Function at 0x42fd60
Capabilities:
Persist via default file association registry key
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x4a5ee9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x234
mov eax, dword [0x4cbba0]
xor eax, esp
push edi
xor edi, edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x234], eax
mov dword [esp + 0xc], edi
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_1]
push 0x104
lea eax, [esp + 0x134]
push eax
push edi
mov dword [esp + 0x24c], edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x42fdc8
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
jmp 0x430139
push ebx
push ebp
push 0x104
lea ecx, [esp + 0x38]
push ecx
lea edx, [esp + 0x140]
push edx
call dword [sym.imp.KERNEL32.dll_GetLongPathNameA]
push edi
lea eax, [esp + 0x13c]
push eax
push 0x104
lea ecx, [esp + 0x40]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
lea edx, [esp + 0x138]
push edx
lea ecx, [esp + 0x1c]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator_2]
lea ecx, [esp + 0xc]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_1]
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_1]
mov dword [esp + 0x1c], edi
xor ebp, ebp
mov dword [esp + 0x20], ebp
push edi
push 0x3a
mov ecx, 0x4cc8fc
mov byte [esp + 0x250], 4
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Find_1]
mov ebx, eax
cmp ebx, edi
jle 0x42fe62
push ebx
lea eax, [esp + 0x28]
push eax
mov ecx, 0x4cc8fc
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Left]
mov dword [esp + 0x14], 1
jmp 0x42fe79
push str.jiaf
lea ecx, [esp + 0x2c]
call dword [0x4ab700]
mov dword [esp + 0x14], 2
push esi
mov ecx, eax
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x34]
push edx
push edi
push 0x2001f
push edi
push edi
push edi
push eax
push SysReAllocString
mov dword [esp + 0x54], edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov esi, eax
test esi, esi
jne 0x42feb3
mov edi, dword [esp + 0x30]
mov dword [esp + 0x20], edi
test byte [esp + 0x18], 2
je 0x42fecf
mov eax, dword [esp + 0x18]
and eax, 0xfffffffd
lea ecx, [esp + 0x2c]
mov dword [esp + 0x18], eax
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
test byte [esp + 0x18], 1
mov dword [esp + 0x24c], 4
je 0x42feeb
lea ecx, [esp + 0x28]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
test esi, esi
jne 0x4300fb
push str.URL:_ppfilm_protocol
lea ecx, [esp + 0x18]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator_2]
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::GetLength]
mov esi, eax
lea ecx, [esp + 0x14]
inc esi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push esi
push eax
push 1
push 0
push 0x4acbb2
push edi
call ebp
push 0x4acbb2
lea ecx, [esp + 0x18]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator_2]
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::GetLength]
mov esi, eax
lea ecx, [esp + 0x14]
inc esi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push esi
push eax
push 1
push 0
push str.URL_protocol
push edi
call ebp
mov eax, dword [esp + 0x1c]
push eax
lea ecx, [esp + 0x14]
push str._s___1
push ecx
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Format]
add esp, 0xc
push 0
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
push str.DefaultIcon
lea ecx, [esp + 0x2c]
call fcn.0042f5f0
push 0
push str.open
push str.shell
lea ecx, [esp + 0x2c]
call fcn.0042f5f0
push 0
push 0x4acbb2
push str.shellopen
lea ecx, [esp + 0x2c]
call fcn.0042f5f0
mov edx, dword [esp + 0x1c]
push edx
lea eax, [esp + 0x14]
push str._s___1
push eax
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Format]
add esp, 0xc
push ebx
lea ecx, [esp + 0x2c]
push ecx
mov ecx, 0x4cc8fc
mov esi, 1
mov dword [esp + 0x34], 0x104
mov byte [esp + 0x40], 0
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Left]
mov edx, dword [eax]
push edx
lea eax, [esp + 0x14]
push str._s_shellopencommand
push eax
mov byte [esp + 0x258], 6
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Format]
add esp, 0xc
lea ecx, [esp + 0x28]
mov byte [esp + 0x24c], 4
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
push 0x2001f
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
push SysReAllocString
lea ecx, [esp + 0x30]
call fcn.0042d6a0
test eax, eax
jne 0x4300ab
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x3c]
push edx
push 0x4acbb2
lea ecx, [esp + 0x30]
call fcn.0042d6f0
test eax, eax
jne 0x4300ab
lea eax, [esp + 0x38]
push 0x25
push eax
call dword [sym.imp.MSVCR71.dll_strrchr]
add esp, 8
test eax, eax
je 0x43007f
mov byte [eax - 1], 0
mov ecx, 0x4cbdc0
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::GetLength]
push eax
mov ecx, 0x4cbdc0
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
lea ecx, [esp + 0x40]
push ecx
call dword [sym.imp.MSVCR71.dll__strnicmp]
add esp, 0xc
test eax, eax
jne 0x4300ab
xor esi, esi
mov ebp, dword [esp + 0x24]
test ebp, ebp
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x4300c2
push ebp
call ebx
xor ebp, ebp
mov dword [esp + 0x24], ebp
mov edx, dword [esp + 0x1c]
push edx
lea eax, [esp + 0x14]
push str._s___1
push eax
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Format]
add esp, 0xc
test esi, esi
je 0x430101
push 0
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
push str.shellopencommand
lea ecx, [esp + 0x2c]
call fcn.0042f5f0
jmp 0x430101
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
pop esi
je 0x43010b
push edi
call ebx
xor edi, edi
test ebp, ebp
je 0x430112
push ebp
call ebx
test edi, edi
je 0x430119
push edi
call ebx
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 0xc]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 0x18]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
pop ebp
pop ebx
mov ecx, dword [esp + 0x238]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x234]
pop edi
xor ecx, esp
mov eax, 1
call fcn.004a17d1
add esp, 0x240
ret