joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413b2c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffd0
mov dword [esp], edx
mov ebx, eax
lea edx, [esp + 0x20]
mov eax, dword [esp]
mov ecx, 0x10
call fcn.004027d4
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x18], eax
mov eax, dword [ebx + 4]
dec eax
test eax, eax
jl 0x413c88
inc eax
mov dword [esp + 0x1c], eax
lea eax, [ebx + 8]
mov ebx, eax
mov edx, dword [esp + 0xc]
mov ecx, dword [ebx]
mov esi, dword [esp + 0x10]
mov eax, dword [ebx + 4]
add edx, eax
add eax, edx
mov edi, edx
shr edi, 7
xor edx, edi
add ecx, edx
add edx, ecx
mov edi, ecx
shl edi, 0xd
xor ecx, edi
add esi, ecx
add ecx, esi
mov edi, esi
shr edi, 0x11
xor esi, edi
add eax, esi
add esi, eax
mov edi, eax
shl edi, 9
xor eax, edi
add edx, eax
add eax, edx
mov edi, edx
shr edi, 3
xor edx, edi
add ecx, edx
add edx, ecx
mov edi, ecx
shl edi, 7
xor ecx, edi
add esi, ecx
add ecx, esi
mov edi, eax
shr edi, 0xf
xor esi, edi
add eax, esi
add esi, eax
mov edi, eax
shl edi, 0xb
xor eax, edi
mov edi, edx
mov edx, esi
mov esi, edi
mov edi, ecx
mov ecx, eax
mov eax, edi
add edx, eax
add eax, edx
mov edi, edx
shr edi, 7
xor edx, edi
add ecx, edx
add edx, ecx
mov edi, ecx
shl edi, 0xd
xor ecx, edi
add esi, ecx
add ecx, esi
mov edi, esi
shr edi, 0x11
xor esi, edi
add eax, esi
add esi, eax
mov edi, eax
shl edi, 9
xor eax, edi
add edx, eax
add eax, edx
mov edi, edx
shr edi, 3
xor edx, edi
add ecx, edx
add edx, ecx
mov edi, ecx
shl edi, 7
xor ecx, edi
add esi, ecx
add ecx, esi
mov edi, eax
shr edi, 0xf
xor esi, edi
add eax, esi
add esi, eax
mov edi, eax
shl edi, 0xb
xor eax, edi
xor edx, dword [esp + 0x14]
xor ecx, edx
mov dword [esp + 4], ecx
xor esi, dword [esp + 0x18]
xor eax, esi
mov dword [esp + 8], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 4]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 8]
mov dword [esp + 0x10], eax
add ebx, 8
dec dword [esp + 0x1c]
jne 0x413b7e
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov edx, dword [esp]
lea eax, [esp + 0x20]
mov ecx, 0x10
call fcn.004027d4
add esp, 0x30
pop edi
pop esi
pop ebx
ret
Function at 0x413cc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff5c
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dl, byte [ebp + 8]
mov byte [eax], dl
mov edx, ebx
mov eax, 0x10
call fcn.00413ae4
mov edx, eax
mov eax, 4
call fcn.00413aec
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov dword [ebp - 0x20], 4
mov dword [ebp - 0x24], 0x41c4fc
mov eax, dword [ebp - 4]
add eax, 8
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov ecx, dword [ebp - 0x24]
mov esi, dword [ecx]
mov ecx, esi
mov ebx, dword [ebp - 8]
mov ebx, dword [ebx + 4]
mov dword [ebp - 0xc], esi
mov edi, dword [ebp - 8]
mov edi, dword [edi + 8]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], esi
mov edi, dword [ebp - 8]
mov edi, dword [edi + 0xc]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], esi
mov esi, 8
mov edi, ecx
shl edi, 0xb
xor edx, edi
add dword [ebp - 0xc], edx
add ecx, ebx
mov edi, ebx
shr edi, 2
xor ecx, edi
add dword [ebp - 0x10], ecx
add ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 0xc]
shl edi, 8
xor ebx, edi
add dword [ebp - 0x14], ebx
mov edi, dword [ebp - 0x10]
add dword [ebp - 0xc], edi
mov edi, dword [ebp - 0x10]
shr edi, 0x10
xor dword [ebp - 0xc], edi
mov edi, dword [ebp - 0xc]
add dword [ebp - 0x18], edi
mov edi, dword [ebp - 0x14]
add dword [ebp - 0x10], edi
mov edi, dword [ebp - 0x14]
shl edi, 0xa
xor dword [ebp - 0x10], edi
mov edi, dword [ebp - 0x10]
add dword [ebp - 0x1c], edi
mov edi, dword [ebp - 0x18]
add dword [ebp - 0x14], edi
mov edi, dword [ebp - 0x18]
shr edi, 4
xor dword [ebp - 0x14], edi
add edx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x1c]
add dword [ebp - 0x18], edi
mov edi, dword [ebp - 0x1c]
shl edi, 8
xor dword [ebp - 0x18], edi
add ecx, dword [ebp - 0x18]
add dword [ebp - 0x1c], edx
mov edi, edx
shr edi, 9
xor dword [ebp - 0x1c], edi
add ebx, dword [ebp - 0x1c]
add edx, ecx
dec esi
jne 0x413d40
mov dword [eax], edx
mov dword [eax + 4], ecx
mov dword [eax + 8], ebx
mov edx, dword [ebp - 0xc]
mov dword [eax + 0xc], edx
mov edx, dword [ebp - 0x10]
mov dword [eax + 0x10], edx
mov edx, dword [ebp - 0x14]
mov dword [eax + 0x14], edx
mov edx, dword [ebp - 0x18]
mov dword [eax + 0x18], edx
mov edx, dword [ebp - 0x1c]
mov dword [eax + 0x1c], edx
add eax, 0x20
add dword [ebp - 0x24], 4
dec dword [ebp - 0x20]
jne 0x413d0e
cmp byte [ebp + 8], 0
jne 0x413e6f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
dec eax
test eax, eax
jl 0x413e44
inc eax
mov dword [ebp - 0x20], 0
mov edx, dword [ebp - 4]
add edx, 8
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 4]
dec ecx
sub ecx, dword [ebp - 0x20]
mov ebx, dword [edx]
mov dword [ebp + ecx*8 - 0xa4], ebx
mov ebx, dword [edx + 4]
mov dword [ebp + ecx*8 - 0xa0], ebx
inc dword [ebp - 0x20]
add edx, 8
dec eax
jne 0x413e1e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
dec eax
test eax, eax
jl 0x413e6f
inc eax
lea edx, [ebp - 0xa4]
mov ebx, dword [ebp - 4]
add ebx, 8
mov ecx, dword [edx]
mov dword [ebx], ecx
mov ecx, dword [edx + 4]
mov dword [ebx + 4], ecx
add ebx, 8
add edx, 8
dec eax
jne 0x413e5c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x413ea0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffee8
mov ebx, eax
mov edx, esp
mov eax, ebx
mov ecx, 0x118
call fcn.004027d4
xor eax, eax
mov dword [esp], eax
mov esi, 0x41c3fc
lea edi, [esp + 4]
mov ecx, 0x40
rep movsd dword es:[edi], dword [esi]
xor eax, eax
mov dword [esp + 0x104], eax
mov dword [esp + 0x108], 0x55555555
mov dword [esp + 0x10c], 0x55555555
mov dword [esp + 0x110], 0x55555555
mov dword [esp + 0x114], 0x55555555
mov edx, ebx
mov eax, esp
mov ecx, 0x118
call fcn.004027d4
add esp, 0x118
pop edi
pop esi
pop ebx
ret

Function at 0x413f1c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffee0
mov edi, ecx
mov ebx, edx
mov dword [esp], eax
lea edx, [esp + 8]
mov eax, dword [esp]
mov ecx, 0x118
call fcn.004027d4
dec edi
test edi, edi
jl 0x41403b
inc edi
mov dword [esp + 4], edi
mov esi, ebx
mov al, byte [esi]
mov edx, dword [esp + 8]
xor byte [esp + edx + 0xc], al
inc dword [esp + 8]
cmp dword [esp + 8], 0x100
jne 0x413f6c
xor edx, edx
mov dword [esp + 8], edx
mov edx, dword [esp + 0x10c]
xor byte [esp + edx + 0x110], al
inc dword [esp + 0x10c]
cmp dword [esp + 0x10c], 8
jne 0x414030
mov edx, dword [esp + 0x11c]
mov ecx, dword [esp + 0x118]
mov ebx, dword [esp + 0x114]
mov eax, dword [esp + 0x110]
mov edi, 4
add edx, eax
add eax, edx
mov ebp, edx
shr ebp, 7
xor edx, ebp
add ecx, edx
add edx, ecx
mov ebp, ecx
shl ebp, 0xd
xor ecx, ebp
add ebx, ecx
add ecx, ebx
mov ebp, ebx
shr ebp, 0x11
xor ebx, ebp
add eax, ebx
add ebx, eax
mov ebp, eax
shl ebp, 9
xor eax, ebp
add edx, eax
add eax, edx
mov ebp, edx
shr ebp, 3
xor edx, ebp
add ecx, edx
add edx, ecx
mov ebp, ecx
shl ebp, 7
xor ecx, ebp
add ebx, ecx
add ecx, ebx
mov ebp, eax
shr ebp, 0xf
xor ebx, ebp
add eax, ebx
add ebx, eax
mov ebp, eax
shl ebp, 0xb
xor eax, ebp
dec edi
jne 0x413fb0
mov dword [esp + 0x110], edx
mov dword [esp + 0x114], ecx
mov dword [esp + 0x118], ebx
mov dword [esp + 0x11c], eax
xor eax, eax
mov dword [esp + 0x10c], eax
inc esi
dec dword [esp + 4]
jne 0x413f4e
mov edx, dword [esp]
lea eax, [esp + 8]
mov ecx, 0x118
call fcn.004027d4
add esp, 0x120
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x414140
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov esi, eax
mov edi, edx
push ecx
shr ecx, 2
je 0x41415a
cld
mov eax, dword [edi]
xor dword [esi], eax
add esi, 4
add edi, 4
dec ecx
jne 0x41414d
pop ecx
and ecx, 3
je 0x414169
mov al, byte [edi]
xor byte [esi], al
inc esi
inc edi
dec ecx
jne 0x414160
pop edi
pop esi
ret

Function at 0x41416c
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
add esp, 0xfffffff8
mov dword [esp], eax
xor eax, eax
mov al, byte [esp]
mov al, byte [eax + 0x41c50c]
mov byte [esp + 4], al
xor eax, eax
mov al, byte [esp + 1]
mov al, byte [eax + 0x41c50c]
mov byte [esp + 5], al
xor eax, eax
mov al, byte [esp + 2]
mov al, byte [eax + 0x41c50c]
mov byte [esp + 6], al
xor eax, eax
mov al, byte [esp + 3]
mov al, byte [eax + 0x41c50c]
mov byte [esp + 7], al
mov eax, dword [esp + 4]
pop ecx
pop edx
ret
Function at 0x414204
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov byte [ebp - 0x15], cl
mov ebx, edx
mov dword [ebp - 0x14], eax
xor eax, eax
lea edx, [ebp - 0x10]
cmp byte [ebp - 0x15], 0
jne 0x414292
lea ecx, [eax]
and ecx, 0x80000003
jns 0x41422f
dec ecx
or ecx, 0xfffffffc
inc ecx
movzx ecx, byte [ebx + ecx*4]
mov ecx, dword [ecx*4 + 0x41c744]
lea esi, [eax + 1]
and esi, 0x80000003
jns 0x41424a
dec esi
or esi, 0xfffffffc
inc esi
movzx esi, byte [ebx + esi*4 + 1]
xor ecx, dword [esi*4 + 0x41cb44]
lea esi, [eax + 2]
and esi, 0x80000003
jns 0x414266
dec esi
or esi, 0xfffffffc
inc esi
movzx esi, byte [ebx + esi*4 + 2]
xor ecx, dword [esi*4 + 0x41cf44]
lea esi, [eax + 3]
and esi, 0x80000003
jns 0x414282
dec esi
or esi, 0xfffffffc
inc esi
movzx esi, byte [ebx + esi*4 + 3]
xor ecx, dword [esi*4 + 0x41d344]
mov dword [edx], ecx
jmp 0x414307
lea ecx, [eax]
and ecx, 0x80000003
jns 0x4142a1
dec ecx
or ecx, 0xfffffffc
inc ecx
movzx ecx, byte [ebx + ecx*4]
mov cl, byte [ecx + 0x41c50c]
mov byte [edx], cl
lea ecx, [eax + 1]
and ecx, 0x80000003
jns 0x4142bd
dec ecx
or ecx, 0xfffffffc
inc ecx
movzx ecx, byte [ebx + ecx*4 + 1]
mov cl, byte [ecx + 0x41c50c]
mov byte [edx + 1], cl
lea ecx, [eax + 2]
and ecx, 0x80000003
jns 0x4142db
dec ecx
or ecx, 0xfffffffc
inc ecx
movzx ecx, byte [ebx + ecx*4 + 2]
mov cl, byte [ecx + 0x41c50c]
mov byte [edx + 2], cl
lea ecx, [eax + 3]
and ecx, 0x80000003
jns 0x4142f9
dec ecx
or ecx, 0xfffffffc
inc ecx
movzx ecx, byte [ebx + ecx*4 + 3]
mov cl, byte [ecx + 0x41c50c]
mov byte [edx + 3], cl
inc eax
add edx, 4
cmp eax, 4
jne 0x41421a
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov ecx, 0x10
call fcn.00414140
mov edi, ebx
lea esi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x414334
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0x14], edx
mov edx, eax
mov eax, dword [ebp - 0x14]
mov ecx, 0x10
call fcn.00414140
xor esi, esi
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
test bl, bl
jne 0x414410
xor ecx, ecx
mov cl, byte [eax]
mov ecx, dword [ecx*4 + 0x41d744]
movzx edi, byte [eax + 1]
xor ecx, dword [edi*4 + 0x41db44]
movzx edi, byte [eax + 2]
xor ecx, dword [edi*4 + 0x41df44]
movzx edi, byte [eax + 3]
xor ecx, dword [edi*4 + 0x41e344]
mov dword [ebp - 0x18], ecx
xor ecx, ecx
mov cl, byte [ebp - 0x18]
mov cl, byte [ecx + 0x41c60c]
lea edi, [esi]
and edi, 0x80000003
jns 0x4143aa
dec edi
or edi, 0xfffffffc
inc edi
mov byte [ebp + edi*4 - 0x10], cl
xor ecx, ecx
mov cl, byte [ebp - 0x17]
mov cl, byte [ecx + 0x41c60c]
lea edi, [esi + 1]
and edi, 0x80000003
jns 0x4143c9
dec edi
or edi, 0xfffffffc
inc edi
mov byte [ebp + edi*4 - 0xf], cl
xor ecx, ecx
mov cl, byte [ebp - 0x16]
mov cl, byte [ecx + 0x41c60c]
lea edi, [esi + 2]
and edi, 0x80000003
jns 0x4143e8
dec edi
or edi, 0xfffffffc
inc edi
mov byte [ebp + edi*4 - 0xe], cl
xor ecx, ecx
mov cl, byte [ebp - 0x15]
mov cl, byte [ecx + 0x41c60c]
lea edi, [esi + 3]
and edi, 0x80000003
jns 0x414407
dec edi
or edi, 0xfffffffc
inc edi
mov byte [ebp + edi*4 - 0xd], cl
jmp 0x414491
lea ecx, [esi]
and ecx, 0x80000003
jns 0x41441f
dec ecx
or ecx, 0xfffffffc
inc ecx
mov edi, dword [ebp - 0x14]
movzx ecx, byte [edi + ecx*4]
mov cl, byte [ecx + 0x41c60c]
mov byte [edx], cl
lea ecx, [esi + 3]
and ecx, 0x80000003
jns 0x41443e
dec ecx
or ecx, 0xfffffffc
inc ecx
mov edi, dword [ebp - 0x14]
movzx ecx, byte [edi + ecx*4 + 1]
mov cl, byte [ecx + 0x41c60c]
mov byte [edx + 1], cl
lea ecx, [esi + 2]
and ecx, 0x80000003
jns 0x41445f
dec ecx
or ecx, 0xfffffffc
inc ecx
mov edi, dword [ebp - 0x14]
movzx ecx, byte [edi + ecx*4 + 2]
mov cl, byte [ecx + 0x41c60c]
mov byte [edx + 2], cl
lea ecx, [esi + 1]
and ecx, 0x80000003
jns 0x414480
dec ecx
or ecx, 0xfffffffc
inc ecx
mov edi, dword [ebp - 0x14]
movzx ecx, byte [edi + ecx*4 + 3]
mov cl, byte [ecx + 0x41c60c]
mov byte [edx + 3], cl
inc esi
add edx, 4
add eax, 4
cmp esi, 4
jne 0x414359
mov eax, dword [ebp - 0x14]
mov edi, eax
lea esi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x414c50
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffff88
mov dword [esp + 4], edx
mov dword [esp], eax
lea eax, [esp + 0x39]
xor ecx, ecx
mov edx, 0x3f
call fcn.00402a74
lea edx, [esp + 0xc]
mov ecx, 0x2d
mov eax, dword [esp]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x414dd5
mov edi, 1
xor esi, esi
jmp 0x414d15
mov al, byte [esp + edi + 0xb]
xor edx, edx
mov dl, al
shr edx, 2
and dl, 0x3f
and edx, 0xff
mov dl, byte [edx + 0x41e74c]
mov byte [esp + esi + 0x39], dl
mov edx, eax
shl edx, 4
xor eax, eax
mov al, byte [esp + edi + 0xc]
shr eax, 4
or dl, al
and dl, 0x3f
xor eax, eax
mov al, dl
mov al, byte [eax + 0x41e74c]
mov byte [esp + esi + 0x3a], al
mov dl, byte [esp + edi + 0xc]
shl edx, 2
mov al, byte [esp + edi + 0xd]
xor ecx, ecx
mov cl, al
shr ecx, 6
or dl, cl
and dl, 0x3f
and edx, 0xff
mov dl, byte [edx + 0x41e74c]
mov byte [esp + esi + 0x3b], dl
mov edx, eax
and dl, 0x3f
xor eax, eax
mov al, dl
mov al, byte [eax + 0x41e74c]
mov byte [esp + esi + 0x3c], al
add edi, 3
add esi, 4
mov eax, dword [esp + 8]
sub eax, 2
cmp edi, eax
jle 0x414c96
cmp edi, dword [esp + 8]
jg 0x414dbb
mov al, byte [esp + edi + 0xb]
xor edx, edx
mov dl, al
shr edx, 2
and dl, 0x3f
and edx, 0xff
mov dl, byte [edx + 0x41e74c]
mov byte [esp + esi + 0x39], dl
cmp edi, dword [esp + 8]
jne 0x414d72
mov edx, eax
shl edx, 4
and dl, 0x30
and dl, 0x3f
xor eax, eax
mov al, dl
mov al, byte [eax + 0x41e74c]
mov byte [esp + esi + 0x3a], al
mov byte [esp + esi + 0x3b], 0x3d
jmp 0x414db3
mov edx, eax
shl edx, 4
and dl, 0x30
xor eax, eax
mov al, byte [esp + edi + 0xc]
shr eax, 4
and al, 0xf
or dl, al
and dl, 0x3f
xor eax, eax
mov al, dl
mov al, byte [eax + 0x41e74c]
mov byte [esp + esi + 0x3a], al
mov dl, byte [esp + edi + 0xc]
shl edx, 2
and dl, 0x3c
and dl, 0x3f
xor eax, eax
mov al, dl
mov al, byte [eax + 0x41e74c]
mov byte [esp + esi + 0x3b], al
mov byte [esp + esi + 0x3c], 0x3d
add esi, 4
lea edx, [esp + 0x39]
mov ecx, esi
mov eax, dword [esp + 4]
mov ebx, dword [eax]
call dword [ebx + 0x10]
cmp dword [esp + 8], 0x2d
jge 0x414c6d
add esp, 0x78
pop edi
pop esi
pop ebx
ret
Function at 0x402aeb
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x483b34]
test eax, eax
je 0x402afc
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
ret
push 0
push 0x402797
push dword [0x4924ec]
push 0xf5
call fcn.0045ebbd
add esp, 0x10
push 5
push eax
mov dword [0x483b34], eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret
Function at 0x4052c1
Capabilities:
Read .ini file

Disassembly:
push 0x487000
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [0x496664]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
ret

Function at 0x4052db
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.00470240
mov eax, dword [0x4823c0]
push ebx
push esi
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
push 0x7ff
lea ecx, [ebp - 0x800]
push ecx
push 0xffffffffffffffff
push dword [ebp + 0xc]
mov esi, 0xfde9
and eax, esi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp eax, ebx
je 0x405322
mov byte [ebp + eax - 0x800], bl
push 0x487000
push 0x800
lea eax, [ebp - 0x1000]
push eax
lea eax, [ebp - 0x800]
push eax
push dword [ebp + 8]
push dword [0x496664]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push dword [ebp + 0x10]
lea eax, [ebp - 0x1000]
push dword [ebp + 0xc]
push 0xffffffffffffffff
push eax
mov eax, dword [0x4823c0]
neg eax
sbb eax, eax
and eax, esi
push ebx
push eax
call fcn.00405193
add esp, 0x18
pop esi
pop ebx
leave
ret

Function at 0x4056ca
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2000
call fcn.00470240
push ebx
push esi
push edi
push dword [ebp + 0xc]
xor eax, eax
xor ebx, ebx
mov word [ebp - 0x1000], bx
mov ecx, 0x3ff
lea edi, [ebp - 0xffe]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov esi, 0x800
push esi
lea eax, [ebp - 0x2000]
push eax
call fcn.00402e02
push 0x487000
push esi
lea eax, [ebp - 0x1800]
push eax
lea eax, [ebp - 0x2000]
push eax
push dword [ebp + 8]
push dword [0x496664]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x7ff
lea eax, [ebp - 0x1000]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x1800]
push eax
push ebx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, ebx
je 0x405759
mov word [ebp + eax*2 - 0x1000], bx
push ebx
push ebx
push dword [ebp + 0x10]
lea eax, [ebp - 0x1000]
push dword [ebp + 0xc]
push 0xffffffffffffffff
push eax
push ebx
push ebx
call fcn.004051db
add esp, 0x20
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4061d4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
cmp dword [0x487334], 0
mov eax, 0x100
mov dword [ebp - 8], eax
jne 0x406226
mov ecx, dword [ebp + 8]
cmp byte [ecx], 0
je 0x406226
push ecx
push 0x473978
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.00402528
add esp, 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10c]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x40622a
xor eax, eax
leave
ret
push esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4062bc
cmp dword [ebp - 0xc], 1
jne 0x4062bc
mov esi, str.Winamp.File
push esi
call sub.NSCRT.dll_strlen
push eax
lea eax, [ebp - 0x10c]
push esi
push eax
call dword [sym.imp.NSCRT.dll_strncmp]
add esp, 0x10
test eax, eax
je 0x4062b7
lea eax, [ebp - 0x10c]
push str.Winamp.PlayList
push eax
call sub.NSCRT.dll_strcmp
test eax, eax
pop ecx
pop ecx
je 0x4062b7
lea eax, [ebp - 0x10c]
push str.Winamp.SkinZip
push eax
call sub.NSCRT.dll_strcmp
test eax, eax
pop ecx
pop ecx
je 0x4062b7
lea eax, [ebp - 0x10c]
push 0x47393c
push eax
call sub.NSCRT.dll_strcmp
test eax, eax
pop ecx
pop ecx
jne 0x4062bc
xor esi, esi
inc esi
jmp 0x4062be
xor esi, esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret
Function at 0x406c44
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push edi
push 0x40
pop ecx
xor eax, eax
mov word [ebp - 0x10c], 0x22
lea edi, [ebp - 0x10a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0xfc
lea eax, [ebp - 0x10b]
push eax
push dword [0x496644]
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x406c9d
lea eax, [ebp - 4]
push eax
push 0x473dc0
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x406ca1
xor eax, eax
jmp 0x406cff
push 0x473db8
push 0x104
lea eax, [ebp - 0x10c]
push eax
call fcn.00405663
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x210]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 4]
mov dword [ebp - 8], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x406cf4
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x406cf4
xor ebx, ebx
inc ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
pop edi
pop ebx
leave
ret
Function at 0x407bc0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x45c
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
mov esi, dword [ebp + 0x1c]
mov eax, dword [esi]
cmp eax, 0xffffffff
jne 0x407c1a
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
push edi
lea edi, [eax + ecx*2]
push 0x473e14
push edi
call ebx
lea eax, [ebp - 0x250]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esi], eax
and word [edi], 0
pop edi
cmp dword [esi], 0xffffffff
je 0x407c37
cmp byte [ebp + 0x18], 0
je 0x407c3f
test byte [ebp - 0x250], 0x10
je 0x407c7f
jmp 0x407c48
lea ecx, [ebp - 0x250]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x407c04
push dword [esi]
call dword [sym.imp.KERNEL32.dll_FindClose]
or dword [esi], 0xffffffff
xor al, al
pop esi
pop ebx
leave
ret 0x18
test byte [ebp - 0x250], 0x10
jne 0x407c7f
xor eax, eax
push eax
push eax
push 0x209
lea ecx, [ebp - 0x45c]
push ecx
push 0xffffffffffffffff
lea ecx, [ebp - 0x224]
push ecx
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push dword [ebp + 0xc]
lea eax, [ebp - 0x45c]
push eax
call dword [sym.imp.NSCRT.dll__stricmp]
test eax, eax
pop ecx
pop ecx
je 0x407c98
lea eax, [ebp - 0x250]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x407c09
jmp 0x407c2c
mov ecx, dword [ebp + 0x14]
lea eax, [ebp - 0x224]
push eax
mov eax, dword [ebp + 0x10]
lea eax, [eax + ecx*2]
push eax
call ebx
mov al, 1
jmp 0x407c39