Function at 0x687c3520
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x2c
test edx, edx
je 0x687c3730
xor eax, eax
cmp dword [edx], 0x10
mov ebx, edx
je 0x687c3548
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esi + 8]
mov dword [esp + 4], 0
mov edi, ecx
mov edx, dword fs:[0x18]
mov dword [esp + 8], eax
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x1c], edx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.kernel32.dll_HeapFree
mov eax, dword [esi + 0xc]
mov edx, dword [ebp - 0x1c]
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.kernel32.dll_HeapFree
mov eax, dword [ebx]
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov dword [esp], esi
call sub.ucrtbase.dll_memcpy
test edi, edi
je 0x687c3650
mov eax, dword [ebx + 8]
test eax, eax
je 0x687c35f7
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_strlen]
mov edx, dword [ebp - 0x1c]
mov dword [esp + 4], 0
add eax, 1
mov dword [esp + 8], eax
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.kernel32.dll_HeapAlloc
mov dword [esi + 8], eax
mov edx, dword [ebx + 8]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.ucrtbase.dll_strcpy]
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x687c3720
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_strlen]
mov dword [esp + 4], 0
add eax, 1
mov dword [esp + 8], eax
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.kernel32.dll_HeapAlloc
mov dword [esi + 0xc], eax
mov edx, dword [ebx + 0xc]
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.ucrtbase.dll_strcpy]
mov eax, edi
jmp 0x687c353c
mov edx, dword [ebx + 8]
test edx, edx
je 0x687c36b8
cmp word [edx], 0
je 0x687c3758
mov eax, edx
lea esi, [esi]
nop
add eax, 2
cmp word [eax], 0
jne 0x687c3668
sub eax, edx
add eax, 2
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.kernel32.dll_HeapAlloc
xor edx, edx
mov dword [esi + 8], eax
mov edi, dword [ebx + 8]
sub esp, 0xc
lea esi, [esi]
movzx ecx, word [edi + edx]
mov word [eax + edx], cx
add edx, 2
test cx, cx
jne 0x687c36a8
mov edx, dword [ebx + 0xc]
test edx, edx
je 0x687c3720
cmp word [edx], 0
je 0x687c3768
mov eax, edx
lea esi, [esi]
nop
add eax, 2
cmp word [eax], 0
jne 0x687c36d0
sub eax, edx
add eax, 2
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.kernel32.dll_HeapAlloc
xor edx, edx
mov dword [esi + 0xc], eax
mov ebx, dword [ebx + 0xc]
sub esp, 0xc
lea esi, [esi]
movzx ecx, word [ebx + edx]
mov word [eax + edx], cx
add edx, 2
test cx, cx
jne 0x687c3710
lea esp, [ebp - 0xc]
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax], 0x10
mov eax, 1
jmp 0x687c353c
mov eax, 2
jmp 0x687c3676
mov eax, 2
jmp 0x687c36de