Function at 0x43e267
Capabilities:
Create process on windows
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48bf13
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x35c4
call fcn.004834f0
push edi
mov dword [ebp - 0x35c0], ecx
mov eax, dword [ebp + 0xc]
and eax, 0xffff
mov ecx, dword [ebp + 0x10]
and ecx, 0xffff
shl ecx, 0x10
or eax, ecx
mov dword [ebp - 0x14], eax
push 0
push 1
mov edx, dword [0x4d5868]
mov eax, dword [edx]
mov ecx, dword [0x4d5868]
call dword [eax + 0x30]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
push 0
push 0x202
call fcn.00409c20
mov ecx, eax
call fcn.00409c60
push eax
mov edx, dword [0x4d5868]
mov eax, dword [edx]
mov ecx, dword [0x4d5868]
call dword [eax + 0x24]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x35c0]
cmp dword [ecx + 0x1c], 0
je 0x43e316
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x35c0]
mov ecx, dword [ecx + 0x1c]
mov edx, dword [ebp - 0x35c0]
mov eax, dword [edx + 0x1c]
mov edx, dword [eax]
call dword [edx + 4]
mov eax, dword [ebp - 0x35c0]
cmp dword [eax + 0x18], 0
je 0x43e378
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x35a4], ecx
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x35a0], edx
mov eax, dword [ebp - 0x35a0]
push eax
mov ecx, dword [ebp - 0x35a4]
push ecx
mov edx, dword [ebp - 0x35c0]
mov ecx, dword [edx + 0x18]
mov eax, dword [ebp - 0x35c0]
mov edx, dword [eax + 0x18]
mov eax, dword [edx]
call dword [eax + 4]
push 0
push 0
push 0x4b7
mov ecx, 0x4c8d68
call fcn.00404a50
mov ecx, eax
call fcn.00413b00
jmp 0x43f6cb
mov ecx, 0x4c8d68
call fcn.00404a50
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x43e3a8
mov ecx, dword [ebp - 0x10]
call fcn.00467725
test eax, eax
je 0x43e3a8
push 0
push 0
push 0x4b7
mov ecx, dword [ebp - 0x10]
call fcn.00413b00
push 0
push 0
mov ecx, dword [0x4d5868]
mov edx, dword [ecx]
mov ecx, dword [0x4d5868]
call dword [edx + 0x30]
push eax
mov eax, dword [ebp - 0x14]
push eax
push 0
push 0x202
call fcn.00409c20
mov ecx, eax
call fcn.00409c60
push eax
mov ecx, dword [0x4d5868]
mov edx, dword [ecx]
mov ecx, dword [0x4d5868]
call dword [edx + 0x24]
cmp dword [0x4c8e3c], 0
jne 0x43e55e
lea ecx, [ebp - 0x2c]
call fcn.00404a10
push 0
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [0x4a3f98]
call fcn.0043329b
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x35ac], ecx
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x35a8], edx
mov eax, dword [ebp - 0x35a8]
push eax
mov ecx, dword [ebp - 0x35ac]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.00402f10
test eax, eax
je 0x43e472
push 0
push 0
mov ecx, 0x4a6bc8
call fcn.0040230f
test eax, eax
je 0x43e472
push 0
mov ecx, dword [ebp - 0x35c0]
add ecx, 0x14
mov edx, dword [ebp - 0x35c0]
mov eax, dword [edx + 0x14]
call dword [eax]
push 3
mov ecx, 0x4a6bc8
call fcn.00401f2a
jmp 0x43f6cb
push 0
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, dword [0x4a3f98]
call fcn.004334ab
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x35b4], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x35b0], eax
mov ecx, dword [ebp - 0x35b0]
push ecx
mov edx, dword [ebp - 0x35b4]
push edx
lea ecx, [ebp - 0x2c]
call fcn.00402f10
test eax, eax
je 0x43e4e8
push 0
push 1
mov ecx, 0x4a6bc8
call fcn.0040230f
test eax, eax
je 0x43e4e8
push 0
mov ecx, dword [ebp - 0x35c0]
add ecx, 0x14
mov eax, dword [ebp - 0x35c0]
mov edx, dword [eax + 0x14]
call dword [edx]
push 3
mov ecx, 0x4a6bc8
call fcn.00401f2a
jmp 0x43f6cb
push 0
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [0x4a3f98]
call fcn.0043339f
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x35bc], ecx
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x35b8], edx
mov eax, dword [ebp - 0x35b8]
push eax
mov ecx, dword [ebp - 0x35bc]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.00402f10
test eax, eax
je 0x43e55e
push 0
push 2
mov ecx, 0x4a6bc8
call fcn.0040230f
test eax, eax
je 0x43e55e
push 0
mov ecx, dword [ebp - 0x35c0]
add ecx, 0x14
mov edx, dword [ebp - 0x35c0]
mov eax, dword [edx + 0x14]
call dword [eax]
push 3
mov ecx, 0x4a6bc8
call fcn.00401f2a
jmp 0x43f6cb
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov ecx, 0x4a6c8c
call fcn.00402cba
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x43e594
push 0
mov ecx, dword [ebp - 0x35c0]
add ecx, 0x14
mov eax, dword [ebp - 0x35c0]
mov edx, dword [eax + 0x14]
call dword [edx]
jmp 0x43f6cb
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp - 0x35c0]
call fcn.0044051b
cmp eax, 0xffffffff
jne 0x43e5b7
jmp 0x43f6cb
mov dword [ebp - 0x1c], 0
mov edx, dword [ebp - 0x35c0]
cmp dword [edx + 0x54], 0
je 0x43e7b4
lea ecx, [ebp - 0x48]
call fcn.00482880
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x68]
call fcn.0043c030
mov eax, dword [ebp - 0x35c0]
mov ecx, dword [eax + 0x44]
mov dword [ebp - 0x58], ecx
mov edx, dword [ebp - 0x35c0]
mov eax, dword [edx + 0x48]
mov dword [ebp - 0x54], eax
push 3
lea ecx, [ebp - 0x68]
push ecx
push 0xc
push 1
lea ecx, [ebp - 0x48]
call fcn.00482906
lea edx, [ebp - 0x48]
push edx
mov eax, dword [ebp - 0x35c0]
mov ecx, dword [eax + 0x10]
mov edx, dword [ebp - 0x35c0]
mov eax, dword [edx + 0x10]
mov edx, dword [eax]
call dword [edx + 4]
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x35c0]
mov edx, dword [ecx + 0x4c]
mov dword [ebp - 0x58], edx
mov eax, dword [ebp - 0x35c0]
mov ecx, dword [eax + 0x50]
mov dword [ebp - 0x54], ecx
push 3
lea edx, [ebp - 0x68]
push edx
push 0xc
push 1
lea ecx, [ebp - 0x48]
call fcn.00482906
lea eax, [ebp - 0x48]
push eax
mov ecx, dword [ebp - 0x35c0]
mov ecx, dword [ecx + 0x10]
mov edx, dword [ebp - 0x35c0]
mov eax, dword [edx + 0x10]
mov edx, dword [eax]
call dword [edx + 4]
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x4c]
cmp ecx, dword [ebp - 0x34]
jge 0x43e69e
mov edx, dword [ebp - 0x34]
add edx, dword [ebp - 0x4c]
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0x4c]
sub eax, dword [ebp - 0x34]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x4c]
sub ecx, dword [ebp - 0x34]
mov dword [ebp - 0x4c], ecx
mov ecx, 0x4c8d68
call fcn.0045da12
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
je 0x43e6bf
mov edx, dword [ebp - 0x50]
movsx eax, byte [edx + 0x1b8]
test eax, eax
jne 0x43e6d3
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.004828bf
jmp 0x43f6cb
cmp dword [0x4c8f68], 0
jne 0x43e6f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.004828bf
jmp 0x43f6cb
mov ecx, dword [ebp - 0x4c]
sub ecx, dword [ebp - 0x34]
test ecx, ecx
jle 0x43e75a
mov edx, dword [ebp - 0x34]
sub edx, 0x32
mov dword [ebp - 0x84], edx
jmp 0x43e717
mov eax, dword [ebp - 0x84]
add eax, 1
mov dword [ebp - 0x84], eax
mov ecx, dword [ebp - 0x4c]
sub ecx, 0x32
cmp dword [ebp - 0x84], ecx
jg 0x43e747
mov edx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x50]
xor ecx, ecx
cmp dword [eax + edx*8 + 0x7c], 0
sete cl
mov edx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x50]
mov dword [eax + edx*8 + 0x7c], ecx
jmp 0x43e708
push 3
mov ecx, 0x4c8d60
call fcn.004827c9
mov dword [ebp - 0x1c], 1
push 0x18
push 0
mov ecx, dword [ebp - 0x35c0]
add ecx, 0x44
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x80]
call fcn.00440b60
push 3
lea edx, [ebp - 0x80]
push edx
push 0x32
push 1
lea ecx, [ebp - 0x48]
call fcn.00482906
lea eax, [ebp - 0x48]
push eax
mov ecx, dword [ebp - 0x35c0]
mov ecx, dword [ecx + 0x10]
mov edx, dword [ebp - 0x35c0]
mov eax, dword [edx + 0x10]
mov edx, dword [eax]
call dword [edx + 4]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.004828bf
mov eax, dword [ebp - 0x35c0]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x35c4], ecx
cmp dword [ebp - 0x35c4], 0
je 0x43e7eb
cmp dword [ebp - 0x35c4], 2
je 0x43e8d0
cmp dword [ebp - 0x35c4], 4
je 0x43f58e
jmp 0x43f6cb
mov edx, dword [ebp - 0x35c0]
mov eax, dword [edx + 0x34]
mov dword [ebp - 0x35c8], eax
cmp dword [ebp - 0x1c], 0
je 0x43e805
jmp 0x43e8cb
mov ecx, dword [ebp - 0x35c0]
cmp dword [ecx + 0x34], 0x32
jl 0x43e89b
mov edx, dword [ebp - 0x35c0]
cmp dword [edx + 0x34], 0x59
jge 0x43e89b
cmp dword [0x4c8f68], 0
jne 0x43e82f
jmp 0x43e8cb
mov ecx, 0x4c8d68
call fcn.0045da12
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
je 0x43e859
mov eax, dword [ebp - 0x88]
movsx ecx, byte [eax + 0x1b8]
test ecx, ecx
jne 0x43e85b
jmp 0x43e8cb
mov edx, dword [ebp - 0x35c0]
mov eax, dword [edx + 0x34]
mov ecx, dword [ebp - 0x88]
xor edx, edx
cmp dword [ecx + eax*8 - 0x114], 0
sete dl
mov eax, dword [ebp - 0x35c0]
mov ecx, dword [eax + 0x34]
mov eax, dword [ebp - 0x88]
mov dword [eax + ecx*8 - 0x114], edx
push 3
mov ecx, 0x4c8d60
call fcn.004827c9
jmp 0x43e8cb
mov ecx, dword [ebp - 0x35c0]
cmp dword [ecx + 0x34], 0x5a
jl 0x43e8cb
mov edx, dword [ebp - 0x35c0]
cmp dword [edx + 0x34], 0x6d
jge 0x43e8cb
mov eax, dword [ebp - 0x35c0]
mov ecx, dword [eax + 0x34]
sub ecx, 0x5a
push ecx
mov ecx, dword [ebp - 0x35c0]
call fcn.004409f7
jmp 0x43f6cb
mov edx, dword [ebp - 0x35c0]
mov eax, dword [edx + 0x34]
push eax
mov ecx, dword [ebp - 0x35c0]
call fcn.004405f7
cmp eax, 3
jne 0x43e8ef
jmp 0x43f6cb
mov ecx, dword [ebp - 0x35c0]
mov edx, dword [ecx + 0x34]
push edx
mov ecx, dword [ebp - 0x35c0]
call fcn.004405f7
cmp eax, 2
je 0x43e92c
mov eax, dword [ebp - 0x35c0]
cmp dword [eax + 0x34], 0x92
je 0x43e92c
mov ecx, dword [ebp - 0x35c0]
cmp dword [ecx + 0x34], 0x93
je 0x43e92c
jmp 0x43f6cb
push 3
mov edx, dword [ebp - 0x35c0]
mov ecx, dword [edx + 0x10]
mov eax, dword [ebp - 0x35c0]
mov edx, dword [eax + 0x10]
mov eax, dword [edx]
call dword [eax + 8]
push 0
mov ecx, dword [ebp - 0x35c0]
mov edx, dword [ecx + 0x34]
push edx
mov ecx, dword [ebp - 0x35c0]
call fcn.0044070b
mov eax, dword [ebp - 0x35c0]
mov ecx, dword [eax + 0x34]
mov dword [ebp - 0x35cc], ecx
mov edx, dword [ebp - 0x35cc]
sub edx, 0x65
mov dword [ebp - 0x35cc], edx
cmp dword [ebp - 0x35cc], 0x42
ja case.0x43e995.43
mov ecx, dword [ebp - 0x35cc]
xor eax, eax
mov al, byte [ecx + 0x43f78c]
jmp dword [eax*4 + 0x43f6dc]
push 6
mov ecx, 0x4c8d68
call fcn.00404a50
mov ecx, eax
call sub.MFC42.DLL_CWnd::ShowWindow
jmp case.0x43e995.43
mov ecx, 0x4a6ee0
call fcn.0041a38b
jmp case.0x43e995.43
mov ecx, 0x4a6ee0
call fcn.0041a554
jmp case.0x43e995.43
lea ecx, [ebp - 0x8c]
call sub.MFC42.DLL_CString::CString_2
mov dword [ebp - 4], 1
push 0x4a0134
push 0x4a016c
lea edx, [ebp - 0x8c]
push edx
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea ecx, [ebp - 0x8c]
call fcn.00402e50
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8c]
call sub.MFC42.DLL_CString::CString
push 0
push 0
push 0x4d9
mov ecx, 0x4c8d68
call fcn.00404a50
mov ecx, eax
call fcn.00404a70
jmp case.0x43e995.43
push 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0x94], eax
push 1
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x94], 0x320
jl 0x43ea74
cmp dword [ebp - 0x98], 0x23a
jge 0x43ea79
jmp case.0x43e995.43
mov ecx, 0x4c8d68
call fcn.00404a50
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
je 0x43eac8
push 1
push 1
call dword [sym.imp.USER32.dll_GetSystemMetrics]
sub eax, dword [0x4d4d38]
push eax
push 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push eax
push 0
push 0
mov ecx, dword [ebp - 0x90]
call sub.MFC42.DLL_CWnd::MoveWindow
push 0
mov ecx, dword [ebp - 0x90]
call sub.MFC42.DLL_CWnd::CenterWindow
push 0
push 0x66
mov ecx, dword [ebp - 0x35c0]
call fcn.00440792
push 1
push 0x67
mov ecx, dword [ebp - 0x35c0]
call fcn.00440792
cmp dword [0x4f7218], 0
je 0x43eb0a
push 0
push 0x3e9
mov eax, dword [0x4f7218]
mov ecx, dword [eax]
mov edx, dword [0x4f7218]
push edx
call dword [ecx + 0x1c]
add esp, 0xc
jmp case.0x43e995.43
push 1
push 0x23a
push 0x320
push 0
push 0
mov ecx, 0x4c8d68
call fcn.00404a50
mov ecx, eax
call sub.MFC42.DLL_CWnd::MoveWindow
push 0
mov ecx, 0x4c8d68
call fcn.00404a50
mov ecx, eax
call sub.MFC42.DLL_CWnd::CenterWindow
push 1
push 0x66
mov ecx, dword [ebp - 0x35c0]
call fcn.00440792
push 0
push 0x67
mov ecx, dword [ebp - 0x35c0]
call fcn.00440792
cmp dword [0x4f7218], 0
je 0x43eb85
push 0
push 0x3e9
mov eax, dword [0x4f7218]
mov ecx, dword [eax]
mov edx, dword [0x4f7218]
push edx
call dword [ecx + 0x1c]
add esp, 0xc
jmp case.0x43e995.43
push 0x4a0184
mov ecx, 0x4c8d68
call fcn.0045def9
push 0x4a0190
push 1
push 2
mov ecx, 0x4c8d30
call fcn.0042aa17
jmp case.0x43e995.43
push 0
push 0
push 0x49d
mov ecx, 0x4c8d68
call fcn.00404a50
mov ecx, eax
call fcn.00404a70
jmp case.0x43e995.43
push 0
push 0
push 0x4a6
mov ecx, 0x4c8d68
call fcn.00404a50
mov ecx, eax
call fcn.00404a70
push 0
push 0
push 0x494
mov ecx, 0x4c8d68
call fcn.00404a50
mov ecx, eax
call fcn.00404a70
jmp case.0x43e995.43
push 0x4a0194
mov ecx, 0x4c8d68
call fcn.0045def9
push 1
push 0
push 0
push str.http:__jump.qq.com_gamehelp90
push 0
mov ecx, 0x4c8d68
call fcn.00404a50
mov ecx, eax
call fcn.00409c60
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp case.0x43e995.43
push 0
push 0
push 0x4a6
mov ecx, 0x4c8d68
call fcn.00404a50
mov ecx, eax
call fcn.00404a70
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0x477
mov ecx, 0x4c8d68
call fcn.00404a50
mov ecx, eax
call fcn.00404a70
jmp case.0x43e995.43
push 0
push 0
push 0x4a6
mov ecx, 0x4c8d68
call fcn.00404a50
mov ecx, eax
call fcn.00404a70
mov byte [ebp - 0x9c], 0x65
lea edx, [ebp - 0x9c]
push edx
push 1
push 0x12
mov ecx, 0x4c8d30
call fcn.0042aa17
jmp case.0x43e995.43
push 0
push 0
push 0x4a6
mov ecx, 0x4c8d68
call fcn.00404a50
mov ecx, eax
call fcn.00404a70
mov ecx, 0x4c8d68
call fcn.0043c0b0
test eax, eax
jne 0x43ecfc
push 0
push 0
push 3
push 0x4a01c0
mov ecx, 0x4c8d68
call fcn.004627d2
jmp case.0x43e995.43
mov ecx, 0x4c8d68
call fcn.0043c0b0
cmp eax, 2
jne 0x43ed25
push 0
push 0
push 3
push 0x4a01e4
mov ecx, 0x4c8d68
call fcn.004627d2
jmp case.0x43e995.43
cmp dword [0x4c8f3c], 0x1e
jge 0x43ed48
push 0
push 0
push 2
push 0x4a0200
mov ecx, 0x4c8d68
call fcn.004627d2
jmp case.0x43e995.43
cmp dword [0x4c8f68], 0
jne 0x43ed6b
push 0
push 0
push 3
push 0x4a0224
mov ecx, 0x4c8d68
call fcn.004627d2
jmp case.0x43e995.43
push 0
push 1
push 0x488
mov ecx, 0x4c8d68
call fcn.00404a50
mov ecx, eax
call fcn.00404a70
jmp case.0x43e995.43
push 0
push 0
push 0x488
mov ecx, 0x4c8d68
call fcn.00404a50
mov ecx, eax
call fcn.00404a70
jmp case.0x43e995.43
push 0
push 0
push 0x4a6
mov ecx, 0x4c8d68
call fcn.00404a50
mov ecx, eax
call fcn.00404a70
push 0
push 0
push 0x49d
mov ecx, 0x4c8d68
call fcn.00404a50
mov ecx, eax
call fcn.00404a70
jmp case.0x43e995.43
push 0
push 0
push 0x4a6
mov ecx, 0x4c8d68
call fcn.00404a50
mov ecx, eax
call fcn.00404a70
push 0
push 0
push 0x498
mov ecx, 0x4c8d68
call fcn.00404a50
mov ecx, eax
call fcn.00404a70
jmp case.0x43e995.43
push 0
push 0
push 0x4a6
mov ecx, 0x4c8d68
call fcn.00404a50
mov ecx, eax
call fcn.00404a70
push 0
push 1
push 0x49f
mov ecx, 0x4c8d68
call fcn.00404a50
mov ecx, eax
call fcn.00404a70
push 0
push 0x7f
mov ecx, dword [ebp - 0x35c0]
call fcn.00440792
push 1
push 0x80
mov ecx, dword [ebp - 0x35c0]
call fcn.00440792
jmp case.0x43e995.43
push 0
push 0
push 0x4a6
mov ecx, 0x4c8d68
call fcn.00404a50
mov ecx, eax
call fcn.00404a70
push 1
push 0x7f
mov ecx, dword [ebp - 0x35c0]
call fcn.00440792
push 0
push 0x80
mov ecx, dword [ebp - 0x35c0]
call fcn.00440792
push 0
push 0
push 0x49f
mov ecx, 0x4c8d68
call fcn.00404a50
mov ecx, eax
call fcn.00404a70
jmp case.0x43e995.43
push 0
push 0
push 0x4a6
mov ecx, 0x4c8d68
call fcn.00404a50
mov ecx, eax
call fcn.00404a70
xor eax, eax
cmp dword [0x4c8eec], 0
sete al
mov dword [0x4c8eec], eax
mov ecx, 0x4c8d68
call fcn.0045dd18
movsx ecx, byte [0x4c8f64]
add ecx, 2
and ecx, 0x80000003
jns 0x43ef1b
dec ecx
or ecx, 0xfffffffc
inc ecx
mov dword [ebp - 0xa0], ecx
mov dl, byte [ebp - 0xa0]
push edx
mov ecx, 0x4c8d68
call fcn.0045d86c
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0
je 0x43efa1
mov eax, dword [ebp - 0xa4]
movsx ecx, byte [eax + 0x1b8]
cmp ecx, 1
jle 0x43efa1
mov edx, dword [ebp - 0xa4]
add edx, 0x78
push edx
mov ecx, 0x4c8d68
call fcn.0045de33
movsx eax, al
test eax, eax
je 0x43efa1
cmp dword [0x4c8eec], 0
je 0x43ef8d
mov ecx, dword [ebp - 0xa4]
add ecx, 0x74
push ecx
mov ecx, 0x4c9898
call fcn.004202ce
jmp 0x43efa1
mov edx, dword [ebp - 0xa4]
add edx, 0x74
push edx
mov ecx, 0x4c9898
call fcn.00420377
push str.resda.wav
mov ecx, 0x4c8d68
call fcn.0045def9
push 3
mov ecx, 0x4c8d60
call fcn.004827c9
jmp case.0x43e995.43
push 0
push 0
push 0x4a6
mov ecx, 0x4c8d68
call fcn.00404a50
mov ecx, eax
call fcn.00404a70
push 0
push 0
push 0x47d
mov ecx, 0x4c8d68
call fcn.00404a50
mov ecx, eax
call fcn.00404a70
jmp case.0x43e995.43
push str.BTN_ID_PLAYSTART
call fcn.0047d3d0
add esp, 4
mov ecx, 0x4a7740
call fcn.00453d21
push 0
push 0x74
mov ecx, dword [ebp - 0x35c0]
call fcn.00440792
mov ecx, 0x4c8d68
call fcn.0045daf5
jmp case.0x43e995.43
push 0
push 1
push 0x478
mov ecx, 0x4c8d68
call fcn.00404a50
mov ecx, eax
call fcn.00413b00
jmp case.0x43e995.43
push 0
push 2
push 0x478
mov ecx, 0x4c8d68
call fcn.00404a50
mov ecx, eax
call fcn.00413b00
jmp case.0x43e995.43
push 0
push 3
push 0x478
mov ecx, 0x4c8d68
call fcn.00404a50
mov ecx, eax
call fcn.00413b00
jmp case.0x43e995.43
push 0
push 0
push 0x478
mov ecx, 0x4c8d68
call fcn.00404a50
mov ecx, eax
call fcn.00413b00
jmp case.0x43e995.43
push 0
push 0
push 0x47b
mov ecx, 0x4c8d68
call fcn.00404a50
mov ecx, eax
call fcn.00413b00
jmp case.0x43e995.43
push 0
push 0
push 0x47c
mov ecx, 0x4c8d68
call fcn.00404a50
mov ecx, eax
call fcn.00413b00
jmp case.0x43e995.43
push 0
push 0
push 0x47f
mov ecx, 0x4c8d68
call fcn.00404a50
mov ecx, eax
call fcn.00404a70
jmp case.0x43e995.43
mov byte [ebp - 0xa8], 0x65
lea eax, [ebp - 0xa8]
push eax
push 1
push 0x12
mov ecx, 0x4c8d30
call fcn.0042aa17
jmp case.0x43e995.43
push 0
push 1
push 0x4b7
mov ecx, 0x4c8d68
call fcn.00404a50
mov ecx, eax
call fcn.00413b00
jmp case.0x43e995.43
push 0x4d4cad
mov ecx, 0x4c8d30
call fcn.0042adce
jmp case.0x43e995.43
push 0
mov ecx, 0x4c8d68
call fcn.00464225
jmp case.0x43e995.43
push 1
mov ecx, 0x4c8d68
call fcn.00464225
jmp case.0x43e995.43
push 1
push 3
mov ecx, 0x4c8d68
call fcn.0046450e
push 2
push 3
mov ecx, 0x4c8d68
call fcn.0046450e
jmp case.0x43e995.43
mov ecx, 0x4c8d68
call fcn.004649df
push 1
push 0
mov ecx, 0x4c8d68
call fcn.0046450e
push 2
push 0
mov ecx, 0x4c8d68
call fcn.0046450e
jmp case.0x43e995.43
push 2
push 1
mov ecx, 0x4c8d68
call fcn.0046450e
push 3
push 1
mov ecx, 0x4c8d68
call fcn.0046450e
jmp case.0x43e995.43
push 0x1008
push 0
lea ecx, [ebp - 0x1edc]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 0x1edc], 0
mov dword [ebp - 0x1ed8], 0xa28
lea ecx, [ebp - 0xed4]
call fcn.0043c2e0
mov dword [ebp - 0xed4], 0x5a
mov dword [ebp - 0xe84], 0xea61
mov dword [ebp - 0xe80], 0x77fc23a6
mov dword [ebp - 0xe7c], 0x4e97
mov dword [ebp - 0xe78], 0xcaa31
movsx edx, byte [0x4c8f64]
imul edx, edx, 0x648
xor eax, eax
mov al, byte [edx + 0x4c98c6]
mov dword [ebp - 0xed0], eax
mov dword [ebp - 0xe74], 3
mov byte [ebp - 0x4ac], 0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x4ab]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, dword [ebp - 0xe78]
push ecx
mov edx, dword [ebp - 0xe7c]
push edx
mov eax, dword [ebp - 0xe80]
push eax
mov ecx, dword [ebp - 0xe84]
push ecx
mov edx, dword [0x4c8f60]
push edx
push 0x4a0260
push 0x3ff
lea eax, [ebp - 0x4ac]
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x20
lea ecx, [ebp - 0x4ac]
push ecx
call fcn.0047d3d0
add esp, 4
push 0xa28
lea edx, [ebp - 0xed4]
push edx
lea eax, [ebp - 0x1ed4]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
lea ecx, [ebp - 0x1edc]
push ecx
push 0x1008
push 0xb3
mov ecx, 0x4c8d30
call fcn.0042aa17
mov dword [ebp - 0xac], str.qqgame:__openembedwebdialog:CaptioniPhone
mov edx, dword [ebp - 0xac]
push edx
mov eax, dword [ebp - 0xac]
push eax
call sub.MSVCRT.dll_strlen
add esp, 4
add eax, 1
push eax
push 0x55
mov ecx, 0x4c8d30
call fcn.0042aa17
jmp case.0x43e995.43
mov ecx, 0x4a6e98
call fcn.00412b72
mov dword [ebp - 0x1ee0], eax
cmp dword [ebp - 0x1ee0], 0
je 0x43f3a5
push 1
mov ecx, dword [0x4c8f60]
push ecx
mov edx, dword [ebp - 0x1ee0]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x1ee0]
call dword [eax + 0x10]
test eax, eax
je 0x43f3a5
push 0x4a031c
push 0x217
push 0x1f4
push 0x4a032c
mov ecx, dword [0x4d5864]
mov edx, dword [ecx]
mov ecx, dword [0x4d5864]
call dword [edx + 0x38]
jmp 0x43f3c9
push 0x4a040c
push 0x217
push 0x1f4
push str.http:__ptlogin2.qq.com_jump_clientuin_UIN_clientkey_SIG_aid7000201keyindex1u1http:__gamevip.qq.com_lz_pop_15_pay_pop_50.html_referIED.HALL.DDZ.INGAMEADTAGIED.HALL.SRDDZ.DLPLZappId1001
mov eax, dword [0x4d5864]
mov edx, dword [eax]
mov ecx, dword [0x4d5864]
call dword [edx + 0x38]
jmp case.0x43e995.43
push 0x4a04e4
push 0x217
push 0x1f4
push str.http:__ptlogin2.qq.com_jump_clientuin_UIN_clientkey_SIG_aid7000201keyindex1u1http:__gamevip.qq.com_lz_pop_15_pay_pop_50.html_referIED.HALL.DDZ.DLPKTADTAGIED.HALL.SRDDZ.DLPKTappId1001
mov eax, dword [0x4d5864]
mov edx, dword [eax]
mov ecx, dword [0x4d5864]
call dword [edx + 0x38]
jmp case.0x43e995.43
push 0x4a05bc
push 0x217
push 0x1f4
push str.http:__ptlogin2.qq.com_jump_clientuin_UIN_clientkey_SIG_aid7000201keyindex1u1http_3a_2f_2fgamevip.qq.com_2flz_pop_15_2fpay_pop_50.html_3frefer_3dIED.HALL.DDZ.INGAME_26ADTAG_3dIED.HALL.SRDDZ.DLPHHB_26appId_3d1001
mov eax, dword [0x4d5864]
mov edx, dword [eax]
mov ecx, dword [0x4d5864]
call dword [edx + 0x38]
jmp case.0x43e995.43
push str.http:__ptlogin2.qq.com_jump_clientuin_UIN_clientkey_SIG_aid7000201keyindex1u1http_3a_2f_2fpay.qq.com_2fipay_2findex.shtml_3fn_3d30_26c_3dqqacct_save_26ch_3dqqcard_2ckj
mov eax, dword [0x4d5864]
mov edx, dword [eax]
mov ecx, dword [0x4d5864]
call dword [edx + 0x34]
jmp case.0x43e995.43
push 0x11ee
push 0
lea eax, [ebp - 0x3588]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov ecx, dword [0x4c8f60]
mov dword [ebp - 0x3588], ecx
mov edx, dword [0x4c8f60]
mov dword [ebp - 0x3584], edx
mov dword [ebp - 0x3580], 0
mov dword [ebp - 0x3578], 1
mov dword [ebp - 0x357c], 2
mov dword [ebp - 0x355e], 0
mov dword [ebp - 0x355a], 0
mov dword [ebp - 0x3570], 1
mov dword [ebp - 0x356c], 1
mov word [ebp - 0x3560], 0xffff
mov dword [ebp - 0x3574], 0x11e1a6e9
mov dword [ebp - 0x3564], 0xffffffff
mov dword [ebp - 0x2398], 0
mov ecx, 0x12d
xor eax, eax
lea edi, [ebp - 0x2394]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x2398], 0xa
mov dword [ebp - 0x2394], 0x11ee
push 0x4b0
lea eax, [ebp - 0x3588]
push eax
lea ecx, [ebp - 0x2390]
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
lea edx, [ebp - 0x2398]
push edx
push 0x4b8
push 0x7f
mov ecx, 0x4c8d30
call fcn.0042aa17
cmp dword [0x4a3f98], 0
je 0x43f559
push 0
push 0
mov ecx, dword [0x4a3f98]
call fcn.0043bbe4
push 0x98
mov ecx, 0x4c8d68
call fcn.00404a50
mov ecx, eax
call fcn.00412490
jmp case.0x43e995.43
cmp dword [0x4a3f98], 0
je case.0x43e995.43
push 0
push 0
mov ecx, dword [0x4a3f98]
call fcn.0043bbe4
push 0x98
mov ecx, 0x4c8d68
call fcn.00404a50
mov ecx, eax
call fcn.00412490
jmp 0x43f6cb
mov eax, dword [ebp - 0x35c0]
mov ecx, dword [eax + 0x34]
mov dword [ebp - 0x35d0], ecx
cmp dword [ebp - 0x35d0], 0x9f
je 0x43f688
cmp dword [ebp - 0x35d0], 0xa0
je 0x43f5ca
cmp dword [ebp - 0x35d0], 0xa1
je 0x43f617
jmp 0x43f6cb
lea ecx, [ebp - 0x3590]
call fcn.00440b90
mov edx, dword [0x4c8f60]
mov dword [ebp - 0x358f], edx
lea eax, [ebp - 0x3590]
push eax
push 5
mov ecx, 0x4c8d30
call fcn.0042a963
push 0x1bec71
push 0x7574
push 0x77fd2ce1
push 0xc351
mov ecx, 0x4c8d68
call fcn.00464bbd
jmp 0x43f6cb
cmp dword [0x4c8fac], 0
jbe 0x43f674
lea ecx, [ebp - 0x359c]
call fcn.00440bc0
mov ecx, dword [0x4c8f60]
mov dword [ebp - 0x359b], ecx
mov edx, dword [0x4c8fac]
mov dword [ebp - 0x3597], edx
lea eax, [ebp - 0x359c]
push eax
push 9
mov ecx, 0x4c8d30
call fcn.0042a963
push 0x1bec72
push 0x7574
push 0x77fd2ce1
push 0xc351
mov ecx, 0x4c8d68
call fcn.00464bbd
push 0
push 0xa1
mov ecx, dword [0x4a3f9c]
call fcn.00440819
jmp 0x43f6cb
push 0x4a0760
push 0x159
push 0x19a
push str.http:__ptlogin2.qq.com_jump_clientuin_UIN_clientkey_SIG_aid7000201keyindex1u1http_3a_2f_2fgamevip.qq.com_2fhall_2fdlp_2findex.html
mov ecx, dword [0x4d5864]
mov edx, dword [ecx]
mov ecx, dword [0x4d5864]
call dword [edx + 0x38]
push 0x1bec73
push 0x7574
push 0x77fd2ce1
push 0xc351
mov ecx, 0x4c8d68
call fcn.00464bbd
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
mov esp, ebp
pop ebp
ret 0xc