Function at 0x40409b
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
push str.SearchKeyword
push edi
call fcn.004d6cd4
pop ecx
pop ecx
test eax, eax
jne 0x4040d1
cmp esi, 1
je 0x4040c8
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4040c8
xor ecx, ecx
mov word [eax], cx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.GetUserInfo
push edi
call fcn.004d6cd4
pop ecx
pop ecx
test eax, eax
jne 0x4040f6
cmp esi, 1
jne 0x4040bc
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov ecx, dword [eax]
call fcn.004030a3
jmp 0x4040ca
push str.GetChannel
push edi
call fcn.004d6cd4
pop ecx
pop ecx
test eax, eax
jne 0x404115
test esi, esi
jne 0x4040bc
mov ecx, dword [ebp + 0xc]
call fcn.004032f7
jmp 0x4040ca
push str.GetRealChannel
push edi
call fcn.004d6cd4
pop ecx
pop ecx
test eax, eax
jne 0x404134
test esi, esi
jne 0x4040bc
mov ecx, dword [ebp + 0xc]
call fcn.004032f7
jmp 0x4040ca
push 0x50df34
push edi
call fcn.004d6cd4
pop ecx
pop ecx
test eax, eax
jne 0x404160
cmp esi, 1
jne 0x4040bc
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov ecx, dword [eax]
call fcn.00403340
jmp 0x4040ca
push str.OpenDialog
push edi
call fcn.004d6cd4
pop ecx
pop ecx
test eax, eax
jne 0x404196
cmp esi, 3
jne 0x4040bc
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4040c8
push 0xb
pop ecx
mov word [eax], cx
xor ecx, ecx
mov word [eax + 8], cx
jmp 0x4040c8
push str.OpenClassifyGame
push edi
call fcn.004d6cd4
pop ecx
pop ecx
test eax, eax
jne 0x4041b1
cmp esi, 2
je 0x40417a
cmp esi, 1
jmp 0x404174
push str.GetSoftWareVersion
push edi
call fcn.004d6cd4
pop ecx
pop ecx
test eax, eax
jne 0x4041f0
test esi, esi
jne 0x4040bc
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x4041db
mov eax, 0x80070057
jmp 0x4040ca
movss xmm0, dword [0x5483cc]
push 4
pop ecx
movss dword [eax + 8], xmm0
jmp 0x4040c5
push str.CloseTab
push edi
call fcn.004d6cd4
pop ecx
pop ecx
test eax, eax
jne 0x404208
test esi, esi
jmp 0x4040ba
push str.OpenWindow
push edi
call fcn.004d6cd4
pop ecx
pop ecx
test eax, eax
je 0x4040bc
push str.OpenLoginWindow
push edi
call fcn.004d6cd4
pop ecx
pop ecx
test eax, eax
jne 0x404261
push dword [ebp + 0xc]
cmp esi, 2
jne 0x404241
mov edx, dword [ebp + 8]
push eax
push dword [edx + 4]
mov edx, dword [edx]
jmp 0x404254
cmp esi, 3
jne 0x40424e
mov edx, dword [ebp + 8]
push dword [edx + 8]
jmp 0x40423a
xor edi, edi
xor edx, edx
push edi
push edi
call fcn.00427499
add esp, 0xc
jmp 0x4040c8
push str.OpenLoginWindowFromHwnd
push edi
call fcn.004d6cd4
pop ecx
pop ecx
test eax, eax
jne 0x4042bd
cmp esi, 3
jne 0x40429b
mov eax, dword [ebp + 8]
push dword [eax]
mov esi, dword [eax + 8]
mov edi, dword [eax + 4]
call fcn.004d61c7
push 0
push esi
mov edx, edi
mov ecx, eax
call fcn.004276a1
add esp, 0xc
jmp 0x4040ca
cmp esi, 4
jne 0x4040bc
mov eax, dword [ebp + 8]
push dword [eax]
mov esi, dword [eax + 0xc]
mov edi, dword [eax + 8]
mov ebx, dword [eax + 4]
call fcn.004d61c7
push esi
push edi
mov edx, ebx
jmp 0x40428c
push str.OpenLoginWindowFromUserAccount
push edi
call fcn.004d6cd4
pop ecx
pop ecx
test eax, eax
jne 0x40431c
mov ebx, dword [ebp + 8]
xor edi, edi
cmp esi, 1
jne 0x4042e7
push dword [ebp + 0xc]
mov ecx, dword [ebx]
xor edx, edx
push edi
call fcn.0042785d
pop ecx
pop ecx
cmp esi, 2
jne 0x4042fc
push dword [ebp + 0xc]
mov edx, dword [ebx + 4]
mov ecx, dword [ebx]
push edi
call fcn.0042785d
pop ecx
pop ecx
cmp esi, 3
jne 0x4040c8
push dword [ebp + 0xc]
mov edx, dword [ebx + 4]
push dword [ebx + 8]
mov ecx, dword [ebx]
call fcn.0042785d
pop ecx
pop ecx
jmp 0x4040c8
push str.OpenOauthLoginWindow
push edi
call fcn.004d6cd4
pop ecx
pop ecx
test eax, eax
jne 0x404342
cmp esi, 1
jne 0x4040bc
xor ecx, ecx
call fcn.0043ec03
jmp 0x4040ca
push str.OauthLoginSuccess
push edi
call fcn.004d6cd4
pop ecx
pop ecx
test eax, eax
jne 0x404368
cmp esi, 1
jne 0x4040bc
xor ecx, ecx
call fcn.0043ec41
jmp 0x4040c8
push str.SignUrl
push edi
call fcn.004d6cd4
pop ecx
pop ecx
test eax, eax
jne 0x404394
cmp esi, 1
jne 0x4040bc
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov ecx, dword [eax]
call fcn.004033b0
jmp 0x4040ca
push str.GetGameStatus
push edi
call fcn.004d6cd4
pop ecx
pop ecx
test eax, eax
je 0x4040b7
push str.OpenUrlTips
push edi
call fcn.004d6cd4
pop ecx
pop ecx
test eax, eax
jne 0x4043c2
cmp esi, 5
jmp 0x4040ba
push 0x50e104
push edi
call fcn.004d6cd4
pop ecx
pop ecx
test eax, eax
jne 0x40441a
mov eax, dword [ebp + 8]
xor edi, edi
push 1
push edi
push dword [eax]
push str.IEXPLORE.EXE
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x4040c8
push 0xb
pop edx
mov word [ecx], dx
xor edx, edx
mov word [ecx + 8], dx
cmp eax, 0x20
jle 0x4040c8
or eax, 0xffffffff
mov word [ecx + 8], ax
jmp 0x4040c8
push str.OpenUrlByDefaultBrowser
push edi
call fcn.004d6cd4
pop ecx
pop ecx
test eax, eax
jne 0x404440
cmp esi, 1
jne 0x4040bc
mov eax, dword [ebp + 8]
xor edi, edi
push esi
push edi
push edi
push dword [eax]
jmp 0x4043e2
push str.SetRegisterUserInfo
push edi
call fcn.004d6cd4
pop ecx
pop ecx
test eax, eax
jne 0x40448b
cmp esi, 9
jne 0x4040bc
push dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edi, edi
push edi
push edi
push dword [ecx + 0x20]
mov edx, dword [ecx + 4]
push dword [ecx + 0x1c]
push dword [ecx + 0x18]
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push dword [ecx + 0xc]
push dword [ecx + 8]
mov ecx, dword [ecx]
call fcn.004037f0
add esp, 0x28
jmp 0x4040c8
push str.SetWebgameTabUserInfo
push edi
call fcn.004d6cd4
pop ecx
pop ecx
test eax, eax
jne 0x4044d7
cmp esi, 2
jne 0x4040bc
mov eax, dword [ebp + 8]
mov ecx, dword [0x5478e4]
push dword [eax + 4]
lea ecx, [ecx + 0x524]
push dword [eax]
call fcn.004b8762
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4040c8
push 0xb
pop ecx
mov word [eax], cx
or ecx, 0xffffffff
jmp 0x40418d
push str.StartWebgame
push edi
call fcn.004d6cd4
pop ecx
pop ecx
test eax, eax
jne 0x4044f5
mov ecx, dword [ebp + 0xc]
call fcn.00403911
jmp 0x4040ca
push str.ActiveTempAccount
push edi
call fcn.004d6cd4
pop ecx
pop ecx
test eax, eax
jne 0x404542
cmp esi, 0xb
jne 0x4040bc
mov eax, dword [ebp + 8]
push dword [ebp + 0xc]
push dword [eax + 0x28]
mov edx, dword [eax + 4]
push dword [eax + 0x24]
mov ecx, dword [eax]
push dword [eax + 0x20]
push dword [eax + 0x1c]
push dword [eax + 0x18]
push dword [eax + 0x14]
push dword [eax + 0x10]
push dword [eax + 0xc]
push dword [eax + 8]
call fcn.00403a97
add esp, 0x28
jmp 0x4040ca
push str.ActiveGameFromNewUser
push edi
call fcn.004d6cd4
pop ecx
pop ecx
test eax, eax
jne 0x404592
cmp esi, 0xc
jne 0x4040bc
mov eax, dword [ebp + 8]
push dword [ebp + 0xc]
push dword [eax + 0x2c]
mov edx, dword [eax + 4]
push dword [eax + 0x28]
mov ecx, dword [eax]
push dword [eax + 0x24]
push dword [eax + 0x20]
push dword [eax + 0x1c]
push dword [eax + 0x18]
push dword [eax + 0x14]
push dword [eax + 0x10]
push dword [eax + 0xc]
push dword [eax + 8]
call fcn.00403966
add esp, 0x2c
jmp 0x4040ca
push str.ActiveGameFromOldUser
push edi
call fcn.004d6cd4
pop ecx
pop ecx
test eax, eax
jne 0x4045dc
cmp esi, 0xc
jne 0x4040bc
mov eax, dword [ebp + 8]
push dword [ebp + 0xc]
push dword [eax + 0x2c]
mov edx, dword [eax + 4]
push dword [eax + 0x28]
mov ecx, dword [eax]
push dword [eax + 0x24]
push dword [eax + 0x20]
push dword [eax + 0x1c]
push dword [eax + 0x18]
push dword [eax + 0x14]
push dword [eax + 0x10]
push dword [eax + 0xc]
push dword [eax + 8]
call fcn.004039d8
jmp 0x40458a
push str.ClearTempUUID
push edi
call fcn.004d6cd4
pop ecx
pop ecx
test eax, eax
jne 0x4045f7
call fcn.0046ec6b
jmp 0x4040c8
push str.SetOldUserInfo
push edi
call fcn.004d6cd4
pop ecx
pop ecx
test eax, eax
jne 0x40463f
cmp esi, 9
jne 0x4040bc
push dword [ebp + 0xc]
mov eax, dword [ebp + 8]
xor edi, edi
push edi
push edi
push dword [eax + 0x20]
mov edx, dword [eax + 4]
push dword [eax + 0x1c]
mov ecx, dword [eax]
push dword [eax + 0x18]
push dword [eax + 0x14]
push dword [eax + 0x10]
push dword [eax + 0xc]
push dword [eax + 8]
call fcn.004037f0
jmp 0x40453a
push str.GetHardwareID
push edi
call fcn.004d6cd4
pop ecx
pop ecx
test eax, eax
jne 0x40468d
mov esi, dword [ebp + 0xc]
push 8
pop edi
cmp word [esi], di
jne 0x404669
cmp dword [esi + 8], eax
je 0x404669
push dword [esi + 8]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea ecx, [ebp - 4]
call fcn.004322f9
push dword [ebp - 4]
mov word [esi], di
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
lea ecx, [ebp - 4]
mov dword [esi + 8], eax
call fcn.00403030
jmp 0x4040c8
push str.QueryTaskProgress
push edi
call fcn.004d6cd4
pop ecx
pop ecx
test eax, eax
je 0x4040b7
push str.CollectOneGame
push edi
call fcn.004d6cd4
pop ecx
pop ecx
test eax, eax
je 0x4040b7
push str.StartXunyou
push edi
call fcn.004d6cd4
pop ecx
pop ecx
test eax, eax
je 0x4040c8
push str.SubscribeMsg
push edi
call fcn.004d6cd4
pop ecx
pop ecx
test eax, eax
jne 0x4046e5
cmp esi, 3
jmp 0x4040ba
push str.FindGameFromRegisteredUser
push edi
call fcn.004d6cd4
pop ecx
pop ecx
test eax, eax
jne 0x404720
cmp esi, 1
jne 0x4040bc
mov eax, dword [ebp + 8]
push dword [eax]
call fcn.004d61c7
pop ecx
push eax
call fcn.004b2360
test eax, eax
mov eax, dword [ebp + 0xc]
je 0x40417d
jmp 0x4044c1
push str.GetHistoryFromTime
push edi
call fcn.004d6cd4
pop ecx
pop ecx
test eax, eax
jne 0x404759
cmp esi, 5
jne 0x4040bc
mov eax, dword [ebp + 8]
push ecx
push dword [eax + 0x10]
mov edx, dword [eax + 4]
push dword [eax + 0xc]
mov ecx, dword [eax]
push dword [eax + 8]
call fcn.00403bad
add esp, 0x10
jmp 0x4040ca
push str.GetHistoryFromNum
push edi
call fcn.004d6cd4
pop ecx
pop ecx
test eax, eax
jne 0x40478b
cmp esi, 3
jne 0x4040bc
mov eax, dword [ebp + 8]
push ecx
push dword [eax + 8]
mov edx, dword [eax + 4]
mov ecx, dword [eax]
call fcn.00403b05
pop ecx
pop ecx
jmp 0x4040ca
push str.DeleteAllHistory
push edi
call fcn.004d6cd4
pop ecx
pop ecx
test eax, eax
jne 0x4047a6
call fcn.0046cc1a
jmp 0x4040c8
push str.DeleteSelectHistory
push edi
call fcn.004d6cd4
pop ecx
pop ecx
test eax, eax
jne 0x4047d2
cmp esi, 2
jne 0x4040bc
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
mov ecx, dword [eax]
call fcn.00403c6a
jmp 0x4040ca
push str.DeleteHistoryFromDate
push edi
call fcn.004d6cd4
pop ecx
pop ecx
test eax, eax
jne 0x4047fb
cmp esi, 1
jne 0x4040bc
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
call fcn.00403d20
jmp 0x4040ca
push str.CopyToClipboard
push edi
call fcn.004d6cd4
pop ecx
pop ecx
test eax, eax
jne 0x404827
cmp esi, 1
jne 0x4040bc
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov ecx, dword [eax]
call fcn.00404016
jmp 0x4040ca
push str.OpenGameURL
push edi
call fcn.004d6cd4
pop ecx
pop ecx
test eax, eax
jne 0x404875
cmp esi, 2
jne 0x404861
push dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push 0x50e6f0
push dword [eax]
mov esi, dword [eax + 4]
call fcn.004d61c7
pop ecx
mov edx, esi
mov ecx, eax
call fcn.00403562
jmp 0x404784
cmp esi, 3
jne 0x4040bc
mov eax, dword [ebp + 8]
push dword [ebp + 0xc]
push dword [eax + 8]
jmp 0x404848
push 0x50e43c
push edi
call fcn.004d6cd4
pop ecx
pop ecx
test eax, eax
jne 0x4040bc
mov ecx, dword [0x5478e4]
test ecx, ecx
je 0x4040c8
xor edi, edi
cmp dword [ecx + 0x160], edi
jne 0x4044be
add ecx, 0x90
push edi
push edi
push 0x69
mov eax, dword [ecx]
call dword [eax]
jmp 0x4044be