joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e0f2
Capabilities:
Delete file

Disassembly:
push esi
push edi
mov edi, 0x104
push edi
call fcn.00401000
mov esi, eax
test esi, esi
je 0x41e1a1
push ebx
push ebp
push 0x445f80
push edi
push esi
mov ebp, str.RegUserIniFolder
push ebp
mov ebx, str.Config
push ebx
call fcn.00401089
push str..ini
push esi
call fcn.00402610
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 2
push 0x4445b8
push 0x43bc5c
push 0
push edi
mov edi, dword [esp + 0x28]
push esi
push edi
call fcn.00404d0a
test eax, eax
je 0x41e199
push esi
push ebp
push ebx
call fcn.00401134
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x66
push edi
call fcn.00403580
xor ebx, ebx
mov ebp, eax
cmp ebp, ebx
mov dword [esp + 0x14], ebx
jle 0x41e199
push 0
push ebx
push 0x66
push edi
call fcn.00403726
test eax, eax
je 0x41e194
push esi
push dword [esp + 0x18]
push eax
call fcn.0041d89c
inc dword [esp + 0x14]
inc ebx
cmp ebx, ebp
jl 0x41e176
push esi
call fcn.00401019
pop ebp
pop ebx
pop edi
pop esi
ret 4

Function at 0x41fb86
Capabilities:
Enumerate files on windows
Move file

Disassembly:
push ecx
and dword [esp], 0
push esi
push 0x44c
call fcn.00401000
mov esi, eax
test esi, esi
je 0x41fcbb
push ebx
push ebp
push edi
push 0
push dword [esp + 0x20]
lea edi, [esi + 0x104]
lea ebx, [edi + 0x104]
push esi
lea ebp, [ebx + 0x104]
call fcn.0040b4bf
push esi
call fcn.004040bc
cmp eax, 2
je 0x41fbe1
push 0
push 0x43bff8
push dword [esp + 0x20]
call fcn.0040258f
jmp 0x41fcb8
push 0x43bff0
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [esp + 0x1c], eax
cmp eax, 0xffffffff
je 0x41fc53
lea eax, [ebx + 0x104]
test byte [eax], 0x10
jne 0x41fc34
add eax, 0x2c
push eax
push esi
call fcn.00402610
push eax
call ebp
push esi
push edi
call ebp
push str..bak
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileA]
lea eax, [ebx + 0x104]
push eax
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41fc04
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_FindClose]
push esi
call fcn.00402610
push str.7_epp___q05_18q_:q4_pSZQ_Mp_PHQpYVQ_ROlqZGZ
push ebx
mov byte [eax], 0
call ebp
push str.BoardHtm3.zip
push ebx
call fcn.0040262f
push eax
call ebp
push 1
push edi
call fcn.00418d59
push str.BoardHtm3.zip
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
xor ebp, ebp
push ebp
push ebp
push edi
push ebx
push dword [esp + 0x28]
call fcn.0041ae32
test eax, eax
je 0x41fcb8
xor ebx, ebx
inc ebx
push ebx
push ebp
push esi
push 0x4445b4
push ebx
push ebp
push edi
push dword [esp + 0x34]
call fcn.0040f37f
test eax, eax
jne 0x41fcb8
mov dword [esp + 0x10], ebx
pop edi
pop ebp
pop ebx
push esi
call fcn.00401019
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 8
Function at 0x4227d0
Capabilities:
Create process on windows
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
push edi
push 0x30c
call fcn.00401000
mov edi, eax
test edi, edi
je 0x422917
push ebx
push esi
lea esi, [edi + 0x104]
lea eax, [esi + 0x104]
mov ebx, 0x104
push ebx
push eax
push 0x74
push dword [ebp + 8]
mov dword [ebp - 0xc], eax
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
push dword [ebp + 0xc]
push ebx
push edi
push dword [ebp + 0xc]
push str.Config
call fcn.00401089
push edi
call fcn.00404046
test eax, eax
jne 0x4228d2
and dword [ebp - 4], eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
test eax, eax
je 0x4228a3
cmp byte [esi], 0
je 0x4228a3
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
jne 0x42288e
push dword [ebp + 0xc]
movsx eax, byte [esi]
push eax
push 0x43c478
push edi
call ebx
add esp, 0x10
push edi
push 0x74
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp + 0xc]
push edi
call fcn.004041d3
mov dword [ebp - 4], eax
test eax, eax
jne 0x4228c4
push 1
push esi
call fcn.00401405
mov esi, eax
cmp byte [esi], 0
jne 0x42284c
cmp dword [ebp - 4], 0
jne 0x4228c4
cmp byte [ebp + 0x10], 0
je 0x4228fe
push dword [ebp + 0xc]
push str._s:
push edi
call ebx
add esp, 0xc
push 0
push edi
push dword [ebp + 8]
call fcn.0040258f
jmp 0x4228fe
push edi
push dword [ebp + 0xc]
push str.Config
call fcn.00401134
mov esi, dword [ebp + 0x14]
test esi, esi
je 0x4228ee
cmp byte [esi], 0
je 0x4228ee
push 0x20
push edi
call fcn.00401255
push esi
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 5
push edi
call dword [sym.imp.KERNEL32.dll_WinExec]
mov dword [ebp - 8], 1
push dword [ebp - 0xc]
push 0x74
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
push edi
call fcn.00401019
mov eax, dword [ebp - 8]
pop esi
pop ebx
pop edi
leave
ret 0x10

Function at 0x42291c
Capabilities:
Get common file path

Disassembly:
push ebx
push ebp
push edi
push 0x445f80
mov ebx, 0x104
push ebx
push esi
mov edi, str.WINAMP.EXE
push edi
mov ebp, str.Config
push ebp
call fcn.00401089
cmp byte [esi], 0
je 0x42294b
push esi
call fcn.00404046
test eax, eax
jne 0x4229b3
push ebx
push esi
push str.UninstallString
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallWinamp
push reloc.WS2_32.dll_bind
call fcn.00405096
test eax, eax
je 0x422982
cmp byte [esi], 0x22
jne 0x422972
push 0
push esi
call fcn.004012af
push edi
push esi
call fcn.00402610
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x4229a1
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.Program_FilesWinamp_
lea eax, [esi + 2]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push esi
call fcn.00404046
test eax, eax
je 0x4229b3
push esi
push edi
push ebp
call fcn.00401134
pop edi
pop ebp
pop ebx
ret
Function at 0x422dc4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
push edi
call ebx
mov dword [ebp - 4], eax
call ebx
sub eax, dword [ebp - 4]
cmp eax, 0x1388
jae 0x422e56
mov esi, dword [sym.imp.USER32.dll_GetWindow]
push 5
push dword [ebp + 8]
call esi
push 0
push dword [ebp + 0xc]
mov edi, eax
push dword [ebp + 8]
push edi
call fcn.00422d6a
test eax, eax
jne 0x422e58
push eax
push str.ComboBoxEx32
push dword [ebp + 8]
push edi
call fcn.00422d6a
test eax, eax
je 0x422e42
push 0
push str.ComboBox
push eax
push 5
push eax
call esi
push eax
call fcn.00422d6a
test eax, eax
je 0x422e42
push 0
push dword [ebp + 0xc]
push eax
push 5
push eax
call esi
push eax
call fcn.00422d6a
test eax, eax
jne 0x422e58
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
call ebx
sub eax, dword [ebp - 4]
cmp eax, 0x1388
jb 0x422de8
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x422e5f
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push esi
push edi
push dword [0x446178]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x422f38
mov edi, dword [sym.imp.USER32.dll_GetWindow]
push 0
push dword [0x446178]
jmp 0x422f2c
push 0x50
lea eax, [ebp - 0x50]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClassNameA]
push esi
call dword [sym.imp.USER32.dll_GetParent]
cmp eax, dword [0x446178]
jne 0x422f29
push str.32770
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x422f29
push 0x50
lea eax, [ebp - 0x50]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0x43c5fc
lea eax, [ebp - 0x50]
push eax
call fcn.00401956
cmp eax, 0xffffffff
jne 0x422f3e
push str.SHOUTcast
lea eax, [ebp - 0x50]
push eax
call fcn.00401956
cmp eax, 0xffffffff
jne 0x422f3e
push 0x43c5e4
lea eax, [ebp - 0x50]
push eax
call fcn.00401956
cmp eax, 0xffffffff
jne 0x422f3e
push 0x43c5d4
lea eax, [ebp - 0x50]
push eax
call fcn.00401956
cmp eax, 0xffffffff
jne 0x422f3e
push 0x43c5cc
lea eax, [ebp - 0x50]
push eax
call fcn.00401956
cmp eax, 0xffffffff
jne 0x422f3e
push 2
push esi
call edi
mov esi, eax
test esi, esi
jne 0x422e8e
xor eax, eax
pop edi
pop esi
leave
ret
mov eax, esi
jmp 0x422f3a
Function at 0x422f42
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
and dword [ebp - 4], 0
push ebx
push esi
mov esi, 0x3f0
push edi
mov ebx, esi
call fcn.00422e5f
mov edi, eax
test edi, edi
je 0x423014
push esi
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push edi
call esi
test eax, eax
jne 0x422f9d
push 1
push str.32770
push edi
push 5
push edi
call dword [sym.imp.USER32.dll_GetWindow]
push eax
call fcn.00422d6a
mov edi, eax
test edi, edi
je 0x423014
lea eax, [ebx - 2]
push eax
push edi
mov ebx, eax
call esi
lea ecx, [ebp - 0x2c]
push ecx
push 0x28
push 0xd
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [ebp + 8], 0
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpA]
lea eax, [ebp - 0x2c]
je 0x422fce
push str.Connect
push eax
call esi
test eax, eax
je 0x422ff8
push 0x43c634
jmp 0x422fee
push 0x43c62c
push eax
call esi
test eax, eax
je 0x422ff8
push str.Disconnect
lea eax, [ebp - 0x2c]
push eax
call esi
test eax, eax
je 0x422ff8
push 0x43c614
lea eax, [ebp - 0x2c]
push eax
call esi
test eax, eax
jne 0x423014
cmp dword [ebp + 0xc], 0
je 0x42300d
push 0
push ebx
push 0x111
push edi
call dword [sym.imp.USER32.dll_PostMessageA]
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x42301e
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x104
push ebx
call fcn.00422e5f
mov ebx, eax
test ebx, ebx
je 0x4230b5
push ebp
push esi
push edi
mov esi, 0x3f6
push esi
push ebx
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebp, 0x111
test eax, eax
je 0x423064
push 0
push esi
push ebx
call dword [sym.imp.USER32.dll_CheckDlgButton]
push 0
push esi
push ebp
push ebx
call edi
push 0x3f5
push ebx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
lea eax, [esp + 0x10]
push eax
push 0x104
push 0xd
push esi
call edi
push dword [0x446424]
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x4230b2
push dword [0x446424]
push 0
push 0xc
push esi
call edi
push 0
push 0x3ec
push ebp
push ebx
call dword [sym.imp.USER32.dll_PostMessageA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
Function at 0x4230bd
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
call fcn.00422e5f
mov dword [ebp - 4], eax
test eax, eax
je 0x4231f2
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push edi
lea ecx, [ebp - 0x2c]
push ecx
push 0x28
push 0xd
push 0x3f0
push eax
call esi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpA]
push str.Disconnect
lea eax, [ebp - 0x2c]
push eax
call ebx
test eax, eax
je 0x42311d
push 0x43c614
lea eax, [ebp - 0x2c]
push eax
call ebx
test eax, eax
jne 0x4231ef
lea eax, [ebp - 0x2c]
push eax
push 0x28
push 0xd
push 0x3ea
push dword [ebp - 4]
call esi
push eax
call edi
xor esi, esi
push esi
lea eax, [ebp - 0x2c]
push eax
call fcn.00401547
push esi
push esi
push 0xf2
push 0x3fc
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
and eax, 4
cmp dword [0x44645c], eax
je 0x423171
mov dword [0x446458], esi
mov dword [0x446454], esi
mov dword [0x44645c], eax
cmp eax, esi
jne 0x423181
mov eax, dword [0x444bd8]
mov ecx, 0x1008
jmp 0x423197
mov eax, dword [0x444bdc]
xor ecx, ecx
cmp byte [0x446132], cl
sete cl
add ecx, 0x1002
cmp edi, dword [0x446170]
jl 0x4231b7
inc dword [0x446458]
cmp dword [0x446458], 2
mov dword [0x446454], esi
jl 0x4231ef
push esi
jmp 0x4231de
cmp edi, dword [0x444bd0]
mov dword [0x446458], esi
jge 0x4231e9
mov edx, dword [0x444bd4]
inc dword [0x446454]
imul edx, edx, 0xa
cmp dword [0x446454], edx
jl 0x4231ef
push 1
push eax
push 1
push ecx
call fcn.0040b221
jmp 0x4231ef
mov dword [0x446454], esi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4246e0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x50
push ebx
push ebp
mov ebp, dword [sym.imp.USER32.dll_GetWindow]
push esi
push edi
push 0
push dword [esp + 0x68]
call ebp
mov esi, eax
test esi, esi
je 0x424778
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpA]
mov edi, str.TPanel
push 0x50
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0x43c7e8
lea eax, [esp + 0x14]
push eax
call ebx
test eax, eax
jne 0x42476d
push 0x50
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClassNameA]
push str.TFormMain
lea eax, [esp + 0x14]
push eax
call ebx
test eax, eax
jne 0x42476d
push 1
push edi
push esi
call fcn.00424692
test eax, eax
je 0x42476d
push 0
push str.TFormChat
push eax
call fcn.00424692
test eax, eax
je 0x42476d
push 0
push edi
push eax
call fcn.00424692
test eax, eax
jne 0x424784
push 2
push esi
call ebp
mov esi, eax
test esi, esi
jne 0x424706
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret 4
push 0
push edi
push eax
call fcn.00424692
jmp 0x42477a
Function at 0x42478f
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetWindow]
push esi
push edi
push 0
push dword [ebp + 8]
call ebx
mov edi, eax
test edi, edi
je 0x4247f4
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpA]
push 0x50
lea eax, [ebp - 0x50]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0x43c7e8
lea eax, [ebp - 0x50]
push eax
call esi
test eax, eax
jne 0x4247e9
push 0x50
lea eax, [ebp - 0x50]
push eax
push edi
call dword [sym.imp.USER32.dll_GetClassNameA]
push str.TApplication
lea eax, [ebp - 0x50]
push eax
call esi
test eax, eax
je 0x4247fd
push 2
push edi
call ebx
mov edi, eax
test edi, edi
jne 0x4247b1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
mov eax, edi
jmp 0x4247f6

Function at 0x424801
Capabilities:
Check for time delay via gettickcount
Get graphical window text

Disassembly:
sub esp, 0x28
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call esi
mov ebp, eax
call esi
mov edi, 0x2710
jmp 0x424875
push 0
push str.32770
push dword [esp + 0x44]
push dword [esp + 0x48]
call fcn.00422d6a
mov ebx, eax
test ebx, ebx
je 0x42486b
push 0x28
lea eax, [esp + 0x14]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0x43c824
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x424887
push 0x43c80c
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x424887
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
call esi
sub eax, ebp
cmp eax, edi
jb 0x42481b
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 4
mov eax, ebx
jmp 0x42487d

Function at 0x42488b
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call esi
mov ebx, eax
call esi
mov edi, 0x1388
jmp 0x4248bc
push 0
push str.32768
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
jne 0x4248c4
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
call esi
sub eax, ebx
cmp eax, edi
jb 0x4248a1
xor eax, eax
pop edi
pop esi
pop ebx
ret

Function at 0x4248c8
Capabilities:
Check for time delay via gettickcount
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov dword [ebp - 4], eax
call esi
sub eax, dword [ebp - 4]
mov ebx, 0x1388
cmp eax, ebx
jae 0x424937
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push dword [ebp + 0xc]
push 0
push 0xc
push dword [ebp + 8]
call edi
lea eax, [ebp - 0x108]
push eax
push 0x104
push 0xd
push dword [ebp + 8]
mov byte [ebp - 0x108], 0
call edi
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x424936
call esi
sub eax, dword [ebp - 4]
cmp eax, ebx
jb 0x4248f3
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x424b9d
Capabilities:
Delete file

Disassembly:
push ecx
push ebx
push 0xffffffffffffffff
push 0x68
push esi
call fcn.00403619
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x424bc2
push 0
push 0x43ca84
push esi
call fcn.0040258f
jmp 0x424c9d
push edi
push 0x30c
call fcn.00401000
mov edi, eax
test edi, edi
je 0x424c9c
push ebp
push 0x68
push esi
lea ebp, [edi + 0x104]
call fcn.004035eb
push eax
push 0x43ca50
push edi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 1
push edi
push esi
call fcn.0040258f
cmp eax, 1
jne 0x424c95
push eax
push 0x43ca10
push esi
call fcn.0040258f
cmp eax, 1
jne 0x424c95
push 4
push 0x43c9cc
push esi
call fcn.0040258f
cmp eax, 7
jne 0x424c95
mov dword [esp + 0xc], ebx
xor eax, eax
push eax
push eax
push eax
push edi
push ebx
push esi
call fcn.00423cd3
test eax, eax
jl 0x424c79
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x424c5b
push ebx
push 0x68
push esi
mov dword [esp + 0x18], ebx
call fcn.004037b4
dec ebx
jmp 0x424c79
push edi
push 0x43c998
push ebp
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 1
push ebp
push esi
call fcn.0040258f
cmp eax, 1
jne 0x424c89
push ebx
push 0x68
push esi
call fcn.00403619
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x424c2f
push dword [esp + 0xc]
push 0x68
push esi
call fcn.00403648
push edi
call fcn.00401019
pop ebp
pop edi
pop ebx
pop ecx
ret

Function at 0x424d5d
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push dword [ebp + 8]
mov dword [ebp - 4], accept
call fcn.0041d856
mov esi, eax
test esi, esi
jne 0x424d81
mov eax, 0x1e0
jmp 0x424e56
cmp dword [esi + 0x18], 0
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
je 0x424da6
call edi
sub eax, dword [esi + 0x18]
cmp eax, 0x36ee80
jbe 0x424da0
and dword [esi + 0x18], 0
jmp 0x424da6
cmp dword [esi + 0x1c], 0x14
jg 0x424daf
test ebx, ebx
je 0x424dbc
cmp dword [esi + 0x14], ebx
jne 0x424db9
mov eax, 0x191
jmp 0x424e55
mov dword [esi + 0x14], ebx
push dword [ebp + 0xc]
lea eax, [esi + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x424e3e
cmp dword [esi + 0xc], eax
je 0x424dea
call fcn.00418cf6
mov ecx, dword [esi + 0xc]
sub ecx, eax
mov dword [ebp - 4], ecx
test ecx, ecx
jg 0x424dea
mov eax, 0x1eb
jmp 0x424e55
push dword [ebp + 0x10]
movzx edi, word [esi + 0xd6]
lea eax, [esi + 0x90]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esi + 0xd4]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [ebp + 0x18]
mov dword [esi + 0x10], eax
movzx eax, word [esi + 0xd6]
cmp eax, edi
je 0x424e33
mov eax, dword [esi + 0xcc]
jmp 0x424e2f
mov ecx, dword [eax + 8]
mov dword [eax + 0xc], ecx
mov eax, dword [eax]
test eax, eax
jne 0x424e27
and dword [esi + 0x18], 0
mov eax, 0xca
jmp 0x424e55
cmp dword [esi + 0x18], 0
jne 0x424e4d
call edi
and dword [esi + 0x1c], 0
mov dword [esi + 0x18], eax
inc dword [esi + 0x1c]
mov eax, 0x1e1
pop edi
mov ecx, dword [ebp + 0x14]
pop esi
test ecx, ecx
je 0x424e63
mov edx, dword [ebp - 4]
mov dword [ecx], edx
leave
ret 0x14
Function at 0x424e67
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
call fcn.0041d856
mov esi, eax
cmp esi, edi
je 0x424ef0
test byte [esi + 4], 0x40
je 0x424ef0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [esi + 0x18], edi
je 0x424ea1
call ebx
sub eax, dword [esi + 0x18]
cmp eax, 0x36ee80
jbe 0x424ece
mov dword [esi + 0x18], edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpA]
push str.anonymous
push dword [ebp + 8]
call edi
test eax, eax
je 0x424ec5
push dword [ebp + 0xc]
lea eax, [esi + 0x30]
push eax
call edi
test eax, eax
jne 0x424edd
and dword [esi + 0x18], eax
mov dword [ebp - 4], 1
jmp 0x424eef
cmp dword [esi + 0x1c], 0x14
jle 0x424ea1
mov dword [ebp - 4], 0x191
jmp 0x424eef
cmp dword [esi + 0x18], 0
jne 0x424eec
call ebx
and dword [esi + 0x1c], 0
mov dword [esi + 0x18], eax
inc dword [esi + 0x1c]
pop ebx
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret 8
Function at 0x4257d6
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
and dword [ebp - 4], 0
push edi
push 0x7d9
call fcn.00401000
mov edi, eax
test edi, edi
je 0x42595e
push ebx
push esi
push dword [ebp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ebx, [edi + 0x104]
lea eax, [ebx + 0x514]
lea ecx, [eax + 0x140]
push edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], eax
call esi
push edi
call fcn.00402610
push str..mp3
push eax
mov dword [ebp - 0xc], eax
call esi
push dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp + 0x10], eax
cmp eax, 0xffffffff
je 0x42595c
mov eax, dword [ebp - 8]
test byte [eax], 0x10
jne 0x42584d
inc dword [ebp - 4]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x425842
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_FindClose]
push dword [ebp - 4]
push str._playlist__r_nVersion2_r_nNumberOfEntries_d_r_n_r_n
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_wsprintfA]
and dword [ebp - 4], 0
add esp, 0xc
push dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp + 0x10], eax
cmp eax, 0xffffffff
je 0x42595c
mov eax, dword [ebp - 8]
test byte [eax], 0x10
jne 0x425941
add eax, 0x2c
push eax
push dword [ebp - 0xc]
call esi
push dword [ebp - 0x10]
lea eax, [ebx + 0x410]
push 0
push eax
lea eax, [ebx + 0x30c]
push eax
lea eax, [ebx + 0x104]
push eax
push edi
call fcn.00407c38
push 0x445f80
push ebx
call fcn.00418f6f
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push str.HOSTING_
push ebx
mov dword [ebp - 0x14], eax
call esi
mov eax, dword [ebp - 0x14]
add eax, edi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x2f
push 0x5c
push ebx
call fcn.0040199b
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, 0x186a0
sub ecx, eax
cmp ecx, 0x208
jl 0x425953
inc dword [ebp - 4]
lea eax, [ebx + 0x104]
push eax
push dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
push dword [ebp - 4]
push str.File_dhttp:___s__s_UserWebPlayer_r_nTitle_d_PLS___s_r_n
push dword [ebp + 8]
call fcn.004019bf
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [ebp - 8]
add esp, 0x1c
push eax
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x425892
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_FindClose]
pop esi
pop ebx
push edi
call fcn.00401019
mov eax, dword [ebp - 4]
pop edi
leave
ret 0xc