Function at 0x4134b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5ab7b6
mov eax, dword fs:[0]
push eax
sub esp, 0xcc0
mov eax, dword [0x5f13cc]
xor eax, esp
mov dword [esp + 0xcb8], eax
push ebx
push esi
push edi
mov eax, dword [0x5f13cc]
xor eax, esp
push eax
lea eax, [esp + 0xcd0]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
cmp ax, 0x4d3
mov ebx, dword [sym.imp.USER32.dll_EnableWindow]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, ecx
jne 0x413535
mov ecx, eax
shr ecx, 0x10
cmp cx, 0x300
jne 0x413547
cmp dword [0x5fe5bc], 0
je 0x413528
mov dword [0x5fe5bc], 0
jmp 0x413547
mov edx, dword [0x5fdb9c]
push 1
push 3
push edx
jmp 0x41353f
mov eax, dword [0x5fdb9c]
push 1
push 3
push eax
call edi
push eax
call ebx
mov eax, dword [ebp + 8]
cmp eax, 0x3eb
jne 0x41358d
push 0x24
push 0x5bdca0
push 0x5bdca8
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x413a16
lea eax, [esp + 0xb4]
call fcn.0040c700
lea ecx, [esp + 0xb4]
push ecx
mov ebx, esi
call fcn.00413090
add esp, 4
jmp 0x413a16
cmp eax, 0x404
jne 0x4135d0
push 0
push 0
push 0xf0
push eax
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x4135be
push 1
push 0x405
push esi
call edi
push eax
call ebx
jmp 0x413a16
push 0
push 0x405
push esi
call edi
push eax
call ebx
jmp 0x413a16
cmp eax, 0x503
jne 0x413613
push 0
push 0
push 0xf0
push eax
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x413601
push 1
push 0x4ef
push esi
call edi
push eax
call ebx
jmp 0x413a16
push 0
push 0x4ef
push esi
call edi
push eax
call ebx
jmp 0x413a16
cmp eax, 0x4d0
jne 0x41366a
push 0
push 0
push 0xf0
push eax
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x41364e
push 1
push 0x40a
push esi
call edi
push eax
call ebx
mov dword [0x5ff06c], 1
jmp 0x413a16
push 0
push 0x40a
push esi
call edi
push eax
call ebx
mov dword [0x5ff06c], 0
jmp 0x413a16
cmp eax, 0x4c8
jne 0x4136ad
push 0
push 0
push 0xf0
push eax
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x41369b
push 1
push 0x406
push esi
call edi
push eax
call ebx
jmp 0x413a16
push 0
push 0x406
push esi
call edi
push eax
call ebx
jmp 0x413a16
cmp eax, 0x48c
jne 0x4136f0
push 0
push 0
push 0xf0
push eax
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x4136de
push 1
push 0x4d3
push esi
call edi
push eax
call ebx
jmp 0x413a16
push 0
push 0x4d3
push esi
call edi
push eax
call ebx
jmp 0x413a16
cmp eax, 0x40a
jne 0x413710
mov edx, dword [0x5fe658]
push 0
push 0x4841b0
push esi
push 0x97
push edx
jmp 0x413a10
cmp eax, 0x405
jne 0x41372c
mov eax, dword [0x5fe658]
push 0
push 0x417ed0
push esi
push 0x7f
push eax
jmp 0x413a10
cmp eax, 0x401
jne 0x413793
mov ecx, dword [0x5fe658]
push 0
push 0x46cdf0
push esi
push 0x95
push ecx
call dword [sym.imp.USER32.dll_DialogBoxParamW]
cmp eax, 1
jne 0x413a16
call fcn.0040cbf0
mov esi, dword [0x5fe584]
mov dword [0x5fe580], 1
mov byte [esi + 0x99c], 1
call fcn.0040cbf0
call fcn.00486380
test eax, eax
jne 0x413787
push eax
push esi
call fcn.0040cc60
mov byte [0x5fdb98], 1
jmp 0x413a16
cmp eax, 0x406
jne 0x4137e5
call fcn.00412c10
cmp eax, 1
jne 0x413a16
call fcn.0040cbf0
mov esi, dword [0x5fe584]
mov dword [0x5fe580], 1
mov byte [esi + 0x99c], 1
call fcn.0040cbf0
call fcn.00486380
test eax, eax
jne 0x4137d9
push eax
push esi
call fcn.0040cc60
mov byte [0x5fdb99], 1
jmp 0x413a16
cmp eax, 0x4ed
jne 0x41386a
push 0
push 0
push 0xf0
push eax
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x4138cd
push 1
push 0x4ee
push esi
call edi
push eax
call ebx
call fcn.0040cbf0
mov esi, dword [0x5fe584]
cmp dword [esi + 0x944], 0
mov dword [0x5fe580], 1
jne 0x41384c
lea eax, [esp + 0xb4]
call fcn.0040c700
mov edx, dword [esp + 0x9f8]
mov dword [esi + 0x944], edx
call fcn.0040cbf0
call fcn.00486380
test eax, eax
jne 0x413a16
push eax
push esi
call fcn.0040cc60
jmp 0x413a16
cmp eax, 0x4ee
jne 0x4138df
mov eax, dword [0x5fe658]
push 0
push 0x435ca0
push esi
push 0x80
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamW]
call fcn.0040cbf0
mov eax, dword [0x5fe584]
cmp dword [eax + 0x944], 0
mov dword [0x5fe580], 1
jne 0x413a16
push 0
push 0
push 0xf1
push 0x4ed
push esi
mov dword [eax + 0x940], 0
call edi
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0x4ee
push esi
call edi
push eax
call ebx
jmp 0x413a16
cmp eax, 0x518
jne 0x4139f5
lea ebx, [esp + 0x14]
call fcn.004747c0
mov eax, ebx
mov dword [esp + 0xcd8], 0
call fcn.0047aca0
mov edx, str.QQPYLiveUp.exe
mov edi, ebx
call fcn.00412930
lea ecx, [esp + 0x34]
push ecx
call fcn.004054d0
mov ebx, 1
mov byte [esp + 0xcd8], bl
call fcn.0040cbf0
push ebx
push ecx
push str.__UpdateDictType_
push ecx
push 2
push ecx
push str.__UpdateImeType_
push ecx
push 2
push ecx
lea edx, [esp + 0x5c]
push str._Mode_
push edx
mov dword [0x5fe580], ebx
call fcn.00415f80
add esp, 0xc
push eax
call fcn.00413fe0
add esp, 4
push eax
call fcn.00415f80
add esp, 0xc
push eax
call fcn.00413fe0
add esp, 4
push eax
call fcn.00415f80
add esp, 0xc
push eax
call fcn.00413fe0
lea ecx, [esp + 0x18]
lea eax, [esp + 0x34]
call fcn.00414210
cmp dword [eax + 0x18], 8
jb 0x41399a
mov eax, dword [eax + 4]
jmp 0x41399d
add eax, 4
push ebx
push 0
push eax
mov eax, dword [esp + 0x20]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea esi, [esp + 0x18]
call fcn.004385c0
push 0
call fcn.0057abc7
add esp, 4
push eax
mov edx, str.lastupdatetime
mov ecx, str.SOFTWARETencentQQPinyin
call fcn.00473c10
add esp, 4
lea eax, [esp + 0x34]
mov byte [esp + 0xcd8], 0
call fcn.004051f0
lea ecx, [esp + 0x14]
call fcn.00404510
jmp 0x413a16
cmp eax, 0x402
jne 0x413a16
mov ecx, dword [0x5fe658]
push 0
push 0x412f10
push esi
push 0xcc
push ecx
call dword [sym.imp.USER32.dll_DialogBoxParamW]
mov ecx, dword [esp + 0xcd0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xcb8]
xor ecx, esp
call fcn.005787fd
mov esp, ebp
pop ebp
ret