Function at 0x47ec00
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4e72e0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push edi
push 0x4ebd38
mov dword [esp + 0x20], ecx
call ebp
lea esi, [eax + eax + 2]
lea eax, [esi + 2]
push eax
call fcn.00445f00
mov ecx, esi
mov edx, ecx
shr ecx, 2
mov esi, 0x4ebd38
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
add esp, 4
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x54]
mov ax, word [eax]
cmp ax, 0x2a
jne 0x47ec81
mov dword [esp + 0x14], 9
jmp 0x47ec8f
cmp ax, 0x24
jne 0x47ec8f
mov dword [esp + 0x14], 0x20
lea ecx, [esp + 0x54]
push ecx
mov byte [esp + 0x14], 1
call fcn.0041676d
lea edx, [esp + 0x58]
push edx
call fcn.0043f2e0
mov esi, dword [esp + 0x5c]
push 1
push esi
push 0x4ec53c
call fcn.004403f0
add esp, 0x14
test al, al
mov byte [esp + 0x13], al
je 0x47ecdc
lea eax, [esp + 0x54]
add esi, 2
push eax
mov dword [esp + 0x58], esi
call fcn.0043f2e0
mov esi, dword [esp + 0x58]
add esp, 4
xor bl, bl
cmp word [esi], 0x2d
mov byte [esp + 0x12], bl
jne 0x47ee07
lea esp, [esp]
mov eax, esi
mov ecx, str._delims:
mov edx, 7
lea esp, [esp]
movzx edi, word [eax]
movsx ebp, byte [ecx]
or edi, 0x20
or ebp, 0x20
add eax, 2
inc ecx
cmp ebp, edi
jne 0x47ed84
dec edx
jns 0x47ed00
lea ecx, [esp + 0x54]
add esi, 0x10
push ecx
mov dword [esp + 0x58], esi
call fcn.00443250
mov esi, dword [esp + 0x58]
movzx edx, word [esi]
add esp, 4
add esi, 2
mov dword [esp + 0x14], edx
mov dword [esp + 0x54], esi
mov ax, word [esi]
test ax, ax
je 0x47ed66
cmp ax, 9
jb 0x47ed51
cmp ax, 0xd
jbe 0x47ed66
cmp ax, 0x20
je 0x47ed66
add esi, 2
mov dword [esp + 0x54], esi
mov ax, word [esi]
test ax, ax
jne 0x47ed45
mov ax, word [esi]
cmp ax, 9
jb 0x47ed75
cmp ax, 0xd
jbe 0x47ed7b
cmp ax, 0x20
jne 0x47edf3
add esi, 2
mov dword [esp + 0x54], esi
jmp 0x47ed66
push 9
push esi
push str._trimleft
call fcn.004403f0
add esp, 0xc
test al, al
je 0x47edc4
add esi, 0x12
mov dword [esp + 0x54], esi
je 0x47edbf
mov ax, word [esi]
cmp ax, 9
jb 0x47edb0
cmp ax, 0xd
jbe 0x47edb6
cmp ax, 0x20
jne 0x47edbf
add esi, 2
mov dword [esp + 0x54], esi
jmp 0x47eda1
or bl, 1
jmp 0x47edf3
push 0xa
push esi
push str._trimright
call fcn.004403f0
add esp, 0xc
test al, al
je 0x47ee1e
lea eax, [esp + 0x54]
add esi, 0x14
push eax
mov dword [esp + 0x58], esi
call fcn.0043f2e0
add esp, 4
or bl, 2
mov esi, dword [esp + 0x54]
cmp word [esi], 0x2d
je 0x47ecf0
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov byte [esp + 0x12], bl
mov eax, dword [esp + 0x14]
cmp eax, 9
jne 0x47ef20
mov byte [esp + 0x10], 0
jmp 0x47ef25
push 5
push esi
push str._trim
call fcn.004403f0
add esp, 0xc
test al, al
je 0x47ee4b
lea ecx, [esp + 0x54]
add esi, 0xa
push ecx
mov dword [esp + 0x58], esi
call fcn.0043f2e0
add esp, 4
or bl, 3
jmp 0x47edef
push 5
push esi
push str._left
call fcn.004403f0
add esp, 0xc
test al, al
je 0x47ee7d
lea edx, [esp + 0x54]
add esi, 0xa
push edx
mov dword [esp + 0x58], esi
call fcn.0043f2e0
add esp, 4
mov byte [esp + 0x10], 0
jmp 0x47edef
push 3
push esi
push 0x4f65f0
call fcn.004403f0
add esp, 0xc
test al, al
je 0x47eeb2
lea eax, [esp + 0x54]
add esi, 6
push eax
mov dword [esp + 0x58], esi
call fcn.0043f2e0
add esp, 4
mov dword [esp + 0x30], 0x10000
jmp 0x47edef
push 3
push esi
push 0x4f65ec
call fcn.004403f0
add esp, 0xc
test al, al
je 0x47eee7
lea ecx, [esp + 0x54]
add esi, 6
push ecx
mov dword [esp + 0x58], esi
call fcn.0043f2e0
add esp, 4
mov dword [esp + 0x2c], 1
jmp 0x47edef
push 4
push esi
push str._rq1
call fcn.004403f0
add esp, 0xc
test al, al
je 0x47ed3d
lea edx, [esp + 0x54]
add esi, 8
push edx
mov dword [esp + 0x58], esi
call fcn.0043f2e0
add esp, 4
mov dword [esp + 0x2c], 3
jmp 0x47edef
test ax, ax
je 0x47ef2d
mov dword [esp + 0x30], 0
push 0x3d
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x5c]
push ecx
call fcn.00449370
mov ecx, dword [esp + 0x28]
add esp, 0xc
push 0
lea edx, [esp + 0x1c]
push edx
call fcn.004152c8
mov ebx, dword [esp + 0x18]
cmp word [ebx], 0
jne 0x47ef72
mov eax, dword [0x51927c]
add ebx, 0xfffffff8
push ebx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x47f75f
mov ecx, dword [esp + 0x54]
cmp word [ecx], 0x3d
je 0x47ef94
mov ecx, dword [0x51927c]
add ebx, 0xfffffff8
push ebx
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x47f75f
add ecx, 2
xor edi, edi
mov dword [esp + 0x54], ecx
mov dword [esp + 0x20], edi
mov eax, dword [esp + 0x2c]
test eax, eax
mov byte [esp + 0x4c], 1
mov esi, 0x22
jne 0x47efbf
mov al, byte [esp + 0x12]
test al, al
je 0x47f137
mov al, byte [esp + 0x13]
test al, al
je 0x47efe6
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x58]
push eax
push ecx
call fcn.00461600
mov ecx, dword [esp + 0x60]
mov edi, dword [esp + 0x2c]
add esp, 0xc
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x47f044
push ecx
call ebp
cmp eax, 2
mov ecx, dword [esp + 0x54]
jl 0x47f01a
cmp word [ecx], si
jne 0x47f01a
cmp word [ecx + eax*2 - 2], si
jne 0x47f01a
mov word [ecx + eax*2 - 2], 0
mov ecx, dword [esp + 0x54]
add ecx, 2
mov dword [esp + 0x54], ecx
jmp 0x47f044
cmp dword [esp + 0x2c], 1
jle 0x47f044
cmp word [ecx], si
jne 0x47f02e
dec eax
add ecx, 2
mov dword [esp + 0x54], ecx
test eax, eax
jle 0x47f044
cmp word [ecx + eax*2 - 2], si
jne 0x47f044
mov word [ecx + eax*2 - 2], 0
mov ecx, dword [esp + 0x54]
mov dl, byte [esp + 0x12]
test dl, dl
je 0x47f0f8
test dl, 1
je 0x47f082
mov eax, dword [esp + 0x14]
test eax, eax
je 0x47f0b7
movzx eax, word [ecx]
cmp eax, dword [esp + 0x14]
jne 0x47f082
jmp 0x47f070
mov esi, dword [esp + 0x14]
add ecx, 2
mov dword [esp + 0x54], ecx
movzx eax, word [ecx]
cmp eax, esi
je 0x47f070
test dl, 2
je 0x47f100
push ecx
call ebp
mov edx, dword [esp + 0x14]
test edx, edx
mov ecx, dword [esp + 0x54]
lea eax, [ecx + eax*2 - 2]
je 0x47f0d5
movzx esi, word [eax]
cmp esi, edx
jne 0x47f100
mov word [eax], 0
movzx ecx, word [eax - 2]
sub eax, 2
cmp ecx, edx
je 0x47f0a1
mov ecx, dword [esp + 0x54]
jmp 0x47f100
mov ax, word [ecx]
cmp ax, 9
jb 0x47f0c6
cmp ax, 0xd
jbe 0x47f0cc
cmp ax, 0x20
jne 0x47f082
add ecx, 2
mov dword [esp + 0x54], ecx
jmp 0x47f0b7
mov dx, word [eax]
cmp dx, 9
jb 0x47f0e4
cmp dx, 0xd
jbe 0x47f0ea
cmp dx, 0x20
jne 0x47f100
mov word [eax], 0
mov ecx, dword [esp + 0x54]
sub eax, 2
jmp 0x47f0d5
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x47f137
push ecx
mov ecx, dword [esp + 0x20]
push ebx
call fcn.00444550
test edi, edi
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
je 0x47f124
mov edx, dword [0x51927c]
add edi, 0xfffffff8
push edi
push 0
push edx
call esi
mov eax, dword [0x51927c]
add ebx, 0xfffffff8
push ebx
push 0
push eax
call esi
jmp 0x47f75f
mov esi, dword [sym.imp.SHLWAPI.dll_StrChrW]
push 0x2c
mov ebp, 1
push ebx
mov dword [esp + 0x44], ebp
call esi
test eax, eax
je 0x47f161
nop
push 0x2c
add eax, 2
push eax
inc ebp
call esi
test eax, eax
jne 0x47f150
mov dword [esp + 0x3c], ebp
mov eax, dword [esp + 0x54]
cmp word [eax], 0x3c
jne 0x47f5cb
lea ecx, [esp + 0x54]
add eax, 2
push ecx
mov byte [esp + 0x15], 0
mov dword [esp + 0x58], eax
call fcn.0043f2e0
mov eax, dword [esp + 0x58]
add esp, 4
cmp word [eax], 0x7e
mov byte [esp + 0x12], 0
jne 0x47f1a4
mov dl, byte [eax]
add eax, 2
mov byte [esp + 0x12], dl
mov dword [esp + 0x54], eax
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x58]
push ecx
mov dword [esp + 0x3c], 1
mov dword [esp + 0x40], 0
call fcn.0044d230
add esp, 8
test eax, eax
jl 0x47f24f
mov esi, dword [esp + 0x54]
mov edi, dword [esp + 0x34]
mov dword [esp + 0x24], esi
mov ax, word [esi]
cmp ax, 0x2a
mov dword [esp + 0x2c], edi
jne 0x47f1f3
mov byte [esp + 0x11], 1
mov edx, 1
jmp 0x47f207
cmp ax, 0x2d
jne 0x47f205
mov byte [esp + 0x11], 2
mov edx, 1
jmp 0x47f207
mov edx, ebp
xor ecx, ecx
test ax, ax
mov dword [esp + 0x28], 0xffffffff
je 0x47f24b
cmp ecx, edx
jge 0x47f27b
mov ax, word [esi]
test ax, ax
je 0x47f237
cmp ax, 0x3e
je 0x47f237
add esi, 2
mov dword [esp + 0x24], esi
mov ax, word [esi]
test ax, ax
jne 0x47f222
cmp word [esi], 0x3e
jne 0x47f245
inc ecx
add esi, 2
mov dword [esp + 0x24], esi
cmp word [esi], 0
jne 0x47f216
cmp ecx, edx
jge 0x47f27b
lea ecx, [esp + 0x20]
call fcn.0043f290
lea ecx, [esp + 0x18]
call fcn.0043f290
pop edi
pop esi
pop ebp
mov eax, 0x80070057
pop ebx
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
add esp, 0x40
ret 8
mov al, byte [esp + 0x10]
test al, al
mov ebx, dword [esp + 0x14]
je 0x47f2a9
test ebx, ebx
jne 0x47f29e
lea edx, [esp + 0x24]
push edx
call fcn.0043f2e0
mov esi, dword [esp + 0x28]
add esp, 4
jmp 0x47f2a9
mov edx, ebx
lea eax, [esp + 0x54]
call fcn.00445be0
mov al, byte [esp + 0x13]
test al, al
je 0x47f2f2
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x28]
push ecx
push edx
call fcn.00461600
mov al, byte [esp + 0x1c]
add esp, 0xc
test al, al
je 0x47f2ee
test ebx, ebx
jne 0x47f2e3
lea eax, [esp + 0x24]
push eax
call fcn.0043f2e0
add esp, 4
jmp 0x47f2ee
mov edx, ebx
lea eax, [esp + 0x54]
call fcn.00445be0
mov esi, dword [esp + 0x24]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x30]
mov al, byte [esp + 0x11]
or edx, ecx
cmp al, 2
mov ebx, esi
mov esi, dword [esp + 0x18]
mov dword [esp + 0x14], edx
jne 0x47f3b3
lea ecx, [esp + 0x34]
call fcn.00446250
test edi, edi
mov byte [esp + 0x4c], 2
jge 0x47f353
lea ecx, [esp + 0x3c]
call fcn.00446250
mov edx, dword [esp + 0x14]
mov esi, dword [esp + 0x1c]
push edx
lea eax, [esp + 0x40]
push eax
push ebx
lea ecx, [esp + 0x34]
push ecx
mov ecx, esi
call fcn.00449160
lea ecx, [esp + 0x3c]
call fcn.0043f290
jmp 0x47f357
mov esi, dword [esp + 0x1c]
lea eax, [edi - 1]
cmp eax, 0xffffffff
mov dword [esp + 0x30], eax
jge 0x47f36f
mov edx, dword [esp + 0x28]
lea eax, [eax + edx + 1]
mov dword [esp + 0x30], eax
test eax, eax
jge 0x47f37b
mov dword [esp + 0x30], 0
mov eax, dword [esp + 0x14]
push eax
lea ecx, [esp + 0x38]
push ecx
push ebx
lea edx, [esp + 0x3c]
push edx
mov ecx, esi
call fcn.00449160
mov ecx, dword [esp + 0x18]
cmp word [ecx], 0
je 0x47f3a5
push eax
push ecx
mov ecx, esi
call fcn.00444550
lea ecx, [esp + 0x34]
call fcn.0043f290
jmp 0x47f74d
cmp al, 1
jne 0x47f410
test edi, edi
jne 0x47f3c5
mov dword [esp + 0x2c], 1
jmp 0x47f410
jge 0x47f410
lea ecx, [esp + 0x34]
call fcn.00446250
mov eax, dword [esp + 0x14]
push eax
lea ecx, [esp + 0x38]
push ecx
mov ecx, dword [esp + 0x24]
push ebx
lea edx, [esp + 0x34]
push edx
call fcn.00449160
lea ecx, [esp + 0x34]
call fcn.0043f290
mov eax, dword [esp + 0x28]
mov ecx, eax
neg ecx
cmp edi, ecx
jg 0x47f408
mov dword [esp + 0x2c], 1
jmp 0x47f410
lea edx, [edi + eax + 1]
mov dword [esp + 0x2c], edx
test ebp, ebp
jle 0x47f74d
jmp 0x47f420
mov esi, dword [esp + 0x34]
mov edi, edi
lea ecx, [esp + 0x30]
call fcn.00446250
push 0x2c
push esi
mov byte [esp + 0x54], 3
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov ebp, eax
test ebp, ebp
je 0x47f446
mov word [ebp], 0
add ebp, 2
mov edi, dword [esp + 0x2c]
test edi, edi
jge 0x47f481
mov eax, dword [esp + 0x28]
test eax, eax
jge 0x47f481
lea ecx, [esp + 0x40]
call fcn.00446250
mov eax, dword [esp + 0x14]
push eax
lea ecx, [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x24]
push ebx
lea edx, [esp + 0x34]
push edx
call fcn.00449160
lea ecx, [esp + 0x40]
call fcn.0043f290
push esi
call fcn.0041e7c0
lea eax, [edi - 1]
add esp, 4
cmp eax, 0xffffffff
mov dword [esp + 0x34], eax
jne 0x47f4a0
mov dword [esp + 0x34], 0
jmp 0x47f4b2
jge 0x47f4ae
mov ecx, dword [esp + 0x28]
lea eax, [eax + ecx + 1]
mov dword [esp + 0x34], eax
test eax, eax
jl 0x47f4cb
mov edx, dword [esp + 0x14]
push edx
lea eax, [esp + 0x34]
push eax
push ebx
lea ecx, [esp + 0x40]
push ecx
mov ecx, dword [esp + 0x2c]
call fcn.00449160
mov al, byte [esp + 0x12]
test al, al
mov edi, dword [esp + 0x30]
je 0x47f4fb
cmp word [edi], 0x22
jne 0x47f4fb
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 2
jl 0x47f4fb
cmp word [edi + eax*2 - 2], 0x22
jne 0x47f4fb
mov word [edi + eax*2 - 2], 0
add edi, 2
cmp word [esi], 0
je 0x47f50c
mov ecx, dword [esp + 0x1c]
push edi
push esi
call fcn.00444550
test ebp, ebp
mov dword [esp + 0x34], ebp
je 0x47f5bd
lea edx, [esp + 0x34]
push edx
call fcn.0043f2e0
mov ecx, dword [esp + 0x30]
mov al, byte [esp + 0x15]
add esp, 4
inc ecx
cmp al, 1
mov dword [esp + 0x2c], ecx
je 0x47f599
mov ecx, dword [esp + 0x54]
mov ax, word [ecx]
test ax, ax
je 0x47f557
cmp ax, 0x3c
je 0x47f557
add ecx, 2
mov dword [esp + 0x54], ecx
mov ax, word [ecx]
test ax, ax
jne 0x47f542
lea eax, [esp + 0x54]
add ecx, 2
push eax
mov dword [esp + 0x58], ecx
call fcn.0043f2e0
mov eax, dword [esp + 0x58]
add esp, 4
cmp word [eax], 0x7e
mov byte [esp + 0x12], 0
jne 0x47f587
mov cl, byte [eax]
add eax, 2
mov byte [esp + 0x12], cl
mov dword [esp + 0x54], eax
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x58]
push eax
call fcn.00449a90
add esp, 8
lea ecx, [esp + 0x30]
mov byte [esp + 0x4c], 1
call fcn.0043f290
mov eax, dword [esp + 0x3c]
dec eax
test eax, eax
mov dword [esp + 0x3c], eax
jg 0x47f41a
jmp 0x47f74d
lea ecx, [esp + 0x30]
call fcn.0043f290
jmp 0x47f74d
mov ebp, eax
mov edx, 0x2c
lea eax, [esp + 0x54]
mov dword [esp + 0x40], ebp
call fcn.00445b70
mov eax, dword [esp + 0x54]
cmp word [eax], dx
jne 0x47f610
xor edi, edi
mov word [eax], di
mov eax, dword [esp + 0x54]
add eax, 2
mov dword [esp + 0x54], eax
mov esi, eax
lea eax, [esp + 0x54]
mov dword [esp + 0x3c], esi
call fcn.00445b70
mov eax, dword [esp + 0x54]
cmp word [eax], dx
je 0x47f63c
lea ecx, [esp + 0x20]
call fcn.0043f290
lea ecx, [esp + 0x18]
call fcn.0043f290
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
add esp, 0x40
ret 8
mov word [eax], di
mov ecx, dword [esp + 0x54]
mov al, byte [esp + 0x13]
add ecx, 2
test al, al
mov dword [esp + 0x54], ecx
je 0x47f669
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x58]
push edx
push eax
call fcn.00461600
add esp, 0xc
push ebp
call fcn.00450d90
add esp, 4
test eax, eax
je 0x47f699
mov ecx, dword [esp + 0x54]
push ecx
call fcn.00450cd0
add esp, 4
test eax, eax
je 0x47f699
mov edx, dword [esp + 0x54]
mov dword [esp + 0x40], esi
mov dword [esp + 0x3c], edx
mov dword [esp + 0x54], ebp
jmp 0x47f69d
mov ebp, dword [esp + 0x54]
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x44]
mov ebx, 1
push ecx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], edi
call fcn.0044d230
mov esi, dword [esp + 0x3c]
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x48]
push eax
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], edi
call fcn.0044d230
mov edi, dword [esp + 0x44]
add esp, 0x10
push ebp
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test edi, edi
jne 0x47f6e8
mov edi, eax
test esi, esi
jge 0x47f712
mov ecx, eax
neg ecx
cmp esi, ecx
jl 0x47f70e
test edi, edi
lea ecx, [eax + esi + 1]
jg 0x47f6fe
add edi, ecx
cmp edi, ecx
jle 0x47f704
mov edi, ecx
mov edx, eax
sub edx, edi
lea esi, [esi + edx + 2]
jmp 0x47f718
xor edi, edi
jmp 0x47f716
cmp esi, ebx
jge 0x47f718
mov esi, ebx
dec esi
mov ecx, eax
sub ecx, esi
cmp esi, eax
jle 0x47f723
mov esi, eax
test edi, edi
jl 0x47f72b
cmp edi, ecx
jle 0x47f72d
mov edi, ecx
mov ecx, dword [esp + 0x1c]
add edi, esi
lea eax, [ebp + esi*2]
mov word [ebp + edi*2], 0
push eax
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x1c]
push eax
call fcn.00444550
lea ecx, [esp + 0x20]
call fcn.0043f290
lea ecx, [esp + 0x18]
call fcn.0043f290
mov ecx, dword [esp + 0x44]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x40
ret 8