Function at 0x405874
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
sub esp, 0x224
lea ebp, [esp - 4]
mov eax, dword [0x4111b4]
xor eax, ebp
mov dword [ebp + 0x224], eax
push 0x58
mov eax, 0x40a9cd
call fcn.00409b4c
mov edi, dword [ebp + 0x230]
push 0x31
push 0x40bf40
push 0x40bed0
xor ebx, ebx
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
xor esi, esi
inc esi
cmp eax, esi
jne 0x4059dd
push str.Click_OK_Btn__Terminate_Process_and_Open_URL
lea ecx, [ebp - 0x28]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
push dword [ebp + 0x234]
lea eax, [ebp - 0x28]
push eax
push edi
mov dword [ebp - 4], ebx
call fcn.0040420f
or dword [ebp - 4], 0xffffffff
add esp, 0xc
lea ecx, [ebp - 0x28]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
push 5
push ebx
push str.http:__qqgame.qq.com
push str.iexplore
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
push 0x206
mov word [ebp + 0x1c], ax
lea eax, [ebp + 0x1e]
push ebx
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x104
lea ecx, [ebp + 0x1c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp + 0x1c]
push eax
lea ecx, [ebp - 0x28]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp]
push eax
mov dword [ebp - 4], esi
call fcn.0040434d
pop ecx
pop ecx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 3
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp]
call dword [sym.imp.MSVCP90.dll_public:_class_std::_String_iterator_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::begin_void_]
mov esi, eax
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp]
call dword [sym.imp.MSVCP90.dll_public:_class_std::_String_iterator_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::end_void_]
mov edi, eax
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp]
call dword [sym.imp.MSVCP90.dll_public:_class_std::_String_iterator_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::begin_void_]
push dword [sym.imp.MSVCR90.dll_towlower]
push dword [esi + 4]
push dword [esi]
push dword [edi + 4]
push dword [edi]
push dword [eax + 4]
push dword [eax]
lea eax, [ebp - 0x30]
push eax
call fcn.00402050
push str.qqgame.exe
lea eax, [ebp]
push eax
call dword [sym.imp.MSVCP90.dll_bool___cdecl_std::operator_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___wchar_t_const__]
add esp, 0x28
test al, al
je 0x4059cc
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
xor eax, eax
jmp 0x405a14
push str.Click_Cancel_Btn
lea ecx, [ebp - 0x64]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
push dword [ebp + 0x234]
lea eax, [ebp - 0x64]
push eax
push edi
mov dword [ebp - 4], 4
call fcn.0040420f
or dword [ebp - 4], 0xffffffff
add esp, 0xc
lea ecx, [ebp - 0x64]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x224]
xor ecx, ebp
call fcn.00409ade
add ebp, 0x228
leave
ret