Function at 0x414c93
Capabilities:
Create process on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x43c360
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
push ebp
mov ebp, dword [esp + 0x4c]
push esi
push edi
mov edi, dword [esp + 0x58]
mov eax, edi
mov esi, ecx
shl eax, 0x10
or eax, ebp
mov ecx, 0x44a8dc
push eax
push 0
push 0x202
call fcn.00435e90
mov ecx, 0x44a8dc
call fcn.00435e00
test eax, eax
jne case.default.0x414d4c
mov ebx, dword [esi + 0x34]
push edi
push ebp
push 0x202
mov ecx, esi
mov dword [esi + 0x38], eax
mov dword [esi + 0x34], eax
call fcn.00415b20
test al, al
jne case.default.0x414d4c
call dword [sym.imp.USER32.dll_ReleaseCapture]
push edi
push ebp
mov ecx, esi
call fcn.00415630
cmp eax, 0xffffffff
je case.default.0x414d4c
mov eax, dword [esi + 0x14]
sub eax, 0
je 0x4151fd
sub eax, 2
jne case.default.0x414d4c
mov eax, dword [esi + 0x18]
mov ecx, esi
push eax
call fcn.00415710
cmp eax, 3
je case.default.0x414d4c
mov ecx, dword [esi + 0x18]
push ecx
mov ecx, esi
call fcn.00415710
cmp eax, 2
jne case.default.0x414d4c
mov ecx, dword [esi + 4]
push 3
mov edx, dword [ecx]
call dword [edx + 8]
mov eax, dword [esi + 0x18]
xor ebx, ebx
push ebx
push eax
mov ecx, esi
call fcn.00415850
mov eax, dword [esi + 0x18]
add eax, 0xffffff9b
cmp eax, 0x1e
ja case.default.0x414d4c
jmp dword [eax*4 + 0x415298]
mov ecx, 0x44a7b0
call fcn.0040d9b0
jmp case.default.0x414d4c
lea edx, [esp + 0x54]
mov ecx, 0x44a7b0
push edx
push 1
push 0x12
mov byte [esp + 0x60], 0x65
call fcn.0040d880
jmp case.default.0x414d4c
push 6
call fcn.00421a20
mov ecx, eax
call sub.MFC42.DLL_CWnd::ShowWindow
jmp case.default.0x414d4c
call fcn.00421a20
mov eax, dword [eax + 0x20]
push ebx
push ebx
push 0x10
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
jmp case.default.0x414d4c
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 1
push 1
call edi
push eax
push ebx
call edi
push eax
push ebx
push ebx
call fcn.00421a20
mov ecx, eax
call sub.MFC42.DLL_CWnd::MoveWindow
push ebx
push 0x66
mov ecx, esi
call fcn.004158f0
push 1
push 0x67
mov ecx, esi
call fcn.004158f0
jmp case.default.0x414d4c
push 1
push 0x23a
push 0x2ee
push ebx
push ebx
call fcn.00421a20
mov ecx, eax
call sub.MFC42.DLL_CWnd::MoveWindow
push ebx
call fcn.00421a20
mov ecx, eax
call sub.MFC42.DLL_CWnd::CenterWindow
push 1
push 0x66
mov ecx, esi
call fcn.004158f0
push ebx
push 0x67
mov ecx, esi
call fcn.004158f0
jmp case.default.0x414d4c
call fcn.00421a20
mov ecx, dword [eax + 0x20]
push ebx
push ebx
push 0x49d
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
jmp case.default.0x414d4c
call fcn.00421a20
mov edx, dword [eax + 0x20]
push ebx
push ebx
push 0x494
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
jmp case.default.0x414d4c
push str.resda.wav
mov ecx, 0x44a7e8
call fcn.0041e060
call fcn.00421a20
cmp eax, ebx
jne 0x414e76
xor eax, eax
jmp 0x414e79
mov eax, dword [eax + 0x20]
push 1
push ebx
push ebx
push str.http:__jump.qq.com_gamehelp47
push ebx
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp case.default.0x414d4c
call fcn.00421a20
mov eax, dword [eax + 0x20]
push edi
push ebp
push 0x477
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
jmp case.default.0x414d4c
lea ecx, [esp + 0x54]
mov byte [esp + 0x54], 0x65
push ecx
push 1
push 0x12
mov ecx, 0x44a7b0
call fcn.0040d880
jmp case.default.0x414d4c
call fcn.00421a20
mov edx, dword [eax + 0x20]
push ebx
push 3
push 0x480
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
push ebx
push 0x7f
mov ecx, esi
mov dword [0x44a9f4], ebx
call fcn.004158f0
jmp case.default.0x414d4c
cmp dword [0x4552f4], ebx
jne 0x414f11
push 3
push 0x448a08
mov ecx, 0x44a7e8
call fcn.00420f50
jmp case.default.0x414d4c
cmp dword [0x44a9dc], ebx
jne 0x414f2f
push 3
push 0x4489ec
mov ecx, 0x44a7e8
call fcn.00420f50
jmp case.default.0x414d4c
call fcn.00421a20
mov eax, dword [eax + 0x20]
push ebx
push 1
push 0x488
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
jmp case.default.0x414d4c
call fcn.00421a20
mov ecx, dword [eax + 0x20]
push ebx
push ebx
push 0x488
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
jmp case.default.0x414d4c
call fcn.00421a20
mov edx, dword [eax + 0x20]
push ebx
push ebx
push 0x49d
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
jmp case.default.0x414d4c
call fcn.00421a20
mov eax, dword [eax + 0x20]
push ebx
push ebx
push 0x498
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
jmp case.default.0x414d4c
mov edx, dword [0x44a95c]
xor ecx, ecx
cmp edx, ebx
sete cl
mov dword [0x44a95c], ecx
mov ecx, 0x44a7e8
call fcn.0041dd50
push str.resda.wav
mov ecx, 0x44a7e8
call fcn.0041e060
jmp 0x415277
call fcn.00421a20
mov edx, dword [eax + 0x20]
push ebx
push ebx
push 0x47d
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
jmp case.default.0x414d4c
push ebx
push 0x74
mov ecx, esi
call fcn.004158f0
mov ecx, 0x44a7e8
call fcn.0041dc00
mov edi, eax
cmp edi, ebx
je case.default.0x414d4c
call fcn.00421a20
mov eax, dword [eax + 0x20]
push ebx
push 3
push 0x480
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push ebx
push 0x7f
mov ecx, esi
mov dword [0x44a9f4], ebx
call fcn.004158f0
push 0x4489e8
push 1
push 1
mov ecx, 0x44a7b0
call fcn.0040d880
mov ecx, 0x44a7e8
mov dword [edi + 0x470], 1
call fcn.0041dc80
push str.resda.wav
mov ecx, 0x44a7e8
call fcn.0041e060
jmp 0x415277
call fcn.00421a20
mov ecx, dword [eax + 0x20]
push ebx
push 1
push 0x478
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
jmp case.default.0x414d4c
call fcn.00421a20
mov edx, dword [eax + 0x20]
push ebx
push 2
push 0x478
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
jmp case.default.0x414d4c
call fcn.00421a20
mov eax, dword [eax + 0x20]
push ebx
push 3
push 0x478
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
jmp case.default.0x414d4c
call fcn.00421a20
mov ecx, dword [eax + 0x20]
push ebx
push ebx
push 0x478
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
jmp case.default.0x414d4c
call fcn.00421a20
mov edx, dword [eax + 0x20]
push ebx
push ebx
push 0x47b
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
jmp case.default.0x414d4c
call fcn.00421a20
mov eax, dword [eax + 0x20]
push ebx
push ebx
push 0x47c
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
jmp case.default.0x414d4c
call fcn.00421a20
mov ecx, dword [eax + 0x20]
push ebx
push ebx
push 0x47f
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
jmp case.default.0x414d4c
xor edx, edx
lea ecx, [esp + 0x18]
mov dword [esp + 0x54], edx
mov dword [esp + 0x54], 0x12
mov dword [esp + 0x58], edx
mov dword [esp + 0x58], 1
call fcn.0042cf60
lea eax, [esp + 0x54]
push 3
push eax
push 0x12
push 1
lea ecx, [esp + 0x28]
mov dword [esp + 0x58], ebx
call fcn.0042cfe0
mov ecx, dword [esi + 4]
lea eax, [esp + 0x18]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
lea ecx, [esp + 0x18]
mov dword [esp + 0x48], 0xffffffff
call fcn.0042cfa0
jmp case.default.0x414d4c
xor ecx, ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x10], 0x12
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x2c]
mov dword [esp + 0x14], ebx
call fcn.0042cf60
lea edx, [esp + 0x10]
push 3
push edx
push 0x12
push 1
lea ecx, [esp + 0x3c]
mov dword [esp + 0x58], 1
call fcn.0042cfe0
mov ecx, dword [esi + 4]
lea edx, [esp + 0x2c]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [esp + 0x2c]
mov dword [esp + 0x48], 0xffffffff
call fcn.0042cfa0
jmp case.default.0x414d4c
mov esi, dword [esi + 0x2c]
cmp esi, ebx
je case.default.0x414d4c
push 1
mov ecx, esi
call fcn.0042ea20
jmp case.default.0x414d4c
mov eax, dword [esi + 0x18]
cmp eax, 0x32
jl case.default.0x414d4c
cmp eax, 0x4f
jge case.default.0x414d4c
mov eax, dword [0x44a9dc]
test eax, eax
je case.default.0x414d4c
mov ecx, 0x44a7e8
call fcn.0041dc00
test eax, eax
je case.default.0x414d4c
mov cl, byte [eax + 0x1b8]
test cl, cl
je case.default.0x414d4c
test ebx, ebx
je 0x415263
mov ecx, dword [esi + 0x18]
cmp ebx, ecx
je 0x415263
mov edx, ebx
jl 0x41523c
mov edx, ecx
cmp ebx, ecx
jle 0x415242
mov ecx, ebx
cmp edx, ecx
jg 0x415277
sub ecx, edx
lea eax, [eax + edx*8 - 0x114]
inc ecx
mov edi, dword [eax]
xor edx, edx
test edi, edi
sete dl
mov dword [eax], edx
add eax, 8
dec ecx
jne 0x415250
jmp 0x415277
mov ecx, dword [esi + 0x18]
xor edx, edx
lea eax, [eax + ecx*8 - 0x114]
cmp dword [eax], 0
sete dl
mov dword [eax], edx
push 3
mov ecx, 0x44a7e0
call fcn.0042ced0
mov ecx, dword [esp + 0x40]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x3c
ret 0xc