Function at 0x41afca
Capabilities:
Delete file
Move file
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc8c
push ebx
push esi
push edi
lea eax, [ebp - 0x28c]
push 0x45db60
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x28c]
push eax
call sub.MSVCRT.dll_strlen
and byte [ebp + eax - 0x28d], 0
lea eax, [ebp - 0x28c]
push 0x44d7a4
push eax
call sub.MSVCRT.dll_strcat
mov esi, dword [sym.imp.MSVCRT.dll_fopen]
mov edi, 0x44c34c
mov ebx, 0x45ec40
push edi
push ebx
mov dword [ebp - 4], 0x79
call esi
add esp, 0x1c
test eax, eax
je 0x41b03d
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
pop ecx
mov dword [ebp - 4], 0x6e
push 0x6e
lea eax, [ebp - 0xc8c]
push dword [0x44d7f4]
push dword [ebp - 4]
push str.http:__www.winamp.com_update_updatelinks.jhtml_i_cv_sr_c
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push 0
push 0
push 0xf
call fcn.004394a8
push eax
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0xc8c]
push eax
push dword [ebp + 8]
call fcn.004186ed
add esp, 0x30
test eax, eax
jne 0x41b2ed
and dword [ebp - 4], eax
lea eax, [ebp - 0x28c]
push edi
push eax
call esi
pop ecx
mov dword [ebp - 8], eax
mov al, byte [0x450890]
pop ecx
mov byte [ebp - 0x68c], al
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x68b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov esi, str.DefBrowseLoc
lea edi, [ebp - 0x88]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push 0x1c
xor eax, eax
pop ecx
lea edi, [ebp - 0x7b]
rep stosd dword es:[edi], eax
cmp byte [0x450ea4], 0
stosw word es:[edi], ax
stosb byte es:[edi], al
je 0x41b100
lea eax, [ebp - 0x88]
push 0x44d750
push eax
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0x88]
push 0x450ea4
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x10
lea eax, [ebp - 0x88]
push 0x44c49c
push eax
call sub.MSVCRT.dll_strcat
mov esi, dword [ebp - 8]
pop ecx
test esi, esi
pop ecx
je 0x41b2ed
jmp 0x41b1bb
lea eax, [ebp - 0xa8c]
push 0x400
push eax
call dword [sym.imp.MSVCRT.dll_fgets]
lea eax, [ebp - 0xa8c]
push str.Winamp_t
push eax
call sub.MSVCRT.dll_strcmp
add esp, 0x14
test eax, eax
jne 0x41b151
or dword [ebp - 4], 1
push 7
lea eax, [ebp - 0xa8c]
push str.EndFile
push eax
call dword [sym.imp.MSVCRT.dll_strncmp]
add esp, 0xc
test eax, eax
jne 0x41b170
or dword [ebp - 4], 2
lea eax, [ebp - 0x88]
push eax
call sub.MSVCRT.dll_strlen
push eax
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0xa8c]
push eax
call dword [sym.imp.MSVCRT.dll__strnicmp]
add esp, 0x10
test eax, eax
jne 0x41b1bb
lea eax, [ebp - 0x88]
push eax
call sub.MSVCRT.dll_strlen
lea eax, [ebp + eax - 0xa8c]
push eax
lea eax, [ebp - 0x68c]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 0xc
test byte [esi + 0xc], 0x10
push esi
je 0x41b123
call dword [sym.imp.MSVCRT.dll_fclose]
cmp dword [ebp - 4], 3
pop ecx
jne 0x41b2ed
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x28c]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov al, byte [0x450890]
push 0x3f
mov byte [ebp - 0x188], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x187]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x45e580
lea eax, [ebp - 0x188]
push 0x100
mov esi, str.http:__www.winamp.com_update_mb.html
push eax
push esi
push str.MBDefLoc
push 0x44d6f4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 7
lea eax, [ebp - 0x188]
push str.http:__
push eax
call dword [sym.imp.MSVCRT.dll__strnicmp]
add esp, 0xc
test eax, eax
je 0x41b258
lea eax, [ebp - 0x188]
push esi
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
push 0
push 0
push 0xf
call fcn.004394a8
push eax
mov edi, 0x45e6a0
lea eax, [ebp - 0x188]
push edi
push eax
push dword [ebp + 8]
call fcn.004186ed
lea eax, [ebp - 0x188]
push esi
push eax
call sub.MSVCRT.dll_strcmp
add esp, 0x24
test eax, eax
je 0x41b29c
lea eax, [ebp - 0x188]
push eax
lea eax, [ebp - 0x188]
jmp 0x41b2d1
call fcn.004397fc
test eax, eax
je 0x41b2e0
cmp byte [ebp - 0x68c], 0
je 0x41b2d4
lea eax, [ebp - 0x68c]
push 0x44c49c
push eax
call dword [sym.imp.MSVCRT.dll__mbsstr]
pop ecx
test eax, eax
pop ecx
je 0x41b2d4
and byte [eax], 0
inc eax
push eax
lea eax, [ebp - 0x68c]
push eax
jmp 0x41b2e6
push 0x44d6e0
push str.http:__www.winamp.com_browser_
jmp 0x41b2e6
push 0x44d6e0
push edi
call fcn.00425376
pop ecx
pop ecx
lea eax, [ebp - 0x28c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
pop ebx
leave
ret