Function at 0x489940
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4e85ed
mov eax, dword fs:[0]
push eax
sub esp, 0x84c
mov eax, dword [0x50e74c]
xor eax, esp
mov dword [esp + 0x844], eax
push esi
push edi
mov eax, dword [0x50e74c]
xor eax, esp
push eax
lea eax, [esp + 0x858]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x10], edi
xor eax, eax
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], 0
mov byte [esp + 0x16], 0
mov byte [esp + 0x17], 0
mov dword [esp + 0x60], 7
mov dword [esp + 0x5c], 0
mov word [esp + 0x4c], ax
mov dword [esp + 0x860], eax
mov esi, dword [edi + 4]
cmp esi, dword [edi + 8]
je 0x489e22
lea esp, [esp]
mov ecx, esi
call fcn.00493d20
test al, al
jne 0x489e13
cmp dword [esi + 0x30], 8
lea edi, [esi + 0x1c]
jb 0x4899ec
mov ecx, dword [edi]
jmp 0x4899ee
mov ecx, edi
mov edx, str.2345haozip
call fcn.00495610
test al, al
je 0x489a0d
mov edi, dword [esp + 0x10]
mov ecx, edi
push esi
call fcn.0048b640
jmp 0x489e02
cmp dword [edi + 0x14], 8
jb 0x489a17
mov ecx, dword [edi]
jmp 0x489a19
mov ecx, edi
mov edx, 0x4fdfec
call fcn.00495610
test al, al
je 0x489a43
mov edi, dword [esp + 0x10]
mov ecx, edi
push esi
call fcn.0048bbe0
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x489e02
cmp dword [edi + 0x14], 8
jb 0x489a4d
mov ecx, dword [edi]
jmp 0x489a4f
mov ecx, edi
mov edx, str.jiasu
call fcn.00495610
test al, al
je 0x489a79
mov edi, dword [esp + 0x10]
mov ecx, edi
push esi
call fcn.0048c390
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x489e02
cmp dword [edi + 0x14], 8
jb 0x489a83
mov ecx, dword [edi]
jmp 0x489a85
mov ecx, edi
mov edx, str.desk
call fcn.00495610
test al, al
je 0x489aa9
mov edi, dword [esp + 0x10]
mov ecx, edi
push esi
mov byte [esp + 0x1a], 1
call fcn.0048c720
jmp 0x489e02
cmp dword [edi + 0x14], 8
jb 0x489ab3
mov ecx, dword [edi]
jmp 0x489ab5
mov ecx, edi
mov edx, str.movie
call fcn.00495610
test al, al
je 0x489ad9
mov edi, dword [esp + 0x10]
mov ecx, edi
push esi
mov byte [esp + 0x1b], 1
call fcn.0048c910
jmp 0x489e02
cmp dword [edi + 0x14], 8
jb 0x489ae3
mov ecx, dword [edi]
jmp 0x489ae5
mov ecx, edi
mov edx, str.2345pic
call fcn.00495610
test al, al
je 0x489b04
mov edi, dword [esp + 0x10]
mov ecx, edi
push esi
call fcn.0048cb00
jmp 0x489e02
cmp dword [edi + 0x14], 8
jb 0x489b0e
mov ecx, dword [edi]
jmp 0x489b10
mov ecx, edi
mov edx, str.2345pinyin
call fcn.00495610
test al, al
je 0x489b2f
mov edi, dword [esp + 0x10]
mov ecx, edi
push esi
call fcn.0048d0a0
jmp 0x489e02
cmp dword [edi + 0x14], 8
jb 0x489b39
mov ecx, dword [edi]
jmp 0x489b3b
mov ecx, edi
mov edx, str.2345zhushou
call fcn.00495610
test al, al
je 0x489b5a
mov edi, dword [esp + 0x10]
mov ecx, edi
push esi
call fcn.0048d470
jmp 0x489e02
cmp dword [edi + 0x14], 8
jb 0x489b64
mov ecx, dword [edi]
jmp 0x489b66
mov ecx, edi
mov edx, str.2345safe
call fcn.00495610
test al, al
je 0x489b8f
mov edi, dword [esp + 0x10]
cmp byte [edi + 0x47], 0
jne 0x489e13
push esi
mov ecx, edi
call fcn.0048d840
jmp 0x489e02
cmp dword [edi + 0x14], 8
jb 0x489b99
mov ecx, dword [edi]
jmp 0x489b9b
mov ecx, edi
mov edx, str.2345pcsafe
call fcn.00495610
test al, al
je 0x489bba
mov edi, dword [esp + 0x10]
mov ecx, edi
push esi
call fcn.0048da30
jmp 0x489e02
cmp dword [edi + 0x14], 8
jb 0x489bc4
mov ecx, dword [edi]
jmp 0x489bc6
mov ecx, edi
mov edx, str.guanjia
call fcn.00495610
test al, al
je 0x489be5
mov edi, dword [esp + 0x10]
mov ecx, edi
push esi
call fcn.0048e0f0
jmp 0x489e02
cmp dword [edi + 0x14], 8
jb 0x489bef
mov ecx, dword [edi]
jmp 0x489bf1
mov ecx, edi
mov edx, str.kuwo
call fcn.00495610
test al, al
je 0x489c10
mov edi, dword [esp + 0x10]
mov ecx, edi
push esi
call fcn.0048e390
jmp 0x489e02
cmp dword [edi + 0x14], 8
jb 0x489c1a
mov ecx, dword [edi]
jmp 0x489c1c
mov ecx, edi
mov edx, str.kugou
call fcn.00495610
test al, al
je 0x489c3b
mov edi, dword [esp + 0x10]
mov ecx, edi
push esi
call fcn.0048e5f0
jmp 0x489e02
cmp dword [edi + 0x14], 8
jb 0x489c45
mov ecx, dword [edi]
jmp 0x489c47
mov ecx, edi
mov edx, str.sohu
call fcn.00495610
test al, al
je 0x489c66
mov edi, dword [esp + 0x10]
mov ecx, edi
push esi
call fcn.0048e880
jmp 0x489e02
cmp dword [edi + 0x14], 8
jb 0x489c70
mov ecx, dword [edi]
jmp 0x489c72
mov ecx, edi
mov edx, str.iqiyi
call fcn.00495610
test al, al
je 0x489c91
mov edi, dword [esp + 0x10]
mov ecx, edi
push esi
call fcn.0048ecc0
jmp 0x489e02
cmp dword [edi + 0x14], 8
jb 0x489c9b
mov ecx, dword [edi]
jmp 0x489c9d
mov ecx, edi
mov edx, str.cqby
call fcn.00495610
test al, al
je 0x489cbc
mov edi, dword [esp + 0x10]
mov ecx, edi
push esi
call fcn.0048f0b0
jmp 0x489e02
cmp dword [edi + 0x14], 8
jb 0x489cc6
mov ecx, dword [edi]
jmp 0x489cc8
mov ecx, edi
mov edx, 0x4fe954
call fcn.00495610
test al, al
je 0x489ce7
mov edi, dword [esp + 0x10]
mov ecx, edi
push esi
call fcn.0048f2f0
jmp 0x489e02
cmp dword [edi + 0x14], 8
jb 0x489cf1
mov ecx, dword [edi]
jmp 0x489cf3
mov ecx, edi
mov edx, str.lkfish
call fcn.00495610
test al, al
je 0x489d12
mov edi, dword [esp + 0x10]
mov ecx, edi
push esi
call fcn.0048f530
jmp 0x489e02
cmp dword [edi + 0x14], 8
jb 0x489d1c
mov ecx, dword [edi]
jmp 0x489d1e
mov ecx, edi
mov edx, 0x4fe96c
call fcn.00495610
test al, al
je 0x489d3d
mov edi, dword [esp + 0x10]
mov ecx, edi
push esi
call fcn.0048f860
jmp 0x489e02
cmp dword [edi + 0x14], 8
jb 0x489d47
mov ecx, dword [edi]
jmp 0x489d49
mov ecx, edi
mov edx, str.qq2013
call fcn.00495610
push esi
test al, al
je 0x489d68
mov edi, dword [esp + 0x14]
mov ecx, edi
call fcn.00490120
jmp 0x489e02
mov ecx, dword [esp + 0x14]
call fcn.004903a0
cmp dword [edi + 0x14], 8
jb 0x489d79
mov edi, dword [edi]
mov edx, str.qudongrs
mov ecx, edi
call fcn.00495610
test al, al
je 0x489dfe
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x30], esp
push str.DriveTheLife.exe
call fcn.004029f0
mov byte [esp + 0x878], 1
mov byte [esp + 0x878], 0
call fcn.004878f0
mov ecx, esp
mov dword [esp + 0x30], esp
push str.DTLService.exe
call fcn.004029f0
mov byte [esp + 0x878], 2
mov byte [esp + 0x878], 0
call fcn.004878f0
mov ecx, esp
mov dword [esp + 0x30], esp
push str.DriveTheLife2013
call fcn.004029f0
mov byte [esp + 0x878], 3
mov byte [esp + 0x878], 0
call fcn.00487a40
add esp, 0x18
mov edi, dword [esp + 0x10]
push 0xffffffffffffffff
push 0
lea eax, [esi + 0x68]
push eax
lea ecx, [esp + 0x58]
call fcn.004033c0
add esi, 0xa4
cmp esi, dword [edi + 8]
jne 0x4899d0
call fcn.004920d0
call fcn.00492200
cmp byte [edi + 0x10], 0
je 0x489e42
push 3
push 0x4fe9f8
lea ecx, [esp + 0x54]
call fcn.00479c40
cmp byte [edi + 0x11], 0
je 0x489e58
push 3
push 0x4fe9f0
lea ecx, [esp + 0x54]
call fcn.00479c40
cmp byte [edi + 0x12], 0
je 0x489e84
push 3
push 0x4fea08
lea ecx, [esp + 0x54]
call fcn.00479c40
cmp byte [edi + 0x12], 0
je 0x489e84
push 3
push 0x4fea08
lea ecx, [esp + 0x54]
call fcn.00479c40
mov eax, dword [edi + 0x6c]
cmp byte [eax + 0x1c], 0
je 0x489e9d
push 3
push 0x4fea00
lea ecx, [esp + 0x54]
call fcn.00479c40
push 0
push 0
push 0x3000
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov eax, dword [0x70e010]
test al, 1
jne 0x489ee4
or eax, 1
mov dword [0x70e010], eax
mov byte [esp + 0x860], 4
call fcn.00488270
push 0x4ec510
call fcn.004c59e4
add esp, 4
mov byte [esp + 0x860], 0
push 0
mov edx, 0x70e01c
lea ecx, [esp + 0x80]
call fcn.00498120
add esp, 4
mov byte [esp + 0x860], 5
lea edx, [esp + 0x4c]
push 0
lea ecx, [esp + 0x98]
call fcn.00498120
add esp, 4
mov byte [esp + 0x860], 6
lea eax, [esp + 0xac]
push 0x780
push 0
push eax
call fcn.004cb9a0
mov eax, dword [0x4fea30]
add esp, 0xc
movdqu xmm0, xmmword [str.update.jifen.2345.com]
mov dword [esp + 0x1bc], eax
mov ax, word [0x4fea34]
mov word [esp + 0x1c0], ax
mov eax, dword [0x70e010]
movdqu xmmword [esp + 0x1ac], xmm0
test al, 1
jne 0x489f99
or eax, 1
mov dword [0x70e010], eax
mov byte [esp + 0x860], 7
call fcn.00488270
push 0x4ec510
call fcn.004c59e4
add esp, 4
mov byte [esp + 0x860], 6
mov eax, dword [0x70e010]
mov ecx, dword [0x70e110]
cmp ecx, 6
jne 0x489fc0
mov eax, dword [0x4fea18]
movq xmm0, qword [str._p6_index.php]
mov dword [esp + 0x234], eax
mov ax, word [0x4fea1c]
jmp 0x48a02f
test al, 1
jne 0x489ff4
or eax, 1
mov dword [0x70e010], eax
mov byte [esp + 0x860], 8
call fcn.00488270
push 0x4ec510
call fcn.004c59e4
add esp, 4
mov byte [esp + 0x860], 6
mov ecx, dword [0x70e110]
cmp ecx, 7
jne 0x48a015
mov eax, dword [0x4fea50]
movq xmm0, qword [str._p7_index.php]
mov dword [esp + 0x234], eax
mov ax, word [0x4fea54]
jmp 0x48a02f
mov eax, dword [0x4fea40]
movq xmm0, qword [str._p4_index.php]
mov dword [esp + 0x234], eax
mov ax, word [0x4fea44]
cmp dword [esp + 0x90], 0x10
lea ecx, [esp + 0x7c]
mov word [esp + 0x238], ax
lea edx, [esp + 0x42c]
mov eax, dword [str.jifen]
cmovae ecx, dword [esp + 0x7c]
mov dword [esp + 0x2ac], eax
movzx eax, word [0x4fea68]
mov word [esp + 0x2b0], ax
movzx eax, word [0x4fea60]
mov word [esp + 0x334], ax
mov al, byte [0x4fea62]
mov byte [esp + 0x336], al
mov eax, dword [str.000010]
mov dword [esp + 0x3ac], eax
movzx eax, word [0x4fea78]
movq qword [esp + 0x22c], xmm0
movq xmm0, qword [str.jifen_heji]
mov word [esp + 0x3b0], ax
mov al, byte [0x4fea7a]
movq qword [esp + 0x32c], xmm0
mov byte [esp + 0x3b2], al
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx], al
lea edx, [edx + 1]
test al, al
jne 0x48a0c6
mov byte [esp + 0x830], al
xorps xmm0, xmm0
mov byte [esp + 0x84f], al
lea eax, [esp + 0x830]
push 0xa
push eax
push 0xf
movdqu xmmword [esp + 0x83d], xmm0
mov dword [esp + 0x855], 0
movq qword [esp + 0x84d], xmm0
mov word [esp + 0x859], 0
call fcn.004e4b34
add esp, 0xc
xor ecx, ecx
mov al, byte [esp + ecx + 0x830]
lea ecx, [ecx + 1]
mov byte [esp + ecx + 0x4ab], al
test al, al
jne 0x48a122
lea edi, [esp + 0x4ac]
dec edi
nop
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x48a140
mov ax, word [0x4fda9c]
mov word [edi], ax
lea eax, [esp + 0x830]
push 0xa
push eax
push 8
call fcn.004e4b34
lea edx, [esp + 0x83c]
add esp, 0xc
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x48a170
lea edi, [esp + 0x4ac]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x48a181
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x4ac]
dec ecx
nop
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x48a1a0
mov eax, dword [str..0.1]
lea edx, [esp + 0x62c]
cmp dword [esp + 0xa8], 0x10
movq xmm0, qword [str.software]
mov dword [ecx], eax
mov al, byte [0x4fea70]
mov byte [ecx + 4], al
lea ecx, [esp + 0x94]
mov al, byte [0x4feb1c]
cmovae ecx, dword [esp + 0x94]
movq qword [esp + 0x5ac], xmm0
mov byte [esp + 0x5b4], al
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx], al
lea edx, [edx + 1]
test al, al
jne 0x48a1f4
mov eax, dword [0x70e124]
test al, 1
jne 0x48a289
or eax, 1
mov dword [0x70e124], eax
mov byte [esp + 0x860], 9
xor eax, eax
mov dword [0x70e138], 0
mov dword [0x70e13c], 0
mov dword [0x70e13c], 7
mov dword [0x70e138], 0
mov word [0x70e128], ax
mov byte [esp + 0x860], 0xa
mov ecx, 0x70e140
call fcn.0049c400
mov byte [esp + 0x860], 0xb
mov byte [0x70e230], 1
mov byte [esp + 0x860], 9
push 0x4ec630
call fcn.004c59e4
add esp, 4
mov byte [esp + 0x860], 6
lea ecx, [esp + 0xac]
mov byte [0x70e230], 0
call fcn.00499f30
cmp byte [esp + 0x16], 0
jne 0x48a2ae
cmp byte [esp + 0x17], 0
je 0x48a675
push 0x1770
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], 0
mov dword [esp + 0x78], 7
mov dword [esp + 0x74], 0
mov word [esp + 0x64], ax
mov byte [esp + 0x860], 0xc
lea edx, [esp + 0x64]
lea ecx, [eax + 0x1a]
call fcn.00487010
test al, al
je 0x48a443
cmp dword [esp + 0x74], 0
je 0x48a443
mov edx, 0x4fff04
lea ecx, [esp + 0x64]
call fcn.00495820
cmp dword [esp + 0x74], 0
je 0x48a329
push 0x5c
push 1
lea ecx, [esp + 0x6c]
call fcn.00495d60
push str.MicrosoftInternet_ExplorerQuick_LaunchUser_PinnedTaskBar2345
lea edx, [esp + 0x68]
lea ecx, [esp + 0x38]
call fcn.00492a30
mov byte [esp + 0x864], 0xe
sub esp, 0x14
mov ecx, esp
mov dword [esp + 0x30], esp
xor eax, eax
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esp + 0x54]
push eax
call fcn.00403000
mov byte [esp + 0x878], 0xf
mov byte [esp + 0x878], 0xe
call fcn.004890a0
push 0x4feb30
lea edx, [esp + 0x80]
lea ecx, [esp + 0x38]
call fcn.00492a30
mov byte [esp + 0x87c], 0x10
add esp, 4
mov ecx, esp
mov dword [esp + 0x30], esp
xor eax, eax
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esp + 0x3c]
push eax
call fcn.00403000
mov byte [esp + 0x878], 0x11
mov byte [esp + 0x878], 0x10
call fcn.004890a0
add esp, 0x18
mov byte [esp + 0x860], 0xe
cmp dword [esp + 0x30], 8
jb 0x48a3fa
push dword [esp + 0x1c]
call fcn.004c515a
add esp, 4
xor eax, eax
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], 0
mov word [esp + 0x1c], ax
mov byte [esp + 0x860], 0xc
cmp dword [esp + 0x48], 8
jb 0x48a42c
push dword [esp + 0x34]
call fcn.004c515a
add esp, 4
xor eax, eax
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], 0
mov word [esp + 0x34], ax
push 5
xor eax, eax
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
lea ecx, [esp + 0x38]
push str.2345_
mov dword [esp + 0x50], 7
mov dword [esp + 0x4c], 0
mov word [esp + 0x3c], ax
call fcn.00403120
mov byte [esp + 0x860], 0x12
mov eax, dword [0x70e010]
test al, 1
jne 0x48a4b5
or eax, 1
mov dword [0x70e010], eax
mov byte [esp + 0x860], 0x13
call fcn.00488270
push 0x4ec510
call fcn.004c59e4
add esp, 4
mov byte [esp + 0x860], 0x12
push 0xffffffffffffffff
push 0
push 0x70e01c
lea ecx, [esp + 0x40]
call fcn.004033c0
push 0xa
push str._movie.exe
lea ecx, [esp + 0x3c]
call fcn.00479c40
sub esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [esp + 0x30], esp
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esp + 0x54]
push eax
call fcn.00403000
mov byte [esp + 0x878], 0x14
mov byte [esp + 0x878], 0x12
call fcn.004878f0
add esp, 0x18
mov byte [esp + 0x860], 0xc
cmp dword [esp + 0x48], 8
jb 0x48a533
push dword [esp + 0x34]
call fcn.004c515a
add esp, 4
xor eax, eax
mov dword [esp + 0x48], 7
push 5
mov dword [esp + 0x30], eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x34], eax
push str.2345_
mov dword [esp + 0x4c], 0
mov word [esp + 0x3c], ax
mov dword [esp + 0x38], 7
mov dword [esp + 0x34], eax
mov word [esp + 0x24], ax
call fcn.00403120
mov byte [esp + 0x860], 0x15
mov eax, dword [0x70e010]
test al, 1
jne 0x48a5ae
or eax, 1
mov dword [0x70e010], eax
mov byte [esp + 0x860], 0x16
call fcn.00488270
push 0x4ec510
call fcn.004c59e4
add esp, 4
mov byte [esp + 0x860], 0x15
push 0xffffffffffffffff
push 0
push 0x70e01c
lea ecx, [esp + 0x28]
call fcn.004033c0
push 9
push str._desk.exe
lea ecx, [esp + 0x24]
call fcn.00479c40
sub esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [esp + 0x30], esp
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esp + 0x3c]
push eax
call fcn.00403000
mov byte [esp + 0x878], 0x17
mov byte [esp + 0x878], 0x15
call fcn.004878f0
add esp, 0x18
mov byte [esp + 0x860], 0xc
cmp dword [esp + 0x30], 8
jb 0x48a62c
push dword [esp + 0x1c]
call fcn.004c515a
add esp, 4
xor eax, eax
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], 0
mov word [esp + 0x1c], ax
mov byte [esp + 0x860], 6
cmp dword [esp + 0x78], 8
jb 0x48a65e
push dword [esp + 0x64]
call fcn.004c515a
add esp, 4
xor eax, eax
mov dword [esp + 0x78], 7
mov dword [esp + 0x74], 0
mov word [esp + 0x64], ax
mov byte [esp + 0x860], 5
cmp dword [esp + 0xa8], 0x10
jb 0x48a696
push dword [esp + 0x94]
call fcn.004c515a
add esp, 4
mov dword [esp + 0xa8], 0xf
mov dword [esp + 0xa4], 0
mov byte [esp + 0x94], 0
mov byte [esp + 0x860], 0
cmp dword [esp + 0x90], 0x10
jb 0x48a6d2
push dword [esp + 0x7c]
call fcn.004c515a
add esp, 4
mov dword [esp + 0x90], 0xf
mov dword [esp + 0x8c], 0
mov byte [esp + 0x7c], 0
mov dword [esp + 0x860], 0xffffffff
cmp dword [esp + 0x60], 8
jb 0x48a70b
push dword [esp + 0x4c]
call fcn.004c515a
add esp, 4
xor eax, eax
mov dword [esp + 0x60], 7
mov dword [esp + 0x5c], 0
mov word [esp + 0x4c], ax
mov ecx, dword [esp + 0x858]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x844]
xor ecx, esp
call fcn.004c515f
mov esp, ebp
pop ebp
ret