Function at 0x40eacb
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x413e4c
call fcn.00411610
sub esp, 0x1c
mov eax, dword [ebp + 8]
push ebx
push esi
cmp eax, 0xe
mov esi, ecx
ja 0x40ecf6
je 0x40ecb6
dec eax
je 0x40eca5
dec eax
je 0x40ec77
dec eax
je 0x40ed5c
sub eax, 7
je 0x40ec03
dec eax
je 0x40ebf3
dec eax
je 0x40ebc1
dec eax
jne 0x40ed7f
xor ebx, ebx
push edi
mov edi, dword [sym.imp.USER32.dll_PostMessageA]
push ebx
push ebx
push 0x10
push dword [esi + 0x20]
call edi
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString_5
mov ecx, dword [esi + 0x26c]
add esi, 0x26c
mov dword [ebp - 4], 2
call fcn.0040b229
mov ecx, dword [esi]
push eax
call fcn.0040b229
push eax
lea eax, [ebp - 0x10]
push str.open_selfuin_u_peeruin_u_selfopen1
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0x10
mov dword [ebp + 8], ebx
lea eax, [ebp + 8]
mov byte [ebp - 4], 3
push eax
call sub.CommBase.dll_CreateBuffer
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
mov ecx, dword [eax - 8]
mov esi, dword [edx]
push ecx
push eax
push edx
call dword [esi + 0x20]
mov esi, dword [ebp + 8]
mov dword [ebp + 8], ebx
call fcn.0040496f
push esi
push 1
push 0x405
push dword [eax + 0x20]
call edi
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 2
cmp eax, ebx
pop edi
je 0x40ebb8
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
jmp 0x40ebe9
push str.http:__bm.bbs.qq.com
lea ecx, [ebp - 0x14]
call fcn.0041114c
push 5
pop eax
push eax
mov dword [ebp - 4], eax
push dword [ebp - 0x14]
push 0
call fcn.00408ce3
add esp, 0xc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::CString
jmp 0x40ed7f
mov ecx, dword [esi + 0x26c]
call fcn.0040c22a
jmp 0x40ed7f
lea ecx, [ebp + 8]
call sub.MFC42.DLL_CString::CString_5
push dword [esi + 0x268]
mov ecx, dword [esi + 0x26c]
lea eax, [ebp - 0x18]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.0040ab88
push dword [eax]
mov ecx, dword [esi + 0x26c]
mov byte [ebp - 4], 1
push dword [esi + 0x268]
call fcn.0040b229
push eax
lea eax, [ebp + 8]
push str.tencent:__buddy__MenuYespuin_utype100peeruin_upeernick_s
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0x14
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], bl
call sub.MFC42.DLL_CString::CString
push ebx
push ebx
push ebx
push dword [ebp + 8]
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
jmp 0x40ebe9
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsZoomed]
test eax, eax
push 0
je 0x40ec9e
push 0xf120
push 0x112
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x40ed7f
push 0xf030
jmp 0x40ec8b
push 0
push 0xf020
push 0x112
push dword [esi + 0x20]
jmp 0x40ec93
lea ecx, [ebp + 8]
call sub.MFC42.DLL_CString::CString_5
push dword [esi + 0x268]
lea eax, [ebp + 8]
mov dword [ebp - 4], 4
push str.http:___u.q_zone.qq.com
push eax
call sub.MFC42.DLL_CString::Format
mov ecx, dword [esi + 0x26c]
add esp, 0xc
push dword [ebp + 8]
call fcn.0040c436
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
jmp 0x40ebe9
cmp eax, 0xf
je 0x40ed6e
cmp eax, 0x14
je 0x40ed65
cmp eax, 0x15
je 0x40ed5c
cmp eax, 0x16
je 0x40ed53
jbe 0x40ed7f
cmp eax, 0x18
jbe 0x40ed25
cmp eax, 0x3f3
jne 0x40ed7f
lea ecx, [esi + 0x27c]
call fcn.00401f71
jmp 0x40ed7f
lea eax, [ebp - 0x28]
push eax
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x28]
sub ecx, dword [ebp - 0x24]
movzx eax, ax
movzx ecx, cx
shl eax, 0x10
or eax, ecx
push eax
push 0
push 5
jmp 0x40ec90
mov ecx, esi
call fcn.0040dff6
jmp 0x40ed7f
mov ecx, esi
call fcn.0040fe52
jmp 0x40ed7f
mov ecx, esi
call fcn.0040fe43
jmp 0x40ed7f
push dword [esi + 0x268]
mov ecx, dword [esi + 0x26c]
call fcn.0040b622
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4