Function at 0x567630
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x50
push ebx
push edi
mov edi, ecx
xor ebx, ebx
xor eax, eax
mov dword [esp + 8], edi
mov ecx, dword [edi + 0x84]
mov dword [esp + 0xc], eax
cmp ecx, ebx
jle 0x567c10
push ebp
push esi
jmp 0x567659
mov eax, dword [esp + 0x14]
mov edx, dword [0xcf95d4]
mov esi, dword [edi + 0x68]
mov ecx, dword [0xcf95d0]
lea ebp, [eax*8]
sub ebp, eax
push edx
shl ebp, 2
mov eax, ebp
push ecx
add eax, esi
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x567bf7
mov eax, dword [edi + 0x68]
cmp dword [eax + ebp + 0x18], ebx
je 0x567bf7
mov eax, dword [esp + 0x14]
cmp eax, 0xe
ja case.default.0x5676a5
mov ecx, eax
jmp dword [ecx*4 + 0x567c18]
mov edx, dword [0xa2af98]
push 5
push 0x68ef6c
push 0x68ef6c
push str.http:__shop.7ma.cn_ShoopMall_SelectServer.aspx
push str.open
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp case.default.0x5676a5
mov ecx, 5
mov esi, str.12345678901234567890
lea edi, [esp + 0x48]
lea eax, [esp + 0x48]
rep movsd dword es:[edi], dword [esi]
push 0x15
push eax
push 0x408
movsb byte es:[edi], byte [esi]
call fcn.004ac410
mov edi, dword [esp + 0x1c]
add esp, 0xc
jmp case.default.0x5676a5
mov edx, dword [0xd114b4]
xor ecx, ecx
cmp edx, ebx
sete cl
mov esi, ecx
cmp esi, ebx
je 0x56771a
call fcn.005a2270
cmp dword [0xd114b4], esi
je case.default.0x5676a5
cmp esi, ebx
mov dword [0xd114b4], esi
jne case.default.0x5676a5
cmp dword [0xd11508], ebx
je 0x567a25
push ebx
push ebx
push 0xd1150c
push 0xd11508
jmp 0x567a1d
mov ecx, dword [0xcfb0ac]
xor edx, edx
cmp ecx, ebx
sete dl
mov esi, edx
cmp esi, ebx
je 0x567769
call fcn.005a2270
cmp dword [0xcfb0ac], esi
je case.default.0x5676a5
cmp esi, ebx
mov dword [0xcfb0ac], esi
jne case.default.0x5676a5
cmp dword [0xcfb100], ebx
je 0x567a25
push ebx
push ebx
push 0xcfb104
push 0xcfb100
jmp 0x567a1d
mov ecx, dword [0xcecbb4]
xor eax, eax
cmp ecx, ebx
sete al
mov esi, eax
cmp esi, ebx
je 0x5677b8
call fcn.005a2270
cmp dword [0xcecbb4], esi
je case.default.0x5676a5
cmp esi, ebx
mov dword [0xcecbb4], esi
jne case.default.0x5676a5
cmp dword [0xcecc08], ebx
je 0x567a25
push ebx
push ebx
push 0xcecc0c
push 0xcecc08
jmp 0x567a1d
mov ecx, dword [0xa2af98]
push 5
push 0x68ef6c
push 0x68ef6c
push str.http:__tx.7ma.cn
push str.open
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp case.default.0x5676a5
call fcn.004e81f0
jmp case.default.0x5676a5
mov ecx, dword [0xcea35c]
xor edx, edx
cmp ecx, ebx
sete dl
mov esi, edx
cmp esi, ebx
je 0x567839
call fcn.005a2270
cmp dword [0xcea35c], esi
je case.default.0x5676a5
cmp esi, ebx
mov dword [0xcea35c], esi
jne case.default.0x5676a5
cmp dword [0xcea3b0], ebx
je 0x567a25
push ebx
push ebx
push 0xcea3b4
push 0xcea3b0
jmp 0x567a1d
mov ecx, dword [0xcf94c4]
xor eax, eax
cmp ecx, ebx
sete al
mov esi, eax
cmp esi, ebx
je 0x567888
call fcn.005a2270
cmp dword [0xcf94c4], esi
je case.default.0x5676a5
cmp esi, ebx
mov dword [0xcf94c4], esi
jne case.default.0x5676a5
cmp dword [0xcf9518], ebx
je 0x567a25
push ebx
push ebx
push 0xcf951c
push 0xcf9518
jmp 0x567a1d
mov eax, dword [0xa4f274]
mov edi, 0xa558b4
cmp eax, ebx
je 0x567968
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ebx
push ebx
cmp ecx, 2
push ebx
push ebx
jae 0x5678eb
push 0x671e18
jmp 0x5678f0
push 0xa558b4
call fcn.004cbc90
mov edi, 0xa559e0
or ecx, 0xffffffff
xor eax, eax
add esp, 0x14
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ebx
push ebx
cmp ecx, 2
push ebx
push ebx
jae 0x567917
push 0x671e18
jmp 0x56791c
push 0xa559e0
call fcn.004cbc90
mov edi, 0xa55784
or ecx, 0xffffffff
xor eax, eax
add esp, 0x14
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ebx
push ebx
cmp ecx, 2
push ebx
push ebx
jae 0x567952
push 0x671e18
call fcn.004cbc90
mov edi, dword [esp + 0x24]
add esp, 0x14
jmp case.default.0x5676a5
push 0xa55784
call fcn.004cbc90
mov edi, dword [esp + 0x24]
add esp, 0x14
jmp case.default.0x5676a5
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ebx
push ebx
cmp ecx, 2
push ebx
push ebx
jae 0x567982
push 0x66c15c
jmp 0x567987
push 0xa558b4
call fcn.004cbc90
mov edi, 0xa559e0
or ecx, 0xffffffff
xor eax, eax
add esp, 0x14
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ebx
push ebx
cmp ecx, 2
push ebx
push ebx
jae 0x5679ae
push 0x66c15c
jmp 0x5679b3
push 0xa559e0
call fcn.004cbc90
mov edi, 0xa55784
or ecx, 0xffffffff
xor eax, eax
add esp, 0x14
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ebx
push ebx
cmp ecx, 2
push ebx
push ebx
jae 0x567952
push 0x66c15c
call fcn.004cbc90
mov edi, dword [esp + 0x24]
add esp, 0x14
jmp case.default.0x5676a5
mov eax, dword [0xd11344]
cmp eax, ebx
je 0x567a40
mov eax, dword [0xd11398]
mov byte [0xd11430], bl
cmp eax, ebx
mov byte [0xd113aa], bl
mov dword [0xd11344], ebx
je 0x567a25
push ebx
push ebx
push 0xd1139c
push 0xd11398
call fcn.005a6840
add esp, 0x10
mov eax, dword [0xd0af88]
cmp eax, ebx
je case.default.0x5676a5
push eax
call fcn.004e6ba0
add esp, 4
jmp case.default.0x5676a5
mov byte [0xd11430], 1
mov byte [0xd113aa], 1
call fcn.005a2270
cmp dword [0xd11344], 1
je case.default.0x5676a5
mov dword [0xd11344], 1
jmp case.default.0x5676a5
cmp byte [edi + 0x80], bl
sete cl
mov byte [edi + 0x80], cl
jmp case.default.0x5676a5
cmp byte [edi + 0x80], bl
je case.default.0x5676a5
cmp dword [0xd0587c], ebx
jne 0x567abd
push 1
mov ecx, 0xd05860
call fcn.00579f60
mov byte [edi + 0x80], bl
mov eax, dword [0xd058e0]
cmp eax, ebx
jne case.default.0x5676a5
call fcn.004ebcb0
jmp case.default.0x5676a5
push ebx
mov ecx, 0xd05860
call fcn.00579f60
jmp case.default.0x5676a5
cmp byte [edi + 0x80], bl
je case.default.0x5676a5
cmp dword [0xd057cc], ebx
jne 0x567afc
push 1
mov ecx, 0xd057b0
call fcn.00579f60
mov byte [edi + 0x80], bl
mov eax, dword [0xd05830]
cmp eax, ebx
jne case.default.0x5676a5
call fcn.004ebcd0
jmp case.default.0x5676a5
push ebx
mov ecx, 0xd057b0
call fcn.00579f60
jmp case.default.0x5676a5
test byte [0x6d6a08], 1
mov eax, dword [0x6d6a08]
je 0x567b1b
and al, 0xfe
jmp 0x567b1d
or al, 1
push 4
push 0x6d6a08
push 0x3f6
mov dword [0x6d6a08], eax
call fcn.004ac410
add esp, 0xc
mov ecx, dword [edi + 0x68]
mov eax, 0x1b3
mov dword [esp + 0x2c], eax
mov dword [esp + 0x3c], eax
mov eax, dword [0xcea298]
add ebp, ecx
mov ecx, 0x1c7
cmp eax, ebx
mov esi, ebp
mov dword [esp + 0x18], 0x1e3
mov dword [esp + 0x1c], 0x1b5
mov dword [esp + 0x20], 0x208
mov dword [esp + 0x24], 0x1c9
mov dword [esp + 0x28], 0x1a3
mov dword [esp + 0x30], 0x1c8
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], 0x21f
mov dword [esp + 0x40], 0x244
mov dword [esp + 0x44], ecx
je 0x567bf4
mov edx, dword [0xcf95d4]
mov eax, dword [0xcf95d0]
push edx
lea ecx, [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x567bf4
mov edx, dword [0xcf95d4]
mov eax, dword [0xcf95d0]
push edx
lea ecx, [esp + 0x2c]
push eax
push ecx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x567bf4
mov edx, dword [0xcf95d4]
mov eax, dword [0xcf95d0]
push edx
lea ecx, [esp + 0x3c]
push eax
push ecx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x567bf7
mov dword [esi + 0x18], ebx
mov eax, dword [esp + 0x14]
mov ecx, dword [edi + 0x84]
inc eax
cmp eax, ecx
mov dword [esp + 0x14], eax
jl 0x567655
pop esi
pop ebp
pop edi
pop ebx
add esp, 0x50
ret