Function at 0x406670
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x51e28f
mov eax, dword fs:[0]
push eax
sub esp, 0x874
mov eax, dword [0x56a338]
xor eax, esp
mov dword [esp + 0x870], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x56a338]
xor eax, esp
push eax
lea eax, [esp + 0x888]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x89c]
mov eax, dword [esp + 0x898]
xor ebx, ebx
cmp ebp, ebx
mov esi, ecx
mov dword [esp + 0x20], esi
mov dword [esp + 0x18], eax
jle 0x4066ef
xor eax, eax
xor ecx, ecx
cmp ebp, ebx
jle 0x4066ef
mov dl, byte [eax + str.GUANGSU]
mov edi, dword [esp + 0x18]
xor byte [edi + ecx], dl
add eax, 1
cmp eax, 7
jl 0x4066e8
xor eax, eax
add ecx, 1
cmp ecx, ebp
jl 0x4066d1
lea ecx, [esp + 0x44]
call fcn.0047a230
mov eax, dword [esp + 0x18]
push 1
push ebx
push eax
lea ecx, [esp + 0x50]
mov dword [esp + 0x89c], ebx
call fcn.0047c330
push str.TheConfigure
lea ecx, [esp + 0x48]
call fcn.004798a0
mov edi, eax
cmp edi, ebx
mov dword [esp + 0x14], edi
jne 0x406788
push str.TheQueryInfo
lea ecx, [esp + 0x48]
call fcn.004798a0
cmp eax, ebx
mov dword [esp + 0x14], eax
jne 0x406786
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x40674f
push eax
call fcn.0042eca7
add esp, 4
mov dword [esp + 0x890], 0xffffffff
mov eax, dword [esp + 0x78]
cmp eax, 0x575478
mov dword [esp + 0x44], vtable.TiXmlDocument.0
je 0x406776
push eax
call fcn.0042f33e
add esp, 4
lea ecx, [esp + 0x44]
call fcn.00479ec0
xor eax, eax
jmp 0x406b19
mov edi, eax
push str.QueryProbability
mov ecx, edi
call fcn.004798a0
cmp eax, ebx
je 0x4067f3
mov ecx, eax
call fcn.00479940
cmp eax, ebx
je 0x4067f3
push 0x5603e4
push eax
call fcn.0042f269
mov edi, eax
add esp, 8
xor ebp, ebp
xor eax, eax
cmp edi, ebx
je 0x4067e0
push 0x5603e4
push ebx
call fcn.0042f269
push edi
mov esi, eax
call fcn.0042f339
add esp, 0xc
push esi
mov ebp, eax
call fcn.0042f339
mov esi, dword [esp + 0x24]
add esp, 4
xor ecx, ecx
call fcn.0040c960
cmp eax, ebp
jg 0x40673e
mov edi, dword [esp + 0x14]
push str.QueryList
mov ecx, edi
call fcn.004798a0
mov edi, eax
cmp edi, ebx
je 0x40673e
push 0x3e6
lea ecx, [esp + 0x4a2]
push ebx
push ecx
mov word [esp + 0x4a8], bx
call fcn.00435740
add esp, 0xc
push 0x3e6
lea edx, [esp + 0xba]
push ebx
push edx
mov word [esp + 0xc0], bx
call fcn.00435740
add esp, 0xc
mov ecx, edi
call fcn.00479870
cmp eax, ebx
mov dword [esp + 0x1c], eax
je 0x406ab7
mov ebp, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 8
call fcn.0042e8a4
mov edi, eax
add esp, 4
mov dword [esp + 0x24], edi
cmp edi, ebx
mov byte [esp + 0x890], 1
je 0x406885
call fcn.00407200
mov dword [esp + 0x14], edi
jmp 0x406889
mov dword [esp + 0x14], ebx
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
mov byte [esp + 0x890], bl
mov dword [esp + 0x24], eax
call fcn.00479870
mov edi, eax
cmp edi, ebx
je 0x406a4c
jmp 0x4068b0
mov esi, dword [edi + 0x20]
push 0x3e8
lea ecx, [esp + 0x4a0]
push ebx
push ecx
add esi, 8
call fcn.00435740
add esp, 0xc
push 0x3e8
lea edx, [esp + 0xb8]
push ebx
push edx
call fcn.00435740
add esp, 0xc
push ebx
push ebx
push 0xffffffffffffffff
push esi
push ebx
push 0xfde9
call ebp
push eax
lea eax, [esp + 0x4a0]
push eax
push 0xffffffffffffffff
push esi
push ebx
push 0xfde9
call ebp
mov ecx, dword [edi + 0x18]
cmp ecx, ebx
je 0x406a37
mov edx, dword [ecx]
mov eax, dword [edx + 0x30]
call eax
cmp eax, ebx
je 0x406940
mov esi, dword [eax + 0x20]
push ebx
push ebx
push 0xffffffffffffffff
add esi, 8
push esi
push ebx
push 0xfde9
call ebp
push eax
lea ecx, [esp + 0xb8]
push ecx
push 0xffffffffffffffff
push esi
push ebx
push 0xfde9
call ebp
lea eax, [esp + 0xb4]
mov dword [esp + 0xa8], 7
mov dword [esp + 0xa4], ebx
mov word [esp + 0x94], bx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x406964
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0xb8]
push edx
lea esi, [esp + 0x98]
call fcn.004021f0
mov byte [esp + 0x890], 2
lea eax, [esp + 0x49c]
mov dword [esp + 0x40], 7
mov dword [esp + 0x3c], ebx
mov word [esp + 0x2c], bx
lea edx, [eax + 2]
jmp 0x4069b0
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4069b0
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x4a0]
push eax
lea esi, [esp + 0x30]
call fcn.004021f0
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x90]
mov byte [esp + 0x890], 3
mov edx, dword [ecx]
mov edx, dword [edx]
push eax
mov eax, esi
push eax
call edx
mov esi, 8
cmp dword [esp + 0x40], esi
jb 0x406a06
mov eax, dword [esp + 0x2c]
push eax
call fcn.0042eca7
add esp, 4
mov byte [esp + 0x890], bl
cmp dword [esp + 0xa8], esi
mov dword [esp + 0x40], 7
mov dword [esp + 0x3c], ebx
mov word [esp + 0x2c], bx
jb 0x406a37
mov ecx, dword [esp + 0x94]
push ecx
call fcn.0042eca7
add esp, 4
mov ecx, edi
call fcn.004798e0
mov edi, eax
cmp edi, ebx
jne 0x4068b0
mov esi, dword [esp + 0x20]
mov edx, dword [esi + 4]
cmp edx, ebx
jne 0x406a57
xor ecx, ecx
jmp 0x406a5f
mov ecx, dword [esi + 8]
sub ecx, edx
sar ecx, 2
cmp edx, ebx
je 0x406a80
mov eax, dword [esi + 0xc]
sub eax, edx
sar eax, 2
cmp ecx, eax
jae 0x406a80
mov eax, dword [esi + 8]
mov edx, dword [esp + 0x14]
mov dword [eax], edx
add eax, 4
mov dword [esi + 8], eax
jmp 0x406aa2
mov edi, dword [esi + 8]
cmp edx, edi
jbe 0x406a8c
call fcn.0042f021
push edi
push esi
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0xb8]
push ecx
mov eax, esi
call fcn.00406ce0
mov ecx, dword [esp + 0x1c]
call fcn.004798e0
cmp eax, ebx
mov dword [esp + 0x1c], eax
jne 0x40685e
mov ecx, dword [esi + 4]
cmp ecx, ebx
je 0x40673e
mov eax, dword [esi + 8]
sub eax, ecx
sar eax, 2
cmp eax, 1
jb 0x40673e
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x406ae4
push eax
call fcn.0042eca7
add esp, 4
mov dword [esp + 0x890], 0xffffffff
mov eax, dword [esp + 0x78]
cmp eax, 0x575478
mov dword [esp + 0x44], vtable.TiXmlDocument.0
je 0x406b0b
push eax
call fcn.0042f33e
add esp, 4
lea ecx, [esp + 0x44]
call fcn.00479ec0
mov eax, 1
mov ecx, dword [esp + 0x888]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x870]
xor ecx, esp
call fcn.0042eb95
add esp, 0x880
ret 8