Function at 0x3004da60
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword fs:[0x30]
push ebx
push esi
push edi
mov eax, dword [eax + 0xc]
add eax, 0xc
mov dword [ebp - 8], eax
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
mov ax, word [ecx + 0x24]
sub ax, word [ecx + 0x2c]
mov word [ebp - 0x1c], ax
mov word [ebp - 0x1a], ax
movzx ecx, ax
pushfd
mov eax, dword fs:[0x18]
pop ebx
test eax, eax
jne 0x3004daa4
or esi, 0xffffffff
or edi, 0xffffffff
jmp 0x3004daad
mov esi, dword [eax + 0x34]
mov edi, dword [eax + 0xbf4]
lea eax, [ecx*2 + 2]
push eax
push 8
push dword [0x3026d8b0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword fs:[0x18]
mov edx, eax
test ecx, ecx
je 0x3004dadf
mov dword [ecx + 0x34], esi
mov dword [ecx + 0xbf4], edi
test ebx, ebx
je 0x3004dadf
push ebx
popfd
movzx eax, word [ebp - 0x1c]
add eax, eax
mov dword [ebp - 0x18], edx
push eax
mov eax, dword [ebp - 4]
push dword [eax + 0x28]
push edx
call fcn.3015c210
mov ecx, dword [ebp - 8]
add esp, 0xc
mov eax, dword [ecx]
mov ebx, dword [eax]
mov dword [ebp - 4], ebx
cmp ebx, ecx
je 0x3004dd79
lea ebx, [ebx]
mov ax, word [ebx + 0x24]
sub ax, word [ebx + 0x2c]
mov word [ebp - 0x14], ax
mov word [ebp - 0x12], ax
movzx ecx, ax
pushfd
mov eax, dword fs:[0x18]
pop dword [ebp - 0xc]
test eax, eax
jne 0x3004db39
or esi, 0xffffffff
or edi, 0xffffffff
jmp 0x3004db42
mov esi, dword [eax + 0x34]
mov edi, dword [eax + 0xbf4]
lea eax, [ecx*2 + 2]
push eax
push 8
push dword [0x3026d8b0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword fs:[0x18]
mov edx, eax
test ecx, ecx
je 0x3004db77
mov eax, dword [ebp - 0xc]
mov dword [ecx + 0x34], esi
mov dword [ecx + 0xbf4], edi
test eax, eax
je 0x3004db77
push eax
popfd
movzx eax, word [ebp - 0x14]
add eax, eax
mov dword [ebp - 0x10], edx
push eax
push dword [ebx + 0x28]
push edx
call fcn.3015c210
mov esi, dword [ebp - 0x10]
push 0x14
push str.c:windows_system32_
push esi
call fcn.30164487
add esp, 0x18
test eax, eax
je 0x3004dbdd
push 0x14
push str.c:windows_syswow64_
push esi
call fcn.30164487
add esp, 0xc
test eax, eax
je 0x3004dbdd
push 0x15
push str.c:windows_sysnative_
push esi
call fcn.30164487
add esp, 0xc
test eax, eax
je 0x3004dbdd
push 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [0x30240954]
test eax, eax
jne 0x3004dbe8
mov eax, dword [ebx + 0x18]
cmp eax, dword [0x30267728]
jne 0x3004dc40
mov ecx, dword [ebp - 0x10]
pushfd
mov eax, dword fs:[0x18]
pop esi
test eax, eax
jne 0x3004dbff
or edi, 0xffffffff
or ebx, 0xffffffff
jmp 0x3004dc08
mov edi, dword [eax + 0x34]
mov ebx, dword [eax + 0xbf4]
push ecx
push 0
push dword [0x3026d8b0]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword fs:[0x18]
test eax, eax
je 0x3004dd1e
mov dword [eax + 0xbf4], ebx
mov ebx, dword [ebp - 4]
mov dword [eax + 0x34], edi
test esi, esi
je 0x3004dd21
push esi
popfd
jmp 0x3004dd21
xor esi, esi
mov edx, dword [esi + 0x3026b080]
test edx, edx
je 0x3004dc80
mov eax, edx
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x3004dc51
sub eax, edi
sar eax, 1
push eax
push edx
push dword [ebx + 0x30]
call fcn.30164487
add esp, 0xc
test eax, eax
je 0x3004dd31
add esi, 4
cmp esi, 0x200
jb 0x3004dc42
mov ecx, dword [ebp - 0x10]
pushfd
mov eax, dword fs:[0x18]
pop esi
test eax, eax
jne 0x3004dc9b
or edi, 0xffffffff
mov dword [ebp - 4], 0xffffffff
jmp 0x3004dca7
mov edi, dword [eax + 0x34]
mov eax, dword [eax + 0xbf4]
mov dword [ebp - 4], eax
push ecx
push 0
push dword [0x3026d8b0]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword fs:[0x18]
test eax, eax
je 0x3004dcd2
mov ecx, dword [ebp - 4]
mov dword [eax + 0x34], edi
mov dword [eax + 0xbf4], ecx
test esi, esi
je 0x3004dcd2
push esi
popfd
mov esi, dword [ebx + 0x20]
mov edx, dword [ebx + 0x18]
add esi, edx
mov ecx, dword [0x302686e4]
cmp ecx, 0x1f4
jae 0x3004dd21
xor eax, eax
test ecx, ecx
je 0x3004dd07
mov edi, edi
cmp edx, dword [eax*8 + 0x30267740]
jb 0x3004dd02
cmp edx, dword [eax*8 + 0x30267744]
jb 0x3004dd21
inc eax
cmp eax, ecx
jb 0x3004dcf0
mov dword [ecx*8 + 0x30267740], edx
mov dword [ecx*8 + 0x30267744], esi
inc ecx
mov dword [0x302686e4], ecx
jmp 0x3004dd21
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
mov dword [ebp - 4], ebx
cmp ebx, dword [ebp - 8]
jne 0x3004db10
jmp 0x3004dd79
mov ecx, dword [ebp - 0x10]
pushfd
mov eax, dword fs:[0x18]
pop esi
test eax, eax
jne 0x3004dd48
or edi, 0xffffffff
or ebx, 0xffffffff
jmp 0x3004dd51
mov edi, dword [eax + 0x34]
mov ebx, dword [eax + 0xbf4]
push ecx
push 0
push dword [0x3026d8b0]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword fs:[0x18]
test eax, eax
je 0x3004dd79
mov dword [eax + 0x34], edi
mov dword [eax + 0xbf4], ebx
test esi, esi
je 0x3004dd79
push esi
popfd
mov ecx, dword [ebp - 0x18]
pushfd
mov eax, dword fs:[0x18]
pop esi
test eax, eax
jne 0x3004dd90
or edi, 0xffffffff
or ebx, 0xffffffff
jmp 0x3004dd99
mov edi, dword [eax + 0x34]
mov ebx, dword [eax + 0xbf4]
push ecx
push 0
push dword [0x3026d8b0]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword fs:[0x18]
test eax, eax
je 0x3004ddc1
mov dword [eax + 0x34], edi
mov dword [eax + 0xbf4], ebx
test esi, esi
je 0x3004ddc1
push esi
popfd
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret