Function at 0x409443
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x453c53
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x4691c0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov edi, ebx
call fcn.0041b140
call fcn.0041a428
call fcn.0041a3f7
call fcn.0041b128
call fcn.0041a453
call fcn.004167d8
call fcn.0041a43f
call fcn.0041a41b
call fcn.0041a45d
call fcn.0041a46a
call fcn.0041a401
call fcn.0041a40e
call fcn.0041a3ea
call fcn.0041a432
call fcn.0041a449
lea eax, [esp + 0x14]
call fcn.00419f8e
and dword [esp + 0x30], 0
mov esi, eax
call fcn.004091c2
push 5
mov edi, esi
call fcn.00419ffc
push str.OPTIMUM
call fcn.0041a00a
push str.Deflate
call fcn.0041a018
push 0x20
call fcn.0041a05e
push 5
call fcn.0041a06c
push 1
call fcn.0041a050
push str..sys__.com_
push 1
push 0x10
push 0x45f830
push 0x45f838
mov eax, esi
push eax
call fcn.0041a07a
push str..ppt__.xls__.doc__.ani__.ico__.cur__.pcx__.emf_
push 6
push 0xe
mov edi, 0x45f83c
push edi
push 0x45f848
mov eax, esi
push eax
call fcn.0041a07a
push str..ace__.alz__.arc__.arj__.bz__.bz2__.cab__.egg__.ice__.ear__.war__.gz__.ha__.jar__.lha__.lzh__.pak__.rar__.tbz__.tbz2__.tgz__.7z__.z__.zip__.zoo__.docx__.xlsx__.pptx__.jpg__.jpeg__.png__.gif__.ape__.mp4__.mov__.flac__.flv__.mp3__.ogg__.wma__.wmv_
push 0
push 0
push 0x45f84c
push 0x45f858
mov eax, esi
push eax
call fcn.0041a07a
push str..h__.c__.java__.cpp__.txt__.pas__.xml__.html__.htm__.bat__.1st__.ans__.asc__.ascii__.bbs__.charset__.dbt__.err__.faq__.hs__.klg__.man__.ada__.as__.au3__.b__.bas__.bb__.bet__.cp__.cs__.d__.def__.dev__.dpr__.dsp__.fpp__.hpp__.hh__.hs__.inc__.j__.jav__.xaml__.x_
push 4
push 0x40
push 0x45f85c
push 0x45f864
mov eax, esi
push eax
call fcn.0041a07a
push ecx
push ecx
lea eax, [esp + 0x1c]
mov esi, esp
mov dword [esp + 0x18], esp
push eax
call fcn.00419fb6
mov ecx, ebx
call fcn.0041a568
push 6
push 0xe
push edi
push 0x45f868
push 6
push ebx
call fcn.0041a5c9
lea eax, [esp + 0x1c]
call fcn.00419f8e
mov esi, eax
mov byte [esp + 0x30], 1
call fcn.004091c2
push 7
mov edi, esi
call fcn.00419ffc
push str.CS_PRIORITY
call fcn.0041a00a
push str.Deflate
call fcn.0041a018
push 0x20
call fcn.0041a05e
push 5
call fcn.0041a06c
push 1
call fcn.0041a050
push str..ace__.alz__.arc__.arj__.bz__.bz2__.cab__.egg__.ice__.ear__.war__.gz__.ha__.jar__.lha__.lzh__.pak__.rar__.tbz__.tbz2__.tgz__.7z__.z__.zip__.zoo__.docx__.xlsx__.pptx__.jpg__.jpeg__.png__.gif__.ape__.mp4__.mov__.flac__.flv__.mp3__.ogg__.wma__.wmv_
push 0
push 0
mov edi, 0x45f84c
push edi
push 0x45f858
mov eax, esi
push eax
call fcn.0041a07a
push ecx
push ecx
lea eax, [esp + 0x24]
mov esi, esp
mov dword [esp + 0x18], esp
push eax
call fcn.00419fb6
mov ecx, ebx
call fcn.0041a568
push 6
push 0x20
push str.Deflate
push str.Normal
push 9
push ebx
call fcn.0041a5c9
xor eax, eax
push eax
push eax
push edi
push str.Nocomp
push eax
push ebx
call fcn.0041a5c9
push 1
push str.Zip_2.0_Compatible
push ebx
call fcn.0041a672
push 2
push str.AES_128_bit
push ebx
call fcn.0041a672
push 4
push str.AES_256_bit
push ebx
call fcn.0041a672
push 5
push str.LEA_128_bit
push ebx
call fcn.0041a672
push 7
push str.LEA_256_bit
push ebx
call fcn.0041a672
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 0
call fcn.00419fcb
or dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.00419fcb
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4