Function at 0x6124d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
push str.Sc_Notify_Ban___login
call fcn.00405d90
mov eax, dword [ebp + 8]
xor ebx, ebx
mov edi, 0x7bd64c
or ecx, 0xffffffff
mov bl, byte [eax + 2]
xor eax, eax
add esp, 4
lea edx, [ebp - 0x104]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00419190
mov ecx, eax
call fcn.00418890
cmp ebx, 0x6e
ja case.0x612539.0
xor ecx, ecx
mov cl, byte [ebx + 0x6128b8]
jmp dword [ecx*4 + 0x612844]
push 4
jmp 0x61278b
push str.BAN_ANOTHER_LOGIN___login
call fcn.00405d90
push 5
call fcn.0057ed70
add esp, 8
jmp 0x612793
push 0xf1
jmp 0x61278b
push 0x108
jmp 0x61278b
push 0x131
jmp 0x61278b
push 0x1b6
call fcn.0057ed70
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x104]
mov eax, ecx
mov esi, edi
mov edi, edx
push str.message
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0
and ecx, 3
push 1
rep movsb byte es:[edi], byte [esi]
push 1
lea ecx, [ebp - 0x104]
push 2
push ecx
mov ecx, 0x7d67b0
call fcn.005069d0
cmp eax, 0x7d
jne case.0x6125eb.2
mov ecx, 0x80fe50
call fcn.00530d40
mov eax, dword [0x80fe3c]
cmp eax, 3
ja case.default.0x6125eb
jmp dword [eax*4 + 0x612928]
mov eax, dword [0x83a14c]
push 1
cmp eax, 1
push 0
push 0
jne 0x612656
push 0x51c
call fcn.0057ed70
mov edx, dword [0x83a870]
add esp, 4
push eax
push str.open
push edx
jmp 0x61266f
mov ecx, dword [0x83a870]
push 1
push 0
push 0
push str.https:__iro.ragnarokonline.com_member_memberjoin1.asp_mNum1
push str.open
push ecx
jmp 0x61266f
mov edx, dword [0x83a870]
push 1
push 0
push 0
push str.http:__ro.sdo.com_business_index.asp_a3
push str.open
push edx
jmp 0x61266f
push 1
push 0
push 0
push 0x210
call fcn.0057ed70
add esp, 4
push eax
mov eax, dword [0x83a870]
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea edx, [ebp - 0x104]
mov edi, 0x7bd64c
jmp 0x61279b
push 0x1b7
jmp 0x61278b
push 0x1b8
jmp 0x61278b
push 0x211
jmp 0x61278b
push 0x212
jmp 0x61278b
push 0x23f
jmp 0x61278b
push 0x240
jmp 0x61278b
push 0x241
jmp 0x61278b
push 0x242
jmp 0x61278b
push 0x25e
jmp 0x61278b
push 0x25f
jmp 0x61278b
push 0x2a6
jmp 0x61278b
push 0x463
jmp 0x61278b
push 0x49a
jmp 0x61278b
push 0x49b
jmp 0x61278b
push 0x51d
jmp 0x61278b
push 0x51e
jmp 0x61278b
push 0x51f
jmp 0x61278b
mov eax, dword [0x80fe3c]
test eax, eax
jne case.0x612539.25
push 9
push 0x595
call fcn.0057ed70
add esp, 4
lea ecx, [ebp - 0x1cc]
push eax
push ecx
call fcn.0070dea8
lea edi, [ebp - 0x1cc]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x104]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x62e
jmp 0x61278b
push 0x62f
jmp 0x61278b
push 0x635
jmp 0x61278b
push 3
call fcn.0057ed70
add esp, 4
lea edx, [ebp - 0x104]
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x104]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
pop edi
dec ecx
pop esi
pop ebx
je 0x612829
mov edx, dword [ebp + 8]
xor ecx, ecx
lea eax, [ebp - 0x104]
mov cl, byte [edx + 2]
push ecx
push eax
lea ecx, [ebp - 0x204]
push str._s__d_
push ecx
call fcn.0070dea8
add esp, 0x10
lea edx, [ebp - 0x204]
mov ecx, 0x7d67b0
push str.message
push 0
push 1
push 1
push 0
push edx
call fcn.005069d0
mov eax, dword [ebp - 4]
mov dword [0x80feb0], 0
mov dword [eax + 0xc], 3
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
mov dword [0x80feb0], 0
mov dword [ecx + 0xc], 3
mov esp, ebp
pop ebp
ret 4