Function at 0x41e400
Capabilities:
Check if file exists
Create thread
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
push ebx
push esi
push edi
xor edi, edi
push edi
mov dword [esp + 0x44], edi
call dword [sym.imp.ole32.dll_CoInitialize]
push str.Gdiplus.dll
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
mov dword [0x44c334], eax
cmp eax, edi
je 0x41e445
push eax
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
push edi
push 0x44950c
push 0x44c2b8
call dword [sym.imp.gdiplus.dll_GdiplusStartup]
mov eax, 1
lea esi, [esp + 0x40]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], edi
call fcn.00405700
push ecx
mov eax, esp
mov dword [esp + 0x40], esp
push eax
mov ecx, str.pplive.exe
call fcn.00405cd0
call fcn.00406c50
mov ecx, esp
mov dword [esp + 0x40], esp
push ecx
mov ecx, 0x440d44
mov ebx, eax
call fcn.00405cd0
lea edx, [esp + 0x30]
push edx
call fcn.00405780
mov eax, dword [esp + 0x2c]
cmp dword [eax - 0xc], edi
je 0x41e4d0
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x40], esp
mov esi, esp
call fcn.004054c0
add eax, 0x10
mov dword [esi], eax
lea eax, [esp + 0x40]
push eax
call fcn.0040a820
add esp, 8
mov edi, 0x44c390
call fcn.00405920
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
jmp 0x41e4f5
mov eax, dword [0x44c378]
add eax, 0xfffffff0
call fcn.004054c0
lea esi, [eax + 0x10]
lea eax, [esp + 0x3c]
mov edi, 0x44c390
mov dword [esp + 0x3c], esi
call fcn.00405920
lea eax, [esi - 0x10]
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41e50e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push ecx
mov ecx, esp
mov dword [esp + 0x40], esp
push ecx
mov ecx, 0x440d4c
call fcn.00405cd0
lea edx, [esp + 0x2c]
push edx
call fcn.00405780
mov eax, dword [esp + 0x28]
cmp dword [eax - 0xc], 0
je 0x41e56b
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x40], esp
mov esi, esp
call fcn.004054c0
add eax, 0x10
mov dword [esi], eax
lea eax, [esp + 0x40]
push eax
call fcn.0040a820
add esp, 8
mov edi, 0x44c384
call fcn.00405920
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
or edx, 0xffffffff
jmp 0x41e597
mov eax, dword [0x44c368]
add eax, 0xfffffff0
call fcn.004054c0
lea esi, [eax + 0x10]
mov edi, 0x44c384
lea eax, [esp + 0x3c]
mov dword [esp + 0x3c], esi
call fcn.00405920
or edx, 0xffffffff
test ebx, ebx
je 0x41e5af
lea eax, [esi - 0x10]
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41e5c8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x41e5c8
add esi, 0xfffffff0
lea ecx, [esi + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41e5c8
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
push ecx
mov eax, esp
mov dword [esp + 0x40], esp
push eax
mov ecx, 0x440d54
call fcn.00405cd0
lea edi, [esp + 0x28]
call fcn.00405890
mov eax, dword [esp + 0x24]
cmp dword [eax - 0xc], 0
je 0x41e609
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x40], esp
mov esi, esp
call fcn.004054c0
add eax, 0x10
mov dword [esi], eax
call fcn.00408d70
add esp, 4
push ecx
mov ecx, esp
mov dword [esp + 0x40], esp
push ecx
mov ecx, 0x440d5c
call fcn.00405cd0
lea edi, [esp + 0x24]
call fcn.00405890
mov edx, dword [esp + 0x20]
push str.noinstall
push edx
call fcn.00426238
add esp, 8
test eax, eax
jne 0x41e63e
mov dword [esp + 0x30], eax
push ecx
mov eax, esp
mov dword [esp + 0x40], esp
push eax
mov ecx, 0x440d78
call fcn.00405cd0
lea edi, [esp + 0x20]
call fcn.00405890
mov ecx, dword [esp + 0x1c]
push str.norun
push ecx
call fcn.00426238
add esp, 8
test eax, eax
jne 0x41e673
mov dword [esp + 0x34], eax
push ecx
mov edx, esp
mov dword [esp + 0x40], esp
push edx
mov ecx, 0x440d8c
call fcn.00405cd0
lea edi, [esp + 0x18]
call fcn.00405890
mov eax, dword [esp + 0x14]
cmp dword [eax - 0xc], 0
je 0x41e6c6
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov eax, edi
mov edi, 0x44c3a0
mov dword [0x44c338], ecx
mov dword [0x44c33c], edx
call fcn.00405920
mov eax, dword [ebp + 0x14]
mov dword [0x449408], eax
mov dword [esp + 0x38], 1
mov ecx, dword [0x44c370]
cmp dword [ecx - 0xc], 0
jg 0x41e763
push ecx
mov edx, esp
mov dword [esp + 0x40], esp
push edx
mov ecx, 0x440d94
call fcn.00405cd0
lea edi, [esp + 0x40]
call fcn.00405890
mov edi, 0x44c370
call fcn.00405920
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41e71b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [0x44c370]
cmp dword [ecx - 0xc], 0
jne 0x41e763
mov edi, 0x44c370
test ebx, ebx
je 0x41e745
mov edx, str.PPTV_
call fcn.00405c90
mov eax, dword [0x44c36c]
mov edx, dword [eax - 0xc]
push edx
jmp 0x41e758
mov edx, str.1717WAN_
call fcn.00405c90
mov eax, dword [0x44c36c]
mov ecx, dword [eax - 0xc]
push ecx
push eax
mov ebx, 0x44c370
call fcn.00405390
push ecx
mov edx, esp
mov dword [esp + 0x40], esp
push edx
mov ecx, 0x440d9c
call fcn.00405cd0
lea edi, [esp + 0x1c]
call fcn.00405890
mov eax, dword [esp + 0x18]
push 0x440da4
push eax
call fcn.00426238
add esp, 8
test eax, eax
jne 0x41e79e
mov dword [0x44c310], 1
push ecx
mov ecx, esp
mov dword [esp + 0x40], esp
push ecx
mov ecx, 0x440dac
call fcn.00405cd0
lea edi, [esp + 0x14]
call fcn.00405890
mov eax, dword [esp + 0x10]
cmp dword [eax - 0xc], 0
jl 0x41e7ec
push str..exe
push eax
call fcn.00426de9
add esp, 8
test eax, eax
je 0x41e7ec
sub eax, dword [esp + 0x10]
sar eax, 1
cmp eax, 0xffffffff
je 0x41e7ec
mov eax, edi
mov edi, 0x44c37c
call fcn.00405920
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41e80c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41e82c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41e84c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41e86c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41e88c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41e8ac
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41e8cc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41e8ec
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x40]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41e90c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [esp + 0x30], 0
je 0x41e9e0
mov esi, dword [esp + 0x34]
push esi
call fcn.004092f0
add esp, 4
cmp eax, 1
jne 0x41e98e
test esi, esi
jne 0x41e983
push 0x3e8
call dword [sym.imp.KERNEL32.DLL_Sleep]
lea esi, [esp + 0x40]
call fcn.0040a050
mov esi, dword [esp + 0x40]
mov eax, dword [esi - 0xc]
push eax
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
test eax, eax
jne 0x41e959
call fcn.004054b0
mov ecx, dword [ebp + 0x14]
push ecx
mov ecx, dword [ebp + 8]
mov edx, eax
call fcn.0040c940
lea eax, [esi - 0x10]
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41e983
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp eax, 0xffffffff
jne 0x41e9e0
push esi
call fcn.00409740
add esp, 4
cmp eax, 1
jne 0x41e9e0
test esi, esi
jne 0x41e9d5
push 0x3e8
call dword [sym.imp.KERNEL32.DLL_Sleep]
lea esi, [esp + 0x34]
call fcn.0040a050
mov ecx, dword [ebp + 0x14]
push ecx
mov eax, esi
call fcn.0040ab80
mov ecx, dword [ebp + 8]
mov edx, eax
call fcn.0040c940
mov eax, esi
call fcn.00405530
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0x104
push 0x44c0a0
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
push 0x44c0a0
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov edx, dword [0x44c38c]
push edx
push 0x44c0a0
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str._mark.mrk
push 0x104
push 0x44c0a0
call fcn.00426bfd
add esp, 0xc
lea eax, [esp + 0x34]
push eax
mov ecx, 0x440dd4
call fcn.00405cd0
mov eax, dword [esp + 0x34]
mov ecx, dword [eax - 0xc]
mov edi, dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
push ecx
push eax
call edi
test eax, eax
jne 0x41ea4f
call fcn.004054b0
mov ecx, eax
call fcn.004082d0
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41ea76
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x44c0a0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ebx, dword [sym.imp.KERNEL32.DLL_DeleteFileW]
test eax, eax
je 0x41eab0
push 0x44c0a0
call ebx
test eax, eax
je 0x41eab0
push ecx
mov ecx, esp
mov dword [esp + 0x44], esp
push ecx
mov ecx, 0x43f8f4
call fcn.00405cd0
call fcn.00408bc0
add esp, 4
xor esi, esi
push esi
push esi
push 4
push esi
push 3
push 0x10000000
push 0x44c0a0
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
push esi
push esi
push 1
push esi
mov dword [0x44c314], eax
call dword [sym.imp.KERNEL32.DLL_CreateEventW]
lea edx, [esp + 0x40]
push edx
push esi
push esi
push 0x41d650
push esi
push esi
mov dword [0x44c2b4], eax
mov dword [esp + 0x58], esi
call dword [sym.imp.KERNEL32.DLL_CreateThread]
push 8
mov dword [0x44c2b0], eax
call fcn.00424d00
add esp, 4
cmp eax, esi
je 0x41eb14
mov dword [eax], vtable.CImpIDispatch.0
mov dword [eax + 4], esi
jmp 0x41eb16
xor eax, eax
push esi
push esi
push esi
push esi
mov dword [0x44c318], eax
call dword [sym.imp.USER32.dll_DefWindowProcW]
lea eax, [esp + 0x40]
push eax
mov dword [esp + 0x44], 8
mov dword [esp + 0x48], 0x604
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
call fcn.0041eed0
call fcn.004198e0
call fcn.0041da20
cmp dword [esp + 0x38], 0
mov esi, eax
je 0x41eb7b
mov eax, dword [0x44c3a0]
mov ecx, dword [eax - 0xc]
push ecx
push eax
call edi
test eax, eax
jne 0x41eb6d
call fcn.004054b0
mov ecx, dword [ebp + 0x14]
push ecx
mov ecx, dword [ebp + 8]
mov edx, eax
call fcn.0040c940
call fcn.0041d9c0
call fcn.0041ee30
cmp dword [0x44c334], 0
je 0x41eb9b
mov edx, dword [0x44c2b8]
push edx
call dword [sym.imp.gdiplus.dll_GdiplusShutdown]
mov eax, dword [0x44c318]
test eax, eax
je 0x41ebb3
push eax
mov dword [eax], vtable.CImpIDispatch.0
call fcn.00424756
add esp, 4
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [0x44c314]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 0x44c0a0
call ebx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10