Function at 0x489590
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4e82dd
mov eax, dword fs:[0]
push eax
sub esp, 0x84c
mov eax, dword [0x50e74c]
xor eax, esp
mov dword [esp + 0x844], eax
push esi
push edi
mov eax, dword [0x50e74c]
xor eax, esp
push eax
lea eax, [esp + 0x858]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x10], edi
xor eax, eax
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], 0
mov byte [esp + 0x16], 0
mov byte [esp + 0x17], 0
mov dword [esp + 0x60], 7
mov dword [esp + 0x5c], 0
mov word [esp + 0x4c], ax
mov dword [esp + 0x860], eax
mov esi, dword [edi + 4]
cmp esi, dword [edi + 8]
je 0x489a72
lea esp, [esp]
mov ecx, esi
call fcn.00493a80
test al, al
jne 0x489a63
cmp dword [esi + 0x30], 8
lea edi, [esi + 0x1c]
jb 0x48963c
mov ecx, dword [edi]
jmp 0x48963e
mov ecx, edi
mov edx, str.2345haozip
call fcn.00495370
test al, al
je 0x48965d
mov edi, dword [esp + 0x10]
mov ecx, edi
push esi
call fcn.0048b290
jmp 0x489a52
cmp dword [edi + 0x14], 8
jb 0x489667
mov ecx, dword [edi]
jmp 0x489669
mov ecx, edi
mov edx, 0x4fde0c
call fcn.00495370
test al, al
je 0x489693
mov edi, dword [esp + 0x10]
mov ecx, edi
push esi
call fcn.0048b830
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x489a52
cmp dword [edi + 0x14], 8
jb 0x48969d
mov ecx, dword [edi]
jmp 0x48969f
mov ecx, edi
mov edx, str.jiasu
call fcn.00495370
test al, al
je 0x4896c9
mov edi, dword [esp + 0x10]
mov ecx, edi
push esi
call fcn.0048bfe0
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x489a52
cmp dword [edi + 0x14], 8
jb 0x4896d3
mov ecx, dword [edi]
jmp 0x4896d5
mov ecx, edi
mov edx, str.desk
call fcn.00495370
test al, al
je 0x4896f9
mov edi, dword [esp + 0x10]
mov ecx, edi
push esi
mov byte [esp + 0x1a], 1
call fcn.0048c370
jmp 0x489a52
cmp dword [edi + 0x14], 8
jb 0x489703
mov ecx, dword [edi]
jmp 0x489705
mov ecx, edi
mov edx, str.movie
call fcn.00495370
test al, al
je 0x489729
mov edi, dword [esp + 0x10]
mov ecx, edi
push esi
mov byte [esp + 0x1b], 1
call fcn.0048c560
jmp 0x489a52
cmp dword [edi + 0x14], 8
jb 0x489733
mov ecx, dword [edi]
jmp 0x489735
mov ecx, edi
mov edx, str.2345pic
call fcn.00495370
test al, al
je 0x489754
mov edi, dword [esp + 0x10]
mov ecx, edi
push esi
call fcn.0048c750
jmp 0x489a52
cmp dword [edi + 0x14], 8
jb 0x48975e
mov ecx, dword [edi]
jmp 0x489760
mov ecx, edi
mov edx, str.2345pinyin
call fcn.00495370
test al, al
je 0x48977f
mov edi, dword [esp + 0x10]
mov ecx, edi
push esi
call fcn.0048ccf0
jmp 0x489a52
cmp dword [edi + 0x14], 8
jb 0x489789
mov ecx, dword [edi]
jmp 0x48978b
mov ecx, edi
mov edx, str.2345zhushou
call fcn.00495370
test al, al
je 0x4897aa
mov edi, dword [esp + 0x10]
mov ecx, edi
push esi
call fcn.0048d0c0
jmp 0x489a52
cmp dword [edi + 0x14], 8
jb 0x4897b4
mov ecx, dword [edi]
jmp 0x4897b6
mov ecx, edi
mov edx, str.2345safe
call fcn.00495370
test al, al
je 0x4897df
mov edi, dword [esp + 0x10]
cmp byte [edi + 0x47], 0
jne 0x489a63
push esi
mov ecx, edi
call fcn.0048d490
jmp 0x489a52
cmp dword [edi + 0x14], 8
jb 0x4897e9
mov ecx, dword [edi]
jmp 0x4897eb
mov ecx, edi
mov edx, str.2345pcsafe
call fcn.00495370
test al, al
je 0x48980a
mov edi, dword [esp + 0x10]
mov ecx, edi
push esi
call fcn.0048d680
jmp 0x489a52
cmp dword [edi + 0x14], 8
jb 0x489814
mov ecx, dword [edi]
jmp 0x489816
mov ecx, edi
mov edx, str.guanjia
call fcn.00495370
test al, al
je 0x489835
mov edi, dword [esp + 0x10]
mov ecx, edi
push esi
call fcn.0048dd40
jmp 0x489a52
cmp dword [edi + 0x14], 8
jb 0x48983f
mov ecx, dword [edi]
jmp 0x489841
mov ecx, edi
mov edx, str.kuwo
call fcn.00495370
test al, al
je 0x489860
mov edi, dword [esp + 0x10]
mov ecx, edi
push esi
call fcn.0048dff0
jmp 0x489a52
cmp dword [edi + 0x14], 8
jb 0x48986a
mov ecx, dword [edi]
jmp 0x48986c
mov ecx, edi
mov edx, str.kugou
call fcn.00495370
test al, al
je 0x48988b
mov edi, dword [esp + 0x10]
mov ecx, edi
push esi
call fcn.0048e230
jmp 0x489a52
cmp dword [edi + 0x14], 8
jb 0x489895
mov ecx, dword [edi]
jmp 0x489897
mov ecx, edi
mov edx, str.sohu
call fcn.00495370
test al, al
je 0x4898b6
mov edi, dword [esp + 0x10]
mov ecx, edi
push esi
call fcn.0048e4c0
jmp 0x489a52
cmp dword [edi + 0x14], 8
jb 0x4898c0
mov ecx, dword [edi]
jmp 0x4898c2
mov ecx, edi
mov edx, str.iqiyi
call fcn.00495370
test al, al
je 0x4898e1
mov edi, dword [esp + 0x10]
mov ecx, edi
push esi
call fcn.0048ea40
jmp 0x489a52
cmp dword [edi + 0x14], 8
jb 0x4898eb
mov ecx, dword [edi]
jmp 0x4898ed
mov ecx, edi
mov edx, str.cqby
call fcn.00495370
test al, al
je 0x48990c
mov edi, dword [esp + 0x10]
mov ecx, edi
push esi
call fcn.0048ee10
jmp 0x489a52
cmp dword [edi + 0x14], 8
jb 0x489916
mov ecx, dword [edi]
jmp 0x489918
mov ecx, edi
mov edx, 0x4fe760
call fcn.00495370
test al, al
je 0x489937
mov edi, dword [esp + 0x10]
mov ecx, edi
push esi
call fcn.0048f050
jmp 0x489a52
cmp dword [edi + 0x14], 8
jb 0x489941
mov ecx, dword [edi]
jmp 0x489943
mov ecx, edi
mov edx, str.lkfish
call fcn.00495370
test al, al
je 0x489962
mov edi, dword [esp + 0x10]
mov ecx, edi
push esi
call fcn.0048f290
jmp 0x489a52
cmp dword [edi + 0x14], 8
jb 0x48996c
mov ecx, dword [edi]
jmp 0x48996e
mov ecx, edi
mov edx, 0x4fe774
call fcn.00495370
test al, al
je 0x48998d
mov edi, dword [esp + 0x10]
mov ecx, edi
push esi
call fcn.0048f5c0
jmp 0x489a52
cmp dword [edi + 0x14], 8
jb 0x489997
mov ecx, dword [edi]
jmp 0x489999
mov ecx, edi
mov edx, str.qq2013
call fcn.00495370
push esi
test al, al
je 0x4899b8
mov edi, dword [esp + 0x14]
mov ecx, edi
call fcn.0048fe80
jmp 0x489a52
mov ecx, dword [esp + 0x14]
call fcn.00490100
cmp dword [edi + 0x14], 8
jb 0x4899c9
mov edi, dword [edi]
mov edx, str.qudongrs
mov ecx, edi
call fcn.00495370
test al, al
je 0x489a4e
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x30], esp
push str.DriveTheLife.exe
call fcn.004029f0
mov byte [esp + 0x878], 1
mov byte [esp + 0x878], 0
call fcn.004873c0
mov ecx, esp
mov dword [esp + 0x30], esp
push str.DTLService.exe
call fcn.004029f0
mov byte [esp + 0x878], 2
mov byte [esp + 0x878], 0
call fcn.004873c0
mov ecx, esp
mov dword [esp + 0x30], esp
push str.DriveTheLife2013
call fcn.004029f0
mov byte [esp + 0x878], 3
mov byte [esp + 0x878], 0
call fcn.00487510
add esp, 0x18
mov edi, dword [esp + 0x10]
push 0xffffffffffffffff
push 0
lea eax, [esi + 0x68]
push eax
lea ecx, [esp + 0x58]
call fcn.004033c0
add esi, 0xa4
cmp esi, dword [edi + 8]
jne 0x489620
call fcn.00491e30
call fcn.00491f60
cmp byte [edi + 0x10], 0
je 0x489a92
push 3
push 0x4fe7f4
lea ecx, [esp + 0x54]
call fcn.004794f0
cmp byte [edi + 0x11], 0
je 0x489aa8
push 3
push 0x4fe828
lea ecx, [esp + 0x54]
call fcn.004794f0
cmp byte [edi + 0x12], 0
je 0x489ad4
push 3
push 0x4fe820
lea ecx, [esp + 0x54]
call fcn.004794f0
cmp byte [edi + 0x12], 0
je 0x489ad4
push 3
push 0x4fe820
lea ecx, [esp + 0x54]
call fcn.004794f0
mov eax, dword [edi + 0x6c]
cmp byte [eax + 0x1c], 0
je 0x489aed
push 3
push 0x4fe848
lea ecx, [esp + 0x54]
call fcn.004794f0
push 0
push 0
push 0x3000
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov eax, dword [0x70e000]
test al, 1
jne 0x489b34
or eax, 1
mov dword [0x70e000], eax
mov byte [esp + 0x860], 4
call fcn.00487ee0
push 0x4ec240
call fcn.004c5734
add esp, 4
mov byte [esp + 0x860], 0
push 0
mov edx, 0x70e00c
lea ecx, [esp + 0x80]
call fcn.00497e80
add esp, 4
mov byte [esp + 0x860], 5
lea edx, [esp + 0x4c]
push 0
lea ecx, [esp + 0x98]
call fcn.00497e80
add esp, 4
mov byte [esp + 0x860], 6
lea eax, [esp + 0xac]
push 0x780
push 0
push eax
call fcn.004cb700
mov eax, dword [0x4fe840]
add esp, 0xc
movdqu xmm0, xmmword [str.update.jifen.2345.com]
mov dword [esp + 0x1bc], eax
mov ax, word [0x4fe844]
mov word [esp + 0x1c0], ax
mov eax, dword [0x70e000]
movdqu xmmword [esp + 0x1ac], xmm0
test al, 1
jne 0x489be9
or eax, 1
mov dword [0x70e000], eax
mov byte [esp + 0x860], 7
call fcn.00487ee0
push 0x4ec240
call fcn.004c5734
add esp, 4
mov byte [esp + 0x860], 6
mov eax, dword [0x70e000]
mov ecx, dword [0x70e100]
cmp ecx, 6
jne 0x489c10
mov eax, dword [0x4fe868]
movq xmm0, qword [str._p6_index.php]
mov dword [esp + 0x234], eax
mov ax, word [0x4fe86c]
jmp 0x489c7f
test al, 1
jne 0x489c44
or eax, 1
mov dword [0x70e000], eax
mov byte [esp + 0x860], 8
call fcn.00487ee0
push 0x4ec240
call fcn.004c5734
add esp, 4
mov byte [esp + 0x860], 6
mov ecx, dword [0x70e100]
cmp ecx, 7
jne 0x489c65
mov eax, dword [0x4fe858]
movq xmm0, qword [str._p7_index.php]
mov dword [esp + 0x234], eax
mov ax, word [0x4fe85c]
jmp 0x489c7f
mov eax, dword [0x4fe880]
movq xmm0, qword [str._p4_index.php]
mov dword [esp + 0x234], eax
mov ax, word [0x4fe884]
cmp dword [esp + 0x90], 0x10
lea ecx, [esp + 0x7c]
mov word [esp + 0x238], ax
lea edx, [esp + 0x42c]
mov eax, dword [str.jifen]
cmovae ecx, dword [esp + 0x7c]
mov dword [esp + 0x2ac], eax
movzx eax, word [0x4fe874]
mov word [esp + 0x2b0], ax
movzx eax, word [0x4fe898]
mov word [esp + 0x334], ax
mov al, byte [0x4fe89a]
mov byte [esp + 0x336], al
mov eax, dword [str.000010]
mov dword [esp + 0x3ac], eax
movzx eax, word [0x4fe88c]
movq qword [esp + 0x22c], xmm0
movq xmm0, qword [str.jifen_heji]
mov word [esp + 0x3b0], ax
mov al, byte [0x4fe88e]
movq qword [esp + 0x32c], xmm0
mov byte [esp + 0x3b2], al
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx], al
lea edx, [edx + 1]
test al, al
jne 0x489d16
mov byte [esp + 0x830], al
xorps xmm0, xmm0
mov byte [esp + 0x84f], al
lea eax, [esp + 0x830]
push 0xa
push eax
push 0xf
movdqu xmmword [esp + 0x83d], xmm0
mov dword [esp + 0x855], 0
movq qword [esp + 0x84d], xmm0
mov word [esp + 0x859], 0
call fcn.004e48a4
add esp, 0xc
xor ecx, ecx
mov al, byte [esp + ecx + 0x830]
lea ecx, [ecx + 1]
mov byte [esp + ecx + 0x4ab], al
test al, al
jne 0x489d72
lea edi, [esp + 0x4ac]
dec edi
nop
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x489d90
mov ax, word [0x4f8de0]
mov word [edi], ax
lea eax, [esp + 0x830]
push 0xa
push eax
push 7
call fcn.004e48a4
lea edx, [esp + 0x83c]
add esp, 0xc
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x489dc0
lea edi, [esp + 0x4ac]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x489dd1
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x4ac]
dec ecx
nop
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x489df0
mov eax, dword [str..0.1]
lea edx, [esp + 0x62c]
cmp dword [esp + 0xa8], 0x10
movq xmm0, qword [str.software]
mov dword [ecx], eax
mov al, byte [0x4fe8ac]
mov byte [ecx + 4], al
lea ecx, [esp + 0x94]
mov al, byte [0x4fe8a4]
cmovae ecx, dword [esp + 0x94]
movq qword [esp + 0x5ac], xmm0
mov byte [esp + 0x5b4], al
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx], al
lea edx, [edx + 1]
test al, al
jne 0x489e44
mov eax, dword [0x70e114]
test al, 1
jne 0x489ed9
or eax, 1
mov dword [0x70e114], eax
mov byte [esp + 0x860], 9
xor eax, eax
mov dword [0x70e128], 0
mov dword [0x70e12c], 0
mov dword [0x70e12c], 7
mov dword [0x70e128], 0
mov word [0x70e118], ax
mov byte [esp + 0x860], 0xa
mov ecx, 0x70e130
call fcn.0049c160
mov byte [esp + 0x860], 0xb
mov byte [0x70e220], 1
mov byte [esp + 0x860], 9
push 0x4ec360
call fcn.004c5734
add esp, 4
mov byte [esp + 0x860], 6
lea ecx, [esp + 0xac]
mov byte [0x70e220], 0
call fcn.00499c90
cmp byte [esp + 0x16], 0
jne 0x489efe
cmp byte [esp + 0x17], 0
je 0x48a2c5
push 0x1770
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], 0
mov dword [esp + 0x78], 7
mov dword [esp + 0x74], 0
mov word [esp + 0x64], ax
mov byte [esp + 0x860], 0xc
lea edx, [esp + 0x64]
lea ecx, [eax + 0x1a]
call fcn.004868d0
test al, al
je 0x48a093
cmp dword [esp + 0x74], 0
je 0x48a093
mov edx, 0x4ffe8c
lea ecx, [esp + 0x64]
call fcn.00495580
cmp dword [esp + 0x74], 0
je 0x489f79
push 0x5c
push 1
lea ecx, [esp + 0x6c]
call fcn.00495ac0
push str.MicrosoftInternet_ExplorerQuick_LaunchUser_PinnedTaskBar2345
lea edx, [esp + 0x68]
lea ecx, [esp + 0x38]
call fcn.00492790
mov byte [esp + 0x864], 0xe
sub esp, 0x14
mov ecx, esp
mov dword [esp + 0x30], esp
xor eax, eax
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esp + 0x54]
push eax
call fcn.00403000
mov byte [esp + 0x878], 0xf
mov byte [esp + 0x878], 0xe
call fcn.00488d10
push 0x4fe8b0
lea edx, [esp + 0x80]
lea ecx, [esp + 0x38]
call fcn.00492790
mov byte [esp + 0x87c], 0x10
add esp, 4
mov ecx, esp
mov dword [esp + 0x30], esp
xor eax, eax
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esp + 0x3c]
push eax
call fcn.00403000
mov byte [esp + 0x878], 0x11
mov byte [esp + 0x878], 0x10
call fcn.00488d10
add esp, 0x18
mov byte [esp + 0x860], 0xe
cmp dword [esp + 0x30], 8
jb 0x48a04a
push dword [esp + 0x1c]
call fcn.004c4eaa
add esp, 4
xor eax, eax
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], 0
mov word [esp + 0x1c], ax
mov byte [esp + 0x860], 0xc
cmp dword [esp + 0x48], 8
jb 0x48a07c
push dword [esp + 0x34]
call fcn.004c4eaa
add esp, 4
xor eax, eax
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], 0
mov word [esp + 0x34], ax
push 5
xor eax, eax
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
lea ecx, [esp + 0x38]
push str.2345_
mov dword [esp + 0x50], 7
mov dword [esp + 0x4c], 0
mov word [esp + 0x3c], ax
call fcn.00403120
mov byte [esp + 0x860], 0x12
mov eax, dword [0x70e000]
test al, 1
jne 0x48a105
or eax, 1
mov dword [0x70e000], eax
mov byte [esp + 0x860], 0x13
call fcn.00487ee0
push 0x4ec240
call fcn.004c5734
add esp, 4
mov byte [esp + 0x860], 0x12
push 0xffffffffffffffff
push 0
push 0x70e00c
lea ecx, [esp + 0x40]
call fcn.004033c0
push 0xa
push str._movie.exe
lea ecx, [esp + 0x3c]
call fcn.004794f0
sub esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [esp + 0x30], esp
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esp + 0x54]
push eax
call fcn.00403000
mov byte [esp + 0x878], 0x14
mov byte [esp + 0x878], 0x12
call fcn.004873c0
add esp, 0x18
mov byte [esp + 0x860], 0xc
cmp dword [esp + 0x48], 8
jb 0x48a183
push dword [esp + 0x34]
call fcn.004c4eaa
add esp, 4
xor eax, eax
mov dword [esp + 0x48], 7
push 5
mov dword [esp + 0x30], eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x34], eax
push str.2345_
mov dword [esp + 0x4c], 0
mov word [esp + 0x3c], ax
mov dword [esp + 0x38], 7
mov dword [esp + 0x34], eax
mov word [esp + 0x24], ax
call fcn.00403120
mov byte [esp + 0x860], 0x15
mov eax, dword [0x70e000]
test al, 1
jne 0x48a1fe
or eax, 1
mov dword [0x70e000], eax
mov byte [esp + 0x860], 0x16
call fcn.00487ee0
push 0x4ec240
call fcn.004c5734
add esp, 4
mov byte [esp + 0x860], 0x15
push 0xffffffffffffffff
push 0
push 0x70e00c
lea ecx, [esp + 0x28]
call fcn.004033c0
push 9
push str._desk.exe
lea ecx, [esp + 0x24]
call fcn.004794f0
sub esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [esp + 0x30], esp
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esp + 0x3c]
push eax
call fcn.00403000
mov byte [esp + 0x878], 0x17
mov byte [esp + 0x878], 0x15
call fcn.004873c0
add esp, 0x18
mov byte [esp + 0x860], 0xc
cmp dword [esp + 0x30], 8
jb 0x48a27c
push dword [esp + 0x1c]
call fcn.004c4eaa
add esp, 4
xor eax, eax
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], 0
mov word [esp + 0x1c], ax
mov byte [esp + 0x860], 6
cmp dword [esp + 0x78], 8
jb 0x48a2ae
push dword [esp + 0x64]
call fcn.004c4eaa
add esp, 4
xor eax, eax
mov dword [esp + 0x78], 7
mov dword [esp + 0x74], 0
mov word [esp + 0x64], ax
mov byte [esp + 0x860], 5
cmp dword [esp + 0xa8], 0x10
jb 0x48a2e6
push dword [esp + 0x94]
call fcn.004c4eaa
add esp, 4
mov dword [esp + 0xa8], 0xf
mov dword [esp + 0xa4], 0
mov byte [esp + 0x94], 0
mov byte [esp + 0x860], 0
cmp dword [esp + 0x90], 0x10
jb 0x48a322
push dword [esp + 0x7c]
call fcn.004c4eaa
add esp, 4
mov dword [esp + 0x90], 0xf
mov dword [esp + 0x8c], 0
mov byte [esp + 0x7c], 0
mov dword [esp + 0x860], 0xffffffff
cmp dword [esp + 0x60], 8
jb 0x48a35b
push dword [esp + 0x4c]
call fcn.004c4eaa
add esp, 4
xor eax, eax
mov dword [esp + 0x60], 7
mov dword [esp + 0x5c], 0
mov word [esp + 0x4c], ax
mov ecx, dword [esp + 0x858]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x844]
xor ecx, esp
call fcn.004c4eaf
mov esp, ebp
pop ebp
ret