Function for the in-game browser is: sub_7A2FDD
Hook it, or cave it in general, and replace it entirely to open the users external browser. (ie. ShellExecute or CreateProcess)
This function is used for all instances of the client trying to start the internal browser, not just the cash shop. So the url generated will depend on how its being accessed. For the cash shop, the client generates the url from the login server's CASHWEB_URL configuration. Appended to that url will be the GET args. Those args are:
v1 = The players 'UserId'. (From the account table.)
v2 = The players 'AuthKey'. (From the account table.)
nt = The players language id of their client to tell the cash shop which language to display as. Generally this will be 6 unless you modded the commonly used client otherwise.