Function at 0x434440
Capabilities:
Delete file
Persist via default file association registry key
Persist via run registry key
Read .ini file
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x4a669a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x420
mov eax, dword [0x4cbba0]
xor eax, esp
push ebx
lea ecx, [esp + 4]
mov dword [esp + 0x420], eax
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_1]
xor ebx, ebx
mov dword [esp + 0x42c], ebx
mov dword [esp + 0xc], ebx
lea ecx, [esp + 0x10]
mov byte [esp + 0x42c], 1
call fcn.004121c0
mov dword [esp + 0x14], eax
mov byte [eax + 0x45], 1
mov eax, dword [esp + 0x14]
mov dword [eax + 4], eax
mov eax, dword [esp + 0x14]
mov dword [eax], eax
mov eax, dword [esp + 0x14]
mov dword [eax + 8], eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
push str.configenumwindow.ini
lea eax, [esp + 0xc]
push 0x4cbdc0
push eax
mov byte [esp + 0x438], 2
call fcn.004010a0
add esp, 0xc
push eax
lea ecx, [esp + 8]
mov byte [esp + 0x430], 3
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator_1]
lea ecx, [esp + 8]
mov byte [esp + 0x42c], 2
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 4]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push ebx
push eax
lea ecx, [esp + 0x18]
call fcn.0041b700
push 0x200
lea ecx, [esp + 0x24]
push ecx
push 0x4acbb2
push str.NAME
push str.MSGWINDOW
lea ecx, [esp + 0x24]
call fcn.00417e50
lea edx, [esp + 0x20]
push str.ppfilm
push edx
call dword [sym.imp.MSVCR71.dll__stricmp]
add esp, 8
test eax, eax
je 0x43458a
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
push eax
push ecx
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x438], 1
call fcn.00418150
mov ecx, dword [esp + 0x14]
push ecx
call sub.MFC71.DLL_operator_delete_1
add esp, 4
lea ecx, [esp + 4]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
jmp 0x435598
push ebp
push esi
push edi
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
mov edi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push eax
push str.PIPIPlayer
push str.NAME
push str.MSGWINDOW
call edi
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
push 0x4b2740
push str.PLAYERNAME
push str.MSGWINDOW
call edi
push 0x200
lea edx, [esp + 0x30]
push edx
push 0x4acbb2
push str.AdUrl
push str.MSGWINDOW
lea ecx, [esp + 0x30]
call fcn.00417e50
mov esi, dword [sym.imp.MSVCR71.dll_strstr]
lea eax, [esp + 0x2c]
push str.www.ppfilm.cn
push eax
call esi
add esp, 8
test eax, eax
je 0x434622
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
push str.http:__www.pipi.cn_player_
push str.AdUrl
push str.MSGWINDOW
call edi
push 0x200
lea ecx, [esp + 0x30]
push ecx
push 0x4acbb2
push str.TopClickURL
push str.MSGWINDOW
lea ecx, [esp + 0x30]
call fcn.00417e50
lea edx, [esp + 0x2c]
push str.www.ppfilm.cn
push edx
call esi
add esp, 8
test eax, eax
je 0x434673
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
push str.http:__www.pipi.cn
push str.TopClickURL
push str.MSGWINDOW
call edi
push 0x200
lea eax, [esp + 0x30]
push eax
push 0x4acbb2
push str.AppendWindow
push str.MSGWINDOW
lea ecx, [esp + 0x30]
call fcn.00417e50
lea ecx, [esp + 0x2c]
push str.www.ppfilm.cn
push ecx
call esi
add esp, 8
test eax, eax
je 0x4346c4
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
push 0x4b2698
push str.AppendWindow
push str.MSGWINDOW
call edi
push str.pphelp.url
lea edx, [esp + 0x18]
push 0x4cbdc0
push edx
call fcn.004010a0
add esp, 0xc
mov ecx, eax
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push eax
push 0x200
lea eax, [esp + 0x34]
push eax
push 0x4acbb2
push 0x4ad2cc
push str.InternetShortcut
call ebp
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 0x2c]
push str.www.ppfilm.cn
push ecx
call esi
add esp, 8
test eax, eax
je 0x43475d
push str.pphelp.url
lea edx, [esp + 0x18]
push 0x4cbdc0
push edx
call fcn.004010a0
add esp, 0xc
mov ecx, eax
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
push str.http:__www.pipi.cn_help
push 0x4ad2cc
push str.InternetShortcut
call edi
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
push str.jfCacheMgr.url
lea eax, [esp + 0x18]
push 0x4cbdc0
push eax
call fcn.004010a0
add esp, 0xc
mov ecx, eax
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
push 0x200
lea ecx, [esp + 0x34]
push ecx
push 0x4acbb2
push 0x4ad2cc
push str.InternetShortcut
call ebp
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea edx, [esp + 0x2c]
push str.www.ppfilm.cn
push edx
call esi
add esp, 8
test eax, eax
je 0x4347f0
push str.jfCacheMgr.url
lea eax, [esp + 0x18]
push 0x4cbdc0
push eax
call fcn.004010a0
add esp, 0xc
mov ecx, eax
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
push str.http:__www.pipi.cn
push 0x4ad2cc
push str.InternetShortcut
call edi
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 0x14]
push ecx
push 0x2001f
push ebx
push str.KmMediaPlayer_shellopencommand
push SysReAllocString
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x4348c2
mov edi, dword [esp + 0x14]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x30]
push eax
mov ebp, edi
push 0x4acbb2
lea ecx, [esp + 0x24]
mov dword [esp + 0x24], ebp
mov dword [esp + 0x20], 0x200
call fcn.0042d6f0
test eax, eax
jne 0x4348ad
lea ecx, [esp + 0x2c]
push str.PPFilmPlayer.exe
push ecx
call esi
add esp, 8
test eax, eax
je 0x4348ad
push 0x4b265c
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator_2]
push 0x4cbdc0
lea ecx, [esp + 0x14]
call dword [0x4ab4b4]
push str.PIPIPlayer.exe____L_
lea ecx, [esp + 0x14]
call dword [0x4ab278]
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::GetLength]
mov esi, eax
lea ecx, [esp + 0x10]
inc esi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push esi
push eax
push 1
push ebx
push 0x4acbb2
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp edi, ebx
je 0x4348c6
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call edi
mov dword [esp + 0x18], ebx
mov ebp, ebx
jmp 0x4348cc
mov ebp, dword [esp + 0x18]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x14]
push edx
push 0x20019
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WS2_32.dll_accept
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x434bb4
xor eax, eax
cmp ebp, ebx
je 0x4348fc
push ebp
call edi
cmp eax, ebx
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x18], ecx
jne 0x434bb0
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x30]
push eax
push str.Desktop
lea ecx, [esp + 0x24]
mov dword [esp + 0x20], 0x200
call fcn.0042d6f0
test eax, eax
jne 0x434bb0
lea ecx, [esp + 0x2c]
push ecx
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator_2]
push 0x4ad6f0
lea ecx, [esp + 0x14]
call dword [0x4ab278]
push 0x4b25e4
lea ecx, [esp + 0x14]
call dword [0x4ab278]
lea edx, [esp + 0x22c]
push edx
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call fcn.0049bba0
add esp, 8
test eax, eax
je 0x4349d3
push str.PIPIPlayer.exe
lea eax, [esp + 0x18]
push 0x4cbdc0
push eax
call fcn.004010a0
add esp, 0xc
mov esi, eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x438], 4
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
push ebx
push ebx
push ebx
push ebx
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call fcn.0049bcd0
add esp, 0x18
lea ecx, [esp + 0x14]
mov byte [esp + 0x438], 2
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 0x2c]
push ecx
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator_2]
push 0x4ad6f0
lea ecx, [esp + 0x14]
call dword [0x4ab278]
push 0x4b25c4
lea ecx, [esp + 0x14]
call dword [0x4ab278]
lea edx, [esp + 0x22c]
push edx
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call fcn.0049bba0
add esp, 8
test eax, eax
je 0x434a72
push str.PIPIPlayer.exe
lea eax, [esp + 0x18]
push 0x4cbdc0
push eax
call fcn.004010a0
add esp, 0xc
mov esi, eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x438], 5
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
push ebx
push ebx
push ebx
push ebx
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call fcn.0049bcd0
add esp, 0x18
lea ecx, [esp + 0x14]
mov byte [esp + 0x438], 2
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 0x2c]
push ecx
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator_2]
push 0x4ad6f0
lea ecx, [esp + 0x14]
call dword [0x4ab278]
push 0x4b25b4
lea ecx, [esp + 0x14]
call dword [0x4ab278]
lea edx, [esp + 0x22c]
push edx
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call fcn.0049bba0
add esp, 8
test eax, eax
je 0x434b11
push str.PIPIPlayer.exe
lea eax, [esp + 0x18]
push 0x4cbdc0
push eax
call fcn.004010a0
add esp, 0xc
mov esi, eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x438], 6
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
push ebx
push ebx
push ebx
push ebx
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call fcn.0049bcd0
add esp, 0x18
lea ecx, [esp + 0x14]
mov byte [esp + 0x438], 2
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 0x2c]
push ecx
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator_2]
push 0x4ad6f0
lea ecx, [esp + 0x14]
call dword [0x4ab278]
push str.PPFilm_Player.lnk
lea ecx, [esp + 0x14]
call dword [0x4ab278]
lea edx, [esp + 0x22c]
push edx
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call fcn.0049bba0
add esp, 8
test eax, eax
je 0x434bb0
push str.PIPIPlayer.exe
lea eax, [esp + 0x18]
push 0x4cbdc0
push eax
call fcn.004010a0
add esp, 0xc
mov esi, eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x438], 7
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
push ebx
push ebx
push ebx
push ebx
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call fcn.0049bcd0
add esp, 0x18
lea ecx, [esp + 0x14]
mov byte [esp + 0x438], 2
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
mov ebp, dword [esp + 0x18]
cmp ebp, ebx
je 0x434bc1
push ebp
call edi
mov dword [esp + 0x18], ebx
mov ebp, ebx
lea ecx, [esp + 0x14]
push ecx
push 0x20019
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WS2_32.dll_accept
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x434ecc
xor eax, eax
cmp ebp, ebx
je 0x434bf1
push ebp
call edi
cmp eax, ebx
mov edx, dword [esp + 0x14]
mov dword [esp + 0x18], edx
jne 0x434ec8
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x30]
push ecx
push str.AppData
lea ecx, [esp + 0x24]
mov dword [esp + 0x20], 0x200
call fcn.0042d6f0
test eax, eax
jne 0x434ec8
lea edi, [esp + 0x2c]
dec edi
mov edi, edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x434c30
mov ecx, 0xa
mov esi, str.MicrosoftInternet_ExplorerQuick_Launch
rep movsd dword es:[edi], dword [esi]
lea edx, [esp + 0x2c]
push edx
lea ecx, [esp + 0x14]
movsw word es:[edi], word [esi]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator_2]
push 0x4ad6f0
lea ecx, [esp + 0x14]
call dword [0x4ab278]
push 0x4b25e4
lea ecx, [esp + 0x14]
call dword [0x4ab278]
lea eax, [esp + 0x22c]
push eax
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call fcn.0049bba0
add esp, 8
test eax, eax
je 0x434ce5
push str.PIPIPlayer.exe
lea ecx, [esp + 0x18]
push 0x4cbdc0
push ecx
call fcn.004010a0
add esp, 0xc
mov esi, eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x438], 8
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
push ebx
push ebx
push ebx
push ebx
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call fcn.0049bcd0
add esp, 0x18
lea ecx, [esp + 0x14]
mov byte [esp + 0x438], 2
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea edx, [esp + 0x2c]
push edx
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator_2]
push 0x4ad6f0
lea ecx, [esp + 0x14]
call dword [0x4ab278]
push 0x4b25c4
lea ecx, [esp + 0x14]
call dword [0x4ab278]
lea eax, [esp + 0x22c]
push eax
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call fcn.0049bba0
add esp, 8
test eax, eax
je 0x434d84
push str.PIPIPlayer.exe
lea ecx, [esp + 0x18]
push 0x4cbdc0
push ecx
call fcn.004010a0
add esp, 0xc
mov esi, eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x438], 9
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
push ebx
push ebx
push ebx
push ebx
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call fcn.0049bcd0
add esp, 0x18
lea ecx, [esp + 0x14]
mov byte [esp + 0x438], 2
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea edx, [esp + 0x2c]
push edx
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator_2]
push 0x4ad6f0
lea ecx, [esp + 0x14]
call dword [0x4ab278]
push 0x4b25b4
lea ecx, [esp + 0x14]
call dword [0x4ab278]
lea eax, [esp + 0x22c]
push eax
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call fcn.0049bba0
add esp, 8
test eax, eax
je 0x434e23
push str.PIPIPlayer.exe
lea ecx, [esp + 0x18]
push 0x4cbdc0
push ecx
call fcn.004010a0
add esp, 0xc
mov esi, eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x438], 0xa
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
push ebx
push ebx
push ebx
push ebx
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call fcn.0049bcd0
add esp, 0x18
lea ecx, [esp + 0x14]
mov byte [esp + 0x438], 2
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea edx, [esp + 0x2c]
push edx
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator_2]
push 0x4ad6f0
lea ecx, [esp + 0x14]
call dword [0x4ab278]
push str.PPFilm_Player.lnk
lea ecx, [esp + 0x14]
call dword [0x4ab278]
lea eax, [esp + 0x22c]
push eax
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call fcn.0049bba0
add esp, 8
test eax, eax
je 0x434ec2
push str.PIPIPlayer.exe
lea ecx, [esp + 0x18]
push 0x4cbdc0
push ecx
call fcn.004010a0
add esp, 0xc
mov esi, eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x438], 0xb
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
push ebx
push ebx
push ebx
push ebx
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call fcn.0049bcd0
add esp, 0x18
lea ecx, [esp + 0x14]
mov byte [esp + 0x438], 2
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebp, dword [esp + 0x18]
cmp ebp, ebx
je 0x434ed9
push ebp
call edi
mov dword [esp + 0x18], ebx
mov ebp, ebx
lea edx, [esp + 0x14]
push edx
push 0x20019
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WS2_32.dll_accept
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x4351e5
xor eax, eax
cmp ebp, ebx
je 0x434f09
push ebp
call edi
cmp eax, ebx
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x18], ecx
jne 0x4351e1
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x30]
push eax
push str.Programs
lea ecx, [esp + 0x24]
mov dword [esp + 0x20], 0x200
call fcn.0042d6f0
test eax, eax
jne 0x4351e1
lea edi, [esp + 0x2c]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x434f46
mov ecx, dword [str.PPFilm]
mov edx, dword [0x4b255c]
mov dword [edi], ecx
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x14]
mov dword [edi + 4], edx
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator_2]
push 0x4ad6f0
lea ecx, [esp + 0x14]
call dword [0x4ab278]
push 0x4b25e4
lea ecx, [esp + 0x14]
call dword [0x4ab278]
lea ecx, [esp + 0x22c]
push ecx
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call fcn.0049bba0
add esp, 8
test eax, eax
je 0x434ffe
push str.PIPIPlayer.exe
lea edx, [esp + 0x18]
push 0x4cbdc0
push edx
call fcn.004010a0
add esp, 0xc
mov esi, eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x438], 0xc
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
push ebx
push ebx
push ebx
push ebx
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call fcn.0049bcd0
add esp, 0x18
lea ecx, [esp + 0x14]
mov byte [esp + 0x438], 2
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator_2]
push 0x4ad6f0
lea ecx, [esp + 0x14]
call dword [0x4ab278]
push 0x4b25c4
lea ecx, [esp + 0x14]
call dword [0x4ab278]
lea ecx, [esp + 0x22c]
push ecx
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call fcn.0049bba0
add esp, 8
test eax, eax
je 0x43509d
push str.PIPIPlayer.exe
lea edx, [esp + 0x18]
push 0x4cbdc0
push edx
call fcn.004010a0
add esp, 0xc
mov esi, eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x438], 0xd
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
push ebx
push ebx
push ebx
push ebx
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call fcn.0049bcd0
add esp, 0x18
lea ecx, [esp + 0x14]
mov byte [esp + 0x438], 2
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator_2]
push 0x4ad6f0
lea ecx, [esp + 0x14]
call dword [0x4ab278]
push 0x4b25b4
lea ecx, [esp + 0x14]
call dword [0x4ab278]
lea ecx, [esp + 0x22c]
push ecx
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call fcn.0049bba0
add esp, 8
test eax, eax
je 0x43513c
push str.PIPIPlayer.exe
lea edx, [esp + 0x18]
push 0x4cbdc0
push edx
call fcn.004010a0
add esp, 0xc
mov esi, eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x438], 0xe
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
push ebx
push ebx
push ebx
push ebx
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call fcn.0049bcd0
add esp, 0x18
lea ecx, [esp + 0x14]
mov byte [esp + 0x438], 2
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator_2]
push 0x4ad6f0
lea ecx, [esp + 0x14]
call dword [0x4ab278]
push str.PPFilm_Player.lnk
lea ecx, [esp + 0x14]
call dword [0x4ab278]
lea ecx, [esp + 0x22c]
push ecx
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call fcn.0049bba0
add esp, 8
test eax, eax
je 0x4351db
push str.PIPIPlayer.exe
lea edx, [esp + 0x18]
push 0x4cbdc0
push edx
call fcn.004010a0
add esp, 0xc
mov esi, eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x438], 0xf
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
push ebx
push ebx
push ebx
push ebx
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call fcn.0049bcd0
add esp, 0x18
lea ecx, [esp + 0x14]
mov byte [esp + 0x438], 2
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebp, dword [esp + 0x18]
cmp ebp, ebx
je 0x4351f2
push ebp
call edi
mov dword [esp + 0x18], ebx
mov ebp, ebx
lea eax, [esp + 0x14]
push eax
push 0x20019
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x4354ff
xor eax, eax
cmp ebp, ebx
je 0x435222
push ebp
call edi
cmp eax, ebx
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x18], ecx
jne 0x4354fb
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x30]
push eax
push str.Common_Programs
lea ecx, [esp + 0x24]
mov dword [esp + 0x20], 0x200
call fcn.0042d6f0
test eax, eax
jne 0x4354fb
lea edi, [esp + 0x2c]
dec edi
nop
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x435260
mov ecx, dword [str.PPFilm]
mov edx, dword [0x4b255c]
mov dword [edi], ecx
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x14]
mov dword [edi + 4], edx
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator_2]
push 0x4ad6f0
lea ecx, [esp + 0x14]
call dword [0x4ab278]
push 0x4b25e4
lea ecx, [esp + 0x14]
call dword [0x4ab278]
lea ecx, [esp + 0x22c]
push ecx
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call fcn.0049bba0
add esp, 8
test eax, eax
je 0x435318
push str.PIPIPlayer.exe
lea edx, [esp + 0x18]
push 0x4cbdc0
push edx
call fcn.004010a0
add esp, 0xc
mov esi, eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x438], 0x10
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
push ebx
push ebx
push ebx
push ebx
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call fcn.0049bcd0
add esp, 0x18
lea ecx, [esp + 0x14]
mov byte [esp + 0x438], 2
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator_2]
push 0x4ad6f0
lea ecx, [esp + 0x14]
call dword [0x4ab278]
push 0x4b25c4
lea ecx, [esp + 0x14]
call dword [0x4ab278]
lea ecx, [esp + 0x22c]
push ecx
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call fcn.0049bba0
add esp, 8
test eax, eax
je 0x4353b7
push str.PIPIPlayer.exe
lea edx, [esp + 0x18]
push 0x4cbdc0
push edx
call fcn.004010a0
add esp, 0xc
mov esi, eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x438], 0x11
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
push ebx
push ebx
push ebx
push ebx
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call fcn.0049bcd0
add esp, 0x18
lea ecx, [esp + 0x14]
mov byte [esp + 0x438], 2
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator_2]
push 0x4ad6f0
lea ecx, [esp + 0x14]
call dword [0x4ab278]
push 0x4b25b4
lea ecx, [esp + 0x14]
call dword [0x4ab278]
lea ecx, [esp + 0x22c]
push ecx
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call fcn.0049bba0
add esp, 8
test eax, eax
je 0x435456
push str.PIPIPlayer.exe
lea edx, [esp + 0x18]
push 0x4cbdc0
push edx
call fcn.004010a0
add esp, 0xc
mov esi, eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x438], 0x12
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
push ebx
push ebx
push ebx
push ebx
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call fcn.0049bcd0
add esp, 0x18
lea ecx, [esp + 0x14]
mov byte [esp + 0x438], 2
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator_2]
push 0x4ad6f0
lea ecx, [esp + 0x14]
call dword [0x4ab278]
push str.PPFilm_Player.lnk
lea ecx, [esp + 0x14]
call dword [0x4ab278]
lea ecx, [esp + 0x22c]
push ecx
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call fcn.0049bba0
add esp, 8
test eax, eax
je 0x4354f5
push str.PIPIPlayer.exe
lea edx, [esp + 0x18]
push 0x4cbdc0
push edx
call fcn.004010a0
add esp, 0xc
mov esi, eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x438], 0x13
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
push ebx
push ebx
push ebx
push ebx
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call fcn.0049bcd0
add esp, 0x18
lea ecx, [esp + 0x14]
mov byte [esp + 0x438], 2
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebp, dword [esp + 0x18]
cmp ebp, ebx
je 0x43550c
push ebp
call edi
mov dword [esp + 0x18], ebx
mov ebp, ebx
push str.PPFilmPlayer.exe
lea eax, [esp + 0x18]
push 0x4cbdc0
push eax
call fcn.004010a0
add esp, 0xc
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x43c], 0x14
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator_1]
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp + 0x20]
mov ecx, dword [eax]
push eax
push ecx
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x28]
mov byte [esp + 0x444], 1
call fcn.00418150
mov edx, dword [esp + 0x20]
push edx
call sub.MFC71.DLL_operator_delete_1
add esp, 4
cmp ebp, ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
je 0x43558b
push ebp
call edi
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x424]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x420]
pop ebx
xor ecx, esp
call fcn.004a17d1
add esp, 0x42c
ret