Function at 0x6f243b30
Capabilities:
Get process heap flags

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov edi, dword [esp + 0x50]
test byte [0x6f266058], 8
jne 0x6f243cb0
mov dword [esp + 4], 0x20
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_wcschr]
test eax, eax
je 0x6f243ca0
lea ebp, [eax + 2]
xor edx, edx
mov word [eax], dx
movzx eax, word [eax + 2]
cmp ax, 0x20
jne 0x6f243b85
lea esi, [esi]
nop
movzx eax, word [ebp + 2]
add ebp, 2
cmp ax, 0x20
je 0x6f243b78
test ax, ax
je 0x6f243ca0
mov dword [esp + 8], 0x1c
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov esi, eax
test eax, eax
je 0x6f243e51
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_LoadLibraryW]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x6f243dc0
mov dword [esp + 4], str.DriverProc
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
sub esp, 8
mov dword [esi + 0xc], eax
test eax, eax
je 0x6f243e08
mov dword [esi + 4], 0
mov dword [esi + 8], ebx
mov dword [esi + 0x10], 0
mov dword [esp], str.__o
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov eax, dword [section..bss]
sub esp, 4
test eax, eax
je 0x6f243e18
xor ecx, ecx
jmp 0x6f243c37
mov eax, dword [eax + 0x18]
test eax, eax
je 0x6f243c46
cmp ebx, dword [eax + 8]
jne 0x6f243c30
mov eax, dword [eax + 0x18]
add ecx, 1
test eax, eax
jne 0x6f243c37
test ecx, ecx
sete byte [esp + 0x2f]
mov dword [esp], str.__o
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
sub esp, 4
mov eax, dword [esp + 0x54]
test eax, eax
je 0x6f243c70
cmp byte [esp + 0x2f], 0
jne 0x6f243cf0
mov ecx, dword [esp + 0x54]
mov edx, ebp
mov eax, esi
call fcn.6f242d90
test eax, eax
je 0x6f243d30
test byte [0x6f266058], 8
jne 0x6f243dd0
add esp, 0x3c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
xor ebp, ebp
jmp 0x6f243b8e
mov eax, edi
call fcn.6f242800
mov edx, dword [esp + 0x54]
mov dword [esp + 0xc], str.__s___08IX___n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.DRIVER_TryOpenDriver32
mov dword [esp + 4], 0x6f266058
mov dword [esp + 0x14], edx
mov dword [esp], 3
call fcn.6f242aa0
jmp 0x6f243b48
xor ecx, ecx
mov edx, ebp
mov eax, esi
call fcn.6f242d90
test eax, eax
je 0x6f243e22
mov eax, dword [esp + 0x54]
mov dword [esp], edi
mov dword [esp + 4], eax
call fcn.6f243b30
test eax, eax
je 0x6f243e2c
or dword [esi + 4], 1
add esp, 0x3c
mov esi, eax
pop ebx
mov eax, esi
pop esi
pop edi
pop ebp
ret
mov ebp, str.load_failed
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_FreeLibrary]
sub esp, 4
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
test byte [0x6f266058], 8
jne 0x6f243d80
xor esi, esi
add esp, 0x3c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, edi
xor esi, esi
call fcn.6f242800
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Unable_to_load_32_bit_module__s:__s_n
mov dword [esp + 8], str.DRIVER_TryOpenDriver32
mov dword [esp + 4], 0x6f266058
mov dword [esp], 3
call fcn.6f242aa0
jmp 0x6f243d70
mov ebp, str.Not_a_32_bit_lib
jmp 0x6f243d35
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], str.___p_n
mov dword [esp + 8], str.DRIVER_TryOpenDriver32
mov dword [esp + 4], 0x6f266058
mov dword [esp], 3
call fcn.6f242aa0
add esp, 0x3c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebp, str.no_DriverProc
jmp 0x6f243d35
mov byte [esp + 0x2f], 1
jmp 0x6f243c4d
mov ebp, str.load0_failed
jmp 0x6f243d35
mov dword [esp + 8], 0
mov ebp, str.load1_failed
mov dword [esp + 4], 0
mov dword [esp], esi
call sym.winmm.dll_CloseDriver
sub esp, 0xc
jmp 0x6f243d35
xor ebx, ebx
mov ebp, 0x6f268245
jmp 0x6f243d35