Function at 0x4815f0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4eb708
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push edi
push 0x4efd50
mov dword [esp + 0x20], ecx
call ebp
lea esi, [eax + eax + 2]
lea eax, [esi + 2]
push eax
call fcn.00449130
mov ecx, esi
mov edx, ecx
shr ecx, 2
mov esi, 0x4efd50
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
add esp, 4
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 0x24], eax
xor eax, eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x5c]
mov ax, word [eax]
cmp ax, 0x2a
jne 0x481675
mov dword [esp + 0x18], 9
jmp 0x481683
cmp ax, 0x24
jne 0x481683
mov dword [esp + 0x18], 0x20
lea ecx, [esp + 0x5c]
push ecx
mov byte [esp + 0x17], 1
call fcn.00417de5
lea edx, [esp + 0x60]
push edx
call fcn.00443850
mov esi, dword [esp + 0x64]
push 1
push esi
push 0x4f05c4
call fcn.00444970
add esp, 0x14
test al, al
mov byte [esp + 0x17], al
je 0x4816d0
lea eax, [esp + 0x5c]
add esi, 2
push eax
mov dword [esp + 0x60], esi
call fcn.00443850
mov esi, dword [esp + 0x60]
add esp, 4
xor bl, bl
cmp word [esi], 0x2d
mov byte [esp + 0x16], bl
jne 0x4817f7
mov eax, esi
mov ecx, str._delims:
mov edx, 7
lea esp, [esp]
movzx edi, word [eax]
movsx ebp, byte [ecx]
or edi, 0x20
or ebp, 0x20
add eax, 2
inc ecx
cmp ebp, edi
jne 0x481774
dec edx
jns 0x4816f0
lea ecx, [esp + 0x5c]
add esi, 0x10
push ecx
mov dword [esp + 0x60], esi
call fcn.004479a0
mov esi, dword [esp + 0x60]
movzx edx, word [esi]
add esp, 4
add esi, 2
mov dword [esp + 0x18], edx
mov dword [esp + 0x5c], esi
mov ax, word [esi]
test ax, ax
je 0x481756
cmp ax, 9
jb 0x481741
cmp ax, 0xd
jbe 0x481756
cmp ax, 0x20
je 0x481756
add esi, 2
mov dword [esp + 0x5c], esi
mov ax, word [esi]
test ax, ax
jne 0x481735
mov ax, word [esi]
cmp ax, 9
jb 0x481765
cmp ax, 0xd
jbe 0x48176b
cmp ax, 0x20
jne 0x4817e3
add esi, 2
mov dword [esp + 0x5c], esi
jmp 0x481756
push 9
push esi
push str._trimleft
call fcn.00444970
add esp, 0xc
test al, al
je 0x4817b4
add esi, 0x12
mov dword [esp + 0x5c], esi
je 0x4817af
mov ax, word [esi]
cmp ax, 9
jb 0x4817a0
cmp ax, 0xd
jbe 0x4817a6
cmp ax, 0x20
jne 0x4817af
add esi, 2
mov dword [esp + 0x5c], esi
jmp 0x481791
or bl, 1
jmp 0x4817e3
push 0xa
push esi
push str._trimright
call fcn.00444970
add esp, 0xc
test al, al
je 0x48180e
lea eax, [esp + 0x5c]
add esi, 0x14
push eax
mov dword [esp + 0x60], esi
call fcn.00443850
add esp, 4
or bl, 2
mov esi, dword [esp + 0x5c]
cmp word [esi], 0x2d
je 0x4816e0
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov byte [esp + 0x16], bl
mov eax, dword [esp + 0x18]
cmp eax, 9
jne 0x48194f
mov byte [esp + 0x13], 0
jmp 0x481954
push 5
push esi
push str._trim
call fcn.00444970
add esp, 0xc
test al, al
je 0x48183b
lea ecx, [esp + 0x5c]
add esi, 0xa
push ecx
mov dword [esp + 0x60], esi
call fcn.00443850
add esp, 4
or bl, 3
jmp 0x4817df
push 5
push esi
push str._left
call fcn.00444970
add esp, 0xc
test al, al
je 0x48186d
lea edx, [esp + 0x5c]
add esi, 0xa
push edx
mov dword [esp + 0x60], esi
call fcn.00443850
add esp, 4
mov byte [esp + 0x13], 0
jmp 0x4817df
push 3
push esi
push 0x4faa9c
call fcn.00444970
add esp, 0xc
test al, al
je 0x4818a7
lea eax, [esp + 0x5c]
add esi, 6
push eax
mov dword [esp + 0x60], esi
call fcn.00443850
mov eax, dword [esp + 0x34]
add esp, 4
or eax, 0x10000
mov dword [esp + 0x30], eax
jmp 0x4817df
push 5
push esi
push str._term
call fcn.00444970
add esp, 0xc
test al, al
je 0x4818e1
lea ecx, [esp + 0x5c]
add esi, 0xa
push ecx
mov dword [esp + 0x60], esi
call fcn.00443850
mov eax, dword [esp + 0x40]
add esp, 4
or eax, 0x20000
mov dword [esp + 0x3c], eax
jmp 0x4817df
push 3
push esi
push 0x4faa90
call fcn.00444970
add esp, 0xc
test al, al
je 0x481916
lea edx, [esp + 0x5c]
add esi, 6
push edx
mov dword [esp + 0x60], esi
call fcn.00443850
add esp, 4
mov dword [esp + 0x2c], 1
jmp 0x4817df
push 4
push esi
push str._rq1
call fcn.00444970
add esp, 0xc
test al, al
je 0x48172d
lea eax, [esp + 0x5c]
add esi, 8
push eax
mov dword [esp + 0x60], esi
call fcn.00443850
add esp, 4
mov dword [esp + 0x2c], 3
jmp 0x4817df
test ax, ax
je 0x48195c
mov dword [esp + 0x30], 0
push 0x3d
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x64]
push edx
call fcn.0044c770
mov ecx, dword [esp + 0x28]
add esp, 0xc
push 0
lea eax, [esp + 0x28]
push eax
call fcn.004166b6
mov ebx, dword [esp + 0x24]
cmp word [ebx], 0
jne 0x4819a2
mov ecx, dword [0x51d3c8]
add ebx, 0xfffffff8
push ebx
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x48213e
mov ecx, dword [esp + 0x5c]
cmp word [ecx], 0x3d
je 0x4819c4
mov edx, dword [0x51d3c8]
add ebx, 0xfffffff8
push ebx
push 0
push edx
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x48213e
add ecx, 2
xor edi, edi
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x20], edi
mov eax, dword [esp + 0x2c]
test eax, eax
mov byte [esp + 0x54], 1
mov esi, 0x22
jne 0x4819ef
mov al, byte [esp + 0x16]
test al, al
je 0x481b67
mov al, byte [esp + 0x17]
test al, al
je 0x481a16
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x60]
push ecx
push edx
call fcn.00463920
mov ecx, dword [esp + 0x68]
mov edi, dword [esp + 0x2c]
add esp, 0xc
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x481a74
push ecx
call ebp
cmp eax, 2
mov ecx, dword [esp + 0x5c]
jl 0x481a4a
cmp word [ecx], si
jne 0x481a4a
cmp word [ecx + eax*2 - 2], si
jne 0x481a4a
mov word [ecx + eax*2 - 2], 0
mov ecx, dword [esp + 0x5c]
add ecx, 2
mov dword [esp + 0x5c], ecx
jmp 0x481a74
cmp dword [esp + 0x2c], 1
jle 0x481a74
cmp word [ecx], si
jne 0x481a5e
dec eax
add ecx, 2
mov dword [esp + 0x5c], ecx
test eax, eax
jle 0x481a74
cmp word [ecx + eax*2 - 2], si
jne 0x481a74
mov word [ecx + eax*2 - 2], 0
mov ecx, dword [esp + 0x5c]
mov dl, byte [esp + 0x16]
test dl, dl
je 0x481b28
test dl, 1
je 0x481ab2
mov eax, dword [esp + 0x18]
test eax, eax
je 0x481ae7
movzx eax, word [ecx]
cmp eax, dword [esp + 0x18]
jne 0x481ab2
jmp 0x481aa0
mov esi, dword [esp + 0x18]
add ecx, 2
mov dword [esp + 0x5c], ecx
movzx eax, word [ecx]
cmp eax, esi
je 0x481aa0
test dl, 2
je 0x481b30
push ecx
call ebp
mov edx, dword [esp + 0x18]
test edx, edx
mov ecx, dword [esp + 0x5c]
lea eax, [ecx + eax*2 - 2]
je 0x481b05
movzx esi, word [eax]
cmp esi, edx
jne 0x481b30
mov word [eax], 0
movzx ecx, word [eax - 2]
sub eax, 2
cmp ecx, edx
je 0x481ad1
mov ecx, dword [esp + 0x5c]
jmp 0x481b30
mov ax, word [ecx]
cmp ax, 9
jb 0x481af6
cmp ax, 0xd
jbe 0x481afc
cmp ax, 0x20
jne 0x481ab2
add ecx, 2
mov dword [esp + 0x5c], ecx
jmp 0x481ae7
mov dx, word [eax]
cmp dx, 9
jb 0x481b14
cmp dx, 0xd
jbe 0x481b1a
cmp dx, 0x20
jne 0x481b30
mov word [eax], 0
mov ecx, dword [esp + 0x5c]
sub eax, 2
jmp 0x481b05
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x481b67
push ecx
mov ecx, dword [esp + 0x20]
push ebx
call fcn.00448be0
test edi, edi
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
je 0x481b54
mov edx, dword [0x51d3c8]
add edi, 0xfffffff8
push edi
push 0
push edx
call esi
mov eax, dword [0x51d3c8]
add ebx, 0xfffffff8
push ebx
push 0
push eax
call esi
jmp 0x48213e
mov esi, dword [sym.imp.SHLWAPI.dll_StrChrW]
push 0x2c
mov ebp, 1
push ebx
mov dword [esp + 0x48], ebp
call esi
test eax, eax
je 0x481b91
nop
push 0x2c
add eax, 2
push eax
inc ebp
call esi
test eax, eax
jne 0x481b80
mov dword [esp + 0x40], ebp
mov eax, dword [esp + 0x5c]
cmp word [eax], 0x3c
jne 0x481fa6
lea ecx, [esp + 0x5c]
add eax, 2
push ecx
mov byte [esp + 0x1a], 0
mov byte [esp + 0x18], 0
mov dword [esp + 0x60], eax
call fcn.00443850
mov eax, dword [esp + 0x60]
add esp, 4
cmp word [eax], 0x7e
mov byte [esp + 0x15], 0
jne 0x481bd9
mov dl, byte [eax]
add eax, 2
mov byte [esp + 0x15], dl
mov dword [esp + 0x5c], eax
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x60]
push ecx
mov dword [esp + 0x3c], 1
mov dword [esp + 0x40], 0
call fcn.0044f5a0
add esp, 8
test eax, eax
jl 0x481c8d
mov esi, dword [esp + 0x5c]
mov edi, dword [esp + 0x34]
mov dword [esp + 0x28], esi
mov ax, word [esi]
cmp ax, 0x2a
mov dword [esp + 0x2c], edi
jne 0x481c28
mov byte [esp + 0x14], 1
mov edx, 1
jmp 0x481c41
cmp ax, 0x2d
jne 0x481c3f
mov byte [esp + 0x16], 1
mov byte [esp + 0x14], 2
mov edx, 1
jmp 0x481c41
mov edx, ebp
xor ecx, ecx
test ax, ax
mov dword [esp + 0x34], 0xffffffff
je 0x481c89
cmp ecx, edx
jge 0x481cb9
mov ax, word [esi]
test ax, ax
je 0x481c75
lea esp, [esp]
cmp ax, 0x3e
je 0x481c75
add esi, 2
mov dword [esp + 0x28], esi
mov ax, word [esi]
test ax, ax
jne 0x481c60
cmp word [esi], 0x3e
jne 0x481c83
inc ecx
add esi, 2
mov dword [esp + 0x28], esi
cmp word [esi], 0
jne 0x481c50
cmp ecx, edx
jge 0x481cb9
lea ecx, [esp + 0x20]
call fcn.00443880
lea ecx, [esp + 0x24]
call fcn.00443880
pop edi
pop esi
pop ebp
mov eax, 0x80070057
pop ebx
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
add esp, 0x48
ret 8
mov al, byte [esp + 0x13]
test al, al
je 0x481ce9
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x481cdc
lea edx, [esp + 0x28]
push edx
call fcn.00443850
mov esi, dword [esp + 0x2c]
add esp, 4
jmp 0x481ce9
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x5c]
call fcn.00448f40
mov al, byte [esp + 0x17]
test al, al
je 0x481d38
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x2c]
push ecx
push edx
call fcn.00463920
mov al, byte [esp + 0x1f]
add esp, 0xc
test al, al
je 0x481d34
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x481d27
lea eax, [esp + 0x28]
push eax
call fcn.00443850
add esp, 4
jmp 0x481d34
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x5c]
call fcn.00448f40
mov esi, dword [esp + 0x28]
mov eax, dword [esp + 0x3c]
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x18]
or eax, edx
or ecx, eax
cmp byte [esp + 0x14], 1
mov dword [esp + 0x48], esi
mov dword [esp + 0x18], ecx
jne 0x481db0
test edi, edi
jne 0x481d65
mov dword [esp + 0x2c], 1
jmp 0x481db0
jge 0x481db0
lea ecx, [esp + 0x3c]
call fcn.00449480
mov ecx, dword [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x40]
push edx
push esi
lea eax, [esp + 0x40]
push eax
call fcn.0044c520
lea ecx, [esp + 0x3c]
call fcn.00443880
mov eax, dword [esp + 0x34]
mov ecx, eax
neg ecx
cmp edi, ecx
jg 0x481da8
mov dword [esp + 0x2c], 1
jmp 0x481db0
lea edx, [edi + eax + 1]
mov dword [esp + 0x2c], edx
test ebp, ebp
jle 0x48212c
jmp 0x481dc0
mov ebx, dword [esp + 0x3c]
mov edi, edi
lea ecx, [esp + 0x30]
call fcn.00449480
push 0x2c
push ebx
mov byte [esp + 0x5c], 2
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov ebp, eax
test ebp, ebp
je 0x481de6
mov word [ebp], 0
add ebp, 2
mov esi, dword [esp + 0x2c]
test esi, esi
jge 0x481e25
mov eax, dword [esp + 0x34]
test eax, eax
jge 0x481e25
lea ecx, [esp + 0x44]
call fcn.00449480
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x48]
push eax
lea ecx, [esp + 0x48]
push ecx
mov ecx, dword [esp + 0x24]
push edx
lea eax, [esp + 0x40]
push eax
call fcn.0044c520
lea ecx, [esp + 0x44]
call fcn.00443880
push ebx
call fcn.004201fa
lea eax, [esi - 1]
add esp, 4
cmp eax, 0xffffffff
mov dword [esp + 0x3c], eax
jne 0x481e3e
xor eax, eax
jmp 0x481e48
jge 0x481e4c
mov ecx, dword [esp + 0x34]
lea eax, [eax + ecx + 1]
mov dword [esp + 0x3c], eax
test eax, eax
mov esi, dword [esp + 0x30]
mov edi, esi
jl 0x481e79
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x48]
push edx
lea eax, [esp + 0x34]
push eax
push ecx
mov ecx, dword [esp + 0x28]
lea edx, [esp + 0x48]
push edx
call fcn.0044c520
mov esi, dword [esp + 0x30]
mov edi, eax
mov al, byte [esp + 0x16]
test al, al
jne 0x481eaf
mov al, byte [esp + 0x15]
test al, al
mov edi, esi
je 0x481eaf
cmp word [esi], 0x22
jne 0x481eaf
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 2
jl 0x481eaf
cmp word [esi + eax*2 - 2], 0x22
jne 0x481eaf
mov word [esi + eax*2 - 2], 0
lea edi, [esi + 2]
cmp word [ebx], 0
je 0x481ec0
mov ecx, dword [esp + 0x1c]
push edi
push ebx
call fcn.00448be0
test ebp, ebp
mov dword [esp + 0x3c], ebp
je 0x481f98
lea eax, [esp + 0x3c]
push eax
call fcn.00443850
mov ecx, dword [esp + 0x30]
mov al, byte [esp + 0x18]
add esp, 4
inc ecx
cmp al, 1
mov dword [esp + 0x2c], ecx
je 0x481f74
mov ecx, dword [esp + 0x5c]
mov ax, word [ecx]
test ax, ax
je 0x481f15
lea ebx, [ebx]
cmp ax, 0x3c
je 0x481f15
add ecx, 2
mov dword [esp + 0x5c], ecx
mov ax, word [ecx]
test ax, ax
jne 0x481f00
add ecx, 2
mov dword [esp + 0x5c], ecx
lea ecx, [esp + 0x5c]
push ecx
call fcn.00443850
mov eax, dword [esp + 0x60]
add esp, 4
cmp word [eax], 0x7e
mov byte [esp + 0x15], 0
jne 0x481f45
mov dl, byte [eax]
add eax, 2
mov byte [esp + 0x15], dl
mov dword [esp + 0x5c], eax
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x60]
push ecx
call fcn.0044ce90
mov edx, dword [esp + 0x64]
add esp, 8
cmp word [edx], 0x2d
mov byte [esp + 0x16], 0
jne 0x481f74
mov eax, edx
add eax, 2
mov dword [esp + 0x5c], eax
mov byte [esp + 0x16], 1
lea ecx, [esp + 0x30]
mov byte [esp + 0x54], 1
call fcn.00443880
mov eax, dword [esp + 0x40]
dec eax
test eax, eax
mov dword [esp + 0x40], eax
jg 0x481dba
jmp 0x48212c
lea ecx, [esp + 0x30]
call fcn.00443880
jmp 0x48212c
mov ebp, eax
mov edx, 0x2c
lea eax, [esp + 0x5c]
mov dword [esp + 0x48], ebp
call fcn.00448ed0
mov eax, dword [esp + 0x5c]
cmp word [eax], dx
jne 0x481feb
mov word [eax], 0
mov eax, dword [esp + 0x5c]
add eax, 2
mov dword [esp + 0x5c], eax
mov esi, eax
lea eax, [esp + 0x5c]
mov dword [esp + 0x44], esi
call fcn.00448ed0
mov eax, dword [esp + 0x5c]
cmp word [eax], dx
je 0x482017
lea ecx, [esp + 0x20]
call fcn.00443880
lea ecx, [esp + 0x24]
call fcn.00443880
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
add esp, 0x48
ret 8
mov word [eax], 0
mov ecx, dword [esp + 0x5c]
mov al, byte [esp + 0x17]
add ecx, 2
test al, al
mov dword [esp + 0x5c], ecx
je 0x482046
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x60]
push ecx
push edx
call fcn.00463920
add esp, 0xc
push ebp
call fcn.00451d80
add esp, 4
test eax, eax
je 0x482076
mov eax, dword [esp + 0x5c]
push eax
call fcn.00451cc0
add esp, 4
test eax, eax
je 0x482076
mov ecx, dword [esp + 0x5c]
mov dword [esp + 0x48], esi
mov dword [esp + 0x44], ecx
mov dword [esp + 0x5c], ebp
jmp 0x48207a
mov ebp, dword [esp + 0x5c]
lea edx, [esp + 0x34]
push edx
lea eax, [esp + 0x4c]
mov ebx, 1
xor edi, edi
push eax
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], edi
call fcn.0044f5a0
mov esi, dword [esp + 0x3c]
lea ecx, [esp + 0x3c]
push ecx
lea edx, [esp + 0x50]
push edx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], edi
call fcn.0044f5a0
mov edi, dword [esp + 0x44]
add esp, 0x10
push ebp
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test edi, edi
jne 0x4820c7
mov edi, eax
test esi, esi
jge 0x4820f1
mov ecx, eax
neg ecx
cmp esi, ecx
jl 0x4820ed
test edi, edi
lea ecx, [eax + esi + 1]
jg 0x4820dd
add edi, ecx
cmp edi, ecx
jle 0x4820e3
mov edi, ecx
mov edx, eax
sub edx, edi
lea esi, [esi + edx + 2]
jmp 0x4820f7
xor edi, edi
jmp 0x4820f5
cmp esi, ebx
jge 0x4820f7
mov esi, ebx
dec esi
mov ecx, eax
sub ecx, esi
cmp esi, eax
jle 0x482102
mov esi, eax
test edi, edi
jl 0x48210a
cmp edi, ecx
jle 0x48210c
mov edi, ecx
mov ecx, dword [esp + 0x1c]
add edi, esi
lea eax, [ebp + esi*2]
mov word [ebp + edi*2], 0
push eax
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x28]
push eax
call fcn.00448be0
lea ecx, [esp + 0x20]
call fcn.00443880
lea ecx, [esp + 0x24]
call fcn.00443880
mov ecx, dword [esp + 0x4c]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x48
ret 8