joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000b070
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x764
mov eax, dword [0x101c1b88]
xor eax, esp
mov dword [esp + 0x760], eax
push ebx
push esi
xor ebx, ebx
push 0x103
lea eax, [esp + 0x269]
push ebx
push eax
mov byte [esp + 0x270], bl
call fcn.1011e8d0
push 0x103
lea ecx, [esp + 0x6d]
push ebx
push ecx
mov byte [esp + 0x74], bl
call fcn.1011e8d0
push 0x103
lea edx, [esp + 0x17d]
push ebx
push edx
mov byte [esp + 0x184], bl
call fcn.1011e8d0
push 0x3ff
lea eax, [esp + 0x391]
push ebx
push eax
mov byte [esp + 0x398], bl
call fcn.1011e8d0
push 0x40
lea ecx, [esp + 0x50]
push ebx
push ecx
mov dword [esp + 0x54], ebx
call fcn.1011e8d0
xor eax, eax
lea edx, [esp + 0x2a0]
push 0x104
push edx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
call fcn.10155740
mov ecx, dword [0x101d8f3c]
add esp, 0x44
lea eax, [esp + 0x160]
push eax
push ecx
call fcn.1014cb40
mov eax, dword [0x101d8f3c]
lea edx, [esp + 0x64]
push edx
push eax
call fcn.1014cb40
lea eax, [esp + 0x6c]
add esp, 0x10
add eax, 0xffffffff
mov cl, byte [eax + 1]
add eax, 1
cmp cl, bl
jne 0x1000b150
mov ecx, dword [str.IsaDriver.dll]
mov edx, dword [0x101a99d8]
mov dword [eax], ecx
mov ecx, dword [0x101a99dc]
mov dword [eax + 4], edx
mov dx, word [0x101a99e0]
mov dword [eax + 8], ecx
mov cl, byte [0x101a99e2]
mov word [eax + 0xc], dx
mov byte [eax + 0xe], cl
lea edx, [esp + 0x5c]
push edx
lea eax, [esp + 0x268]
push eax
lea ecx, [esp + 0x370]
push str._sRundll32.exe___s__Rundll32_UpdateDriverFile
push ecx
call fcn.1011a63e
add esp, 0x10
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x168]
push ecx
push ebx
push 0x8000020
push ebx
push ebx
push ebx
lea edx, [esp + 0x388]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esi, eax
cmp esi, ebx
je 0x1000b22b
push edi
push str._IsaDriver__Start_to_Update_All_Driver_File...
push 0xac
push str.UpdateDriverFile
push str..If_Driver.c
push 3
call fcn.1014edc0
push str._IsaDriver__Start_to_Update_All_Driver_File...
push 0xac
push str.UpdateDriverFile
push str..If_Driver.c
push 3
call fcn.1014f750
mov eax, dword [esp + 0x34]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x28
push eax
call edi
mov ecx, dword [esp + 0x10]
push ecx
call edi
pop edi
jmp 0x1000b264
push str._IsaDriver__Start_to_Update_All_Driver_File...
push 0xb3
push str.UpdateDriverFile
push str..If_Driver.c
push 1
call fcn.1014edc0
push str._IsaDriver__Start_to_Update_All_Driver_File...
push 0xb3
push str.UpdateDriverFile
push str..If_Driver.c
push 1
call fcn.1014f750
add esp, 0x28
mov ecx, dword [esp + 0x768]
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.1011a380
add esp, 0x764
ret
Function at 0x1000ba00
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x404
mov eax, dword [0x101c1b88]
xor eax, esp
mov dword [esp + 0x400], eax
push esi
push edi
push 0x3ff
lea eax, [esp + 0xd]
push 0
push eax
mov edi, ecx
mov byte [esp + 0x14], 0
call fcn.1011e8d0
add esp, 0xc
test edi, edi
je 0x1000bbc6
test ebx, ebx
je 0x1000bbc6
cmp byte [edi], 0
jne 0x1000baa5
push 1
push str.lpSrvPath__d_
push 0x3bb
push str.FtpGetFileSizes
push str..If_FileTransfer.c
push 1
call fcn.1014edc0
xor ecx, ecx
cmp byte [edi], cl
sete cl
push ecx
push str.lpSrvPath__d_
push 0x3bb
push str.FtpGetFileSizes
push str..If_FileTransfer.c
push 1
call fcn.1014f750
add esp, 0x30
pop edi
mov eax, 0xfffffffb
pop esi
mov ecx, dword [esp + 0x400]
xor ecx, esp
call fcn.1011a380
add esp, 0x404
ret
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
mov ecx, dword [0x101d93b8]
mov edx, eax
sub edx, ecx
cmp edx, 0xea60
jae 0x1000bae1
cmp eax, ecx
jbe 0x1000bae1
pop ebp
pop edi
mov eax, 0xfffffff6
pop esi
mov ecx, dword [esp + 0x400]
xor ecx, esp
call fcn.1011a380
add esp, 0x404
ret
push edi
lea esi, [esp + 0x10]
call fcn.1000b480
mov esi, eax
add esp, 4
test esi, esi
jge 0x1000bb49
push edi
push str._GetFile_
push 0x3c8
push str.FtpGetFileSizes
push str..If_FileTransfer.c
push 1
call fcn.1014edc0
push edi
push str._GetFile_
push 0x3c8
push str.FtpGetFileSizes
push str..If_FileTransfer.c
push 1
call fcn.1014f750
add esp, 0x30
pop ebp
pop edi
mov eax, esi
pop esi
mov ecx, dword [esp + 0x400]
xor ecx, esp
call fcn.1011a380
add esp, 0x404
ret
push ebx
push str.infogoftpuser
push str.infogoftpuser
lea eax, [esp + 0x18]
push eax
call fcn.10147030
mov esi, eax
cmp esi, 0xffffffff
jne 0x1000bb7c
push ebx
push str.infogoftp
push str.infogoftp
lea ecx, [esp + 0x18]
push ecx
call fcn.10147030
mov esi, eax
cmp esi, 0xfffffff6
jne 0x1000bb2f
push str._GetFile__FTP
push 0x3d3
push str.FtpGetFileSizes
push str..If_FileTransfer.c
push 1
call fcn.1014edc0
push str._GetFile__FTP
push 0x3d3
push str.FtpGetFileSizes
push str..If_FileTransfer.c
push 1
call fcn.1014f750
add esp, 0x28
call ebp
mov dword [0x101d93b8], eax
jmp 0x1000bb2f
xor edx, edx
test ebx, ebx
sete dl
xor eax, eax
test edi, edi
sete al
mov esi, edx
push esi
mov edi, eax
push edi
push str.lpSrvPath__d___pdwFileSize__d_
push 0x3b5
push str.FtpGetFileSizes
push str..If_FileTransfer.c
push 1
call fcn.1014edc0
push esi
push edi
push str.lpSrvPath__d___pdwFileSize__d_
push 0x3b5
push str.FtpGetFileSizes
push str..If_FileTransfer.c
push 1
call fcn.1014f750
mov ecx, dword [esp + 0x440]
add esp, 0x38
pop edi
pop esi
xor ecx, esp
mov eax, 0xfffffffb
call fcn.1011a380
add esp, 0x404
ret
Function at 0x1000bc40
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x404
mov eax, dword [0x101c1b88]
xor eax, esp
mov dword [esp + 0x400], eax
push esi
push edi
push 0x3ff
lea eax, [esp + 0xd]
push 0
push eax
mov edi, ecx
mov byte [esp + 0x14], 0
call fcn.1011e8d0
add esp, 0xc
test edi, edi
je 0x1000be06
test ebx, ebx
je 0x1000be06
cmp byte [edi], 0
jne 0x1000bce5
push 1
push str.lpSrvPath__d_
push 0x3eb
push str.FtpGetFileLastTime
push str..If_FileTransfer.c
push 1
call fcn.1014edc0
xor ecx, ecx
cmp byte [edi], cl
sete cl
push ecx
push str.lpSrvPath__d_
push 0x3eb
push str.FtpGetFileLastTime
push str..If_FileTransfer.c
push 1
call fcn.1014f750
add esp, 0x30
pop edi
mov eax, 0xfffffffb
pop esi
mov ecx, dword [esp + 0x400]
xor ecx, esp
call fcn.1011a380
add esp, 0x404
ret
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
mov ecx, dword [0x101d93bc]
mov edx, eax
sub edx, ecx
cmp edx, 0xea60
jae 0x1000bd21
cmp eax, ecx
jbe 0x1000bd21
pop ebp
pop edi
mov eax, 0xfffffff6
pop esi
mov ecx, dword [esp + 0x400]
xor ecx, esp
call fcn.1011a380
add esp, 0x404
ret
push edi
lea esi, [esp + 0x10]
call fcn.1000b480
mov esi, eax
add esp, 4
test esi, esi
jge 0x1000bd89
push edi
push str._GetFile_
push 0x3f8
push str.FtpGetFileLastTime
push str..If_FileTransfer.c
push 1
call fcn.1014edc0
push edi
push str._GetFile_
push 0x3f8
push str.FtpGetFileLastTime
push str..If_FileTransfer.c
push 1
call fcn.1014f750
add esp, 0x30
pop ebp
pop edi
mov eax, esi
pop esi
mov ecx, dword [esp + 0x400]
xor ecx, esp
call fcn.1011a380
add esp, 0x404
ret
push ebx
push str.Infogo0718Ftp__
push str.infogoftpuser
lea eax, [esp + 0x18]
push eax
call fcn.10146ce0
mov esi, eax
cmp esi, 0xffffffff
jne 0x1000bdbc
push ebx
push str.infogoftp
push str.infogoftp
lea ecx, [esp + 0x18]
push ecx
call fcn.10146ce0
mov esi, eax
cmp esi, 0xfffffff6
jne 0x1000bd6f
push str._GetFile__FTP
push 0x403
push str.FtpGetFileLastTime
push str..If_FileTransfer.c
push 1
call fcn.1014edc0
push str._GetFile__FTP
push 0x403
push str.FtpGetFileLastTime
push str..If_FileTransfer.c
push 1
call fcn.1014f750
add esp, 0x28
call ebp
mov dword [0x101d93bc], eax
jmp 0x1000bd6f
xor edx, edx
test ebx, ebx
sete dl
xor eax, eax
test edi, edi
sete al
mov esi, edx
push esi
mov edi, eax
push edi
push str.lpSrvPath__d___psysTime__d_
push 0x3e5
push str.FtpGetFileLastTime
push str..If_FileTransfer.c
push 1
call fcn.1014edc0
push esi
push edi
push str.lpSrvPath__d___psysTime__d_
push 0x3e5
push str.FtpGetFileLastTime
push str..If_FileTransfer.c
push 1
call fcn.1014f750
mov ecx, dword [esp + 0x440]
add esp, 0x38
pop edi
pop esi
xor ecx, esp
mov eax, 0xfffffffb
call fcn.1011a380
add esp, 0x404
ret
Function at 0x1000e880
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
push 0x101aa518
push 0x9e9
push str.P2PServiceStart
push str..If_FileTransfer.c
push 2
call fcn.1014edc0
push 0x101aa518
push 0x9e9
push str.P2PServiceStart
push str..If_FileTransfer.c
push 2
call fcn.1014f750
add esp, 0x28
push 0x101dab60
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, 1
mov dword [0x101dab84], eax
lea ebx, [esi + 2]
jmp 0x1000e8f0
push esi
push 0x101aa53c
push 0x9f1
push str.P2PServiceStart
push str..If_FileTransfer.c
push 2
call fcn.1014edc0
push esi
push 0x101aa53c
push 0x9f1
push str.P2PServiceStart
push str..If_FileTransfer.c
push 2
call fcn.1014f750
add esp, 0x30
push 0
push 0
push 0
push 0x1000dcd0
push 0
push 0
call edi
add esi, 1
sub ebx, 1
jne 0x1000e8f0
mov eax, dword [0x101dab78]
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
add eax, 3
push eax
push 0x101dab78
call esi
mov ecx, dword [0x101dab7c]
add ecx, 3
push ecx
push 0x101dab7c
call esi
push ebx
push ebx
push ebx
push 0x1000e410
push ebx
push ebx
call edi
push ebx
push ebx
push ebx
push 0x1000da40
push ebx
push ebx
call edi
pop edi
pop esi
xor eax, eax
pop ebx
ret

Function at 0x1000e990
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov eax, edi
mov dword [esp + 4], 0x400
mov dword [esp], 0
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1000e9a7
sub eax, edx
push esi
mov esi, eax
je 0x1000e9dc
jmp 0x1000e9c0
push 1
lea eax, [esi + edi]
push 0x101a92ac
push eax
call fcn.1011b8bf
add esp, 0xc
test eax, eax
je 0x1000e9dc
sub esi, 1
jne 0x1000e9c0
lea ecx, [esp + 4]
push ecx
push 1
push 0
add esi, edi
push esi
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
pop esi
jne 0x1000ea3f
lea edx, [esp + 4]
push edx
push 0x101d93c0
push eax
push eax
mov eax, dword [esp + 0x10]
push str.Content_Type
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x1000ea2c
push 0x18
push str.application_octet_stream
push 0x101d93c0
call fcn.1011b73f
add esp, 0xc
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x101d93c0
add esp, 8
ret
push 0x18
push str.application_octet_stream
push 0x101d93c0
call fcn.1011b73f
add esp, 0xc
mov eax, 0x101d93c0
add esp, 8
ret
Function at 0x1000ea60
Capabilities:
Get file size

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
xor eax, eax
mov edi, ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
add edi, 0x100
lea esp, [esp]
mov eax, dword [edi + 0x4000]
sub eax, 1
je 0x1000eb36
sub eax, 1
jne 0x1000eb83
push eax
push 0x8000080
push 3
push eax
push 7
push closesocket
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000ebc0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, str.__MULTI_PARTS_FORM_DATA_BOUNDARY
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1000ead6
sub eax, edx
mov ebp, eax
lea eax, [edi - 0x100]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1000eaf0
sub eax, edx
mov ebx, eax
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1000eb02
sub eax, edx
mov esi, eax
call fcn.1000e990
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1000eb17
mov ecx, dword [esp + 0x10]
sub eax, edx
add eax, esi
add eax, ebx
add eax, ebp
add eax, dword [esp + 0x18]
lea edx, [ecx + eax + 0x4e]
jmp 0x1000eb7f
mov eax, str.__MULTI_PARTS_FORM_DATA_BOUNDARY
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1000eb40
sub eax, edx
mov ebx, eax
lea eax, [edi - 0x100]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1000eb56
sub eax, edx
mov edx, eax
mov eax, edi
lea esi, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1000eb68
mov ecx, dword [esp + 0x10]
sub eax, esi
add eax, edx
add eax, ebx
lea edx, [ecx + eax + 0x31]
mov dword [esp + 0x10], edx
mov eax, dword [esp + 0x14]
add eax, 1
add edi, 0x4104
cmp eax, 4
mov dword [esp + 0x14], eax
jl 0x1000ea80
mov eax, str.__MULTI_PARTS_FORM_DATA_BOUNDARY
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1000eba5
mov ecx, dword [esp + 0x10]
pop edi
pop esi
sub eax, edx
pop ebp
lea eax, [eax + ecx + 6]
pop ebx
add esp, 0xc
ret
push 0x101aa588
push 0xa83
push str.GetMultiPartsFormDataLength
push str..If_FileTransfer.c
push 2
call fcn.1014edc0
push 0x101aa588
push 0xa83
push str.GetMultiPartsFormDataLength
push str..If_FileTransfer.c
push 2
call fcn.1014f750
add esp, 0x28
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
Function at 0x100106f0
Capabilities:
Set file attributes

Disassembly:
sub esp, 0x118
mov eax, dword [0x101c1b88]
xor eax, esp
mov dword [esp + 0x114], eax
push ebx
push esi
xor eax, eax
push edi
push 0x103
push eax
mov byte [esp + 0x18], al
mov word [esp + 0x19], ax
mov byte [esp + 0x1b], al
mov byte [esp + 0x1c], al
lea eax, [esp + 0x1d]
push eax
mov edi, ecx
call fcn.1011e8d0
add esp, 0xc
call fcn.100103d0
test eax, eax
jne 0x10010820
lea ebx, [esp + 0x10]
call fcn.100105d0
mov esi, eax
test esi, esi
jge 0x100107a1
push 0x101aabec
push 0xdc7
push str.GetBackupSpacePath
push str..If_FileTransfer.c
push 1
call fcn.1014edc0
add esp, 0x14
push 0x101aabec
push 0xdc7
push str.GetBackupSpacePath
push str..If_FileTransfer.c
push 1
call fcn.1014f750
add esp, 0x14
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.1011a380
add esp, 0x118
ret
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push 0x104
push edx
call fcn.1011b28e
add esp, 0xc
push str.AgentTemp
lea eax, [esp + 0x18]
push 0x104
push eax
call fcn.1011a6f4
lea ecx, [esp + 0x20]
add esp, 0xc
push ecx
call fcn.1014c440
add esp, 4
push 0x16
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push str.SmpAgent
lea eax, [esp + 0x18]
push 0x104
push eax
call fcn.1011a6f4
lea ecx, [esp + 0x20]
add esp, 0xc
push ecx
call fcn.1014c440
add esp, 4
lea edx, [esp + 0x14]
push edx
push 0x104
push edi
call fcn.1011b28e
add esp, 0xc
mov ecx, dword [esp + 0x120]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.1011a380
add esp, 0x118
ret

Function at 0x10012420
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x10012360
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x10012476
push 0x101ab420
push 0xc6
push str.InitOfflineMgr
push str..If_OfflineMgr.cpp
push 1
call fcn.1014edc0
push 0x101ab420
push 0xc6
push str.InitOfflineMgr
push str..If_OfflineMgr.cpp
push 1
call fcn.1014f750
add esp, 0x28
or eax, 0xffffffff
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
ret
Function at 0x10012fa0
Capabilities:
Create thread

Disassembly:
cmp dword [0x101d8f40], 0
jne 0x10012fbd
call fcn.1014b3e0
mov dword [0x101d8f44], eax
mov dword [0x101d8f40], 1
cmp dword [0x101d8f44], 0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
je 0x10013015
push str.PrivilegeStat
push str.ConfigPrivilegeMode
call sym.IsaManage.dll_IsiReadDb_l
add esp, 8
cmp eax, 1
je 0x10012fe9
call fcn.10014770
push str.PolicyList
call fcn.10028d40
add esp, 4
cmp dword [0x101d97e4], 0
jne 0x10013015
push 0
push 0
push 0
push 0x10014b00
push 0
push 0
call esi
mov dword [0x101d97e4], eax
push str.PolicyList
call fcn.10028e50
add esp, 4
cmp dword [0x101d97dc], 0
jne 0x10013041
push 0
push 0
push 0
push 0x10014b60
push 0
push 0
call esi
mov dword [0x101d97dc], eax
cmp dword [0x101d97d4], 0
jne 0x10013060
push 0
push 0
push 0
push 0x10014b90
push 0
push 0
call esi
mov dword [0x101d97d4], eax
pop esi
ret

Function at 0x100152f0
Capabilities:
Create thread

Disassembly:
cmp dword [0x101d97f0], 0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
jne 0x10015316
push 0
push 0
push 0
push 0x10017040
push 0
push 0
call esi
mov dword [0x101d97f0], eax
cmp dword [0x101d97f4], 0
jne 0x10015335
push 0
push 0
push 0
push 0x10016ee0
push 0
push 0
call esi
mov dword [0x101d97f4], eax
pop esi
ret
Function at 0x10016990
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
or esi, 0xffffffff
push 0x101daae0
mov dword [esp + 0x14], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x101d97ec]
test ebx, ebx
je 0x10016b15
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, dword [ebx + 0x48]
test esi, esi
je 0x10016b06
lea ecx, [ecx]
mov eax, dword [esi]
push eax
push 0x101ac4c0
push 0x4a1
push str.ExecuteCycleTask
push str..If_TaskMgr.c
push 2
mov dword [esp + 0x2c], 0xffffffff
call fcn.1014edc0
mov ecx, dword [esi]
push ecx
push 0x101ac4c0
push 0x4a1
push str.ExecuteCycleTask
push str..If_TaskMgr.c
push 2
call fcn.1014f750
add esp, 0x30
lea edx, [esp + 0x14]
mov ecx, esi
call fcn.10016300
test eax, eax
je 0x10016afb
cmp dword [esi + 0xc], 0
jne 0x10016aae
mov edx, dword [esi]
push 0
push 0
push edx
push 0x10015f50
push 0
push 0
call edi
test eax, eax
mov dword [esi + 0xc], eax
jne 0x10016a76
mov eax, dword [esi]
push eax
push 0x101ac4f0
push 0x4b6
push str.ExecuteCycleTask
push str..If_TaskMgr.c
push 1
call fcn.1014edc0
mov ecx, dword [esi]
push ecx
push 0x101ac4f0
push 0x4b6
jmp 0x10016ad9
push eax
push 0x101ac51c
push 0x4ba
push str.ExecuteCycleTask
push str..If_TaskMgr.c
push 3
call fcn.1014edc0
mov edx, dword [esi + 0xc]
push edx
push 0x101ac51c
push 0x4ba
push str.ExecuteCycleTask
push str..If_TaskMgr.c
push 3
jmp 0x10016ae5
mov eax, dword [esi]
push eax
push 0x101ac53c
push 0x4bf
push str.ExecuteCycleTask
push str..If_TaskMgr.c
push 1
call fcn.1014edc0
mov ecx, dword [esi]
push ecx
push 0x101ac53c
push 0x4bf
push str.ExecuteCycleTask
push str..If_TaskMgr.c
push 1
call fcn.1014f750
mov eax, dword [esp + 0x44]
add esp, 0x30
cmp eax, dword [esp + 0x10]
jae 0x10016afb
mov dword [esp + 0x10], eax
mov esi, dword [esi + 0x4c]
test esi, esi
jne 0x100169d0
mov ebx, dword [ebx + 0x4c]
test ebx, ebx
jne 0x100169c2
mov esi, dword [esp + 0x10]
push 0x101daae0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp + 8]
test eax, eax
je 0x10016b37
cmp esi, 0x3e8
jbe 0x10016b35
sub esi, 0x3e8
mov dword [eax], esi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100171d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push esi
push edi
push 0x101daac0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
push 0xc
call esi
push eax
push 0xb
call esi
push eax
mov eax, dword [0x101d8f3c]
push 1
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadImageA]
cmp dword [0x101d9804], 0
mov dword [0x101d9810], eax
jne 0x10017341
mov eax, dword [0x101d9800]
test eax, eax
je 0x10017231
push eax
call dword [sym.imp.USER32.dll_CloseWindow]
mov dword [0x101d9800], 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
mov esi, eax
push esi
push 0x10018f90
push 0
push 0
call edi
push 0x101ac718
push 0xaf
push str.InitTray
push str..If_Tray.c
push 3
mov dword [0x101d9804], eax
call fcn.1014edc0
push 0x101ac718
push 0xaf
push str.InitTray
push str..If_Tray.c
push 3
call fcn.1014f750
add esp, 0x28
push 0x7530
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x101ac754
push 0xb2
push str.InitTray
push str..If_Tray.c
push 3
call fcn.1014edc0
push 0x101ac754
push 0xb2
push str.InitTray
push str..If_Tray.c
push 3
call fcn.1014f750
add esp, 0x28
call fcn.10017640
test eax, eax
jne 0x10017341
cmp dword [0x101d9818], eax
jne 0x10017341
push str.Shell_NotifyIcon_NIM_ADD__Create_Thread_to_delay_loop_do_it
push 0xb8
push str.InitTray
push str..If_Tray.c
push 1
call fcn.1014edc0
push str.Shell_NotifyIcon_NIM_ADD__Create_Thread_to_delay_loop_do_it
push 0xb8
push str.InitTray
push str..If_Tray.c
push 1
call fcn.1014f750
add esp, 0x28
push 0
push 0
push 0
push 0x10017760
push 0
push 0
call edi
mov dword [0x101d9818], eax
call fcn.10017360
push eax
call fcn.10017430
call fcn.100173d0
push eax
call fcn.10017430
add esp, 8
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10017360
Capabilities:
Find taskbar

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersion]
push edi
call esi
movzx edi, ah
call esi
xor ecx, ecx
mov ch, al
push 0
push str.Shell_TrayWnd
or edi, ecx
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
jne 0x1001738b
pop edi
xor eax, eax
pop esi
ret
mov esi, dword [sym.imp.USER32.dll_FindWindowExA]
push 0
push str.TrayNotifyWnd
push 0
push eax
call esi
test eax, eax
je 0x10017386
cmp edi, 0x500
jbe 0x100173b5
push 0
push str.SysPager
push 0
push eax
call esi
test eax, eax
je 0x10017386
push 0
push str.ToolbarWindow32
push 0
push eax
call esi
pop edi
pop esi
ret
Function at 0x100175d0
Capabilities:
Terminate thread

Disassembly:
call fcn.100177f0
mov eax, dword [0x101d9800]
test eax, eax
je 0x100175ef
push eax
call dword [sym.imp.USER32.dll_CloseWindow]
mov dword [0x101d9800], 0
mov eax, dword [0x101d9804]
test eax, eax
je 0x10017617
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [0x101d9804]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x101d9804], 0
push 0x101daac0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call fcn.10018f50
push 0x101daac0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
ret