea ecx, [esi + 0x34]
mov dword [esp + 0x14], ebx
call fcn.10154190
lea ecx, [esi + 0x48]
mov byte [esp + 0x14], 1
call fcn.10154190
lea ecx, [esi + 0x74]
mov byte [esp + 0x14], 2
call fcn.10154190
lea ecx, [esi + 0x88]
mov byte [esp + 0x14], 3
call fcn.10154190
lea ecx, [esi + 0x9c]
mov byte [esp + 0x14], 4
call fcn.10154190
lea ecx, [esi + 0xb0]
mov byte [esp + 0x14], 5
call fcn.10154190
lea ecx, [esi + 0xc4]
mov byte [esp + 0x14], 6
call fcn.10154190
mov ecx, dword [esp + 0xc]
mov dword [esi], 0x1017b4e8
mov dword [esi + 0x5c], ebx
mov dword [esi + 0xd8], ebx
mov dword [esi + 0xdc], ebx
mov dword [esi + 0xe0], ebx
mov byte [esi + 0x30], bl
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x1009db10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x101713fe
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.10053ae0
xor edi, edi
lea ecx, [esi + 0x38]
mov dword [esp + 0x14], edi
call fcn.10154190
lea ecx, [esi + 0x4c]
mov byte [esp + 0x14], 1
call fcn.10154190
lea ecx, [esi + 0x60]
mov byte [esp + 0x14], 2
call fcn.10154190
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x7c], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x78], edi
mov dword [esi + 0x30], edi
mov dword [esi], 0x1017b4f4
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x100aa630
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x10171f87
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
call fcn.10053ae0
xor ebx, ebx
lea ecx, [esi + 0x3c]
mov dword [esp + 0x14], ebx
call fcn.10154190
lea ecx, [esi + 0x50]
mov byte [esp + 0x14], 1
call fcn.10154190
lea ecx, [esi + 0x64]
mov byte [esp + 0x14], 2
call fcn.10154190
lea ecx, [esi + 0x88]
mov byte [esp + 0x14], 3
call fcn.10154190
lea ecx, [esi + 0xa0]
mov byte [esp + 0x14], 4
call fcn.10154190
mov ecx, dword [esp + 0xc]
mov dword [esi], 0x1017b51c
mov dword [esi + 0x34], ebx
mov byte [esi + 0x30], bl
mov byte [esi + 0x38], bl
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x84], ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x80], ebx
mov dword [esi + 0xb4], ebx
mov dword [esi + 0x9c], ebx
mov dword [esi + 0xb8], ebx
mov dword [esi + 0xbc], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x100b1a40
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x10172494
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.10053ae0
lea ecx, [esi + 0x3c]
mov dword [esp + 0x14], 0
call fcn.10154190
lea ecx, [esi + 0x50]
mov byte [esp + 0x14], 1
call fcn.10154190
lea edi, [esi + 0x64]
mov byte [esp + 0x14], 2
mov ecx, edi
call fcn.10154190
lea ecx, [esi + 0x78]
mov byte [esp + 0x14], 3
call fcn.10154190
mov eax, 4
push str.1_2_840_113549_1_7_1
mov ecx, edi
mov byte [esp + 0x18], al
mov dword [esi], 0x1017b520
mov dword [esi + 0x34], 0xbcc
mov dword [esi + 0x38], eax
call fcn.10154630
mov ecx, dword [esp + 0xc]
mov byte [esi + 0x30], 0
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x100b21d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x101725b4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.10053ae0
lea edi, [esi + 0x38]
mov dword [esp + 0x18], 0
mov ecx, edi
call fcn.10154190
lea ebx, [esi + 0x4c]
mov byte [esp + 0x18], 1
mov ecx, ebx
call fcn.10154190
lea ecx, [esi + 0x60]
mov byte [esp + 0x18], 2
call fcn.10154190
lea ecx, [esi + 0x74]
mov byte [esp + 0x18], 3
call fcn.10154190
mov ecx, edi
mov byte [esp + 0x18], 4
mov dword [esi], 0x1017b524
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
call fcn.10154ad0
mov ecx, ebx
call fcn.10154ad0
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x100b2f80
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x101726ef
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.10053ae0
xor ebx, ebx
lea ecx, [esi + 0x44]
mov dword [esp + 0x18], ebx
call fcn.10154190
lea ecx, [esi + 0x58]
mov byte [esp + 0x18], 1
call fcn.10154190
lea edi, [esi + 0x78]
mov byte [esp + 0x18], 2
mov ecx, edi
call fcn.10154190
lea ecx, [esi + 0x8c]
mov byte [esp + 0x18], 3
call fcn.10154190
lea ecx, [esi + 0xa0]
mov byte [esp + 0x18], 4
call fcn.10154190
lea ecx, [esi + 0xb4]
mov byte [esp + 0x18], 5
call fcn.10154190
lea ecx, [esi + 0xc8]
mov byte [esp + 0x18], 6
call fcn.10154190
lea ecx, [esi + 0xdc]
mov byte [esp + 0x18], 7
call fcn.10154190
mov eax, 2
push str.1_2_840_113549_1_7_1
mov ecx, edi
mov byte [esp + 0x1c], 8
mov dword [esi], 0x1017b528
mov byte [esi + 0x30], bl
mov byte [esi + 0x31], bl
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 1
mov dword [esi + 0x40], eax
mov dword [esi + 0x6c], 0xbb8
mov dword [esi + 0x70], 4
call fcn.10154630
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x74], ebx
mov dword [esi + 0xf0], ebx
mov dword [esi + 0xf4], ebx
mov dword [esi + 0x34], 0x3f3
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x100b8ad0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10172c09
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
call fcn.10053ae0
xor ebx, ebx
lea ecx, [esi + 0x34]
mov dword [esp + 0x14], ebx
call fcn.10154190
lea ecx, [esi + 0x5c]
mov byte [esp + 0x14], 1
call fcn.10154190
lea ecx, [esi + 0x70]
mov byte [esp + 0x14], 2
call fcn.10154190
mov ecx, esi
mov byte [esp + 0x14], 3
mov dword [esi], 0x1017b530
mov byte [esi + 0x30], bl
mov dword [esi + 0x58], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x50], ebx
call fcn.100b8c90
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x100c4ad0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10173178
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, dword [esp + 0x30]
push edi
mov edi, ecx
mov ecx, esi
call fcn.10154a90
mov ecx, esi
mov ebp, eax
call fcn.10154280
lea ebx, [eax + eax + 2]
push ebx
call fcn.10164e45
mov esi, eax
add esp, 4
test esi, esi
jne 0x100c4b43
push str.new_failed.
push 1
push str.ucUni
push str.asc2uniWithByteString
push str.PPKCS12
push 0x4ec
push str.H:00.project01.MagicAPICAOSLib_srcDSProcessPPKCS12.cpp
mov ecx, edi
call fcn.10053bb0
mov eax, 1
jmp 0x100c4bb0
mov ecx, ebx
xor eax, eax
mov edx, ecx
mov edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
xor eax, eax
test ebx, ebx
jle 0x100c4b73
mov ecx, eax
mov byte [esi + eax], 0
sar ecx, 1
add eax, 2
mov dl, byte [ecx + ebp]
cmp eax, ebx
mov byte [esi + eax - 1], dl
jl 0x100c4b5d
push ebx
push esi
lea ecx, [esp + 0x18]
call fcn.101541f0
mov ecx, dword [esp + 0x38]
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x30], 0
call fcn.101546c0
push esi
call fcn.10164e6e
add esp, 4
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
call fcn.10154250
xor eax, eax
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 8
Function at 0x100c6190
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x101733a3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.10053ae0
xor ebx, ebx
lea ecx, [esi + 0x54]
mov dword [esp + 0x18], ebx
call fcn.10154190
lea ecx, [esi + 0x68]
mov byte [esp + 0x18], 1
call fcn.10154190
lea edi, [esi + 0x7c]
mov byte [esp + 0x18], 2
mov ecx, edi
call fcn.10154190
lea ecx, [esi + 0x90]
mov byte [esp + 0x18], 3
call fcn.10154190
lea ecx, [esi + 0xa8]
mov byte [esp + 0x18], 4
call fcn.10154190
lea ecx, [esi + 0xbc]
mov byte [esp + 0x18], 5
call fcn.10154190
mov byte [esp + 0x18], 6
mov dword [esi], 0x1017b534
mov byte [esi + 0x30], bl
mov dword [esi + 0x34], 0x18
call fcn.10126f40
mov dword [esi + 0x38], eax
call fcn.10126ff0
push str.1_2_410_200004_1_4
mov ecx, edi
mov dword [esi + 0x3c], eax
call fcn.10154630
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x40], 0x20
mov dword [esi + 0x44], 0x10
mov dword [esi + 0x48], 0x14
mov dword [esi + 0x50], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0xa4], 0x400
mov dword [esi + 0xd0], ebx
mov byte [esi + 0xd4], bl
mov byte [esi + 0xd5], bl
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x100c9bf0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10173763
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
call fcn.10053ae0
xor ebx, ebx
lea ecx, [esi + 0x38]
mov dword [esp + 0x14], ebx
call fcn.10154190
lea ecx, [esi + 0x50]
mov byte [esp + 0x14], 1
call fcn.100aa630
mov ecx, dword [esp + 0xc]
mov dword [esi], 0x1017b538
mov dword [esi + 0x30], ebx
mov dword [esi + 0x4c], ebx
mov byte [esi + 0x34], bl
mov dword [esi + 0x110], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x100eaf10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10175a98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0xc]
call fcn.10154190
mov edi, dword [esp + 0x30]
mov dword [esp + 0x28], 0
mov ecx, edi
call fcn.100d1160
push eax
lea ecx, [esp + 0x10]
call fcn.101546c0
mov ecx, edi
call fcn.10154280
test eax, eax
jle 0x100eafb6
mov ecx, edi
call fcn.100ce1b0
mov ecx, eax
call fcn.10154a90
push eax
push 1
push str.data
push str.setHashAlgorithm
push str.RRSAES_OAEP_params
push 0x27
push str.H:00.project01.MagicAPICAOSLib_srcASN1PkixRRSAES_OAEP_params.cpp
mov ecx, esi
call fcn.100ce0a0
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.10154250
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret 4
push str.1_3_14_3_2_26
lea ecx, [esp + 0x10]
call fcn.101549c0
test al, al
jne 0x100eb0ba
mov ecx, edi
lea ebx, [esi + 8]
call fcn.100d11d0
push eax
mov ecx, ebx
call fcn.101546c0
mov ecx, edi
call fcn.10154280
test eax, eax
jle 0x100eb041
mov ecx, edi
call fcn.100ce1b0
mov ecx, eax
call fcn.10154a90
push eax
push 2
push str.data
push str.setHashAlgorithm
push str.RRSAES_OAEP_params
push 0x2f
push str.H:00.project01.MagicAPICAOSLib_srcASN1PkixRRSAES_OAEP_params.cpp
mov ecx, esi
call fcn.100ce0a0
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.10154250
pop edi
pop esi
mov eax, 2
pop ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret 4
lea edi, [esi + 0x40]
push ebx
mov ecx, edi
call fcn.100d1330
test eax, eax
jle 0x100eb0a8
mov ecx, edi
call fcn.100ce1b0
mov ecx, eax
call fcn.10154a90
push eax
push 3
push str.m_hashAlgorithm
push str.setHashAlgorithm
push str.RRSAES_OAEP_params
push 0x32
push str.H:00.project01.MagicAPICAOSLib_srcASN1PkixRRSAES_OAEP_params.cpp
mov ecx, esi
call fcn.100ce0a0
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.10154250
pop edi
pop esi
mov eax, 3
pop ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret 4
push 0x80
push 0
mov ecx, edi
call fcn.100cdfb0
or byte [esi + 0x3c], 1
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.10154250
mov ecx, dword [esp + 0x20]
pop edi
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 4
Function at 0x100f8680
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10176be8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.10053ae0
xor edi, edi
lea ecx, [esi + 0x34]
mov dword [esp + 0x14], edi
call fcn.10154190
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x30], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi], 0x1017b7b8
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x10103c70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10177ad8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0xc]
call fcn.10154190
mov edi, dword [esp + 0x30]
mov dword [esp + 0x28], 0
mov ecx, edi
call fcn.100d1160
push eax
lea ecx, [esp + 0x10]
call fcn.101546c0
mov ecx, edi
call fcn.10154280
test eax, eax
jle 0x10103d16
mov ecx, edi
call fcn.100ce1b0
mov ecx, eax
call fcn.10154a90
push eax
push 1
push str.data
push str.setHashAlgorithm
push str.RRSASSA_PSS_params
push 0x20
push str.H:00.project01.MagicAPICAOSLib_srcASN1PkixRRSASSA_PSS_params.cpp
mov ecx, esi
call fcn.100ce0a0
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.10154250
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret 4
push str.1_3_14_3_2_26
lea ecx, [esp + 0x10]
call fcn.101549c0
test al, al
jne 0x10103e1a
mov ecx, edi
lea ebx, [esi + 8]
call fcn.100d11d0
push eax
mov ecx, ebx
call fcn.101546c0
mov ecx, edi
call fcn.10154280
test eax, eax
jle 0x10103da1
mov ecx, edi
call fcn.100ce1b0
mov ecx, eax
call fcn.10154a90
push eax
push 2
push str.data
push str.setHashAlgorithm
push str.RRSASSA_PSS_params
push 0x28
push str.H:00.project01.MagicAPICAOSLib_srcASN1PkixRRSASSA_PSS_params.cpp
mov ecx, esi
call fcn.100ce0a0
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.10154250
pop edi
pop esi
mov eax, 2
pop ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret 4
lea edi, [esi + 0x40]
push ebx
mov ecx, edi
call fcn.100d1330
test eax, eax
jle 0x10103e08
mov ecx, edi
call fcn.100ce1b0
mov ecx, eax
call fcn.10154a90
push eax
push 3
push str.m_hashAlgorithm
push str.setHashAlgorithm
push str.RRSASSA_PSS_params
push 0x2b
push str.H:00.project01.MagicAPICAOSLib_srcASN1PkixRRSASSA_PSS_params.cpp
mov ecx, esi
call fcn.100ce0a0
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.10154250
pop edi
pop esi
mov eax, 3
pop ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret 4
push 0x80
push 0
mov ecx, edi
call fcn.100cdfb0
or byte [esi + 0x3c], 1
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.10154250
mov ecx, dword [esp + 0x20]
pop edi
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 4
Function at 0x1010f9e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x101788b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x70
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x20]
call fcn.10154190
lea ecx, [esp + 0x34]
mov dword [esp + 0x84], 0
call fcn.10154190
lea ecx, [esp + 0xc]
mov byte [esp + 0x84], 1
call fcn.10154190
mov edi, dword [esp + 0x90]
lea eax, [esp + 0xc]
mov bl, 2
push eax
mov ecx, edi
mov byte [esp + 0x88], bl
call fcn.10070630
lea ecx, [esp + 0x48]
call fcn.1005af20
mov ecx, edi
mov byte [esp + 0x84], 3
call fcn.10070c70
lea ecx, [esp + 0x20]
push eax
lea edx, [esp + 0x38]
push ecx
lea eax, [edi + 0x30]
push edx
lea ecx, [esp + 0x18]
push eax
push ecx
lea ecx, [esp + 0x5c]
call fcn.1005b870
test eax, eax
lea ecx, [esp + 0xc]
jle 0x1010fb1c
call fcn.10154b00
lea ecx, [esp + 0x48]
call fcn.10053cc0
mov ecx, eax
call fcn.10154a90
push eax
push 0x10
push str.cryptUtil
push str.composePKIBody
push str.PPKIBody
push 0x3f
push str.H:00.project01.MagicAPICAOSLib_srcDSProcessPPKIBody.cpp
mov ecx, esi
call fcn.10053bb0
lea ecx, [esp + 0x48]
mov byte [esp + 0x84], bl
call fcn.1005af60
lea ecx, [esp + 0xc]
mov byte [esp + 0x84], 1
call fcn.10154250
lea ecx, [esp + 0x34]
mov byte [esp + 0x84], 0
call fcn.10154250
lea ecx, [esp + 0x20]
mov dword [esp + 0x84], 0xffffffff
call fcn.10154250
pop edi
pop esi
mov eax, 0x10
pop ebx
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
add esp, 0x7c
ret 0xc
call fcn.10154b00
mov eax, dword [esp + 0x94]
mov ecx, dword [esp + 0x8c]
lea edx, [esp + 0x20]
push edx
push eax
push edi
push ecx
mov ecx, esi
call fcn.1010fc30
test eax, eax
jle 0x1010fbd3
mov ecx, esi
call fcn.10053cc0
mov ecx, eax
call fcn.10154a90
push eax
push 0x11
push str.this
push str.composePKIBody
push str.PPKIBody
push 0x44
push str.H:00.project01.MagicAPICAOSLib_srcDSProcessPPKIBody.cpp
mov ecx, esi
call fcn.10053bb0
lea ecx, [esp + 0x48]
mov byte [esp + 0x84], bl
call fcn.1005af60
lea ecx, [esp + 0xc]
mov byte [esp + 0x84], 1
call fcn.10154250
lea ecx, [esp + 0x34]
mov byte [esp + 0x84], 0
call fcn.10154250
lea ecx, [esp + 0x20]
mov dword [esp + 0x84], 0xffffffff
call fcn.10154250
pop edi
pop esi
mov eax, 0x11
pop ebx
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
add esp, 0x7c
ret 0xc
lea ecx, [esp + 0x48]
mov byte [esp + 0x84], bl
call fcn.1005af60
lea ecx, [esp + 0xc]
mov byte [esp + 0x84], 1
call fcn.10154250
lea ecx, [esp + 0x34]
mov byte [esp + 0x84], 0
call fcn.10154250
lea ecx, [esp + 0x20]
mov dword [esp + 0x84], 0xffffffff
call fcn.10154250
mov ecx, dword [esp + 0x7c]
pop edi
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x7c
ret 0xc
Function at 0x10127960
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1017a0e8
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
push edi
mov edi, dword [esp + 0x2c]
mov esi, ecx
lea eax, [edi - 1]
cmp eax, 5
ja case.default.0x1012798c
jmp dword [eax*4 + 0x10127a98]
pop edi
mov eax, 7
pop esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret 4
pop edi
mov eax, 6
pop esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret 4
pop edi
mov eax, 2
pop esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret 4
pop edi
mov eax, 3
pop esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret 4
pop edi
mov eax, 4
pop esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret 4
pop edi
mov eax, 5
pop esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret 4
lea ecx, [esp + 8]
call fcn.10154190
push edi
lea eax, [esp + 0xc]
push str.The_Mode__d__is_not_supported.
push eax
mov dword [esp + 0x30], 0
call fcn.101552a0
add esp, 0xc
lea ecx, [esp + 8]
push 0
push 0xffffffffffffffff
call fcn.10154a90
push eax
push str.getECSP_EncMode
push str.DSCryptoBase
push 0x402
push str.H:00.project01.MagicAPICAOSLib_srcDSCryptoDSCryptoBase.cpp
mov ecx, esi
call fcn.101272f0
lea ecx, [esp + 8]
mov dword [esp + 0x24], 0xffffffff
call fcn.10154250
mov ecx, dword [esp + 0x1c]
pop edi
or eax, 0xffffffff
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret 4

Function at 0x10127ab0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1017a108
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
mov esi, dword [esp + 0x28]
push edi
cmp esi, 4
mov edi, ecx
ja case.default.0x10127ad5
jmp dword [esi*4 + 0x10127bb0]
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret 4
pop edi
mov eax, 3
pop esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret 4
pop edi
mov eax, 8
pop esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret 4
pop edi
mov eax, 0xa
pop esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret 4
lea ecx, [esp + 8]
call fcn.10154190
push esi
lea eax, [esp + 0xc]
push str.The_Padding__d__is_not_supported.
push eax
mov dword [esp + 0x30], 0
call fcn.101552a0
add esp, 0xc
lea ecx, [esp + 8]
push 0
push 0xffffffffffffffff
call fcn.10154a90
push eax
push str.getECSP_Padding
push str.DSCryptoBase
push 0x42f
push str.H:00.project01.MagicAPICAOSLib_srcDSCryptoDSCryptoBase.cpp
mov ecx, edi
call fcn.101272f0
lea ecx, [esp + 8]
mov dword [esp + 0x24], 0xffffffff
call fcn.10154250
mov ecx, dword [esp + 0x1c]
pop edi
or eax, 0xffffffff
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret 4