Function at 0x47afc9
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push esi
push edi
push ebx
push ebp
sub esp, 0x18
mov ecx, dword fs:[0x30]
mov eax, dword [ecx + 0xc]
add eax, 0xc
mov edx, dword [eax]
cmp edx, eax
je 0x47b335
mov eax, dword [edx + 0x30]
mov edx, dword [edx + 0x18]
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov eax, dword [0x5f91aa]
mov ecx, dword [ecx + 0xc]
add ecx, 0xc
mov ebx, dword [ecx]
cmp ebx, ecx
je 0x47b072
test eax, eax
je 0x47b29b
mov ebp, dword [ebx + 0x30]
xor esi, esi
movzx edx, word [ebp]
test edx, edx
je 0x47b064
mov dword [esp], eax
xor edx, edx
inc edx
movzx edi, word [ebp + edx*4 - 4]
cmp edi, 0x41
jl 0x47b034
cmp edi, 0x5a
lea eax, [edi + 0x20]
cmovle edi, eax
movzx eax, di
add esi, eax
movzx eax, word [ebp + edx*4 - 2]
test eax, eax
je 0x47b05e
cmp eax, 0x41
jl 0x47b053
lea edi, [eax + 0x20]
movzx edi, di
cmp eax, 0x5a
cmovle eax, edi
add esi, eax
movzx eax, word [ebp + edx*4]
test eax, eax
jne 0x47b020
nop dword [eax]
mov eax, dword [esp]
cmp eax, esi
je 0x47b29b
mov ebx, dword [ebx]
cmp ebx, ecx
jne 0x47b006
mov eax, dword [0x5f91b2]
xor ebp, ebp
xor ebx, ebx
mov ecx, dword [0x5f917a]
cmp dword [ecx], 0
je 0x47b10f
mov eax, dword [esp + 8]
movzx edx, word [eax]
test edx, edx
je 0x47b1d2
mov dword [esp], edx
xor esi, esi
mov dword [esp + 0xc], ecx
mov edx, eax
inc esi
movzx ecx, word [edx + esi*4 - 2]
lea edi, [esi + esi]
lea eax, [esi + esi - 1]
test ecx, ecx
je 0x47b0bf
movzx ecx, word [edx + esi*4]
mov eax, edi
test ecx, ecx
jne 0x47b0a4
mov edx, dword [esp]
mov ecx, dword [esp + 0xc]
movzx eax, al
cmp al, byte [ecx]
je 0x47b0de
cmp al, byte [ecx + 1]
jne 0x47b1bf
test edx, edx
je 0x47b1cb
xor eax, eax
mov edx, dword [esp + 8]
xor esi, esi
inc esi
movzx edi, word [edx + esi*4 - 4]
add eax, edi
movzx edi, word [edx + esi*4 - 2]
test edi, edi
je 0x47b101
add eax, edi
movzx edi, word [edx + esi*4]
test edi, edi
jne 0x47b0e6
cmp eax, dword [ecx + 4]
je 0x47b10f
cmp eax, dword [ecx + 8]
jne 0x47b1bf
call dword [sym.imp.kernel32.dll_GetProcessHeap]
mov edx, eax
mov eax, dword [0x5f91a6]
push eax
push 0
push edx
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [esp + 0xc], eax
mov eax, dword [0x5f9186]
test eax, eax
jbe 0x47b157
mov eax, dword [esp + 0xc]
xor edx, edx
mov ecx, dword [0x5f91ba]
mov esi, dword [ecx + edx]
mov dword [eax + edx], esi
mov edi, dword [0x5f918a]
add edx, edi
mov ecx, dword [0x5f9186]
cmp edx, ecx
jb 0x47b139
test ebp, ebp
je 0x47b1bf
mov eax, dword [ebp + 0x3c]
mov esi, dword [eax + ebp + 0x78]
mov edi, dword [esi + ebp + 0x20]
mov edx, dword [esi + ebp + 0x18]
add edi, ebp
test edx, edx
jbe 0x47b1bf
mov eax, dword [esp + 0xc]
xor ecx, ecx
mov dword [esp], esi
mov dword [esp + 8], ebx
mov al, byte [eax]
mov esi, ebp
add esi, dword [edi + ecx*4]
cmp al, byte [esi]
jne 0x47b1b6
mov dword [esp + 0x10], edi
xor ebx, ebx
mov dword [esp + 0x14], edx
mov edi, dword [esp + 0xc]
cmp byte [ebx + esi], 0
je 0x47b1df
cmp byte [ebx + edi], 0
je 0x47b1df
inc ebx
mov dl, byte [ebx + esi]
cmp dl, byte [ebx + edi]
je 0x47b196
nop dword [eax]
mov edx, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
inc ecx
cmp ecx, edx
jb 0x47b17f
mov ebx, dword [esp + 8]
push 1
call ebx
add esp, 0x18
pop ebp
pop ebx
pop edi
pop esi
ret
xor eax, eax
jmp 0x47b101
xor eax, eax
cmp byte [ecx], 0
jne 0x47b0cd
jmp 0x47b1cb
mov esi, dword [esp]
mov ebx, dword [esp + 8]
mov eax, dword [esi + ebp + 0x1c]
mov esi, dword [esi + ebp + 0x24]
add eax, ebp
add esi, ebp
movzx edx, word [esi + ecx*2]
mov ecx, dword [eax + edx*4]
add ebp, ecx
je 0x47b1bf
mov esi, dword [0x5f9196]
lea edi, [esp]
push edi
mov edx, dword [0x5f91a2]
mov eax, dword [0x5f9186]
push eax
push edx
push esi
call ebp
mov edx, dword [0x5f919a]
mov ecx, dword [esp + 4]
add ecx, edx
mov edx, dword [0x5f919e]
mov eax, dword [0x5f91a2]
mov dword [esp + 4], ecx
mov ecx, dword [ecx + 4]
cmp edx, eax
jae 0x47b25f
mov dword [esp + 8], ebx
mov eax, dword [esp + 4]
mov ebx, dword [eax + edx]
add ebx, ecx
mov dword [esi + edx], ebx
mov ebx, dword [0x5f918a]
add edx, ebx
mov ebx, dword [0x5f91a2]
cmp edx, ebx
jb 0x47b241
mov ebx, dword [esp + 8]
mov eax, dword [0x5f91b6]
mov edx, dword [0x5f918e]
push edi
mov dword [esi + edx*4], eax
push dword [esp + 4]
mov ecx, dword [0x5f91a2]
push ecx
push esi
call ebp
mov ecx, dword [esi + 0xc]
add ecx, esi
mov eax, dword [0x5f91ae]
add ecx, eax
mov edx, dword [0x5f91ae]
add esi, edx
push esi
call ecx
add esp, 4
jmp 0x47b1bf
mov ebp, dword [ebx + 0x18]
mov eax, dword [0x5f91b2]
mov dword [esp + 0xc], eax
test ebp, ebp
je 0x47b079
mov eax, dword [ebp + 0x3c]
mov ecx, dword [eax + ebp + 0x78]
mov eax, dword [ecx + ebp + 0x20]
mov esi, dword [ecx + ebp + 0x18]
add eax, ebp
test esi, esi
jbe 0x47b079
mov edx, dword [esp + 0xc]
xor edi, edi
mov dword [esp], ecx
mov dl, byte [edx]
mov ecx, ebp
add ecx, dword [eax + edi*4]
cmp dl, byte [ecx]
jne 0x47b30a
mov dword [esp + 0x10], ebp
xor ebx, ebx
mov dword [esp + 0x14], eax
mov ebp, dword [esp + 0xc]
cmp byte [ebx + ecx], 0
je 0x47b314
cmp byte [ebx + ebp], 0
je 0x47b314
inc ebx
mov al, byte [ebx + ecx]
cmp al, byte [ebx + ebp]
je 0x47b2ea
nop dword [eax]
mov eax, dword [esp + 0x14]
mov ebp, dword [esp + 0x10]
inc edi
cmp edi, esi
jb 0x47b2d3
jmp 0x47b079
mov ecx, dword [esp]
mov ebp, dword [esp + 0x10]
mov eax, dword [ecx + ebp + 0x1c]
mov ecx, dword [ecx + ebp + 0x24]
add eax, ebp
add ecx, ebp
movzx edx, word [ecx + edi*2]
mov ebx, dword [eax + edx*4]
add ebx, ebp
jmp 0x47b07b
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 4], eax
jmp 0x47aff5