Function at 0x412c50
Capabilities:
Create process on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4428d0
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
mov ebx, dword [esp + 0x48]
push ebp
push esi
push edi
mov edi, dword [esp + 0x58]
push edi
push ebx
mov esi, ecx
push 0x202
call fcn.00413880
test al, al
jne case.0x412d04.105
call dword [sym.imp.USER32.dll_ReleaseCapture]
push edi
push ebx
mov ecx, esi
call fcn.004133b0
or edi, 0xffffffff
cmp eax, edi
je case.0x412d04.105
mov eax, dword [esi + 0x14]
sub eax, 2
jne case.0x412d04.105
mov eax, dword [esi + 0x18]
mov ecx, esi
push eax
call fcn.00413490
cmp eax, 3
je case.0x412d04.105
mov ecx, dword [esi + 0x18]
push ecx
mov ecx, esi
call fcn.00413490
cmp eax, 2
jne case.0x412d04.105
mov edx, dword [esi + 0x18]
xor ebp, ebp
push ebp
push edx
mov ecx, esi
call fcn.004135d0
push str.resda.wav
mov ecx, 0x450840
call fcn.00425a70
mov eax, dword [esi + 0x18]
add eax, 0xffffff9b
cmp eax, 0x21
ja case.0x412d04.105
jmp dword [eax*4 + 0x413104]
mov ecx, 0x450408
call fcn.0040e8d0
jmp case.0x412d04.105
mov eax, dword [0x450860]
push ebp
push ebp
push 0x49d
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
jmp case.0x412d04.105
lea edx, [esp + 0x54]
mov ecx, 0x450408
push edx
push 1
push 0x12
mov byte [esp + 0x60], 0x65
call fcn.0040e770
jmp case.0x412d04.105
mov ecx, dword [0x450860]
push 6
call sub.MFC42.DLL_CWnd::ShowWindow
jmp case.0x412d04.105
mov eax, dword [0x450860]
push ebp
push ebp
push 0x10
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
jmp case.0x412d04.105
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
mov edi, dword [0x450860]
push 1
push 1
call ebx
push eax
push ebp
call ebx
push eax
push ebp
push ebp
mov ecx, edi
call sub.MFC42.DLL_CWnd::MoveWindow
push ebp
push 0x66
mov ecx, esi
call fcn.00413670
push 1
push 0x67
mov ecx, esi
call fcn.00413670
jmp case.0x412d04.105
mov ecx, dword [0x450860]
push 1
push 0x23a
push 0x2ee
push ebp
push ebp
call sub.MFC42.DLL_CWnd::MoveWindow
mov ecx, dword [0x450860]
push ebp
call sub.MFC42.DLL_CWnd::CenterWindow
push 1
push 0x66
mov ecx, esi
call fcn.00413670
push ebp
push 0x67
mov ecx, esi
call fcn.00413670
jmp case.0x412d04.105
push ebp
push ebp
push 0x494
jmp 0x412ee1
mov eax, dword [0x450860]
cmp eax, ebp
jne 0x412e0e
xor eax, eax
jmp 0x412e11
mov eax, dword [eax + 0x20]
push 1
push ebp
push ebp
push str.http:__qqgamecdnimg.qq.com_help_rule198.html
push ebp
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp case.0x412d04.105
push ebp
push 0x7f
mov ecx, esi
mov dword [0x450a10], ebp
call fcn.00413670
jmp case.0x412d04.105
cmp dword [0x45a678], ebp
jne 0x412e5a
push 3
push 0x44e900
mov ecx, 0x450840
call fcn.00428010
jmp case.0x412d04.105
cmp dword [0x4509c8], ebp
jne 0x412e78
push 3
push 0x44e8e4
mov ecx, 0x450840
call fcn.00428010
jmp case.0x412d04.105
mov ecx, dword [0x450860]
push ebp
push 1
push 0x488
mov edx, dword [ecx + 0x20]
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
jmp case.0x412d04.105
mov eax, dword [0x450860]
push ebp
push ebp
push 0x488
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
jmp case.0x412d04.105
push ebp
push ebp
push 0x49d
jmp 0x412ee1
mov eax, dword [0x450980]
xor ecx, ecx
cmp eax, ebp
sete cl
mov dword [0x450980], ecx
mov ecx, 0x450840
call fcn.00425730
jmp case.0x412d04.105
push ebp
push ebp
push 0x47d
mov edx, dword [0x450860]
mov eax, dword [edx + 0x20]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
jmp case.0x412d04.105
push ebp
push 0x74
mov ecx, esi
call fcn.00413670
mov ecx, 0x450840
call fcn.004255d0
mov edi, eax
cmp edi, ebp
je case.0x412d04.105
push ebp
push 0x7f
mov ecx, esi
mov dword [0x450a10], ebp
call fcn.00413670
push 0x44e8e0
push 1
push 1
mov ecx, 0x450408
call fcn.0040e770
mov ecx, 0x450840
mov dword [edi + 0x470], 1
call fcn.00425650
jmp case.0x412d04.105
mov ecx, dword [0x450860]
push ebp
push 1
push 0x478
mov edx, dword [ecx + 0x20]
push edx
jmp 0x4130e6
push ebp
push 2
push 0x478
jmp 0x4130dd
mov edx, dword [0x450860]
push ebp
push 3
push 0x478
mov eax, dword [edx + 0x20]
push eax
jmp 0x4130e6
mov ecx, dword [0x450860]
push ebp
push 4
push 0x478
mov edx, dword [ecx + 0x20]
push edx
jmp 0x4130e6
push ebp
push ebp
push 0x478
jmp 0x4130dd
mov edx, dword [0x450860]
push ebp
push ebp
push 0x47b
mov eax, dword [edx + 0x20]
push eax
jmp 0x4130e6
mov ecx, dword [0x450860]
push ebp
push ebp
push 0x47c
mov edx, dword [ecx + 0x20]
push edx
jmp 0x4130e6
mov eax, dword [0x450860]
push ebp
push ebp
push 0x47f
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
jmp case.0x412d04.105
xor edx, edx
lea ecx, [esp + 0x18]
mov dword [esp + 0x54], edx
mov dword [esp + 0x54], 0x12
mov dword [esp + 0x58], edx
mov dword [esp + 0x58], 1
call fcn.004357d0
lea eax, [esp + 0x54]
push 3
push eax
push 0x12
push 1
lea ecx, [esp + 0x28]
mov dword [esp + 0x58], ebp
call fcn.00435850
mov ecx, dword [esi + 4]
lea eax, [esp + 0x18]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
lea ecx, [esp + 0x18]
mov dword [esp + 0x48], edi
call fcn.00435810
jmp case.0x412d04.105
xor ecx, ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x10], 0x12
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x2c]
mov dword [esp + 0x14], ebp
call fcn.004357d0
lea edx, [esp + 0x10]
push 3
push edx
push 0x12
push 1
lea ecx, [esp + 0x3c]
mov dword [esp + 0x58], 1
call fcn.00435850
mov ecx, dword [esi + 4]
lea edx, [esp + 0x2c]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [esp + 0x2c]
mov dword [esp + 0x48], edi
call fcn.00435810
jmp case.0x412d04.105
mov ecx, dword [esi + 0x2c]
cmp ecx, ebp
je case.0x412d04.105
call fcn.00437510
mov ecx, dword [esi + 0x2c]
test al, al
sete al
push eax
call fcn.00437210
jmp case.0x412d04.105
mov ecx, dword [0x450860]
push ebp
push 1
push 0x4a1
mov edx, dword [ecx + 0x20]
push edx
jmp 0x4130e6
push ebp
push ebp
push 0x4a1
mov eax, dword [0x450860]
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [esp + 0x40]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x3c
ret 0xc