Function at 0x1005f120
Capabilities:
Create process on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1011eda4
mov eax, dword fs:[0]
push eax
sub esp, 0x1f0
mov eax, dword [0x1019142c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1ac], ecx
lea eax, [ebp - 0xdc]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x108]
mov eax, dword [ebp + 8]
mov edx, dword [edx]
mov ecx, dword [eax + 0x108]
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0
push str.btn_menu_buyvip
lea ecx, [ebp - 0xdc]
call sym.UserAndPayClient.dll_public:_int___thiscall_xx_DuiLib::CDuiString::CompareNoCase_wchar_t_const__const
test eax, eax
jne 0x1005f200
mov ecx, dword [ebp - 0x1ac]
mov ecx, dword [ecx + 0x698]
call sym.UserAndPayClient.dll_public:_bool___thiscall_Talk2Svr::CTalk2Svr::CheckUserIsVip_void_
movzx edx, al
test edx, edx
je 0x1005f1c5
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x1ac]
mov ecx, dword [eax + 0x698]
call sym.UserAndPayClient.dll_public:_int___thiscall_Talk2Svr::CTalk2Svr::ShowPayWnd_int__char___char___char___char___bool__enum_PayType_
jmp 0x1005f1e4
push 0
push 0
push 0
push 0
push 0
push 0
push 1
mov ecx, dword [ebp - 0x1ac]
mov ecx, dword [ecx + 0x698]
call sym.UserAndPayClient.dll_public:_int___thiscall_Talk2Svr::CTalk2Svr::ShowPayWnd_int__char___char___char___char___bool__enum_PayType_
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdc]
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CDuiString::destructor_void_
jmp 0x1005f86f
push str.ShowMachinecode
lea ecx, [ebp - 0xdc]
call sym.UserAndPayClient.dll_public:_int___thiscall_xx_DuiLib::CDuiString::CompareNoCase_wchar_t_const__const
test eax, eax
jne 0x1005f232
push 0
push 0
push 0
push 0
mov edx, dword [ebp - 0x1ac]
mov ecx, dword [edx + 0x698]
call sym.UserAndPayClient.dll_public:_int___thiscall_Talk2Svr::CTalk2Svr::MessageWndUI_enum_Talk2Svr::CTalk2Svr::MessageBoxUI__bool__wchar_t___bool_
jmp 0x1005f85d
push str.Checkforupdates
lea ecx, [ebp - 0xdc]
call sym.UserAndPayClient.dll_public:_int___thiscall_xx_DuiLib::CDuiString::CompareNoCase_wchar_t_const__const
test eax, eax
jne 0x1005f27a
push 0
push 0
push 0x5f8
mov eax, dword [ebp - 0x1ac]
mov ecx, dword [eax + 0x698]
mov edx, dword [ecx + 0x2e4]
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
push 0
mov ecx, dword [ebp - 0x1ac]
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CWindowWnd::Close_unsigned_int_
jmp 0x1005f85d
push str.ExportLog
lea ecx, [ebp - 0xdc]
call sym.UserAndPayClient.dll_public:_int___thiscall_xx_DuiLib::CDuiString::CompareNoCase_wchar_t_const__const
test eax, eax
jne 0x1005f3c9
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x1ac]
mov ecx, dword [ecx + 0x698]
call sym.UserAndPayClient.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____thiscall_Talk2Svr::CTalk2Svr::GetLogPathW_void_
mov byte [ebp - 4], 1
push 0x1014f7e4
lea ecx, [ebp - 0x28]
call fcn.1001a390
test eax, eax
jne 0x1005f2df
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.10022b70
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdc]
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CDuiString::destructor_void_
jmp 0x1005f86f
lea ecx, [ebp - 0x28]
call fcn.100226d0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x1b4], eax
mov edx, dword [ebp - 0x1b4]
and edx, 0x10
je 0x1005f320
push 1
push 0
push 0
lea ecx, [ebp - 0x28]
call fcn.100226d0
push eax
push 0x1014f7e8
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x1005f3b8
push str.__select_
lea ecx, [ebp - 0x40]
call fcn.10022620
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
call fcn.100226d0
push eax
lea ecx, [ebp - 0x40]
call fcn.10018620
mov dword [ebp - 0x1fc], 0
push 0x38
push 0
lea eax, [ebp - 0x1f8]
push eax
call fcn.100db6b0
add esp, 0xc
mov dword [ebp - 0x1fc], 0x3c
mov dword [ebp - 0x1ec], str.explorer
lea ecx, [ebp - 0x40]
call fcn.100226d0
mov dword [ebp - 0x1e8], eax
mov dword [ebp - 0x1f0], 0x1014f820
mov dword [ebp - 0x1e0], 0xa
mov dword [ebp - 0x1e4], 0
lea ecx, [ebp - 0x1fc]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x40]
call fcn.10022b70
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.10022b70
jmp 0x1005f85d
push str.CopyrightNotice
lea ecx, [ebp - 0xdc]
call sym.UserAndPayClient.dll_public:_int___thiscall_xx_DuiLib::CDuiString::CompareNoCase_wchar_t_const__const
test eax, eax
jne 0x1005f3fb
push 0
push 0
push 0
push 4
mov edx, dword [ebp - 0x1ac]
mov ecx, dword [edx + 0x698]
call sym.UserAndPayClient.dll_public:_int___thiscall_Talk2Svr::CTalk2Svr::MessageWndUI_enum_Talk2Svr::CTalk2Svr::MessageBoxUI__bool__wchar_t___bool_
jmp 0x1005f85d
push str.Help
lea ecx, [ebp - 0xdc]
call sym.UserAndPayClient.dll_public:_int___thiscall_xx_DuiLib::CDuiString::CompareNoCase_wchar_t_const__const
test eax, eax
jne 0x1005f43f
push 1
push 0
push 0
mov eax, dword [ebp - 0x1ac]
mov ecx, dword [eax + 0x698]
add ecx, 0x244
call fcn.100226d0
push eax
push 0x1014f858
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x1005f85d
push 0x1014f864
lea ecx, [ebp - 0xdc]
call sym.UserAndPayClient.dll_public:_int___thiscall_xx_DuiLib::CDuiString::CompareNoCase_wchar_t_const__const
test eax, eax
jne 0x1005f4cf
mov ecx, dword [ebp - 0x1ac]
mov edx, dword [ecx + 0x698]
add edx, 0x168
push edx
lea eax, [ebp - 0x10c]
push eax
call fcn.1003c5e0
add esp, 8
mov dword [ebp - 0x1b8], eax
mov ecx, dword [ebp - 0x1b8]
call fcn.10021de0
push eax
push str.strWebSite:_s_n
call fcn.1001f8a0
add esp, 8
lea ecx, [ebp - 0x10c]
call fcn.10022960
push 1
push 0
push 0
mov ecx, dword [ebp - 0x1ac]
mov ecx, dword [ecx + 0x698]
add ecx, 0x168
call fcn.100226d0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x1005f85d
push str.AboutSoftare
lea ecx, [ebp - 0xdc]
call sym.UserAndPayClient.dll_public:_int___thiscall_xx_DuiLib::CDuiString::CompareNoCase_wchar_t_const__const
test eax, eax
jne 0x1005f501
push 0
push 0
push 0
push 3
mov edx, dword [ebp - 0x1ac]
mov ecx, dword [edx + 0x698]
call sym.UserAndPayClient.dll_public:_int___thiscall_Talk2Svr::CTalk2Svr::MessageWndUI_enum_Talk2Svr::CTalk2Svr::MessageBoxUI__bool__wchar_t___bool_
jmp 0x1005f85d
push str.QQService
lea ecx, [ebp - 0xdc]
call sym.UserAndPayClient.dll_public:_int___thiscall_xx_DuiLib::CDuiString::CompareNoCase_wchar_t_const__const
test eax, eax
jne 0x1005f52b
mov eax, dword [ebp - 0x1ac]
mov ecx, dword [eax + 0x698]
call sym.UserAndPayClient.dll_public:_void___thiscall_Talk2Svr::CTalk2Svr::GotoQQ_void_
jmp 0x1005f85d
push str.btn_quit
lea ecx, [ebp - 0xdc]
call sym.UserAndPayClient.dll_public:_int___thiscall_xx_DuiLib::CDuiString::CompareNoCase_wchar_t_const__const
test eax, eax
jne 0x1005f58b
lea ecx, [ebp - 0xf4]
call fcn.10021e90
mov byte [ebp - 4], 3
push 0
push 0
lea ecx, [ebp - 0xf4]
push ecx
mov edx, dword [ebp - 0x1ac]
mov ecx, dword [edx + 0x698]
call sym.UserAndPayClient.dll_public:_bool___thiscall_Talk2Svr::CTalk2Svr::SignOut_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____int___bool_
push 1
mov ecx, dword [ebp - 0x1ac]
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CWindowWnd::Close_unsigned_int_
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xf4]
call fcn.10022960
jmp 0x1005f85d
push str.CutPicShow
lea ecx, [ebp - 0xdc]
call sym.UserAndPayClient.dll_public:_int___thiscall_xx_DuiLib::CDuiString::CompareNoCase_wchar_t_const__const
test eax, eax
jne 0x1005f63d
mov eax, dword [ebp - 0x1ac]
cmp dword [eax + 0x7c4], 0
je 0x1005f5d6
push 1
mov ecx, dword [ebp - 0x1ac]
mov edx, dword [ecx + 0x7c4]
mov eax, dword [ebp - 0x1ac]
mov edx, dword [edx]
mov ecx, dword [eax + 0x7c4]
mov eax, dword [edx + 0x104]
call eax
mov ecx, dword [ebp - 0x1ac]
cmp dword [ecx + 0x7c0], 0
je 0x1005f609
push 0
mov edx, dword [ebp - 0x1ac]
mov eax, dword [edx + 0x7c0]
mov ecx, dword [ebp - 0x1ac]
mov edx, dword [eax]
mov ecx, dword [ecx + 0x7c0]
mov eax, dword [edx + 0x104]
call eax
push 0
push 1
push 0x1428
mov ecx, dword [ebp - 0x1ac]
mov edx, dword [ecx + 0x698]
mov eax, dword [edx + 0x2e4]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
push 1
mov ecx, dword [ebp - 0x1ac]
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CWindowWnd::Close_unsigned_int_
jmp 0x1005f85d
push str.CutPic
lea ecx, [ebp - 0xdc]
call sym.UserAndPayClient.dll_public:_int___thiscall_xx_DuiLib::CDuiString::CompareNoCase_wchar_t_const__const
test eax, eax
jne 0x1005f6ef
mov ecx, dword [ebp - 0x1ac]
cmp dword [ecx + 0x7c4], 0
je 0x1005f688
push 0
mov edx, dword [ebp - 0x1ac]
mov eax, dword [edx + 0x7c4]
mov ecx, dword [ebp - 0x1ac]
mov edx, dword [eax]
mov ecx, dword [ecx + 0x7c4]
mov eax, dword [edx + 0x104]
call eax
mov ecx, dword [ebp - 0x1ac]
cmp dword [ecx + 0x7c0], 0
je 0x1005f6bb
push 1
mov edx, dword [ebp - 0x1ac]
mov eax, dword [edx + 0x7c0]
mov ecx, dword [ebp - 0x1ac]
mov edx, dword [eax]
mov ecx, dword [ecx + 0x7c0]
mov eax, dword [edx + 0x104]
call eax
push 0
push 0
push 0x1428
mov ecx, dword [ebp - 0x1ac]
mov edx, dword [ecx + 0x698]
mov eax, dword [edx + 0x2e4]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
push 1
mov ecx, dword [ebp - 0x1ac]
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CWindowWnd::Close_unsigned_int_
jmp 0x1005f85d
push str.Kjzq
lea ecx, [ebp - 0xdc]
call sym.UserAndPayClient.dll_public:_int___thiscall_xx_DuiLib::CDuiString::CompareNoCase_wchar_t_const__const
test eax, eax
jne 0x1005f7bc
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x108]
mov dword [ebp - 0x1b0], edx
push 0xffffffffffffffff
mov eax, dword [ebp - 0x1b0]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x1b0]
mov eax, dword [edx + 0x188]
call eax
push eax
lea ecx, [ebp - 0x1a8]
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CDuiString::constructor_wchar_t_const___int_
mov byte [ebp - 4], 4
push 0
push str.op2.png
lea ecx, [ebp - 0x1a8]
call sym.UserAndPayClient.dll_public:_int___thiscall_xx_DuiLib::CDuiString::Find_wchar_t_const___int_const
cmp eax, 0xffffffff
je 0x1005f779
push 0
push 0
push 0x1428
mov ecx, dword [ebp - 0x1ac]
mov edx, dword [ecx + 0x698]
mov eax, dword [edx + 0x2e4]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x1005f79b
push 0
push 1
push 0x1428
mov ecx, dword [ebp - 0x1ac]
mov edx, dword [ecx + 0x698]
mov eax, dword [edx + 0x2e4]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
push 1
mov ecx, dword [ebp - 0x1ac]
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CWindowWnd::Close_unsigned_int_
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1a8]
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CDuiString::destructor_void_
jmp 0x1005f85d
push str.Copy
lea ecx, [ebp - 0xdc]
call sym.UserAndPayClient.dll_public:_int___thiscall_xx_DuiLib::CDuiString::CompareNoCase_wchar_t_const__const
test eax, eax
jne 0x1005f85d
mov ecx, dword [ebp - 0x1ac]
mov edx, dword [ecx + 0x698]
mov eax, dword [edx + 0x34]
push eax
push 0x1014f91c
lea ecx, [ebp - 0x58]
push ecx
call fcn.1003d290
add esp, 0xc
mov byte [ebp - 4], 5
lea edx, [ebp - 0x58]
push edx
lea eax, [ebp - 0x124]
push eax
call fcn.1003c5e0
add esp, 8
mov dword [ebp - 0x1bc], eax
mov ecx, dword [ebp - 0x1bc]
mov dword [ebp - 0x1c0], ecx
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x58]
call fcn.10018830
push eax
mov ecx, dword [ebp - 0x1c0]
call fcn.10021de0
push eax
mov ecx, dword [ebp - 0x1ac]
call fcn.1002f1e0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x124]
call fcn.10022960
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x58]
call fcn.10022b70
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdc]
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CDuiString::destructor_void_
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100ddfee
mov esp, ebp
pop ebp
ret 4