Function at 0x409320
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46d806
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
mov eax, dword [0x485370]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ecx + 0x108]
mov esi, edx
mov dword [ebp - 0x98], ecx
cmp eax, dword [esi + 0x360]
jne 0x409381
push 5
push 0
push 0
push str.http:__jq.qq.com___wv1027kZsbarg
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp case.default.0x409432
cmp eax, dword [esi + 0x364]
jne 0x4093a1
push 0
push 0xf020
push 0x112
mov ecx, esi
call fcn.0041bcc9
jmp case.default.0x409432
cmp eax, dword [esi + 0x368]
jne 0x4093f6
cmp dword [esi + 0x79c], 0
je 0x4093c2
push 1
push 0
mov ecx, esi
call fcn.0041b921
jmp case.default.0x409432
mov eax, dword [esi + 4]
push 4
push 0x47a5b8
push 0x47a604
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne case.default.0x409432
mov ecx, dword [esi + 4]
push 0
push 0
push 2
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
jmp case.default.0x409432
cmp eax, dword [esi + 0x3d0]
jne 0x409417
cmp dword [esi + 0x79c], 0
jne case.default.0x409432
mov ecx, esi
call fcn.00408680
jmp case.default.0x409432
cmp eax, dword [esi + 0x38c]
jne 0x4094af
mov eax, dword [0x4865dc]
inc eax
cmp eax, 4
ja case.default.0x409432
jmp dword [eax*4 + 0x4096e8]
mov edx, dword [esi + 4]
push 0
push 0x47a5b8
push str.ck_W
push edx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp case.default.0x409432
mov eax, dword [esi + 4]
push 0x30
push 0x47a5ec
push 0x47ad70
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp case.default.0x409432
mov ecx, dword [esi + 4]
push 0x30
push 0x47a5ec
push str.S_MR
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp case.default.0x409432
mov edx, dword [esi + 4]
push 0x30
push 0x47a5ec
push 0x47adcc
push edx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp case.default.0x409432
call fcn.00409700
jmp case.default.0x409432
cmp eax, dword [esi + 0x398]
jne 0x4094d1
mov eax, dword [esi + 4]
push 0x457
push eax
call dword [sym.imp.USER32.dll_KillTimer]
push esi
call fcn.00408c90
jmp case.default.0x409432
cmp eax, dword [esi + 0x3b4]
jne 0x4094fe
lea esi, [ebp - 0x98]
call fcn.0040f3f0
mov dword [ebp - 4], 0
mov ecx, dword [eax]
call fcn.004113c0
mov ecx, esi
call fcn.004051a0
jmp case.default.0x409432
cmp eax, dword [esi + 0x3bc]
jne 0x409534
mov ecx, dword [esi + 4]
push 4
push 0x47a5b8
push 0x47adf0
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne case.default.0x409432
mov dword [0x48813c], 1
jmp case.default.0x409432
cmp eax, dword [esi + 0x3b8]
jne 0x409592
cmp dword [0x488138], 0
mov ecx, dword [esi + 0x3b8]
mov edx, dword [ecx]
mov eax, dword [edx + 0x2c]
je 0x409571
push 0x479a54
call eax
mov ecx, dword [esi + 0x3a0]
call fcn.00426c33
mov dword [0x488138], 0
jmp case.default.0x409432
push 0x479a60
call eax
mov ecx, dword [esi + 0x3a0]
call fcn.00426c79
mov dword [0x488138], 1
jmp case.default.0x409432
cmp eax, dword [esi + 0x3d4]
jne 0x4095dd
cmp dword [esi + 0x79c], 0
jne case.default.0x409432
mov ecx, dword [esi + 4]
push 4
push 0x47a5b8
push 0x47ae14
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne case.default.0x409432
call fcn.0040a720
push 0
push str.cmd__c_shutdown__r__t_0
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp case.default.0x409432
cmp eax, dword [esi + 0x3d8]
jne 0x409628
cmp dword [esi + 0x79c], 0
jne case.default.0x409432
mov edx, dword [esi + 4]
push 4
push 0x47a5b8
push str._fT
push edx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne case.default.0x409432
call fcn.0040a7e0
push 0
push str.cmd__c_shutdown__r__t_0
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp case.default.0x409432
mov ecx, eax
mov eax, dword [ecx]
mov eax, dword [eax + 4]
lea edx, [ebp - 0x94]
push edx
call eax
mov ecx, eax
mov dword [ebp - 4], 1
mov edi, str.btnsoft
call fcn.0041fe6a
jmp 0x409650
mov cx, word [eax]
cmp cx, word [edi]
jne 0x409676
test cx, cx
je 0x409672
mov cx, word [eax + 2]
cmp cx, word [edi + 2]
jne 0x409676
add eax, 4
add edi, 4
test cx, cx
jne 0x409650
xor eax, eax
jmp 0x40967b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea ecx, [ebp - 0x94]
sete bl
mov dword [ebp - 4], 0xffffffff
call fcn.0041fd16
test bl, bl
je case.default.0x409432
mov edi, dword [ebp - 0x98]
mov ecx, dword [edi + 0x108]
mov edx, dword [ecx]
mov eax, dword [edx + 0xb0]
call eax
mov ecx, eax
call fcn.0041fe6a
push eax
call fcn.004528f3
mov ecx, dword [edi + 0x108]
add esp, 4
push ecx
mov edx, eax
mov ecx, esi
call fcn.00409820
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004501c4
mov esp, ebp
pop ebp
ret