joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4156cc
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x460
cmp byte [0x49ee0e], 0
je 0x41591d
push ebx
push esi
push edi
push 0x4880a8
push 0x49e4d0
lea eax, [ebp - 0x460]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov esi, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x460]
push eax
mov dword [ebp - 4], 1
call esi
mov ebx, dword [sym.imp.NSCRT.dll__wcsicmp]
mov edi, eax
cmp edi, 0xffffffff
je 0x4157d0
test byte [ebp - 0x258], 0x10
lea eax, [ebp - 0x22c]
je 0x415765
push 0x48844c
push eax
call dword [sym.imp.NSCRT.dll_wcscmp]
test eax, eax
pop ecx
pop ecx
je 0x4157b3
lea eax, [ebp - 0x22c]
push 0x488444
push eax
call dword [sym.imp.NSCRT.dll_wcscmp]
test eax, eax
pop ecx
pop ecx
je 0x4157b3
jmp 0x4157b0
push 0x48a304
push eax
call fcn.0041b1e3
pop ecx
push eax
call ebx
test eax, eax
pop ecx
pop ecx
je 0x4157b0
lea eax, [ebp - 0x22c]
push 0x48733c
push eax
call fcn.0041b1e3
pop ecx
push eax
call ebx
test eax, eax
pop ecx
pop ecx
je 0x4157b0
lea eax, [ebp - 0x22c]
push 0x487334
push eax
call fcn.0041b1e3
pop ecx
push eax
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x4157b3
inc dword [ebp - 4]
lea eax, [ebp - 0x258]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x41572a
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
call fcn.0046e4cd
cdq
idiv dword [ebp - 4]
test edx, edx
mov dword [ebp - 8], edx
jne 0x4157ec
and word [0x4a0298], dx
jmp 0x41591a
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x460]
push eax
mov dword [ebp - 4], 1
call esi
mov edi, eax
cmp edi, 0xffffffff
je 0x4158d2
test byte [ebp - 0x258], 0x10
lea eax, [ebp - 0x22c]
je 0x415847
mov esi, dword [sym.imp.NSCRT.dll_wcscmp]
push 0x48844c
push eax
call esi
test eax, eax
pop ecx
pop ecx
je 0x41589d
lea eax, [ebp - 0x22c]
push 0x488444
push eax
call esi
test eax, eax
pop ecx
pop ecx
je 0x41589d
jmp 0x415892
push 0x48a304
push eax
call fcn.0041b1e3
pop ecx
push eax
call ebx
test eax, eax
pop ecx
pop ecx
je 0x415892
lea eax, [ebp - 0x22c]
push 0x48733c
push eax
call fcn.0041b1e3
pop ecx
push eax
call ebx
test eax, eax
pop ecx
pop ecx
je 0x415892
lea eax, [ebp - 0x22c]
push 0x487334
push eax
call fcn.0041b1e3
pop ecx
push eax
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x41589d
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
je 0x4158b5
inc dword [ebp - 4]
lea eax, [ebp - 0x258]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x41580e
jmp 0x4158cb
lea eax, [ebp - 0x22c]
push eax
push 0x104
push 0x4a0298
call fcn.0047aaff
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor edi, edi
push edi
push 0x9d63
push 0x111
push dword [0x4ac344]
call dword [sym.imp.USER32.dll_PostMessageA]
push 0x28
pop esi
cmp dword [0x4aa720], esi
jne 0x41591a
cmp dword [0x4aa724], edi
je 0x41591a
push 1
mov dword [0x4aa720], edi
call fcn.00443a10
push 1
mov dword [0x4aa720], esi
call fcn.00443a10
pop ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x416b81
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push edi
lea eax, [ebp - 0x14]
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x10]
neg eax
push eax
mov eax, dword [ebp - 0x14]
neg eax
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_OffsetRect]
push 0x20023f
push 0
push dword [esi]
call dword [sym.imp.USER32.dll_GetDCEx]
mov edi, eax
test edi, edi
je 0x416c7d
push ebx
push edi
call fcn.0044d2ff
push dword [0x4abad0]
call fcn.0044d325
pop ecx
pop ecx
push 0x80
lea eax, [ebp - 0x94]
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ebx, dword [esi + 0x14]
cmp ebx, 1
mov dword [ebp - 4], eax
jne 0x416c23
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x416c21
movzx ecx, word [eax + 4]
movzx eax, word [eax]
shl ecx, 0x10
or ecx, eax
push ecx
push 0
push 0x84
push dword [esi]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0x14
je 0x416c23
xor ebx, ebx
xor eax, eax
cmp dword [ebp + 8], eax
je 0x416c2d
inc eax
jmp 0x416c37
cmp byte [0x49bcb2], 0
sete al
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x14]
push ecx
push eax
push dword [ebp - 4]
lea eax, [ebp - 0x94]
push eax
push dword [0x4ab9cc]
push edi
call fcn.004168d2
push dword [ebp + 8]
mov ecx, ebx
push dword [0x4ab9cc]
lea eax, [ebp - 0x14]
push edi
call fcn.0041687e
push 0
call fcn.0044d325
add esp, 0x28
push edi
push dword [esi]
call dword [sym.imp.USER32.dll_ReleaseDC]
pop ebx
pop edi
leave
ret
Function at 0x41764b
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [esi + 0x14], 1
jne 0x4176b5
push 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
xor ecx, ecx
test eax, eax
setne cl
inc ecx
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ah, ah
jns 0x4176a1
push 0x10
lea eax, [ebp - 0x10]
push 0
push eax
call sub.NSCRT.dll_memset
mov eax, dword [esi]
mov dword [ebp - 8], eax
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], 0x10
mov dword [ebp - 0xc], 0x12
call dword [sym.imp.USER32.dll_TrackMouseEvent]
leave
ret
xor eax, eax
push 0x401
push eax
push eax
push dword [esi]
mov dword [esi + 0x14], eax
call dword [sym.imp.USER32.dll_RedrawWindow]
leave
ret

Function at 0x41777d
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
test dword [edi + 8], 1
jne 0x4177f9
mov eax, 0xffff
cmp dword [edi + 0xc], eax
je 0x4177f9
cmp dword [edi + 0x10], eax
je 0x4177f9
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
xor ecx, ecx
shr eax, 0xf
and eax, 1
cmp byte [0x49bcaf], cl
setne cl
add eax, ecx
cmp eax, 1
jne 0x4177f9
lea eax, [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edx, dword [ebp - 8]
sub edx, dword [edi + 0xc]
mov eax, dword [esi + 8]
sub eax, dword [esi]
mov ecx, dword [esi + 0xc]
sub ecx, dword [esi + 4]
mov dword [esi], edx
mov edx, dword [ebp - 4]
sub edx, dword [edi + 0x10]
mov dword [esi + 4], edx
mov edx, dword [esi]
add edx, eax
mov eax, dword [esi + 4]
add eax, ecx
mov dword [esi + 8], edx
mov dword [esi + 0xc], eax
push dword [edi]
push esi
call fcn.0040ad9d
pop ecx
pop ecx
leave
ret

Function at 0x4177fb
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, dword [esi + 8]
sub ebx, dword [esi]
push edi
mov edi, dword [esi + 0xc]
sub edi, dword [esi + 4]
cmp dword [0x49f854], 0
jne 0x417837
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ah, ah
js 0x417837
add ebx, 0x18
mov eax, ebx
cdq
push 0x19
pop ecx
idiv ecx
add edi, 0x1c
mov eax, edi
push 0x1d
pop ecx
sub ebx, edx
cdq
idiv ecx
sub edi, edx
cmp ebx, 0x32
jge 0x41783f
push 0x32
pop ebx
cmp edi, 0x3a
jge 0x417847
push 0x3a
pop edi
mov eax, dword [esi]
add eax, ebx
mov dword [esi + 8], eax
mov eax, dword [esi + 4]
add eax, edi
pop edi
mov dword [esi + 0xc], eax
pop ebx
ret

Function at 0x418287
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
and word [esi], 0
add eax, 3
push edi
and eax, 0xfffffffc
call fcn.00483980
mov edi, esp
test edi, edi
je 0x4182d9
push 0x4a09c0
push dword [ebp + 0x10]
push edi
push 0x486d4c
push dword [ebp + 8]
push str.WinampReg
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push dword [ebp + 0x10]
push esi
push 0xffffffffffffffff
push edi
push 0
push 0xfde9
call fcn.00405faa
add esp, 0x18
lea esp, [ebp - 8]
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x418375
Capabilities:
Read .ini file

Disassembly:
mov ecx, 0x4a4c98
jmp fcn.004181a5
Function at 0x41846a
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
push 0x4a09c0
push 0x80
push esi
push 0x486d4c
push 0x48a878
mov ebx, str.WinampReg
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push esi
call sub.NSCRT.dll_strlen
cmp eax, 0x20
pop ecx
jbe 0x4184a5
mov byte [esi], 0
cmp byte [esi], 0
jne 0x418500
push edi
lea eax, [ebp - 0x14]
push eax
mov dword [ebp + 8], 0x200
mov dword [ebp - 4], esi
call dword [sym.imp.ole32.dll_CoCreateGuid]
mov byte [esi], 0
xor edi, edi
movzx eax, byte [ebp + edi - 0x14]
push eax
push str._02X
push 0
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.00410f7a
add esp, 0x1c
inc edi
cmp edi, 0x10
jb 0x4184c4
push 0x4a09c0
push esi
push 0x48a878
push ebx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x418d1c
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
movzx eax, byte [0x49ee0c]
push ebx
push eax
call fcn.0041b4a6
cmp dword [0x4ac344], 0
pop ecx
mov ebx, eax
je 0x418e25
mov eax, dword [0x4a4cf4]
push esi
xor esi, esi
inc esi
test eax, eax
je 0x418d63
cmp dword [0x49bea8], ebx
je 0x418df2
push eax
call dword [sym.imp.USER32.dll_DestroyIcon]
cmp ebx, 0xfffffd66
jne 0x418dd3
push edi
push 0x40
pop ecx
xor eax, eax
mov byte [ebp - 0x104], 0
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x4a08b8
push str._swinamp.ico
stosb byte es:[edi], al
lea eax, [ebp - 0x104]
push 0x104
push eax
call fcn.00402528
add esp, 0x10
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
pop edi
jne 0x418dc1
push 0x8000
push 0x10
push 0x10
push esi
push 0x66
jmp 0x418de1
push 0x10
push 0x10
push 0x10
push esi
lea eax, [ebp - 0x104]
push eax
push 0
jmp 0x418de7
push 0x8000
push 0x10
push 0x10
movzx eax, bx
push esi
push eax
push dword [0x4b0600]
call dword [sym.imp.USER32.dll_LoadImageA]
mov dword [0x4a4cf4], eax
cmp dword [0x4a4cf8], 0
push dword [ebp + 8]
mov dword [0x49bea8], ebx
push 0x1f6
push dword [0x4ac344]
jne 0x418e1c
call fcn.00418baa
mov dword [0x4a4cf8], esi
jmp 0x418e21
call fcn.00418c6b
add esp, 0xc
pop esi
pop ebx
leave
ret
Function at 0x41b97c
Capabilities:
Hash data using sha1

Disassembly:
xor ecx, ecx
push 0x140
mov dword [eax + 0x154], ecx
mov dword [eax + 0x158], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
push ecx
add eax, 0x14
push eax
call sub.NSCRT.dll_memset
add esp, 0xc
ret
Function at 0x41beb5
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
xor esi, esi
cmp dword [ebp + 8], esi
je 0x41befd
lea eax, [ebp + 8]
push eax
mov dword [ebp + 8], esi
call fcn.00406326
test eax, eax
pop ecx
jne 0x41c028
mov eax, dword [ebp + 8]
cmp eax, esi
je 0x41c028
push dword [ebp + 0x10]
mov ecx, dword [eax]
push dword [ebp + 0xc]
push eax
call dword [ecx + 0x60]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x41c028
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov byte [eax], 0
lea eax, [ebp - 8]
push eax
push esi
push 0x20019
push esi
push esi
push esi
push str.SOFTWARENullsoftWinamp
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [ebx], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x41c027
push edi
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp + 8]
push eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push str.regname
push dword [ebp - 8]
xor edi, edi
inc edi
mov dword [ebp - 4], 0x200
mov dword [ebp + 8], edi
call esi
test eax, eax
jne 0x41bf61
cmp dword [ebp + 8], edi
je 0x41bf64
mov byte [ebx], 0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp + 8]
push eax
push 0
push str.regkey
push dword [ebp - 8]
mov dword [ebp - 4], 0x21
mov dword [ebp + 8], edi
call esi
test eax, eax
jne 0x41c017
cmp dword [ebp + 8], edi
jne 0x41c017
cmp byte [ebp - 0x2c], 0x7e
jne 0x41c006
cmp byte [ebp - 0x2b], al
je 0x41c001
push 0x1b
pop esi
lea ecx, [ebp + edi - 0x2c]
mov al, byte [ecx]
cmp al, 0x41
jl 0x41bfce
cmp al, 0x5a
jg 0x41bfce
movsx eax, al
sub eax, edi
sub eax, 0x41
push 0x1a
cdq
pop ebx
idiv ebx
test edx, edx
jge 0x41bfc7
add edx, ebx
add dl, 0x41
mov byte [ecx], dl
jmp 0x41bff6
cmp al, 0x61
jl 0x41bfef
cmp al, 0x6b
jg 0x41bfef
movsx eax, al
sub eax, esi
sub eax, 0x61
push 0xa
cdq
pop ebx
idiv ebx
test edx, edx
jge 0x41bfea
add edx, ebx
add dl, 0x30
jmp 0x41bfca
cmp al, 0x2f
jne 0x41bff6
mov byte [ecx], 0x2d
inc edi
add esi, 0x1b
cmp byte [ebp + edi - 0x2c], 0
jne 0x41bfa5
lea eax, [ebp - 0x2b]
jmp 0x41c009
lea eax, [ebp - 0x2c]
push 0x20
push eax
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
jmp 0x41c01d
mov eax, dword [ebp + 0x10]
mov byte [eax], 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
pop esi
leave
ret
Function at 0x41c08b
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0xb4
mov eax, dword [0x49bf90]
cmp eax, 0xffffffff
jne 0x41c172
and dword [ebp + 0x70], 0
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x3c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x41c16a
cmp dword [ebp - 0x38], 5
ja 0x41c0d7
jne 0x41c16a
cmp dword [ebp - 0x34], 0
jbe 0x41c16a
push edi
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x48aa60
call edi
test eax, eax
mov dword [ebp + 0x74], eax
je 0x41c169
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.IsAppThemed
push eax
call esi
push str.IsThemeActive
push dword [ebp + 0x74]
mov ebx, eax
call esi
test ebx, ebx
mov dword [ebp + 0x6c], eax
je 0x41c15e
test eax, eax
je 0x41c15e
call ebx
test eax, eax
je 0x41c15e
call dword [ebp + 0x6c]
test eax, eax
je 0x41c15e
push str.comctl32.dll
call edi
mov edi, eax
test edi, edi
je 0x41c15e
push str.DllGetVersion
push edi
call esi
test eax, eax
je 0x41c157
lea ecx, [ebp + 0x58]
push ecx
mov dword [ebp + 0x58], 0x14
call eax
test eax, eax
jne 0x41c157
cmp dword [ebp + 0x5c], 6
jb 0x41c157
mov dword [ebp + 0x70], 1
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push dword [ebp + 0x74]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
pop ebx
pop edi
mov eax, dword [ebp + 0x70]
mov dword [0x49bf90], eax
add ebp, 0x78
leave
ret

Function at 0x41c4fa
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48c
push ebx
push esi
push edi
push 0x4a09c0
push 0x10
push str.NumRecentURLs
push 0x486c04
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
and word [ebp - 0x284], 0
push dword [ebp + 0xc]
mov ebx, eax
xor eax, eax
mov ecx, 0x81
lea edi, [ebp - 0x282]
rep stosd dword es:[edi], eax
push str.RecentURL_s1
stosw word es:[edi], ax
lea eax, [ebp - 0x7c]
push 0x7b
push eax
call fcn.00402528
mov esi, 0x104
push esi
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.0040609c
push dword [ebp + 8]
lea eax, [ebp - 0x7c]
push eax
call fcn.00406186
push dword [ebp + 8]
lea eax, [ebp - 0x284]
push eax
call dword [sym.imp.NSCRT.dll_wcscmp]
add esp, 0x2c
test eax, eax
je 0x41c5f9
xor edi, edi
inc edi
cmp ebx, edi
jle 0x41c5f9
inc edi
push edi
push dword [ebp + 0xc]
lea eax, [ebp - 0x7c]
push str.RecentURL_s_d
push 0x7b
push eax
call fcn.00402528
and word [ebp - 0x48c], 0
push esi
lea eax, [ebp - 0x48c]
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.0040609c
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.00406186
push dword [ebp + 8]
lea eax, [ebp - 0x48c]
push eax
call dword [sym.imp.NSCRT.dll__wcsicmp]
add esp, 0x30
test eax, eax
je 0x41c5f9
push esi
lea eax, [ebp - 0x48c]
push eax
lea eax, [ebp - 0x284]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
cmp edi, ebx
jl 0x41c58b
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41c6da
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push dword [ebp + 8]
call dword [sym.imp.NSCRT.dll__strdup]
pop ecx
mov esi, eax
lea eax, [ebp - 4]
push eax
xor eax, eax
push eax
push esi
push 0x41c61d
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x41c70c
push esi
call dword [sym.imp.NSCRT.dll_free]
pop ecx
pop esi
leave
ret
Function at 0x41cb2e
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1464
call fcn.00483980
call fcn.0041b787
test eax, eax
je 0x41cd6b
push esi
push edi
push dword [0x49bcfc]
call fcn.0041c5fe
test al, al
pop ecx
je 0x41cb95
push 0x7f
xor eax, eax
mov byte [ebp - 0x264], 0
pop ecx
lea edi, [ebp - 0x263]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x264]
push eax
call fcn.0041846a
pop ecx
xor esi, esi
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push 0x41c70f
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x41cb97
xor esi, esi
push dword [0x49bd00]
call fcn.0041c5fe
test al, al
pop ecx
je 0x41cd69
push 0x48ac38
push str.http:__client.winamp.com_update_client_session.php_v_s
push esi
lea ecx, [ebp - 8]
push ecx
lea eax, [ebp - 0x1464]
mov dword [ebp - 4], eax
lea ecx, [ebp - 4]
mov eax, 0x1000
push ecx
push eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x1464]
push eax
call fcn.00410f7a
push 0x7f
xor eax, eax
mov byte [ebp - 0x464], 0
pop ecx
lea edi, [ebp - 0x463]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x464]
push eax
call fcn.0041846a
add esp, 0x20
cmp byte [ebp - 0x464], 0
je 0x41cc2e
lea eax, [ebp - 0x464]
push eax
push str.ID_s
push esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.00410f7a
add esp, 0x1c
push 0x15
pop ecx
xor eax, eax
mov dword [ebp - 0x64], esi
lea edi, [ebp - 0x60]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x64]
mov edi, 0x4a4c98
push eax
mov ecx, edi
call fcn.0041823a
xor eax, eax
push ebx
push dword [ebp + eax*4 - 0x64]
lea ebx, [eax + 1]
push ebx
push str.st_d_d
push esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.00410f7a
mov eax, ebx
add esp, 0x20
cmp eax, 0x16
jl 0x41cc4e
mov ebx, 0x100
push ebx
lea eax, [ebp - 0x264]
push eax
push 0x4872d0
mov ecx, edi
call fcn.00418287
lea eax, [ebp - 0x264]
push eax
call fcn.00402c41
push eax
push str.skin_s
mov dword [ebp - 0xc], eax
push esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.00410f7a
push dword [ebp - 0xc]
mov esi, dword [sym.imp.NSCRT.dll_free]
call esi
add esp, 0x24
push ebx
lea eax, [ebp - 0x264]
push eax
push str.colortheme
mov ecx, edi
call fcn.00418287
lea eax, [ebp - 0x264]
push eax
call fcn.00402c41
mov edi, eax
push edi
push str.ct_s
xor ebx, ebx
push ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.00410f7a
push edi
call esi
mov ecx, dword [0x4ac3fc]
add esp, 0x24
cmp ecx, ebx
je 0x41cd1f
push ebx
call fcn.00472135
jmp 0x41cd21
xor eax, eax
cmp eax, ebx
je 0x41cd51
push eax
lea ecx, [ebp - 0xc]
call fcn.00402c93
push dword [eax]
lea eax, [ebp - 8]
push str.lang_s
push ebx
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.00410f7a
push dword [ebp - 0xc]
call esi
add esp, 0x20
lea eax, [ebp - 0x1464]
push eax
call fcn.0041c6da
pop ecx
call fcn.0041b7bd
mov dword [0x49bd00], eax
pop ebx
pop edi
pop esi
leave
ret
Function at 0x420fcd
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x4a52a4], ebx
jne 0x421045
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x420ff3
cmp al, 6
sbb al, al
inc al
jmp 0x420ff5
xor al, al
cmp al, bl
je 0x42103b
push 0x48b13c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [0x4a52a0], eax
je 0x421035
push ebx
lea eax, [ebp - 0x10]
push eax
push 0x4a5294
mov dword [ebp - 0x10], 1
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call sub.gdiplus.dll_GdiplusStartup
mov byte [0x4a5298], 1
jmp 0x42103b
mov byte [0x4a5298], bl
mov dword [0x4a52a4], 1
pop ebx
leave
ret
Function at 0x4224a2
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4842bc
call fcn.00483a50
sub esp, 0x30
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x14], esi
mov edi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [esi + 4], 0x48b148
xor ebx, ebx
lea eax, [esi + 0x88]
push eax
mov dword [ebp - 4], ebx
mov dword [esi], 0x48b150
mov dword [esi + 4], 0x48b14c
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
call edi
lea eax, [esi + 0xa0]
push eax
call edi
lea ecx, [esi + 0xc0]
mov byte [ebp - 4], 2
call fcn.00420387
lea eax, [esi + 0x88]
push eax
mov byte [esi + 0x1ac], bl
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 9
pop ecx
xor eax, eax
push 0x7f00
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
push ebx
mov byte [ebp - 4], 4
mov dword [ebp - 0x3c], 8
call dword [sym.imp.USER32.dll_LoadCursorA]
push ebx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x38], 0x422420
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push ebx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], str.WinampVideoChild
call dword [sym.imp.GDI32.dll_GetStockObject]
cmp dword [0x4a528c], ebx
mov dword [ebp - 0x20], eax
jne 0x42256e
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.USER32.dll_RegisterClassW]
inc dword [0x4a528c]
fld1
or dword [esi + 0x50], 0xffffffff
fstp qword [esi + 0x18]
push 0x10
lea eax, [esi + 0x30]
push ebx
push eax
mov dword [esi + 0x84], ebx
mov dword [esi + 0x80], ebx
mov dword [esi + 0x7c], ebx
mov byte [esi + 0x69], bl
mov byte [esi + 9], bl
mov byte [esi + 0x6a], bl
mov dword [esi + 0xc], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x10], ebx
mov byte [esi + 0x68], bl
mov byte [esi + 8], bl
mov dword [esi + 0x28], ebx
call sub.NSCRT.dll_memset
push 0x10
lea eax, [esi + 0x40]
push ebx
push eax
call sub.NSCRT.dll_memset
add esp, 0x18
mov ecx, esi
mov dword [esi + 0x60], ebx
call fcn.004216c8
mov eax, dword [ebp + 8]
push esi
push dword [ebp - 0x2c]
mov dword [esi + 0x78], ebx
push ebx
push eax
push 1
push 1
neg eax
push ebx
sbb eax, eax
push ebx
and eax, 0x45320000
add eax, 0xce0000
push eax
push 0x48b180
push dword [ebp - 0x18]
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov eax, dword [esi + 0x10]
push dword [ebp - 0x10]
mov dword [esi + 0xc4], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc

Function at 0x422df1
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x54], 0
jne 0x422e10
push 0
call fcn.0042389a
push 0
push dword [esi + 0x34]
call dword [sym.imp.USER32.dll_ShowWindow]
mov byte [esi + 0x54], 1
pop esi
ret