{"jsonrpc": "2.0", "result": {"structuredContent": {"format": "json", "functions": [{"addr": "0xffe0e088", "name": "CopyMem", "prototype": "char *__cdecl(char *dst, char *src, unsigned int count)", "size": "0x3f", "comments": {}, "asm": "CopyMem (.text @ 0xffe0e088):\nffe0e088 push esi\nffe0e089 push edi\nffe0e08a mov esi, [esp+8+src]\nffe0e08e mov edi, [esp+8+dst]\nffe0e092 mov edx, [esp+8+count]\nffe0e096 lea eax, [esi+edx-1]\nffe0e09a cmp esi, edi\nffe0e09c jnb loc_FFE0E0A2\nffe0e09e cmp eax, edi\nffe0e0a0 jnb loc_FFE0E0B4\nffe0e0a2 mov ecx, edx\nffe0e0a4 and edx, 3\nffe0e0aa shr ecx, 2\nffe0e0ad movsd ,\nffe0e0af jmp loc_FFE0E0BB\nffe0e0b4 mov esi, eax\nffe0e0b6 lea edi, [edi+edx-1]\nffe0e0ba std\nffe0e0bb mov ecx, edx\nffe0e0bd movsb ,\nffe0e0bf cld\nffe0e0c0 mov eax, [esp+8+dst]\nffe0e0c4 pop edi\nffe0e0c5 pop esi\nffe0e0c6 retn", "code": "char *__cdecl CopyMem(char *dst, char *src, unsigned int count)\n{\n unsigned int count_1; // edx\n char *dst_1; // edi\n char *src_1; // esi\n\n count_1 = count; /*0xffe0e092*/\n if ( src < dst && &src[count - 1] >= dst ) /*0xffe0e0a0*/\n {\n src_1 = &src[count - 1]; /*0xffe0e0b4*/\n dst_1 = &dst[count - 1]; /*0xffe0e0b6*/\n }\n else\n {\n count_1 = count & 3; /*0xffe0e0a4*/\n qmemcpy(dst, src, 4 * (count >> 2)); /*0xffe0e0ad*/\n src_1 = &src[4 * (count >> 2)]; /*0xffe0e0ad*/\n dst_1 = &dst[4 * (count >> 2)]; /*0xffe0e0ad*/\n }\n qmemcpy(dst_1, src_1, count_1); /*0xffe0e0bd*/\n return dst; /*0xffe0e0c4*/\n}", "xrefs": {"to": [{"addr": "0xffe10446", "type": "code"}, {"addr": "0xffe0df1c", "type": "data"}, {"addr": "0xffe0dff4", "type": "data"}], "from": [{"addr": "0xffe0e089", "type": "code"}]}}, {"addr": "0xffe0e0c8", "name": "SetMem", "prototype": "void *__cdecl(void *buf, unsigned int count, char value)", "size": "0x15", "comments": {}, "asm": "SetMem (.text @ 0xffe0e0c8):\nffe0e0c8 push edi\nffe0e0c9 mov eax, dword ptr [esp+4+value]\nffe0e0cd mov edi, [esp+4+buf]\nffe0e0d1 mov ecx, [esp+4+count]\nffe0e0d5 stosb ,\nffe0e0d7 mov eax, [esp+4+buf]\nffe0e0db pop edi\nffe0e0dc retn", "code": "void *__cdecl SetMem(void *buf, unsigned int count, char value)\n{\n memset(buf, value, count); /*0xffe0e0d5*/\n return buf; /*0xffe0e0db*/\n}", "xrefs": {"to": [{"addr": "0xffe10484", "type": "code"}], "from": [{"addr": "0xffe0e0c9", "type": "code"}]}}, {"addr": "0xffe0e0e8", "name": "ZeroMem", "prototype": "void *__cdecl(void *buf, unsigned int count)", "size": "0x20", "comments": {}, "asm": "ZeroMem (.text @ 0xffe0e0e8):\nffe0e0e8 push edi\nffe0e0e9 xor eax, eax\nffe0e0eb mov edi, [esp+4+buf]\nffe0e0ef mov ecx, [esp+4+count]\nffe0e0f3 mov edx, ecx\nffe0e0f5 shr ecx, 2\nffe0e0f8 and edx, 3\nffe0e0fe push edi\nffe0e0ff stosd ,\nffe0e101 mov ecx, edx\nffe0e103 stosb ,\nffe0e105 pop eax\nffe0e106 pop edi\nffe0e107 retn", "code": "void *__cdecl ZeroMem(void *buf, unsigned int count)\n{\n memset(buf, 0, count); /*0xffe0e0ff*/\n return buf; /*0xffe0e106*/\n}", "xrefs": {"to": [{"addr": "0xffe104d8", "type": "code"}], "from": [{"addr": "0xffe0e0e9", "type": "code"}]}}, {"addr": "0xffe0e108", "name": "PeiServicesLocatePpi", "prototype": "int __cdecl(int, int, int, int)", "size": "0x1f", "comments": {}, "asm": "PeiServicesLocatePpi (.text @ 0xffe0e108):\nffe0e108 push edi\nffe0e109 mov ecx, [esp+4+arg_4]\nffe0e10d mov eax, [esp+4+arg_8]\nffe0e111 mov edx, [esp+4+arg_C]\nffe0e115 mov edi, [esp+4+arg_0]\nffe0e119 mov [edi+ecx*8-8], eax\nffe0e11d mov [edi+ecx*8-4], edx\nffe0e121 loop loc_FFE0E119,\nffe0e123 mov eax, edi\nffe0e125 pop edi\nffe0e126 retn", "code": "int __cdecl PeiServicesLocatePpi(int a1, int a2, int a3, int a4)\n{\n do /*0xffe0e121*/\n {\n *(_DWORD *)(a1 + 8 * a2 - 8) = a3; /*0xffe0e119*/\n *(_DWORD *)(a1 + 8 * a2-- - 4) = a4; /*0xffe0e11d*/\n }\n while ( a2 ); /*0xffe0e121*/\n return a1; /*0xffe0e125*/\n}", "xrefs": {"to": [], "from": [{"addr": "0xffe0e109", "type": "code"}]}}, {"addr": "0xffe0e128", "name": "SetMem32", "prototype": "void *__cdecl(void *buf, unsigned int count, int value)", "size": "0x15", "comments": {}, "asm": "SetMem32 (.text @ 0xffe0e128):\nffe0e128 push edi\nffe0e129 mov eax, [esp+4+value]\nffe0e12d mov edi, [esp+4+buf]\nffe0e131 mov ecx, [esp+4+count]\nffe0e135 stosd ,\nffe0e137 mov eax, [esp+4+buf]\nffe0e13b pop edi\nffe0e13c retn", "code": "void *__cdecl SetMem32(void *buf, unsigned int count, int value)\n{\n memset32(buf, value, count); /*0xffe0e135*/\n return buf; /*0xffe0e13b*/\n}", "xrefs": {"to": [], "from": [{"addr": "0xffe0e129", "type": "code"}]}}, {"addr": "0xffe0e148", "name": "CompareMem", "prototype": "int __cdecl(_BYTE *, _BYTE *, int)", "size": "0x1d", "comments": {}, "asm": "CompareMem (.text @ 0xffe0e148):\nffe0e148 push esi\nffe0e149 push edi\nffe0e14a mov esi, [esp+8+arg_0]\nffe0e14e mov edi, [esp+8+arg_4]\nffe0e152 mov ecx, [esp+8+arg_8]\nffe0e156 cmpsb ,\nffe0e158 movzx eax, byte ptr [esi-1]\nffe0e15c movzx edx, byte ptr [edi-1]\nffe0e160 sub eax, edx\nffe0e162 pop edi\nffe0e163 pop esi\nffe0e164 retn", "code": "int __cdecl CompareMem(_BYTE *a1, _BYTE *a2, int a3)\n{\n bool v6; // zf\n\n do /*0xffe0e156*/\n {\n if ( !a3 ) /*0xffe0e156*/\n break; /*0xffe0e156*/\n v6 = *a1++ == *a2++; /*0xffe0e156*/\n --a3; /*0xffe0e156*/\n }\n while ( v6 ); /*0xffe0e156*/\n return (unsigned __int8)*(a1 - 1) - (unsigned __int8)*(a2 - 1); /*0xffe0e162*/\n}", "xrefs": {"to": [], "from": [{"addr": "0xffe0e149", "type": "code"}]}}, {"addr": "0xffe0e1e4", "name": "_ModuleEntryPoint", "prototype": "EFI_STATUS(EFI_HANDLE ImageHandle, EFI_SYSTEM_TABLE *SystemTable)", "size": "0x30", "comments": {}, "asm": "_ModuleEntryPoint (.text @ 0xffe0e1e4):\nffe0e1e4 push esi\nffe0e1e5 call GetGlobalState\nffe0e1ea mov esi, 0FA044h\nffe0e1ef add eax, esi\nffe0e1f1 mov al, [eax]\nffe0e1f3 test al, al\nffe0e1f5 js loc_FFE0E20A\nffe0e1f7 call SetGlobalState\nffe0e1fc call GetGlobalState\nffe0e201 add eax, esi\nffe0e203 mov cl, [eax]\nffe0e205 or cl, 80h\nffe0e208 mov [eax], cl\nffe0e20a mov edx, [esp+4+SystemTable]\nffe0e20e pop esi\nffe0e20f jmp TrEEPeiEntry", "code": "EFI_STATUS ModuleEntryPoint(EFI_HANDLE ImageHandle, EFI_SYSTEM_TABLE *SystemTable)\n{\n char v2; // di\n int v3; // eax\n\n if ( *(char *)(sub_FFE162DD() + 1024068) >= 0 ) /*0xffe0e1f5*/\n {\n sub_FFE162E9(); /*0xffe0e1f7*/\n v3 = sub_FFE162DD(); /*0xffe0e1fc*/\n *(_BYTE *)(v3 + 1024068) |= 0x80u; /*0xffe0e208*/\n }\n return sub_FFE0FD42((int *)SystemTable, v2); /*0xffe0e20e*/\n}", "xrefs": {"to": [{"addr": "0xffe0df18", "type": "data"}], "from": [{"addr": "0xffe0e1e5", "type": "code"}]}}, {"addr": "0xffe0e214", "name": "Sha256Hash", "prototype": "int __fastcall(int src, unsigned int i)", "size": "0x65", "comments": {}, "asm": "Sha256Hash (.text @ 0xffe0e214):\nffe0e214 push ebx\nffe0e215 push ebp\nffe0e216 push esi\nffe0e217 push edi\nffe0e218 mov edi, edx\nffe0e21a xor esi, esi\nffe0e21c mov ebp, ecx\nffe0e21e mov ebx, esi\nffe0e220 test edi, edi\nffe0e222 jz loc_FFE0E274\nffe0e224 test ebx, ebx\nffe0e226 jz loc_FFE0E23C\nffe0e228 movzx eax, byte ptr [ebx+ebp]\nffe0e22c push eax\nffe0e22d push offset a02x\nffe0e232 push 40h\nffe0e234 call DebugPrint\nffe0e239 add esp, 0Ch\nffe0e23c test bl, 0Fh\nffe0e23f jnz loc_FFE0E26F\nffe0e241 push offset asc_FFE163C8\nffe0e246 push 40h\nffe0e248 call DebugPrint\nffe0e24d push esi\nffe0e24e push offset a04x\nffe0e253 push 40h\nffe0e255 call DebugPrint\nffe0e25a movzx eax, byte ptr [ebx+ebp]\nffe0e25e push eax\nffe0e25f push offset a02x\nffe0e264 push 40h\nffe0e266 call DebugPrint\nffe0e26b add esp, 20h\nffe0e26e inc esi\nffe0e26f inc ebx\nffe0e270 cmp ebx, edi\nffe0e272 jb loc_FFE0E224\nffe0e274 pop edi\nffe0e275 pop esi\nffe0e276 pop ebp\nffe0e277 pop ebx\nffe0e278 ret... [1001 chars total]", "code": "int __fastcall Sha256Hash(int src, unsigned int i)\n{\n int v3; // esi\n unsigned int j; // ebx\n int result; // eax\n\n v3 = 0; /*0xffe0e21a*/\n for ( j = 0; j < i; ++j ) /*0xffe0e222*/\n {\n if ( j ) /*0xffe0e226*/\n result = sub_FFE10514(64, \"%02x \", *(unsigned __int8 *)(j + src)); /*0xffe0e234*/\n if ( (j & 0xF) == 0 ) /*0xffe0e23f*/\n {\n sub_FFE10514(64, \"\\n\"); /*0xffe0e248*/\n sub_FFE10514(64, \"%04x :\", v3); /*0xffe0e255*/\n result = sub_FFE10514(64, \"%02x \", *(unsigned __int8 *)(j + src)); /*0xffe0e266*/\n ++v3; /*0xffe0e26e*/\n }\n }\n return result; /*0xffe0e274*/\n}", "xrefs": {"to": [{"addr": "0xffe0e3e7", "type": "code"}, {"addr": "0xffe0ea4b", "type": "code"}], "from": [{"addr": "0xffe0e215", "type": "code"}]}}, {"addr": "0xffe0e279", "name": "GetAllDigestValues", "prototype": "int __fastcall(int, int, int, unsigned int i, int *p_n20)", "size": "0x19c", "comments": {"0xffe0e2bf": {"regular": "_BYTE *"}, "0xffe0e2c0": {"regular": "i"}, "0xffe0e341": {"regular": "i"}, "0xffe0e348": {"regular": "int"}, "0xffe0e351": {"regular": "_BYTE *"}, "0xffe0e378": {"regular": "i"}, "0xffe0e37f": {"regular": "int"}, "0xffe0e388": {"regular": "_BYTE *"}, "0xffe0e3bb": {"regular": "n1024"}, "0xffe0e3c2": {"regular": "src"}, "0xffe0e3ce": {"regular": "dst"}, "0xffe0e3e2": {"regular": "src"}, "0xffe0e3e6": {"regular": "i"}}, "asm": "GetAllDigestValues (.text @ 0xffe0e279):\nffe0e279 push ecx\nffe0e27a push ecx\nffe0e27b push ebx\nffe0e27c push ebp\nffe0e27d push esi\nffe0e27e push edi\nffe0e27f xor ebx, ebx\nffe0e281 mov edi, edx\nffe0e283 mov eax, ecx\nffe0e285 mov [esp+18h+var_4], edi\nffe0e289 xor ebp, ebp\nffe0e28b mov [esp+18h+var_8], eax\nffe0e28f cmp dword_FFE174E0, ebx\nffe0e295 jnz loc_FFE0E2A1\nffe0e297 mov eax, 8000000Eh\nffe0e29c jmp loc_FFE0E40E\nffe0e2a1 push eax\nffe0e2a2 push offset aGetalldigestva\nffe0e2a7 push 40h\nffe0e2a9 call DebugPrint\nffe0e2ae add esp, 0Ch\nffe0e2b1 test byte ptr [esp+18h+var_8], 1\nffe0e2b6 jz loc_FFE0E2D8\nffe0e2b8 mov edx, [esp+18h+src]\nffe0e2bc lea eax, [edi+6]\nffe0e2bf push eax\nffe0e2c0 push [esp+1Ch+i]\nffe0e2c4 call Tpm20CopyDigest\nffe0e2c9 pop ecx\nffe0e2ca pop ecx\nffe0e2cb push 4\nffe0e2cd pop eax\nffe0e2ce push 14h\nffe0e2d0 xor ebx, ebx\nffe0e2d2 mov [edi+4], ax\nffe0e2d6 pop ebp\nffe0e2d7 inc ebx\nffe0e2d8 push ebx\nffe0e2d9 push offset aGetalldigestva_0\nf... [3786 chars total]", "code": "int __fastcall GetAllDigestValues(int a1, int a2, int a3, unsigned int i, int *p_n20)\n{\n int v5; // ebx\n int v6; // edi\n int n20; // ebp\n char v9; // cl\n int v10; // esi\n int v11; // edi\n char v12; // [esp+10h] [ebp-8h]\n\n v5 = 0; /*0xffe0e27f*/\n v6 = a2; /*0xffe0e281*/\n n20 = 0; /*0xffe0e289*/\n v12 = a1; /*0xffe0e28b*/\n if ( !dword_FFE174E0 ) /*0xffe0e295*/\n return -2147483634; /*0xffe0e297*/\n sub_FFE10514(64, \" GetAllDigestValues:: PcrBitMap = %x \\n\", a1);\n if ( (v12 & 1) != 0 ) /*0xffe0e2b6*/\n {\n sub_FFE155F1(i, (_BYTE *)(v6 + 6)); /*0xffe0e2c4*/\n *(_WORD *)(v6 + 4) = 4; /*0xffe0e2d2*/\n n20 = 20; /*0xffe0e2d6*/\n v5 = 1; /*0xffe0e2d7*/\n }\n sub_FFE10514(64, \" GetAllDigestValues:: Count = %x \\n\", v5);\n v9 = v12; /*0xffe0e2e5*/\n if ( (v12 & 2) != 0 && *(_DWORD *)(dword_FFE174E0 + 4) ) /*0xffe0e2f6*/\n {\n sub_FFE10514(64, \" GetAllDigestValues::Sha256 \\n\"); /*0xffe0e303*/\n v10 = 66 * v5; /*0xffe0e30f*/\n sub_FFE15629(i, (char *)(66 * v5 + v6 + 6));... [2273 chars total]", "xrefs": {"to": [{"addr": "0xffe0eb4f", "type": "code"}, {"addr": "0xffe0f186", "type": "code"}], "from": [{"addr": "0xffe0e27a", "type": "code"}]}}, {"addr": "0xffe0e415", "name": "Tpm20CmdInit", "prototype": "int __cdecl(int n286, int, _BYTE *, char *dst)", "size": "0xa8", "comments": {}, "asm": "Tpm20CmdInit (.text @ 0xffe0e415):\nffe0e415 push ebp\nffe0e416 mov ebp, esp\nffe0e418 sub esp, 428h\nffe0e41e mov eax, [ecx]\nffe0e420 lea edx, [ebp+var_4]\nffe0e423 and [ebp+var_4], 0\nffe0e427 push edx\nffe0e428 push 0\nffe0e42a push 0\nffe0e42c push offset unk_FFE17408\nffe0e431 push ecx\nffe0e432 call dword ptr [eax+20h]\nffe0e435 add esp, 14h\nffe0e438 test eax, eax\nffe0e43a js loc_FFE0E4B9\nffe0e43c mov eax, 180h\nffe0e441 mov [ebp+var_16], 7A010000h\nffe0e448 push 6\nffe0e44a pop ecx\nffe0e44b mov [ebp+var_1C], ax\nffe0e44f call SwapBytes32\nffe0e454 mov ecx, [ebp+n286]\nffe0e457 mov [ebp+var_12], eax\nffe0e45a call SwapBytes32\nffe0e45f xor ecx, ecx\nffe0e461 mov [ebp+var_E], eax\nffe0e464 inc ecx\nffe0e465 call SwapBytes32\nffe0e46a push 16h\nffe0e46c pop ecx\nffe0e46d mov [ebp+var_A], eax\nffe0e470 call SwapBytes32\nffe0e475 mov [ebp+var_1A], eax\nffe0e478 lea eax, [ebp+var_428]\nffe0e47e push eax\nffe0e47f push 40Bh\nffe0e484 lea eax, [ebp+var_1C]\nffe0e487 push eax\nffe0e4... [1466 chars total]", "code": "int __cdecl Tpm20CmdInit(int n286, int a2, _BYTE *a3, char *dst)\n{\n int *v4; // ecx\n int v5; // eax\n int result; // eax\n char v7[11]; // [esp+0h] [ebp-428h] BYREF\n char src[1025]; // [esp+Bh] [ebp-41Dh] BYREF\n __int16 n384; // [esp+40Ch] [ebp-1Ch] BYREF\n int v10; // [esp+40Eh] [ebp-1Ah]\n int n2046885888; // [esp+412h] [ebp-16h]\n int v12; // [esp+416h] [ebp-12h]\n int v13; // [esp+41Ah] [ebp-Eh]\n int v14; // [esp+41Eh] [ebp-Ah]\n int v15; // [esp+424h] [ebp-4h] BYREF\n\n v5 = *v4; /*0xffe0e41e*/\n v15 = 0; /*0xffe0e423*/\n result = (*(int (__cdecl **)(int *, void *, _DWORD, _DWORD, int *))(v5 + 32))(v4, &unk_FFE17408, 0, 0, &v15); /*0xffe0e432*/\n if ( result >= 0 ) /*0xffe0e43a*/\n {\n n2046885888 = 2046885888; /*0xffe0e441*/\n n384 = 384; /*0xffe0e44b*/\n v12 = sub_FFE10573(6); /*0xffe0e457*/\n v13 = sub_FFE10573(n286); /*0xffe0e461*/\n v14 = sub_FFE10573(1); /*0xffe0e46d*/\n v10 = sub_FFE10573(22); /*0xffe0e475*/\n result = (*(int (__cdecl **)(int, int, __int16... [1277 chars total]", "xrefs": {"to": [{"addr": "0xffe0e4dd", "type": "code"}, {"addr": "0xffe0e509", "type": "code"}, {"addr": "0xffe0e586", "type": "code"}], "from": [{"addr": "0xffe0e416", "type": "code"}]}}]}, "content": [{"type": "text", "text": "{\"format\":\"json\",\"functions\":[{\"addr\":\"0xffe0e088\",\"name\":\"CopyMem\",\"prototype\":\"char *__cdecl(char *dst, char *src, unsigned int count)\",\"size\":\"0x3f\",\"comments\":{},\"asm\":\"CopyMem (.text @ 0xffe0e088):\\nffe0e088 push esi\\nffe0e089 push edi\\nffe0e08a mov esi, [esp+8+src]\\nffe0e08e mov edi, [esp+8+dst]\\nffe0e092 mov edx, [esp+8+count]\\nffe0e096 lea eax, [esi+edx-1]\\nffe0e09a cmp esi, edi\\nffe0e09c jnb loc_FFE0E0A2\\nffe0e09e cmp eax, edi\\nffe0e0a0 jnb loc_FFE0E0B4\\nffe0e0a2 mov ecx, edx\\nffe0e0a4 and edx, 3\\nffe0e0aa shr ecx, 2\\nffe0e0ad movsd ,\\nffe0e0af jmp loc_FFE0E0BB\\nffe0e0b4 mov esi, eax\\nffe0e0b6 lea edi, [edi+edx-1]\\nffe0e0ba std\\nffe0e0bb mov ecx, edx\\nffe0e0bd movsb ,\\nffe0e0bf cld\\nffe0e0c0 mov eax, [esp+8+dst]\\nffe0e0c4 pop edi\\nffe0e0c5 pop esi\\nffe0e0c6 retn\",\"code\":\"char *__cdecl CopyMem(char *dst, char *src, unsigned int count)\\n{\\n unsigned int count_1; // edx\\n char *dst_1; // edi\\n char *src_1; // esi\\n\\n count_1 = count; /*0xffe0e092*/\\n if ( src < dst && &src[count - 1] >= dst ) /*0xffe0e0a0*/\\n {\\n src_1 = &src[count - 1]; /*0xffe0e0b4*/\\n dst_1 = &dst[count - 1]; /*0xffe0e0b6*/\\n }\\n else\\n {\\n count_1 = count & 3; /*0xffe0e0a4*/\\n qmemcpy(dst, src, 4 * (count >> 2)); /*0xffe0e0ad*/\\n src_1 = &src[4 * (count >> 2)]; /*0xffe0e0ad*/\\n dst_1 = &dst[4 * (count >> 2)]; /*0xffe0e0ad*/\\n }\\n qmemcpy(dst_1, src_1, count_1); /*0xffe0e0bd*/\\n return dst; /*0xffe0e0c4*/\\n}\",\"xrefs\":{\"to\":[{\"addr\":\"0xffe10446\",\"type\":\"code\"},{\"addr\":\"0xffe0df1c\",\"type\":\"data\"},{\"addr\":\"0xffe0dff4\",\"type\":\"data\"}],\"from\":[{\"addr\":\"0xffe0e089\",\"type\":\"code\"}]}},{\"addr\":\"0xffe0e0c8\",\"name\":\"SetMem\",\"prototype\":\"void *__cdecl(void *buf, unsigned int count, char value)\",\"size\":\"0x15\",\"comments\":{},\"asm\":\"SetMem (.text @ 0xffe0e0c8):\\nffe0e0c8 push edi\\nffe0e0c9 mov eax, dword ptr [esp+4+value]\\nffe0e0cd mov edi, [esp+4+buf]\\nffe0e0d1 mov ecx, [esp+4+count]\\nffe0e0d5 stosb ,\\nffe0e0d7 mov eax, [esp+4+buf]\\nffe0e0db pop edi\\nffe0e0dc retn\",\"code\":\"void *__cdecl SetMem(void *buf, unsigned int count, char value)\\n{\\n memset(buf, value, count); /*0xffe0e0d5*/\\n return buf; /*0xffe0e0db*/\\n}\",\"xrefs\":{\"to\":[{\"addr\":\"0xffe10484\",\"type\":\"code\"}],\"from\":[{\"addr\":\"0xffe0e0c9\",\"type\":\"code\"}]}},{\"addr\":\"0xffe0e0e8\",\"name\":\"ZeroMem\",\"prototype\":\"void *__cdecl(void *buf, unsigned int count)\",\"size\":\"0x20\",\"comments\":{},\"asm\":\"ZeroMem (.text @ 0xffe0e0e8):\\nffe0e0e8 push edi\\nffe0e0e9 xor eax, eax\\nffe0e0eb mov edi, [esp+4+buf]\\nffe0e0ef mov ecx, [esp+4+count]\\nffe0e0f3 mov edx, ecx\\nffe0e0f5 shr ecx, 2\\nffe0e0f8 and edx, 3\\nffe0e0fe push edi\\nffe0e0ff stosd ,\\nffe0e101 mov ecx, edx\\nffe0e103 stosb ,\\nffe0e105 pop eax\\nffe0e106 pop edi\\nffe0e107 retn\",\"code\":\"void *__cdecl ZeroMem(void *buf, unsigned int count)\\n{\\n memset(buf, 0, count); /*0xffe0e0ff*/\\n return buf; /*0xffe0e106*/\\n}\",\"xrefs\":{\"to\":[{\"addr\":\"0xffe104d8\",\"type\":\"code\"}],\"from\":[{\"addr\":\"0xffe0e0e9\",\"type\":\"code\"}]}},{\"addr\":\"0xffe0e108\",\"name\":\"PeiServicesLocatePpi\",\"prototype\":\"int __cdecl(int, int, int, int)\",\"size\":\"0x1f\",\"comments\":{},\"asm\":\"PeiServicesLocatePpi (.text @ 0xffe0e108):\\nffe0e108 push edi\\nffe0e109 mov ecx, [esp+4+arg_4]\\nffe0e10d mov eax, [esp+4+arg_8]\\nffe0e111 mov edx, [esp+4+arg_C]\\nffe0e115 mov edi, [esp+4+arg_0]\\nffe0e119 mov [edi+ecx*8-8], eax\\nffe0e11d mov [edi+ecx*8-4], edx\\nffe0e121 loop loc_FFE0E119,\\nffe0e123 mov eax, edi\\nffe0e125 pop edi\\nffe0e126 retn\",\"code\":\"int __cdecl PeiServicesLocatePpi(int a1, int a2, int a3, int a4)\\n{\\n do /*0xffe0e121*/\\n {\\n *(_DWORD *)(a1 + 8 * a2 - 8) = a3; /*0xffe0e119*/\\n *(_DWORD *)(a1 + 8 * a2-- - 4) = a4; /*0xffe0e11d*/\\n }\\n while ( a2 ); /*0xffe0e121*/\\n return a1; /*0xffe0e125*/\\n}\",\"xrefs\":{\"to\":[],\"from\":[{\"addr\":\"0xffe0e109\",\"type\":\"code\"}]}},{\"addr\":\"0xffe0e128\",\"name\":\"SetMem32\",\"prototype\":\"void *__cdecl(void *buf, unsigned int count, int value)\",\"size\":\"0x15\",\"comments\":{},\"asm\":\"SetMem32 (.text @ 0xffe0e128):\\nffe0e128 push edi\\nffe0e129 mov eax, [esp+4+value]\\nffe0e12d mov edi, [esp+4+buf]\\nffe0e131 mov ecx, [esp+4+count]\\nffe0e135 stosd ,\\nffe0e137 mov eax, [esp+4+buf]\\nffe0e13b pop edi\\nffe0e13c retn\",\"code\":\"void *__cdecl SetMem32(void *buf, unsigned int count, int value)\\n{\\n memset32(buf, value, count); /*0xffe0e135*/\\n return buf; /*0xffe0e13b*/\\n}\",\"xrefs\":{\"to\":[],\"from\":[{\"addr\":\"0xffe0e129\",\"type\":\"code\"}]}},{\"addr\":\"0xffe0e148\",\"name\":\"CompareMem\",\"prototype\":\"int __cdecl(_BYTE *, _BYTE *, int)\",\"size\":\"0x1d\",\"comments\":{},\"asm\":\"CompareMem (.text @ 0xffe0e148):\\nffe0e148 push esi\\nffe0e149 push edi\\nffe0e14a mov esi, [esp+8+arg_0]\\nffe0e14e mov edi, [esp+8+arg_4]\\nffe0e152 mov ecx, [esp+8+arg_8]\\nffe0e156 cmpsb ,\\nffe0e158 movzx eax, byte ptr [esi-1]\\nffe0e15c movzx edx, byte ptr [edi-1]\\nffe0e160 sub eax, edx\\nffe0e162 pop edi\\nffe0e163 pop esi\\nffe0e164 retn\",\"code\":\"int __cdecl CompareMem(_BYTE *a1, _BYTE *a2, int a3)\\n{\\n bool v6; // zf\\n\\n do /*0xffe0e156*/\\n {\\n if ( !a3 ) /*0xffe0e156*/\\n break; /*0xffe0e156*/\\n v6 = *a1++ == *a2++; /*0xffe0e156*/\\n --a3; /*0xffe0e156*/\\n }\\n while ( v6 ); /*0xffe0e156*/\\n return (unsigned __int8)*(a1 - 1) - (unsigned __int8)*(a2 - 1); /*0xffe0e162*/\\n}\",\"xrefs\":{\"to\":[],\"from\":[{\"addr\":\"0xffe0e149\",\"type\":\"code\"}]}},{\"addr\":\"0xffe0e1e4\",\"name\":\"_ModuleEntryPoint\",\"prototype\":\"EFI_STATUS(EFI_HANDLE ImageHandle, EFI_SYSTEM_TABLE *SystemTable)\",\"size\":\"0x30\",\"comments\":{},\"asm\":\"_ModuleEntryPoint (.text @ 0xffe0e1e4):\\nffe0e1e4 push esi\\nffe0e1e5 call GetGlobalState\\nffe0e1ea mov esi, 0FA044h\\nffe0e1ef add eax, esi\\nffe0e1f1 mov al, [eax]\\nffe0e1f3 test al, al\\nffe0e1f5 js loc_FFE0E20A\\nffe0e1f7 call SetGlobalState\\nffe0e1fc call GetGlobalState\\nffe0e201 add eax, esi\\nffe0e203 mov cl, [eax]\\nffe0e205 or cl, 80h\\nffe0e208 mov [eax], cl\\nffe0e20a mov edx, [esp+4+SystemTable]\\nffe0e20e pop esi\\nffe0e20f jmp TrEEPeiEntry\",\"code\":\"EFI_STATUS ModuleEntryPoint(EFI_HANDLE ImageHandle, EFI_SYSTEM_TABLE *SystemTable)\\n{\\n char v2; // di\\n int v3; // eax\\n\\n if ( *(char *)(sub_FFE162DD() + 1024068) >= 0 ) /*0xffe0e1f5*/\\n {\\n sub_FFE162E9(); /*0xffe0e1f7*/\\n v3 = sub_FFE162DD(); /*0xffe0e1fc*/\\n *(_BYTE *)(v3 + 1024068) |= 0x80u; /*0xffe0e208*/\\n }\\n return sub_FFE0FD42((int *)SystemTable, v2); /*0xffe0e20e*/\\n}\",\"xrefs\":{\"to\":[{\"addr\":\"0xffe0df18\",\"type\":\"data\"}],\"from\":[{\"addr\":\"0xffe0e1e5\",\"type\":\"code\"}]}},{\"addr\":\"0xffe0e214\",\"name\":\"Sha256Hash\",\"prototype\":\"int __fastcall(int src, unsigned int i)\",\"size\":\"0x65\",\"comments\":{},\"asm\":\"Sha256Hash (.text @ 0xffe0e214):\\nffe0e214 push ebx\\nffe0e215 push ebp\\nffe0e216 push esi\\nffe0e217 push edi\\nffe0e218 mov edi, edx\\nffe0e21a xor esi, esi\\nffe0e21c mov ebp, ecx\\nffe0e21e mov ebx, esi\\nffe0e220 test edi, edi\\nffe0e222 jz loc_FFE0E274\\nffe0e224 test ebx, ebx\\nffe0e226 jz loc_FFE0E23C\\nffe0e228 movzx eax, byte ptr [ebx+ebp]\\nffe0e22c push eax\\nffe0e22d push offset a02x\\nffe0e232 push 40h\\nffe0e234 call DebugPrint\\nffe0e239 add esp, 0Ch\\nffe0e23c test bl, 0Fh\\nffe0e23f jnz loc_FFE0E26F\\nffe0e241 push offset asc_FFE163C8\\nffe0e246 push 40h\\nffe0e248 call DebugPrint\\nffe0e24d push esi\\nffe0e24e push offset a04x\\nffe0e253 push 40h\\nffe0e255 call DebugPrint\\nffe0e25a movzx eax, byte ptr [ebx+ebp]\\nffe0e25e push eax\\nffe0e25f push offset a02x\\nffe0e264 push 40h\\nffe0e266 call DebugPrint\\nffe0e26b add esp, 20h\\nffe0e26e inc esi\\nffe0e26f inc ebx\\nffe0e270 cmp ebx, edi\\nffe0e272 jb loc_FFE0E224\\nffe0e274 pop edi\\nffe0e275 pop esi\\nffe0e276 pop ebp\\nffe0e277 pop ebx\\nffe0e278 ret... [1001 chars total]\",\"code\":\"int __fastcall Sha256Hash(int src, unsigned int i)\\n{\\n int v3; // esi\\n unsigned int j; // ebx\\n int result; // eax\\n\\n v3 = 0; /*0xffe0e21a*/\\n for ( j = 0; j < i; ++j ) /*0xffe0e222*/\\n {\\n if ( j ) /*0xffe0e226*/\\n result = sub_FFE10514(64, \\\"%02x \\\", *(unsigned __int8 *)(j + src)); /*0xffe0e234*/\\n if ( (j & 0xF) == 0 ) /*0xffe0e23f*/\\n {\\n sub_FFE10514(64, \\\"\\\\n\\\"); /*0xffe0e248*/\\n sub_FFE10514(64, \\\"%04x :\\\", v3); /*0xffe0e255*/\\n result = sub_FFE10514(64, \\\"%02x \\\", *(unsigned __int8 *)(j + src)); /*0xffe0e266*/\\n ++v3; /*0xffe0e26e*/\\n }\\n }\\n return result; /*0xffe0e274*/\\n}\",\"xrefs\":{\"to\":[{\"addr\":\"0xffe0e3e7\",\"type\":\"code\"},{\"addr\":\"0xffe0ea4b\",\"type\":\"code\"}],\"from\":[{\"addr\":\"0xffe0e215\",\"type\":\"code\"}]}},{\"addr\":\"0xffe0e279\",\"name\":\"GetAllDigestValues\",\"prototype\":\"int __fastcall(int, int, int, unsigned int i, int *p_n20)\",\"size\":\"0x19c\",\"comments\":{\"0xffe0e2bf\":{\"regular\":\"_BYTE *\"},\"0xffe0e2c0\":{\"regular\":\"i\"},\"0xffe0e341\":{\"regular\":\"i\"},\"0xffe0e348\":{\"regular\":\"int\"},\"0xffe0e351\":{\"regular\":\"_BYTE *\"},\"0xffe0e378\":{\"regular\":\"i\"},\"0xffe0e37f\":{\"regular\":\"int\"},\"0xffe0e388\":{\"regular\":\"_BYTE *\"},\"0xffe0e3bb\":{\"regular\":\"n1024\"},\"0xffe0e3c2\":{\"regular\":\"src\"},\"0xffe0e3ce\":{\"regular\":\"dst\"},\"0xffe0e3e2\":{\"regular\":\"src\"},\"0xffe0e3e6\":{\"regular\":\"i\"}},\"asm\":\"GetAllDigestValues (.text @ 0xffe0e279):\\nffe0e279 push ecx\\nffe0e27a push ecx\\nffe0e27b push ebx\\nffe0e27c push ebp\\nffe0e27d push esi\\nffe0e27e push edi\\nffe0e27f xor ebx, ebx\\nffe0e281 mov edi, edx\\nffe0e283 mov eax, ecx\\nffe0e285 mov [esp+18h+var_4], edi\\nffe0e289 xor ebp, ebp\\nffe0e28b mov [esp+18h+var_8], eax\\nffe0e28f cmp dword_FFE174E0, ebx\\nffe0e295 jnz loc_FFE0E2A1\\nffe0e297 mov eax, 8000000Eh\\nffe0e29c jmp loc_FFE0E40E\\nffe0e2a1 push eax\\nffe0e2a2 push offset aGetalldigestva\\nffe0e2a7 push 40h\\nffe0e2a9 call DebugPrint\\nffe0e2ae add esp, 0Ch\\nffe0e2b1 test byte ptr [esp+18h+var_8], 1\\nffe0e2b6 jz loc_FFE0E2D8\\nffe0e2b8 mov edx, [esp+18h+src]\\nffe0e2bc lea eax, [edi+6]\\nffe0e2bf push eax\\nffe0e2c0 push [esp+1Ch+i]\\nffe0e2c4 call Tpm20CopyDigest\\nffe0e2c9 pop ecx\\nffe0e2ca pop ecx\\nffe0e2cb push 4\\nffe0e2cd pop eax\\nffe0e2ce push 14h\\nffe0e2d0 xor ebx, ebx\\nffe0e2d2 mov [edi+4], ax\\nffe0e2d6 pop ebp\\nffe0e2d7 inc ebx\\nffe0e2d8 push ebx\\nffe0e2d9 push offset aGetalldigestva_0\\nf... [3786 chars total]\",\"code\":\"int __fastcall GetAllDigestValues(int a1, int a2, int a3, unsigned int i, int *p_n20)\\n{\\n int v5; // ebx\\n int v6; // edi\\n int n20; // ebp\\n char v9; // cl\\n int v10; // esi\\n int v11; // edi\\n char v12; // [esp+10h] [ebp-8h]\\n\\n v5 = 0; /*0xffe0e27f*/\\n v6 = a2; /*0xffe0e281*/\\n n20 = 0; /*0xffe0e289*/\\n v12 = a1; /*0xffe0e28b*/\\n if ( !dword_FFE174E0 ) /*0xffe0e295*/\\n return -2147483634; /*0xffe0e297*/\\n sub_FFE10514(64, \\\" GetAllDigestValues:: PcrBitMap = %x \\\\n\\\", a1);\\n if ( (v12 & 1) != 0 ) /*0xffe0e2b6*/\\n {\\n sub_FFE155F1(i, (_BYTE *)(v6 + 6)); /*0xffe0e2c4*/\\n *(_WORD *)(v6 + 4) = 4; /*0xffe0e2d2*/\\n n20 = 20; /*0xffe0e2d6*/\\n v5 = 1; /*0xffe0e2d7*/\\n }\\n sub_FFE10514(64, \\\" GetAllDigestValues:: Count = %x \\\\n\\\", v5);\\n v9 = v12; /*0xffe0e2e5*/\\n if ( (v12 & 2) != 0 && *(_DWORD *)(dword_FFE174E0 + 4) ) /*0xffe0e2f6*/\\n {\\n sub_FFE10514(64, \\\" GetAllDigestValues::Sha256 \\\\n\\\"); /*0xffe0e303*/\\n v10 = 66 * v5; /*0xffe0e30f*/\\n sub_FFE15629(i, (char *)(66 * v5 + v6 + 6));... [2273 chars total]\",\"xrefs\":{\"to\":[{\"addr\":\"0xffe0eb4f\",\"type\":\"code\"},{\"addr\":\"0xffe0f186\",\"type\":\"code\"}],\"from\":[{\"addr\":\"0xffe0e27a\",\"type\":\"code\"}]}},{\"addr\":\"0xffe0e415\",\"name\":\"Tpm20CmdInit\",\"prototype\":\"int __cdecl(int n286, int, _BYTE *, char *dst)\",\"size\":\"0xa8\",\"comments\":{},\"asm\":\"Tpm20CmdInit (.text @ 0xffe0e415):\\nffe0e415 push ebp\\nffe0e416 mov ebp, esp\\nffe0e418 sub esp, 428h\\nffe0e41e mov eax, [ecx]\\nffe0e420 lea edx, [ebp+var_4]\\nffe0e423 and [ebp+var_4], 0\\nffe0e427 push edx\\nffe0e428 push 0\\nffe0e42a push 0\\nffe0e42c push offset unk_FFE17408\\nffe0e431 push ecx\\nffe0e432 call dword ptr [eax+20h]\\nffe0e435 add esp, 14h\\nffe0e438 test eax, eax\\nffe0e43a js loc_FFE0E4B9\\nffe0e43c mov eax, 180h\\nffe0e441 mov [ebp+var_16], 7A010000h\\nffe0e448 push 6\\nffe0e44a pop ecx\\nffe0e44b mov [ebp+var_1C], ax\\nffe0e44f call SwapBytes32\\nffe0e454 mov ecx, [ebp+n286]\\nffe0e457 mov [ebp+var_12], eax\\nffe0e45a call SwapBytes32\\nffe0e45f xor ecx, ecx\\nffe0e461 mov [ebp+var_E], eax\\nffe0e464 inc ecx\\nffe0e465 call SwapBytes32\\nffe0e46a push 16h\\nffe0e46c pop ecx\\nffe0e46d mov [ebp+var_A], eax\\nffe0e470 call SwapBytes32\\nffe0e475 mov [ebp+var_1A], eax\\nffe0e478 lea eax, [ebp+var_428]\\nffe0e47e push eax\\nffe0e47f push 40Bh\\nffe0e484 lea eax, [ebp+var_1C]\\nffe0e487 push eax\\nffe0e4... [1466 chars total]\",\"code\":\"int __cdecl Tpm20CmdInit(int n286, int a2, _BYTE *a3, char *dst)\\n{\\n int *v4; // ecx\\n int v5; // eax\\n int result; // eax\\n char v7[11]; // [esp+0h] [ebp-428h] BYREF\\n char src[1025]; // [esp+Bh] [ebp-41Dh] BYREF\\n __int16 n384; // [esp+40Ch] [ebp-1Ch] BYREF\\n int v10; // [esp+40Eh] [ebp-1Ah]\\n int n2046885888; // [esp+412h] [ebp-16h]\\n int v12; // [esp+416h] [ebp-12h]\\n int v13; // [esp+41Ah] [ebp-Eh]\\n int v14; // [esp+41Eh] [ebp-Ah]\\n int v15; // [esp+424h] [ebp-4h] BYREF\\n\\n v5 = *v4; /*0xffe0e41e*/\\n v15 = 0; /*0xffe0e423*/\\n result = (*(int (__cdecl **)(int *, void *, _DWORD, _DWORD, int *))(v5 + 32))(v4, &unk_FFE17408, 0, 0, &v15); /*0xffe0e432*/\\n if ( result >= 0 ) /*0xffe0e43a*/\\n {\\n n2046885888 = 2046885888; /*0xffe0e441*/\\n n384 = 384; /*0xffe0e44b*/\\n v12 = sub_FFE10573(6); /*0xffe0e457*/\\n v13 = sub_FFE10573(n286); /*0xffe0e461*/\\n v14 = sub_FFE10573(1); /*0xffe0e46d*/\\n v10 = sub_FFE10573(22); /*0xffe0e475*/\\n result = (*(int (__cdecl **)(int, int, __int16... [1277 chars total]\",\"xrefs\":{\"to\":[{\"addr\":\"0xffe0e4dd\",\"type\":\"code\"},{\"addr\":\"0xffe0e509\",\"type\":\"code\"},{\"addr\":\"0xffe0e586\",\"type\":\"code\"}],\"from\":[{\"addr\":\"0xffe0e416\",\"type\":\"code\"}]}}]}"}, {"type": "text", "text": "Output truncated. Run: curl -o .ida-mcp/afe858c0-6963-4827-9b3c-535b6551e40a.json http://127.0.0.1:13375/output/afe858c0-6963-4827-9b3c-535b6551e40a.json"}], "isError": false, "_meta": {"ida_mcp": {"output_truncated": true, "total_chars": 120521, "output_id": "afe858c0-6963-4827-9b3c-535b6551e40a", "download_url": "http://127.0.0.1:13375/output/afe858c0-6963-4827-9b3c-535b6551e40a.json", "download_hint": "Output truncated. Run: curl -o .ida-mcp/afe858c0-6963-4827-9b3c-535b6551e40a.json http://127.0.0.1:13375/output/afe858c0-6963-4827-9b3c-535b6551e40a.json"}}}, "id": 1}
Ajax Dong