joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408fab
Capabilities:
Read .ini file

Disassembly:
push 7
push str.config_
push dword [esp + 0xc]
call dword [sym.imp.MSVCRT.dll_strncmp]
add esp, 0xc
test eax, eax
jne 0x408fc8
add dword [esp + 4], 7
push 0x45e580
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [0x45b9a4]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
ret

Function at 0x408fe2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [ebp + 8]
mov dword [ebp - 8], 0x100
cmp byte [eax], 0
je 0x40902a
push eax
lea eax, [ebp - 0x108]
push 0x44b700
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x108]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x40902e
xor eax, eax
leave
ret
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor esi, esi
test eax, eax
jne 0x40909e
inc esi
cmp dword [ebp - 4], esi
jne 0x40909c
lea eax, [ebp - 0x108]
push str.Winamp.File
push eax
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
je 0x40909e
lea eax, [ebp - 0x108]
push str.Winamp.PlayList
push eax
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
je 0x40909e
lea eax, [ebp - 0x108]
push str.Winamp.SkinZip
push eax
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
je 0x40909e
xor esi, esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret
Function at 0x409496
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x409501
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
push edi
mov edi, 0x400
jmp 0x4094d7
lea eax, [ebp - 0x404]
push eax
push dword [ebp - 4]
call fcn.00409496
pop ecx
test eax, eax
pop ecx
jne 0x4094ea
lea eax, [ebp - 0x404]
push edi
push eax
push 0
push dword [ebp - 4]
call esi
test eax, eax
je 0x4094c2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
pop edi
pop esi
leave
ret

Function at 0x409503
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1e8
cmp dword [ebp + 0x14], 0
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push edi
jne 0x4095ba
lea eax, [ebp + 0x14]
mov edi, 0x80000000
push eax
push dword [ebp + 0x10]
push edi
call ebx
test eax, eax
jne 0x40955d
push dword [ebp + 8]
call sub.MSVCRT.dll_strlen
pop ecx
inc eax
push eax
push dword [ebp + 8]
push 1
push 0
push str.Content_Type
push dword [ebp + 0x14]
call esi
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 8]
lea eax, [ebp - 0x1e8]
push str.MIMEDatabaseContent_Type_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp + 0x14]
push eax
lea eax, [ebp - 0x1e8]
push eax
push edi
call ebx
test eax, eax
jne 0x4095ba
push str.CLSID
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp + 0x10]
call sub.MSVCRT.dll_strlen
pop ecx
inc eax
push eax
push dword [ebp + 0x10]
push 1
push 0
push str.Extension
push dword [ebp + 0x14]
call esi
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp + 0x14]
push eax
push str.SoftwareNetscapeNetscape_NavigatorViewers
push 0x80000001
call ebx
test eax, eax
jne 0x409668
push dword [ebp + 0xc]
call sub.MSVCRT.dll_strlen
mov edi, dword [ebp + 8]
pop ecx
inc eax
push eax
push dword [ebp + 0xc]
push 1
push 0
push edi
push dword [ebp + 0x14]
call esi
xor ebx, ebx
push ebx
lea eax, [ebp - 0x64]
push str.TYPE_d
push eax
mov dword [ebp + 8], 0x80
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0xe4]
push eax
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 0x64]
push 0
push eax
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
push edi
jne 0x409649
lea eax, [ebp - 0xe4]
push eax
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
je 0x40965f
inc ebx
cmp ebx, 0x3e7
jl 0x4095ef
jmp 0x40965f
call sub.MSVCRT.dll_strlen
pop ecx
inc eax
push eax
push edi
push 1
lea eax, [ebp - 0x64]
push 0
push eax
push dword [ebp + 0x14]
call esi
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40a6c8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov ax, word [0x44bfbc]
push esi
push edi
push 0x40
mov word [ebp - 0x10c], ax
pop ecx
xor eax, eax
lea edi, [ebp - 0x10a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x10b]
push 0xfc
push eax
xor esi, esi
push dword [0x45bf10]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x40a725
lea eax, [ebp - 4]
push eax
push str.AudioCD_shellplaycommand
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x40a729
xor eax, eax
jmp 0x40a784
lea eax, [ebp - 0x10c]
push str.___1
push eax
call sub.MSVCRT.dll_strcat
pop ecx
lea eax, [ebp - 8]
pop ecx
mov dword [ebp - 8], 0x104
push eax
lea eax, [ebp - 0x210]
push eax
push esi
push esi
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40a779
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x40a779
xor esi, esi
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
leave
ret
Function at 0x40a788
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
mov ax, word [0x44bfbc]
push edi
push 0x40
mov word [ebp - 0x10c], ax
pop ecx
xor eax, eax
lea edi, [ebp - 0x10a]
push 0xfc
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x10b]
push eax
push dword [0x45bf10]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x40a999
lea eax, [ebp - 0x10c]
push str.___1
push eax
call sub.MSVCRT.dll_strcat
pop ecx
lea eax, [ebp - 4]
pop ecx
push eax
push str.AudioCD_shellplaycommand
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x40a999
push ebx
lea eax, [ebp + 8]
push esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
lea eax, [ebp - 0x210]
xor ebx, ebx
push eax
cmp dword [ebp + 8], ebx
push ebx
push ebx
mov esi, 0x104
push ebx
mov dword [ebp + 8], esi
push dword [ebp - 4]
je 0x40a8d3
call edi
test eax, eax
lea eax, [ebp - 0x10c]
push eax
jne 0x40a972
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
test eax, eax
pop ecx
je 0x40a98e
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
push eax
lea eax, [ebp - 0x314]
push eax
push ebx
mov esi, str.Winamp_Back
push ebx
push esi
push dword [ebp - 4]
call edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x40a890
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x314]
push eax
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
test eax, eax
pop ecx
je 0x40a8af
lea eax, [ebp - 0x210]
push eax
call sub.MSVCRT.dll_strlen
pop ecx
inc eax
push eax
lea eax, [ebp - 0x210]
push eax
push 1
push ebx
push esi
push dword [ebp - 4]
call edi
lea eax, [ebp - 0x10c]
push eax
call sub.MSVCRT.dll_strlen
pop ecx
inc eax
push eax
lea eax, [ebp - 0x10c]
push eax
push 1
push ebx
push ebx
push dword [ebp - 4]
call edi
jmp 0x40a98e
call edi
test eax, eax
jne 0x40a98e
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x210]
push eax
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
jne 0x40a98e
lea eax, [ebp + 8]
mov dword [ebp + 8], esi
push eax
lea eax, [ebp - 0x210]
push eax
push ebx
mov esi, str.Winamp_Back
push ebx
push esi
push dword [ebp - 4]
call edi
test eax, eax
lea eax, [ebp - 0x10c]
push eax
jne 0x40a96c
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
test eax, eax
pop ecx
jne 0x40a939
mov byte [ebp - 0x210], bl
lea eax, [ebp - 0x210]
push eax
call sub.MSVCRT.dll_strlen
pop ecx
inc eax
push eax
lea eax, [ebp - 0x210]
push eax
push 1
push ebx
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x40a98e
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x40a98e
mov byte [ebp - 0x10c], bl
call sub.MSVCRT.dll_strlen
inc eax
pop ecx
push eax
lea eax, [ebp - 0x10c]
push eax
push 1
push ebx
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
pop edi
leave
ret
Function at 0x40a9c6
Capabilities:
Create process on windows
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x160
push esi
push edi
push 0x10
xor eax, eax
pop ecx
lea edi, [ebp - 0x54]
mov dword [ebp - 0x58], 0x44
xor esi, esi
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x15f]
push 0x104
push eax
mov byte [ebp - 0x160], 0x22
push dword [0x45bf10]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x160]
push str.a.exe_
push eax
call sub.MSVCRT.dll_strlen
lea eax, [ebp + eax - 0x160]
push eax
lea eax, [ebp - 0x15f]
push 0x44ad84
push eax
call fcn.00439a62
add esp, 0x10
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
lea eax, [ebp - 4]
pop ecx
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x40aa89
lea eax, [ebp - 0x160]
push eax
call sub.MSVCRT.dll_strlen
pop ecx
inc eax
push eax
lea eax, [ebp - 0x160]
push eax
push 1
push esi
push str.WinampAgent
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x58]
push eax
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x160]
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop edi
pop esi
leave
ret

Function at 0x40aaa9
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
push str.WinampAgentMain
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x40aacb
push 0
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [ebp - 4]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x40aafa
push str.WinampAgent
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret
Function at 0x40b2c0
Capabilities:
Create thread

Disassembly:
sub esp, 0x18
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebp
push esi
mov esi, dword [esp + 0x28]
push edi
xor eax, eax
mov ecx, 0x40
lea edi, [esi + 0x40]
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], eax
rep stosd dword es:[edi], eax
mov ecx, dword [esi]
lea eax, [esp + 0x10]
push eax
push ecx
call fcn.004198e0
mov edi, eax
add esp, 8
test edi, edi
je 0x40b35a
mov eax, dword [esp + 0x10]
test eax, eax
jl 0x40b308
inc eax
mov dword [esp + 0x10], eax
mov edx, dword [edi + 0xc]
push str.winampGetExtendedRead_open
push edx
mov dword [esp + 0x24], 1
call ebx
mov ebp, eax
mov eax, dword [edi + 0xc]
push str.winampGetExtendedRead_getData
push eax
call ebx
mov ecx, dword [edi + 0xc]
push str.winampGetExtendedRead_close
push ecx
mov dword [esp + 0x28], eax
call ebx
test ebp, ebp
mov edi, eax
jne 0x40b373
mov eax, dword [esp + 0x10]
test eax, eax
jge 0x40b2e5
test ebp, ebp
jne 0x40b373
mov dword [esi + 0x2c], 0x44c07c
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x40b349
mov dword [esi + 0x2c], 0x44c068
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret
xor ecx, ecx
lea edx, [esp + 0x18]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ecx
push edx
lea ecx, [esp + 0x18]
lea eax, [esi + 0x34]
lea edx, [esp + 0x30]
push ecx
push edx
mov dword [eax], 0xffffffff
push eax
mov eax, dword [esi]
push eax
call ebp
mov ebx, eax
add esp, 0x14
test ebx, ebx
jne 0x40b3b7
mov dword [esi + 0x2c], 0x44c054
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
mov eax, dword [esi + 8]
cmp eax, 0x204d4350
je 0x40b401
mov edx, dword [esp + 0x18]
push 0
lea ecx, [esp + 0x20]
push 0
push ecx
mov ecx, dword [esp + 0x38]
push 1
push eax
mov eax, dword [esp + 0x28]
push edx
push eax
push ecx
call fcn.0040b490
add esp, 0x20
test eax, eax
jne 0x40b3f7
mov dword [esi + 0x2c], 0x44c040
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
mov edx, dword [esp + 0x1c]
mov dword [esi + 0x54], eax
mov dword [esi + 0x58], edx
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
push 0
push 0x80
push 2
mov dword [esi + 0x5c], ecx
mov ecx, dword [esi + 4]
push 0
mov dword [esi + 0x44], eax
mov eax, dword [esp + 0x28]
push 1
push 0x40000000
push ecx
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], ebx
mov dword [esi + 0x48], edi
mov dword [esi + 0x60], edx
mov dword [esi + 0x64], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
test eax, eax
jne 0x40b459
mov dword [esi + 0x2c], 0x44c024
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
lea edx, [esp + 0x24]
mov dword [esi + 0x50], eax
push edx
push 0
push esi
push 0x40b940
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x4c], eax
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x18
ret
Function at 0x40b490
Capabilities:
Get common file path
Query or enumerate registry value
Read .ini file

Disassembly:
mov eax, dword [esp + 0x10]
sub esp, 0x110
cmp eax, 0x20564157
push ebx
push ebp
push esi
push edi
jne 0x40b514
mov eax, dword [esp + 0x140]
test eax, eax
jne 0x40b514
mov eax, dword [esp + 0x138]
mov dword [eax], 0
mov eax, dword [esp + 0x134]
test eax, eax
je 0x40b6a0
push 0x18
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x40b6a0
mov ecx, dword [esp + 0x12c]
mov edx, dword [esp + 0x128]
mov dword [eax + 0xc], ecx
mov ecx, dword [esp + 0x124]
pop edi
pop esi
pop ebp
mov dword [eax], 0x447868
mov dword [eax + 4], 0
mov dword [eax + 8], edx
mov dword [eax + 0x10], ecx
pop ebx
add esp, 0x110
ret
mov al, byte [0x450ec0]
test al, al
jne 0x40b5b0
lea edx, [esp + 0x10]
push edx
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40b597
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
push 0x450ec0
push ecx
push 0
push str.CommonFilesDir
push edx
mov dword [esp + 0x2c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40b575
cmp dword [esp + 0x18], 1
je 0x40b57c
mov byte [0x450ec0], 0
push str.NSV
push 0x450ec0
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [0x450ec0]
test al, al
jne 0x40b5b0
push 0x450ec0
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x1c]
push 0x45eb20
push ecx
call esi
lea edx, [esp + 0x1c]
push 0x44ad50
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, dword [esp + 0x140]
mov edi, dword [esp + 0x13c]
mov ebp, dword [esp + 0x138]
mov ebx, dword [esp + 0x134]
mov edx, dword [esp + 0x130]
push eax
mov eax, dword [esp + 0x130]
push edi
push ebp
lea ecx, [esp + 0x28]
push ebx
push ecx
mov ecx, dword [esp + 0x13c]
push edx
mov edx, dword [esp + 0x13c]
push eax
push ecx
push edx
push str.enc_.dll
call fcn.0040b760
add esp, 0x28
test eax, eax
jne 0x40b6a2
push 0x45e580
push eax
mov eax, dword [0x45b9a4]
push str.scannsv
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test eax, eax
je 0x40b6a0
lea ecx, [esp + 0x1c]
push 0x450ec0
push ecx
call esi
lea edx, [esp + 0x1c]
push 0x44ad50
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, dword [esp + 0x140]
mov edx, dword [esp + 0x130]
push eax
mov eax, dword [esp + 0x130]
push edi
push ebp
lea ecx, [esp + 0x28]
push ebx
push ecx
mov ecx, dword [esp + 0x13c]
push edx
mov edx, dword [esp + 0x13c]
push eax
push ecx
push edx
push str.nsv_coder_.dll
call fcn.0040b760
add esp, 0x28
test eax, eax
jne 0x40b6a2
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret
Function at 0x40b760
Capabilities:
Enumerate files on windows

Disassembly:
mov eax, dword [esp + 0x18]
sub esp, 0x750
lea ecx, [esp + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 0x754]
lea eax, [esp + 4]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, dword [esp + 0x770]
test eax, eax
je 0x40b79a
mov dword [eax], 0
push ebx
push ebp
push esi
lea ecx, [esp + 0x21c]
push edi
lea edx, [esp + 0x14]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x10], esi
je 0x40b91a
mov ebp, dword [esp + 0x788]
mov eax, dword [esp + 0x778]
lea ecx, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 0x24c]
lea eax, [esp + 0x14]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
je 0x40b8fc
test ebp, ebp
je 0x40b862
push str.GetAudioTypes3
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x40b8f1
lea edx, [esp + 0x360]
mov esi, 1
push edx
push 0
call edi
add esp, 8
test eax, eax
je 0x40b8f1
mov ecx, dword [ebp + 4]
push eax
lea eax, [esp + 0x364]
push eax
push ecx
call dword [ebp]
lea edx, [esp + 0x36c]
mov eax, esi
push edx
push eax
inc esi
call edi
add esp, 0x14
test eax, eax
jne 0x40b838
jmp 0x40b8f1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CreateAudio3
push ebx
call esi
mov ecx, dword [esp + 0x77c]
test ecx, ecx
jne 0x40b8ba
push str.ConfigAudio3
push ebx
call esi
test eax, eax
je 0x40b8f1
mov ecx, dword [esp + 0x774]
mov edx, dword [esp + 0x784]
push 0x45e580
push ecx
push ebx
push edx
call eax
add esp, 0x10
test eax, eax
je 0x40b8f1
mov ecx, dword [esp + 0x780]
pop edi
pop esi
pop ebp
mov dword [ecx], ebx
pop ebx
add esp, 0x750
ret
test eax, eax
je 0x40b8f1
mov edx, dword [esp + 0x768]
lea ecx, [esp + 0x774]
push 0x45e580
push ecx
mov ecx, dword [esp + 0x778]
push 0x204d4350
push edx
mov edx, dword [esp + 0x77c]
push ecx
push edx
call eax
add esp, 0x18
test eax, eax
jne 0x40b927
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x220]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40b7c7
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x750
ret
mov edx, dword [esp + 0x780]
pop edi
pop esi
pop ebp
mov dword [edx], ebx
pop ebx
add esp, 0x750
ret
Function at 0x40bea0
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov al, byte [0x450890]
push edi
push 0x40
mov byte [ebp - 0x10c], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x10b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
xor edi, edi
test eax, eax
jne 0x40bf0a
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
lea eax, [ebp - 0x10c]
push eax
push edi
push edi
push str.Desktop
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x10c]
push eax
call sub.MSVCRT.dll_strlen
test eax, eax
pop ecx
je 0x40bf5a
lea eax, [ebp - 0x210]
push 0x104
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x10c]
push str.WINAMP.LNK
push eax
call sub.MSVCRT.dll_strcat
push edi
lea eax, [ebp - 0x210]
push edi
push eax
lea eax, [ebp - 0x10c]
push eax
push dword [ebp + 8]
call fcn.00435d90
add esp, 0x1c
pop edi
leave
ret

Function at 0x40bf5d
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov al, byte [0x450890]
push edi
push 0x40
mov byte [ebp - 0x10c], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x10b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
xor edi, edi
test eax, eax
jne 0x40bfc7
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
lea eax, [ebp - 0x10c]
push eax
push edi
push edi
push str.AppData
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x10c]
push eax
call sub.MSVCRT.dll_strlen
test eax, eax
pop ecx
je 0x40c017
lea eax, [ebp - 0x210]
push 0x104
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x10c]
push str.MicrosoftInternet_ExplorerQuick_LaunchWINAMP.LNK
push eax
call sub.MSVCRT.dll_strcat
push edi
lea eax, [ebp - 0x210]
push edi
push eax
lea eax, [ebp - 0x10c]
push eax
push dword [ebp + 8]
call fcn.00435d90
add esp, 0x1c
pop edi
leave
ret
Function at 0x40c01a
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
mov al, byte [0x450890]
push edi
push 0x40
mov byte [ebp - 0x10c], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x10b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
pop edi
jne 0x40c085
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
lea eax, [ebp - 0x10c]
push eax
push 0
push 0
push str.AppData
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x10c]
push eax
call sub.MSVCRT.dll_strlen
test eax, eax
pop ecx
je 0x40c0d7
lea eax, [ebp - 0x10c]
push str.MicrosoftInternet_ExplorerQuick_Launch
push eax
call sub.MSVCRT.dll_strcat
pop ecx
lea eax, [ebp - 0x24c]
pop ecx
push eax
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x40c0d7
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
test byte [ebp - 0x24c], 0x10
je 0x40c0d7
xor eax, eax
inc eax
leave
ret
xor eax, eax
leave
ret