Function at 0x407120
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x54a5a2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xf0
push ebx
push ebp
mov dword [esp + 0x2c], ecx
push esi
push edi
lea ecx, [esp + 0x18]
call fcn.00477df0
mov eax, dword [0x5ada84]
mov dword [esp + 0x108], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
push 0x58ab80
lea ecx, [esp + 0x30]
mov byte [esp + 0x10c], 2
call fcn.0052808d
mov ebx, dword [esp + 0x114]
mov edi, dword [esp + 0x110]
mov byte [esp + 0x108], 3
cmp word [ebx + 0xc], 0xffff
jne 0x4071d5
mov eax, dword [edi + 0x54]
mov ebp, dword [edi + 0x58]
xor esi, esi
test eax, eax
jle 0x4071cb
mov eax, dword [esp + 0x118]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
push eax
push ecx
push edx
call fcn.00478c20
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4071cb
mov eax, dword [edi + 0x54]
add ebp, 0x38
inc esi
cmp esi, eax
jl 0x4071a3
cmp esi, dword [edi + 0x54]
jl 0x4071dd
jmp 0x407815
mov ebp, dword [esp + 0x30]
mov esi, dword [esp + 0x30]
mov eax, dword [ebx]
lea ecx, [esp + 0x18]
push eax
push str._html__r_n_head__r_n_meta_http_equiv_Content_Type__content_text_html__charsetgb2312___r_n_title_
call fcn.004781d0
cmp word [ebx + 0xc], 0xffff
jne 0x40720c
mov ecx, dword [ebp]
push 0x58a6a0
push ecx
push 0x58a96c
lea ecx, [esp + 0x24]
call fcn.004781f0
mov edx, dword [ebx]
push str.__font___big_nbsp_
push edx
push str.__title__r_n__head__r_n_body__r_n_p__big__strong__font_color_000000__
lea ecx, [esp + 0x24]
call fcn.004781f0
cmp word [ebx + 0xc], 0xffff
jne 0x407230
push 0x58af3c
jmp 0x407235
push 0x58af34
lea ecx, [esp + 0x1c]
call fcn.004781a0
lea ecx, [esp + 0x10]
call fcn.00527faa
push 0
push 0
push ebx
push 0
lea eax, [esp + 0x20]
push edi
push eax
call fcn.004e5320
mov ecx, dword [esp + 0x28]
add esp, 0x18
push ecx
push str.__strong_nbsp_nbsp_nbsp_
lea ecx, [esp + 0x20]
call fcn.004781d0
mov ax, word [ebx + 0xc]
cmp ax, 0xffff
je 0x4072c8
movsx esi, ax
dec esi
lea edx, [esp + 0x38]
push esi
push str.ct_d.htm__
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 0x38]
lea ecx, [esp + 0x18]
push eax
push str.nbsp_nbsp_nbsp_
call fcn.004781d0
mov edi, dword [edi + 0x60]
test esi, esi
jle 0x4072b9
push edi
call fcn.00478d70
add esp, 4
add edi, eax
dec esi
jne 0x4072ab
add edi, 4
lea ecx, [esp + 0x18]
push edi
call fcn.004781a0
jmp 0x4072f3
push esi
lea ecx, [esp + 0x3c]
push str.dt_d.htm__
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
mov edx, dword [ebp]
add esp, 0xc
lea eax, [esp + 0x38]
lea ecx, [esp + 0x18]
push edx
push eax
push 0x58aed8
call fcn.004781f0
push str.__a___p__r_n_p_
lea ecx, [esp + 0x1c]
call fcn.004781a0
xor esi, esi
cmp word [ebx + 0x16], 3
jne 0x40731d
push 0x58aea4
lea ecx, [esp + 0x1c]
call fcn.004781a0
mov esi, 1
test byte [ebx + 0xe], 0x10
je 0x407336
push 0x58ae68
lea ecx, [esp + 0x1c]
call fcn.004781a0
mov esi, 1
mov ecx, dword [ebx + 8]
push ecx
call fcn.00478c40
add esp, 4
test eax, eax
jne 0x4073aa
cmp esi, 1
jne 0x407359
push str._br_
lea ecx, [esp + 0x1c]
call fcn.004781a0
mov edx, dword [ebx + 8]
lea ecx, [esp + 0x14]
push edx
call fcn.005281a8
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx - 8]
cmp byte [eax + ecx - 1], 0x20
jb 0x407393
lea eax, [esp + 0x14]
push eax
call fcn.004e5070
add esp, 4
test eax, eax
jne 0x407393
lea ecx, [esp + 0x2c]
push ecx
lea ecx, [esp + 0x18]
call fcn.00528437
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
call fcn.004781a0
lea ecx, [esp + 0x14]
call fcn.00527faa
push str.__p__r_n_p__em_
lea ecx, [esp + 0x1c]
call fcn.004781a0
mov eax, dword [ebx + 0x10]
test eax, eax
jne 0x4073c6
push 0x58a58c
jmp 0x4073fc
mov ecx, dword [esp + 0x120]
lea edx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x38]
push 0
push 0
push edx
push eax
push 0
call fcn.00469220
test byte [ebx + 0xe], 0x40
je 0x4073f7
push 0x58ae20
lea ecx, [esp + 0x18]
call fcn.005283fb
mov eax, dword [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
call fcn.004781a0
push str.__font_nbsp_
lea ecx, [esp + 0x1c]
call fcn.004781a0
cmp word [ebx + 0xc], 0xffff
jne 0x407450
push str._em_
lea ecx, [esp + 0x1c]
call fcn.004781a0
test byte [ebp + 0x14], 0x10
je 0x407435
push 0x58aa9c
jmp 0x407439
mov ecx, dword [ebp]
push ecx
lea ecx, [esp + 0x1c]
call fcn.004781a0
push str.__em_
lea ecx, [esp + 0x1c]
call fcn.004781a0
mov edx, dword [ebx]
push 0x58a574
push edx
lea ecx, [esp + 0x20]
call fcn.004781d0
mov eax, dword [ebx + 0x1c]
xor edi, edi
test eax, eax
jle 0x4074c8
xor ebp, ebp
mov ecx, dword [ebx + 0x20]
mov esi, ebp
add esi, ecx
lea ecx, [esp + 0x14]
call fcn.00527faa
test byte [esi + 0x14], 2
je 0x407491
mov eax, dword [esi]
push str.__font__font_color_000000__
push eax
push str._font_color_000000__
jmp 0x40749e
mov ecx, dword [esi]
push 0x58a564
push ecx
push 0x58a54c
lea ecx, [esp + 0x24]
call fcn.004781f0
mov edx, dword [ebx + 0x1c]
dec edx
cmp edi, edx
je 0x4074bd
push 0x58a524
lea ecx, [esp + 0x1c]
call fcn.004781a0
mov eax, dword [ebx + 0x1c]
inc edi
add ebp, 0x18
cmp edi, eax
jl 0x40746c
test byte [ebx + 0xe], 0x20
je 0x4074dc
push 0x58ad58
lea ecx, [esp + 0x1c]
call fcn.004781a0
push 0x58a4fc
lea ecx, [esp + 0x1c]
call fcn.004781a0
mov eax, dword [ebx + 0x1c]
test eax, eax
jle 0x4074ff
push str._table_border1_cols2_framebelow_rulesrows_width_100___bordercolorlight_000000__bordercolordark_FFFFFF__cellspacing_0__cellpadding_5__
lea ecx, [esp + 0x1c]
call fcn.004781a0
mov eax, dword [ebx + 0x1c]
xor edi, edi
test eax, eax
jle 0x4077ae
test edi, edi
jne 0x40751e
push str._tr__r_n_td_width_30___valign_top___strong_
lea ecx, [esp + 0x1c]
call fcn.004781a0
mov ecx, dword [ebx + 0x20]
lea eax, [edi + edi*2]
push str.__font___td__r_n_td_width_70___valign_top__
mov edx, dword [ecx + eax*8]
lea esi, [ecx + eax*8]
push edx
push str._tr__r_n_td_width_30___valign_top___font_color_000000__
lea ecx, [esp + 0x24]
call fcn.004781f0
push str._em_
lea ecx, [esp + 0x14]
call fcn.005281a8
test byte [esi + 0x14], 2
je 0x407559
push str._font_color_808080__
jmp 0x40755e
push 0x58ad2c
lea ecx, [esp + 0x14]
call fcn.005283fb
push 0x58ad24
lea ecx, [esp + 0x14]
call fcn.005283fb
push 0x58a370
lea ecx, [esp + 0x14]
call fcn.005283fb
mov eax, dword [ebx + 0x1c]
dec eax
cmp edi, eax
jne 0x40759f
test byte [ebx + 0xe], 0x20
je 0x40759f
push 0x58ad10
lea ecx, [esp + 0x14]
call fcn.005283fb
mov ecx, dword [esp + 0x120]
mov eax, dword [esi + 0xc]
push ecx
mov ecx, dword [esp + 0x38]
push 0
lea edx, [esp + 0x1c]
push 0
push edx
push eax
push 0
call fcn.00469220
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x14]
call fcn.00528437
test byte [esi + 0x14], 1
je 0x4076bb
mov eax, dword [esi + 0xc]
cmp eax, 0x80000201
ja 0x407646
je 0x407635
cmp eax, reloc.OLEAUT32.dll_SysReAllocStringLen
ja 0x407618
je 0x407613
cmp eax, 0x80000000
je 0x407666
cmp eax, reloc.OLEAUT32.dll_SysReAllocString
jne 0x4076bb
mov eax, dword [esi + 0x10]
test eax, eax
je 0x40760c
mov eax, 0x5898d8
jmp 0x407681
mov eax, 0x5898d4
jmp 0x407681
mov eax, dword [esi + 0x10]
jmp 0x407681
cmp eax, 0x80000101
jne 0x4076bb
xor edx, edx
lea eax, [esp + 0x38]
mov dl, byte [esi + 0x10]
push edx
push 0x58ad0c
push eax
jmp 0x407674
movsx ecx, word [esi + 0x10]
push ecx
lea edx, [esp + 0x3c]
push 0x58a810
push edx
jmp 0x407674
cmp eax, 0x80000501
ja 0x40765f
je 0x407666
cmp eax, 0x80000301
je 0x407666
cmp eax, 0x80000401
je 0x407666
jmp 0x4076bb
cmp eax, 0x80000601
jne 0x4076bb
mov eax, dword [esi + 0x10]
lea ecx, [esp + 0x38]
push eax
push 0x58a810
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 0x38]
test eax, eax
je 0x4076bb
push eax
lea edx, [esp + 0x34]
push 0x58acf8
push edx
call fcn.004e6da0
add esp, 0xc
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x10c], 4
call fcn.00528437
lea ecx, [esp + 0x30]
mov byte [esp + 0x108], 3
call fcn.0052801f
mov eax, dword [esi + 0x14]
test al, 0x1c
je 0x4076e6
test al, 8
je 0x4076cd
push 0x58acdc
jmp 0x4076dd
test al, 0x10
je 0x4076d8
push 0x58acb8
jmp 0x4076dd
push 0x58aca0
lea ecx, [esp + 0x14]
call fcn.005283fb
mov eax, dword [esi + 0x14]
test al, 0x40
je 0x4076f4
push 0x58ac78
jmp 0x4076fd
test al, 0x20
je 0x407706
push 0x58ac5c
lea ecx, [esp + 0x14]
call fcn.005283fb
mov eax, dword [esp + 0x10]
mov ecx, dword [eax - 8]
cmp byte [ecx + eax - 1], 0x20
jb 0x407733
lea eax, [esp + 0x10]
push eax
call fcn.004e5070
add esp, 4
test eax, eax
jne 0x407733
lea ecx, [esp + 0x2c]
push ecx
lea ecx, [esp + 0x14]
call fcn.00528437
mov edx, dword [esi + 4]
push edx
call fcn.00478c40
add esp, 4
test eax, eax
jne 0x40777d
mov eax, dword [esi + 4]
lea ecx, [esp + 0x10]
push eax
call fcn.005283fb
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx - 8]
cmp byte [eax + ecx - 1], 0x20
jb 0x40777d
lea ecx, [esp + 0x10]
push ecx
call fcn.004e5070
add esp, 4
test eax, eax
jne 0x40777d
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x10]
push edx
call fcn.00528437
mov eax, dword [esp + 0x10]
push str.__td__r_n__tr__r_n
push eax
lea ecx, [esp + 0x20]
call fcn.004781d0
mov eax, dword [ebx + 0x1c]
inc edi
cmp edi, eax
jl 0x40750c
test eax, eax
jle 0x4077ae
push str.__table__r_n
lea ecx, [esp + 0x1c]
call fcn.004781a0
push 0x58a2c0
lea ecx, [esp + 0x1c]
call fcn.004781a0
mov ecx, dword [esp + 0x118]
lea edx, [esp + 0x38]
push ecx
push str.cmd_d.htm
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [esp + 0x128]
add esp, 0xc
lea eax, [esp + 0x38]
lea edx, [esp + 0x30]
push eax
push ecx
push edx
call fcn.005282b4
push 0
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x114], 5
call fcn.00478500
lea ecx, [esp + 0x30]
mov byte [esp + 0x108], 3
call fcn.0052801f
lea ecx, [esp + 0x2c]
mov byte [esp + 0x108], 2
call fcn.0052801f
lea ecx, [esp + 0x14]
mov byte [esp + 0x108], 1
call fcn.0052801f
lea ecx, [esp + 0x10]
mov byte [esp + 0x108], 0
call fcn.0052801f
lea ecx, [esp + 0x18]
mov dword [esp + 0x108], 0xffffffff
mov dword [esp + 0x18], 0x55f890
call fcn.00477ff0
mov ecx, dword [esp + 0x100]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xfc
ret 0x14