Function at 0x4048fa
Capabilities:
Delete file
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x5054
call fcn.00483980
push ebx
push esi
push edi
xor ebx, ebx
push dword [ebp + 8]
call fcn.004045c5
push 0xa
mov esi, eax
push str._embedding
push esi
call fcn.0040467c
add esp, 0x10
test al, al
je 0x404931
push 0xa
jmp 0x404cfc
push 2
push 0x4872b0
push esi
call fcn.0040467c
add esp, 0xc
test al, al
jne 0x404d15
push 4
push str._NEW
push esi
call fcn.0040467c
add esp, 0xc
test al, al
je 0x404974
push 4
push esi
call fcn.0041853b
mov dword [0x4ac390], 1
jmp 0x404d02
mov edi, dword [sym.imp.NSCRT.dll__wcsnicmp]
push 5
push str._REG
push esi
call edi
add esp, 0xc
test eax, eax
jne 0x404a4f
mov word [ebp - 0x1854], bx
mov ecx, 0x1ff
lea edi, [ebp - 0x1852]
rep stosd dword es:[edi], eax
push 5
stosw word es:[edi], ax
push esi
lea edi, [ebp - 0x1854]
call fcn.0041853b
mov esi, eax
push 0x400
mov eax, edi
push eax
push esi
call fcn.00404614
add esp, 0x14
cmp word [ebp - 0x1854], bx
mov dword [0x4b002c], 1
je 0x404d06
movzx eax, word [edi]
sub eax, 0x41
je 0x404a35
dec eax
dec eax
je 0x404a2c
dec eax
je 0x404a23
sub eax, 8
je 0x404a1a
dec eax
dec eax
je 0x404a11
sub eax, 5
je 0x404a08
sub eax, 3
jne 0x404a3c
or dword [0x4b002c], 4
jmp 0x404a3c
or byte [0x4b002c], 0x80
jmp 0x404a3c
or dword [0x4b002c], 0x10
jmp 0x404a3c
or dword [0x4b002c], 0x40
jmp 0x404a3c
or dword [0x4b002c], 0x20
jmp 0x404a3c
or dword [0x4b002c], 8
jmp 0x404a3c
or dword [0x4b002c], 2
push edi
call dword [sym.imp.USER32.dll_CharNextW]
mov edi, eax
cmp word [edi], bx
jne 0x4049dd
jmp 0x404d06
push 6
push str._NOREG
push esi
call fcn.0040467c
add esp, 0xc
test al, al
push 6
je 0x404a7a
push esi
call fcn.0041853b
mov dword [0x4b0a10], 1
jmp 0x404d02
push str._UNREG
push esi
call fcn.0040467c
add esp, 0xc
test al, al
jne 0x404d2c
push 4
push str._ADD
push esi
call edi
add esp, 0xc
test eax, eax
jne 0x404abf
mov ax, word [esi + 8]
cmp ax, bx
je 0x404ab0
cmp ax, 0x20
jne 0x404abf
push 4
push esi
call fcn.0041853b
mov esi, eax
mov eax, dword [ebp + 0xc]
jmp 0x404aec
push 9
push 0x487140
push esi
call edi
add esp, 0xc
test eax, eax
jne 0x404af7
mov ax, word [esi + 0x12]
cmp ax, bx
je 0x404adf
cmp ax, 0x20
jne 0x404af7
push 9
push esi
call fcn.0041853b
mov esi, eax
mov eax, dword [ebp + 0x10]
mov dword [eax], 1
jmp 0x404d04
push 8
push str._CONFIG
push esi
call edi
add esp, 0xc
test eax, eax
push 8
jne 0x404b5f
mov word [ebp - 0x2054], bx
mov ecx, 0x1ff
lea edi, [ebp - 0x2052]
rep stosd dword es:[edi], eax
push esi
stosw word es:[edi], ax
call fcn.0041853b
mov esi, eax
push 0x400
lea eax, [ebp - 0x2054]
push eax
push esi
call fcn.00404614
push ebx
lea eax, [ebp - 0x2054]
push ebx
push eax
call fcn.00402b25
mov edi, eax
push edi
call fcn.004061e8
push edi
call dword [sym.imp.NSCRT.dll_free]
add esp, 0x28
jmp 0x404d06
push str._INIDIR
push esi
call edi
add esp, 0xc
test eax, eax
push 8
jne 0x404bb8
mov word [ebp - 0x2854], bx
mov ecx, 0x1ff
lea edi, [ebp - 0x2852]
rep stosd dword es:[edi], eax
push esi
stosw word es:[edi], ax
call fcn.0041853b
mov esi, eax
push 0x400
lea eax, [ebp - 0x2854]
push eax
push esi
call fcn.00404614
push ebx
lea eax, [ebp - 0x2854]
push ebx
push eax
call fcn.00402b25
mov edi, eax
push edi
call fcn.004070a2
jmp 0x404b50
push str._M3UDIR
push esi
call edi
add esp, 0xc
test eax, eax
jne 0x404c0d
mov word [ebp - 0x3054], bx
mov ecx, 0x1ff
lea edi, [ebp - 0x3052]
rep stosd dword es:[edi], eax
push 8
push esi
stosw word es:[edi], ax
call fcn.0041853b
mov esi, eax
push 0x400
lea eax, [ebp - 0x3054]
push eax
push esi
call fcn.00404614
lea eax, [ebp - 0x3054]
push eax
call fcn.004070cd
add esp, 0x18
jmp 0x404d06
push 7
push str._CLASS
push esi
call edi
add esp, 0xc
test eax, eax
push 7
jne 0x404c6b
mov word [ebp - 0x854], bx
mov ecx, 0x1ff
lea edi, [ebp - 0x852]
rep stosd dword es:[edi], eax
push esi
stosw word es:[edi], ax
call fcn.0041853b
mov esi, eax
push 0x400
lea eax, [ebp - 0x854]
push eax
push esi
call fcn.00404614
add esp, 0x14
lea eax, [ebp - 0x854]
push eax
push 0x40
push 0x4b0460
call fcn.0047aaff
jmp 0x404d06
push str._DELM3U
push esi
call fcn.0040467c
add esp, 0xc
test al, al
jne 0x404e4b
push 6
push str._CLOSE
push esi
call fcn.0040467c
add esp, 0xc
test al, al
push 5
jne 0x404e69
push str._KILL
push esi
call fcn.0040467c
add esp, 0xc
test al, al
jne 0x404e8e
push 8
push str._RETURN
push esi
call edi
add esp, 0xc
test eax, eax
je 0x404f13
push 6
push str._BURN
push esi
call edi
add esp, 0xc
test eax, eax
je 0x404f4a
push 8
push str._WATCHER
push esi
call edi
add esp, 0xc
test eax, eax
je 0x404ff1
cmp word [esi], 0x2f
jne 0x40502d
push 1
push esi
call fcn.0041853b
mov esi, eax
pop ecx
pop ecx
push esi
call fcn.004045e1
pop ecx
mov dword [ebp + 8], eax
jmp 0x40490c
push ebx
push 0x487194
push str._NEW_n_REG_n_NOREG_n_UNREG_n_ADD_n_BOOKMARK_n_CONFIG_n_INIDIR_n_M3UDIR_n_CLASS_n_DELM3U_n_CLOSE_n_KILL_n_RETURN_n_BURN_n_WATCHER_n
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x405026
push ebx
lea esi, [ebp - 0x5054]
call dword [sym.imp.ole32.dll_CoInitialize]
call fcn.00407125
call fcn.0045b8e7
call fcn.0042f17e
push 0x2000
mov eax, esi
push eax
push str.config_extlist
mov byte [ebp - 0x5054], bl
call fcn.00406402
add esp, 0xc
cmp byte [esi], bl
je 0x404d8d
push 0x487180
push esi
call dword [sym.imp.NSCRT.dll_strstr]
mov edi, eax
cmp edi, ebx
pop ecx
pop ecx
je 0x404d7e
mov byte [edi], bl
inc edi
push ebx
push esi
call fcn.0040772b
cmp edi, ebx
pop ecx
pop ecx
mov esi, edi
jne 0x404d63
mov ecx, dword [0x4ac3b4]
push 0x400
lea eax, [ebp - 0x854]
push eax
push 0x82
mov word [ebp - 0x854], bx
call fcn.00404831
cmp word [ebp - 0x854], bx
lea esi, [ebp - 0x854]
je 0x404df1
push ebx
push ebx
push esi
lea ecx, [ebp - 4]
call fcn.00402b8d
push ebx
push dword [eax]
call fcn.0040772b
push dword [ebp - 4]
call dword [sym.imp.NSCRT.dll_free]
add esp, 0xc
push esi
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [esi + eax*2 + 2]
cmp word [esi], bx
jne 0x404dbf
mov esi, 0x48716c
push ebx
push esi
call fcn.0040772b
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esi + eax + 1]
cmp byte [esi], bl
jne 0x404df6
push ebx
call fcn.004075d7
pop ecx
call fcn.00412a47
test eax, eax
je 0x404e23
call fcn.00407586
push ebx
call fcn.00412be1
pop ecx
call fcn.0042f27f
call fcn.0045ba74
push ebx
push ebx
push 0x2000
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
jmp 0x405026
call fcn.00407125
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x49fb70
call esi
push 0x49d978
call esi
jmp 0x405026
push esi
call fcn.0041853b
pop ecx
pop ecx
call fcn.00404886
cmp eax, ebx
je 0x405026
push ebx
push ebx
push 0x10
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x405026
push 5
push esi
mov dword [ebp - 4], ebx
call fcn.0041853b
pop ecx
pop ecx
call fcn.00404886
mov esi, eax
cmp esi, ebx
je 0x405026
push ebx
push ebx
push 0x10
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp dword [ebp - 4], ebx
je 0x405026
push dword [ebp - 4]
push ebx
push 0x100401
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
cmp edi, ebx
je 0x405026
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xbb8
push edi
call esi
cmp eax, 0x102
jne 0x404f07
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x3e8
push edi
call esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x405026
push 0x13
pop ecx
mov word [ebp - 0x54], bx
xor eax, eax
lea edi, [ebp - 0x52]
rep stosd dword es:[edi], eax
push 8
push esi
stosw word es:[edi], ax
call fcn.0041853b
push 0x28
lea ecx, [ebp - 0x54]
push ecx
push eax
call fcn.00404614
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.NSCRT.dll__wtoi]
add esp, 0x18
push eax
jmp 0x405027
mov word [ebp - 0x854], bx
xor eax, eax
mov ecx, 0x1ff
lea edi, [ebp - 0x852]
rep stosd dword es:[edi], eax
push 6
push esi
stosw word es:[edi], ax
call fcn.0041853b
push 0x400
lea ecx, [ebp - 0x854]
push ecx
push eax
call fcn.00404614
add esp, 0x14
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
call fcn.00407125
call fcn.0045b8e7
call fcn.00434a75
call fcn.0042f17e
call fcn.0042cb19
push 1
call fcn.00407c8a
push ebx
lea eax, [ebp - 0x854]
push ebx
push eax
call fcn.00402b25
push dword [0x4b0600]
mov esi, eax
push dword [0x4ac344]
push esi
call fcn.0047a3f4
push esi
mov edi, eax
call dword [sym.imp.NSCRT.dll_free]
add esp, 0x20
call fcn.0042c244
call fcn.0042f27f
call fcn.0045ba74
call fcn.00434ae0
push edi
jmp 0x405027
mov word [ebp - 0x1054], bx
xor eax, eax
mov ecx, 0x3ff
lea edi, [ebp - 0x1052]
rep stosd dword es:[edi], eax
push 9
push esi
stosw word es:[edi], ax
call fcn.0041853b
push 0x800
lea ecx, [ebp - 0x1054]
push ecx
push eax
call fcn.00404614
add esp, 0x14
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret