Function at 0x4a9c74
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x4df4c8
call fcn.0046fad0
sub esp, 0x3c
push ebx
push esi
push edi
xor ebx, ebx
push str.QQTIPCWnd
mov esi, ecx
push ebx
call dword [sym.imp.USER32.dll_FindWindowA]
cmp eax, ebx
mov dword [ebp - 0x3c], eax
je 0x4a9d38
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::CString_4
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0xd]
mov edi, 0x4f6a84
push edx
mov ecx, dword [eax]
push edi
mov dword [ebp - 4], ebx
push eax
mov byte [ebp - 0xd], bl
call dword [ecx + 0x70]
cmp byte [ebp - 0xd], 7
jne 0x4a9cd7
lea eax, [ebp - 0x14]
push eax
push edi
push dword [ebp + 0xc]
call dword [sym.imp.BasicCtrlDll.dll_long_int___cdecl_GetQQDataBuf_struct_IQQData___char_const___class_CString__]
add esp, 0xc
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax - 8]
mov dword [ebp - 0x44], eax
call sub.MFC42.DLL_CString::LockBuffer
cmp esi, ebx
mov dword [ebp - 0x40], eax
jne 0x4a9cf9
xor esi, esi
jmp 0x4a9cfc
mov esi, dword [esi + 0x20]
lea eax, [ebp - 0x48]
push eax
push esi
push 0x4a
push dword [ebp - 0x3c]
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::UnlockBuffer
cmp byte [ebp - 0xd], 7
jne 0x4a9d2c
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 0xc]
push eax
mov ecx, dword [eax - 8]
mov esi, dword [edx]
push ecx
push edi
push edx
call dword [esi + 0x24]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
jmp 0x4a9fb4
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0xd]
mov edi, str.strData
push edx
mov ecx, dword [eax]
push edi
push eax
mov byte [ebp - 0xd], bl
call dword [ecx + 0x70]
cmp byte [ebp - 0xd], 6
jne 0x4a9fb9
lea ecx, [ebp - 0x18]
call sub.MFC42.DLL_CString::CString_4
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 1
push eax
call dword [sym.imp.QQHelperDll.dll_int___cdecl_GetQQTangExeFilePath_class_CString__]
test eax, eax
pop ecx
jne 0x4a9dd0
lea ecx, [ebp + 0xc]
call sub.MFC42.DLL_CString::CString_4
push str.http:__jump.qq.com_clienturl_107
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 2
call fcn.0046f48c
push 5
push ecx
lea eax, [ebp + 0xc]
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
call sub.MFC42.DLL_CString::CString_3
push ebx
mov byte [ebp - 4], 2
call dword [sym.imp.QQHelperDll.dll_void___cdecl_OpenUrlWithTe_struct_HWND_____class_CString__int_]
add esp, 0xc
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call sub.MFC42.DLL_CString::CString
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call sub.MFC42.DLL_CString::CString
mov eax, 0x80004005
jmp 0x4a9fbb
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::CString_4
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 4
push eax
push edi
push dword [ebp + 0xc]
call dword [sym.imp.BasicCtrlDll.dll_long_int___cdecl_GetQQDataStr_struct_IQQData___char_const___class_CString__]
add esp, 0xc
lea ecx, [ebp - 0x30]
call sub.MFC42.DLL_CString::CString_4
push dword [esi + 0x20]
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 5
push str._WNDHANDLE:_u
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea eax, [ebp - 0x30]
lea ecx, [ebp - 0x14]
push eax
call sub.MFC42.DLL_CString::operator
lea ecx, [ebp - 0x2c]
mov byte [ebp + 0xb], bl
mov dword [ebp - 0x34], ebx
call sub.MFC42.DLL_CString::CString_4
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 6
call sub.MFC42.DLL_CString::CString_4
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 7
call sub.MFC42.DLL_CString::CString_4
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 8
call sub.MFC42.DLL_CString::CString_4
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 9
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp + 0xb]
push eax
push dword [esi + 0x6c]
call dword [sym.imp.QQHelperDll.dll_int___cdecl_GetCurrentProxy_struct_IQQCore___unsigned_char___class_CString___unsigned_short_int___class_CString___class_CString___class_CString__]
add esp, 0x1c
cmp byte [ebp + 0xb], bl
je 0x4a9ef3
lea ecx, [ebp - 0x1c]
call sub.MFC42.DLL_CString::CString_4
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 0xa
call sub.MFC42.DLL_CString::CString_4
cmp byte [ebp + 0xb], 1
mov byte [ebp - 4], 0xb
jne 0x4a9e9d
push str.SOCKET5
jmp 0x4a9ea2
push str.HTTP
lea ecx, [ebp + 0xc]
call fcn.0046f48c
push dword [ebp - 0x20]
movzx eax, word [ebp - 0x34]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push eax
lea eax, [ebp - 0x1c]
push dword [ebp - 0x2c]
push dword [ebp + 0xc]
push str._PROXYTYPE:_s_PROXYIP:_s_PROXYPORT:_d_PROXYUSERNAME:_s_PROXYUSERPWD:_s_PROXYDOMAIN:_s
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0x20
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x14]
push eax
call sub.MFC42.DLL_CString::operator
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 0xa
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 9
call sub.MFC42.DLL_CString::CString
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], ebx
push eax
push dword [esi + 0x6c]
call dword [sym.imp.BasicCtrlDll.dll_int___cdecl_GetCurrentStatus_struct_IQQCore___int__]
pop ecx
test eax, eax
pop ecx
je 0x4a9f1c
cmp dword [ebp - 0x38], 0x28
jne 0x4a9f1c
push str._INCOG:1
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::operator_1
push ecx
lea eax, [ebp - 0x14]
mov ecx, esp
mov dword [ebp + 0xc], esp
push eax
call sub.MFC42.DLL_CString::CString_3
lea eax, [ebp - 0x3c]
mov ecx, esi
push eax
mov byte [ebp - 4], 9
call fcn.004ab5c7
push 5
push ebx
push dword [ebp - 0x3c]
mov byte [ebp - 4], 0xd
push dword [ebp - 0x18]
push str.open
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 9
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 8
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 7
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 6
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 5
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 4
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call sub.MFC42.DLL_CString::CString
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call sub.MFC42.DLL_CString::CString
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 8