Function at 0x489ad0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1d4
mov eax, dword [0x632b20]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 2
mov eax, dword [0x121bbdc]
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0xa
ja case.default.0x489b08
mov ecx, dword [ebp - 0x1a0]
jmp dword [ecx*4 + 0x48a7bc]
call fcn.00401430
mov dword [0x9cd344], 0
mov dword [0x9cd504], 0
mov dword [0x9cd350], 0
mov dword [0x9cd34c], 0
mov dword [0x9ccc8c], 0
push 0xffffffffffffffff
push 0
push 0x3bda0
push 3
push 0x1de
push 0x27e
call fcn.00489930
add esp, 0x18
push 0xffffffffffffffff
push 0
push 0x3bd9e
push 3
push 0x1de
push 0x27e
call fcn.00489930
add esp, 0x18
push 0xffffffffffffffff
push 0
push 0x3bda4
push 3
push 0x1de
push 0x27e
call fcn.00489930
add esp, 0x18
push 0xffffffffffffffff
push 0
push 0x3bda5
push 3
push 0x1de
push 0x27e
call fcn.00489930
add esp, 0x18
push 0xffffffffffffffff
push 0
push 0x3bd9f
push 3
push 0x1de
push 0x27e
call fcn.00489930
add esp, 0x18
mov dword [0x121bbdc], 1
jmp case.default.0x489b08
push 0xffffffffffffffff
push 0
push 0x3bda0
push 3
push 0x1de
push 0x27e
call fcn.00489930
add esp, 0x18
push 0xffffffffffffffff
push 0
push 0x3bd9e
push 3
push 0x1de
push 0x27e
call fcn.00489930
add esp, 0x18
push 0xffffffffffffffff
push 0
push 0x3bda4
push 3
push 0x1de
push 0x27e
call fcn.00489930
add esp, 0x18
push 0xffffffffffffffff
push 0
push 0x3bda5
push 3
push 0x1de
push 0x27e
call fcn.00489930
add esp, 0x18
push 0xffffffffffffffff
push 0
push 0x3bd9f
push 3
push 0x1de
push 0x27e
call fcn.00489930
add esp, 0x18
call fcn.004897a0
test eax, eax
je 0x489c85
jmp case.default.0x489b08
mov edx, dword [0x9cd344]
add edx, 4
mov dword [0x9cd344], edx
cmp dword [0x600f80], 0x10
jne 0x489cf4
mov eax, dword [0x9cd344]
imul eax, eax, 6
mov ecx, dword [0x6ba8fc]
mov edx, dword [ecx + 0xc0]
movzx eax, word [edx + eax + 4]
mov ecx, dword [0x9cd344]
imul ecx, ecx, 6
mov edx, dword [0x6ba8fc]
mov edx, dword [edx + 0xc0]
movzx ecx, word [edx + ecx + 2]
or eax, ecx
mov edx, dword [0x9cd344]
imul edx, edx, 6
mov ecx, dword [0x6ba8fc]
mov ecx, dword [ecx + 0xc0]
movzx edx, word [ecx + edx]
or eax, edx
mov dword [0x6bc07c], eax
jmp 0x489d12
mov eax, dword [0x9cd344]
shl eax, 0x10
mov ecx, dword [0x9cd344]
shl ecx, 8
or eax, ecx
or eax, dword [0x9cd344]
mov dword [0x6bc07c], eax
cmp dword [0x9cd344], 0xff
jl 0x489d51
cmp dword [0x600f80], 0x10
jne 0x489d33
mov dword [0x6bc07c], 0xffff
jmp 0x489d3d
mov dword [0x6bc07c], 0xffffff
mov dword [0x9cd344], 0
mov dword [0x121bbdc], 2
jmp case.default.0x489b08
mov edx, dword [0x9cd344]
add edx, 1
mov dword [0x9cd344], edx
mov eax, dword [0x9cd344]
imul eax, eax, 0xff
cdq
mov ecx, 0x28
idiv ecx
mov dword [0x9cd504], eax
cmp dword [0x9cd344], 0x28
jl 0x489ef6
mov dword [0x9cd344], 0
mov dword [0x9cd504], 0xff
push 0
push 2
call fcn.004010b0
add esp, 8
mov dword [0x9ccc80], eax
cmp dword [0x9ccc80], 0
je 0x489e3f
mov edx, dword [0x9ccc80]
mov dword [edx + 0x2a8], 0x3bd9e
mov eax, dword [0x9ccc80]
mov dword [eax + 0x2b0], 0
mov ecx, dword [0x9ccc80]
mov byte [ecx + 0x15], 0xa
mov edx, dword [0x9ccc80]
mov dword [edx + 0x30], 0x1c3
mov eax, dword [0x9ccc80]
mov dword [eax + 0x34], 0xc1
mov ecx, dword [0x9ccc80]
mov dword [ecx + 0x2b8], 0
mov edx, dword [0x9ccc80]
mov byte [edx + 0x308], 8
mov eax, dword [0x9ccc80]
mov dword [eax + 0x30c], 0xffffff
push 0
push 0
push 0x64
mov ecx, dword [0x9ccc80]
push ecx
call fcn.00592b40
add esp, 0x10
push 0
push 2
call fcn.004010b0
add esp, 8
mov dword [0x9ccc84], eax
cmp dword [0x9ccc84], 0
je 0x489eec
mov edx, dword [0x9ccc84]
mov dword [edx + 0x2a8], 0x3bd9e
mov eax, dword [0x9ccc84]
mov dword [eax + 0x2b0], 0
mov ecx, dword [0x9ccc84]
mov byte [ecx + 0x15], 0xa
mov edx, dword [0x9ccc84]
mov dword [edx + 0x30], 0xbd
mov eax, dword [0x9ccc84]
mov dword [eax + 0x34], 0x11f
mov ecx, dword [0x9ccc84]
mov dword [ecx + 0x2b8], 0
mov edx, dword [0x9ccc84]
mov byte [edx + 0x308], 8
mov eax, dword [0x9ccc84]
mov dword [eax + 0x30c], 0xffffff
push 0
push 0
push 0x64
mov ecx, dword [0x9ccc84]
push ecx
call fcn.00592b40
add esp, 0x10
mov dword [0x121bbdc], 3
jmp 0x489ef6
mov dword [0x121bbdc], 6
jmp case.default.0x489b08
mov edx, dword [0x9ccc80]
mov eax, dword [edx + 0x30]
sub eax, 3
mov ecx, dword [0x9ccc80]
mov dword [ecx + 0x30], eax
mov edx, dword [0x9ccc80]
mov eax, dword [edx + 0x34]
add eax, 1
mov ecx, dword [0x9ccc80]
mov dword [ecx + 0x34], eax
mov edx, dword [0x9ccc84]
mov eax, dword [edx + 0x30]
add eax, 3
mov ecx, dword [0x9ccc84]
mov dword [ecx + 0x30], eax
mov edx, dword [0x9ccc84]
mov eax, dword [edx + 0x34]
sub eax, 1
mov ecx, dword [0x9ccc84]
mov dword [ecx + 0x34], eax
mov edx, dword [0x9ccc84]
mov eax, dword [edx + 0x34]
sub eax, 0xf0
mov ecx, 0x2f
sub ecx, eax
mov dword [0x9cd344], ecx
js 0x489f9f
mov eax, dword [0x9cd344]
shl eax, 7
cdq
mov ecx, 0x2f
idiv ecx
mov edx, dword [0x9ccc80]
mov byte [edx + 0x30f], al
mov eax, dword [0x9ccc84]
mov ecx, dword [0x9ccc80]
mov dl, byte [ecx + 0x30f]
mov byte [eax + 0x30f], dl
mov eax, dword [0x9ccc80]
cmp dword [eax + 0x30], 0x140
jg 0x48a028
mov ecx, dword [0x9ccc80]
mov dword [ecx + 0x30], 0x140
mov edx, dword [0x9ccc80]
mov dword [edx + 0x34], 0xf0
mov eax, dword [0x9ccc80]
mov byte [eax + 0x30f], 0
mov ecx, dword [0x9ccc84]
push ecx
call fcn.004013e0
add esp, 4
mov dword [0x9ccc84], 0
mov dword [0x9cd504], 0
mov dword [0x9cd350], 0
mov dword [0x9cd34c], 0
mov dword [0x121bbdc], 4
mov dword [0x9cd344], 0x10
push 0x21
call fcn.005aeaf0
add esp, 4
jmp case.default.0x489b08
cmp dword [0x9cd344], 0
jle 0x48a06b
mov edx, dword [0x9cd344]
sub edx, 1
mov dword [0x9cd344], edx
jne 0x48a066
cmp dword [0x9ccc80], 0
je 0x48a066
mov eax, dword [0x9ccc80]
mov byte [eax + 0x30f], 0xff
mov dword [0x9cd504], 0xff
jmp case.default.0x489b08
cmp dword [0x9cd350], 0xff
jge 0x48a0d5
mov ecx, dword [0x9cd350]
add ecx, 4
mov dword [0x9cd350], ecx
cmp dword [0x9cd350], 0xff
jl 0x48a0d3
mov dword [0x9cd350], 0xff
mov dword [0x9cd344], 0x3c
mov edx, dword [0x9ccc80]
push edx
call fcn.004013e0
add esp, 4
mov dword [0x9ccc80], 0
mov dword [0x6bc07c], 0
mov dword [0x9cd504], 0
jmp 0x48a111
mov eax, dword [0x9cd34c]
add eax, 4
mov dword [0x9cd34c], eax
cmp dword [0x9cd34c], 0xff
jle 0x48a111
mov dword [0x9cd350], 0
mov dword [0x9cd34c], 0xff
call fcn.0048a7f0
mov dword [0x121bbdc], 6
jmp case.default.0x489b08
mov dword [0x9cd504], 0
mov dword [0x9cd350], 0
mov dword [0x9cd34c], 0xff
mov dword [0x6bc07c], 0
mov ecx, dword [0x9ccc80]
push ecx
call fcn.004013e0
add esp, 4
mov edx, dword [0x9ccc84]
push edx
call fcn.004013e0
add esp, 4
mov dword [0x9ccc84], 0
mov eax, dword [0x9ccc84]
mov dword [0x9ccc80], eax
call fcn.0048a7f0
mov dword [0x121bbdc], 6
push 0x21
call fcn.005aeaf0
add esp, 4
jmp case.default.0x489b08
mov dword [ebp - 8], 0
jmp case.default.0x489b08
cmp dword [0x6ba8f8], 0
jne 0x48a1b6
push 0x3c
push 0x13
call fcn.0046c870
add esp, 8
mov dword [0x121bbdc], 0xa
jmp case.default.0x489b08
call fcn.00480580
push 0xf0
push 0x140
push 0x38
call fcn.005af300
add esp, 0xc
mov dword [0x121bbdc], 9
jmp case.default.0x489b08
push 0x9cec38
call fcn.00480590
add esp, 4
test eax, eax
je 0x48a1f8
mov dword [0x121bbdc], 5
jmp case.default.0x489b08
push 2
call fcn.00599ef0
add esp, 4
call fcn.00401430
mov dword [0x6bc07c], 0
cmp dword [0x121bbdc], 4
jae 0x48a231
mov ecx, dword [0xf1ce2c]
and ecx, 1
je 0x48a231
mov dword [0x121bbdc], 5
cmp dword [0x121bbdc], 0xa
jne 0x48a6e8
mov dword [ebp - 0x1a4], 0x9ccfa0
mov edx, dword [ebp - 0x1a4]
add edx, 1
mov dword [ebp - 0x1a8], edx
mov eax, dword [ebp - 0x1a4]
mov cl, byte [eax]
mov byte [ebp - 0x1a9], cl
add dword [ebp - 0x1a4], 1
cmp byte [ebp - 0x1a9], 0
jne 0x48a257
mov edx, dword [ebp - 0x1a4]
sub edx, dword [ebp - 0x1a8]
mov dword [ebp - 0x1b0], edx
je 0x48a6e8
mov dword [ebp - 0x1b4], 0x9ccc90
mov eax, dword [ebp - 0x1b4]
add eax, 1
mov dword [ebp - 0x1b8], eax
mov ecx, dword [ebp - 0x1b4]
mov dl, byte [ecx]
mov byte [ebp - 0x1b9], dl
add dword [ebp - 0x1b4], 1
cmp byte [ebp - 0x1b9], 0
jne 0x48a2a6
mov eax, dword [ebp - 0x1b4]
sub eax, dword [ebp - 0x1b8]
mov dword [ebp - 0x1c0], eax
je 0x48a6e8
push 0x9ccdf0
call fcn.0059f6b0
add esp, 4
push 0x9ccfa0
call fcn.0059f7c0
add esp, 4
push 0x9ccc90
call fcn.0059f860
add esp, 4
call fcn.0059f0a0
mov ecx, dword [str.shiwanmoli]
mov dword [ebp - 0x150], ecx
mov edx, dword [0x5eb600]
mov dword [ebp - 0x14c], edx
mov ax, word [0x5eb604]
mov word [ebp - 0x148], ax
mov cl, byte [0x5eb606]
mov byte [ebp - 0x146], cl
xor edx, edx
mov dword [ebp - 0x145], edx
mov dword [ebp - 0x141], edx
mov dword [ebp - 0x13d], edx
mov dword [ebp - 0x139], edx
mov dword [ebp - 0x135], edx
mov byte [ebp - 0x131], dl
mov eax, dword [str.zhaorenyao]
mov dword [ebp - 0x130], eax
mov ecx, dword [0x5eb60c]
mov dword [ebp - 0x12c], ecx
mov dx, word [0x5eb610]
mov word [ebp - 0x128], dx
mov al, byte [0x5eb612]
mov byte [ebp - 0x126], al
xor ecx, ecx
mov dword [ebp - 0x125], ecx
mov dword [ebp - 0x121], ecx
mov dword [ebp - 0x11d], ecx
mov dword [ebp - 0x119], ecx
mov dword [ebp - 0x115], ecx
mov byte [ebp - 0x111], cl
mov edx, dword [str.lhkiss123]
mov dword [ebp - 0x110], edx
mov eax, dword [0x5eb618]
mov dword [ebp - 0x10c], eax
mov cx, word [0x5eb61c]
mov word [ebp - 0x108], cx
xor edx, edx
mov dword [ebp - 0x106], edx
mov dword [ebp - 0x102], edx
mov dword [ebp - 0xfe], edx
mov dword [ebp - 0xfa], edx
mov dword [ebp - 0xf6], edx
mov word [ebp - 0xf2], dx
mov eax, dword [str.lihongxia916]
mov dword [ebp - 0xf0], eax
mov ecx, dword [0x5eb624]
mov dword [ebp - 0xec], ecx
mov edx, dword [0x5eb628]
mov dword [ebp - 0xe8], edx
mov al, byte [0x5eb62c]
mov byte [ebp - 0xe4], al
xor ecx, ecx
mov dword [ebp - 0xe3], ecx
mov dword [ebp - 0xdf], ecx
mov dword [ebp - 0xdb], ecx
mov dword [ebp - 0xd7], ecx
mov word [ebp - 0xd3], cx
mov byte [ebp - 0xd1], cl
mov edx, dword [str.jay3068]
mov dword [ebp - 0xd0], edx
mov eax, dword [0x5eb634]
mov dword [ebp - 0xcc], eax
xor ecx, ecx
mov dword [ebp - 0xc8], ecx
mov dword [ebp - 0xc4], ecx
mov dword [ebp - 0xc0], ecx
mov dword [ebp - 0xbc], ecx
mov dword [ebp - 0xb8], ecx
mov dword [ebp - 0xb4], ecx
mov edx, dword [str.mimi5016]
mov dword [ebp - 0xb0], edx
mov eax, dword [0x5eb63c]
mov dword [ebp - 0xac], eax
mov cl, byte [0x5eb640]
mov byte [ebp - 0xa8], cl
xor edx, edx
mov dword [ebp - 0xa7], edx
mov dword [ebp - 0xa3], edx
mov dword [ebp - 0x9f], edx
mov dword [ebp - 0x9b], edx
mov dword [ebp - 0x97], edx
mov word [ebp - 0x93], dx
mov byte [ebp - 0x91], dl
push 0x80
push 0
lea eax, [ebp - 0x90]
push eax
call fcn.005cbc50
add esp, 0xc
mov byte [0x7d22d6], 0
mov byte [0x7d22d7], 0
mov dword [ebp - 0x154], 0
jmp 0x48a522
mov ecx, dword [ebp - 0x154]
add ecx, 1
mov dword [ebp - 0x154], ecx
cmp dword [ebp - 0x154], 0xa
jge 0x48a5e7
mov edx, dword [ebp - 0x154]
shl edx, 5
lea eax, [ebp + edx - 0x150]
mov dword [ebp - 0x1c4], eax
mov dword [ebp - 0x1c8], 0x9ccc90
mov ecx, dword [ebp - 0x1c8]
mov dl, byte [ecx]
mov byte [ebp - 0x1c9], dl
mov eax, dword [ebp - 0x1c4]
cmp dl, byte [eax]
jne 0x48a5ad
cmp byte [ebp - 0x1c9], 0
je 0x48a5a1
mov ecx, dword [ebp - 0x1c8]
mov dl, byte [ecx + 1]
mov byte [ebp - 0x1ca], dl
mov eax, dword [ebp - 0x1c4]
cmp dl, byte [eax + 1]
jne 0x48a5ad
add dword [ebp - 0x1c8], 2
add dword [ebp - 0x1c4], 2
cmp byte [ebp - 0x1ca], 0
jne 0x48a54f
mov dword [ebp - 0x1d0], 0
jmp 0x48a5b8
sbb ecx, ecx
sbb ecx, 0xffffffff
mov dword [ebp - 0x1d0], ecx
mov edx, dword [ebp - 0x1d0]
mov dword [ebp - 0x1d4], edx
mov eax, dword [ebp - 0x1d4]
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0
jne 0x48a5e2
mov byte [0x7d22d6], 1
jmp 0x48a5e7
jmp 0x48a513
movzx ecx, byte [0x7d22d6]
test ecx, ecx
je 0x48a6be
mov edx, dword [str.._bincgpuk3.gcp]
mov dword [ebp - 0x198], edx
mov eax, dword [0x5eb648]
mov dword [ebp - 0x194], eax
mov ecx, dword [0x5eb64c]
mov dword [ebp - 0x190], ecx
mov edx, dword [0x5eb650]
mov dword [ebp - 0x18c], edx
mov al, byte [0x5eb654]
mov byte [ebp - 0x188], al
push 0x5eb658
lea ecx, [ebp - 0x198]
push ecx
call fcn.005cd6b5
add esp, 8
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 0
jne 0x48a69f
push 0
push str.cmd.exe__c_ipconfig.exe__all____._bin_cgpuk3.gcp
call dword [sym.imp.kernel32.dll_WinExec]
call fcn.0047b240
mov dword [0x7d2300], eax
mov dword [0x7d2304], edx
push 5
call fcn.0047b290
add esp, 4
test eax, eax
jne 0x48a680
jmp 0x48a670
push 0
push str.cmd.exe__c_tracert.exe__h_20_www.joypark.com.tw____._bin_cgpuk3.gcp
call dword [sym.imp.kernel32.dll_WinExec]
push 5
call fcn.0047b290
add esp, 4
test eax, eax
jne 0x48a69d
jmp 0x48a68d
jmp 0x48a6ae
mov edx, dword [ebp - 0x19c]
push edx
call fcn.005cd459
add esp, 4
call fcn.0047b240
mov dword [0x7d2300], eax
mov dword [0x7d2304], edx
push 0xf0
push 0x140
push 0x35
call fcn.005af300
add esp, 0xc
push 0x1e
push 0x1e
call fcn.0046c870
add esp, 8
mov dword [0x121bbdc], 0xa
cmp dword [0x9ccc8c], 0
je 0x48a71d
mov eax, dword [0x9ccc8c]
shl eax, 0x18
or eax, 0xffffff
push eax
push 0
push 0x3bda0
push 0xce
push 0x15e
push 0x8b
call fcn.00489930
add esp, 0x18
cmp dword [0x9cd34c], 0
je 0x48a74e
mov ecx, dword [0x9cd34c]
shl ecx, 0x18
or ecx, 0xffffff
push ecx
push 0
push 0x3bda5
push 0xce
push 0
push 0
call fcn.00489930
add esp, 0x18
cmp dword [0x9cd350], 0
je 0x48a77f
mov edx, dword [0x9cd350]
shl edx, 0x18
or edx, 0xffffff
push edx
push 0
push 0x3bda4
push 0xce
push 0
push 0
call fcn.00489930
add esp, 0x18
cmp dword [0x9cd504], 0
je 0x48a7ab
mov eax, dword [0x9cd504]
shl eax, 0x18
or eax, 0xffffff
push eax
push 0
push 0x3bd9f
push 3
push 0
push 0
call fcn.00489930
add esp, 0x18
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.005cbcfe
mov esp, ebp
pop ebp
ret