joyce8/EMBER2024-capa huggingface dataset:
Function at 0x437a0d
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov ebx, 0x503d88
push edi
push ebx
push 0x104
push esi
xor edi, edi
push edi
push str.downloadpath
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test esi, esi
je 0x437a49
cmp word [esi], di
je 0x437a49
mov al, 1
jmp 0x437b11
push esi
call fcn.0040c753
mov dword [esp], 0x208
lea eax, [ebp - 0x428]
push edi
push eax
mov dword [ebp - 0x1c], edi
mov dword [ebp - 4], edi
call fcn.0049a3b0
push 0x200
lea eax, [ebp - 0x220]
push edi
push eax
call fcn.0049a3b0
mov eax, dword [0x533114]
add esp, 0x18
mov ecx, dword [0x531f70]
test eax, eax
cmovne ecx, eax
lea eax, [ebp - 0x428]
push dword [ebp + 0xc]
mov dword [ebp - 0x20], ecx
push edi
push edi
push 0xc1
mov dword [ebp - 0x18], eax
call fcn.00441947
add esp, 0xc
push eax
lea eax, [ebp - 0x220]
push 0x100
push eax
call fcn.0040adba
add esp, 0x10
mov dword [ebp - 0x10], 0x41
lea eax, [ebp - 0x220]
mov dword [ebp - 0xc], 0x4385b6
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 8], esi
push eax
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
mov edi, eax
test edi, edi
je 0x437b0f
push esi
push edi
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
push edi
call fcn.00470a9c
pop ecx
push ebx
push esi
push str.downloadpath
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp 0x437a42
xor al, al
pop edi
pop esi
pop ebx
leave
ret

Function at 0x437d8a
Capabilities:
Delete file

Disassembly:
mov eax, 0x4c6c31
call fcn.0049911c
push ecx
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 4], 0xffffffff
je 0x437db2
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebx, 0x50bb64
push ebx
mov dword [ebp - 0x10], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
and dword [ebp - 4], 0
xor ecx, ecx
mov edx, dword [0x4f8e00]
test edx, edx
je 0x437df6
mov edi, dword [ebp + 8]
mov eax, dword [0x4f8e08]
cmp dword [eax + ecx*4], edi
je 0x437de5
inc ecx
cmp ecx, edx
jb 0x437dd4
jmp 0x437df6
push ecx
mov ecx, 0x4f8dfc
call fcn.0040c13d
mov edx, dword [0x4f8e00]
xor edi, edi
test edx, edx
je 0x437e38
mov eax, dword [0x4f8e08]
mov ecx, dword [0x531bd8]
push dword [eax + edi*4]
push 0
push 0xdc
call fcn.0040affb
test al, al
jne 0x437e25
inc edi
cmp edi, dword [0x4f8e00]
jb 0x437dfc
jmp 0x437e38
mov eax, dword [0x4f8e08]
mov ecx, dword [0x531bd8]
push dword [eax + edi*4]
call fcn.004383d0
or dword [ebp - 4], 0xffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [esi + 0x10]
mov ecx, 0x50bb88
push dword [esi + 8]
call fcn.00438bcd
mov ecx, esi
call fcn.004383a2
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x437d96
Capabilities:
Delete file

Disassembly:
mov eax, 0x4c6c31
call fcn.0049911c
push ecx
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 4], 0xffffffff
je 0x437db2
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebx, 0x50bb64
push ebx
mov dword [ebp - 0x10], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
and dword [ebp - 4], 0
xor ecx, ecx
mov edx, dword [0x4f8e00]
test edx, edx
je 0x437df6
mov edi, dword [ebp + 8]
mov eax, dword [0x4f8e08]
cmp dword [eax + ecx*4], edi
je 0x437de5
inc ecx
cmp ecx, edx
jb 0x437dd4
jmp 0x437df6
push ecx
mov ecx, 0x4f8dfc
call fcn.0040c13d
mov edx, dword [0x4f8e00]
xor edi, edi
test edx, edx
je 0x437e38
mov eax, dword [0x4f8e08]
mov ecx, dword [0x531bd8]
push dword [eax + edi*4]
push 0
push 0xdc
call fcn.0040affb
test al, al
jne 0x437e25
inc edi
cmp edi, dword [0x4f8e00]
jb 0x437dfc
jmp 0x437e38
mov eax, dword [0x4f8e08]
mov ecx, dword [0x531bd8]
push dword [eax + edi*4]
call fcn.004383d0
or dword [ebp - 4], 0xffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [esi + 0x10]
mov ecx, 0x50bb88
push dword [esi + 8]
call fcn.00438bcd
mov ecx, esi
call fcn.004383a2
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x437f4f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push dword [ebp + 8]
xor ebx, ebx
mov esi, ecx
mov ecx, dword [0x531bd8]
push ebx
push 0x64
call fcn.00406ad0
cmp dword [esi + 0x18], ebx
jne 0x437f7c
test eax, eax
je 0x437f7c
mov ecx, eax
call fcn.0043859b
mov dword [esi + 0x18], eax
cmp dword [esi + 4], 0xffffffff
jne 0x437fb3
push ebx
push 0x80
push 2
push ebx
push 1
push 0x40000000
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
jne 0x437fb3
push dword [ebp + 8]
mov ecx, dword [0x531bd8]
call fcn.004364c3
jmp 0x438001
push dword [ebp + 8]
mov ecx, dword [0x531bd8]
push ebx
push ebx
push 0x78
call fcn.00437577
mov ebx, dword [ebp + 0x10]
mov dword [esi + 0x1c], eax
test ebx, ebx
je 0x437feb
and dword [ebp + 0x10], 0
lea eax, [ebp + 0x10]
push 0
push eax
push ebx
push dword [ebp + 0xc]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp + 0x10], ebx
jne 0x437fa3
push dword [esi + 0x10]
mov ecx, 0x50bb88
push dword [esi + 0x18]
push dword [esi + 0x1c]
push dword [esi + 8]
call fcn.00438def
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x438043
Capabilities:
Delete file

Disassembly:
mov eax, 0x4c6c31
call fcn.0049911c
push ecx
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 4], 0xffffffff
je 0x43806b
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebx, 0x50bb64
push ebx
mov dword [ebp - 0x10], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
and dword [ebp - 4], 0
xor ecx, ecx
mov edx, dword [0x4f8e00]
test edx, edx
je 0x4380af
mov edi, dword [ebp + 8]
mov eax, dword [0x4f8e08]
cmp dword [eax + ecx*4], edi
je 0x43809e
inc ecx
cmp ecx, edx
jb 0x43808d
jmp 0x4380af
push ecx
mov ecx, 0x4f8dfc
call fcn.0040c13d
mov edx, dword [0x4f8e00]
xor edi, edi
test edx, edx
je 0x4380f1
mov eax, dword [0x4f8e08]
mov ecx, dword [0x531bd8]
push dword [eax + edi*4]
push 0
push 0xdc
call fcn.0040affb
test al, al
jne 0x4380de
inc edi
cmp edi, dword [0x4f8e00]
jb 0x4380b5
jmp 0x4380f1
mov eax, dword [0x4f8e08]
mov ecx, dword [0x531bd8]
push dword [eax + edi*4]
call fcn.004383d0
or dword [ebp - 4], 0xffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [esi + 0x10]
mov ecx, 0x50bb88
push dword [ebp + 0xc]
push dword [esi + 8]
call fcn.00438f0c
mov ecx, esi
call fcn.004383a2
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0x43804f
Capabilities:
Delete file

Disassembly:
mov eax, 0x4c6c31
call fcn.0049911c
push ecx
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 4], 0xffffffff
je 0x43806b
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebx, 0x50bb64
push ebx
mov dword [ebp - 0x10], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
and dword [ebp - 4], 0
xor ecx, ecx
mov edx, dword [0x4f8e00]
test edx, edx
je 0x4380af
mov edi, dword [ebp + 8]
mov eax, dword [0x4f8e08]
cmp dword [eax + ecx*4], edi
je 0x43809e
inc ecx
cmp ecx, edx
jb 0x43808d
jmp 0x4380af
push ecx
mov ecx, 0x4f8dfc
call fcn.0040c13d
mov edx, dword [0x4f8e00]
xor edi, edi
test edx, edx
je 0x4380f1
mov eax, dword [0x4f8e08]
mov ecx, dword [0x531bd8]
push dword [eax + edi*4]
push 0
push 0xdc
call fcn.0040affb
test al, al
jne 0x4380de
inc edi
cmp edi, dword [0x4f8e00]
jb 0x4380b5
jmp 0x4380f1
mov eax, dword [0x4f8e08]
mov ecx, dword [0x531bd8]
push dword [eax + edi*4]
call fcn.004383d0
or dword [ebp - 4], 0xffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [esi + 0x10]
mov ecx, 0x50bb88
push dword [ebp + 0xc]
push dword [esi + 8]
call fcn.00438f0c
mov ecx, esi
call fcn.004383a2
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x43a029
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x61c
test byte [ebp + 0xc], 1
push ebx
jne 0x43a043
mov eax, 0x80020003
jmp 0x43a245
push esi
push edi
mov edi, dword [ebp + 0x10]
mov ecx, dword [edi + 8]
lea esi, [ecx - 1]
cmp esi, 2
ja 0x43a23e
mov edx, dword [edi]
mov eax, ecx
add eax, eax
push 8
pop ebx
cmp word [edx + eax*8 - 0x10], bx
je 0x43a06e
mov eax, dword [ebp + 0x18]
mov dword [eax], esi
jmp 0x43a09e
cmp ecx, 2
jb 0x43a083
lea eax, [ecx - 2]
add eax, eax
cmp word [edx + eax*8], bx
je 0x43a083
add ecx, 0xfffffffe
jmp 0x43a099
push 0xb
pop ebx
cmp ecx, 3
jb 0x43a0a8
lea eax, [ecx - 3]
add eax, eax
cmp word [edx + eax*8], bx
je 0x43a0a8
add ecx, 0xfffffffd
mov eax, dword [ebp + 0x18]
mov dword [eax], ecx
mov eax, 0x80020005
jmp 0x43a243
mov esi, dword [ebp + 0x14]
test esi, esi
je 0x43a0b9
push esi
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov word [esi], bx
mov ebx, dword [ebp + 8]
mov ecx, 0x4f8e10
push 0
push 2
push dword [ebx + 0xc]
push dword [ebx + 4]
push str.downloadmedia
push str.downloader
call fcn.0043c134
cmp eax, 1
jne 0x43a230
or eax, 0xffffffff
test esi, esi
je 0x43a0ee
mov word [esi + 8], ax
mov eax, dword [edi + 8]
mov ecx, dword [edi]
add eax, eax
cmp dword [edi + 8], 2
mov edx, dword [ecx + eax*8 - 8]
mov dword [ebp + 0xc], edx
jb 0x43a108
mov edi, dword [ecx + eax*8 - 0x18]
jmp 0x43a111
push edx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov edi, eax
push edi
call fcn.00438603
push edi
call fcn.00437c91
pop ecx
pop ecx
test al, al
jne 0x43a13d
push edi
call fcn.00437d3a
pop ecx
test al, al
jne 0x43a13d
push edi
call fcn.00437d1d
pop ecx
test al, al
je 0x43a230
push 0x208
lea eax, [ebp - 0x214]
push 0
push eax
call fcn.0049a3b0
mov ecx, dword [ebx + 0xc]
lea eax, [ebp - 0x214]
add esp, 0xc
push eax
call fcn.004379f2
push eax
push dword [ebx + 4]
call fcn.00437a0d
add esp, 0xc
test al, al
je 0x43a230
push 0x200
xor ebx, ebx
lea eax, [ebp - 0x61c]
push ebx
push eax
call fcn.0049a3b0
add esp, 0xc
lea eax, [ebp - 0x214]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x208
lea eax, [ebp - 0x41c]
push ebx
push eax
call fcn.0049a3b0
add esp, 0xc
lea eax, [ebp - 0x214]
push edi
push eax
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push ebx
push ebx
push dword [ebp + 0xc]
call fcn.00404fb9
mov esi, eax
lea eax, [ebp - 0x61c]
push 0x100
push eax
push 0x1a3
call fcn.00441947
push eax
lea eax, [ebp - 0x41c]
push eax
push esi
push dword [0x531f70]
call fcn.004314f7
push esi
call fcn.004a1b5f
or dword [ebp - 8], 0xffffffff
lea eax, [ebp - 0x41c]
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0x1711
call fcn.0048d08a
push ebx
push 0x709
call fcn.0048d08a
add esp, 0x3c
jmp 0x43a23a
test esi, esi
je 0x43a23a
xor eax, eax
mov word [esi + 8], ax
xor eax, eax
jmp 0x43a243
mov eax, 0x8002000e
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x43c134
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
cmp dword [ebp + 0xc], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 4], ecx
je 0x43c19b
push 0x200
lea eax, [ebp - 0x214]
push 0
push eax
call fcn.0049a3b0
push ebx
push dword [ebp + 0xc]
lea eax, [ebp - 0x214]
push 0x4d2a68
push 0x200
push eax
call fcn.0040433e
add esp, 0x20
lea eax, [ebp - 0x214]
push 0x503d88
push 0xffffffffffffffff
push eax
push edi
call esi
cmp eax, 0xffffffff
jne 0x43c1d9
test ebx, ebx
je 0x43c1af
push 0x503d88
push 0xffffffffffffffff
push ebx
push edi
call esi
cmp eax, 0xffffffff
jne 0x43c1d9
push 0x503d88
push dword [ebp + 0x18]
push edi
push edi
call esi
mov esi, eax
cmp esi, 0xffffffff
je 0x43c1c7
cmp esi, 2
jne 0x43c1d7
mov ecx, dword [ebp - 4]
push edi
call fcn.0043c3b3
test al, al
je 0x43c1e0
xor esi, esi
inc esi
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x18
cmp esi, 0xffffffff
je 0x43c1ea
cmp esi, 2
jne 0x43c1d7
cmp dword [ebp + 0x18], 0xffffffff
je 0x43c1d7
test ebx, ebx
je 0x43c1d7
xor eax, eax
xor ebx, ebx
mov dword [ebp + 0x10], eax
inc ebx
mov ecx, dword [0x531bbc]
push eax
push 0x6a736163
push 0
push 0x28
call fcn.0040ea78
inc dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x43c1d7
push ebx
push 0
push 0x12c
mov ecx, eax
call fcn.00406ad0
mov dword [ebp - 8], eax
test eax, eax
je 0x43c275
cmp dword [ebp + 0x14], 0
je 0x43c243
mov ecx, dword [ebp + 0x14]
call fcn.0043c398
test eax, eax
jne 0x43c24c
mov ecx, dword [ebp - 4]
push edi
call fcn.0043c34a
push dword [ebp + 0x1c]
mov ecx, dword [ebp - 8]
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
push 0
push ebx
call fcn.0042908b
mov ecx, eax
mov dword [ebp - 0x14], eax
and ecx, 0xfff
mov dword [ebp - 0x10], ecx
jne 0x43c28d
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
push eax
push 0
push 0x136
call fcn.00406ad0
mov eax, dword [ebp + 0x10]
jmp 0x43c1fc
push dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
push 0
push 0x136
call fcn.00406ad0
mov eax, dword [ebp - 0x10]
sub eax, 1
je 0x43c2b6
sub eax, 1
je 0x43c2b4
mov eax, dword [ebp + 0x18]
jmp 0x43c1d9
xor ebx, ebx
mov esi, dword [ebp - 0x14]
mov ecx, esi
and ecx, 0x4000
test esi, 0x1000
je 0x43c2df
xor eax, eax
test ecx, ecx
mov ecx, dword [ebp - 4]
cmove eax, dword [ebp + 0xc]
push ebx
push edi
push eax
push dword [ebp + 8]
call fcn.0043c432
test esi, 0x2000
je 0x43c2f5
mov ecx, dword [ebp - 4]
push ebx
push edi
push 0
push 0
call fcn.0043c432
mov eax, ebx
jmp 0x43c1d9
Function at 0x43ca68
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push edi
push 0x56a
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
test edi, edi
je 0x43cb06
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push esi
xor esi, esi
push esi
push esi
push 0xb
push edi
call ebx
push 0x8040
push esi
push esi
push 1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_LoadImageW]
mov esi, eax
push esi
push 1
push 0x172
push edi
call ebx
test eax, eax
je 0x43cac2
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
test esi, esi
je 0x43cadd
push 0
push 1
push 0x173
push edi
call ebx
cmp eax, esi
je 0x43cadd
push esi
call dword [sym.imp.GDI32.dll_DeleteObject]
push 0
push 1
push 0xb
push edi
call ebx
neg esi
sbb esi, esi
and esi, 8
push esi
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebx
test eax, eax
je 0x43cb06
push 1
push 0
push edi
call dword [sym.imp.USER32.dll_InvalidateRect]
pop edi
pop ebp
ret
Function at 0x4406a0
Capabilities:
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x61c
cmp dword [0x531e9c], 0
push ebx
push esi
push edi
jne 0x44084c
xor edi, edi
push edi
push str.WinampAgentMain
call dword [sym.imp.USER32.dll_FindWindowW]
push 0x208
mov ebx, eax
lea eax, [ebp - 0x414]
push edi
push eax
call fcn.0049a3b0
add esp, 0xc
push ebx
call dword [sym.imp.USER32.dll_IsWindow]
xor esi, esi
inc esi
test eax, eax
je 0x440702
cmp dword [0x50bc0c], edi
jne 0x440735
push edi
push esi
push 0x410
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x50bc0c], edi
jne 0x440735
push 0x5011d8
push str._swinampa.lng
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.0040adba
add esp, 0x10
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.0041267e
cmp dword [0x50bc0c], edi
jne 0x440777
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
push edi
mov dword [0x50bc0c], esi
call fcn.004412ff
mov esi, eax
pop ecx
pop ecx
mov dword [0x50bc10], esi
cmp dword [ebp - 4], edi
jne 0x44076d
push edi
call fcn.00440c01
pop ecx
jmp 0x44077f
xor eax, eax
mov word [0x503568], ax
jmp 0x44077f
mov esi, dword [0x50bc10]
mov ebx, edi
push 0x208
lea eax, [ebp - 0x61c]
push edi
push eax
call fcn.0049a3b0
add esp, 0xc
lea eax, [ebp - 0x61c]
push 0x104
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push edi
lea eax, [ebp - 0x61c]
push 0x4d2ff0
push eax
call fcn.00476935
add esp, 0xc
mov dword [ebp - 4], eax
test eax, eax
je 0x4407cf
push eax
call dword [sym.imp.USER32.dll_CharNextW]
mov dword [ebp - 4], eax
cmp word [0x503f90], di
je 0x44084c
test esi, esi
je 0x44084c
mov ecx, dword [0x531bf4]
lea esi, [ebp + 0xc]
sub esp, 0x10
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.0043fe44
mov esi, eax
test esi, esi
jne 0x440856
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea eax, [ebp - 0x20c]
push 0x104
push dword [ebp - 4]
push eax
call esi
xor edi, edi
lea eax, [ebp - 0x20c]
push edi
push 0x4cb7a8
push eax
call fcn.00476935
add esp, 0xc
push 0x104
push str..lng
push eax
call esi
mov ecx, dword [0x531bf4]
lea eax, [ebp - 0x20c]
push eax
call fcn.0043ff4f
mov esi, eax
test esi, esi
jne 0x440858
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret 0x14
xor edi, edi
push ebx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4408b6
push 0x208
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.0049a3b0
push 0x5043a0
push str._swinampa.lng
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0040adba
add esp, 0x1c
lea eax, [ebp - 0x414]
push edi
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push edi
push edi
push 0x410
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, esi
jmp 0x44084f
Function at 0x4408ba
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
lea eax, [ebp - 8]
push edi
push 4
push eax
xorps xmm0, xmm0
mov edi, ecx
push 0x59
push 0x400
movlpd qword [ebp - 0x18], xmm0
movlpd qword [ebp - 8], xmm0
movlpd qword [ebp - 0x10], xmm0
call esi
push 4
lea eax, [ebp - 0x10]
push eax
push 0x5a
push 0x400
call esi
push 1
mov ecx, edi
call fcn.004401e3
push eax
lea eax, [ebp - 8]
push eax
call fcn.0049e71a
pop ecx
pop ecx
test eax, eax
jne 0x44095c
push 2
mov ecx, edi
call fcn.004401e3
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0049e71a
pop ecx
pop ecx
test eax, eax
jne 0x44095c
push 4
lea eax, [ebp - 0x18]
push eax
push 3
push 0x400
call esi
test eax, eax
je 0x44095c
push 1
call fcn.004aa7fd
lea eax, [ebp - 0x18]
push eax
push 4
call fcn.004aae00
add esp, 0xc
neg eax
sbb eax, eax
neg eax
jmp 0x44095e
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x440c01
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [0x531bf4]
sub esp, 0x6b4
push ebx
xor ebx, ebx
test ecx, ecx
je 0x440ddb
push esi
push edi
push ebx
call fcn.004401e3
mov esi, dword [ebp + 8]
mov edi, eax
test edi, edi
jne 0x440c34
test esi, esi
je 0x440dd9
push 0x208
lea eax, [ebp - 0x464]
push 0
push eax
call fcn.0049a3b0
push 0x208
lea eax, [ebp - 0x25c]
push 0
push eax
call fcn.0049a3b0
add esp, 0x18
lea eax, [ebp - 0x464]
test esi, esi
jne 0x440c76
push edi
push 0x503b80
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
jmp 0x440c87
push 0x104
push 0x5043a0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0x4d2f38
lea eax, [ebp - 0x464]
push eax
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 0x250
lea eax, [ebp - 0x6b4]
push 0
push eax
call fcn.0049a3b0
add esp, 0xc
lea eax, [ebp - 0x6b4]
push eax
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x440dd9
xor ebx, ebx
inc ebx
lea eax, [ebp - 0x688]
push eax
lea eax, [ebp - 0x464]
push eax
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 0x14
push ebx
call fcn.004a1b54
mov esi, eax
lea eax, [ebp - 0x25c]
push eax
call fcn.004a1860
add esp, 0xc
mov dword [esi], eax
push str.omBrowser.lng
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x440d33
push str.ml_online.lng
push dword [esi]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x440d33
xor cl, cl
jmp 0x440d35
mov cl, bl
push 0x22
xor eax, eax
test cl, cl
pop edx
cmove eax, edx
push eax
push 0
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - 4], eax
mov dword [esi + 0x10], eax
test eax, eax
jne 0x440d70
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi + 0x10], eax
mov dword [ebp - 4], eax
test eax, eax
je 0x440dbc
push 0x4e
lea eax, [ebp - 0x54]
push 0
push eax
call fcn.0049a3b0
add esp, 0xc
lea eax, [ebp - 0x54]
push 0x27
push eax
push 0xffff
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x440db1
lea eax, [ebp - 0x54]
mov dword [esi + 0xc], ebx
push eax
call fcn.004a1860
push dword [esi + 0x10]
mov dword [esi + 4], eax
call fcn.004401b8
pop ecx
pop ecx
push esi
mov ecx, 0x50bc18
call fcn.00406a4d
lea eax, [ebp - 0x6b4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x440cd8
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret

Function at 0x441071
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword [0x531bf4]
jmp fcn.004408ba
Function at 0x4410b7
Capabilities:
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
cmp dword [0x50bc0c], 0
je 0x441193
push ebx
push esi
xor ebx, ebx
push ebx
push str.WinampAgentMain
call dword [sym.imp.USER32.dll_FindWindowW]
push 0x208
mov esi, eax
lea eax, [ebp - 0x208]
push ebx
push eax
call fcn.0049a3b0
add esp, 0xc
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x44110e
push ebx
push 1
push 0x410
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x5011d8
push str._swinampa.lng
lea eax, [ebp - 0x208]
push 0x104
push eax
call fcn.0040adba
add esp, 0x10
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp + 8], ebx
je 0x441191
push 0x208
lea eax, [ebp - 0x410]
push ebx
push eax
call fcn.0049a3b0
push 0x5043a0
push str._swinampa.lng
lea eax, [ebp - 0x410]
push 0x104
push eax
call fcn.0040adba
add esp, 0x1c
lea eax, [ebp - 0x208]
push ebx
push eax
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push ebx
push ebx
push 0x410
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
pop esi
pop ebx
leave
ret
Function at 0x444907
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
mov ebx, dword [sym.imp.USER32.dll_LoadIconW]
xorps xmm0, xmm0
push esi
push edi
mov edi, dword [ebp + 8]
push 0x66
push edi
movlpd qword [ebp - 0x48], xmm0
movlpd qword [ebp - 0x34], xmm0
mov dword [ebp - 0x50], 8
mov dword [ebp - 0x40], edi
call ebx
and dword [ebp - 0x38], 0
mov esi, dword [sym.imp.USER32.dll_RegisterClassW]
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x50]
push eax
mov dword [ebp - 0x4c], 0x484702
mov dword [ebp - 0x2c], str.WinampVis
call esi
test ax, ax
je 0x444a25
lea eax, [ebp - 0x50]
mov dword [ebp - 0x4c], 0x47c891
push eax
mov dword [ebp - 0x2c], str.Winamp_Video
call esi
test ax, ax
je 0x444a25
and dword [ebp - 0x14], 0
xorps xmm0, xmm0
push 0x66
push edi
movlpd qword [ebp - 0x20], xmm0
movlpd qword [ebp - 0xc], xmm0
mov dword [ebp - 0x28], 8
mov dword [ebp - 0x18], edi
call ebx
mov edi, eax
mov dword [ebp - 0x24], 0x4226f6
lea eax, [ebp - 0x28]
mov dword [ebp - 0x14], edi
xor ebx, ebx
mov dword [ebp - 4], str.Winamp_Gen
push eax
mov dword [ebp - 0x10], ebx
call esi
test ax, ax
je 0x444a25
or dword [ebp - 0x28], 3
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x24], 0x42465b
mov dword [ebp - 4], str.Winamp_EQ
call esi
test ax, ax
je 0x444a25
lea eax, [ebp - 0x28]
mov dword [ebp - 0x24], 0x45a835
push eax
mov dword [ebp - 4], str.Winamp_PE
call esi
test ax, ax
je 0x444a25
push ebx
push 0x444902
push ebx
push 0xb0
push dword [0x531f80]
call dword [sym.imp.USER32.dll_CreateDialogParamW]
push edi
mov esi, eax
push 0xfffffffffffffff2
push esi
call dword [sym.imp.USER32.dll_SetClassLongW]
push esi
call dword [sym.imp.USER32.dll_DestroyWindow]
xor eax, eax
inc eax
jmp 0x444a27
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret