Function at 0x4656ba
Capabilities:
Hide graphical window

Disassembly:
movzx eax, word [esp + 8]
add eax, 0xffffdcd3
push esi
mov esi, ecx
cmp eax, 0xe
ja case.0x4656c6.9008
jmp dword [eax*4 + 0x465ae0]
call fcn.0049d2b0
mov ecx, eax
call fcn.0049cb30
push ecx
mov ecx, esp
push 0x527f5c
call fcn.0043a930
push 0
push 1
mov ecx, esi
call fcn.00464960
mov eax, dword [esi + 0x900]
mov ecx, dword [eax + 0x30]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
pop esi
ret 0x10
push ecx
mov ecx, esp
push 0x527f5c
call fcn.0043a930
push 0
push 2
mov ecx, esi
call fcn.00464960
mov edx, dword [esi + 0x900]
mov eax, dword [edx + 0x30]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push ecx
mov ecx, esp
push 0x527f5c
call fcn.0043a930
call fcn.0049d2b0
mov ecx, eax
call fcn.0049cbc0
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
pop esi
ret 0x10
push ecx
mov ecx, esp
push 0x527f5c
call fcn.0043a930
push 0
push 3
mov ecx, esi
call fcn.00464960
mov ecx, dword [esi + 0x900]
mov edx, dword [ecx + 0x30]
push 0
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
pop esi
ret 0x10
push ecx
mov ecx, esp
push 0x527f5c
call fcn.0043a930
push 0
push 4
mov ecx, esi
call fcn.00464960
mov eax, dword [esi + 0x900]
mov ecx, dword [eax + 0x30]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push str.page
lea ecx, [esp + 0x10]
call fcn.0043a930
lea edx, [esp + 0xc]
push edx
call fcn.0049d2b0
mov ecx, eax
call fcn.0049cc80
lea ecx, [esp + 0xc]
call fcn.00439d40
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
pop esi
ret 0x10
push ecx
mov ecx, esp
push 0x527f5c
call fcn.0043a930
push 0
push 5
mov ecx, esi
call fcn.00464960
mov ecx, esi
call fcn.004754a0
push 0
mov ecx, esi
call fcn.004535b0
call fcn.0049d2b0
mov ecx, eax
call fcn.0049cc50
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
pop esi
ret 0x10
push ecx
mov ecx, esp
push 0x527f5c
call fcn.0043a930
push 0
push 6
mov ecx, esi
call fcn.00464960
mov eax, dword [esi + 0x900]
mov ecx, dword [eax + 0x30]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.0049d2b0
mov ecx, eax
call fcn.0049cb60
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
pop esi
ret 0x10
push ecx
mov ecx, esp
push 0x527f5c
call fcn.0043a930
push 0
push 7
mov ecx, esi
call fcn.00464960
mov edx, dword [esi + 0x900]
mov eax, dword [edx + 0x30]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
pop esi
ret 0x10
mov eax, dword [esi + 0x548]
cmp eax, 4
jne 0x4658f2
push str.https:__www.nicaifu.com_
call fcn.004846d0
mov ecx, eax
call fcn.0047e8e0
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
pop esi
ret 0x10
cmp eax, 6
jne 0x465918
push str.https:__jie.360.cn_
call fcn.004846d0
mov ecx, eax
call fcn.0047e8e0
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
pop esi
ret 0x10
cmp eax, 7
jne 0x46593e
push str.http:__www.huajiao.com_
call fcn.004846d0
mov ecx, eax
call fcn.0047e8e0
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
pop esi
ret 0x10
cmp dword [esi + 0xec], 0
je case.0x4656c6.9008
push eax
push ecx
mov ecx, esp
push str.safe
call fcn.0043a930
mov ecx, esi
call fcn.00463510
mov eax, dword [esi + 0x548]
dec eax
cmp eax, 5
ja case.0x4656c6.9008
jmp dword [eax*4 + 0x465b1c]
push ecx
push esp
call fcn.0048a050
mov ecx, eax
call fcn.0048a250
mov ecx, dword [esi + 0x548]
push ecx
mov ecx, dword [esi + 0xec]
call fcn.0044b590
mov edx, dword [esi + 0x548]
push 1
push edx
jmp 0x465ac2
push ecx
push esp
call fcn.0048a050
mov ecx, eax
call fcn.0048a2f0
jmp 0x465aa7
push ecx
push esp
call fcn.0048a050
mov ecx, eax
call fcn.0048a390
mov edx, dword [esi + 0x548]
mov ecx, dword [esi + 0xec]
push edx
call fcn.0044b590
mov eax, dword [esi + 0x548]
push 1
push eax
jmp 0x465ac2
push ecx
mov ecx, esp
push str.http:__ws.nicaifu.com
call fcn.0043a930
mov ecx, dword [esi + 0x548]
push ecx
mov ecx, dword [esi + 0xec]
call fcn.0044b590
mov edx, dword [esi + 0x548]
push 1
push edx
jmp 0x465ac2
push ecx
mov ecx, esp
push str.http:__vip.360.cn_client_store_newclientstore.html
jmp 0x465aa2
push ecx
mov ecx, esp
push str.https:__mkt.360jie.com.cn_activity_guide_wsbrand_utm_source360wsutm_mediumpinpaiutm_campaignpinpaituiguang_huodong
call fcn.0043a930
mov edx, dword [esi + 0x548]
mov ecx, dword [esi + 0xec]
push edx
call fcn.0044b590
mov eax, dword [esi + 0x548]
push 1
push eax
jmp 0x465ac2
cmp dword [esi + 0xec], 0
je case.0x4656c6.9008
mov ecx, dword [esi + 0x548]
push ecx
push ecx
mov ecx, esp
push str.safe
call fcn.0043a930
mov ecx, esi
call fcn.00463510
mov eax, dword [esi + 0x548]
cmp eax, 4
jne 0x465a83
push ecx
mov ecx, esp
push str.http:__ws.nicaifu.com
jmp 0x465a28
cmp eax, 6
jne 0x465a95
push ecx
mov ecx, esp
push str.https:__mkt.360jie.com.cn_activity_guide_wsbrand_utm_source360wsutm_mediumpinpaiutm_campaignpinpaituiguang_huodong
jmp 0x4659ee
cmp eax, 7
jne case.0x4656c6.9008
push ecx
mov ecx, esp
push str.http:__www.huajiao.com_channel_weishi.html
call fcn.0043a930
mov eax, dword [esi + 0x548]
mov ecx, dword [esi + 0xec]
push eax
call fcn.0044b590
mov ecx, dword [esi + 0x548]
push 1
push ecx
mov ecx, dword [esi + 0xec]
call fcn.0044bec0
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
pop esi
ret 0x10