{"jsonrpc": "2.0", "result": {"structuredContent": {"format": "json", "functions": [{"addr": "0xffe14375", "name": "Sha1FinalInternal", "prototype": "int __fastcall(_DWORD *, _BYTE *)", "size": "0x18f", "comments": {"0xffe143ba": {"regular": "src"}, "0xffe143bd": {"regular": "_DWORD *"}, "0xffe14403": {"regular": "src"}, "0xffe14433": {"regular": "_DWORD *"}}, "asm": "Sha1FinalInternal (.text @ 0xffe14375):\nffe14375 push esi\nffe14376 mov esi, ecx\nffe14378 push edi\nffe14379 mov edi, edx\nffe1437b mov ecx, [esi+28h]\nffe1437e cmp ecx, 40h\nffe14381 jb loc_FFE1438B\nffe14383 or eax, 0FFFFFFFFh\nffe14386 jmp loc_FFE14501\nffe1438b push ebx\nffe1438c mov eax, ecx\nffe1438e shl eax, 3\nffe14391 add [esi], eax\nffe14393 push 0\nffe14395 pop ebx\nffe14396 adc [esi+4], ebx\nffe14399 mov byte ptr [ecx+esi+2Ch], 80h\nffe1439e inc dword ptr [esi+28h]\nffe143a1 mov eax, [esi+28h]\nffe143a4 cmp eax, 38h\nffe143a7 jbe loc_FFE143D3\nffe143a9 jmp loc_FFE143B5\nffe143ab mov [esi+eax+2Ch], bl\nffe143af inc dword ptr [esi+28h]\nffe143b2 mov eax, [esi+28h]\nffe143b5 cmp eax, 40h\nffe143b8 jb loc_FFE143AB\nffe143ba lea edx, [esi+2Ch]\nffe143bd mov ecx, esi\nffe143bf call Sha256Transform\nffe143c4 mov [esi+28h], ebx\nffe143c7 jmp loc_FFE143D3\nffe143c9 mov eax, [esi+28h]\nffe143cc mov [esi+eax+2Ch], bl\nffe143d0 inc dword ptr [esi+28h]\nffe143d3 cmp dword ptr [esi+28h... [3787 chars total]", "code": "int __fastcall Sha1FinalInternal(_DWORD *a1, _BYTE *a2)\n{\n unsigned int n0x40; // ecx\n bool v6; // cf\n unsigned int n0x40_1; // eax\n\n n0x40 = a1[10]; /*0xffe1437b*/\n if ( n0x40 >= 0x40 ) /*0xffe14381*/\n return -1; /*0xffe14383*/\n v6 = __CFADD__(8 * n0x40, *a1); /*0xffe14391*/\n *a1 += 8 * n0x40; /*0xffe14391*/\n a1[1] += v6; /*0xffe14396*/\n *((_BYTE *)a1 + n0x40 + 44) = 0x80; /*0xffe14399*/\n n0x40_1 = ++a1[10]; /*0xffe143a1*/\n if ( n0x40_1 > 0x38 ) /*0xffe143a7*/\n {\n while ( n0x40_1 < 0x40 ) /*0xffe143b8*/\n {\n *((_BYTE *)a1 + n0x40_1 + 44) = 0; /*0xffe143ab*/\n n0x40_1 = ++a1[10]; /*0xffe143b2*/\n }\n Sha256Transform(a1, (unsigned __int8 *)a1 + 44); /*0xffe143bf*/\n a1[10] = 0; /*0xffe143c4*/\n }\n while ( a1[10] < 0x38u ) /*0xffe143d7*/\n *((_BYTE *)a1 + a1[10]++ + 44) = 0; /*0xffe143cc*/\n *((_BYTE *)a1 + 100) = *((_BYTE *)a1 + 7); /*0xffe143de*/\n *((_BYTE *)a1 + 101) = *((_BYTE *)a1 + 6); /*0xffe143e4*/\n *((_BYTE *)a1 + 102) = sub_FFE16354(0x28u... [2914 chars total]", "xrefs": {"to": [{"addr": "0xffe0f0dd", "type": "code"}, {"addr": "0xffe1564e", "type": "code"}], "from": [{"addr": "0xffe14376", "type": "code"}]}}, {"addr": "0xffe14504", "name": "Tpm20HashAllSha256", "prototype": "int __thiscall(_DWORD *this)", "size": "0x83", "comments": {}, "asm": "Tpm20HashAllSha256 (.text @ 0xffe14504):\nffe14504 test ecx, ecx\nffe14506 jnz loc_FFE1450C\nffe14508 or eax, 0FFFFFFFFh\nffe1450b retn\nffe1450c xor eax, eax\nffe1450e mov [ecx+48h], eax\nffe14511 mov [ecx], eax\nffe14513 mov [ecx+4], eax\nffe14516 mov dword ptr [ecx+8], 0C1059ED8h\nffe1451d mov dword ptr [ecx+0Ch], 0CBBB9D5Dh\nffe14524 mov dword ptr [ecx+10h], 367CD507h\nffe1452b mov dword ptr [ecx+14h], 629A292Ah\nffe14532 mov dword ptr [ecx+18h], 3070DD17h\nffe14539 mov dword ptr [ecx+1Ch], 9159015Ah\nffe14540 mov dword ptr [ecx+20h], 0F70E5939h\nffe14547 mov dword ptr [ecx+24h], 152FECD8h\nffe1454e mov dword ptr [ecx+28h], 0FFC00B31h\nffe14555 mov dword ptr [ecx+2Ch], 67332667h\nffe1455c mov dword ptr [ecx+30h], 68581511h\nffe14563 mov dword ptr [ecx+34h], 8EB44A87h\nffe1456a mov dword ptr [ecx+38h], 64F98FA7h\nffe14571 mov dword ptr [ecx+3Ch], 0DB0C2E0Dh\nffe14578 mov dword ptr [ecx+40h], 0BEFA4FA4h\nffe1457f mov dword ptr [ecx+44h], 47B5481Dh\nffe14586 retn", "code": "int __thiscall Tpm20HashAllSha256(_DWORD *this)\n{\n if ( !this ) /*0xffe14506*/\n return -1; /*0xffe14508*/\n *(this + 18) = 0; /*0xffe1450e*/\n *this = 0; /*0xffe14511*/\n *(this + 1) = 0; /*0xffe14513*/\n *(this + 2) = -1056596264; /*0xffe14516*/\n *(this + 3) = -876896931; /*0xffe1451d*/\n *(this + 4) = 914150663; /*0xffe14524*/\n *(this + 5) = 1654270250; /*0xffe1452b*/\n *(this + 6) = 812702999; /*0xffe14532*/\n *(this + 7) = -1856437926; /*0xffe14539*/\n *(this + 8) = -150054599; /*0xffe14540*/\n *(this + 9) = 355462360; /*0xffe14547*/\n *(this + 10) = -4191439; /*0xffe1454e*/\n *(this + 11) = 1731405415; /*0xffe14555*/\n *(this + 12) = 1750603025; /*0xffe1455c*/\n *(this + 13) = -1900787065; /*0xffe14563*/\n *(this + 14) = 1694076839; /*0xffe1456a*/\n *(this + 15) = -619958771; /*0xffe14571*/\n *(this + 16) = -1090891868; /*0xffe14578*/\n *(this + 17) = 1203062813; /*0xffe1457f*/\n return 0; /*0xffe1450b*/\n}", "xrefs": {"to": [{"addr": "0xffe0ef25", "type": "code"}, {"addr": "0xffe145d1", "type": "code"}], "from": [{"addr": "0xffe14506", "type": "code"}]}}, {"addr": "0xffe14587", "name": "Sha256FinalInternal", "prototype": "int __fastcall(int, char *dst)", "size": "0x3b", "comments": {}, "asm": "Sha256FinalInternal (.text @ 0xffe14587):\nffe14587 push ebp\nffe14588 mov ebp, esp\nffe1458a sub esp, 44h\nffe1458d push esi\nffe1458e mov esi, edx\nffe14590 test ecx, ecx\nffe14592 jnz loc_FFE14599\nffe14594 or eax, 0FFFFFFFFh\nffe14597 jmp loc_FFE145BD\nffe14599 test esi, esi\nffe1459b jz loc_FFE14594\nffe1459d cmp dword ptr [ecx+48h], 80h\nffe145a4 jnb loc_FFE14594\nffe145a6 lea edx, [ebp+var_40]\nffe145a9 call Sha384FinalInternal\nffe145ae push 30h\nffe145b0 lea edx, [ebp+var_40]\nffe145b3 mov ecx, esi\nffe145b5 call CopyMemChecked\nffe145ba pop ecx\nffe145bb xor eax, eax\nffe145bd pop esi\nffe145be mov esp, ebp\nffe145c0 pop ebp\nffe145c1 retn", "code": "int __fastcall Sha256FinalInternal(int a1, char *dst)\n{\n char src[64]; // [esp+8h] [ebp-40h] BYREF\n\n if ( !a1 || !dst || *(_DWORD *)(a1 + 72) >= 0x80u ) /*0xffe145a4*/\n return -1; /*0xffe14594*/\n sub_FFE154A9(); /*0xffe145a9*/\n CopyMemChecked(dst, src, 0x30u); /*0xffe145b5*/\n return 0; /*0xffe145bd*/\n}", "xrefs": {"to": [{"addr": "0xffe0f0f1", "type": "code"}, {"addr": "0xffe145e9", "type": "code"}], "from": [{"addr": "0xffe14588", "type": "code"}]}}, {"addr": "0xffe145c2", "name": "Sha256HashAll", "prototype": "int __cdecl(unsigned int *p_i, char *dst)", "size": "0x30", "comments": {"0xffe145d9": {"regular": "src"}, "0xffe145db": {"regular": "i"}, "0xffe145e2": {"regular": "dst"}, "0xffe145e6": {"regular": "int"}}, "asm": "Sha256HashAll (.text @ 0xffe145c2):\nffe145c2 push ebp\nffe145c3 mov ebp, esp\nffe145c5 and esp, 0FFFFFFF8h\nffe145c8 sub esp, 0D0h\nffe145ce lea ecx, [esp+0D0h+var_D0]\nffe145d1 call Tpm20HashAllSha256\nffe145d6 mov eax, [ebp+p_i]\nffe145d9 mov edx, [edx]\nffe145db push dword ptr [eax]\nffe145dd call Sha384UpdateInternal\nffe145e2 mov edx, [ebp+dst]\nffe145e5 pop ecx\nffe145e6 lea ecx, [esp+0D0h+var_D0]\nffe145e9 call Sha256FinalInternal\nffe145ee mov esp, ebp\nffe145f0 pop ebp\nffe145f1 retn", "code": "int __cdecl Sha256HashAll(unsigned int *p_i, char *dst)\n{\n char **p_src; // edx\n char *v3; // ecx\n int v5[52]; // [esp+0h] [ebp-D0h] BYREF\n\n Tpm20HashAllSha256(v5); /*0xffe145d1*/\n sub_FFE153F4(v3, *p_src, *p_i); /*0xffe145dd*/\n return Sha256FinalInternal((int)v5, dst); /*0xffe145ee*/\n}", "xrefs": {"to": [{"addr": "0xffe15682", "type": "code"}, {"addr": "0xffe156b5", "type": "code"}], "from": [{"addr": "0xffe145c3", "type": "code"}]}}, {"addr": "0xffe145f2", "name": "Sha256RoundConstants", "prototype": "int __fastcall(int, int src)", "size": "0xd7f", "comments": {}, "asm": "Sha256RoundConstants (.text @ 0xffe145f2):\nffe145f2 sub esp, 314h\nffe145f8 push ebx\nffe145f9 push ebp\nffe145fa push esi\nffe145fb push edi\nffe145fc add ecx, 8\nffe145ff lea esi, [esp+324h+var_2CC]\nffe14603 push 8\nffe14605 mov ebp, edx\nffe14607 mov [esp+328h+var_288], ecx\nffe1460e mov edi, ecx\nffe14610 pop ebx\nffe14611 push 8\nffe14613 mov edx, edi\nffe14615 mov ecx, esi\nffe14617 call CopyMemChecked\nffe1461c add edi, 8\nffe1461f add esi, 8\nffe14622 pop ecx\nffe14623 sub ebx, 1\nffe14626 jnz loc_FFE14611\nffe14628 lea edi, [ebp+2]\nffe1462b movzx eax, byte ptr [edi-2]\nffe1462f cdq ,\nffe14630 mov ecx, eax\nffe14632 mov esi, edx\nffe14634 movzx eax, byte ptr [edi-1]\nffe14638 shld esi, ecx, 8\nffe1463c cdq ,\nffe1463d shl ecx, 8\nffe14640 or esi, edx\nffe14642 or ecx, eax\nffe14644 movzx eax, byte ptr [edi]\nffe14647 shld esi, ecx, 8\nffe1464b cdq ,\nffe1464c lea edi, [edi+8]\nffe1464f shl ecx, 8\nffe14652 or esi, edx\nffe14654 or ecx, eax\nffe14656 movzx eax, byte ptr [edi... [35565 chars total]", "code": "int __fastcall Sha256RoundConstants(int a1, int src)\n{\n char *dst; // esi\n char *src_1; // edi\n int n8; // ebx\n unsigned __int8 *v6; // edi\n __int64 v7; // rt0\n __int64 v8; // rax\n unsigned __int64 v9; // rt0\n int v10; // ecx\n _BYTE *v11; // edx\n __int64 v12; // rcx\n unsigned int v13; // edi\n unsigned int v14; // ebp\n unsigned __int64 v15; // rt0\n int v16; // edi\n bool v17; // zf\n int n8_1; // ebp\n unsigned int v19; // ecx\n unsigned int v20; // edx\n unsigned __int64 v21; // kr28_8\n unsigned __int64 v22; // kr58_8\n unsigned __int64 v23; // kr88_8\n unsigned __int64 v24; // kr90_8\n unsigned __int64 v25; // krB0_8\n unsigned __int64 v26; // kr00_8\n unsigned __int64 v27; // krD0_8\n unsigned int v28; // eax\n unsigned __int64 v29; // kr100_8\n unsigned int v30; // eax\n unsigned __int64 v31; // kr130_8\n unsigned __int64 v32; // kr08_8\n unsigned int v33; // eax\n unsigned __int64 v34; // kr160_8\n unsigned __int64 v35; // kr20_8\n unsigned __int64 v36; // kr170_8\n ... [14483 chars total]", "xrefs": {"to": [{"addr": "0xffe1542f", "type": "code"}, {"addr": "0xffe15483", "type": "code"}, {"addr": "0xffe15504", "type": "code"}, {"addr": "0xffe1556c", "type": "code"}], "from": [{"addr": "0xffe145f8", "type": "code"}]}}, {"addr": "0xffe15371", "name": "Tpm20HashAllSha384", "prototype": "int __thiscall(_DWORD *this)", "size": "0x83", "comments": {}, "asm": "Tpm20HashAllSha384 (.text @ 0xffe15371):\nffe15371 test ecx, ecx\nffe15373 jnz loc_FFE15379\nffe15375 or eax, 0FFFFFFFFh\nffe15378 retn\nffe15379 xor eax, eax\nffe1537b mov [ecx+48h], eax\nffe1537e mov [ecx], eax\nffe15380 mov [ecx+4], eax\nffe15383 mov dword ptr [ecx+8], 0F3BCC908h\nffe1538a mov dword ptr [ecx+0Ch], 6A09E667h\nffe15391 mov dword ptr [ecx+10h], 84CAA73Bh\nffe15398 mov dword ptr [ecx+14h], 0BB67AE85h\nffe1539f mov dword ptr [ecx+18h], 0FE94F82Bh\nffe153a6 mov dword ptr [ecx+1Ch], 3C6EF372h\nffe153ad mov dword ptr [ecx+20h], 5F1D36F1h\nffe153b4 mov dword ptr [ecx+24h], 0A54FF53Ah\nffe153bb mov dword ptr [ecx+28h], 0ADE682D1h\nffe153c2 mov dword ptr [ecx+2Ch], 510E527Fh\nffe153c9 mov dword ptr [ecx+30h], 2B3E6C1Fh\nffe153d0 mov dword ptr [ecx+34h], 9B05688Ch\nffe153d7 mov dword ptr [ecx+38h], 0FB41BD6Bh\nffe153de mov dword ptr [ecx+3Ch], 1F83D9ABh\nffe153e5 mov dword ptr [ecx+40h], 137E2179h\nffe153ec mov dword ptr [ecx+44h], 5BE0CD19h\nffe153f3 retn", "code": "int __thiscall Tpm20HashAllSha384(_DWORD *this)\n{\n if ( !this ) /*0xffe15373*/\n return -1; /*0xffe15375*/\n *(this + 18) = 0; /*0xffe1537b*/\n *this = 0; /*0xffe1537e*/\n *(this + 1) = 0; /*0xffe15380*/\n *(this + 2) = -205731576; /*0xffe15383*/\n *(this + 3) = 1779033703; /*0xffe1538a*/\n *(this + 4) = -2067093701; /*0xffe15391*/\n *(this + 5) = -1150833019; /*0xffe15398*/\n *(this + 6) = -23791573; /*0xffe1539f*/\n *(this + 7) = 1013904242; /*0xffe153a6*/\n *(this + 8) = 1595750129; /*0xffe153ad*/\n *(this + 9) = -1521486534; /*0xffe153b4*/\n *(this + 10) = -1377402159; /*0xffe153bb*/\n *(this + 11) = 1359893119; /*0xffe153c2*/\n *(this + 12) = 725511199; /*0xffe153c9*/\n *(this + 13) = -1694144372; /*0xffe153d0*/\n *(this + 14) = -79577749; /*0xffe153d7*/\n *(this + 15) = 528734635; /*0xffe153de*/\n *(this + 16) = 327033209; /*0xffe153e5*/\n *(this + 17) = 1541459225; /*0xffe153ec*/\n return 0; /*0xffe15378*/\n}", "xrefs": {"to": [{"addr": "0xffe0ef3e", "type": "code"}], "from": [{"addr": "0xffe15373", "type": "code"}]}}, {"addr": "0xffe153f4", "name": "Sha384UpdateInternal", "prototype": "int __fastcall(char *, char *src, unsigned int i)", "size": "0xb5", "comments": {"0xffe1542d": {"regular": "int"}, "0xffe1547e": {"regular": "src"}, "0xffe15481": {"regular": "int"}, "0xffe15492": {"regular": "src"}}, "asm": "Sha384UpdateInternal (.text @ 0xffe153f4):\nffe153f4 push ebp\nffe153f5 mov ebp, esp\nffe153f7 and esp, 0FFFFFFF8h\nffe153fa push ecx\nffe153fb push ebx\nffe153fc push esi\nffe153fd mov esi, ecx\nffe153ff mov [esp+0Ch+src], edx\nffe15403 push edi\nffe15404 test esi, esi\nffe15406 jnz loc_FFE15410\nffe15408 or eax, 0FFFFFFFFh\nffe1540b jmp loc_FFE154A2\nffe15410 test edx, edx\nffe15412 jz loc_FFE15408\nffe15414 mov ebx, 80h\nffe15419 cmp [esi+48h], ebx\nffe1541c ja loc_FFE15408\nffe1541e mov edi, [ebp+i]\nffe15421 jmp loc_FFE1549C\nffe15423 cmp dword ptr [esi+48h], 0\nffe15427 jnz loc_FFE1544F\nffe15429 cmp edi, ebx\nffe1542b jb loc_FFE1544F\nffe1542d mov ecx, esi\nffe1542f call Sha256RoundConstants\nffe15434 test eax, eax\nffe15436 jnz loc_FFE154A2\nffe15438 add dword ptr [esi], 400h\nffe1543e mov edx, [esp+10h+src]\nffe15442 adc [esi+4], eax\nffe15445 add edx, ebx\nffe15447 mov [esp+10h+src], edx\nffe1544b sub edi, ebx\nffe1544d jmp loc_FFE1549C\nffe1544f sub ebx, [esi+48h]\nffe15452 ... [1855 chars total]", "code": "int __fastcall Sha384UpdateInternal(char *a1, char *src, unsigned int i)\n{\n int result; // eax\n bool v6; // cf\n unsigned int i_1; // ebx\n char *srca; // [esp+Ch] [ebp-4h]\n\n srca = src; /*0xffe153ff*/\n if ( !a1 || !src || *((_DWORD *)a1 + 18) > 0x80u ) /*0xffe1541c*/\n return -1; /*0xffe15408*/\n while ( i ) /*0xffe1549e*/\n {\n if ( *((_DWORD *)a1 + 18) || i < 0x80 ) /*0xffe1542b*/\n {\n i_1 = 128 - *((_DWORD *)a1 + 18); /*0xffe1544f*/\n if ( i < i_1 ) /*0xffe15454*/\n i_1 = i; /*0xffe15456*/\n CopyMemChecked(&a1[*((_DWORD *)a1 + 18) + 76], src, i_1); /*0xffe1545f*/\n i -= i_1; /*0xffe15468*/\n *((_DWORD *)a1 + 18) += i_1; /*0xffe1546a*/\n src = &srca[i_1]; /*0xffe1546d*/\n srca += i_1; /*0xffe15474*/\n if ( *((_DWORD *)a1 + 18) == 128 ) /*0xffe1547c*/\n {\n result = Sha256RoundConstants((int)a1, (int)(a1 + 76)); /*0xffe15483*/\n if ( result ) /*0xffe1548a*/\n return result; /*0xffe1548a*/\n v6 = __CFADD__(... [1682 chars total]", "xrefs": {"to": [{"addr": "0xffe0eff7", "type": "code"}, {"addr": "0xffe145dd", "type": "code"}], "from": [{"addr": "0xffe153f5", "type": "code"}]}}, {"addr": "0xffe154a9", "name": "Sha384FinalInternal", "prototype": "int __fastcall(int, int)", "size": "0x111", "comments": {"0xffe154ff": {"regular": "src"}, "0xffe15502": {"regular": "int"}, "0xffe15523": {"regular": "src"}, "0xffe1552c": {"regular": "int"}}, "asm": "Sha384FinalInternal (.text @ 0xffe154a9):\nffe154a9 push ebp\nffe154aa mov ebp, esp\nffe154ac and esp, 0FFFFFFF8h\nffe154af push ebx\nffe154b0 push ebp\nffe154b1 push esi\nffe154b2 mov esi, ecx\nffe154b4 push edi\nffe154b5 mov edi, edx\nffe154b7 test esi, esi\nffe154b9 jnz loc_FFE154C3\nffe154bb or eax, 0FFFFFFFFh\nffe154be jmp loc_FFE155B2\nffe154c3 test edi, edi\nffe154c5 jz loc_FFE154BB\nffe154c7 mov ecx, [esi+48h]\nffe154ca mov ebx, 80h\nffe154cf cmp ecx, ebx\nffe154d1 jnb loc_FFE154BB\nffe154d3 push 8\nffe154d5 mov eax, ecx\nffe154d7 pop ebp\nffe154d8 mul , ebp\nffe154da add [esi], eax\nffe154dc adc [esi+4], edx\nffe154df mov [ecx+esi+4Ch], bl\nffe154e3 inc dword ptr [esi+48h]\nffe154e6 mov eax, [esi+48h]\nffe154e9 cmp eax, 70h\nffe154ec jbe loc_FFE1551A\nffe154ee jmp loc_FFE154FB\nffe154f0 mov byte ptr [esi+eax+4Ch], 0\nffe154f5 inc dword ptr [esi+48h]\nffe154f8 mov eax, [esi+48h]\nffe154fb cmp eax, ebx\nffe154fd jb loc_FFE154F0\nffe154ff lea edx, [esi+4Ch]\nffe15502 mov ecx, esi... [2524 chars total]", "code": "int __fastcall Sha384FinalInternal(int a1, int a2)\n{\n unsigned int n0x80; // ecx\n unsigned int n0x80_1; // eax\n _BYTE *v7; // ecx\n _BYTE *v8; // esi\n int n8; // edx\n char v10; // al\n\n if ( !a1 ) /*0xffe154b9*/\n return -1; /*0xffe154b9*/\n if ( !a2 ) /*0xffe154c5*/\n return -1; /*0xffe154c5*/\n n0x80 = *(_DWORD *)(a1 + 72); /*0xffe154c7*/\n if ( n0x80 >= 0x80 ) /*0xffe154d1*/\n return -1; /*0xffe154bb*/\n *(_QWORD *)a1 += 8LL * n0x80; /*0xffe154da*/\n *(_BYTE *)(n0x80 + a1 + 76) = 0x80; /*0xffe154df*/\n n0x80_1 = ++*(_DWORD *)(a1 + 72); /*0xffe154e6*/\n if ( n0x80_1 > 0x70 ) /*0xffe154ec*/\n {\n while ( n0x80_1 < 0x80 ) /*0xffe154fd*/\n {\n *(_BYTE *)(a1 + n0x80_1 + 76) = 0; /*0xffe154f0*/\n n0x80_1 = ++*(_DWORD *)(a1 + 72); /*0xffe154f8*/\n }\n Sha256RoundConstants(a1, a1 + 76); /*0xffe15504*/\n *(_DWORD *)(a1 + 72) = 0; /*0xffe15509*/\n }\n while ( *(_DWORD *)(a1 + 72) < 0x78u ) /*0xffe1551e*/\n {\n *(_BYTE *)(*(_DWORD *)(a1 + 72) + a1 + 76) = 0; /*0x... [2190 chars total]", "xrefs": {"to": [{"addr": "0xffe0f105", "type": "code"}, {"addr": "0xffe145a9", "type": "code"}], "from": [{"addr": "0xffe154aa", "type": "code"}]}}, {"addr": "0xffe155ba", "name": "Tpm20GetHashFromDigest", "prototype": "void __usercall(_BYTE *@<edx>, unsigned int, int)", "size": "0x37", "comments": {}, "asm": "Tpm20GetHashFromDigest (.text @ 0xffe155ba):\nffe155ba mov ecx, [esp+arg_0]\nffe155be push esi\nffe155bf mov esi, [esp+4+arg_4]\nffe155c3 cmp ecx, edx\nffe155c5 jnb loc_FFE155DE\nffe155c7 dec edx\nffe155c8 dec ecx\nffe155c9 add edx, esi\nffe155cb add ecx, esi\nffe155cd test esi, esi\nffe155cf jz loc_FFE155EF\nffe155d1 mov al, [ecx]\nffe155d3 mov [edx], al\nffe155d5 dec edx\nffe155d6 dec ecx\nffe155d7 sub esi, 1\nffe155da jnz loc_FFE155D1\nffe155dc pop esi\nffe155dd retn\nffe155de test esi, esi\nffe155e0 jz loc_FFE155EF\nffe155e2 sub ecx, edx\nffe155e4 mov al, [ecx+edx]\nffe155e7 mov [edx], al\nffe155e9 inc edx\nffe155ea sub esi, 1\nffe155ed jnz loc_FFE155E4\nffe155ef pop esi\nffe155f0 retn", "code": "void __usercall Tpm20GetHashFromDigest(_BYTE *a1@<edx>, unsigned int a2, int a3)\n{\n int v3; // esi\n _BYTE *v4; // edx\n _BYTE *v5; // ecx\n unsigned int v6; // ecx\n\n v3 = a3; /*0xffe155bf*/\n if ( a2 >= (unsigned int)a1 ) /*0xffe155c5*/\n {\n if ( a3 ) /*0xffe155e0*/\n {\n v6 = a2 - (_DWORD)a1; /*0xffe155e2*/\n do /*0xffe155ed*/\n {\n *a1 = a1[v6]; /*0xffe155e7*/\n ++a1; /*0xffe155e9*/\n --v3; /*0xffe155ea*/\n }\n while ( v3 ); /*0xffe155ed*/\n }\n }\n else\n {\n v4 = &a1[a3 - 1]; /*0xffe155c9*/\n v5 = (_BYTE *)(a3 + a2 - 1); /*0xffe155cb*/\n if ( a3 ) /*0xffe155cf*/\n {\n do /*0xffe155da*/\n {\n *v4-- = *v5--; /*0xffe155d3*/\n --v3; /*0xffe155d7*/\n }\n while ( v3 ); /*0xffe155da*/\n }\n }\n}", "xrefs": {"to": [{"addr": "0xffe0e88a", "type": "code"}, {"addr": "0xffe0f8c4", "type": "code"}, {"addr": "0xffe1561b", "type": "code"}, {"addr": "0xffe1565d", "type": "code"}, {"addr": "0xffe15690", "type": "code"}, {"addr": "0xffe156c3", "type": "code"}], "from": [{"addr": "0xffe155be", "type": "code"}]}}, {"addr": "0xffe155f1", "name": "Tpm20CopyDigest", "prototype": "int __cdecl(unsigned int i, _BYTE *)", "size": "0x38", "comments": {"0xffe155ff": {"regular": "i"}, "0xffe15607": {"regular": "buf"}, "0xffe1560a": {"regular": "dst"}}, "asm": "Tpm20CopyDigest (.text @ 0xffe155f1):\nffe155f1 push ebp\nffe155f2 mov ebp, esp\nffe155f4 sub esp, 70h\nffe155f7 lea ecx, [ebp+buf]\nffe155fa call Sha1Init\nffe155ff push [ebp+i]\nffe15602 call Sha1Update\nffe15607 lea edx, [ebp+buf]\nffe1560a lea ecx, [ebp+dst]\nffe1560d call Sha1Final\nffe15612 mov edx, [ebp+arg_4]\nffe15615 lea eax, [ebp+dst]\nffe15618 push 14h\nffe1561a push eax\nffe1561b call Tpm20GetHashFromDigest\nffe15620 add esp, 0Ch\nffe15623 xor eax, eax\nffe15625 mov esp, ebp\nffe15627 pop ebp\nffe15628 retn", "code": "int __cdecl Tpm20CopyDigest(unsigned int i, _BYTE *a2)\n{\n char *src; // edx\n int buf_1; // ecx\n _DWORD buf[23]; // [esp+0h] [ebp-70h] BYREF\n char dst[20]; // [esp+5Ch] [ebp-14h] BYREF\n\n Sha1Init(buf); /*0xffe155fa*/\n Sha1Update(buf_1, src, i); /*0xffe15602*/\n Sha1Final(dst, buf); /*0xffe1560d*/\n Tpm20GetHashFromDigest(a2, (unsigned int)dst, 20); /*0xffe1561b*/\n return 0; /*0xffe15625*/\n}", "xrefs": {"to": [{"addr": "0xffe0e2c4", "type": "code"}, {"addr": "0xffe0fb3f", "type": "code"}], "from": [{"addr": "0xffe155f2", "type": "code"}]}}]}, "content": [{"type": "text", "text": "{\"format\":\"json\",\"functions\":[{\"addr\":\"0xffe14375\",\"name\":\"Sha1FinalInternal\",\"prototype\":\"int __fastcall(_DWORD *, _BYTE *)\",\"size\":\"0x18f\",\"comments\":{\"0xffe143ba\":{\"regular\":\"src\"},\"0xffe143bd\":{\"regular\":\"_DWORD *\"},\"0xffe14403\":{\"regular\":\"src\"},\"0xffe14433\":{\"regular\":\"_DWORD *\"}},\"asm\":\"Sha1FinalInternal (.text @ 0xffe14375):\\nffe14375 push esi\\nffe14376 mov esi, ecx\\nffe14378 push edi\\nffe14379 mov edi, edx\\nffe1437b mov ecx, [esi+28h]\\nffe1437e cmp ecx, 40h\\nffe14381 jb loc_FFE1438B\\nffe14383 or eax, 0FFFFFFFFh\\nffe14386 jmp loc_FFE14501\\nffe1438b push ebx\\nffe1438c mov eax, ecx\\nffe1438e shl eax, 3\\nffe14391 add [esi], eax\\nffe14393 push 0\\nffe14395 pop ebx\\nffe14396 adc [esi+4], ebx\\nffe14399 mov byte ptr [ecx+esi+2Ch], 80h\\nffe1439e inc dword ptr [esi+28h]\\nffe143a1 mov eax, [esi+28h]\\nffe143a4 cmp eax, 38h\\nffe143a7 jbe loc_FFE143D3\\nffe143a9 jmp loc_FFE143B5\\nffe143ab mov [esi+eax+2Ch], bl\\nffe143af inc dword ptr [esi+28h]\\nffe143b2 mov eax, [esi+28h]\\nffe143b5 cmp eax, 40h\\nffe143b8 jb loc_FFE143AB\\nffe143ba lea edx, [esi+2Ch]\\nffe143bd mov ecx, esi\\nffe143bf call Sha256Transform\\nffe143c4 mov [esi+28h], ebx\\nffe143c7 jmp loc_FFE143D3\\nffe143c9 mov eax, [esi+28h]\\nffe143cc mov [esi+eax+2Ch], bl\\nffe143d0 inc dword ptr [esi+28h]\\nffe143d3 cmp dword ptr [esi+28h... [3787 chars total]\",\"code\":\"int __fastcall Sha1FinalInternal(_DWORD *a1, _BYTE *a2)\\n{\\n unsigned int n0x40; // ecx\\n bool v6; // cf\\n unsigned int n0x40_1; // eax\\n\\n n0x40 = a1[10]; /*0xffe1437b*/\\n if ( n0x40 >= 0x40 ) /*0xffe14381*/\\n return -1; /*0xffe14383*/\\n v6 = __CFADD__(8 * n0x40, *a1); /*0xffe14391*/\\n *a1 += 8 * n0x40; /*0xffe14391*/\\n a1[1] += v6; /*0xffe14396*/\\n *((_BYTE *)a1 + n0x40 + 44) = 0x80; /*0xffe14399*/\\n n0x40_1 = ++a1[10]; /*0xffe143a1*/\\n if ( n0x40_1 > 0x38 ) /*0xffe143a7*/\\n {\\n while ( n0x40_1 < 0x40 ) /*0xffe143b8*/\\n {\\n *((_BYTE *)a1 + n0x40_1 + 44) = 0; /*0xffe143ab*/\\n n0x40_1 = ++a1[10]; /*0xffe143b2*/\\n }\\n Sha256Transform(a1, (unsigned __int8 *)a1 + 44); /*0xffe143bf*/\\n a1[10] = 0; /*0xffe143c4*/\\n }\\n while ( a1[10] < 0x38u ) /*0xffe143d7*/\\n *((_BYTE *)a1 + a1[10]++ + 44) = 0; /*0xffe143cc*/\\n *((_BYTE *)a1 + 100) = *((_BYTE *)a1 + 7); /*0xffe143de*/\\n *((_BYTE *)a1 + 101) = *((_BYTE *)a1 + 6); /*0xffe143e4*/\\n *((_BYTE *)a1 + 102) = sub_FFE16354(0x28u... [2914 chars total]\",\"xrefs\":{\"to\":[{\"addr\":\"0xffe0f0dd\",\"type\":\"code\"},{\"addr\":\"0xffe1564e\",\"type\":\"code\"}],\"from\":[{\"addr\":\"0xffe14376\",\"type\":\"code\"}]}},{\"addr\":\"0xffe14504\",\"name\":\"Tpm20HashAllSha256\",\"prototype\":\"int __thiscall(_DWORD *this)\",\"size\":\"0x83\",\"comments\":{},\"asm\":\"Tpm20HashAllSha256 (.text @ 0xffe14504):\\nffe14504 test ecx, ecx\\nffe14506 jnz loc_FFE1450C\\nffe14508 or eax, 0FFFFFFFFh\\nffe1450b retn\\nffe1450c xor eax, eax\\nffe1450e mov [ecx+48h], eax\\nffe14511 mov [ecx], eax\\nffe14513 mov [ecx+4], eax\\nffe14516 mov dword ptr [ecx+8], 0C1059ED8h\\nffe1451d mov dword ptr [ecx+0Ch], 0CBBB9D5Dh\\nffe14524 mov dword ptr [ecx+10h], 367CD507h\\nffe1452b mov dword ptr [ecx+14h], 629A292Ah\\nffe14532 mov dword ptr [ecx+18h], 3070DD17h\\nffe14539 mov dword ptr [ecx+1Ch], 9159015Ah\\nffe14540 mov dword ptr [ecx+20h], 0F70E5939h\\nffe14547 mov dword ptr [ecx+24h], 152FECD8h\\nffe1454e mov dword ptr [ecx+28h], 0FFC00B31h\\nffe14555 mov dword ptr [ecx+2Ch], 67332667h\\nffe1455c mov dword ptr [ecx+30h], 68581511h\\nffe14563 mov dword ptr [ecx+34h], 8EB44A87h\\nffe1456a mov dword ptr [ecx+38h], 64F98FA7h\\nffe14571 mov dword ptr [ecx+3Ch], 0DB0C2E0Dh\\nffe14578 mov dword ptr [ecx+40h], 0BEFA4FA4h\\nffe1457f mov dword ptr [ecx+44h], 47B5481Dh\\nffe14586 retn\",\"code\":\"int __thiscall Tpm20HashAllSha256(_DWORD *this)\\n{\\n if ( !this ) /*0xffe14506*/\\n return -1; /*0xffe14508*/\\n *(this + 18) = 0; /*0xffe1450e*/\\n *this = 0; /*0xffe14511*/\\n *(this + 1) = 0; /*0xffe14513*/\\n *(this + 2) = -1056596264; /*0xffe14516*/\\n *(this + 3) = -876896931; /*0xffe1451d*/\\n *(this + 4) = 914150663; /*0xffe14524*/\\n *(this + 5) = 1654270250; /*0xffe1452b*/\\n *(this + 6) = 812702999; /*0xffe14532*/\\n *(this + 7) = -1856437926; /*0xffe14539*/\\n *(this + 8) = -150054599; /*0xffe14540*/\\n *(this + 9) = 355462360; /*0xffe14547*/\\n *(this + 10) = -4191439; /*0xffe1454e*/\\n *(this + 11) = 1731405415; /*0xffe14555*/\\n *(this + 12) = 1750603025; /*0xffe1455c*/\\n *(this + 13) = -1900787065; /*0xffe14563*/\\n *(this + 14) = 1694076839; /*0xffe1456a*/\\n *(this + 15) = -619958771; /*0xffe14571*/\\n *(this + 16) = -1090891868; /*0xffe14578*/\\n *(this + 17) = 1203062813; /*0xffe1457f*/\\n return 0; /*0xffe1450b*/\\n}\",\"xrefs\":{\"to\":[{\"addr\":\"0xffe0ef25\",\"type\":\"code\"},{\"addr\":\"0xffe145d1\",\"type\":\"code\"}],\"from\":[{\"addr\":\"0xffe14506\",\"type\":\"code\"}]}},{\"addr\":\"0xffe14587\",\"name\":\"Sha256FinalInternal\",\"prototype\":\"int __fastcall(int, char *dst)\",\"size\":\"0x3b\",\"comments\":{},\"asm\":\"Sha256FinalInternal (.text @ 0xffe14587):\\nffe14587 push ebp\\nffe14588 mov ebp, esp\\nffe1458a sub esp, 44h\\nffe1458d push esi\\nffe1458e mov esi, edx\\nffe14590 test ecx, ecx\\nffe14592 jnz loc_FFE14599\\nffe14594 or eax, 0FFFFFFFFh\\nffe14597 jmp loc_FFE145BD\\nffe14599 test esi, esi\\nffe1459b jz loc_FFE14594\\nffe1459d cmp dword ptr [ecx+48h], 80h\\nffe145a4 jnb loc_FFE14594\\nffe145a6 lea edx, [ebp+var_40]\\nffe145a9 call Sha384FinalInternal\\nffe145ae push 30h\\nffe145b0 lea edx, [ebp+var_40]\\nffe145b3 mov ecx, esi\\nffe145b5 call CopyMemChecked\\nffe145ba pop ecx\\nffe145bb xor eax, eax\\nffe145bd pop esi\\nffe145be mov esp, ebp\\nffe145c0 pop ebp\\nffe145c1 retn\",\"code\":\"int __fastcall Sha256FinalInternal(int a1, char *dst)\\n{\\n char src[64]; // [esp+8h] [ebp-40h] BYREF\\n\\n if ( !a1 || !dst || *(_DWORD *)(a1 + 72) >= 0x80u ) /*0xffe145a4*/\\n return -1; /*0xffe14594*/\\n sub_FFE154A9(); /*0xffe145a9*/\\n CopyMemChecked(dst, src, 0x30u); /*0xffe145b5*/\\n return 0; /*0xffe145bd*/\\n}\",\"xrefs\":{\"to\":[{\"addr\":\"0xffe0f0f1\",\"type\":\"code\"},{\"addr\":\"0xffe145e9\",\"type\":\"code\"}],\"from\":[{\"addr\":\"0xffe14588\",\"type\":\"code\"}]}},{\"addr\":\"0xffe145c2\",\"name\":\"Sha256HashAll\",\"prototype\":\"int __cdecl(unsigned int *p_i, char *dst)\",\"size\":\"0x30\",\"comments\":{\"0xffe145d9\":{\"regular\":\"src\"},\"0xffe145db\":{\"regular\":\"i\"},\"0xffe145e2\":{\"regular\":\"dst\"},\"0xffe145e6\":{\"regular\":\"int\"}},\"asm\":\"Sha256HashAll (.text @ 0xffe145c2):\\nffe145c2 push ebp\\nffe145c3 mov ebp, esp\\nffe145c5 and esp, 0FFFFFFF8h\\nffe145c8 sub esp, 0D0h\\nffe145ce lea ecx, [esp+0D0h+var_D0]\\nffe145d1 call Tpm20HashAllSha256\\nffe145d6 mov eax, [ebp+p_i]\\nffe145d9 mov edx, [edx]\\nffe145db push dword ptr [eax]\\nffe145dd call Sha384UpdateInternal\\nffe145e2 mov edx, [ebp+dst]\\nffe145e5 pop ecx\\nffe145e6 lea ecx, [esp+0D0h+var_D0]\\nffe145e9 call Sha256FinalInternal\\nffe145ee mov esp, ebp\\nffe145f0 pop ebp\\nffe145f1 retn\",\"code\":\"int __cdecl Sha256HashAll(unsigned int *p_i, char *dst)\\n{\\n char **p_src; // edx\\n char *v3; // ecx\\n int v5[52]; // [esp+0h] [ebp-D0h] BYREF\\n\\n Tpm20HashAllSha256(v5); /*0xffe145d1*/\\n sub_FFE153F4(v3, *p_src, *p_i); /*0xffe145dd*/\\n return Sha256FinalInternal((int)v5, dst); /*0xffe145ee*/\\n}\",\"xrefs\":{\"to\":[{\"addr\":\"0xffe15682\",\"type\":\"code\"},{\"addr\":\"0xffe156b5\",\"type\":\"code\"}],\"from\":[{\"addr\":\"0xffe145c3\",\"type\":\"code\"}]}},{\"addr\":\"0xffe145f2\",\"name\":\"Sha256RoundConstants\",\"prototype\":\"int __fastcall(int, int src)\",\"size\":\"0xd7f\",\"comments\":{},\"asm\":\"Sha256RoundConstants (.text @ 0xffe145f2):\\nffe145f2 sub esp, 314h\\nffe145f8 push ebx\\nffe145f9 push ebp\\nffe145fa push esi\\nffe145fb push edi\\nffe145fc add ecx, 8\\nffe145ff lea esi, [esp+324h+var_2CC]\\nffe14603 push 8\\nffe14605 mov ebp, edx\\nffe14607 mov [esp+328h+var_288], ecx\\nffe1460e mov edi, ecx\\nffe14610 pop ebx\\nffe14611 push 8\\nffe14613 mov edx, edi\\nffe14615 mov ecx, esi\\nffe14617 call CopyMemChecked\\nffe1461c add edi, 8\\nffe1461f add esi, 8\\nffe14622 pop ecx\\nffe14623 sub ebx, 1\\nffe14626 jnz loc_FFE14611\\nffe14628 lea edi, [ebp+2]\\nffe1462b movzx eax, byte ptr [edi-2]\\nffe1462f cdq ,\\nffe14630 mov ecx, eax\\nffe14632 mov esi, edx\\nffe14634 movzx eax, byte ptr [edi-1]\\nffe14638 shld esi, ecx, 8\\nffe1463c cdq ,\\nffe1463d shl ecx, 8\\nffe14640 or esi, edx\\nffe14642 or ecx, eax\\nffe14644 movzx eax, byte ptr [edi]\\nffe14647 shld esi, ecx, 8\\nffe1464b cdq ,\\nffe1464c lea edi, [edi+8]\\nffe1464f shl ecx, 8\\nffe14652 or esi, edx\\nffe14654 or ecx, eax\\nffe14656 movzx eax, byte ptr [edi... [35565 chars total]\",\"code\":\"int __fastcall Sha256RoundConstants(int a1, int src)\\n{\\n char *dst; // esi\\n char *src_1; // edi\\n int n8; // ebx\\n unsigned __int8 *v6; // edi\\n __int64 v7; // rt0\\n __int64 v8; // rax\\n unsigned __int64 v9; // rt0\\n int v10; // ecx\\n _BYTE *v11; // edx\\n __int64 v12; // rcx\\n unsigned int v13; // edi\\n unsigned int v14; // ebp\\n unsigned __int64 v15; // rt0\\n int v16; // edi\\n bool v17; // zf\\n int n8_1; // ebp\\n unsigned int v19; // ecx\\n unsigned int v20; // edx\\n unsigned __int64 v21; // kr28_8\\n unsigned __int64 v22; // kr58_8\\n unsigned __int64 v23; // kr88_8\\n unsigned __int64 v24; // kr90_8\\n unsigned __int64 v25; // krB0_8\\n unsigned __int64 v26; // kr00_8\\n unsigned __int64 v27; // krD0_8\\n unsigned int v28; // eax\\n unsigned __int64 v29; // kr100_8\\n unsigned int v30; // eax\\n unsigned __int64 v31; // kr130_8\\n unsigned __int64 v32; // kr08_8\\n unsigned int v33; // eax\\n unsigned __int64 v34; // kr160_8\\n unsigned __int64 v35; // kr20_8\\n unsigned __int64 v36; // kr170_8\\n ... [14483 chars total]\",\"xrefs\":{\"to\":[{\"addr\":\"0xffe1542f\",\"type\":\"code\"},{\"addr\":\"0xffe15483\",\"type\":\"code\"},{\"addr\":\"0xffe15504\",\"type\":\"code\"},{\"addr\":\"0xffe1556c\",\"type\":\"code\"}],\"from\":[{\"addr\":\"0xffe145f8\",\"type\":\"code\"}]}},{\"addr\":\"0xffe15371\",\"name\":\"Tpm20HashAllSha384\",\"prototype\":\"int __thiscall(_DWORD *this)\",\"size\":\"0x83\",\"comments\":{},\"asm\":\"Tpm20HashAllSha384 (.text @ 0xffe15371):\\nffe15371 test ecx, ecx\\nffe15373 jnz loc_FFE15379\\nffe15375 or eax, 0FFFFFFFFh\\nffe15378 retn\\nffe15379 xor eax, eax\\nffe1537b mov [ecx+48h], eax\\nffe1537e mov [ecx], eax\\nffe15380 mov [ecx+4], eax\\nffe15383 mov dword ptr [ecx+8], 0F3BCC908h\\nffe1538a mov dword ptr [ecx+0Ch], 6A09E667h\\nffe15391 mov dword ptr [ecx+10h], 84CAA73Bh\\nffe15398 mov dword ptr [ecx+14h], 0BB67AE85h\\nffe1539f mov dword ptr [ecx+18h], 0FE94F82Bh\\nffe153a6 mov dword ptr [ecx+1Ch], 3C6EF372h\\nffe153ad mov dword ptr [ecx+20h], 5F1D36F1h\\nffe153b4 mov dword ptr [ecx+24h], 0A54FF53Ah\\nffe153bb mov dword ptr [ecx+28h], 0ADE682D1h\\nffe153c2 mov dword ptr [ecx+2Ch], 510E527Fh\\nffe153c9 mov dword ptr [ecx+30h], 2B3E6C1Fh\\nffe153d0 mov dword ptr [ecx+34h], 9B05688Ch\\nffe153d7 mov dword ptr [ecx+38h], 0FB41BD6Bh\\nffe153de mov dword ptr [ecx+3Ch], 1F83D9ABh\\nffe153e5 mov dword ptr [ecx+40h], 137E2179h\\nffe153ec mov dword ptr [ecx+44h], 5BE0CD19h\\nffe153f3 retn\",\"code\":\"int __thiscall Tpm20HashAllSha384(_DWORD *this)\\n{\\n if ( !this ) /*0xffe15373*/\\n return -1; /*0xffe15375*/\\n *(this + 18) = 0; /*0xffe1537b*/\\n *this = 0; /*0xffe1537e*/\\n *(this + 1) = 0; /*0xffe15380*/\\n *(this + 2) = -205731576; /*0xffe15383*/\\n *(this + 3) = 1779033703; /*0xffe1538a*/\\n *(this + 4) = -2067093701; /*0xffe15391*/\\n *(this + 5) = -1150833019; /*0xffe15398*/\\n *(this + 6) = -23791573; /*0xffe1539f*/\\n *(this + 7) = 1013904242; /*0xffe153a6*/\\n *(this + 8) = 1595750129; /*0xffe153ad*/\\n *(this + 9) = -1521486534; /*0xffe153b4*/\\n *(this + 10) = -1377402159; /*0xffe153bb*/\\n *(this + 11) = 1359893119; /*0xffe153c2*/\\n *(this + 12) = 725511199; /*0xffe153c9*/\\n *(this + 13) = -1694144372; /*0xffe153d0*/\\n *(this + 14) = -79577749; /*0xffe153d7*/\\n *(this + 15) = 528734635; /*0xffe153de*/\\n *(this + 16) = 327033209; /*0xffe153e5*/\\n *(this + 17) = 1541459225; /*0xffe153ec*/\\n return 0; /*0xffe15378*/\\n}\",\"xrefs\":{\"to\":[{\"addr\":\"0xffe0ef3e\",\"type\":\"code\"}],\"from\":[{\"addr\":\"0xffe15373\",\"type\":\"code\"}]}},{\"addr\":\"0xffe153f4\",\"name\":\"Sha384UpdateInternal\",\"prototype\":\"int __fastcall(char *, char *src, unsigned int i)\",\"size\":\"0xb5\",\"comments\":{\"0xffe1542d\":{\"regular\":\"int\"},\"0xffe1547e\":{\"regular\":\"src\"},\"0xffe15481\":{\"regular\":\"int\"},\"0xffe15492\":{\"regular\":\"src\"}},\"asm\":\"Sha384UpdateInternal (.text @ 0xffe153f4):\\nffe153f4 push ebp\\nffe153f5 mov ebp, esp\\nffe153f7 and esp, 0FFFFFFF8h\\nffe153fa push ecx\\nffe153fb push ebx\\nffe153fc push esi\\nffe153fd mov esi, ecx\\nffe153ff mov [esp+0Ch+src], edx\\nffe15403 push edi\\nffe15404 test esi, esi\\nffe15406 jnz loc_FFE15410\\nffe15408 or eax, 0FFFFFFFFh\\nffe1540b jmp loc_FFE154A2\\nffe15410 test edx, edx\\nffe15412 jz loc_FFE15408\\nffe15414 mov ebx, 80h\\nffe15419 cmp [esi+48h], ebx\\nffe1541c ja loc_FFE15408\\nffe1541e mov edi, [ebp+i]\\nffe15421 jmp loc_FFE1549C\\nffe15423 cmp dword ptr [esi+48h], 0\\nffe15427 jnz loc_FFE1544F\\nffe15429 cmp edi, ebx\\nffe1542b jb loc_FFE1544F\\nffe1542d mov ecx, esi\\nffe1542f call Sha256RoundConstants\\nffe15434 test eax, eax\\nffe15436 jnz loc_FFE154A2\\nffe15438 add dword ptr [esi], 400h\\nffe1543e mov edx, [esp+10h+src]\\nffe15442 adc [esi+4], eax\\nffe15445 add edx, ebx\\nffe15447 mov [esp+10h+src], edx\\nffe1544b sub edi, ebx\\nffe1544d jmp loc_FFE1549C\\nffe1544f sub ebx, [esi+48h]\\nffe15452 ... [1855 chars total]\",\"code\":\"int __fastcall Sha384UpdateInternal(char *a1, char *src, unsigned int i)\\n{\\n int result; // eax\\n bool v6; // cf\\n unsigned int i_1; // ebx\\n char *srca; // [esp+Ch] [ebp-4h]\\n\\n srca = src; /*0xffe153ff*/\\n if ( !a1 || !src || *((_DWORD *)a1 + 18) > 0x80u ) /*0xffe1541c*/\\n return -1; /*0xffe15408*/\\n while ( i ) /*0xffe1549e*/\\n {\\n if ( *((_DWORD *)a1 + 18) || i < 0x80 ) /*0xffe1542b*/\\n {\\n i_1 = 128 - *((_DWORD *)a1 + 18); /*0xffe1544f*/\\n if ( i < i_1 ) /*0xffe15454*/\\n i_1 = i; /*0xffe15456*/\\n CopyMemChecked(&a1[*((_DWORD *)a1 + 18) + 76], src, i_1); /*0xffe1545f*/\\n i -= i_1; /*0xffe15468*/\\n *((_DWORD *)a1 + 18) += i_1; /*0xffe1546a*/\\n src = &srca[i_1]; /*0xffe1546d*/\\n srca += i_1; /*0xffe15474*/\\n if ( *((_DWORD *)a1 + 18) == 128 ) /*0xffe1547c*/\\n {\\n result = Sha256RoundConstants((int)a1, (int)(a1 + 76)); /*0xffe15483*/\\n if ( result ) /*0xffe1548a*/\\n return result; /*0xffe1548a*/\\n v6 = __CFADD__(... [1682 chars total]\",\"xrefs\":{\"to\":[{\"addr\":\"0xffe0eff7\",\"type\":\"code\"},{\"addr\":\"0xffe145dd\",\"type\":\"code\"}],\"from\":[{\"addr\":\"0xffe153f5\",\"type\":\"code\"}]}},{\"addr\":\"0xffe154a9\",\"name\":\"Sha384FinalInternal\",\"prototype\":\"int __fastcall(int, int)\",\"size\":\"0x111\",\"comments\":{\"0xffe154ff\":{\"regular\":\"src\"},\"0xffe15502\":{\"regular\":\"int\"},\"0xffe15523\":{\"regular\":\"src\"},\"0xffe1552c\":{\"regular\":\"int\"}},\"asm\":\"Sha384FinalInternal (.text @ 0xffe154a9):\\nffe154a9 push ebp\\nffe154aa mov ebp, esp\\nffe154ac and esp, 0FFFFFFF8h\\nffe154af push ebx\\nffe154b0 push ebp\\nffe154b1 push esi\\nffe154b2 mov esi, ecx\\nffe154b4 push edi\\nffe154b5 mov edi, edx\\nffe154b7 test esi, esi\\nffe154b9 jnz loc_FFE154C3\\nffe154bb or eax, 0FFFFFFFFh\\nffe154be jmp loc_FFE155B2\\nffe154c3 test edi, edi\\nffe154c5 jz loc_FFE154BB\\nffe154c7 mov ecx, [esi+48h]\\nffe154ca mov ebx, 80h\\nffe154cf cmp ecx, ebx\\nffe154d1 jnb loc_FFE154BB\\nffe154d3 push 8\\nffe154d5 mov eax, ecx\\nffe154d7 pop ebp\\nffe154d8 mul , ebp\\nffe154da add [esi], eax\\nffe154dc adc [esi+4], edx\\nffe154df mov [ecx+esi+4Ch], bl\\nffe154e3 inc dword ptr [esi+48h]\\nffe154e6 mov eax, [esi+48h]\\nffe154e9 cmp eax, 70h\\nffe154ec jbe loc_FFE1551A\\nffe154ee jmp loc_FFE154FB\\nffe154f0 mov byte ptr [esi+eax+4Ch], 0\\nffe154f5 inc dword ptr [esi+48h]\\nffe154f8 mov eax, [esi+48h]\\nffe154fb cmp eax, ebx\\nffe154fd jb loc_FFE154F0\\nffe154ff lea edx, [esi+4Ch]\\nffe15502 mov ecx, esi... [2524 chars total]\",\"code\":\"int __fastcall Sha384FinalInternal(int a1, int a2)\\n{\\n unsigned int n0x80; // ecx\\n unsigned int n0x80_1; // eax\\n _BYTE *v7; // ecx\\n _BYTE *v8; // esi\\n int n8; // edx\\n char v10; // al\\n\\n if ( !a1 ) /*0xffe154b9*/\\n return -1; /*0xffe154b9*/\\n if ( !a2 ) /*0xffe154c5*/\\n return -1; /*0xffe154c5*/\\n n0x80 = *(_DWORD *)(a1 + 72); /*0xffe154c7*/\\n if ( n0x80 >= 0x80 ) /*0xffe154d1*/\\n return -1; /*0xffe154bb*/\\n *(_QWORD *)a1 += 8LL * n0x80; /*0xffe154da*/\\n *(_BYTE *)(n0x80 + a1 + 76) = 0x80; /*0xffe154df*/\\n n0x80_1 = ++*(_DWORD *)(a1 + 72); /*0xffe154e6*/\\n if ( n0x80_1 > 0x70 ) /*0xffe154ec*/\\n {\\n while ( n0x80_1 < 0x80 ) /*0xffe154fd*/\\n {\\n *(_BYTE *)(a1 + n0x80_1 + 76) = 0; /*0xffe154f0*/\\n n0x80_1 = ++*(_DWORD *)(a1 + 72); /*0xffe154f8*/\\n }\\n Sha256RoundConstants(a1, a1 + 76); /*0xffe15504*/\\n *(_DWORD *)(a1 + 72) = 0; /*0xffe15509*/\\n }\\n while ( *(_DWORD *)(a1 + 72) < 0x78u ) /*0xffe1551e*/\\n {\\n *(_BYTE *)(*(_DWORD *)(a1 + 72) + a1 + 76) = 0; /*0x... [2190 chars total]\",\"xrefs\":{\"to\":[{\"addr\":\"0xffe0f105\",\"type\":\"code\"},{\"addr\":\"0xffe145a9\",\"type\":\"code\"}],\"from\":[{\"addr\":\"0xffe154aa\",\"type\":\"code\"}]}},{\"addr\":\"0xffe155ba\",\"name\":\"Tpm20GetHashFromDigest\",\"prototype\":\"void __usercall(_BYTE *@<edx>, unsigned int, int)\",\"size\":\"0x37\",\"comments\":{},\"asm\":\"Tpm20GetHashFromDigest (.text @ 0xffe155ba):\\nffe155ba mov ecx, [esp+arg_0]\\nffe155be push esi\\nffe155bf mov esi, [esp+4+arg_4]\\nffe155c3 cmp ecx, edx\\nffe155c5 jnb loc_FFE155DE\\nffe155c7 dec edx\\nffe155c8 dec ecx\\nffe155c9 add edx, esi\\nffe155cb add ecx, esi\\nffe155cd test esi, esi\\nffe155cf jz loc_FFE155EF\\nffe155d1 mov al, [ecx]\\nffe155d3 mov [edx], al\\nffe155d5 dec edx\\nffe155d6 dec ecx\\nffe155d7 sub esi, 1\\nffe155da jnz loc_FFE155D1\\nffe155dc pop esi\\nffe155dd retn\\nffe155de test esi, esi\\nffe155e0 jz loc_FFE155EF\\nffe155e2 sub ecx, edx\\nffe155e4 mov al, [ecx+edx]\\nffe155e7 mov [edx], al\\nffe155e9 inc edx\\nffe155ea sub esi, 1\\nffe155ed jnz loc_FFE155E4\\nffe155ef pop esi\\nffe155f0 retn\",\"code\":\"void __usercall Tpm20GetHashFromDigest(_BYTE *a1@<edx>, unsigned int a2, int a3)\\n{\\n int v3; // esi\\n _BYTE *v4; // edx\\n _BYTE *v5; // ecx\\n unsigned int v6; // ecx\\n\\n v3 = a3; /*0xffe155bf*/\\n if ( a2 >= (unsigned int)a1 ) /*0xffe155c5*/\\n {\\n if ( a3 ) /*0xffe155e0*/\\n {\\n v6 = a2 - (_DWORD)a1; /*0xffe155e2*/\\n do /*0xffe155ed*/\\n {\\n *a1 = a1[v6]; /*0xffe155e7*/\\n ++a1; /*0xffe155e9*/\\n --v3; /*0xffe155ea*/\\n }\\n while ( v3 ); /*0xffe155ed*/\\n }\\n }\\n else\\n {\\n v4 = &a1[a3 - 1]; /*0xffe155c9*/\\n v5 = (_BYTE *)(a3 + a2 - 1); /*0xffe155cb*/\\n if ( a3 ) /*0xffe155cf*/\\n {\\n do /*0xffe155da*/\\n {\\n *v4-- = *v5--; /*0xffe155d3*/\\n --v3; /*0xffe155d7*/\\n }\\n while ( v3 ); /*0xffe155da*/\\n }\\n }\\n}\",\"xrefs\":{\"to\":[{\"addr\":\"0xffe0e88a\",\"type\":\"code\"},{\"addr\":\"0xffe0f8c4\",\"type\":\"code\"},{\"addr\":\"0xffe1561b\",\"type\":\"code\"},{\"addr\":\"0xffe1565d\",\"type\":\"code\"},{\"addr\":\"0xffe15690\",\"type\":\"code\"},{\"addr\":\"0xffe156c3\",\"type\":\"code\"}],\"from\":[{\"addr\":\"0xffe155be\",\"type\":\"code\"}]}},{\"addr\":\"0xffe155f1\",\"name\":\"Tpm20CopyDigest\",\"prototype\":\"int __cdecl(unsigned int i, _BYTE *)\",\"size\":\"0x38\",\"comments\":{\"0xffe155ff\":{\"regular\":\"i\"},\"0xffe15607\":{\"regular\":\"buf\"},\"0xffe1560a\":{\"regular\":\"dst\"}},\"asm\":\"Tpm20CopyDigest (.text @ 0xffe155f1):\\nffe155f1 push ebp\\nffe155f2 mov ebp, esp\\nffe155f4 sub esp, 70h\\nffe155f7 lea ecx, [ebp+buf]\\nffe155fa call Sha1Init\\nffe155ff push [ebp+i]\\nffe15602 call Sha1Update\\nffe15607 lea edx, [ebp+buf]\\nffe1560a lea ecx, [ebp+dst]\\nffe1560d call Sha1Final\\nffe15612 mov edx, [ebp+arg_4]\\nffe15615 lea eax, [ebp+dst]\\nffe15618 push 14h\\nffe1561a push eax\\nffe1561b call Tpm20GetHashFromDigest\\nffe15620 add esp, 0Ch\\nffe15623 xor eax, eax\\nffe15625 mov esp, ebp\\nffe15627 pop ebp\\nffe15628 retn\",\"code\":\"int __cdecl Tpm20CopyDigest(unsigned int i, _BYTE *a2)\\n{\\n char *src; // edx\\n int buf_1; // ecx\\n _DWORD buf[23]; // [esp+0h] [ebp-70h] BYREF\\n char dst[20]; // [esp+5Ch] [ebp-14h] BYREF\\n\\n Sha1Init(buf); /*0xffe155fa*/\\n Sha1Update(buf_1, src, i); /*0xffe15602*/\\n Sha1Final(dst, buf); /*0xffe1560d*/\\n Tpm20GetHashFromDigest(a2, (unsigned int)dst, 20); /*0xffe1561b*/\\n return 0; /*0xffe15625*/\\n}\",\"xrefs\":{\"to\":[{\"addr\":\"0xffe0e2c4\",\"type\":\"code\"},{\"addr\":\"0xffe0fb3f\",\"type\":\"code\"}],\"from\":[{\"addr\":\"0xffe155f2\",\"type\":\"code\"}]}}]}"}, {"type": "text", "text": "Output truncated. Run: curl -o .ida-mcp/f2225352-6edc-4364-a17e-941ed58ebe2d.json http://127.0.0.1:13375/output/f2225352-6edc-4364-a17e-941ed58ebe2d.json"}], "isError": false, "_meta": {"ida_mcp": {"output_truncated": true, "total_chars": 117105, "output_id": "f2225352-6edc-4364-a17e-941ed58ebe2d", "download_url": "http://127.0.0.1:13375/output/f2225352-6edc-4364-a17e-941ed58ebe2d.json", "download_hint": "Output truncated. Run: curl -o .ida-mcp/f2225352-6edc-4364-a17e-941ed58ebe2d.json http://127.0.0.1:13375/output/f2225352-6edc-4364-a17e-941ed58ebe2d.json"}}}, "id": 1}
Ajax Dong