Function at 0x4446e0
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x497d36
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1e0
mov eax, dword [esp + 0x1f0]
push esi
push edi
xor edi, edi
push eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], 0xfe
mov dword [esp + 0x30], 4
mov dword [esp + 0x34], 8
mov dword [esp + 0x38], 0x10
mov dword [esp + 0x3c], 0x18
mov dword [esp + 0x40], 0x20
call fcn.004465a0
lea ecx, [esp + 0x10]
mov dword [esp + 0x1f0], edi
call fcn.004464c0
push eax
mov ecx, 0x4c0be8
call fcn.0044b9b0
mov ecx, eax
call fcn.004496c0
mov esi, eax
cmp esi, edi
je 0x4447bb
mov ecx, esi
call fcn.0044ea60
cmp eax, 0x27
je 0x444799
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea edx, [esp + 8]
push edx
mov ecx, 0x4c086c
mov dword [esp + 0xc], eax
call fcn.00444110
mov dword [eax], 9
jmp 0x4447da
lea eax, [esi + 0xbc]
push eax
mov ecx, 0x4c0be8
call fcn.0044b9b0
mov ecx, eax
call fcn.004495d0
mov ecx, eax
cmp ecx, edi
mov dword [esp + 0x20], ecx
jne 0x4447f5
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea ecx, [esp + 8]
push ecx
mov ecx, 0x4c086c
mov dword [esp + 0xc], eax
call fcn.00444110
mov dword [eax], 8
lea ecx, [esp + 0x10]
mov dword [esp + 0x1f0], 0xffffffff
call fcn.004462c0
xor eax, eax
jmp 0x44498a
mov eax, dword [ecx + 0xc]
mov edi, dword [esi + 0xac]
xor edx, edx
div edi
push ebx
xor edx, edx
push ebp
mov ebx, eax
mov eax, dword [ecx + 0x10]
mov ecx, dword [esi + 0xb0]
div ecx
test ebx, ebx
mov ebp, eax
mov dword [esp + 0x14], ebp
je 0x444953
test ebp, ebp
je 0x444953
mov edx, dword [esi + 0xb8]
imul eax, ebx
push edx
mov edx, dword [esi + 0xb4]
push eax
mov eax, dword [esp + edx*4 + 0x34]
or eax, 1
push eax
push ecx
push edi
call dword [sym.imp.COMCTL32.dll_ImageList_Create]
mov edi, eax
test edi, edi
mov dword [esp + 0x10], edi
jne 0x444878
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea ecx, [esp + 0x10]
push ecx
mov ecx, 0x4c086c
mov dword [esp + 0x14], eax
call fcn.00444110
mov dword [eax], 0xb
jmp 0x444972
push 0
lea ecx, [esp + 0x4c]
call fcn.004450f0
xor ecx, ecx
test ebp, ebp
mov byte [esp + 0x1f8], 1
jle 0x444922
jmp 0x4448a0
mov edi, dword [esi + 0xf4]
lea eax, [esi + 0xf0]
mov ebx, dword [eax]
mov edx, dword [eax + 4]
mov dword [esp + 0x30], edx
mov edx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x34], edx
mov edx, dword [esi + 0xb0]
mov dword [esp + 0x38], eax
lea ebp, [ecx + 1]
mov eax, edx
imul eax, ecx
mov ecx, ebp
imul ecx, edx
add ecx, edi
lea edx, [esp + 0x48]
push edx
push ecx
mov ecx, dword [esp + 0x3c]
push ecx
mov ecx, dword [esp + 0x34]
add eax, edi
push eax
push ebx
call fcn.00445e70
push 0
lea ecx, [esp + 0x4c]
call fcn.00459d30
mov edx, dword [esi + 0x18]
mov edi, eax
mov eax, dword [esp + 0x10]
push edx
push edi
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
push edi
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [esp + 0x14]
mov ecx, ebp
cmp ecx, eax
jl 0x4448a0
mov edi, dword [esp + 0x10]
lea ecx, [esp + 0x48]
mov byte [esp + 0x1f8], 0
mov dword [esp + 0x48], 0x4a79a8
call fcn.00444b20
lea ecx, [esp + 0x18]
mov dword [esp + 0x1f8], 0xffffffff
call fcn.004462c0
mov eax, edi
jmp 0x444988
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea ecx, [esp + 0x14]
push ecx
mov ecx, 0x4c086c
mov dword [esp + 0x18], eax
call fcn.00444110
mov dword [eax], 0xa
lea ecx, [esp + 0x18]
mov dword [esp + 0x1f8], 0xffffffff
call fcn.004462c0
xor eax, eax
pop ebp
pop ebx
mov ecx, dword [esp + 0x1e8]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x1ec
ret 4