joyce8/EMBER2024-capa huggingface dataset:
Function at 0x490734
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x4c1238], 0
je 0x490875
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x4bb548]
mov edx, dword [edx]
xor al, byte [edx + 0xbc]
je 0x490875
mov eax, dword [0x4c123c]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x4c1238]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x490844
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x4c1238]
call fcn.00432d94
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x49083c
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1ea], 0
je 0x49083c
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x5c]
test al, al
je 0x49083c
mov eax, dword [ebp - 0x14]
call fcn.0049c114
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x49083c
push ebp
call fcn.004906f0
pop ecx
test al, al
jne 0x49083c
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbb
call fcn.00405034
test al, al
je 0x49083c
mov byte [ebp - 1], 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbc
call fcn.00405034
cmp byte [ebp - 1], 0
je 0x49083c
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x28]
call fcn.0040a778
test al, al
je 0x49083c
mov edx, dword [ebp - 0x14]
mov eax, dword [0x4c123c]
call fcn.0048fe4c
inc edi
dec ebx
jne 0x490799
mov eax, dword [0x4c123c]
cmp dword [eax + 8], 0
jle 0x49085c
mov eax, dword [0x4c123c]
call fcn.0048ff04
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x490875
push ebp
mov eax, dword [ebp - 0x18]
call fcn.00490554
pop ecx
test al, al
jne 0x490875
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x498cc0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffed8
mov ebx, ecx
mov edi, edx
mov esi, eax
call sub.user32.dll_GetMessagePos
call fcn.0040a760
mov dword [esp + 8], eax
movsx eax, word [esp + 8]
mov dword [esp + 0xc], eax
movsx eax, word [esp + 0xa]
mov dword [esp + 0x10], eax
mov ecx, esp
lea edx, [esp + 0xc]
mov eax, esi
call fcn.00492cfc
test ebx, ebx
jne 0x498d13
push 0
push 0
lea edx, [esp + 8]
xor ecx, ecx
mov eax, esi
call fcn.00498b3c
mov ebx, eax
test ebx, ebx
je 0x498e09
cmp esi, ebx
je 0x498d3c
mov eax, dword [esp]
sub eax, dword [ebx + 0x40]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
sub eax, dword [ebx + 0x44]
mov dword [esp + 0x118], eax
jmp 0x498d51
mov eax, dword [esp]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x118], eax
movzx eax, word [edi + 8]
mov dword [esp + 0x11c], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x124], eax
movzx eax, word [edi + 0xa]
cmp eax, 0x201
jge 0x498d89
add eax, 0xffffff5f
sub eax, 2
jb 0x498da1
dec eax
sub eax, 2
jb 0x498db5
dec eax
sub eax, 2
jb 0x498dab
jmp 0x498dbf
add eax, 0xfffffdff
sub eax, 2
jb 0x498da1
dec eax
sub eax, 2
jb 0x498db5
dec eax
sub eax, 2
jb 0x498dab
jmp 0x498dbf
mov byte [esp + 0x120], 0
jmp 0x498dc7
mov byte [esp + 0x120], 2
jmp 0x498dc7
mov byte [esp + 0x120], 1
jmp 0x498dc7
mov byte [esp + 0x120], 0
lea eax, [esp + 0x14]
push eax
call sub.user32.dll_GetKeyboardState
lea eax, [esp + 0x14]
call fcn.0046c844
mov esi, eax
call fcn.0048f5ec
or si, ax
mov word [esp + 0x121], si
lea eax, [esp + 0x114]
push eax
xor ecx, ecx
mov edx, 0xb04b
mov eax, ebx
call fcn.004946bc
mov dword [edi + 0xc], eax
mov al, 1
jmp 0x498e0b
xor eax, eax
add esp, 0x128
pop edi
pop esi
pop ebx
ret
Function at 0x4b0490
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00406c40
xor eax, eax
push ebp
push 0x4b0625
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x4b05f3
xor edx, edx
push ebp
push 0x4b05ec
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00406cac
mov eax, dword [ebp - 8]
test eax, eax
je 0x4b04ff
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x4b04ff
lea eax, [ebp - 8]
mov edx, dword [ebp - 8]
call fcn.004062dc
test eax, eax
je 0x4b0508
sub eax, 4
mov eax, dword [eax]
add eax, eax
add eax, 2
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x4b05c1
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GlobalLock
mov ebx, eax
xor edx, edx
push ebp
push 0x4b05b0
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00406cac
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x4b056a
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x4b056a
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0xc]
call fcn.004062dc
test eax, eax
je 0x4b0573
sub eax, 4
mov eax, dword [eax]
mov esi, eax
add esi, esi
mov eax, dword [ebp - 4]
call fcn.00406ce4
lea ecx, [esi + 2]
mov edx, ebx
call fcn.0040438c
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 0x10]
push eax
push 0xd
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b05b7
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov ecx, dword [0x4bb278]
mov dl, 1
mov eax, dword [0x40d04c]
call fcn.00416a90
call fcn.00405880
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b062c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00406c50
ret
Function at 0x4b1e54
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406734
xor eax, eax
push ebp
push 0x4b1f1c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.004060f0
mov eax, dword [ebp - 4]
test eax, eax
je 0x4b1ea8
mov edx, eax
sub edx, 0xa
cmp word [edx], 1
je 0x4b1ea8
lea eax, [ebp - 4]
xor ecx, ecx
mov edx, dword [ebp - 4]
call fcn.0040630c
test eax, eax
je 0x4b1eb1
sub eax, 4
mov eax, dword [eax]
mov esi, eax
test esi, esi
jle 0x4b1eee
mov edi, 1
mov eax, edi
dec eax
mov ebx, 0xff
sub ebx, eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + edi - 1]
xor ebx, eax
lea eax, [ebp - 0x14]
mov edx, ebx
mov ecx, 0
call fcn.004063c4
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 8]
call fcn.004064bc
inc edi
dec esi
jne 0x4b1ebc
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.00406144
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b1f23
lea eax, [ebp - 0x14]
call fcn.004060f0
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406114
ret

Function at 0x4b1f2c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x10], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b1ff7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4bb2c4]
mov eax, dword [eax + ebx*4]
lea edx, [ebp - 4]
call fcn.004b1dc8
lea eax, [ebp - 8]
call fcn.004060f0
mov eax, dword [ebp - 4]
test eax, eax
je 0x4b1f83
mov edx, eax
sub edx, 0xa
cmp word [edx], 1
je 0x4b1f83
lea eax, [ebp - 4]
xor ecx, ecx
mov edx, dword [ebp - 4]
call fcn.0040630c
test eax, eax
je 0x4b1f8c
sub eax, 4
mov eax, dword [eax]
mov esi, eax
test esi, esi
jle 0x4b1fc9
mov edi, 1
mov eax, edi
dec eax
mov ebx, 0xff
sub ebx, eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + edi - 1]
xor ebx, eax
lea eax, [ebp - 0x14]
mov edx, ebx
mov ecx, 0
call fcn.004063c4
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 8]
call fcn.004064bc
inc edi
dec esi
jne 0x4b1f97
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.00406144
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b1ffe
lea eax, [ebp - 0x14]
call fcn.004060f0
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406114
ret
Function at 0x402aeb
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x49cdd4]
test eax, eax
je 0x402afc
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
ret
push 0
push 0x402797
push dword [0x4ac344]
push 0xf5
call fcn.00471e9c
add esp, 0x10
push 5
push eax
mov dword [0x49cdd4], eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret
Function at 0x405594
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
push edi
xor edi, edi
cmp dword [ebp + 0xc], edi
jne 0x4055ac
xor eax, eax
jmp 0x40567f
push esi
push 8
push edi
push dword [ebp + 0xc]
call sub.NSCRT.dll_memset
add esp, 0xc
push edi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov esi, eax
cmp esi, edi
jne 0x4055d2
xor eax, eax
jmp 0x40567e
push ebx
push 0x100
lea eax, [ebp - 0x244]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 7
push edi
push dword [ebp + 8]
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_GetDCEx]
mov ebx, eax
cmp ebx, edi
jne 0x405601
xor eax, eax
jmp 0x40567d
push dword [esi + 0x10]
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
push ebx
call edi
cmp dword [ebp - 4], 0
mov dword [ebp - 8], eax
jne 0x405633
lea eax, [ebp - 0x44]
push eax
push ebx
call dword [sym.imp.GDI32.dll_GetTextMetricsW]
test eax, eax
mov dword [ebp - 4], eax
je 0x40564a
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 4], eax
jmp 0x40564a
push dword [ebp + 0xc]
lea eax, [ebp - 0x244]
push dword [ebp - 4]
push eax
push ebx
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
cmp eax, dword [esi + 0x10]
je 0x405656
push eax
push ebx
call edi
push ebx
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ReleaseDC]
cmp dword [ebp - 4], 0
je 0x40567a
mov ecx, dword [esi + 0x20]
add ecx, dword [esi + 0x18]
mov eax, dword [ebp + 0xc]
add dword [eax], ecx
mov ecx, dword [esi + 0x24]
add ecx, dword [esi + 0x1c]
add dword [eax + 4], ecx
mov eax, dword [ebp - 4]
pop ebx
pop esi
pop edi
leave
ret
Function at 0x406082
Capabilities:
Read .ini file

Disassembly:
push 0x4a09c0
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [0x4b0620]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
ret

Function at 0x40609c
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.00483980
mov eax, dword [0x49b3f0]
push ebx
push esi
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
push 0x7ff
lea ecx, [ebp - 0x800]
push ecx
push 0xffffffffffffffff
push dword [ebp + 0xc]
mov esi, 0xfde9
and eax, esi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp eax, ebx
je 0x4060e3
mov byte [ebp + eax - 0x800], bl
push 0x4a09c0
push 0x800
lea eax, [ebp - 0x1000]
push eax
lea eax, [ebp - 0x800]
push eax
push dword [ebp + 8]
push dword [0x4b0620]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push dword [ebp + 0x10]
lea eax, [ebp - 0x1000]
push dword [ebp + 0xc]
push 0xffffffffffffffff
push eax
mov eax, dword [0x49b3f0]
neg eax
sbb eax, eax
and eax, esi
push ebx
push eax
call fcn.00405faa
add esp, 0x18
pop esi
pop ebx
leave
ret

Function at 0x406326
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push esi
mov esi, 0x4a0d08
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x49db80], 0
jne 0x4063aa
lea eax, [ebp - 0x94]
push eax
mov dword [ebp - 0x94], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x406375
push 0x94
push eax
lea eax, [ebp - 0x94]
push eax
call sub.NSCRT.dll_memset
add esp, 0xc
cmp dword [ebp - 0x90], 6
jb 0x406397
push 0x49db80
push 0x4873e8
push 0x48736c
push 0
call fcn.004062aa
add esp, 0x10
cmp dword [0x49db80], 0
jne 0x4063aa
mov dword [0x49db80], 0x4a0d20
mov ecx, dword [0x49db80]
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov eax, dword [0x49db80]
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
pop esi
leave
ret

Function at 0x406402
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2000
call fcn.00483980
push ebx
push esi
push edi
push dword [ebp + 0xc]
xor eax, eax
xor ebx, ebx
mov word [ebp - 0x1000], bx
mov ecx, 0x3ff
lea edi, [ebp - 0xffe]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov esi, 0x800
push esi
lea eax, [ebp - 0x2000]
push eax
call fcn.00402db5
push 0x4a09c0
push esi
lea eax, [ebp - 0x1800]
push eax
lea eax, [ebp - 0x2000]
push eax
push dword [ebp + 8]
push dword [0x4b0620]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x7ff
lea eax, [ebp - 0x1000]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x1800]
push eax
push ebx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, ebx
je 0x406491
mov word [ebp + eax*2 - 0x1000], bx
push ebx
push ebx
push dword [ebp + 0x10]
lea eax, [ebp - 0x1000]
push dword [ebp + 0xc]
push 0xffffffffffffffff
push eax
push ebx
push ebx
call fcn.00405ff2
add esp, 0x20
pop edi
pop esi
pop ebx
leave
ret
Function at 0x406f68
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
cmp dword [0x4a0cfc], 0
mov eax, 0x100
mov dword [ebp - 8], eax
jne 0x406fba
mov ecx, dword [ebp + 8]
cmp byte [ecx], 0
je 0x406fba
push ecx
push 0x487b54
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.00402528
add esp, 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10c]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x406fbe
xor eax, eax
leave
ret
push esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x407050
cmp dword [ebp - 0xc], 1
jne 0x407050
mov esi, str.Winamp.File
push esi
call sub.NSCRT.dll_strlen
push eax
lea eax, [ebp - 0x10c]
push esi
push eax
call dword [sym.imp.NSCRT.dll_strncmp]
add esp, 0x10
test eax, eax
je 0x40704b
lea eax, [ebp - 0x10c]
push str.Winamp.PlayList
push eax
call sub.NSCRT.dll_strcmp
test eax, eax
pop ecx
pop ecx
je 0x40704b
lea eax, [ebp - 0x10c]
push 0x487b28
push eax
call sub.NSCRT.dll_strcmp
test eax, eax
pop ecx
pop ecx
je 0x40704b
lea eax, [ebp - 0x10c]
push 0x487b18
push eax
call sub.NSCRT.dll_strcmp
test eax, eax
pop ecx
pop ecx
jne 0x407050
xor esi, esi
inc esi
jmp 0x407052
xor esi, esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret
Function at 0x407bcb
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push edi
push 0x40
pop ecx
xor eax, eax
mov word [ebp - 0x10c], 0x22
lea edi, [ebp - 0x10a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0xfc
lea eax, [ebp - 0x10b]
push eax
push dword [0x4b0600]
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x407c24
lea eax, [ebp - 4]
push eax
push 0x488050
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x407c28
xor eax, eax
jmp 0x407c86
push 0x488048
push 0x104
lea eax, [ebp - 0x10c]
push eax
call fcn.00406279
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x210]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 4]
mov dword [ebp - 8], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x407c7b
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x407c7b
xor ebx, ebx
inc ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
pop edi
pop ebx
leave
ret
Function at 0x408bfd
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x45c
push ebx
push esi
mov esi, dword [ebp + 0x1c]
mov eax, dword [esi]
cmp eax, 0xffffffff
push edi
jne 0x408c62
mov eax, dword [ebp + 0x14]
mov ebx, dword [ebp + 0x10]
lea edi, [ebx + eax*2]
push 0x4880a8
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x250]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esi], eax
and word [edi], 0
cmp dword [esi], 0xffffffff
je 0x408c7f
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, dword [sym.imp.NSCRT.dll__stricmp]
cmp byte [ebp + 0x18], 0
je 0x408c88
test byte [ebp - 0x250], 0x10
je 0x408cec
jmp 0x408c91
lea ecx, [ebp - 0x250]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x408c3c
push dword [esi]
call dword [sym.imp.KERNEL32.dll_FindClose]
or dword [esi], 0xffffffff
xor al, al
pop edi
pop esi
pop ebx
leave
ret 0x18
test byte [ebp - 0x250], 0x10
jne 0x408cec
xor eax, eax
push eax
push eax
push 0x209
lea ecx, [ebp - 0x45c]
push ecx
push 0xffffffffffffffff
lea ecx, [ebp - 0x224]
push ecx
push eax
push eax
call edi
push dword [ebp + 0xc]
lea eax, [ebp - 0x45c]
push eax
call ebx
test eax, eax
pop ecx
pop ecx
je 0x408d08
xor eax, eax
push eax
push eax
push 0x209
lea ecx, [ebp - 0x45c]
push ecx
push 0xffffffffffffffff
lea ecx, [ebp - 0x1c]
push ecx
push eax
push eax
call edi
push dword [ebp + 0xc]
lea eax, [ebp - 0x45c]
push eax
call ebx
test eax, eax
pop ecx
pop ecx
je 0x408d08
lea eax, [ebp - 0x250]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x408c4d
jmp 0x408c74
mov ecx, dword [ebp + 0x14]
lea eax, [ebp - 0x224]
push eax
mov eax, dword [ebp + 0x10]
lea eax, [eax + ecx*2]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov al, 1
jmp 0x408c81
Function at 0x409039
Capabilities:
Enumerate files on windows
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe6c
push dword [ebp + 8]
lea eax, [ebp - 0x66c]
push dword [ebp + 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov eax, dword [ebp + 0x24]
test eax, eax
je 0x40905f
and dword [eax], 0
push ebx
push esi
push edi
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x66c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x409210
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea eax, [ebp - 0x22c]
push eax
push dword [ebp + 0x1c]
lea eax, [ebp - 0x66c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x66c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
xor edi, edi
cmp ebx, edi
mov dword [ebp - 4], ebx
je 0x4091ef
push str.SetWinampHWND
push ebx
call esi
cmp eax, edi
je 0x4090d0
push dword [0x4ac344]
call eax
pop ecx
cmp dword [ebp + 0x2c], edi
je 0x409120
push str.GetAudioTypes3
push ebx
call esi
mov edi, eax
test edi, edi
je 0x4091e6
lea eax, [ebp - 0xa6c]
push eax
push 0
call edi
pop ecx
xor ebx, ebx
pop ecx
inc ebx
jmp 0x409117
push eax
lea eax, [ebp - 0xa6c]
push eax
mov eax, dword [ebp + 0x2c]
push dword [eax + 4]
call dword [eax]
lea eax, [ebp - 0xa6c]
push eax
push ebx
call edi
add esp, 0x14
inc ebx
test eax, eax
jne 0x4090f9
jmp 0x4091e6
push str.ExtAudio3
push ebx
call esi
cmp eax, edi
je 0x409139
push edi
push edi
push dword [0x4ac344]
call eax
add esp, 0xc
push str.CreateAudio3
push ebx
call esi
cmp dword [ebp + 0x20], 0
mov edi, eax
jne 0x40917a
push str.ConfigAudio3
push ebx
call esi
test eax, eax
je 0x4091e6
mov ecx, dword [ebp + 0x30]
test ecx, ecx
jne 0x409165
mov ecx, 0x4a09c0
push ecx
push dword [ebp + 0x18]
push ebx
push dword [ebp + 0x28]
call eax
add esp, 0x10
test eax, eax
jne 0x409219
cmp dword [ebp + 0x20], 1
jne 0x4091ac
test edi, edi
je 0x4091e6
mov eax, dword [ebp + 0x30]
test eax, eax
jne 0x409190
mov eax, 0x4a09c0
push eax
lea eax, [ebp + 0x18]
push eax
push 0x204d4350
push dword [ebp + 0xc]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call edi
add esp, 0x18
test eax, eax
jne 0x409219
cmp dword [ebp + 0x20], 2
jne 0x4091e6
push str.GetAudioTypes3
push ebx
call esi
mov edi, eax
test edi, edi
je 0x4091e6
lea eax, [ebp - 0xe6c]
push eax
push 0
call edi
xor ebx, ebx
inc ebx
jmp 0x4091e0
cmp eax, dword [ebp + 0x18]
je 0x409217
lea eax, [ebp - 0xe6c]
push eax
push ebx
call edi
inc ebx
test eax, eax
pop ecx
pop ecx
jne 0x4091d0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x258]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x409088
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
xor eax, eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0x24]
mov dword [edx], ecx
jmp 0x409212
Function at 0x409223
Capabilities:
Get common file path
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
cmp word [0x4a2528], bx
push edi
mov edi, 0x4a2528
jne 0x4092b3
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40929e
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 0xc]
push eax
push ebx
push str.CommonFilesDir
push dword [ebp - 4]
mov dword [ebp - 8], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x409282
cmp dword [ebp - 0xc], 1
je 0x409289
mov word [0x4a2528], bx
push 0x488134
push edi
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [0x4a2528], bx
jne 0x4092b3
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push 0x49f020
push dword [esi]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push str.enc_.dll
call fcn.00409039
add esp, 0x2c
cmp eax, ebx
jne 0x40932c
push 0x4a09c0
push ebx
push str.scannsv
push dword [0x4b0620]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test eax, eax
je 0x40932a
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push edi
push dword [esi]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push str.nsv_coder_.dll
call fcn.00409039
add esp, 0x2c
cmp eax, ebx
jne 0x40932c
xor eax, eax
pop edi
pop ebx
leave
ret