joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409898
Capabilities:
Delete file
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2448
call fcn.00461410
push ebx
push esi
push edi
call fcn.0040d585
push 1
call fcn.0040d1e7
mov ebx, dword [ebp + 8]
test bl, 0x20
pop ecx
je 0x4098c4
call fcn.0040d3a9
jmp 0x4098c9
call fcn.00405c79
test bl, 0x10
je 0x4098e8
push 0x47b158
push 0x469a88
push str.NeedReg
push str.WinampReg
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
call fcn.00405ca5
test bl, 8
je 0x4098fa
test eax, eax
jne 0x409906
push 1
jmp 0x409900
test eax, eax
je 0x409906
push 0
call fcn.00405d64
pop ecx
test bl, 0x46
je 0x409ac4
test bl, 6
mov byte [ebp - 0x2448], 0
je 0x409a03
call fcn.00426ca4
test eax, eax
mov dword [ebp - 8], eax
mov ebx, eax
je 0x409a00
cmp byte [eax], 0
je 0x4099f9
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebx
push str.test._s
mov eax, 0x400
lea edi, [ebp - 0x448]
call fcn.0040258b
push 0x20
lea eax, [ebp - 0x48]
push eax
mov eax, edi
push 0x469a64
push eax
mov byte [ebp - 0x48], 0
call fcn.004255a3
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.NSCRT.dll_atoi]
mov dword [ebp - 4], eax
add esp, 0x1c
mov eax, edi
push eax
call esi
mov edi, eax
lea eax, [ebp - 0x2448]
push eax
call esi
add edi, eax
cmp edi, 0x1fa4
jg 0x4099f6
cmp dword [ebp - 4], 0
jne 0x4099a5
test byte [ebp + 8], 2
jne 0x4099ab
jmp 0x4099e6
test byte [ebp + 8], 4
je 0x4099e6
push 1
push ebx
call fcn.00405258
cmp byte [ebp - 0x2448], 0
pop ecx
pop ecx
je 0x4099d4
push 0x467f00
push 0x2000
lea eax, [ebp - 0x2448]
push eax
call fcn.0040380b
push ebx
push 0x2000
lea eax, [ebp - 0x2448]
push eax
call fcn.0040380b
push ebx
call esi
lea ebx, [ebx + eax + 1]
cmp byte [ebx], 0
jne 0x409940
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ebx, dword [ebp + 8]
test bl, 0x40
je 0x409ab1
mov ecx, dword [0x47b720]
xor eax, eax
push eax
push eax
mov esi, 0x96
push esi
mov dword [ebp + 8], eax
call fcn.00415a9d
mov edi, eax
test edi, edi
je 0x409ab1
shr ebx, 6
and ebx, 1
mov dword [ebp - 4], ebx
inc dword [ebp + 8]
push 0
push 0
push edi
call fcn.0040263a
add esp, 0xc
cmp dword [ebp - 4], 0
mov ebx, eax
je 0x409a8b
push dword [ebp - 4]
push ebx
call fcn.00405258
cmp byte [ebp - 0x2448], 0
pop ecx
pop ecx
je 0x409a79
push 0x467f00
push 0x2000
lea eax, [ebp - 0x2448]
push eax
call fcn.0040380b
push ebx
push 0x2000
lea eax, [ebp - 0x2448]
push eax
call fcn.0040380b
push edi
call dword [0x473f40]
push ebx
call dword [sym.imp.NSCRT.dll_free]
pop ecx
push dword [ebp + 8]
mov ecx, dword [0x47b720]
push 0
push esi
call fcn.00415a9d
mov edi, eax
test edi, edi
jne 0x409a37
lea eax, [ebp - 0x2448]
push eax
push str.config_extlist
call fcn.0040396c
pop ecx
pop ecx
push 1
push 0x468394
call fcn.00405258
push 1
push 0x468390
call fcn.00405258
add esp, 0x10
push 0x4769c8
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
call fcn.004039c9
pop ecx
call fcn.0042549d
call fcn.004260b9
call fcn.00428d23
call fcn.0044fe30
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40b5ba
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
push edi
push 0x1f
pop ecx
xor eax, eax
mov byte [ebp - 0x80], 0
lea edi, [ebp - 0x7f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x47b158
push 0x7f
stosb byte es:[edi], al
lea eax, [ebp - 0x7f]
push eax
push 0x468a9b
push str.browserbrand
push str.winamp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [ebp - 0x7f], 0
push 0x4835e0
sete al
dec al
and eax, 0x2e
mov byte [ebp - 0x80], al
lea eax, [ebp - 0x80]
push eax
push 0x473ac8
push str.wa_s_s_s
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
pop edi
leave
ret
Function at 0x40c966
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [ebp + 0xc]
xor ecx, ecx
push esi
mov esi, dword [ebp + 8]
mov byte [eax], cl
cmp byte [esi], cl
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], ecx
lea edi, [ebp - 0x110]
je 0x40cb4c
push ebx
mov ebx, dword [sym.imp.USER32.dll_CharNextA]
jmp 0x40c99a
xor ecx, ecx
mov al, byte [esi]
cmp al, 0x25
jne 0x40ca27
cmp dword [ebp - 4], ecx
je 0x40c9fa
push 0x104
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x110]
push eax
mov byte [edi], 0
mov byte [ebp - 0x214], 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
cmp dword [ebp + 0x10], 0x7fffffff
ja 0x40c9e7
lea eax, [ebp - 0x214]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0040380b
push esi
lea edi, [ebp - 0x110]
call ebx
mov byte [esi], 0
mov dword [ebp + 8], eax
mov esi, eax
jmp 0x40ca17
push esi
call ebx
push dword [ebp + 8]
mov dword [ebp - 8], eax
push dword [ebp + 0x10]
mov byte [esi], 0
push dword [ebp + 0xc]
call fcn.004037f4
mov esi, dword [ebp - 8]
mov dword [ebp + 8], esi
xor eax, eax
cmp dword [ebp - 4], eax
sete al
mov dword [ebp - 4], eax
jmp 0x40cb42
cmp al, 0x7b
jne 0x40ca8a
cmp dword [ebp - 4], ecx
push esi
je 0x40ca62
call ebx
sub eax, esi
je 0x40cb42
mov ecx, edi
lea edx, [ebp - 0x110]
sub ecx, edx
dec eax
cmp ecx, 0x104
jge 0x40cb42
mov dl, byte [esi]
mov byte [edi], dl
inc edi
inc ecx
inc esi
test eax, eax
jne 0x40ca45
jmp 0x40cb42
call ebx
push dword [ebp + 8]
mov dword [ebp - 8], eax
push dword [ebp + 0x10]
mov byte [esi], 0
push dword [ebp + 0xc]
call fcn.004037f4
mov esi, dword [ebp - 8]
mov dword [ebp + 8], esi
mov dword [ebp - 0xc], 1
jmp 0x40cb42
cmp al, 0x7d
jne 0x40cb0c
cmp dword [ebp - 4], ecx
je 0x40cab8
push esi
call ebx
sub eax, esi
je 0x40cab8
mov ecx, edi
lea edx, [ebp - 0x110]
sub ecx, edx
dec eax
cmp ecx, 0x104
jge 0x40cab8
mov dl, byte [esi]
mov byte [edi], dl
inc edi
inc ecx
inc esi
test eax, eax
jne 0x40caa4
lea eax, [ebp - 0x110]
push eax
mov byte [edi], 0
call dword [sym.imp.NSCRT.dll_atoi]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
call fcn.0040c912
add esp, 0x10
cmp dword [ebp + 0x10], 0x7fffffff
ja 0x40caf5
lea eax, [ebp - 0x214]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0040380b
push esi
lea edi, [ebp - 0x110]
call ebx
and dword [ebp - 0xc], 0
mov byte [esi], 0
mov dword [ebp + 8], eax
mov esi, eax
jmp 0x40cb42
cmp dword [ebp - 4], ecx
jne 0x40cb1d
cmp dword [ebp - 0xc], ecx
jne 0x40cb1d
push esi
call ebx
mov esi, eax
jmp 0x40cb42
push esi
call ebx
sub eax, esi
je 0x40cb42
mov ecx, edi
lea edx, [ebp - 0x110]
sub ecx, edx
dec eax
cmp ecx, 0x104
jge 0x40cb42
mov dl, byte [esi]
mov byte [edi], dl
inc edi
inc ecx
inc esi
test eax, eax
jne 0x40cb2e
cmp byte [esi], 0
jne 0x40c998
pop ebx
push dword [ebp + 8]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.004037f4
pop edi
pop esi
leave
ret
Function at 0x40cb93
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x508
push ebx
push esi
push edi
push str.paths.ini
push 0x475108
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x108]
push eax
mov esi, 0x400
push esi
lea eax, [ebp - 0x508]
push eax
push 0x468a9b
push str.inidir
mov ebx, 0x469db8
push ebx
call edi
cmp byte [ebp - 0x508], 0
je 0x40cc07
lea eax, [ebp - 0x508]
push esi
push eax
call fcn.0040cb5e
lea eax, [ebp - 0x508]
push eax
call fcn.004058e8
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push esi
lea eax, [ebp - 0x508]
push eax
push 0x468a9b
push str.m3udir
push ebx
call edi
cmp byte [ebp - 0x508], 0
je 0x40cc5b
lea eax, [ebp - 0x508]
push esi
push eax
call fcn.0040cb5e
lea eax, [ebp - 0x508]
push 0
push eax
call fcn.004026c1
mov dword [ebp - 4], eax
call fcn.00405913
push dword [ebp - 4]
call dword [sym.imp.NSCRT.dll_free]
add esp, 0x14
lea eax, [ebp - 0x108]
push eax
push esi
lea eax, [ebp - 0x508]
push eax
push 0x468a9b
push str.m3ubase
push ebx
call edi
cmp byte [ebp - 0x508], 0
je 0x40ccaf
lea eax, [ebp - 0x508]
push esi
push eax
call fcn.0040cb5e
lea eax, [ebp - 0x508]
push 0
push eax
call fcn.004026c1
mov dword [ebp - 4], eax
call fcn.0040593c
push dword [ebp - 4]
call dword [sym.imp.NSCRT.dll_free]
add esp, 0x14
lea eax, [ebp - 0x108]
push eax
push esi
lea eax, [ebp - 0x508]
push eax
push 0x468a9b
push str.inifile
push ebx
call edi
cmp byte [ebp - 0x508], 0
je 0x40ccf0
lea eax, [ebp - 0x508]
push esi
push eax
call fcn.0040cb5e
lea eax, [ebp - 0x508]
push eax
call fcn.004058d3
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push esi
lea eax, [ebp - 0x508]
push eax
push 0x468a9b
push str.class
push ebx
call edi
cmp byte [ebp - 0x508], 0
je 0x40cd4c
lea eax, [ebp - 0x508]
push esi
push eax
call fcn.0040cb5e
lea eax, [ebp - 0x508]
push 0
push eax
call fcn.004026c1
add esp, 0x10
push 0x40
mov edx, 0x4808a0
mov dword [ebp - 4], eax
call fcn.00403759
push dword [ebp - 4]
call dword [sym.imp.NSCRT.dll_free]
pop ecx
lea eax, [ebp - 0x108]
push eax
push esi
lea eax, [ebp - 0x508]
push eax
push 0x468a9b
push 0x469e1c
push ebx
call edi
cmp byte [ebp - 0x508], 0
je 0x40cd9d
lea eax, [ebp - 0x508]
push esi
push eax
call fcn.0040cb5e
pop ecx
pop ecx
push 0x104
push 0x47b270
push 0xffffffffffffffff
lea eax, [ebp - 0x508]
push eax
push 0
push 0
call dword [0x473f1c]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40d1a3
Capabilities:
Set registry value

Disassembly:
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [esp + 0xc]
push 1
push 0
push 0
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret

Function at 0x40d1c4
Capabilities:
Set registry value

Disassembly:
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [esp + 0x10]
push 1
push 0
push dword [esp + 0x18]
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret
Function at 0x40d1e7
Capabilities:
Persist via default file association registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28c
cmp dword [0x47b49c], 0
jne 0x40d3a7
push 0x3ff
lea eax, [ebp - 0x108]
push eax
push dword [0x480940]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x40d3a7
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
lea eax, [ebp - 4]
push eax
push str.SOFTWAREClientsMediaWinamp
mov ebx, reloc.OLEAUT32.dll_SysReAllocString
push ebx
call esi
test eax, eax
jne 0x40d252
push 0x469db8
push dword [ebp - 4]
call fcn.0040d1a3
pop ecx
pop ecx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
lea eax, [ebp - 4]
push eax
push str.SOFTWAREClientsMediaWinampDefaultIcon
push ebx
call esi
test eax, eax
jne 0x40d29e
movzx eax, byte [0x472cd5]
push eax
lea eax, [ebp - 0x108]
push eax
push 0x46a56c
mov eax, 0x184
lea edi, [ebp - 0x28c]
call fcn.0040258b
mov eax, edi
push eax
push dword [ebp - 4]
call fcn.0040d1a3
add esp, 0x14
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
push str.SOFTWAREClientsMediaWinampInstallInfo
push ebx
call esi
test eax, eax
jne 0x40d348
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0
push str.IconsVisible
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
movzx eax, byte [0x472cd5]
push eax
lea eax, [ebp - 0x108]
push eax
push str.__s___REGAVCDL
mov eax, 0x184
lea edi, [ebp - 0x28c]
call fcn.0040258b
mov eax, edi
push eax
push str.ReinstallCommand
push dword [ebp - 4]
call fcn.0040d1c4
mov eax, edi
push eax
push str.ShowIconsCommand
push dword [ebp - 4]
call fcn.0040d1c4
movzx eax, byte [0x472cd5]
push eax
lea eax, [ebp - 0x108]
push eax
push str.__s___UNREG
mov eax, 0x184
call fcn.0040258b
mov eax, edi
push eax
push str.HideIconsCommand
push dword [ebp - 4]
call fcn.0040d1c4
add esp, 0x3c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
push str.SOFTWAREClientsMediaWinamp_shell
push ebx
call esi
test eax, eax
pop edi
jne 0x40d362
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
push str.SOFTWAREClientsMediaWinamp_shellopen
push ebx
call esi
test eax, eax
jne 0x40d37b
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
push str.SOFTWAREClientsMediaWinamp_shellopencommand
push ebx
call esi
test eax, eax
pop esi
pop ebx
jne 0x40d3a7
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 4]
call fcn.0040d1a3
pop ecx
pop ecx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret
Function at 0x40dece
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 8]
push 0x40debf
push 0x20000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
leave
ret

Function at 0x40e0f2
Capabilities:
Hide graphical window

Disassembly:
mov al, byte [0x4764ad]
cmp al, 1
je 0x40e10f
cmp al, 2
je 0x40e10f
cmp dword [0x47b558], 0
je 0x40e11a
call fcn.00411816
jmp 0x40e11a
push 0x480a40
call fcn.00411792
pop ecx
push esi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [0x47b6c8]
call esi
mov al, byte [0x4764ad]
cmp al, 1
je 0x40e14d
cmp al, 3
je 0x40e14d
push 0xffffffffffffffec
push dword [0x47b6c8]
call dword [0x473f90]
and eax, 0xffffff7f
jmp 0x40e160
push 0xffffffffffffffec
push dword [0x47b6c8]
call dword [0x473f90]
or eax, 0x80
push eax
push 0xffffffffffffffec
push dword [0x47b6c8]
call dword [0x473fbc]
cmp dword [0x477970], 0
je 0x40e18b
cmp dword [0x47b714], 0
jne 0x40e18b
push 8
push dword [0x47b6c8]
call esi
mov dword [0x477970], 1
pop esi
ret

Function at 0x40fbfe
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x960
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineA]
push edi
push 0x46a940
push dword [ebp + 8]
lea eax, [ebp - 0x960]
push eax
call esi
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x960]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x40fc95
lea eax, [ebp - 0x114]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x550]
push eax
call esi
test byte [ebp - 0x140], 0x10
je 0x40fc6f
cmp byte [ebp - 0x114], 0x2e
je 0x40fc7c
lea eax, [ebp - 0x550]
push eax
call fcn.0040fbfe
pop ecx
jmp 0x40fc7c
lea eax, [ebp - 0x550]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x140]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40fc3b
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop edi
pop esi
leave
ret
Function at 0x40fcb7
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push ebx
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x410]
push 0x410
push eax
call fcn.004025ff
lea eax, [ebp - 0x410]
push eax
mov ebx, 0x46a93c
call fcn.00411743
xor ebx, ebx
mov byte [eax], bl
cmp byte [ebp - 0x410], bl
pop ecx
lea eax, [ebp - 0x410]
je 0x40fd07
cmp byte [eax], 0x2f
jne 0x40fd02
mov byte [eax], 0x5c
inc eax
cmp byte [eax], bl
jne 0x40fcfa
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [ebp + eax - 0x410]
cmp byte [esi], bl
je 0x40fd5b
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
jmp 0x40fd31
cmp byte [esi], bl
je 0x40fd3a
push esi
call dword [sym.imp.USER32.dll_CharNextA]
mov esi, eax
cmp byte [esi], 0x5c
jne 0x40fd24
cmp byte [esi], bl
jne 0x40fd46
push ebx
lea eax, [ebp - 0x410]
push eax
call edi
jmp 0x40fd56
push ebx
lea eax, [ebp - 0x410]
push eax
mov byte [esi], bl
call edi
mov byte [esi], 0x5c
inc esi
cmp byte [esi], bl
jne 0x40fd31
pop edi
pop esi
pop ebx
leave
ret
Function at 0x410415
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10004
call fcn.00461410
push ebx
push edi
push dword [ebp + 0x10]
lea eax, [ebp - 0x10004]
push 0xffff
push eax
push 0x468a9b
push dword [ebp + 0xc]
xor ebx, ebx
push dword [ebp + 8]
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x10004]
xor edx, edx
mov cl, byte [eax]
cmp cl, 0x20
je 0x410461
cmp cl, 9
je 0x410461
cmp cl, 0x2c
jne 0x410464
inc eax
jmp 0x410450
cmp byte [eax], 0x2d
jne 0x41046a
inc eax
mov cl, byte [eax]
cmp cl, 0x30
jl 0x410488
cmp cl, 0x39
jg 0x410481
xor edx, edx
inc edx
inc eax
mov cl, byte [eax]
cmp cl, 0x30
jge 0x410471
cmp edx, ebx
je 0x410488
inc edi
jmp 0x41044e
cmp edi, ebx
jne 0x410490
xor eax, eax
jmp 0x41050b
push esi
mov eax, edi
shl eax, 2
push eax
push ebx
lea esi, [ebp - 0x10004]
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
mov dword [ebp - 4], edi
cmp ebx, dword [ebp - 4]
jge 0x410508
xor edi, edi
xor eax, eax
xor edx, edx
inc edi
mov cl, byte [esi]
cmp cl, 0x20
je 0x4104c9
cmp cl, 9
je 0x4104c9
cmp cl, 0x2c
jne 0x4104cc
inc esi
jmp 0x4104b8
cmp byte [esi], 0x2d
jne 0x4104d5
or edi, 0xffffffff
inc esi
mov cl, byte [esi]
cmp cl, 0x30
jl 0x410508
cmp cl, 0x39
jg 0x4104f6
movsx ecx, cl
lea eax, [edx + edx*4]
lea edx, [ecx + eax*2 - 0x30]
inc esi
mov cl, byte [esi]
xor eax, eax
inc eax
cmp cl, 0x30
jge 0x4104dc
test eax, eax
je 0x410508
mov eax, dword [ebp + 0x14]
imul edi, edx
mov eax, dword [eax]
mov dword [eax + ebx*4], edi
inc ebx
jmp 0x4104ac
mov eax, ebx
pop esi
pop edi
pop ebx
leave
ret

Function at 0x41050f
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push dword [ebp + 0x14]
lea eax, [ebp - 0x68]
push 0x64
push eax
push 0x468a9b
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x41056d
cmp byte [ebp - 0x68], 0
je 0x41056d
cmp byte [ebp - 0x68], 0x23
lea eax, [ebp - 0x68]
mov dword [ebp - 4], eax
jne 0x41054b
lea eax, [ebp - 0x67]
mov dword [ebp - 4], eax
push 0x10
lea ecx, [ebp - 4]
push ecx
push eax
call dword [sym.imp.NSCRT.dll_strtol]
movzx ecx, ah
mov ch, al
sar eax, 0x10
movzx eax, al
add esp, 0xc
shl ecx, 8
or eax, ecx
leave
ret
mov eax, dword [ebp + 0x10]
leave
ret
Function at 0x410acf
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x24c
cmp byte [0x475f76], 0
je 0x410d0f
push ebx
push esi
push edi
push 0x46a5d0
push 0x475a50
lea eax, [ebp - 0x1d4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
mov edi, dword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0x1d4]
push eax
mov dword [ebp + 0x74], 1
call edi
cmp eax, 0xffffffff
mov ebx, dword [sym.imp.NSCRT.dll__stricmp]
mov dword [ebp + 0x70], eax
je 0x410bcc
test byte [ebp - 0xd0], 0x10
je 0x410b69
lea eax, [ebp - 0xa4]
push 0x467ff8
push eax
call sub.NSCRT.dll_strcmp
test eax, eax
pop ecx
pop ecx
je 0x410bab
lea eax, [ebp - 0xa4]
push 0x46a5cc
push eax
call sub.NSCRT.dll_strcmp
test eax, eax
pop ecx
pop ecx
je 0x410bab
jmp 0x410ba8
push 0x46a938
lea esi, [ebp - 0xa4]
call fcn.00413b30
push eax
call ebx
test eax, eax
pop ecx
pop ecx
je 0x410ba8
push 0x468394
call fcn.00413b30
push eax
call ebx
test eax, eax
pop ecx
pop ecx
je 0x410ba8
push 0x468390
call fcn.00413b30
push eax
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x410bab
inc dword [ebp + 0x74]
lea eax, [ebp - 0xd0]
push eax
push dword [ebp + 0x70]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x410b30
push dword [ebp + 0x70]
call dword [sym.imp.KERNEL32.dll_FindClose]
call fcn.00455bb1
shr eax, 1
cdq
idiv dword [ebp + 0x74]
test edx, edx
mov dword [ebp + 0x70], edx
jne 0x410be9
mov byte [0x476ad0], dl
jmp 0x410d0c
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0x1d4]
push eax
mov dword [ebp + 0x74], 1
call edi
mov edi, eax
cmp edi, 0xffffffff
je 0x410cc3
test byte [ebp - 0xd0], 0x10
je 0x410c44
lea eax, [ebp - 0xa4]
push 0x467ff8
push eax
call sub.NSCRT.dll_strcmp
test eax, eax
pop ecx
pop ecx
je 0x410c8e
lea eax, [ebp - 0xa4]
push 0x46a5cc
push eax
call sub.NSCRT.dll_strcmp
test eax, eax
pop ecx
pop ecx
je 0x410c8e
jmp 0x410c83
push 0x46a938
lea esi, [ebp - 0xa4]
call fcn.00413b30
push eax
call ebx
test eax, eax
pop ecx
pop ecx
je 0x410c83
push 0x468394
call fcn.00413b30
push eax
call ebx
test eax, eax
pop ecx
pop ecx
je 0x410c83
push 0x468390
call fcn.00413b30
push eax
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x410c8e
mov eax, dword [ebp + 0x74]
cmp eax, dword [ebp + 0x70]
je 0x410ca6
inc dword [ebp + 0x74]
lea eax, [ebp - 0xd0]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x410c0b
jmp 0x410cbc
lea eax, [ebp - 0xa4]
push eax
push 0x104
push 0x476ad0
call fcn.004025ff
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0
push 0x9d63
push 0x111
push dword [0x47b6c8]
call dword [sym.imp.USER32.dll_PostMessageA]
push 0x28
pop esi
cmp dword [0x478ba8], esi
jne 0x410d0c
cmp dword [0x47b678], 0
je 0x410d0c
and dword [0x478ba8], 0
push 1
call fcn.0043587c
push 1
mov dword [0x478ba8], esi
call fcn.0043587c
pop ecx
pop ecx
pop edi
pop esi
pop ebx
add ebp, 0x78
leave
ret
Function at 0x411076
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
push 0x47b158
push 0x100
lea eax, [ebp - 0x104]
push eax
push 0x468a9b
push str.Stats
push str.WinampReg
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
xor esi, esi
push 0x10
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
call dword [sym.imp.NSCRT.dll_strtol]
mov ecx, dword [ebp + 8]
mov dword [ecx + esi*4], eax
mov eax, dword [ebp - 4]
add esp, 0xc
cmp byte [eax], 0
je 0x4110d4
inc dword [ebp - 4]
inc esi
cmp esi, 0xd
jl 0x4110ab
pop esi
leave
ret

Function at 0x4110d7
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x10
push ebx
push ebp
push 0x47b158
push 0x80
push esi
push 0x468a9b
mov ebp, 0x46a9a0
push ebp
mov ebx, str.WinampReg
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [esi], 0
jne 0x411147
push edi
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
mov byte [esi], 0
xor edi, edi
movsx eax, byte [esp + edi + 0xc]
push eax
push str._02X
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, esi
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
inc edi
cmp edi, 0x10
jb 0x411114
push 0x47b158
push esi
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
pop edi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x414215
Capabilities:
Read .ini file

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x28c
push ebx
push esi
push edi
mov ebx, 0x47b158
push ebx
push 0x10
push str.NumRecentURLs
mov esi, 0x469db8
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push dword [ebp + 0x7c]
mov dword [ebp + 0x6c], eax
push str.RecentURL_s1
push 0x7b
pop eax
lea edi, [ebp - 0x14]
call fcn.0040258b
pop ecx
pop ecx
push ebx
push 0x104
lea eax, [ebp - 0x118]
push eax
push 0x468a9b
mov eax, edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push ebx
push dword [ebp + 0x78]
mov eax, edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push dword [ebp + 0x78]
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x41431b
xor eax, eax
inc eax
cmp dword [ebp + 0x6c], eax
jle 0x41431b
inc eax
push eax
push dword [ebp + 0x7c]
mov dword [ebp + 0x68], eax
push str.RecentURL_s_d
push 0x7b
pop eax
lea edi, [ebp - 0x14]
call fcn.0040258b
add esp, 0xc
push ebx
mov edi, 0x104
push edi
lea eax, [ebp - 0x21c]
push eax
push 0x468a9b
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push ebx
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push dword [ebp + 0x78]
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x41431b
push edi
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov eax, dword [ebp + 0x68]
cmp eax, dword [ebp + 0x6c]
jl 0x41429e
pop edi
pop esi
pop ebx
add ebp, 0x70
leave
ret

Function at 0x414448
Capabilities:
Hash data using sha1

Disassembly:
xor ecx, ecx
push 0x140
mov dword [eax + 0x154], ecx
mov dword [eax + 0x158], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
push ecx
add eax, 0x14
push eax
call sub.NSCRT.dll_memset
add esp, 0xc
ret