Function at 0x407ed0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5dead2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xf0
push ebx
push ebp
mov dword [esp + 0x2c], ecx
push esi
push edi
lea ecx, [esp + 0x18]
call fcn.004918b0
mov eax, dword [0x6707bc]
mov dword [esp + 0x108], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
push 0x64ae6c
lea ecx, [esp + 0x30]
mov byte [esp + 0x10c], 2
call fcn.005bc48f
mov ebx, dword [esp + 0x114]
mov edi, dword [esp + 0x110]
mov byte [esp + 0x108], 3
cmp word [ebx + 0xc], 0xffff
jne 0x407f85
mov eax, dword [edi + 0x54]
mov ebp, dword [edi + 0x58]
xor esi, esi
test eax, eax
jle 0x407f7b
mov eax, dword [esp + 0x118]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
push eax
push ecx
push edx
call fcn.004926e0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x407f7b
mov eax, dword [edi + 0x54]
add ebp, 0x38
inc esi
cmp esi, eax
jl 0x407f53
cmp esi, dword [edi + 0x54]
jl 0x407f8d
jmp 0x4085c5
mov ebp, dword [esp + 0x30]
mov esi, dword [esp + 0x30]
mov eax, dword [ebx]
lea ecx, [esp + 0x18]
push eax
push str._html__r_n_head__r_n_meta_http_equiv_Content_Type__content_text_html__charsetgb2312___r_n_title_
call fcn.00491c90
cmp word [ebx + 0xc], 0xffff
jne 0x407fbc
mov ecx, dword [ebp]
push 0x64a98c
push ecx
push 0x64ac58
lea ecx, [esp + 0x24]
call fcn.00491cb0
mov edx, dword [ebx]
push str.__font___big_nbsp_
push edx
push str.__title__r_n__head__r_n_body__r_n_p__big__strong__font_color_000000__
lea ecx, [esp + 0x24]
call fcn.00491cb0
cmp word [ebx + 0xc], 0xffff
jne 0x407fe0
push 0x64b228
jmp 0x407fe5
push 0x64b220
lea ecx, [esp + 0x1c]
call fcn.00491c60
lea ecx, [esp + 0x10]
call fcn.005bc3ac
push 0
push 0
push ebx
push 0
lea eax, [esp + 0x20]
push edi
push eax
call fcn.00501a20
mov ecx, dword [esp + 0x28]
add esp, 0x18
push ecx
push str.__strong_nbsp_nbsp_nbsp_
lea ecx, [esp + 0x20]
call fcn.00491c90
mov ax, word [ebx + 0xc]
cmp ax, 0xffff
je 0x408078
movsx esi, ax
dec esi
lea edx, [esp + 0x38]
push esi
push str.ct_d.htm__
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 0x38]
lea ecx, [esp + 0x18]
push eax
push str.nbsp_nbsp_nbsp_
call fcn.00491c90
mov edi, dword [edi + 0x60]
test esi, esi
jle 0x408069
push edi
call fcn.00492830
add esp, 4
add edi, eax
dec esi
jne 0x40805b
add edi, 4
lea ecx, [esp + 0x18]
push edi
call fcn.00491c60
jmp 0x4080a3
push esi
lea ecx, [esp + 0x3c]
push str.dt_d.htm__
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
mov edx, dword [ebp]
add esp, 0xc
lea eax, [esp + 0x38]
lea ecx, [esp + 0x18]
push edx
push eax
push 0x64b1c4
call fcn.00491cb0
push str.__a___p__r_n_p_
lea ecx, [esp + 0x1c]
call fcn.00491c60
xor esi, esi
cmp word [ebx + 0x16], 3
jne 0x4080cd
push 0x64b190
lea ecx, [esp + 0x1c]
call fcn.00491c60
mov esi, 1
test byte [ebx + 0xe], 0x10
je 0x4080e6
push 0x64b154
lea ecx, [esp + 0x1c]
call fcn.00491c60
mov esi, 1
mov ecx, dword [ebx + 8]
push ecx
call fcn.00492700
add esp, 4
test eax, eax
jne 0x40815a
cmp esi, 1
jne 0x408109
push str._br_
lea ecx, [esp + 0x1c]
call fcn.00491c60
mov edx, dword [ebx + 8]
lea ecx, [esp + 0x14]
push edx
call fcn.005bc5aa
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx - 8]
cmp byte [eax + ecx - 1], 0x20
jb 0x408143
lea eax, [esp + 0x14]
push eax
call fcn.00501770
add esp, 4
test eax, eax
jne 0x408143
lea ecx, [esp + 0x2c]
push ecx
lea ecx, [esp + 0x18]
call fcn.005bc839
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
call fcn.00491c60
lea ecx, [esp + 0x14]
call fcn.005bc3ac
push str.__p__r_n_p__em_
lea ecx, [esp + 0x1c]
call fcn.00491c60
mov eax, dword [ebx + 0x10]
test eax, eax
jne 0x408176
push 0x64a878
jmp 0x4081ac
mov ecx, dword [esp + 0x120]
lea edx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x38]
push 0
push 0
push edx
push eax
push 0
call fcn.0047e2b0
test byte [ebx + 0xe], 0x40
je 0x4081a7
push 0x64b10c
lea ecx, [esp + 0x18]
call fcn.005bc7fd
mov eax, dword [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
call fcn.00491c60
push str.__font_nbsp_
lea ecx, [esp + 0x1c]
call fcn.00491c60
cmp word [ebx + 0xc], 0xffff
jne 0x408200
push str._em_
lea ecx, [esp + 0x1c]
call fcn.00491c60
test byte [ebp + 0x14], 0x10
je 0x4081e5
push 0x64ad88
jmp 0x4081e9
mov ecx, dword [ebp]
push ecx
lea ecx, [esp + 0x1c]
call fcn.00491c60
push str.__em_
lea ecx, [esp + 0x1c]
call fcn.00491c60
mov edx, dword [ebx]
push 0x64a860
push edx
lea ecx, [esp + 0x20]
call fcn.00491c90
mov eax, dword [ebx + 0x1c]
xor edi, edi
test eax, eax
jle 0x408278
xor ebp, ebp
mov ecx, dword [ebx + 0x20]
mov esi, ebp
add esi, ecx
lea ecx, [esp + 0x14]
call fcn.005bc3ac
test byte [esi + 0x14], 2
je 0x408241
mov eax, dword [esi]
push str.__font__font_color_000000__
push eax
push str._font_color_000000__
jmp 0x40824e
mov ecx, dword [esi]
push 0x64a850
push ecx
push 0x64a838
lea ecx, [esp + 0x24]
call fcn.00491cb0
mov edx, dword [ebx + 0x1c]
dec edx
cmp edi, edx
je 0x40826d
push 0x64a810
lea ecx, [esp + 0x1c]
call fcn.00491c60
mov eax, dword [ebx + 0x1c]
inc edi
add ebp, 0x18
cmp edi, eax
jl 0x40821c
test byte [ebx + 0xe], 0x20
je 0x40828c
push 0x64b044
lea ecx, [esp + 0x1c]
call fcn.00491c60
push 0x64a7e8
lea ecx, [esp + 0x1c]
call fcn.00491c60
mov eax, dword [ebx + 0x1c]
test eax, eax
jle 0x4082af
push str._table_border1_cols2_framebelow_rulesrows_width_100___bordercolorlight_000000__bordercolordark_FFFFFF__cellspacing_0__cellpadding_5__
lea ecx, [esp + 0x1c]
call fcn.00491c60
mov eax, dword [ebx + 0x1c]
xor edi, edi
test eax, eax
jle 0x40855e
test edi, edi
jne 0x4082ce
push str._tr__r_n_td_width_30___valign_top___strong_
lea ecx, [esp + 0x1c]
call fcn.00491c60
mov ecx, dword [ebx + 0x20]
lea eax, [edi + edi*2]
push str.__font___td__r_n_td_width_70___valign_top__
mov edx, dword [ecx + eax*8]
lea esi, [ecx + eax*8]
push edx
push str._tr__r_n_td_width_30___valign_top___font_color_000000__
lea ecx, [esp + 0x24]
call fcn.00491cb0
push str._em_
lea ecx, [esp + 0x14]
call fcn.005bc5aa
test byte [esi + 0x14], 2
je 0x408309
push str._font_color_808080__
jmp 0x40830e
push 0x64b018
lea ecx, [esp + 0x14]
call fcn.005bc7fd
push 0x64b010
lea ecx, [esp + 0x14]
call fcn.005bc7fd
push 0x64a65c
lea ecx, [esp + 0x14]
call fcn.005bc7fd
mov eax, dword [ebx + 0x1c]
dec eax
cmp edi, eax
jne 0x40834f
test byte [ebx + 0xe], 0x20
je 0x40834f
push 0x64affc
lea ecx, [esp + 0x14]
call fcn.005bc7fd
mov ecx, dword [esp + 0x120]
mov eax, dword [esi + 0xc]
push ecx
mov ecx, dword [esp + 0x38]
push 0
lea edx, [esp + 0x1c]
push 0
push edx
push eax
push 0
call fcn.0047e2b0
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x14]
call fcn.005bc839
test byte [esi + 0x14], 1
je 0x40846b
mov eax, dword [esi + 0xc]
cmp eax, 0x80000201
ja 0x4083f6
je 0x4083e5
cmp eax, reloc.OLEAUT32.dll_SysReAllocStringLen
ja 0x4083c8
je 0x4083c3
cmp eax, 0x80000000
je 0x408416
cmp eax, reloc.OLEAUT32.dll_SysReAllocString
jne 0x40846b
mov eax, dword [esi + 0x10]
test eax, eax
je 0x4083bc
mov eax, 0x649bc8
jmp 0x408431
mov eax, 0x649bc4
jmp 0x408431
mov eax, dword [esi + 0x10]
jmp 0x408431
cmp eax, 0x80000101
jne 0x40846b
xor edx, edx
lea eax, [esp + 0x38]
mov dl, byte [esi + 0x10]
push edx
push 0x64aff8
push eax
jmp 0x408424
movsx ecx, word [esi + 0x10]
push ecx
lea edx, [esp + 0x3c]
push 0x64aafc
push edx
jmp 0x408424
cmp eax, 0x80000501
ja 0x40840f
je 0x408416
cmp eax, 0x80000301
je 0x408416
cmp eax, 0x80000401
je 0x408416
jmp 0x40846b
cmp eax, 0x80000601
jne 0x40846b
mov eax, dword [esi + 0x10]
lea ecx, [esp + 0x38]
push eax
push 0x64aafc
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 0x38]
test eax, eax
je 0x40846b
push eax
lea edx, [esp + 0x34]
push 0x64afe4
push edx
call fcn.00503c60
add esp, 0xc
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x10c], 4
call fcn.005bc839
lea ecx, [esp + 0x30]
mov byte [esp + 0x108], 3
call fcn.005bc421
mov eax, dword [esi + 0x14]
test al, 0x1c
je 0x408496
test al, 8
je 0x40847d
push 0x64afc8
jmp 0x40848d
test al, 0x10
je 0x408488
push 0x64afa4
jmp 0x40848d
push 0x64af8c
lea ecx, [esp + 0x14]
call fcn.005bc7fd
mov eax, dword [esi + 0x14]
test al, 0x40
je 0x4084a4
push 0x64af64
jmp 0x4084ad
test al, 0x20
je 0x4084b6
push 0x64af48
lea ecx, [esp + 0x14]
call fcn.005bc7fd
mov eax, dword [esp + 0x10]
mov ecx, dword [eax - 8]
cmp byte [ecx + eax - 1], 0x20
jb 0x4084e3
lea eax, [esp + 0x10]
push eax
call fcn.00501770
add esp, 4
test eax, eax
jne 0x4084e3
lea ecx, [esp + 0x2c]
push ecx
lea ecx, [esp + 0x14]
call fcn.005bc839
mov edx, dword [esi + 4]
push edx
call fcn.00492700
add esp, 4
test eax, eax
jne 0x40852d
mov eax, dword [esi + 4]
lea ecx, [esp + 0x10]
push eax
call fcn.005bc7fd
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx - 8]
cmp byte [eax + ecx - 1], 0x20
jb 0x40852d
lea ecx, [esp + 0x10]
push ecx
call fcn.00501770
add esp, 4
test eax, eax
jne 0x40852d
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x10]
push edx
call fcn.005bc839
mov eax, dword [esp + 0x10]
push str.__td__r_n__tr__r_n
push eax
lea ecx, [esp + 0x20]
call fcn.00491c90
mov eax, dword [ebx + 0x1c]
inc edi
cmp edi, eax
jl 0x4082bc
test eax, eax
jle 0x40855e
push str.__table__r_n
lea ecx, [esp + 0x1c]
call fcn.00491c60
push 0x64a5ac
lea ecx, [esp + 0x1c]
call fcn.00491c60
mov ecx, dword [esp + 0x118]
lea edx, [esp + 0x38]
push ecx
push str.cmd_d.htm
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [esp + 0x128]
add esp, 0xc
lea eax, [esp + 0x38]
lea edx, [esp + 0x30]
push eax
push ecx
push edx
call fcn.005bc6b6
push 0
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x114], 5
call fcn.00491fc0
lea ecx, [esp + 0x30]
mov byte [esp + 0x108], 3
call fcn.005bc421
lea ecx, [esp + 0x2c]
mov byte [esp + 0x108], 2
call fcn.005bc421
lea ecx, [esp + 0x14]
mov byte [esp + 0x108], 1
call fcn.005bc421
lea ecx, [esp + 0x10]
mov byte [esp + 0x108], 0
call fcn.005bc421
lea ecx, [esp + 0x18]
mov dword [esp + 0x108], 0xffffffff
mov dword [esp + 0x18], 0x5f7940
call fcn.00491ab0
mov ecx, dword [esp + 0x100]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xfc
ret 0x14