Function at 0x10064b30
Capabilities:
Create process on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10124be4
mov eax, dword fs:[0]
push eax
sub esp, 0x1f0
mov eax, dword [0x1019842c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1ac], ecx
lea eax, [ebp - 0xdc]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x108]
mov eax, dword [ebp + 8]
mov edx, dword [edx]
mov ecx, dword [eax + 0x108]
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0
push str.btn_menu_buyvip
lea ecx, [ebp - 0xdc]
call sym.UserAndPayClient.dll_public:_int___thiscall_xx_DuiLib::CDuiString::CompareNoCase_wchar_t_const__const
test eax, eax
jne 0x10064c10
mov ecx, dword [ebp - 0x1ac]
mov ecx, dword [ecx + 0x698]
call sym.UserAndPayClient.dll_public:_bool___thiscall_Talk2Svr::CTalk2Svr::CheckUserIsVip_void_
movzx edx, al
test edx, edx
je 0x10064bd5
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x1ac]
mov ecx, dword [eax + 0x698]
call sym.UserAndPayClient.dll_public:_int___thiscall_Talk2Svr::CTalk2Svr::ShowPayWnd_int__char___char___char___char___bool__enum_PayType_
jmp 0x10064bf4
push 0
push 0
push 0
push 0
push 0
push 0
push 1
mov ecx, dword [ebp - 0x1ac]
mov ecx, dword [ecx + 0x698]
call sym.UserAndPayClient.dll_public:_int___thiscall_Talk2Svr::CTalk2Svr::ShowPayWnd_int__char___char___char___char___bool__enum_PayType_
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdc]
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CDuiString::destructor_void_
jmp 0x10065293
push str.ShowMachinecode
lea ecx, [ebp - 0xdc]
call sym.UserAndPayClient.dll_public:_int___thiscall_xx_DuiLib::CDuiString::CompareNoCase_wchar_t_const__const
test eax, eax
jne 0x10064c42
push 0
push 0
push 0
push 0
mov edx, dword [ebp - 0x1ac]
mov ecx, dword [edx + 0x698]
call sym.UserAndPayClient.dll_public:_int___thiscall_Talk2Svr::CTalk2Svr::MessageWndUI_enum_Talk2Svr::CTalk2Svr::MessageBoxUI__bool__wchar_t___bool_
jmp 0x10065281
push str.Checkforupdates
lea ecx, [ebp - 0xdc]
call sym.UserAndPayClient.dll_public:_int___thiscall_xx_DuiLib::CDuiString::CompareNoCase_wchar_t_const__const
test eax, eax
jne 0x10064c8a
push 0
push 0
push 0x5f8
mov eax, dword [ebp - 0x1ac]
mov ecx, dword [eax + 0x698]
mov edx, dword [ecx + 0x3e0]
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
push 0
mov ecx, dword [ebp - 0x1ac]
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CWindowWnd::Close_unsigned_int_
jmp 0x10065281
push str.ExportLog
lea ecx, [ebp - 0xdc]
call sym.UserAndPayClient.dll_public:_int___thiscall_xx_DuiLib::CDuiString::CompareNoCase_wchar_t_const__const
test eax, eax
jne 0x10064dd9
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x1ac]
mov ecx, dword [ecx + 0x698]
call sym.UserAndPayClient.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____thiscall_Talk2Svr::CTalk2Svr::GetLogPathW_void_
mov byte [ebp - 4], 1
push 0x10155e18
lea ecx, [ebp - 0x28]
call fcn.1002b450
test eax, eax
jne 0x10064cef
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.10023d20
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdc]
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CDuiString::destructor_void_
jmp 0x10065293
lea ecx, [ebp - 0x28]
call fcn.10023880
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x1b4], eax
mov edx, dword [ebp - 0x1b4]
and edx, 0x10
je 0x10064d30
push 1
push 0
push 0
lea ecx, [ebp - 0x28]
call fcn.10023880
push eax
push 0x10155e1c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x10064dc8
push str.__select_
lea ecx, [ebp - 0x40]
call fcn.10020010
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
call fcn.10023880
push eax
lea ecx, [ebp - 0x40]
call fcn.10019550
mov dword [ebp - 0x1fc], 0
push 0x38
push 0
lea eax, [ebp - 0x1f8]
push eax
call fcn.100e0f10
add esp, 0xc
mov dword [ebp - 0x1fc], 0x3c
mov dword [ebp - 0x1ec], str.explorer
lea ecx, [ebp - 0x40]
call fcn.10023880
mov dword [ebp - 0x1e8], eax
mov dword [ebp - 0x1f0], 0x10155e54
mov dword [ebp - 0x1e0], 0xa
mov dword [ebp - 0x1e4], 0
lea ecx, [ebp - 0x1fc]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x40]
call fcn.10023d20
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.10023d20
jmp 0x10065281
push str.CopyrightNotice
lea ecx, [ebp - 0xdc]
call sym.UserAndPayClient.dll_public:_int___thiscall_xx_DuiLib::CDuiString::CompareNoCase_wchar_t_const__const
test eax, eax
jne 0x10064e0b
push 0
push 0
push 0
push 4
mov edx, dword [ebp - 0x1ac]
mov ecx, dword [edx + 0x698]
call sym.UserAndPayClient.dll_public:_int___thiscall_Talk2Svr::CTalk2Svr::MessageWndUI_enum_Talk2Svr::CTalk2Svr::MessageBoxUI__bool__wchar_t___bool_
jmp 0x10065281
push str.Help
lea ecx, [ebp - 0xdc]
call sym.UserAndPayClient.dll_public:_int___thiscall_xx_DuiLib::CDuiString::CompareNoCase_wchar_t_const__const
test eax, eax
jne 0x10064e4f
push 1
push 0
push 0
mov eax, dword [ebp - 0x1ac]
mov ecx, dword [eax + 0x698]
add ecx, 0x250
call fcn.10023880
push eax
push 0x10155e8c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x10065281
push 0x10155e98
lea ecx, [ebp - 0xdc]
call sym.UserAndPayClient.dll_public:_int___thiscall_xx_DuiLib::CDuiString::CompareNoCase_wchar_t_const__const
test eax, eax
jne 0x10064edf
mov ecx, dword [ebp - 0x1ac]
mov edx, dword [ecx + 0x698]
add edx, 0x174
push edx
lea eax, [ebp - 0x10c]
push eax
call fcn.1003efe0
add esp, 8
mov dword [ebp - 0x1b8], eax
mov ecx, dword [ebp - 0x1b8]
call fcn.100237b0
push eax
push str.strWebSite:_s_n
call fcn.10020c60
add esp, 8
lea ecx, [ebp - 0x10c]
call fcn.10023b10
push 1
push 0
push 0
mov ecx, dword [ebp - 0x1ac]
mov ecx, dword [ecx + 0x698]
add ecx, 0x174
call fcn.10023880
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x10065281
push str.AboutSoftare
lea ecx, [ebp - 0xdc]
call sym.UserAndPayClient.dll_public:_int___thiscall_xx_DuiLib::CDuiString::CompareNoCase_wchar_t_const__const
test eax, eax
jne 0x10064f11
push 0
push 0
push 0
push 3
mov edx, dword [ebp - 0x1ac]
mov ecx, dword [edx + 0x698]
call sym.UserAndPayClient.dll_public:_int___thiscall_Talk2Svr::CTalk2Svr::MessageWndUI_enum_Talk2Svr::CTalk2Svr::MessageBoxUI__bool__wchar_t___bool_
jmp 0x10065281
push str.QQService
lea ecx, [ebp - 0xdc]
call sym.UserAndPayClient.dll_public:_int___thiscall_xx_DuiLib::CDuiString::CompareNoCase_wchar_t_const__const
test eax, eax
jne 0x10064f3b
mov eax, dword [ebp - 0x1ac]
mov ecx, dword [eax + 0x698]
call sym.UserAndPayClient.dll_public:_void___thiscall_Talk2Svr::CTalk2Svr::GotoQQ_void_
jmp 0x10065281
push str.btn_quit
lea ecx, [ebp - 0xdc]
call sym.UserAndPayClient.dll_public:_int___thiscall_xx_DuiLib::CDuiString::CompareNoCase_wchar_t_const__const
test eax, eax
jne 0x10064f9b
lea ecx, [ebp - 0xf4]
call fcn.100237f0
mov byte [ebp - 4], 3
push 0
push 0
lea ecx, [ebp - 0xf4]
push ecx
mov edx, dword [ebp - 0x1ac]
mov ecx, dword [edx + 0x698]
call sym.UserAndPayClient.dll_public:_bool___thiscall_Talk2Svr::CTalk2Svr::SignOut_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____int___bool_
push 1
mov ecx, dword [ebp - 0x1ac]
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CWindowWnd::Close_unsigned_int_
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xf4]
call fcn.10023b10
jmp 0x10065281
push str.CutPicShow
lea ecx, [ebp - 0xdc]
call sym.UserAndPayClient.dll_public:_int___thiscall_xx_DuiLib::CDuiString::CompareNoCase_wchar_t_const__const
test eax, eax
jne 0x1006504d
mov eax, dword [ebp - 0x1ac]
cmp dword [eax + 0x7c4], 0
je 0x10064fe6
push 1
mov ecx, dword [ebp - 0x1ac]
mov edx, dword [ecx + 0x7c4]
mov eax, dword [ebp - 0x1ac]
mov edx, dword [edx]
mov ecx, dword [eax + 0x7c4]
mov eax, dword [edx + 0x104]
call eax
mov ecx, dword [ebp - 0x1ac]
cmp dword [ecx + 0x7c0], 0
je 0x10065019
push 0
mov edx, dword [ebp - 0x1ac]
mov eax, dword [edx + 0x7c0]
mov ecx, dword [ebp - 0x1ac]
mov edx, dword [eax]
mov ecx, dword [ecx + 0x7c0]
mov eax, dword [edx + 0x104]
call eax
push 0
push 1
push 0x1428
mov ecx, dword [ebp - 0x1ac]
mov edx, dword [ecx + 0x698]
mov eax, dword [edx + 0x3e0]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
push 1
mov ecx, dword [ebp - 0x1ac]
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CWindowWnd::Close_unsigned_int_
jmp 0x10065281
push str.CutPic
lea ecx, [ebp - 0xdc]
call sym.UserAndPayClient.dll_public:_int___thiscall_xx_DuiLib::CDuiString::CompareNoCase_wchar_t_const__const
test eax, eax
jne 0x100650ff
mov ecx, dword [ebp - 0x1ac]
cmp dword [ecx + 0x7c4], 0
je 0x10065098
push 0
mov edx, dword [ebp - 0x1ac]
mov eax, dword [edx + 0x7c4]
mov ecx, dword [ebp - 0x1ac]
mov edx, dword [eax]
mov ecx, dword [ecx + 0x7c4]
mov eax, dword [edx + 0x104]
call eax
mov ecx, dword [ebp - 0x1ac]
cmp dword [ecx + 0x7c0], 0
je 0x100650cb
push 1
mov edx, dword [ebp - 0x1ac]
mov eax, dword [edx + 0x7c0]
mov ecx, dword [ebp - 0x1ac]
mov edx, dword [eax]
mov ecx, dword [ecx + 0x7c0]
mov eax, dword [edx + 0x104]
call eax
push 0
push 0
push 0x1428
mov ecx, dword [ebp - 0x1ac]
mov edx, dword [ecx + 0x698]
mov eax, dword [edx + 0x3e0]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
push 1
mov ecx, dword [ebp - 0x1ac]
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CWindowWnd::Close_unsigned_int_
jmp 0x10065281
push str.Kjzq
lea ecx, [ebp - 0xdc]
call sym.UserAndPayClient.dll_public:_int___thiscall_xx_DuiLib::CDuiString::CompareNoCase_wchar_t_const__const
test eax, eax
jne 0x100651cc
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x108]
mov dword [ebp - 0x1b0], edx
push 0xffffffffffffffff
mov eax, dword [ebp - 0x1b0]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x1b0]
mov eax, dword [edx + 0x188]
call eax
push eax
lea ecx, [ebp - 0x1a8]
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CDuiString::constructor_wchar_t_const___int_
mov byte [ebp - 4], 4
push 0
push str.op2.png
lea ecx, [ebp - 0x1a8]
call sym.UserAndPayClient.dll_public:_int___thiscall_xx_DuiLib::CDuiString::Find_wchar_t_const___int_const
cmp eax, 0xffffffff
je 0x10065189
push 0
push 0
push 0x1428
mov ecx, dword [ebp - 0x1ac]
mov edx, dword [ecx + 0x698]
mov eax, dword [edx + 0x3e0]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x100651ab
push 0
push 1
push 0x1428
mov ecx, dword [ebp - 0x1ac]
mov edx, dword [ecx + 0x698]
mov eax, dword [edx + 0x3e0]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
push 1
mov ecx, dword [ebp - 0x1ac]
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CWindowWnd::Close_unsigned_int_
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1a8]
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CDuiString::destructor_void_
jmp 0x10065281
push str.Copy
lea ecx, [ebp - 0xdc]
call sym.UserAndPayClient.dll_public:_int___thiscall_xx_DuiLib::CDuiString::CompareNoCase_wchar_t_const__const
test eax, eax
je 0x100651f8
push str.copyId
lea ecx, [ebp - 0xdc]
call sym.UserAndPayClient.dll_public:_int___thiscall_xx_DuiLib::CDuiString::CompareNoCase_wchar_t_const__const
test eax, eax
jne 0x10065281
mov ecx, dword [ebp - 0x1ac]
mov edx, dword [ecx + 0x698]
mov eax, dword [edx + 0x34]
push eax
push 0x10155f60
lea ecx, [ebp - 0x58]
push ecx
call fcn.1003fc90
add esp, 0xc
mov byte [ebp - 4], 5
lea edx, [ebp - 0x58]
push edx
lea eax, [ebp - 0x124]
push eax
call fcn.1003efe0
add esp, 8
mov dword [ebp - 0x1bc], eax
mov ecx, dword [ebp - 0x1bc]
mov dword [ebp - 0x1c0], ecx
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x58]
call fcn.10019760
push eax
mov ecx, dword [ebp - 0x1c0]
call fcn.100237b0
push eax
mov ecx, dword [ebp - 0x1ac]
call fcn.10031940
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x124]
call fcn.10023b10
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x58]
call fcn.10023d20
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdc]
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CDuiString::destructor_void_
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100e3849
mov esp, ebp
pop ebp
ret 4