Function at 0x40472d
Capabilities:
Delete file
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x5054
call fcn.00470240
push ebx
push esi
push edi
xor ebx, ebx
push dword [ebp + 8]
call fcn.0040441c
push 0xa
mov esi, eax
push str._embedding
push esi
call fcn.004044d3
add esp, 0x10
test al, al
je 0x404764
push 0xa
jmp 0x404b2f
push 2
push 0x473148
push esi
call fcn.004044d3
add esp, 0xc
test al, al
jne 0x404b48
push 4
push str._NEW
push esi
call fcn.004044d3
add esp, 0xc
test al, al
je 0x4047a7
push 4
push esi
call fcn.00414590
mov dword [0x492534], 1
jmp 0x404b35
mov edi, dword [sym.imp.NSCRT.dll__wcsnicmp]
push 5
push str._REG
push esi
call edi
add esp, 0xc
test eax, eax
jne 0x404882
mov word [ebp - 0x1854], bx
mov ecx, 0x1ff
lea edi, [ebp - 0x1852]
rep stosd dword es:[edi], eax
push 5
stosw word es:[edi], ax
push esi
lea edi, [ebp - 0x1854]
call fcn.00414590
mov esi, eax
push 0x400
mov eax, edi
push eax
push esi
call fcn.0040446b
add esp, 0x14
cmp word [ebp - 0x1854], bx
mov dword [0x496198], 1
je 0x404b39
movzx eax, word [edi]
sub eax, 0x41
je 0x404868
dec eax
dec eax
je 0x40485f
dec eax
je 0x404856
sub eax, 8
je 0x40484d
dec eax
dec eax
je 0x404844
sub eax, 5
je 0x40483b
sub eax, 3
jne 0x40486f
or dword [0x496198], 4
jmp 0x40486f
or byte [0x496198], 0x80
jmp 0x40486f
or dword [0x496198], 0x10
jmp 0x40486f
or dword [0x496198], 0x40
jmp 0x40486f
or dword [0x496198], 0x20
jmp 0x40486f
or dword [0x496198], 8
jmp 0x40486f
or dword [0x496198], 2
push edi
call dword [sym.imp.USER32.dll_CharNextW]
mov edi, eax
cmp word [edi], bx
jne 0x404810
jmp 0x404b39
push 6
push str._NOREG
push esi
call fcn.004044d3
add esp, 0xc
test al, al
push 6
je 0x4048ad
push esi
call fcn.00414590
mov dword [0x496a50], 1
jmp 0x404b35
push str._UNREG
push esi
call fcn.004044d3
add esp, 0xc
test al, al
jne 0x404b5f
push 4
push str._ADD
push esi
call edi
add esp, 0xc
test eax, eax
jne 0x4048f2
mov ax, word [esi + 8]
cmp ax, bx
je 0x4048e3
cmp ax, 0x20
jne 0x4048f2
push 4
push esi
call fcn.00414590
mov esi, eax
mov eax, dword [ebp + 0xc]
jmp 0x40491f
push 9
push 0x472fd8
push esi
call edi
add esp, 0xc
test eax, eax
jne 0x40492a
mov ax, word [esi + 0x12]
cmp ax, bx
je 0x404912
cmp ax, 0x20
jne 0x40492a
push 9
push esi
call fcn.00414590
mov esi, eax
mov eax, dword [ebp + 0x10]
mov dword [eax], 1
jmp 0x404b37
push 8
push str._CONFIG
push esi
call edi
add esp, 0xc
test eax, eax
push 8
jne 0x404992
mov word [ebp - 0x2054], bx
mov ecx, 0x1ff
lea edi, [ebp - 0x2052]
rep stosd dword es:[edi], eax
push esi
stosw word es:[edi], ax
call fcn.00414590
mov esi, eax
push 0x400
lea eax, [ebp - 0x2054]
push eax
push esi
call fcn.0040446b
push ebx
lea eax, [ebp - 0x2054]
push ebx
push eax
call fcn.00402b25
mov edi, eax
push edi
call fcn.00405469
push edi
call dword [sym.imp.NSCRT.dll_free]
add esp, 0x28
jmp 0x404b39
push str._INIDIR
push esi
call edi
add esp, 0xc
test eax, eax
push 8
jne 0x4049eb
mov word [ebp - 0x2854], bx
mov ecx, 0x1ff
lea edi, [ebp - 0x2852]
rep stosd dword es:[edi], eax
push esi
stosw word es:[edi], ax
call fcn.00414590
mov esi, eax
push 0x400
lea eax, [ebp - 0x2854]
push eax
push esi
call fcn.0040446b
push ebx
lea eax, [ebp - 0x2854]
push ebx
push eax
call fcn.00402b25
mov edi, eax
push edi
call fcn.00406762
jmp 0x404983
push str._M3UDIR
push esi
call edi
add esp, 0xc
test eax, eax
jne 0x404a40
mov word [ebp - 0x3054], bx
mov ecx, 0x1ff
lea edi, [ebp - 0x3052]
rep stosd dword es:[edi], eax
push 8
push esi
stosw word es:[edi], ax
call fcn.00414590
mov esi, eax
push 0x400
lea eax, [ebp - 0x3054]
push eax
push esi
call fcn.0040446b
lea eax, [ebp - 0x3054]
push eax
call fcn.0040678d
add esp, 0x18
jmp 0x404b39
push 7
push str._CLASS
push esi
call edi
add esp, 0xc
test eax, eax
push 7
jne 0x404a9e
mov word [ebp - 0x854], bx
mov ecx, 0x1ff
lea edi, [ebp - 0x852]
rep stosd dword es:[edi], eax
push esi
stosw word es:[edi], ax
call fcn.00414590
mov esi, eax
push 0x400
lea eax, [ebp - 0x854]
push eax
push esi
call fcn.0040446b
add esp, 0x14
lea eax, [ebp - 0x854]
push eax
push 0x40
push 0x4965c0
call fcn.00467521
jmp 0x404b39
push str._DELM3U
push esi
call fcn.004044d3
add esp, 0xc
test al, al
jne 0x404c6c
push 6
push str._CLOSE
push esi
call fcn.004044d3
add esp, 0xc
test al, al
push 5
jne 0x404c8a
push str._KILL
push esi
call fcn.004044d3
add esp, 0xc
test al, al
jne 0x404caf
push 8
push str._RETURN
push esi
call edi
add esp, 0xc
test eax, eax
je 0x404d34
push 6
push str._BURN
push esi
call edi
add esp, 0xc
test eax, eax
je 0x404d6b
push 8
push str._WATCHER
push esi
call edi
add esp, 0xc
test eax, eax
je 0x404e12
cmp word [esi], 0x2f
jne 0x404e4e
push 1
push esi
call fcn.00414590
mov esi, eax
pop ecx
pop ecx
push esi
call fcn.00404438
pop ecx
mov dword [ebp + 8], eax
jmp 0x40473f
push ebx
push 0x47302c
push 0x472ee0
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x404e47
push ebx
lea edi, [ebp - 0x5054]
call dword [sym.imp.ole32.dll_CoInitialize]
call fcn.004067e5
call fcn.004550dd
call fcn.0042a970
push 0x2000
mov eax, edi
push eax
push str.config_extlist
mov byte [ebp - 0x5054], bl
call fcn.004056ca
add esp, 0xc
cmp byte [edi], bl
je 0x404bc0
push 0x473018
push edi
call dword [sym.imp.NSCRT.dll_strstr]
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
je 0x404bb1
mov byte [esi], bl
inc esi
push ebx
push edi
call fcn.004062cc
cmp esi, ebx
pop ecx
pop ecx
mov edi, esi
jne 0x404b96
mov ecx, dword [0x492558]
push 0x400
lea eax, [ebp - 0x854]
push eax
push 0x82
mov word [ebp - 0x854], bx
call fcn.004184ff
cmp word [ebp - 0x854], bx
lea esi, [ebp - 0x854]
je 0x404c24
push ebx
push ebx
push esi
lea ecx, [ebp - 4]
call fcn.00402b8d
push ebx
push dword [eax]
call fcn.004062cc
push dword [ebp - 4]
call dword [sym.imp.NSCRT.dll_free]
add esp, 0xc
push esi
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [esi + eax*2 + 2]
cmp word [esi], bx
jne 0x404bf2
mov esi, 0x473004
push ebx
push esi
call fcn.004062cc
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esi + eax + 1]
cmp byte [esi], bl
jne 0x404c29
push ebx
call fcn.004054fc
pop ecx
call fcn.00410cc2
test eax, eax
je 0x404c56
call fcn.004054ab
push ebx
call fcn.00410e2f
pop ecx
call fcn.0042aa71
call fcn.004552b8
jmp 0x404e47
call fcn.004067e5
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x4861b0
call esi
push 0x4845d8
call esi
jmp 0x404e47
push esi
call fcn.00414590
pop ecx
pop ecx
call fcn.004046b9
cmp eax, ebx
je 0x404e47
push ebx
push ebx
push 0x10
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x404e47
push 5
push esi
mov dword [ebp - 4], ebx
call fcn.00414590
pop ecx
pop ecx
call fcn.004046b9
mov esi, eax
cmp esi, ebx
je 0x404e47
push ebx
push ebx
push 0x10
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp dword [ebp - 4], ebx
je 0x404e47
push dword [ebp - 4]
push ebx
push 0x100401
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
cmp edi, ebx
je 0x404e47
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xbb8
push edi
call esi
cmp eax, 0x102
jne 0x404d28
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x3e8
push edi
call esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x404e47
push 0x13
pop ecx
mov word [ebp - 0x54], bx
xor eax, eax
lea edi, [ebp - 0x52]
rep stosd dword es:[edi], eax
push 8
push esi
stosw word es:[edi], ax
call fcn.00414590
push 0x28
lea ecx, [ebp - 0x54]
push ecx
push eax
call fcn.0040446b
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.NSCRT.dll__wtoi]
add esp, 0x18
push eax
jmp 0x404e48
mov word [ebp - 0x854], bx
xor eax, eax
mov ecx, 0x1ff
lea edi, [ebp - 0x852]
rep stosd dword es:[edi], eax
push 6
push esi
stosw word es:[edi], ax
call fcn.00414590
push 0x400
lea ecx, [ebp - 0x854]
push ecx
push eax
call fcn.0040446b
add esp, 0x14
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
call fcn.004067e5
call fcn.004550dd
call fcn.0042f777
call fcn.0042a970
call fcn.00428736
push 1
call fcn.00406d03
push ebx
lea eax, [ebp - 0x854]
push ebx
push eax
call fcn.00402b25
push dword [0x496644]
mov esi, eax
push dword [0x4924ec]
push esi
call fcn.00466e32
push esi
mov edi, eax
call dword [sym.imp.NSCRT.dll_free]
add esp, 0x20
call fcn.00427c1c
call fcn.0042aa71
call fcn.004552b8
call fcn.0042f7e2
push edi
jmp 0x404e48
mov word [ebp - 0x1054], bx
xor eax, eax
mov ecx, 0x3ff
lea edi, [ebp - 0x1052]
rep stosd dword es:[edi], eax
push 9
push esi
stosw word es:[edi], ax
call fcn.00414590
push 0x800
lea ecx, [ebp - 0x1054]
push ecx
push eax
call fcn.0040446b
add esp, 0x14
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret