Function at 0x42a000
Capabilities:
Delete file
Persist via default file association registry key
Persist via run registry key
Read .ini file
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x49a9ef
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x410
mov eax, dword [0x4bc410]
xor eax, esp
push ebx
push esi
lea ecx, [esp + 8]
mov dword [esp + 0x414], eax
call dword [0x49f754]
xor ebx, ebx
mov dword [esp + 0x420], ebx
mov dword [esp + 0x10], ebx
push str.configenumwindow.ini
lea eax, [esp + 0x10]
push 0x4bc618
push eax
mov byte [esp + 0x42c], 1
call fcn.00401050
add esp, 0xc
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x424], 2
call dword [0x49f214]
lea ecx, [esp + 0xc]
mov byte [esp + 0x420], 1
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 8]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push eax
push 0x200
lea ecx, [esp + 0x1c]
push ecx
push 0x4a095c
push str.NAME
push str.MSGWINDOW
call esi
lea edx, [esp + 0x14]
push str.ppfilm
push edx
call dword [sym.imp.MSVCR71.dll__stricmp]
add esp, 8
test eax, eax
lea ecx, [esp + 8]
je 0x42a0d8
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
jmp 0x42b05a
push ebp
push edi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
mov ebp, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push eax
push str.PIPIPlayer
push str.NAME
push str.MSGWINDOW
call ebp
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
push 0x4a5338
push str.PLAYERNAME
push str.MSGWINDOW
call ebp
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
push 0x200
lea eax, [esp + 0x24]
push eax
push 0x4a095c
push str.AdUrl
push str.MSGWINDOW
call esi
mov edi, dword [sym.imp.MSVCR71.dll_strstr]
lea ecx, [esp + 0x1c]
push str.www.ppfilm.cn
push ecx
call edi
add esp, 8
test eax, eax
je 0x42a16f
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
push str.http:__www.pipi.cn_player_
push str.AdUrl
push str.MSGWINDOW
call ebp
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
push 0x200
lea edx, [esp + 0x24]
push edx
push 0x4a095c
push str.TopClickURL
push str.MSGWINDOW
call esi
lea eax, [esp + 0x1c]
push str.www.ppfilm.cn
push eax
call edi
add esp, 8
test eax, eax
je 0x42a1c4
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
push 0x4a52e4
push str.TopClickURL
push str.MSGWINDOW
call ebp
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
push 0x200
lea ecx, [esp + 0x24]
push ecx
push 0x4a095c
push str.AppendWindow
push str.MSGWINDOW
call esi
lea edx, [esp + 0x1c]
push str.www.ppfilm.cn
push edx
call edi
add esp, 8
test eax, eax
je 0x42a219
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
push 0x4a5290
push str.AppendWindow
push str.MSGWINDOW
call ebp
push str.pphelp.url
lea eax, [esp + 0x18]
push 0x4bc618
push eax
call fcn.00401050
add esp, 0xc
mov ecx, eax
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
push 0x200
lea ecx, [esp + 0x24]
push ecx
push 0x4a095c
push 0x4a1048
push str.InternetShortcut
call esi
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea edx, [esp + 0x1c]
push str.www.ppfilm.cn
push edx
call edi
add esp, 8
test eax, eax
je 0x42a2ac
push str.pphelp.url
lea eax, [esp + 0x18]
push 0x4bc618
push eax
call fcn.00401050
add esp, 0xc
mov ecx, eax
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
push str.http:__www.pipi.cn_help
push 0x4a1048
push str.InternetShortcut
call ebp
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
push str.jfCacheMgr.url
lea ecx, [esp + 0x18]
push 0x4bc618
push ecx
call fcn.00401050
add esp, 0xc
mov ecx, eax
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
push 0x200
lea edx, [esp + 0x24]
push edx
push 0x4a095c
push 0x4a1048
push str.InternetShortcut
call esi
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea eax, [esp + 0x1c]
push str.www.ppfilm.cn
push eax
call edi
add esp, 8
test eax, eax
je 0x42a33f
push str.jfCacheMgr.url
lea ecx, [esp + 0x18]
push 0x4bc618
push ecx
call fcn.00401050
add esp, 0xc
mov ecx, eax
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
push 0x4a52e4
push 0x4a1048
push str.InternetShortcut
call ebp
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea edx, [esp + 0x14]
push edx
push 0x2001f
push 0
push str.KmMediaPlayer_shellopencommand
push Ordinal_1
mov dword [esp + 0x28], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42a417
mov ebp, dword [esp + 0x14]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x20]
push ecx
mov ebx, ebp
push 0x4a095c
lea ecx, [esp + 0x24]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], 0x200
call fcn.00426980
test eax, eax
jne 0x42a402
lea edx, [esp + 0x1c]
push str.PPFilmPlayer.exe
push edx
call edi
add esp, 8
test eax, eax
je 0x42a402
push 0x4a5254
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator_3]
push 0x4bc618
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator_1]
push str.PIPIPlayer.exe____L_
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator]
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::GetLength]
mov esi, eax
lea ecx, [esp + 0x10]
inc esi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push esi
push eax
push 1
push 0
push 0x4a095c
push ebp
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test ebp, ebp
je 0x42a417
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call ebp
xor ebx, ebx
mov dword [esp + 0x18], ebx
jmp 0x42a41d
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.libdb43.dll_Ordinal_1
mov dword [esp + 0x28], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42a6f4
test ebx, ebx
je 0x42a450
push ebx
call ebp
test eax, eax
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x18], ebx
jne 0x42a6f4
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x20]
push edx
push str.Desktop
lea ecx, [esp + 0x24]
mov dword [esp + 0x20], 0x200
call fcn.00426980
test eax, eax
jne 0x42a6f4
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator_3]
push 0x4a1f5c
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator]
push 0x4a51e0
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator]
lea ecx, [esp + 0x21c]
push ecx
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call fcn.004266b0
add esp, 8
test eax, eax
je 0x42a523
push str.PIPIPlayer.exe
lea edx, [esp + 0x18]
push 0x4bc618
push edx
call fcn.00401050
add esp, 0xc
mov esi, eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x428], 3
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call fcn.004267e0
add esp, 8
lea ecx, [esp + 0x14]
mov byte [esp + 0x428], 1
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator_3]
push 0x4a1f5c
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator]
push 0x4a51c0
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator]
lea ecx, [esp + 0x21c]
push ecx
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call fcn.004266b0
add esp, 8
test eax, eax
je 0x42a5be
push str.PIPIPlayer.exe
lea edx, [esp + 0x18]
push 0x4bc618
push edx
call fcn.00401050
add esp, 0xc
mov esi, eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x428], 4
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call fcn.004267e0
add esp, 8
lea ecx, [esp + 0x14]
mov byte [esp + 0x428], 1
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator_3]
push 0x4a1f5c
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator]
push 0x4a51b0
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator]
lea ecx, [esp + 0x21c]
push ecx
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call fcn.004266b0
add esp, 8
test eax, eax
je 0x42a659
push str.PIPIPlayer.exe
lea edx, [esp + 0x18]
push 0x4bc618
push edx
call fcn.00401050
add esp, 0xc
mov esi, eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x428], 5
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call fcn.004267e0
add esp, 8
lea ecx, [esp + 0x14]
mov byte [esp + 0x428], 1
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator_3]
push 0x4a1f5c
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator]
push str.PPFilm_Player.lnk
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator]
lea ecx, [esp + 0x21c]
push ecx
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call fcn.004266b0
add esp, 8
test eax, eax
je 0x42a6f4
push str.PIPIPlayer.exe
lea edx, [esp + 0x18]
push 0x4bc618
push edx
call fcn.00401050
add esp, 0xc
mov esi, eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x428], 6
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call fcn.004267e0
add esp, 8
lea ecx, [esp + 0x14]
mov byte [esp + 0x428], 1
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
test ebx, ebx
je 0x42a701
push ebx
call ebp
xor ebx, ebx
mov dword [esp + 0x18], ebx
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.libdb43.dll_Ordinal_1
mov dword [esp + 0x28], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42a9f3
test ebx, ebx
je 0x42a734
push ebx
call ebp
test eax, eax
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x18], ebx
jne 0x42a9f3
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x20]
push edx
push str.AppData
lea ecx, [esp + 0x24]
mov dword [esp + 0x20], 0x200
call fcn.00426980
test eax, eax
jne 0x42a9f3
lea edi, [esp + 0x1c]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x42a771
mov ecx, 0xa
mov esi, str.MicrosoftInternet_ExplorerQuick_Launch
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x14]
movsw word es:[edi], word [esi]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator_3]
push 0x4a1f5c
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator]
push 0x4a51e0
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator]
lea ecx, [esp + 0x21c]
push ecx
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call fcn.004266b0
add esp, 8
test eax, eax
je 0x42a822
push str.PIPIPlayer.exe
lea edx, [esp + 0x18]
push 0x4bc618
push edx
call fcn.00401050
add esp, 0xc
mov esi, eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x428], 7
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call fcn.004267e0
add esp, 8
lea ecx, [esp + 0x14]
mov byte [esp + 0x428], 1
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator_3]
push 0x4a1f5c
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator]
push 0x4a51c0
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator]
lea ecx, [esp + 0x21c]
push ecx
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call fcn.004266b0
add esp, 8
test eax, eax
je 0x42a8bd
push str.PIPIPlayer.exe
lea edx, [esp + 0x18]
push 0x4bc618
push edx
call fcn.00401050
add esp, 0xc
mov esi, eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x428], 8
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call fcn.004267e0
add esp, 8
lea ecx, [esp + 0x14]
mov byte [esp + 0x428], 1
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator_3]
push 0x4a1f5c
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator]
push 0x4a51b0
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator]
lea ecx, [esp + 0x21c]
push ecx
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call fcn.004266b0
add esp, 8
test eax, eax
je 0x42a958
push str.PIPIPlayer.exe
lea edx, [esp + 0x18]
push 0x4bc618
push edx
call fcn.00401050
add esp, 0xc
mov esi, eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x428], 9
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call fcn.004267e0
add esp, 8
lea ecx, [esp + 0x14]
mov byte [esp + 0x428], 1
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator_3]
push 0x4a1f5c
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator]
push str.PPFilm_Player.lnk
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator]
lea ecx, [esp + 0x21c]
push ecx
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call fcn.004266b0
add esp, 8
test eax, eax
je 0x42a9f3
push str.PIPIPlayer.exe
lea edx, [esp + 0x18]
push 0x4bc618
push edx
call fcn.00401050
add esp, 0xc
mov esi, eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x428], 0xa
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call fcn.004267e0
add esp, 8
lea ecx, [esp + 0x14]
mov byte [esp + 0x428], 1
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
test ebx, ebx
je 0x42aa00
push ebx
call ebp
xor ebx, ebx
mov dword [esp + 0x18], ebx
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.libdb43.dll_Ordinal_1
mov dword [esp + 0x28], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42acf4
test ebx, ebx
je 0x42aa33
push ebx
call ebp
test eax, eax
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x18], ebx
jne 0x42acf4
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x20]
push edx
push str.Programs
lea ecx, [esp + 0x24]
mov dword [esp + 0x20], 0x200
call fcn.00426980
test eax, eax
jne 0x42acf4
lea edi, [esp + 0x1c]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x42aa70
mov eax, dword [str.PPFilm]
mov ecx, dword [0x4a5158]
mov dword [edi], eax
lea edx, [esp + 0x1c]
mov dword [edi + 4], ecx
push edx
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator_3]
push 0x4a1f5c
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator]
push 0x4a51e0
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator]
lea eax, [esp + 0x21c]
push eax
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call fcn.004266b0
add esp, 8
test eax, eax
je 0x42ab23
push str.PIPIPlayer.exe
lea ecx, [esp + 0x18]
push 0x4bc618
push ecx
call fcn.00401050
add esp, 0xc
mov esi, eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x428], 0xb
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call fcn.004267e0
add esp, 8
lea ecx, [esp + 0x14]
mov byte [esp + 0x428], 1
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator_3]
push 0x4a1f5c
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator]
push 0x4a51c0
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator]
lea eax, [esp + 0x21c]
push eax
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call fcn.004266b0
add esp, 8
test eax, eax
je 0x42abbe
push str.PIPIPlayer.exe
lea ecx, [esp + 0x18]
push 0x4bc618
push ecx
call fcn.00401050
add esp, 0xc
mov esi, eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x428], 0xc
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call fcn.004267e0
add esp, 8
lea ecx, [esp + 0x14]
mov byte [esp + 0x428], 1
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator_3]
push 0x4a1f5c
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator]
push 0x4a51b0
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator]
lea eax, [esp + 0x21c]
push eax
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call fcn.004266b0
add esp, 8
test eax, eax
je 0x42ac59
push str.PIPIPlayer.exe
lea ecx, [esp + 0x18]
push 0x4bc618
push ecx
call fcn.00401050
add esp, 0xc
mov esi, eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x428], 0xd
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call fcn.004267e0
add esp, 8
lea ecx, [esp + 0x14]
mov byte [esp + 0x428], 1
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator_3]
push 0x4a1f5c
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator]
push str.PPFilm_Player.lnk
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator]
lea eax, [esp + 0x21c]
push eax
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call fcn.004266b0
add esp, 8
test eax, eax
je 0x42acf4
push str.PIPIPlayer.exe
lea ecx, [esp + 0x18]
push 0x4bc618
push ecx
call fcn.00401050
add esp, 0xc
mov esi, eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x428], 0xe
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call fcn.004267e0
add esp, 8
lea ecx, [esp + 0x14]
mov byte [esp + 0x428], 1
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
test ebx, ebx
je 0x42ad01
push ebx
call ebp
xor ebx, ebx
mov dword [esp + 0x18], ebx
lea edx, [esp + 0x14]
push edx
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x28], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42aff5
test ebx, ebx
je 0x42ad34
push ebx
call ebp
test eax, eax
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x18], ebx
jne 0x42aff5
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x20]
push ecx
push str.Common_Programs
lea ecx, [esp + 0x24]
mov dword [esp + 0x20], 0x200
call fcn.00426980
test eax, eax
jne 0x42aff5
lea edi, [esp + 0x1c]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x42ad71
mov edx, dword [str.PPFilm]
mov eax, dword [0x4a5158]
lea ecx, [esp + 0x1c]
mov dword [edi], edx
push ecx
lea ecx, [esp + 0x14]
mov dword [edi + 4], eax
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator_3]
push 0x4a1f5c
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator]
push 0x4a51e0
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator]
lea edx, [esp + 0x21c]
push edx
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call fcn.004266b0
add esp, 8
test eax, eax
je 0x42ae24
push str.PIPIPlayer.exe
lea eax, [esp + 0x18]
push 0x4bc618
push eax
call fcn.00401050
add esp, 0xc
mov esi, eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x428], 0xf
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call fcn.004267e0
add esp, 8
lea ecx, [esp + 0x14]
mov byte [esp + 0x428], 1
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator_3]
push 0x4a1f5c
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator]
push 0x4a51c0
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator]
lea edx, [esp + 0x21c]
push edx
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call fcn.004266b0
add esp, 8
test eax, eax
je 0x42aebf
push str.PIPIPlayer.exe
lea eax, [esp + 0x18]
push 0x4bc618
push eax
call fcn.00401050
add esp, 0xc
mov esi, eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x428], 0x10
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call fcn.004267e0
add esp, 8
lea ecx, [esp + 0x14]
mov byte [esp + 0x428], 1
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator_3]
push 0x4a1f5c
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator]
push 0x4a51b0
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator]
lea edx, [esp + 0x21c]
push edx
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call fcn.004266b0
add esp, 8
test eax, eax
je 0x42af5a
push str.PIPIPlayer.exe
lea eax, [esp + 0x18]
push 0x4bc618
push eax
call fcn.00401050
add esp, 0xc
mov esi, eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x428], 0x11
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call fcn.004267e0
add esp, 8
lea ecx, [esp + 0x14]
mov byte [esp + 0x428], 1
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator_3]
push 0x4a1f5c
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator]
push str.PPFilm_Player.lnk
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator]
lea edx, [esp + 0x21c]
push edx
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call fcn.004266b0
add esp, 8
test eax, eax
je 0x42aff5
push str.PIPIPlayer.exe
lea eax, [esp + 0x18]
push 0x4bc618
push eax
call fcn.00401050
add esp, 0xc
mov esi, eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x428], 0x12
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call fcn.004267e0
add esp, 8
lea ecx, [esp + 0x14]
mov byte [esp + 0x428], 1
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
test ebx, ebx
je 0x42b002
push ebx
call ebp
xor ebx, ebx
mov dword [esp + 0x18], ebx
push str.PPFilmPlayer.exe
lea ecx, [esp + 0x18]
push 0x4bc618
push ecx
call fcn.00401050
add esp, 0xc
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x42c], 0x13
call dword [0x49f214]
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test ebx, ebx
je 0x42b04e
push ebx
call ebp
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
pop edi
pop ebp
mov ecx, dword [esp + 0x418]
pop esi
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x410]
pop ebx
xor ecx, esp
call fcn.00496ace
add esp, 0x41c
ret