Function at 0x42e06e
Capabilities:
Create process on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x46c4b8
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push ebp
mov ebx, dword [esp + 0x60]
push esi
mov esi, ecx
push edi
mov ecx, dword [esi + 0x1c]
test ecx, ecx
je 0x42e085
mov ebp, dword [esp + 0x6c]
mov eax, dword [ecx]
push ebp
push ebx
call dword [eax]
jmp 0x42e089
mov ebp, dword [esp + 0x6c]
mov eax, dword [esi + 0x18]
test eax, eax
jne 0x42e494
mov eax, dword [0x484b40]
test eax, eax
je 0x42e1a3
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_2
mov ecx, dword [0x484b40]
mov edi, dword [sym.imp.USER32.dll_PtInRect]
push ebp
push ebx
lea eax, [ecx + 0x58]
mov dword [esp + 0x64], 0
push eax
call edi
test eax, eax
je 0x42e0d6
mov ecx, 0x4a9190
call fcn.00446150
jmp 0x42e13c
mov ecx, dword [0x484b40]
push ebp
push ebx
lea eax, [ecx + 0x68]
push eax
call edi
test eax, eax
je 0x42e0f4
mov ecx, 0x4a9190
call fcn.004444b0
jmp 0x42e131
mov ecx, dword [0x484b40]
push ebp
push ebx
lea eax, [ecx + 0x78]
push eax
call edi
test eax, eax
je 0x42e112
mov ecx, 0x4a9190
call fcn.00444510
jmp 0x42e131
mov ecx, dword [0x484b40]
push ebp
push ebx
lea eax, [ecx + 0x88]
push eax
call edi
test eax, eax
je 0x42e155
mov ecx, 0x4a9190
call fcn.004444e0
push eax
mov ecx, 0x4a9190
call fcn.00445ff0
mov edx, dword [eax + 0x644]
lea eax, [esp + 0x10]
push edx
push str.http:__jz.qq.com_jz.shtml_leagueid_dflag1
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx - 8]
test eax, eax
je 0x42e192
mov eax, dword [0x4a91b0]
test eax, eax
je 0x42e16c
mov eax, dword [eax + 0x20]
push 1
push 0
push 0
push ecx
push 0
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp + 0x10]
mov dword [esp + 0x5c], 0xffffffff
call sub.MFC42.DLL_CString::CString
jmp 0x42e494
lea ecx, [esp + 0x10]
mov dword [esp + 0x5c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, ebp
mov ecx, ebx
and eax, 0xffff
and ecx, 0xffff
shl eax, 0x10
or eax, ecx
mov dword [esp + 0x10], eax
call sub.MFC42.DLL_AfxGetThread
test eax, eax
je 0x42e1cf
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x7c]
test eax, eax
jne 0x42e1d3
xor ebp, ebp
jmp 0x42e1d6
mov ebp, dword [eax + 0x20]
mov ecx, dword [0x4b5c8c]
push 0
push 1
mov edi, dword [ecx]
call dword [edi + 0x30]
mov ecx, dword [0x4b5c8c]
push eax
mov eax, dword [esp + 0x18]
push eax
push 0
push 0x201
push ebp
call dword [edi + 0x24]
mov ebp, dword [esp + 0x6c]
mov ecx, esi
push ebp
push ebx
call fcn.0042ff10
cmp eax, 0xffffffff
je 0x42e494
mov ecx, dword [0x4a91b0]
mov edi, dword [sym.imp.USER32.dll_PostMessageA]
push 0
push 0
mov edx, dword [ecx + 0x20]
push 0x466
push edx
call edi
mov eax, dword [esi + 0x30]
sub eax, 0
je 0x42e2da
sub eax, 2
je 0x42e27a
sub eax, 2
jne case.0x42e2a5.102
mov eax, dword [esi + 0x34]
cmp eax, 0x9f
jl case.0x42e2a5.102
cmp eax, 0xa1
jg case.0x42e2a5.102
mov eax, dword [0x4a91b0]
mov eax, dword [eax + 0x20]
push eax
call dword [sym.imp.USER32.dll_SetCapture]
push eax
call sub.MFC42.DLL_CWnd::FromHandle
jmp case.0x42e2a5.102
mov ecx, dword [esi + 0x34]
push ecx
mov ecx, esi
call fcn.0042fff0
cmp eax, 3
je case.0x42e2a5.102
mov eax, dword [esi + 0x34]
lea edi, [eax - 0x65]
cmp edi, 0x42
ja case.0x42e2a5.102
xor edx, edx
mov dl, byte [edi + 0x42e4b4]
jmp dword [edx*4 + 0x42e4ac]
push 2
push eax
mov ecx, esi
call fcn.00430130
mov eax, dword [0x4a91b0]
mov eax, dword [eax + 0x20]
push eax
call dword [sym.imp.USER32.dll_SetCapture]
push eax
call sub.MFC42.DLL_CWnd::FromHandle
mov ecx, dword [esi + 0x10]
push 3
mov edx, dword [ecx]
call dword [edx + 8]
jmp case.0x42e2a5.102
mov eax, dword [esi + 0x34]
lea ecx, [eax - 1]
cmp ecx, 5
ja case.0x42e2e9.2
jmp dword [ecx*4 + 0x42e4f8]
mov ecx, dword [0x4a9294]
test ecx, ecx
je case.0x42e2a5.102
add eax, 0xfffffffc
push 0
push eax
mov eax, dword [0x4a91b0]
push 0x49a
mov ecx, dword [eax + 0x20]
push ecx
call edi
mov dword [0x4a9294], 0
jmp case.0x42e2a5.102
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x60]
mov edi, eax
mov edx, edi
sub edx, ecx
cmp edx, 0x12c
jae 0x42e36c
mov ecx, 0x4a9190
call fcn.00446150
test eax, eax
je 0x42e36c
mov dl, byte [eax + 0x1b8]
xor ecx, ecx
test dl, dl
jle 0x42e36c
lea edx, [eax + 0x7c]
mov dword [edx], 0
inc ecx
movsx ebp, byte [eax + 0x1b8]
add edx, 8
cmp ecx, ebp
jl 0x42e357
mov dword [esi + 0x60], edi
jmp case.0x42e2a5.102
mov eax, dword [0x4a91b0]
push 0
push 1
push 0x498
mov ecx, dword [eax + 0x20]
push ecx
call edi
jmp case.0x42e2a5.102
cmp eax, 0x32
mov dword [esi + 0x60], 0
jl 0x42e3db
cmp eax, 0x59
jge 0x42e3db
mov eax, dword [0x4a938c]
test eax, eax
je case.0x42e2a5.102
mov ecx, 0x4a9190
call fcn.00446150
test eax, eax
je case.0x42e2a5.102
mov cl, byte [eax + 0x1b8]
test cl, cl
je case.0x42e2a5.102
mov edx, dword [esi + 0x34]
mov dword [esi + 0x54], 1
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x50], ebp
mov dword [esi + 0x48], ebp
mov eax, dword [eax + edx*8 - 0x114]
mov dword [esi + 0x58], eax
jmp case.0x42e2a5.102
cmp eax, 0x5a
jl case.0x42e2a5.102
cmp eax, 0x6d
jge case.0x42e2a5.102
add eax, 0xffffffa6
mov ecx, esi
push eax
call fcn.00430440
call sub.MFC42.DLL_AfxGetThread
test eax, eax
je 0x42e404
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x7c]
test eax, eax
jne 0x42e408
xor ebp, ebp
jmp 0x42e40b
mov ebp, dword [eax + 0x20]
mov ecx, dword [0x4b5c8c]
push 0
push 0
mov edi, dword [ecx]
call dword [edi + 0x30]
mov ecx, dword [0x4b5c8c]
push eax
mov eax, dword [esp + 0x18]
push eax
push 0
push 0x201
push ebp
call dword [edi + 0x24]
mov ecx, dword [esp + 0x6c]
push ecx
push ebx
mov ecx, esi
call fcn.0042fcd0
test eax, eax
je 0x42e494
mov eax, dword [0x4a938c]
test eax, eax
je 0x42e494
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x3f
lea edx, [esp + 0x18]
push str.qqgame:__selfsetting:1
push edx
stosb byte es:[edi], al
call dword [sym.imp.MSVCRT.dll_strncpy]
add esp, 0xc
lea eax, [esp + 0x14]
lea edi, [esp + 0x14]
or ecx, 0xffffffff
push eax
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push 0x55
mov ecx, 0x4a9158
call fcn.0041f790
mov ecx, dword [esp + 0x54]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x50
ret 0xc