Function at 0x407110
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x54a482
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xf0
push ebx
push ebp
mov dword [esp + 0x2c], ecx
push esi
push edi
lea ecx, [esp + 0x18]
call fcn.00477cf0
mov eax, dword [0x5ada84]
mov dword [esp + 0x108], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
push 0x58ab80
lea ecx, [esp + 0x30]
mov byte [esp + 0x10c], 2
call fcn.00527f6d
mov ebx, dword [esp + 0x114]
mov edi, dword [esp + 0x110]
mov byte [esp + 0x108], 3
cmp word [ebx + 0xc], 0xffff
jne 0x4071c5
mov eax, dword [edi + 0x54]
mov ebp, dword [edi + 0x58]
xor esi, esi
test eax, eax
jle 0x4071bb
mov eax, dword [esp + 0x118]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
push eax
push ecx
push edx
call fcn.00478b20
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4071bb
mov eax, dword [edi + 0x54]
add ebp, 0x38
inc esi
cmp esi, eax
jl 0x407193
cmp esi, dword [edi + 0x54]
jl 0x4071cd
jmp 0x407805
mov ebp, dword [esp + 0x30]
mov esi, dword [esp + 0x30]
mov eax, dword [ebx]
lea ecx, [esp + 0x18]
push eax
push str._html__r_n_head__r_n_meta_http_equiv_Content_Type__content_text_html__charsetgb2312___r_n_title_
call fcn.004780d0
cmp word [ebx + 0xc], 0xffff
jne 0x4071fc
mov ecx, dword [ebp]
push 0x58a6a0
push ecx
push 0x58a96c
lea ecx, [esp + 0x24]
call fcn.004780f0
mov edx, dword [ebx]
push str.__font___big_nbsp_
push edx
push str.__title__r_n__head__r_n_body__r_n_p__big__strong__font_color_000000__
lea ecx, [esp + 0x24]
call fcn.004780f0
cmp word [ebx + 0xc], 0xffff
jne 0x407220
push 0x58af3c
jmp 0x407225
push 0x58af34
lea ecx, [esp + 0x1c]
call fcn.004780a0
lea ecx, [esp + 0x10]
call fcn.00527e8a
push 0
push 0
push ebx
push 0
lea eax, [esp + 0x20]
push edi
push eax
call fcn.004e5220
mov ecx, dword [esp + 0x28]
add esp, 0x18
push ecx
push str.__strong_nbsp_nbsp_nbsp_
lea ecx, [esp + 0x20]
call fcn.004780d0
mov ax, word [ebx + 0xc]
cmp ax, 0xffff
je 0x4072b8
movsx esi, ax
dec esi
lea edx, [esp + 0x38]
push esi
push str.ct_d.htm__
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 0x38]
lea ecx, [esp + 0x18]
push eax
push str.nbsp_nbsp_nbsp_
call fcn.004780d0
mov edi, dword [edi + 0x60]
test esi, esi
jle 0x4072a9
push edi
call fcn.00478c70
add esp, 4
add edi, eax
dec esi
jne 0x40729b
add edi, 4
lea ecx, [esp + 0x18]
push edi
call fcn.004780a0
jmp 0x4072e3
push esi
lea ecx, [esp + 0x3c]
push str.dt_d.htm__
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
mov edx, dword [ebp]
add esp, 0xc
lea eax, [esp + 0x38]
lea ecx, [esp + 0x18]
push edx
push eax
push 0x58aed8
call fcn.004780f0
push str.__a___p__r_n_p_
lea ecx, [esp + 0x1c]
call fcn.004780a0
xor esi, esi
cmp word [ebx + 0x16], 3
jne 0x40730d
push 0x58aea4
lea ecx, [esp + 0x1c]
call fcn.004780a0
mov esi, 1
test byte [ebx + 0xe], 0x10
je 0x407326
push 0x58ae68
lea ecx, [esp + 0x1c]
call fcn.004780a0
mov esi, 1
mov ecx, dword [ebx + 8]
push ecx
call fcn.00478b40
add esp, 4
test eax, eax
jne 0x40739a
cmp esi, 1
jne 0x407349
push str._br_
lea ecx, [esp + 0x1c]
call fcn.004780a0
mov edx, dword [ebx + 8]
lea ecx, [esp + 0x14]
push edx
call fcn.00528088
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx - 8]
cmp byte [eax + ecx - 1], 0x20
jb 0x407383
lea eax, [esp + 0x14]
push eax
call fcn.004e4f70
add esp, 4
test eax, eax
jne 0x407383
lea ecx, [esp + 0x2c]
push ecx
lea ecx, [esp + 0x18]
call fcn.00528317
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
call fcn.004780a0
lea ecx, [esp + 0x14]
call fcn.00527e8a
push str.__p__r_n_p__em_
lea ecx, [esp + 0x1c]
call fcn.004780a0
mov eax, dword [ebx + 0x10]
test eax, eax
jne 0x4073b6
push 0x58a58c
jmp 0x4073ec
mov ecx, dword [esp + 0x120]
lea edx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x38]
push 0
push 0
push edx
push eax
push 0
call fcn.00469130
test byte [ebx + 0xe], 0x40
je 0x4073e7
push 0x58ae20
lea ecx, [esp + 0x18]
call fcn.005282db
mov eax, dword [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
call fcn.004780a0
push str.__font_nbsp_
lea ecx, [esp + 0x1c]
call fcn.004780a0
cmp word [ebx + 0xc], 0xffff
jne 0x407440
push str._em_
lea ecx, [esp + 0x1c]
call fcn.004780a0
test byte [ebp + 0x14], 0x10
je 0x407425
push 0x58aa9c
jmp 0x407429
mov ecx, dword [ebp]
push ecx
lea ecx, [esp + 0x1c]
call fcn.004780a0
push str.__em_
lea ecx, [esp + 0x1c]
call fcn.004780a0
mov edx, dword [ebx]
push 0x58a574
push edx
lea ecx, [esp + 0x20]
call fcn.004780d0
mov eax, dword [ebx + 0x1c]
xor edi, edi
test eax, eax
jle 0x4074b8
xor ebp, ebp
mov ecx, dword [ebx + 0x20]
mov esi, ebp
add esi, ecx
lea ecx, [esp + 0x14]
call fcn.00527e8a
test byte [esi + 0x14], 2
je 0x407481
mov eax, dword [esi]
push str.__font__font_color_000000__
push eax
push str._font_color_000000__
jmp 0x40748e
mov ecx, dword [esi]
push 0x58a564
push ecx
push 0x58a54c
lea ecx, [esp + 0x24]
call fcn.004780f0
mov edx, dword [ebx + 0x1c]
dec edx
cmp edi, edx
je 0x4074ad
push 0x58a524
lea ecx, [esp + 0x1c]
call fcn.004780a0
mov eax, dword [ebx + 0x1c]
inc edi
add ebp, 0x18
cmp edi, eax
jl 0x40745c
test byte [ebx + 0xe], 0x20
je 0x4074cc
push 0x58ad58
lea ecx, [esp + 0x1c]
call fcn.004780a0
push 0x58a4fc
lea ecx, [esp + 0x1c]
call fcn.004780a0
mov eax, dword [ebx + 0x1c]
test eax, eax
jle 0x4074ef
push str._table_border1_cols2_framebelow_rulesrows_width_100___bordercolorlight_000000__bordercolordark_FFFFFF__cellspacing_0__cellpadding_5__
lea ecx, [esp + 0x1c]
call fcn.004780a0
mov eax, dword [ebx + 0x1c]
xor edi, edi
test eax, eax
jle 0x40779e
test edi, edi
jne 0x40750e
push str._tr__r_n_td_width_30___valign_top___strong_
lea ecx, [esp + 0x1c]
call fcn.004780a0
mov ecx, dword [ebx + 0x20]
lea eax, [edi + edi*2]
push str.__font___td__r_n_td_width_70___valign_top__
mov edx, dword [ecx + eax*8]
lea esi, [ecx + eax*8]
push edx
push str._tr__r_n_td_width_30___valign_top___font_color_000000__
lea ecx, [esp + 0x24]
call fcn.004780f0
push str._em_
lea ecx, [esp + 0x14]
call fcn.00528088
test byte [esi + 0x14], 2
je 0x407549
push str._font_color_808080__
jmp 0x40754e
push 0x58ad2c
lea ecx, [esp + 0x14]
call fcn.005282db
push 0x58ad24
lea ecx, [esp + 0x14]
call fcn.005282db
push 0x58a370
lea ecx, [esp + 0x14]
call fcn.005282db
mov eax, dword [ebx + 0x1c]
dec eax
cmp edi, eax
jne 0x40758f
test byte [ebx + 0xe], 0x20
je 0x40758f
push 0x58ad10
lea ecx, [esp + 0x14]
call fcn.005282db
mov ecx, dword [esp + 0x120]
mov eax, dword [esi + 0xc]
push ecx
mov ecx, dword [esp + 0x38]
push 0
lea edx, [esp + 0x1c]
push 0
push edx
push eax
push 0
call fcn.00469130
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x14]
call fcn.00528317
test byte [esi + 0x14], 1
je 0x4076ab
mov eax, dword [esi + 0xc]
cmp eax, 0x80000201
ja 0x407636
je 0x407625
cmp eax, reloc.OLEAUT32.dll_SysReAllocStringLen
ja 0x407608
je 0x407603
cmp eax, 0x80000000
je 0x407656
cmp eax, reloc.OLEAUT32.dll_SysReAllocString
jne 0x4076ab
mov eax, dword [esi + 0x10]
test eax, eax
je 0x4075fc
mov eax, 0x5898d8
jmp 0x407671
mov eax, 0x5898d4
jmp 0x407671
mov eax, dword [esi + 0x10]
jmp 0x407671
cmp eax, 0x80000101
jne 0x4076ab
xor edx, edx
lea eax, [esp + 0x38]
mov dl, byte [esi + 0x10]
push edx
push 0x58ad0c
push eax
jmp 0x407664
movsx ecx, word [esi + 0x10]
push ecx
lea edx, [esp + 0x3c]
push 0x58a810
push edx
jmp 0x407664
cmp eax, 0x80000501
ja 0x40764f
je 0x407656
cmp eax, 0x80000301
je 0x407656
cmp eax, 0x80000401
je 0x407656
jmp 0x4076ab
cmp eax, 0x80000601
jne 0x4076ab
mov eax, dword [esi + 0x10]
lea ecx, [esp + 0x38]
push eax
push 0x58a810
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 0x38]
test eax, eax
je 0x4076ab
push eax
lea edx, [esp + 0x34]
push 0x58acf8
push edx
call fcn.004e6ca0
add esp, 0xc
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x10c], 4
call fcn.00528317
lea ecx, [esp + 0x30]
mov byte [esp + 0x108], 3
call fcn.00527eff
mov eax, dword [esi + 0x14]
test al, 0x1c
je 0x4076d6
test al, 8
je 0x4076bd
push 0x58acdc
jmp 0x4076cd
test al, 0x10
je 0x4076c8
push 0x58acb8
jmp 0x4076cd
push 0x58aca0
lea ecx, [esp + 0x14]
call fcn.005282db
mov eax, dword [esi + 0x14]
test al, 0x40
je 0x4076e4
push 0x58ac78
jmp 0x4076ed
test al, 0x20
je 0x4076f6
push 0x58ac5c
lea ecx, [esp + 0x14]
call fcn.005282db
mov eax, dword [esp + 0x10]
mov ecx, dword [eax - 8]
cmp byte [ecx + eax - 1], 0x20
jb 0x407723
lea eax, [esp + 0x10]
push eax
call fcn.004e4f70
add esp, 4
test eax, eax
jne 0x407723
lea ecx, [esp + 0x2c]
push ecx
lea ecx, [esp + 0x14]
call fcn.00528317
mov edx, dword [esi + 4]
push edx
call fcn.00478b40
add esp, 4
test eax, eax
jne 0x40776d
mov eax, dword [esi + 4]
lea ecx, [esp + 0x10]
push eax
call fcn.005282db
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx - 8]
cmp byte [eax + ecx - 1], 0x20
jb 0x40776d
lea ecx, [esp + 0x10]
push ecx
call fcn.004e4f70
add esp, 4
test eax, eax
jne 0x40776d
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x10]
push edx
call fcn.00528317
mov eax, dword [esp + 0x10]
push str.__td__r_n__tr__r_n
push eax
lea ecx, [esp + 0x20]
call fcn.004780d0
mov eax, dword [ebx + 0x1c]
inc edi
cmp edi, eax
jl 0x4074fc
test eax, eax
jle 0x40779e
push str.__table__r_n
lea ecx, [esp + 0x1c]
call fcn.004780a0
push 0x58a2c0
lea ecx, [esp + 0x1c]
call fcn.004780a0
mov ecx, dword [esp + 0x118]
lea edx, [esp + 0x38]
push ecx
push str.cmd_d.htm
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [esp + 0x128]
add esp, 0xc
lea eax, [esp + 0x38]
lea edx, [esp + 0x30]
push eax
push ecx
push edx
call fcn.00528194
push 0
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x114], 5
call fcn.00478400
lea ecx, [esp + 0x30]
mov byte [esp + 0x108], 3
call fcn.00527eff
lea ecx, [esp + 0x2c]
mov byte [esp + 0x108], 2
call fcn.00527eff
lea ecx, [esp + 0x14]
mov byte [esp + 0x108], 1
call fcn.00527eff
lea ecx, [esp + 0x10]
mov byte [esp + 0x108], 0
call fcn.00527eff
lea ecx, [esp + 0x18]
mov dword [esp + 0x108], 0xffffffff
mov dword [esp + 0x18], 0x55f890
call fcn.00477ef0
mov ecx, dword [esp + 0x100]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xfc
ret 0x14