Function at 0x4041b8
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
push str.SearchKeyword
push edi
call fcn.004da5d4
pop ecx
pop ecx
test eax, eax
jne 0x4041ee
cmp esi, 1
je 0x4041e5
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4041e5
xor ecx, ecx
mov word [eax], cx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.GetUserInfo
push edi
call fcn.004da5d4
pop ecx
pop ecx
test eax, eax
jne 0x404213
cmp esi, 1
jne 0x4041d9
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov ecx, dword [eax]
call fcn.004031be
jmp 0x4041e7
push str.GetChannel
push edi
call fcn.004da5d4
pop ecx
pop ecx
test eax, eax
jne 0x404232
test esi, esi
jne 0x4041d9
mov ecx, dword [ebp + 0xc]
call fcn.00403412
jmp 0x4041e7
push str.GetRealChannel
push edi
call fcn.004da5d4
pop ecx
pop ecx
test eax, eax
jne 0x404251
test esi, esi
jne 0x4041d9
mov ecx, dword [ebp + 0xc]
call fcn.00403412
jmp 0x4041e7
push 0x511f44
push edi
call fcn.004da5d4
pop ecx
pop ecx
test eax, eax
jne 0x40427d
cmp esi, 1
jne 0x4041d9
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov ecx, dword [eax]
call fcn.0040345b
jmp 0x4041e7
push str.OpenDialog
push edi
call fcn.004da5d4
pop ecx
pop ecx
test eax, eax
jne 0x4042b3
cmp esi, 3
jne 0x4041d9
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4041e5
push 0xb
pop ecx
mov word [eax], cx
xor ecx, ecx
mov word [eax + 8], cx
jmp 0x4041e5
push str.OpenClassifyGame
push edi
call fcn.004da5d4
pop ecx
pop ecx
test eax, eax
jne 0x4042ce
cmp esi, 2
je 0x404297
cmp esi, 1
jmp 0x404291
push str.GetSoftWareVersion
push edi
call fcn.004da5d4
pop ecx
pop ecx
test eax, eax
jne 0x40430d
test esi, esi
jne 0x4041d9
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x4042f8
mov eax, 0x80070057
jmp 0x4041e7
movss xmm0, dword [0x54e494]
push 4
pop ecx
movss dword [eax + 8], xmm0
jmp 0x4041e2
push str.CloseTab
push edi
call fcn.004da5d4
pop ecx
pop ecx
test eax, eax
jne 0x404325
test esi, esi
jmp 0x4041d7
push str.OpenWindow
push edi
call fcn.004da5d4
pop ecx
pop ecx
test eax, eax
je 0x4041d9
push str.OpenLoginWindow
push edi
call fcn.004da5d4
pop ecx
pop ecx
test eax, eax
jne 0x40437e
push dword [ebp + 0xc]
cmp esi, 2
jne 0x40435e
mov edx, dword [ebp + 8]
push eax
push dword [edx + 4]
mov edx, dword [edx]
jmp 0x404371
cmp esi, 3
jne 0x40436b
mov edx, dword [ebp + 8]
push dword [edx + 8]
jmp 0x404357
xor edi, edi
xor edx, edx
push edi
push edi
call fcn.00428883
add esp, 0xc
jmp 0x4041e5
push str.OpenLoginWindowFromHwnd
push edi
call fcn.004da5d4
pop ecx
pop ecx
test eax, eax
jne 0x4043da
cmp esi, 3
jne 0x4043b8
mov eax, dword [ebp + 8]
push dword [eax]
mov esi, dword [eax + 8]
mov edi, dword [eax + 4]
call fcn.004d9ace
push 0
push esi
mov edx, edi
mov ecx, eax
call fcn.00428a8b
add esp, 0xc
jmp 0x4041e7
cmp esi, 4
jne 0x4041d9
mov eax, dword [ebp + 8]
push dword [eax]
mov esi, dword [eax + 0xc]
mov edi, dword [eax + 8]
mov ebx, dword [eax + 4]
call fcn.004d9ace
push esi
push edi
mov edx, ebx
jmp 0x4043a9
push str.OpenLoginWindowFromUserAccount
push edi
call fcn.004da5d4
pop ecx
pop ecx
test eax, eax
jne 0x404439
mov ebx, dword [ebp + 8]
xor edi, edi
cmp esi, 1
jne 0x404404
push dword [ebp + 0xc]
mov ecx, dword [ebx]
xor edx, edx
push edi
call fcn.00428c47
pop ecx
pop ecx
cmp esi, 2
jne 0x404419
push dword [ebp + 0xc]
mov edx, dword [ebx + 4]
mov ecx, dword [ebx]
push edi
call fcn.00428c47
pop ecx
pop ecx
cmp esi, 3
jne 0x4041e5
push dword [ebp + 0xc]
mov edx, dword [ebx + 4]
push dword [ebx + 8]
mov ecx, dword [ebx]
call fcn.00428c47
pop ecx
pop ecx
jmp 0x4041e5
push str.OpenOauthLoginWindow
push edi
call fcn.004da5d4
pop ecx
pop ecx
test eax, eax
jne 0x40445f
cmp esi, 1
jne 0x4041d9
xor ecx, ecx
call fcn.00442057
jmp 0x4041e7
push str.OauthLoginSuccess
push edi
call fcn.004da5d4
pop ecx
pop ecx
test eax, eax
jne 0x404485
cmp esi, 1
jne 0x4041d9
xor ecx, ecx
call fcn.00442095
jmp 0x4041e5
push str.SignUrl
push edi
call fcn.004da5d4
pop ecx
pop ecx
test eax, eax
jne 0x4044b1
cmp esi, 1
jne 0x4041d9
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov ecx, dword [eax]
call fcn.004034cb
jmp 0x4041e7
push str.GetGameStatus
push edi
call fcn.004da5d4
pop ecx
pop ecx
test eax, eax
je 0x4041d4
push str.OpenUrlTips
push edi
call fcn.004da5d4
pop ecx
pop ecx
test eax, eax
jne 0x4044df
cmp esi, 5
jmp 0x4041d7
push 0x512114
push edi
call fcn.004da5d4
pop ecx
pop ecx
test eax, eax
jne 0x404537
mov eax, dword [ebp + 8]
xor edi, edi
push 1
push edi
push dword [eax]
push str.IEXPLORE.EXE
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x4041e5
push 0xb
pop edx
mov word [ecx], dx
xor edx, edx
mov word [ecx + 8], dx
cmp eax, 0x20
jle 0x4041e5
or eax, 0xffffffff
mov word [ecx + 8], ax
jmp 0x4041e5
push str.OpenUrlByDefaultBrowser
push edi
call fcn.004da5d4
pop ecx
pop ecx
test eax, eax
jne 0x40455d
cmp esi, 1
jne 0x4041d9
mov eax, dword [ebp + 8]
xor edi, edi
push esi
push edi
push edi
push dword [eax]
jmp 0x4044ff
push str.SetRegisterUserInfo
push edi
call fcn.004da5d4
pop ecx
pop ecx
test eax, eax
jne 0x4045a8
cmp esi, 9
jne 0x4041d9
push dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edi, edi
push edi
push edi
push dword [ecx + 0x20]
mov edx, dword [ecx + 4]
push dword [ecx + 0x1c]
push dword [ecx + 0x18]
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push dword [ecx + 0xc]
push dword [ecx + 8]
mov ecx, dword [ecx]
call fcn.0040390b
add esp, 0x28
jmp 0x4041e5
push str.SetWebgameTabUserInfo
push edi
call fcn.004da5d4
pop ecx
pop ecx
test eax, eax
jne 0x4045f4
cmp esi, 2
jne 0x4041d9
mov eax, dword [ebp + 8]
mov ecx, dword [0x54d9b4]
push dword [eax + 4]
lea ecx, [ecx + 0x524]
push dword [eax]
call fcn.004bc01d
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4041e5
push 0xb
pop ecx
mov word [eax], cx
or ecx, 0xffffffff
jmp 0x4042aa
push str.StartWebgame
push edi
call fcn.004da5d4
pop ecx
pop ecx
test eax, eax
jne 0x404612
mov ecx, dword [ebp + 0xc]
call fcn.00403a2c
jmp 0x4041e7
push str.ActiveTempAccount
push edi
call fcn.004da5d4
pop ecx
pop ecx
test eax, eax
jne 0x40465f
cmp esi, 0xb
jne 0x4041d9
mov eax, dword [ebp + 8]
push dword [ebp + 0xc]
push dword [eax + 0x28]
mov edx, dword [eax + 4]
push dword [eax + 0x24]
mov ecx, dword [eax]
push dword [eax + 0x20]
push dword [eax + 0x1c]
push dword [eax + 0x18]
push dword [eax + 0x14]
push dword [eax + 0x10]
push dword [eax + 0xc]
push dword [eax + 8]
call fcn.00403bb2
add esp, 0x28
jmp 0x4041e7
push str.ActiveGameFromNewUser
push edi
call fcn.004da5d4
pop ecx
pop ecx
test eax, eax
jne 0x4046af
cmp esi, 0xc
jne 0x4041d9
mov eax, dword [ebp + 8]
push dword [ebp + 0xc]
push dword [eax + 0x2c]
mov edx, dword [eax + 4]
push dword [eax + 0x28]
mov ecx, dword [eax]
push dword [eax + 0x24]
push dword [eax + 0x20]
push dword [eax + 0x1c]
push dword [eax + 0x18]
push dword [eax + 0x14]
push dword [eax + 0x10]
push dword [eax + 0xc]
push dword [eax + 8]
call fcn.00403a81
add esp, 0x2c
jmp 0x4041e7
push str.ActiveGameFromOldUser
push edi
call fcn.004da5d4
pop ecx
pop ecx
test eax, eax
jne 0x4046f9
cmp esi, 0xc
jne 0x4041d9
mov eax, dword [ebp + 8]
push dword [ebp + 0xc]
push dword [eax + 0x2c]
mov edx, dword [eax + 4]
push dword [eax + 0x28]
mov ecx, dword [eax]
push dword [eax + 0x24]
push dword [eax + 0x20]
push dword [eax + 0x1c]
push dword [eax + 0x18]
push dword [eax + 0x14]
push dword [eax + 0x10]
push dword [eax + 0xc]
push dword [eax + 8]
call fcn.00403af3
jmp 0x4046a7
push str.ClearTempUUID
push edi
call fcn.004da5d4
pop ecx
pop ecx
test eax, eax
jne 0x404714
call fcn.00472e5f
jmp 0x4041e5
push str.SetOldUserInfo
push edi
call fcn.004da5d4
pop ecx
pop ecx
test eax, eax
jne 0x40475c
cmp esi, 9
jne 0x4041d9
push dword [ebp + 0xc]
mov eax, dword [ebp + 8]
xor edi, edi
push edi
push edi
push dword [eax + 0x20]
mov edx, dword [eax + 4]
push dword [eax + 0x1c]
mov ecx, dword [eax]
push dword [eax + 0x18]
push dword [eax + 0x14]
push dword [eax + 0x10]
push dword [eax + 0xc]
push dword [eax + 8]
call fcn.0040390b
jmp 0x404657
push str.GetHardwareID
push edi
call fcn.004da5d4
pop ecx
pop ecx
test eax, eax
jne 0x4047aa
mov esi, dword [ebp + 0xc]
push 8
pop edi
cmp word [esi], di
jne 0x404786
cmp dword [esi + 8], eax
je 0x404786
push dword [esi + 8]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea ecx, [ebp - 4]
call fcn.00435775
push dword [ebp - 4]
mov word [esi], di
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
lea ecx, [ebp - 4]
mov dword [esi + 8], eax
call fcn.00403080
jmp 0x4041e5
push str.QueryTaskProgress
push edi
call fcn.004da5d4
pop ecx
pop ecx
test eax, eax
je 0x4041d4
push str.CollectOneGame
push edi
call fcn.004da5d4
pop ecx
pop ecx
test eax, eax
je 0x4041d4
push str.StartXunyou
push edi
call fcn.004da5d4
pop ecx
pop ecx
test eax, eax
je 0x4041e5
push str.SubscribeMsg
push edi
call fcn.004da5d4
pop ecx
pop ecx
test eax, eax
jne 0x404802
cmp esi, 3
jmp 0x4041d7
push str.FindGameFromRegisteredUser
push edi
call fcn.004da5d4
pop ecx
pop ecx
test eax, eax
jne 0x40483d
cmp esi, 1
jne 0x4041d9
mov eax, dword [ebp + 8]
push dword [eax]
call fcn.004d9ace
pop ecx
push eax
call fcn.004b6163
test eax, eax
mov eax, dword [ebp + 0xc]
je 0x40429a
jmp 0x4045de
push str.GetHistoryFromTime
push edi
call fcn.004da5d4
pop ecx
pop ecx
test eax, eax
jne 0x404876
cmp esi, 5
jne 0x4041d9
mov eax, dword [ebp + 8]
push ecx
push dword [eax + 0x10]
mov edx, dword [eax + 4]
push dword [eax + 0xc]
mov ecx, dword [eax]
push dword [eax + 8]
call fcn.00403cc8
add esp, 0x10
jmp 0x4041e7
push str.GetHistoryFromNum
push edi
call fcn.004da5d4
pop ecx
pop ecx
test eax, eax
jne 0x4048a8
cmp esi, 3
jne 0x4041d9
mov eax, dword [ebp + 8]
push ecx
push dword [eax + 8]
mov edx, dword [eax + 4]
mov ecx, dword [eax]
call fcn.00403c20
pop ecx
pop ecx
jmp 0x4041e7
push str.DeleteAllHistory
push edi
call fcn.004da5d4
pop ecx
pop ecx
test eax, eax
jne 0x4048c3
call fcn.00470e0e
jmp 0x4041e5
push str.DeleteSelectHistory
push edi
call fcn.004da5d4
pop ecx
pop ecx
test eax, eax
jne 0x4048ef
cmp esi, 2
jne 0x4041d9
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
mov ecx, dword [eax]
call fcn.00403d85
jmp 0x4041e7
push str.DeleteHistoryFromDate
push edi
call fcn.004da5d4
pop ecx
pop ecx
test eax, eax
jne 0x404918
cmp esi, 1
jne 0x4041d9
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
call fcn.00403e3b
jmp 0x4041e7
push str.CopyToClipboard
push edi
call fcn.004da5d4
pop ecx
pop ecx
test eax, eax
jne 0x404944
cmp esi, 1
jne 0x4041d9
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov ecx, dword [eax]
call fcn.00404133
jmp 0x4041e7
push str.OpenGameURL
push edi
call fcn.004da5d4
pop ecx
pop ecx
test eax, eax
jne 0x404992
cmp esi, 2
jne 0x40497e
push dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push 0x512700
push dword [eax]
mov esi, dword [eax + 4]
call fcn.004d9ace
pop ecx
mov edx, esi
mov ecx, eax
call fcn.0040367d
jmp 0x4048a1
cmp esi, 3
jne 0x4041d9
mov eax, dword [ebp + 8]
push dword [ebp + 0xc]
push dword [eax + 8]
jmp 0x404965
push 0x51244c
push edi
call fcn.004da5d4
pop ecx
pop ecx
test eax, eax
jne 0x4041d9
mov ecx, dword [0x54d9b4]
test ecx, ecx
je 0x4041e5
xor edi, edi
cmp dword [ecx + 0x160], edi
jne 0x4045db
add ecx, 0x90
push edi
push edi
push 0x69
mov eax, dword [ecx]
call dword [eax]
jmp 0x4045db