Function at 0x100641e0
Capabilities:
Create process on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101243b4
mov eax, dword fs:[0]
push eax
sub esp, 0x1f0
mov eax, dword [0x1019742c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1ac], ecx
lea eax, [ebp - 0xdc]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x108]
mov eax, dword [ebp + 8]
mov edx, dword [edx]
mov ecx, dword [eax + 0x108]
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0
push str.btn_menu_buyvip
lea ecx, [ebp - 0xdc]
call sym.UserAndPayClient.dll_public:_int___thiscall_xx_DuiLib::CDuiString::CompareNoCase_wchar_t_const__const
test eax, eax
jne 0x100642c0
mov ecx, dword [ebp - 0x1ac]
mov ecx, dword [ecx + 0x698]
call sym.UserAndPayClient.dll_public:_bool___thiscall_Talk2Svr::CTalk2Svr::CheckUserIsVip_void_
movzx edx, al
test edx, edx
je 0x10064285
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x1ac]
mov ecx, dword [eax + 0x698]
call sym.UserAndPayClient.dll_public:_int___thiscall_Talk2Svr::CTalk2Svr::ShowPayWnd_int__char___char___char___char___bool__enum_PayType_
jmp 0x100642a4
push 0
push 0
push 0
push 0
push 0
push 0
push 1
mov ecx, dword [ebp - 0x1ac]
mov ecx, dword [ecx + 0x698]
call sym.UserAndPayClient.dll_public:_int___thiscall_Talk2Svr::CTalk2Svr::ShowPayWnd_int__char___char___char___char___bool__enum_PayType_
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdc]
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CDuiString::destructor_void_
jmp 0x1006492f
push str.ShowMachinecode
lea ecx, [ebp - 0xdc]
call sym.UserAndPayClient.dll_public:_int___thiscall_xx_DuiLib::CDuiString::CompareNoCase_wchar_t_const__const
test eax, eax
jne 0x100642f2
push 0
push 0
push 0
push 0
mov edx, dword [ebp - 0x1ac]
mov ecx, dword [edx + 0x698]
call sym.UserAndPayClient.dll_public:_int___thiscall_Talk2Svr::CTalk2Svr::MessageWndUI_enum_Talk2Svr::CTalk2Svr::MessageBoxUI__bool__wchar_t___bool_
jmp 0x1006491d
push str.Checkforupdates
lea ecx, [ebp - 0xdc]
call sym.UserAndPayClient.dll_public:_int___thiscall_xx_DuiLib::CDuiString::CompareNoCase_wchar_t_const__const
test eax, eax
jne 0x1006433a
push 0
push 0
push 0x5f8
mov eax, dword [ebp - 0x1ac]
mov ecx, dword [eax + 0x698]
mov edx, dword [ecx + 0x3e0]
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
push 0
mov ecx, dword [ebp - 0x1ac]
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CWindowWnd::Close_unsigned_int_
jmp 0x1006491d
push str.ExportLog
lea ecx, [ebp - 0xdc]
call sym.UserAndPayClient.dll_public:_int___thiscall_xx_DuiLib::CDuiString::CompareNoCase_wchar_t_const__const
test eax, eax
jne 0x10064489
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x1ac]
mov ecx, dword [ecx + 0x698]
call sym.UserAndPayClient.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____thiscall_Talk2Svr::CTalk2Svr::GetLogPathW_void_
mov byte [ebp - 4], 1
push 0x10154c2c
lea ecx, [ebp - 0x28]
call fcn.1002b1f0
test eax, eax
jne 0x1006439f
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.10023ac0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdc]
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CDuiString::destructor_void_
jmp 0x1006492f
lea ecx, [ebp - 0x28]
call fcn.10023620
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x1b4], eax
mov edx, dword [ebp - 0x1b4]
and edx, 0x10
je 0x100643e0
push 1
push 0
push 0
lea ecx, [ebp - 0x28]
call fcn.10023620
push eax
push 0x10154c30
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x10064478
push str.__select_
lea ecx, [ebp - 0x40]
call fcn.1001fdb0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
call fcn.10023620
push eax
lea ecx, [ebp - 0x40]
call fcn.100192f0
mov dword [ebp - 0x1fc], 0
push 0x38
push 0
lea eax, [ebp - 0x1f8]
push eax
call fcn.100e0740
add esp, 0xc
mov dword [ebp - 0x1fc], 0x3c
mov dword [ebp - 0x1ec], str.explorer
lea ecx, [ebp - 0x40]
call fcn.10023620
mov dword [ebp - 0x1e8], eax
mov dword [ebp - 0x1f0], 0x10154c68
mov dword [ebp - 0x1e0], 0xa
mov dword [ebp - 0x1e4], 0
lea ecx, [ebp - 0x1fc]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x40]
call fcn.10023ac0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.10023ac0
jmp 0x1006491d
push str.CopyrightNotice
lea ecx, [ebp - 0xdc]
call sym.UserAndPayClient.dll_public:_int___thiscall_xx_DuiLib::CDuiString::CompareNoCase_wchar_t_const__const
test eax, eax
jne 0x100644bb
push 0
push 0
push 0
push 4
mov edx, dword [ebp - 0x1ac]
mov ecx, dword [edx + 0x698]
call sym.UserAndPayClient.dll_public:_int___thiscall_Talk2Svr::CTalk2Svr::MessageWndUI_enum_Talk2Svr::CTalk2Svr::MessageBoxUI__bool__wchar_t___bool_
jmp 0x1006491d
push str.Help
lea ecx, [ebp - 0xdc]
call sym.UserAndPayClient.dll_public:_int___thiscall_xx_DuiLib::CDuiString::CompareNoCase_wchar_t_const__const
test eax, eax
jne 0x100644ff
push 1
push 0
push 0
mov eax, dword [ebp - 0x1ac]
mov ecx, dword [eax + 0x698]
add ecx, 0x250
call fcn.10023620
push eax
push 0x10154ca0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x1006491d
push 0x10154cac
lea ecx, [ebp - 0xdc]
call sym.UserAndPayClient.dll_public:_int___thiscall_xx_DuiLib::CDuiString::CompareNoCase_wchar_t_const__const
test eax, eax
jne 0x1006458f
mov ecx, dword [ebp - 0x1ac]
mov edx, dword [ecx + 0x698]
add edx, 0x174
push edx
lea eax, [ebp - 0x10c]
push eax
call fcn.1003eb00
add esp, 8
mov dword [ebp - 0x1b8], eax
mov ecx, dword [ebp - 0x1b8]
call fcn.10023550
push eax
push str.strWebSite:_s_n
call fcn.10020a00
add esp, 8
lea ecx, [ebp - 0x10c]
call fcn.100238b0
push 1
push 0
push 0
mov ecx, dword [ebp - 0x1ac]
mov ecx, dword [ecx + 0x698]
add ecx, 0x174
call fcn.10023620
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x1006491d
push str.AboutSoftare
lea ecx, [ebp - 0xdc]
call sym.UserAndPayClient.dll_public:_int___thiscall_xx_DuiLib::CDuiString::CompareNoCase_wchar_t_const__const
test eax, eax
jne 0x100645c1
push 0
push 0
push 0
push 3
mov edx, dword [ebp - 0x1ac]
mov ecx, dword [edx + 0x698]
call sym.UserAndPayClient.dll_public:_int___thiscall_Talk2Svr::CTalk2Svr::MessageWndUI_enum_Talk2Svr::CTalk2Svr::MessageBoxUI__bool__wchar_t___bool_
jmp 0x1006491d
push str.QQService
lea ecx, [ebp - 0xdc]
call sym.UserAndPayClient.dll_public:_int___thiscall_xx_DuiLib::CDuiString::CompareNoCase_wchar_t_const__const
test eax, eax
jne 0x100645eb
mov eax, dword [ebp - 0x1ac]
mov ecx, dword [eax + 0x698]
call sym.UserAndPayClient.dll_public:_void___thiscall_Talk2Svr::CTalk2Svr::GotoQQ_void_
jmp 0x1006491d
push str.btn_quit
lea ecx, [ebp - 0xdc]
call sym.UserAndPayClient.dll_public:_int___thiscall_xx_DuiLib::CDuiString::CompareNoCase_wchar_t_const__const
test eax, eax
jne 0x1006464b
lea ecx, [ebp - 0xf4]
call fcn.10023590
mov byte [ebp - 4], 3
push 0
push 0
lea ecx, [ebp - 0xf4]
push ecx
mov edx, dword [ebp - 0x1ac]
mov ecx, dword [edx + 0x698]
call sym.UserAndPayClient.dll_public:_bool___thiscall_Talk2Svr::CTalk2Svr::SignOut_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____int___bool_
push 1
mov ecx, dword [ebp - 0x1ac]
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CWindowWnd::Close_unsigned_int_
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xf4]
call fcn.100238b0
jmp 0x1006491d
push str.CutPicShow
lea ecx, [ebp - 0xdc]
call sym.UserAndPayClient.dll_public:_int___thiscall_xx_DuiLib::CDuiString::CompareNoCase_wchar_t_const__const
test eax, eax
jne 0x100646fd
mov eax, dword [ebp - 0x1ac]
cmp dword [eax + 0x7c4], 0
je 0x10064696
push 1
mov ecx, dword [ebp - 0x1ac]
mov edx, dword [ecx + 0x7c4]
mov eax, dword [ebp - 0x1ac]
mov edx, dword [edx]
mov ecx, dword [eax + 0x7c4]
mov eax, dword [edx + 0x104]
call eax
mov ecx, dword [ebp - 0x1ac]
cmp dword [ecx + 0x7c0], 0
je 0x100646c9
push 0
mov edx, dword [ebp - 0x1ac]
mov eax, dword [edx + 0x7c0]
mov ecx, dword [ebp - 0x1ac]
mov edx, dword [eax]
mov ecx, dword [ecx + 0x7c0]
mov eax, dword [edx + 0x104]
call eax
push 0
push 1
push 0x1428
mov ecx, dword [ebp - 0x1ac]
mov edx, dword [ecx + 0x698]
mov eax, dword [edx + 0x3e0]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
push 1
mov ecx, dword [ebp - 0x1ac]
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CWindowWnd::Close_unsigned_int_
jmp 0x1006491d
push str.CutPic
lea ecx, [ebp - 0xdc]
call sym.UserAndPayClient.dll_public:_int___thiscall_xx_DuiLib::CDuiString::CompareNoCase_wchar_t_const__const
test eax, eax
jne 0x100647af
mov ecx, dword [ebp - 0x1ac]
cmp dword [ecx + 0x7c4], 0
je 0x10064748
push 0
mov edx, dword [ebp - 0x1ac]
mov eax, dword [edx + 0x7c4]
mov ecx, dword [ebp - 0x1ac]
mov edx, dword [eax]
mov ecx, dword [ecx + 0x7c4]
mov eax, dword [edx + 0x104]
call eax
mov ecx, dword [ebp - 0x1ac]
cmp dword [ecx + 0x7c0], 0
je 0x1006477b
push 1
mov edx, dword [ebp - 0x1ac]
mov eax, dword [edx + 0x7c0]
mov ecx, dword [ebp - 0x1ac]
mov edx, dword [eax]
mov ecx, dword [ecx + 0x7c0]
mov eax, dword [edx + 0x104]
call eax
push 0
push 0
push 0x1428
mov ecx, dword [ebp - 0x1ac]
mov edx, dword [ecx + 0x698]
mov eax, dword [edx + 0x3e0]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
push 1
mov ecx, dword [ebp - 0x1ac]
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CWindowWnd::Close_unsigned_int_
jmp 0x1006491d
push str.Kjzq
lea ecx, [ebp - 0xdc]
call sym.UserAndPayClient.dll_public:_int___thiscall_xx_DuiLib::CDuiString::CompareNoCase_wchar_t_const__const
test eax, eax
jne 0x1006487c
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x108]
mov dword [ebp - 0x1b0], edx
push 0xffffffffffffffff
mov eax, dword [ebp - 0x1b0]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x1b0]
mov eax, dword [edx + 0x188]
call eax
push eax
lea ecx, [ebp - 0x1a8]
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CDuiString::constructor_wchar_t_const___int_
mov byte [ebp - 4], 4
push 0
push str.op2.png
lea ecx, [ebp - 0x1a8]
call sym.UserAndPayClient.dll_public:_int___thiscall_xx_DuiLib::CDuiString::Find_wchar_t_const___int_const
cmp eax, 0xffffffff
je 0x10064839
push 0
push 0
push 0x1428
mov ecx, dword [ebp - 0x1ac]
mov edx, dword [ecx + 0x698]
mov eax, dword [edx + 0x3e0]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x1006485b
push 0
push 1
push 0x1428
mov ecx, dword [ebp - 0x1ac]
mov edx, dword [ecx + 0x698]
mov eax, dword [edx + 0x3e0]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
push 1
mov ecx, dword [ebp - 0x1ac]
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CWindowWnd::Close_unsigned_int_
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1a8]
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CDuiString::destructor_void_
jmp 0x1006491d
push str.Copy
lea ecx, [ebp - 0xdc]
call sym.UserAndPayClient.dll_public:_int___thiscall_xx_DuiLib::CDuiString::CompareNoCase_wchar_t_const__const
test eax, eax
jne 0x1006491d
mov ecx, dword [ebp - 0x1ac]
mov edx, dword [ecx + 0x698]
mov eax, dword [edx + 0x34]
push eax
push 0x10154d64
lea ecx, [ebp - 0x58]
push ecx
call fcn.1003f7b0
add esp, 0xc
mov byte [ebp - 4], 5
lea edx, [ebp - 0x58]
push edx
lea eax, [ebp - 0x124]
push eax
call fcn.1003eb00
add esp, 8
mov dword [ebp - 0x1bc], eax
mov ecx, dword [ebp - 0x1bc]
mov dword [ebp - 0x1c0], ecx
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x58]
call fcn.10019500
push eax
mov ecx, dword [ebp - 0x1c0]
call fcn.10023550
push eax
mov ecx, dword [ebp - 0x1ac]
call fcn.100316f0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x124]
call fcn.100238b0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x58]
call fcn.10023ac0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdc]
call sym.UserAndPayClient.dll_public:_void___thiscall_xx_DuiLib::CDuiString::destructor_void_
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100e3069
mov esp, ebp
pop ebp
ret 4