Function at 0x1027559
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ax, word [ebp + 0xc]
shr ax, 8
mov cl, al
and al, 0xf
sub esp, 0xc
shr cl, 4
movzx ax, al
push ebx
movzx cx, cl
push esi
movzx esi, ax
movzx ax, byte [ebp + 0xc]
movzx ecx, cx
movzx ebx, ax
movzx eax, cx
mov ecx, dword [ebp + 8]
push edi
lea edi, [ecx + eax*4 + 0xc]
mov eax, dword [edi]
test eax, eax
jne 0x10275bf
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0x40
push 8
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
test eax, eax
jne 0x10275bd
mov eax, 0xc0000017
jmp 0x102778e
mov dword [edi], eax
movzx ecx, si
lea esi, [eax + ecx*4]
mov eax, dword [esi]
test eax, eax
jne 0x10275ea
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0x400
push 8
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
test eax, eax
je 0x10275b3
mov dword [esi], eax
movzx ecx, bx
lea edi, [eax + ecx*4]
mov esi, dword [edi]
mov dword [ebp + 0xc], edi
test esi, esi
jne 0x1027615
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0x10
push 8
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
test esi, esi
je 0x10275b3
mov edx, dword [ebp + 0x10]
mov cx, word [ebp + 0x12]
test dx, dx
jne 0x1027643
test cx, cx
jne 0x1027643
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
and dword [edi], 0
jmp 0x102778c
xor ebx, ebx
inc ebx
mov eax, esi
cmp word [eax + 8], dx
jne 0x1027654
cmp word [eax + 0xa], cx
je 0x102765c
mov eax, dword [eax]
test eax, eax
je 0x102766b
jmp 0x1027648
cmp dword [eax + 0xc], 0
push 2
pop ebx
mov esi, eax
je 0x10275b3
push 2
push edx
call fcn.01026d2f
mov dword [ebp - 8], eax
cmp ebx, 1
jne 0x1027776
mov ecx, dword [edi]
mov edi, dword [sym.imp.ntdll.dll_RtlSizeHeap]
mov ebx, dword [sym.imp.ntdll.dll_RtlReAllocateHeap]
mov dword [ebp - 4], ecx
test ecx, ecx
je 0x10276e9
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ecx
push 0
push dword [eax + 0x18]
call edi
mov ecx, dword fs:[0x18]
mov dword [ebp - 0xc], eax
add eax, 0x10
push eax
push dword [ebp - 4]
mov eax, dword [ecx + 0x30]
push 8
push dword [eax + 0x18]
call ebx
mov esi, eax
test esi, esi
je 0x10275b3
push dword [ebp - 4]
mov eax, dword [ebp + 0xc]
push esi
mov dword [eax], esi
call fcn.01026c6b
add esi, dword [ebp - 0xc]
mov eax, dword [ebp + 0x10]
mov dword [esi + 8], eax
lea eax, [esi - 0x10]
mov dword [esi + 4], eax
jmp 0x10276f2
mov eax, dword [ebp + 0x10]
mov dword [esi + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], ecx
test ecx, ecx
jne 0x1027730
push dword [ebp - 8]
push 8
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], eax
test eax, eax
jne 0x1027773
push esi
push dword [ebp + 0xc]
call fcn.010273af
jmp 0x10275b3
push ecx
push 0
push dword [eax + 0x18]
call edi
mov ecx, dword [ebp - 8]
mov edi, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
add ecx, edi
push ecx
push dword [ebp - 4]
push 8
push dword [eax + 0x18]
call ebx
mov ebx, dword [ebp + 8]
mov dword [ebx + 8], eax
test eax, eax
jne 0x1027765
mov eax, dword [ebp - 4]
mov dword [ebx + 8], eax
jmp 0x1027722
push dword [ebp - 4]
push ebx
call fcn.01026ca0
mov eax, dword [ebx + 8]
add eax, edi
mov dword [esi + 0xc], eax
push dword [ebp + 0x10]
push dword [ebp + 0x14]
push dword [ebp + 0x18]
push 2
push dword [ebp - 8]
push dword [esi + 0xc]
call fcn.01026d6b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x14