SendMessage(hwndWinamp, WM_WA_IPC, &s, libhsendtoipc);
The parameter to this message is actually a weird struct. The first byte of the struct indicates the command:
0 = Build the send to menu, return a HMENU
1 = Showing the send to menu
2 = A command was clicked
3 = List of selected files
4 = Free allocated memory?
At about offset 0x20 of the struct is where a pointer to the list of null delimeted files is stored. Note however, there is no way to get this message other than from a menu item being clicked on the send to menu. As winamp calls trackmenupopup on the send to menu and will only issue the '3' command on return from this.
It would be possible to intercept and put your own stuff on the send to menu and then intercept this '3' command, but there seems no way to get it without adding stuff to the send to menu
There is also an undocumented(?) IPC to add hot keys with the gen_hotkeys.dll. "GenHotkeysAdd", with the parameter being a struct which contains an offset to a descriptive string, and I suppose a HWND, key command, and window message? Will work it out later on.