Function at 0x6c828420
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x178
mov eax, dword [ecx]
mov edi, dword [ecx + 4]
cmp byte [eax], 0x22
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x154], edi
je 0x6c8286c0
mov eax, dword [sym.imp.ucrtbase.dll_strchr]
mov dword [esp + 4], 0x20
mov esi, dword [ebp - 0x150]
mov dword [ebp - 0x15c], eax
mov dword [esp], esi
call eax
mov edi, eax
test eax, eax
je 0x6c8288d0
mov ebx, eax
sub ebx, esi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov ecx, eax
lea eax, [ebx + 1]
mov dword [ebp - 0x164], ecx
mov dword [esp + 8], eax
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebp - 0x158], eax
call eax
sub esp, 0xc
mov dword [ebp - 0x14c], eax
test eax, eax
je 0x6c828a79
mov dword [esp + 4], esi
mov esi, eax
mov dword [esp + 8], ebx
mov dword [esp], eax
call sub.ucrtbase.dll_memcpy
mov byte [esi + ebx], 0
test edi, edi
je 0x6c8288e7
lea esi, [edi + 1]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ecx, dword [ebp - 0x164]
mov dword [esp + 4], 0
mov edx, eax
lea eax, [eax + 2]
mov dword [ebp - 0x160], edx
mov dword [esp + 8], eax
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x158]
call eax
mov edx, dword [ebp - 0x160]
sub esp, 0xc
mov ebx, eax
lea eax, [eax + 1]
mov byte [eax - 1], dl
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_strcpy]
test byte [0x6c845914], 8
jne 0x6c828888
movzx eax, word [ebp - 0x154]
mov ecx, 2
xor esi, esi
mov dword [esp], ebx
mov word [ebp - 0x140], cx
lea edi, [ebp - 0x11c]
mov word [ebp - 0x138], si
mov word [ebp - 0x13e], ax
call sym.krnl386.exe16_MapLS
sub esp, 4
mov dword [ebp - 0x136], eax
lea eax, [ebp - 0x140]
mov dword [esp], eax
call sym.krnl386.exe16_MapLS
mov dword [ebp - 0x12e], 0
mov dword [ebp - 0x132], eax
mov eax, dword [ebp - 0x14c]
sub esp, 4
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], 0x104
mov dword [esp + 8], str..exe
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_SearchPathA]
sub esp, 0x18
test eax, eax
jne 0x6c828700
mov eax, dword [ebp - 0x14c]
movzx edx, byte [eax]
test dl, dl
je 0x6c8285f0
cmp byte [eax + 1], 0x3a
je 0x6c828617
mov eax, dword [ebp - 0x14c]
mov byte [ebp - 0x160], dl
mov dword [esp + 4], 0x2f
mov dword [esp], eax
mov eax, dword [ebp - 0x15c]
call eax
test eax, eax
je 0x6c828938
mov eax, dword [ebp - 0x136]
mov dword [esp], eax
call sym.krnl386.exe16_UnMapLS
mov eax, dword [ebp - 0x132]
sub esp, 4
mov dword [esp], eax
call sym.krnl386.exe16_UnMapLS
sub esp, 4
mov dword [esp + 8], ebx
mov ebx, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call ebx
mov ecx, dword [ebp - 0x14c]
sub esp, 0xc
cmp dword [ebp - 0x150], ecx
je 0x6c828920
xor esi, esi
mov edi, 2
mov ecx, dword [ebp - 0x14c]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], ecx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call ebx
mov eax, esi
sub esp, 0xc
test al, al
jne 0x6c82878d
lea esp, [ebp - 0x10]
mov eax, edi
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 8
mov edi, dword [sym.imp.ucrtbase.dll_strchr]
lea esi, [eax + 1]
mov dword [esp + 4], 0x22
mov dword [esp], esi
mov dword [ebp - 0x15c], edi
call edi
mov ebx, eax
test eax, eax
je 0x6c828a50
mov dword [esp + 4], 0x20
mov dword [esp], eax
call edi
mov edi, eax
jmp 0x6c82847b
lea eax, [ebp - 0x138]
mov dword [esp], edi
mov dword [esp + 4], eax
call sym.krnl386.exe16_LoadModule16
sub esp, 8
mov edi, eax
mov eax, dword [ebp - 0x136]
mov dword [esp], eax
call sym.krnl386.exe16_UnMapLS
mov eax, dword [ebp - 0x132]
sub esp, 4
mov dword [esp], eax
call sym.krnl386.exe16_UnMapLS
sub esp, 4
mov dword [esp + 8], ebx
mov ebx, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call ebx
mov ecx, dword [ebp - 0x14c]
sub esp, 0xc
cmp di, 0xb
sete dl
cmp di, 0x15
sete al
or edx, eax
mov esi, edx
cmp dword [ebp - 0x150], ecx
jne 0x6c828678
mov eax, esi
test al, al
je 0x6c8286a8
mov esi, dword [sym.imp.ucrtbase.dll_strlen]
mov eax, 2
mov edi, dword [ebp - 0x150]
mov word [ebp - 0x13c], ax
movzx eax, word [ebp - 0x154]
mov dword [esp], edi
mov word [ebp - 0x13a], ax
call esi
mov dword [esp + 4], 0
mov esi, eax
lea edx, [esi + 1]
mov dword [esp + 8], edx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x158]
call eax
mov ebx, eax
mov eax, esi
sub esp, 0xc
mov byte [ebx], al
lea eax, [ebx + 1]
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], eax
call sub.ucrtbase.dll_memcpy
xor edx, edx
mov dword [esp], ebx
mov word [ebp - 0x12a], dx
call sym.krnl386.exe16_MapLS
mov dword [ebp - 0x128], eax
lea eax, [ebp - 0x13c]
sub esp, 4
mov dword [esp], eax
call sym.krnl386.exe16_MapLS
mov dword [ebp - 0x120], 0
sub esp, 4
mov dword [ebp - 0x124], eax
lea eax, [ebp - 0x12a]
mov dword [esp], str.winoldap.mod
mov dword [esp + 4], eax
call sym.krnl386.exe16_LoadModule16
mov edi, eax
mov eax, dword [ebp - 0x128]
sub esp, 8
mov dword [esp], eax
call sym.krnl386.exe16_UnMapLS
mov eax, dword [ebp - 0x124]
sub esp, 4
mov dword [esp], eax
call sym.krnl386.exe16_UnMapLS
mov eax, edi
sub esp, 4
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 8
lea eax, [ebx + 1]
mov dword [esp + 0x18], eax
movsx eax, byte [ebx]
mov dword [esp + 0xc], str.name:__s__cmdline:__.s_n
mov dword [esp + 8], str.WinExec16
mov dword [esp + 4], 0x6c845914
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x14c]
mov dword [esp], 3
mov dword [esp + 0x10], eax
call fcn.6c824ba0
jmp 0x6c828544
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0x14c], eax
mov eax, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebp - 0x158], eax
mov dword [esp + 8], 2
xor edi, edi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x158]
call eax
sub esp, 0xc
mov ebx, eax
mov word [eax], di
jmp 0x6c828537
lea esp, [ebp - 0x10]
mov edi, 2
pop ecx
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 8
mov eax, dword [ebp - 0x14c]
mov dword [esp + 4], 0x5c
mov dword [esp], eax
mov eax, dword [ebp - 0x15c]
call eax
movzx edx, byte [ebp - 0x160]
test eax, eax
jne 0x6c828617
mov ecx, dword [ebp - 0x14c]
lea esi, [ebp - 0x19]
mov eax, edi
jmp 0x6c828973
movzx edx, byte [ecx]
test dl, dl
je 0x6c828984
add eax, 1
add ecx, 1
mov byte [eax - 1], dl
cmp eax, esi
jne 0x6c828970
mov byte [eax], 0
mov esi, dword [sym.imp.ucrtbase.dll_strlen]
mov dword [esp], edi
call esi
mov edx, eax
cmp eax, 0xff
ja 0x6c8289c2
mov dword [ebp - 0x160], edx
mov eax, dword [ebp - 0x15c]
mov dword [esp + 4], 0x2e
mov dword [esp], edi
call eax
mov edx, dword [ebp - 0x160]
test eax, eax
je 0x6c828a68
lea eax, [ebp - 0x138]
mov dword [esp], edi
mov dword [esp + 4], eax
call sym.krnl386.exe16_LoadModule16
sub esp, 8
mov edi, eax
cmp ax, 2
jne 0x6c828717
mov eax, dword [ebp - 0x136]
mov dword [esp], eax
call sym.krnl386.exe16_UnMapLS
mov eax, dword [ebp - 0x132]
sub esp, 4
mov dword [esp], eax
call sym.krnl386.exe16_UnMapLS
sub esp, 4
mov dword [esp + 8], ebx
mov ebx, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call ebx
mov ecx, dword [ebp - 0x14c]
sub esp, 0xc
cmp dword [ebp - 0x150], ecx
je 0x6c828793
mov esi, 1
mov edi, 0x15
jmp 0x6c828678
mov ebx, dword [ebp - 0x150]
xor edi, edi
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_strlen]
add ebx, eax
jmp 0x6c82847b
add edx, edi
mov dword [edx], 0x6578652e
mov byte [edx + 4], 0
jmp 0x6c8289c2
mov edi, 8
jmp 0x6c8286a8