Function at 0x407020
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x534852
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xf0
push ebx
push ebp
mov dword [esp + 0x2c], ecx
push esi
push edi
lea ecx, [esp + 0x18]
call fcn.00470b30
mov eax, dword [0x58f614]
mov dword [esp + 0x108], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
push 0x56db24
lea ecx, [esp + 0x30]
mov byte [esp + 0x10c], 2
call fcn.005143a4
mov ebx, dword [esp + 0x114]
mov edi, dword [esp + 0x110]
mov byte [esp + 0x108], 3
cmp word [ebx + 0xc], 0xffff
jne 0x4070d5
mov eax, dword [edi + 0x54]
mov ebp, dword [edi + 0x58]
xor esi, esi
test eax, eax
jle 0x4070cb
mov eax, dword [esp + 0x118]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
push eax
push ecx
push edx
call fcn.00471960
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4070cb
mov eax, dword [edi + 0x54]
add ebp, 0x38
inc esi
cmp esi, eax
jl 0x4070a3
cmp esi, dword [edi + 0x54]
jl 0x4070dd
jmp 0x407715
mov ebp, dword [esp + 0x30]
mov esi, dword [esp + 0x30]
mov eax, dword [ebx]
lea ecx, [esp + 0x18]
push eax
push str._html__r_n_head__r_n_meta_http_equiv_Content_Type__content_text_html__charsetgb2312___r_n_title_
call fcn.00470f10
cmp word [ebx + 0xc], 0xffff
jne 0x40710c
mov ecx, dword [ebp]
push 0x56d644
push ecx
push 0x56d910
lea ecx, [esp + 0x24]
call fcn.00470f30
mov edx, dword [ebx]
push str.__font___big_nbsp_
push edx
push str.__title__r_n__head__r_n_body__r_n_p__big__strong__font_color_000000__
lea ecx, [esp + 0x24]
call fcn.00470f30
cmp word [ebx + 0xc], 0xffff
jne 0x407130
push 0x56dee0
jmp 0x407135
push 0x56ded8
lea ecx, [esp + 0x1c]
call fcn.00470ee0
lea ecx, [esp + 0x10]
call fcn.005142c1
push 0
push 0
push ebx
push 0
lea eax, [esp + 0x20]
push edi
push eax
call fcn.004dbcf0
mov ecx, dword [esp + 0x28]
add esp, 0x18
push ecx
push str.__strong_nbsp_nbsp_nbsp_
lea ecx, [esp + 0x20]
call fcn.00470f10
mov ax, word [ebx + 0xc]
cmp ax, 0xffff
je 0x4071c8
movsx esi, ax
dec esi
lea edx, [esp + 0x38]
push esi
push str.ct_d.htm__
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 0x38]
lea ecx, [esp + 0x18]
push eax
push str.nbsp_nbsp_nbsp_
call fcn.00470f10
mov edi, dword [edi + 0x60]
test esi, esi
jle 0x4071b9
push edi
call fcn.00471ab0
add esp, 4
add edi, eax
dec esi
jne 0x4071ab
add edi, 4
lea ecx, [esp + 0x18]
push edi
call fcn.00470ee0
jmp 0x4071f3
push esi
lea ecx, [esp + 0x3c]
push str.dt_d.htm__
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
mov edx, dword [ebp]
add esp, 0xc
lea eax, [esp + 0x38]
lea ecx, [esp + 0x18]
push edx
push eax
push 0x56de7c
call fcn.00470f30
push str.__a___p__r_n_p_
lea ecx, [esp + 0x1c]
call fcn.00470ee0
xor esi, esi
cmp word [ebx + 0x16], 3
jne 0x40721d
push 0x56de48
lea ecx, [esp + 0x1c]
call fcn.00470ee0
mov esi, 1
test byte [ebx + 0xe], 0x10
je 0x407236
push 0x56de0c
lea ecx, [esp + 0x1c]
call fcn.00470ee0
mov esi, 1
mov ecx, dword [ebx + 8]
push ecx
call fcn.00471980
add esp, 4
test eax, eax
jne 0x4072aa
cmp esi, 1
jne 0x407259
push str._br_
lea ecx, [esp + 0x1c]
call fcn.00470ee0
mov edx, dword [ebx + 8]
lea ecx, [esp + 0x14]
push edx
call fcn.00514473
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx - 8]
cmp byte [eax + ecx - 1], 0x20
jb 0x407293
lea eax, [esp + 0x14]
push eax
call fcn.004dba40
add esp, 4
test eax, eax
jne 0x407293
lea ecx, [esp + 0x2c]
push ecx
lea ecx, [esp + 0x18]
call fcn.00514702
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
call fcn.00470ee0
lea ecx, [esp + 0x14]
call fcn.005142c1
push str.__p__r_n_p__em_
lea ecx, [esp + 0x1c]
call fcn.00470ee0
mov eax, dword [ebx + 0x10]
test eax, eax
jne 0x4072c6
push 0x56d530
jmp 0x4072fc
mov ecx, dword [esp + 0x120]
lea edx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x38]
push 0
push 0
push edx
push eax
push 0
call fcn.00462a80
test byte [ebx + 0xe], 0x40
je 0x4072f7
push 0x56ddc4
lea ecx, [esp + 0x18]
call fcn.005146c6
mov eax, dword [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
call fcn.00470ee0
push str.__font_nbsp_
lea ecx, [esp + 0x1c]
call fcn.00470ee0
cmp word [ebx + 0xc], 0xffff
jne 0x407350
push str._em_
lea ecx, [esp + 0x1c]
call fcn.00470ee0
test byte [ebp + 0x14], 0x10
je 0x407335
push 0x56da40
jmp 0x407339
mov ecx, dword [ebp]
push ecx
lea ecx, [esp + 0x1c]
call fcn.00470ee0
push str.__em_
lea ecx, [esp + 0x1c]
call fcn.00470ee0
mov edx, dword [ebx]
push 0x56d518
push edx
lea ecx, [esp + 0x20]
call fcn.00470f10
mov eax, dword [ebx + 0x1c]
xor edi, edi
test eax, eax
jle 0x4073c8
xor ebp, ebp
mov ecx, dword [ebx + 0x20]
mov esi, ebp
add esi, ecx
lea ecx, [esp + 0x14]
call fcn.005142c1
test byte [esi + 0x14], 2
je 0x407391
mov eax, dword [esi]
push str.__font__font_color_000000__
push eax
push str._font_color_000000__
jmp 0x40739e
mov ecx, dword [esi]
push 0x56d508
push ecx
push 0x56d4f0
lea ecx, [esp + 0x24]
call fcn.00470f30
mov edx, dword [ebx + 0x1c]
dec edx
cmp edi, edx
je 0x4073bd
push 0x56d4c8
lea ecx, [esp + 0x1c]
call fcn.00470ee0
mov eax, dword [ebx + 0x1c]
inc edi
add ebp, 0x18
cmp edi, eax
jl 0x40736c
test byte [ebx + 0xe], 0x20
je 0x4073dc
push 0x56dcfc
lea ecx, [esp + 0x1c]
call fcn.00470ee0
push 0x56d4a0
lea ecx, [esp + 0x1c]
call fcn.00470ee0
mov eax, dword [ebx + 0x1c]
test eax, eax
jle 0x4073ff
push str._table_border1_cols2_framebelow_rulesrows_width_100___bordercolorlight_000000__bordercolordark_FFFFFF__cellspacing_0__cellpadding_5__
lea ecx, [esp + 0x1c]
call fcn.00470ee0
mov eax, dword [ebx + 0x1c]
xor edi, edi
test eax, eax
jle 0x4076ae
test edi, edi
jne 0x40741e
push str._tr__r_n_td_width_30___valign_top___strong_
lea ecx, [esp + 0x1c]
call fcn.00470ee0
mov ecx, dword [ebx + 0x20]
lea eax, [edi + edi*2]
push str.__font___td__r_n_td_width_70___valign_top__
mov edx, dword [ecx + eax*8]
lea esi, [ecx + eax*8]
push edx
push str._tr__r_n_td_width_30___valign_top___font_color_000000__
lea ecx, [esp + 0x24]
call fcn.00470f30
push str._em_
lea ecx, [esp + 0x14]
call fcn.00514473
test byte [esi + 0x14], 2
je 0x407459
push str._font_color_808080__
jmp 0x40745e
push 0x56dcd0
lea ecx, [esp + 0x14]
call fcn.005146c6
push 0x56dcc8
lea ecx, [esp + 0x14]
call fcn.005146c6
push 0x56d314
lea ecx, [esp + 0x14]
call fcn.005146c6
mov eax, dword [ebx + 0x1c]
dec eax
cmp edi, eax
jne 0x40749f
test byte [ebx + 0xe], 0x20
je 0x40749f
push 0x56dcb4
lea ecx, [esp + 0x14]
call fcn.005146c6
mov ecx, dword [esp + 0x120]
mov eax, dword [esi + 0xc]
push ecx
mov ecx, dword [esp + 0x38]
push 0
lea edx, [esp + 0x1c]
push 0
push edx
push eax
push 0
call fcn.00462a80
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x14]
call fcn.00514702
test byte [esi + 0x14], 1
je 0x4075bb
mov eax, dword [esi + 0xc]
cmp eax, 0x80000201
ja 0x407546
je 0x407535
cmp eax, 0x80000004
ja 0x407518
je 0x407513
cmp eax, 0x80000000
je 0x407566
cmp eax, 0x80000002
jne 0x4075bb
mov eax, dword [esi + 0x10]
test eax, eax
je 0x40750c
mov eax, 0x56c87c
jmp 0x407581
mov eax, 0x56c878
jmp 0x407581
mov eax, dword [esi + 0x10]
jmp 0x407581
cmp eax, 0x80000101
jne 0x4075bb
xor edx, edx
lea eax, [esp + 0x38]
mov dl, byte [esi + 0x10]
push edx
push 0x56dcb0
push eax
jmp 0x407574
movsx ecx, word [esi + 0x10]
push ecx
lea edx, [esp + 0x3c]
push 0x56d7b4
push edx
jmp 0x407574
cmp eax, 0x80000501
ja 0x40755f
je 0x407566
cmp eax, 0x80000301
je 0x407566
cmp eax, 0x80000401
je 0x407566
jmp 0x4075bb
cmp eax, 0x80000601
jne 0x4075bb
mov eax, dword [esi + 0x10]
lea ecx, [esp + 0x38]
push eax
push 0x56d7b4
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 0x38]
test eax, eax
je 0x4075bb
push eax
lea edx, [esp + 0x34]
push 0x56dc9c
push edx
call fcn.004dd760
add esp, 0xc
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x10c], 4
call fcn.00514702
lea ecx, [esp + 0x30]
mov byte [esp + 0x108], 3
call fcn.00514336
mov eax, dword [esi + 0x14]
test al, 0x1c
je 0x4075e6
test al, 8
je 0x4075cd
push 0x56dc80
jmp 0x4075dd
test al, 0x10
je 0x4075d8
push 0x56dc5c
jmp 0x4075dd
push 0x56dc44
lea ecx, [esp + 0x14]
call fcn.005146c6
mov eax, dword [esi + 0x14]
test al, 0x40
je 0x4075f4
push 0x56dc1c
jmp 0x4075fd
test al, 0x20
je 0x407606
push 0x56dc00
lea ecx, [esp + 0x14]
call fcn.005146c6
mov eax, dword [esp + 0x10]
mov ecx, dword [eax - 8]
cmp byte [ecx + eax - 1], 0x20
jb 0x407633
lea eax, [esp + 0x10]
push eax
call fcn.004dba40
add esp, 4
test eax, eax
jne 0x407633
lea ecx, [esp + 0x2c]
push ecx
lea ecx, [esp + 0x14]
call fcn.00514702
mov edx, dword [esi + 4]
push edx
call fcn.00471980
add esp, 4
test eax, eax
jne 0x40767d
mov eax, dword [esi + 4]
lea ecx, [esp + 0x10]
push eax
call fcn.005146c6
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx - 8]
cmp byte [eax + ecx - 1], 0x20
jb 0x40767d
lea ecx, [esp + 0x10]
push ecx
call fcn.004dba40
add esp, 4
test eax, eax
jne 0x40767d
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x10]
push edx
call fcn.00514702
mov eax, dword [esp + 0x10]
push str.__td__r_n__tr__r_n
push eax
lea ecx, [esp + 0x20]
call fcn.00470f10
mov eax, dword [ebx + 0x1c]
inc edi
cmp edi, eax
jl 0x40740c
test eax, eax
jle 0x4076ae
push str.__table__r_n
lea ecx, [esp + 0x1c]
call fcn.00470ee0
push 0x56d264
lea ecx, [esp + 0x1c]
call fcn.00470ee0
mov ecx, dword [esp + 0x118]
lea edx, [esp + 0x38]
push ecx
push str.cmd_d.htm
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [esp + 0x128]
add esp, 0xc
lea eax, [esp + 0x38]
lea edx, [esp + 0x30]
push eax
push ecx
push edx
call fcn.0051457f
push 0
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x114], 5
call fcn.00471240
lea ecx, [esp + 0x30]
mov byte [esp + 0x108], 3
call fcn.00514336
lea ecx, [esp + 0x2c]
mov byte [esp + 0x108], 2
call fcn.00514336
lea ecx, [esp + 0x14]
mov byte [esp + 0x108], 1
call fcn.00514336
lea ecx, [esp + 0x10]
mov byte [esp + 0x108], 0
call fcn.00514336
lea ecx, [esp + 0x18]
mov dword [esp + 0x108], 0xffffffff
mov dword [esp + 0x18], 0x5477b0
call fcn.00470d30
mov ecx, dword [esp + 0x100]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xfc
ret 0x14