Function at 0x4a5ea1
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 9
push 0
push 0
dec ecx
jne 0x4a59e5
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov esi, edx
mov edi, eax
xor eax, eax
push ebp
push 0x4a625a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov eax, dword [esi + 4]
cmp eax, dword [edi + 0x18]
jne 0x4a5c66
xor edx, edx
push ebp
push 0x4a5c5f
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4a5c4d
xor edx, edx
push ebp
push 0x4a5c46
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax + 4]
cmp eax, 0x15
jge 0x4a5a6a
dec eax
sub eax, 3
jb 0x4a5a8b
je 0x4a5ade
add eax, 0xfffffff9
sub eax, 3
jb 0x4a5b0d
jmp 0x4a5c30
add eax, 0xffffffeb
sub eax, 2
jb 0x4a5b91
sub eax, 8
je 0x4a5bd5
dec eax
je 0x4a5c14
jmp 0x4a5c30
cmp word [edi + 0x22], 0
je 0x4a5c30
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x14]
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x1c]
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x20]
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x24]
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x28]
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x2c]
push eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x10]
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 8]
mov eax, dword [edi + 0x24]
call dword [edi + 0x20]
jmp 0x4a5c30
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0xc], 0
je 0x4a5c30
cmp word [edi + 0x2a], 0
je 0x4a5c30
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 8]
mov eax, dword [edi + 0x2c]
call dword [edi + 0x28]
jmp 0x4a5c30
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0xc], 0
je 0x4a5c30
cmp word [edi + 0x32], 0
je 0x4a5c30
mov eax, dword [ebp - 0x10]
add eax, 0xc
call fcn.004a5858
mov ebx, eax
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + 0xc]
call fcn.00406d10
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax + 4]
cmp al, 0xc
jne 0x4a5b61
mov eax, dword [ebp - 4]
push eax
push 2
mov edx, dword [esi + 8]
mov ecx, ebx
mov eax, dword [edi + 0x34]
call dword [edi + 0x30]
jmp 0x4a5c30
cmp al, 0xd
jne 0x4a5b7b
mov eax, dword [ebp - 4]
push eax
push 1
mov edx, dword [esi + 8]
mov ecx, ebx
mov eax, dword [edi + 0x34]
call dword [edi + 0x30]
jmp 0x4a5c30
mov eax, dword [ebp - 4]
push eax
push 0
mov edx, dword [esi + 8]
mov ecx, ebx
mov eax, dword [edi + 0x34]
call dword [edi + 0x30]
jmp 0x4a5c30
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0xc], 0
je 0x4a5c30
cmp word [edi + 0x3a], 0
je 0x4a5c30
mov eax, dword [ebp - 0x10]
add eax, 0xc
call fcn.004a5858
mov ebx, eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
push eax
mov eax, dword [ebp - 0x10]
cmp byte [eax + 4], 0x16
sete al
push eax
mov edx, dword [esi + 8]
mov ecx, ebx
mov eax, dword [edi + 0x3c]
call dword [edi + 0x38]
jmp 0x4a5c30
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x14], 0
je 0x4a5c30
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0xc], 0
je 0x4a5c30
cmp word [edi + 0x42], 0
je 0x4a5c30
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x1c]
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
push eax
mov ecx, dword [esi + 8]
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 0x14]
mov eax, dword [edi + 0x44]
call dword [edi + 0x40]
jmp 0x4a5c30
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0xc], 0
je 0x4a5c30
cmp word [edi + 0x4a], 0
je 0x4a5c30
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 0xc]
mov eax, dword [edi + 0x4c]
call dword [edi + 0x48]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a5c4d
mov eax, dword [ebp - 0x10]
call fcn.004050f4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a6232
mov byte [ebp - 9], 1
ret
cmp eax, dword [edi + 0x50]
jne 0x4a5c7f
cmp dword [esi + 8], 6
jne 0x4a6232
xor eax, eax
mov dword [edi + 8], eax
jmp 0x4a6232
cmp eax, 0x4a
jne 0x4a6232
mov ebx, dword [esi + 0xc]
test ebx, ebx
je 0x4a6232
xor eax, eax
push ebp
push 0x4a6228
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, byte [ebx]
mov byte [ebp - 0x11], al
movzx eax, byte [ebp - 0x11]
cmp eax, 0x20
ja case.0x4a5cbb.0
movzx eax, byte [eax + 0x4a5cc2]
jmp dword [eax*4 + 0x4a5ce3]
xor eax, eax
push ebp
push 0x4a5dc0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 8]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4a5dae
mov eax, dword [esi + 8]
push eax
movzx ecx, byte [ebp - 0x11]
mov dl, 1
mov eax, dword [0x4a4ed4]
call fcn.004a4fd4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
add eax, 0x10
mov edx, dword [ebp - 0x18]
mov ecx, pe_nt_image_headers32
call fcn.004074e0
mov eax, dword [ebp - 0x10]
add eax, 0x14
mov edx, dword [ebp - 0x18]
add edx, 0x200
mov ecx, pe_nt_image_headers32
call fcn.004074e0
mov eax, dword [ebp - 0x10]
add eax, 0x18
mov edx, dword [ebp - 0x18]
add edx, 0x400
mov ecx, 0x401
call fcn.004074e0
mov eax, dword [ebp - 0x10]
add eax, 0x1c
mov edx, dword [ebp - 0x18]
add edx, 0xc02
mov ecx, 0xfe6
call fcn.004074e0
mov eax, dword [ebp - 0x10]
add eax, 0x20
call fcn.004068e8
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [esi + 8]
push eax
mov eax, dword [edi + 0x18]
push eax
mov eax, dword [edi + 4]
push eax
call sub.user32.dll_PostMessageW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x4a5cbb.0
mov byte [ebp - 9], 1
ret
xor eax, eax
push ebp
push 0x4a5e9a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 8]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4a5e88
mov eax, dword [esi + 8]
push eax
movzx ecx, byte [ebp - 0x11]
mov dl, 1
mov eax, dword [0x4a4ed4]
call fcn.004a4fd4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
add eax, 0x10
mov edx, dword [ebp - 0x1c]
mov ecx, pe_nt_image_headers32
call fcn.004074e0
mov eax, dword [ebp - 0x10]
add eax, 0x14
mov edx, dword [ebp - 0x1c]
add edx, 0x200
mov ecx, pe_nt_image_headers32
call fcn.004074e0
mov eax, dword [ebp - 0x10]
add eax, 0x18
mov edx, dword [ebp - 0x1c]
add edx, 0x400
mov ecx, 0x401
call fcn.004074e0
mov eax, dword [ebp - 0x10]
add eax, 0x1c
mov edx, dword [ebp - 0x1c]
add edx, 0xc02
mov ecx, 0xfe6
call fcn.004074e0
mov eax, dword [ebp - 0x10]
add eax, 0x20
mov edx, dword [ebp - 0x1c]
add edx, 0x2bce
mov ecx, 0xfe6
call fcn.004074e0
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [esi + 8]
push eax
mov eax, dword [edi + 0x18]
push eax
mov eax, dword [edi + 4]
push eax
call sub.user32.dll_PostMessageW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x4a5cbb.0
mov byte [ebp - 9], 1
ret
xor eax, eax
push ebp
push 0x4a6037
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, dword [ebx + 8]
call fcn.004074a4
cmp dword [ebp - 8], 0
je 0x4a6025
mov dl, 1
mov eax, dword [0x46a4e8]
call fcn.00484a18
mov dword [ebp - 0x20], eax
xor eax, eax
push ebp
push 0x4a601e
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov eax, dword [esi + 8]
push eax
movzx ecx, byte [ebp - 0x11]
mov dl, 1
mov eax, dword [0x4a4ed4]
call fcn.004a4fd4
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x24]
mov edx, 0x4a6278
mov eax, dword [ebp - 0x20]
call fcn.0048336c
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
add eax, 0x10
call fcn.00406cc8
lea ecx, [ebp - 0x28]
mov edx, 0x4a6298
mov eax, dword [ebp - 0x20]
call fcn.0048336c
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
add eax, 0x14
call fcn.00406cc8
lea ecx, [ebp - 0x2c]
mov edx, 0x4a62b4
mov eax, dword [ebp - 0x20]
call fcn.0048336c
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
add eax, 0x18
call fcn.00406cc8
lea ecx, [ebp - 0x30]
mov edx, 0x4a62cc
mov eax, dword [ebp - 0x20]
call fcn.0048336c
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x10]
add eax, 0x1c
call fcn.00406cc8
lea ecx, [ebp - 0x34]
mov edx, 0x4a62e8
mov eax, dword [ebp - 0x20]
call fcn.0048336c
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x10]
add eax, 0x20
call fcn.00406cc8
lea ecx, [ebp - 0x38]
mov edx, 0x4a6300
mov eax, dword [ebp - 0x20]
call fcn.0048336c
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x10]
add eax, 0x24
call fcn.00406cc8
lea ecx, [ebp - 0x3c]
mov edx, 0x4a631c
mov eax, dword [ebp - 0x20]
call fcn.0048336c
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x10]
add eax, 0x28
call fcn.00406cc8
lea ecx, [ebp - 0x40]
mov edx, 0x4a6334
mov eax, dword [ebp - 0x20]
call fcn.0048336c
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x10]
add eax, 0x2c
call fcn.00406cc8
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [esi + 8]
push eax
mov eax, dword [edi + 0x18]
push eax
mov eax, dword [edi + 4]
push eax
call sub.user32.dll_PostMessageW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a6025
mov eax, dword [ebp - 0x20]
call fcn.004050f4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x4a5cbb.0
mov byte [ebp - 9], 1
ret
xor eax, eax
push ebp
push 0x4a60a9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, dword [ebx + 8]
call fcn.004074a4
cmp dword [ebp - 8], 0
je 0x4a6097
mov eax, dword [esi + 8]
push eax
movzx ecx, byte [ebp - 0x11]
mov dl, 1
mov eax, dword [0x4a4ed4]
call fcn.004a4fd4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
add eax, 0xc
mov edx, dword [ebp - 8]
call fcn.00406cc8
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [esi + 8]
push eax
mov eax, dword [edi + 0x18]
push eax
mov eax, dword [edi + 4]
push eax
call sub.user32.dll_PostMessageW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x4a5cbb.0
mov byte [ebp - 9], 1
ret
xor eax, eax
push ebp
push 0x4a6217
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, dword [ebx + 8]
call fcn.004074a4
cmp dword [ebp - 8], 0
je 0x4a6205
mov dl, 1
mov eax, dword [0x46a4e8]
call fcn.00484a18
mov dword [ebp - 0x20], eax
xor eax, eax
push ebp
push 0x4a61fe
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov eax, dword [esi + 8]
push eax
movzx ecx, byte [ebp - 0x11]
mov dl, 1
mov eax, dword [0x4a4ed4]
call fcn.004a4fd4
mov dword [ebp - 0x10], eax
mov edx, 0x4a634c
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
mov ebx, eax
test ebx, ebx
jl 0x4a614a
lea ecx, [ebp - 0x44]
mov edx, ebx
mov eax, dword [ebp - 0x20]
call fcn.00484138
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x10]
add eax, 0x14
call fcn.00406cc8
mov edx, ebx
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
call dword [ecx + 0x4c]
mov edx, 0x4a6278
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
mov ebx, eax
test ebx, ebx
jl 0x4a6182
lea ecx, [ebp - 0x48]
mov edx, ebx
mov eax, dword [ebp - 0x20]
call fcn.00484138
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x10]
add eax, 0x10
call fcn.00406cc8
mov edx, ebx
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
call dword [ecx + 0x4c]
mov edx, 0x4a636c
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
mov ebx, eax
test ebx, ebx
jl 0x4a61ba
lea ecx, [ebp - 0x4c]
mov edx, ebx
mov eax, dword [ebp - 0x20]
call fcn.00484138
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x10]
add eax, 0x1c
call fcn.00406cc8
mov edx, ebx
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
call dword [ecx + 0x4c]
lea edx, [ebp - 0x50]
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x10]
add eax, 0xc
call fcn.00406cc8
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [esi + 8]
push eax
mov eax, dword [edi + 0x18]
push eax
mov eax, dword [edi + 4]
push eax
call sub.user32.dll_PostMessageW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a6205
mov eax, dword [ebp - 0x20]
call fcn.004050f4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x4a5cbb.0
mov byte [ebp - 9], 1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a6232
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a6261
lea eax, [ebp - 0x50]
mov edx, 0xc
call fcn.00406948
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406948
ret