joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414070
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24c
xor eax, eax
push ebx
push esi
push edi
mov byte [esp + 0x24], 0
mov ecx, 0xc
lea edi, [esp + 0x25]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
xor eax, eax
mov dword [esp + 0x11], eax
mov dword [esp + 0x15], eax
mov dword [esp + 0x19], eax
mov dword [esp + 0x1d], eax
mov word [esp + 0x21], ax
mov esi, dword [ebp + 8]
mov byte [esp + 0x158], al
mov byte [esp + 0x23], al
mov ecx, 0x3f
lea edi, [esp + 0x159]
mov byte [esp + 0x58], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov ecx, 0x3f
lea edi, [esp + 0x59]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x3f0
stosb byte es:[edi], al
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push esi
mov byte [esp + 0x18], 0
call edi
mov ebx, dword [sym.imp.USER32.dll_GetWindowTextA]
push 0x32
lea ecx, [esp + 0x28]
push ecx
push eax
call ebx
push 0x3fa
push esi
call edi
push 0x14
lea edx, [esp + 0x14]
push edx
push eax
call ebx
push 0x3f4
push esi
call edi
push 0x100
lea ecx, [esp + 0x15c]
push ecx
push eax
call ebx
push 0x3f5
push esi
call edi
push 0x100
lea edx, [esp + 0x5c]
push edx
push eax
call ebx
push 0x3fd
push esi
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
lea ecx, [esp + 0x24]
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x414152
sub ecx, esi
mov dword [esp + 0xc], ecx
je 0x41423d
lea ecx, [esp + 0x10]
lea esi, [ecx + 1]
lea esp, [esp]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x414170
sub ecx, esi
mov dword [esp + 0xc], ecx
je 0x41423d
lea ecx, [esp + 0x158]
lea esi, [ecx + 1]
lea ecx, [ecx]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x414190
sub ecx, esi
mov dword [esp + 0xc], ecx
je 0x41423d
lea ecx, [esp + 0x58]
lea esi, [ecx + 1]
lea ebx, [ebx]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x4141b0
sub ecx, esi
mov dword [esp + 0xc], ecx
je 0x41423d
cmp eax, 1
jne 0x4141de
push eax
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x160]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x34]
push eax
jmp 0x4141fa
test eax, eax
jne 0x414202
push eax
lea ecx, [esp + 0x5c]
push ecx
lea edx, [esp + 0x160]
push edx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x34]
push ecx
call fcn.00413b90
add esp, 0x14
mov ecx, 0x20
xor eax, eax
mov edi, 0x4d3ed0
rep stosd dword es:[edi], eax
mov cl, byte [esp + eax + 0x24]
mov byte [eax + 0x4d3ed0], cl
inc eax
test cl, cl
jne 0x414210
lea edx, [esp + 0x10]
push edx
call fcn.0044e1d6
mov dword [0x49f060], eax
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push str.error
push 0x47e444
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4152a0
Capabilities:
Create thread
Terminate process

Disassembly:
sub esp, 0x404
push ebx
mov ebx, ecx
call fcn.0041c310
test eax, eax
je 0x4152cb
push str.Cannot_setup_thread_mutex_n
push 0x4a8380
call fcn.0044dcce
add esp, 8
push 1
call fcn.0044ede9
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push edi
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0x411c30
push 0
push 0
call esi
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
jne 0x41530f
lea ecx, [esp + 0x10]
push str.SSLTray:_Create_ThreadCMD_failed.
push ecx
call fcn.0044dd9b
lea edx, [esp + 0x18]
push edx
call fcn.00402a90
add esp, 0xc
jmp 0x415312
push eax
call edi
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0x412dd0
push 0
push 0
call esi
test eax, eax
jne 0x415357
lea ecx, [esp + 0x10]
push str.SSLTray:_Create_ThreadTCP_failed.
push ecx
call fcn.0044dd9b
lea edx, [esp + 0x18]
push edx
call fcn.00402a90
add esp, 0xc
mov ecx, ebx
call fcn.00415180
pop edi
pop esi
pop ebx
add esp, 0x404
ret
push eax
call edi
mov ecx, ebx
call fcn.00415180
pop edi
pop esi
pop ebx
add esp, 0x404
ret
Function at 0x415930
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc04
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push ebx
lea eax, [esp + 0x814]
push str.SSLTray:_client_socket_is__d.
push eax
call fcn.0044dd9b
lea ecx, [esp + 0x81c]
push ecx
call fcn.00402a90
add esp, 0x10
xor eax, eax
push eax
push 0x400
mov ecx, 0x100
lea edi, [esp + 0x18]
lea edx, [esp + 0x18]
rep stosd dword es:[edi], eax
mov eax, dword [ebx]
push edx
push eax
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
cmp esi, 0xffffffff
je 0x4159d7
lea ecx, [ecx]
test esi, esi
je 0x4159d7
push esi
mov esi, dword [ebp + 0xc]
mov edx, dword [esi + 4]
lea ecx, [esp + 0x14]
push ecx
push edx
call fcn.0041b4c0
add esp, 0xc
test eax, eax
jne 0x415a56
push eax
mov ecx, 0x100
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
mov ecx, dword [ebx]
push 0x400
lea eax, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
cmp esi, 0xffffffff
jne 0x415990
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push esi
lea eax, [esp + 0x418]
push str.SSLTray:_tcp_c__s_read_failed__d__d_.
push eax
call fcn.0044dd9b
lea ecx, [esp + 0x420]
push ecx
call fcn.00402a90
mov eax, dword [ebx]
add esp, 0x14
push 4
lea edx, [esp + 0x10]
push edx
push 0x80
push 0xffff
push eax
mov word [esp + 0x20], 1
mov word [esp + 0x22], 0
call dword [sym.imp.WS2_32.dll_setsockopt]
mov ecx, dword [ebx]
push 2
push ecx
call dword [sym.imp.WS2_32.dll_shutdown]
mov edx, dword [ebx]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, dword [ebp + 0xc]
push eax
mov dword [ebx], 0xffffffff
call fcn.0041bb80
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
lea edx, [esp + 0x414]
push str.SSLTray:_tcp_c__s_write_failed__d
push edx
call fcn.0044dd9b
lea eax, [esp + 0x41c]
push eax
call fcn.00402a90
mov ecx, dword [ebx]
add esp, 0x10
push 2
push ecx
call dword [sym.imp.WS2_32.dll_shutdown]
mov edx, dword [ebx]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
push esi
jmp 0x415a41
Function at 0x415b90
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47e7a0
push 0x44e7f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, 0x2408
call fcn.0044e0a0
push ebx
push esi
push edi
mov dword [ebp - 0x1c], 0
jmp 0x415bd0
mov dword [ebp - 4], 0
or ebx, 0xffffffff
mov dword [ebp - 0x1c], ebx
push 0
push 0x1000
lea eax, [ebp - 0x1020]
push eax
mov edi, dword [ebp + 8]
mov ecx, dword [edi]
push ecx
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], ebx
call fcn.00415cac
cmp esi, 0xffffffff
je 0x415cba
test esi, esi
je 0x415cba
mov dword [ebp - 0x20], 0x1400
lea edx, [ebp - 0x20]
push edx
lea eax, [ebp - 0x2420]
push eax
push esi
lea ecx, [ebp - 0x1020]
push ecx
call fcn.004155e0
push 4
call fcn.0044dffd
mov esi, eax
push esi
mov ebx, dword [ebp - 0x20]
push ebx
call fcn.0041bb20
push 4
push esi
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 4]
push eax
call fcn.0041b4c0
mov edi, eax
push esi
call fcn.0044dee5
add esp, 0x2c
test edi, edi
jne 0x415c87
push ebx
lea ecx, [ebp - 0x2420]
push ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 4]
push eax
call fcn.0041b4c0
add esp, 0xc
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x415bd0
push 2
mov esi, dword [ebp + 8]
mov ecx, dword [esi]
push ecx
call dword [sym.imp.WS2_32.dll_shutdown]
mov edx, dword [esi]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi], 0xffffffff
jmp 0x415cd4
push 2
mov ecx, dword [edi]
push ecx
call dword [sym.imp.WS2_32.dll_shutdown]
mov edx, dword [edi]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [edi], 0xffffffff
mov eax, dword [ebp + 0xc]
push eax
call fcn.0041bb80
add esp, 4
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x415eb0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47e868
push 0x44e7f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x410
push ebx
push esi
push edi
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0x400
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
lea ebx, [ebx]
mov ecx, 0x100
xor eax, eax
lea edi, [ebp - 0x420]
rep stosd dword es:[edi], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], 0xffffffff
push eax
mov eax, dword [ebp - 0x20]
push eax
lea ecx, [ebp - 0x420]
push ecx
mov edx, dword [esi]
push edx
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
mov dword [ebp - 0x1c], edi
mov dword [ebp - 4], 0xffffffff
call fcn.00415f99
test edi, edi
jg 0x415fa7
push str.tcp_failed_0
call fcn.00402a90
add esp, 4
push 2
mov eax, dword [ebx]
push eax
mov edi, dword [sym.imp.WS2_32.dll_shutdown]
call edi
mov ecx, dword [ebx]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [ebx], 0xffffffff
push 2
mov edx, dword [esi]
push edx
call edi
mov eax, dword [esi]
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi], 0xffffffff
push str.tcp_failed_01
call fcn.00402a90
add esp, 4
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
lea ecx, [ebp - 0x420]
push ecx
mov edx, dword [ebx]
push edx
call fcn.0041b340
add esp, 0xc
test eax, eax
je 0x415ef0
push str.tcp_failed_1
call fcn.00402a90
add esp, 4
push 2
mov eax, dword [ebx]
push eax
mov edi, dword [sym.imp.WS2_32.dll_shutdown]
call edi
mov ecx, dword [ebx]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [ebx], 0xffffffff
push 2
mov edx, dword [esi]
push edx
call edi
mov eax, dword [esi]
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x416020
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47e8c8
push 0x44e7f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x410
push ebx
push esi
push edi
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0x400
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
lea ebx, [ebx]
mov ecx, 0x100
xor eax, eax
lea edi, [ebp - 0x420]
rep stosd dword es:[edi], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], 0xffffffff
push eax
mov eax, dword [ebp - 0x20]
push eax
lea ecx, [ebp - 0x420]
push ecx
mov edx, dword [esi]
push edx
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
mov dword [ebp - 0x1c], edi
mov dword [ebp - 4], 0xffffffff
call fcn.00416123
cmp edi, 0xffffffff
je 0x416131
test edi, edi
je 0x416131
push edi
lea eax, [ebp - 0x420]
push eax
mov ecx, dword [ebx]
push ecx
call fcn.0041b340
add esp, 0xc
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x416060
push str.tcp_failed_3
call fcn.00402a90
add esp, 4
push 2
mov edx, dword [esi]
push edx
mov edi, dword [sym.imp.WS2_32.dll_shutdown]
call edi
mov eax, dword [esi]
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi], 0xffffffff
push 2
mov ecx, dword [ebx]
push ecx
call edi
mov edx, dword [ebx]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [ebx], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.tcp_failed_2
call fcn.00402a90
add esp, 4
push 2
mov eax, dword [esi]
push eax
mov edi, dword [sym.imp.WS2_32.dll_shutdown]
call edi
mov ecx, dword [esi]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi], 0xffffffff
push 2
mov edx, dword [ebx]
push edx
call edi
mov eax, dword [ebx]
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [ebx], 0xffffffff
push str.tcp_failed_21
call fcn.00402a90
add esp, 4
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x416da0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x50c
push edi
mov byte [esp + 8], 0
xor eax, eax
mov ecx, 0x40
lea edi, [esp + 9]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetVersion]
and eax, 0xff
cmp eax, 5
mov eax, str.Global
jae 0x416ddc
mov eax, 0x47a7a9
push str.TdiRdrFilter
push eax
lea eax, [esp + 0x10]
push str.._s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x416e63
mov byte [esp + 0x110], 0
xor eax, eax
mov ecx, 0xff
lea edi, [esp + 0x111]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x118]
push str.SSLTray:_Driver_open___s__failed_with_error__d
push eax
call fcn.0044dd9b
lea ecx, [esp + 0x120]
push ecx
call fcn.00402a90
add esp, 0x14
or eax, 0xffffffff
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x417d00
Capabilities:
Check if file exists
Create service
Get common file path
Get file attributes
Get program files directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x610
push esi
push edi
push 0
push 0x26
lea eax, [esp + 0x518]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push str.XEngine.sys
lea ecx, [esp + 0x514]
push ecx
lea edx, [esp + 0x10]
push str._sSAG_s
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x417d9c
mov byte [esp + 0x110], 0
xor eax, eax
mov ecx, 0xff
lea edi, [esp + 0x111]
rep stosd dword es:[edi], eax
lea ecx, [esp + 8]
push ecx
stosw word es:[edi], ax
lea edx, [esp + 0x114]
push str.SSLTray:_TDI_file__s_not_exits.
push edx
stosb byte es:[edi], al
call fcn.0044dd9b
lea eax, [esp + 0x11c]
push eax
call fcn.00402a90
add esp, 0x10
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
test esi, esi
jne 0x417dfa
mov byte [esp + 0x110], al
mov ecx, 0xff
lea edi, [esp + 0x111]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [esp + 0x114]
push str.SSLTray:_TdiInstall_open_SCManager_failed_with_error__d
push ecx
call fcn.0044dd9b
lea edx, [esp + 0x11c]
push edx
call fcn.00402a90
add esp, 0x10
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x1c]
push eax
push 1
push 3
push 1
push 0xf01ff
push ecx
push str.XEngine
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
test eax, eax
jne 0x417e78
mov byte [esp + 0x110], al
mov ecx, 0xff
lea edi, [esp + 0x111]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [esp + 0x114]
push str.SSLTray:_DriverServiceInstall_create_service_failed_with_error__d
push edx
call fcn.0044dd9b
lea eax, [esp + 0x11c]
push eax
call fcn.00402a90
add esp, 0x10
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push eax
call edi
push esi
call edi
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x417e90
Capabilities:
Check if file exists
Get common file path
Get file attributes
Get program files directory
Modify service

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x614
push ebx
push esi
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
test ebx, ebx
jne 0x417ed7
mov byte [esp + 0x10], al
mov ecx, 0xff
lea edi, [esp + 0x11]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SSLTray:_Tdi_Update_open_SCManager_failed_with_error__d
jmp 0x417f9f
push 0xf01ff
push str.XEngine
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x417f33
mov byte [esp + 0x10], al
mov ecx, 0xff
lea edi, [esp + 0x11]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [esp + 0x14]
push str.SSLTray:_Tdi_Update_open_service_failed_with_error__d
push edx
call fcn.0044dd9b
lea eax, [esp + 0x1c]
push eax
call fcn.00402a90
add esp, 0x10
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0x26
lea ecx, [esp + 0x520]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push str.XEngine.sys
lea edx, [esp + 0x51c]
push edx
lea eax, [esp + 0x418]
push str._sSAG_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea ecx, [esp + 0x410]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x417fbf
mov byte [esp + 0x10], 0
xor eax, eax
mov ecx, 0xff
lea edi, [esp + 0x11]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [esp + 0x410]
push edx
stosb byte es:[edi], al
push str.SSLTray:_TDI_file__s_not_exits.
lea eax, [esp + 0x18]
push eax
call fcn.0044dd9b
lea ecx, [esp + 0x1c]
push ecx
call fcn.00402a90
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
push edx
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x428]
push eax
push 1
push 3
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
test eax, eax
jne 0x418030
mov byte [esp + 0x10], al
mov ecx, 0xff
lea edi, [esp + 0x11]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [esp + 0x14]
push str.SSLTray:_ChangeServiceConfig_failed_with_error__d
push ecx
call fcn.0044dd9b
lea edx, [esp + 0x1c]
push edx
call fcn.00402a90
add esp, 0x10
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebx
call esi
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebx
call esi
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x418120
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x408
push ebx
push ebp
push esi
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
test ebx, ebx
mov dword [esp + 0x14], ebx
jne 0x418188
mov byte [esp + 0x18], al
mov ecx, 0xff
lea edi, [esp + 0x19]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x1c]
push str.SSLTray:_TdiStart_open_SCManager_failed_with_error__d
push eax
call fcn.0044dd9b
lea ecx, [esp + 0x24]
push ecx
call fcn.00402a90
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push 0xf01ff
push str.XEngine
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebp, eax
test ebp, ebp
jne 0x4181e5
mov byte [esp + 0x18], al
mov ecx, 0xff
lea edi, [esp + 0x19]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [esp + 0x1c]
push str.SSLTray:_DriverServiceStart_open_service_failed_with_error__d
push edx
call fcn.0044dd9b
lea eax, [esp + 0x24]
push eax
call fcn.00402a90
add esp, 0x10
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push ebp
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x418295
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0x420
je 0x418295
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, 3
push 0
push 0
push ebp
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x418241
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0x420
je 0x418241
push 0x64
dec edi
call ebx
test edi, edi
jg 0x418217
jmp 0x418245
test edi, edi
jg 0x418291
mov byte [esp + 0x18], 0
xor eax, eax
mov ecx, 0xff
lea edi, [esp + 0x19]
rep stosd dword es:[edi], eax
push esi
stosw word es:[edi], ax
lea ecx, [esp + 0x1c]
push str.SSLTray:_DriverServiceStart_start_service_failed_with_error__d.
push ecx
stosb byte es:[edi], al
call fcn.0044dd9b
lea edx, [esp + 0x24]
push edx
call fcn.00402a90
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
add esp, 0x10
push ebp
call esi
mov eax, dword [esp + 0x14]
push eax
call esi
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [esp + 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebp
call esi
push ebx
call esi
pop edi
mov eax, 1
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4182b0
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x420
xor eax, eax
mov dword [esp + 1], eax
mov dword [esp + 5], eax
mov dword [esp + 9], eax
mov dword [esp + 0xd], eax
mov dword [esp + 0x11], eax
mov dword [esp + 0x15], eax
push esi
mov dword [esp + 0x1d], eax
lea ecx, [esp + 4]
push edi
mov word [esp + 0x25], ax
push ecx
mov byte [esp + 0xc], 0
mov byte [esp + 0x2b], al
call fcn.00417b20
add esp, 4
test eax, eax
jne 0x418310
push str.XEngine_get_version_failed.
call fcn.00402a90
add esp, 4
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp + 8]
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x418318
sub eax, edx
mov ecx, eax
lea esi, [esp + 8]
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x418345
push str.XEngine_verify_version_and_need_update.
call fcn.00402a90
add esp, 4
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov byte [esp + 0x28], 0
mov ecx, 0x7f
lea edi, [esp + 0x29]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0
stosb byte es:[edi], al
push 0x26
lea eax, [esp + 0x230]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [esp + 0x228]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x418377
lea edi, [esp + 0x28]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x418385
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x28]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4183a2
mov ecx, dword [str.SAGXEngine.sys]
mov edx, dword [0x47f444]
mov eax, dword [0x47f448]
mov dword [edi], ecx
mov ecx, dword [0x47f44c]
mov dword [edi + 4], edx
mov dl, byte [0x47f450]
mov dword [edi + 8], eax
lea eax, [esp + 0x28]
mov dword [edi + 0xc], ecx
push 0x47a858
push eax
mov byte [edi + 0x10], dl
call fcn.0044dd88
mov esi, eax
add esp, 8
test esi, esi
je 0x41843d
push 2
push 0
push esi
call fcn.0044e4f6
push esi
call fcn.0044e426
push esi
mov edi, eax
call fcn.0044dc7d
mov eax, dword [ebp + 0xc]
add esp, 0x14
cmp edi, eax
je 0x418427
push str.XEngine_verify_length_and_need_update.
call fcn.00402a90
add esp, 4
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push str.XEngine_need_not_update.
call fcn.00402a90
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push str.XEngine_verify_file_exist_and_need_update.
call fcn.00402a90
add esp, 4
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41b300
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x41b331
push eax
push str.WSAStartup_failed_with_error__d
call fcn.0044ee3f
add esp, 8
or eax, 0xffffffff
add esp, 0x190
ret
xor eax, eax
add esp, 0x190
ret