Function at 0x404780
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, edx
push esi
push ebx
sub esp, 0x4c
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x28], 0
jmp 0x4047bf
cmp eax, 1
je 0x4047ce
cmp eax, 2
je 0x404800
test byte [0x411020], 4
jne 0x404970
mov eax, dword [edi]
test eax, eax
je 0x4047ef
add edi, eax
mov eax, dword [edi + 4]
cmp eax, 4
je 0x404800
jbe 0x4047a0
cmp eax, 5
jne 0x4047aa
mov ecx, dword [edi + 8]
lea edx, [edi + 0xc]
mov eax, dword [ebp - 0x1c]
shr ecx, 1
call fcn.00401ff0
test eax, eax
je 0x4047b7
mov eax, dword [edi]
mov dword [ebp - 0x28], 1
test eax, eax
jne 0x4047bd
mov eax, dword [ebp - 0x28]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [edi + 8]
lea edx, [edi + 0xc]
mov eax, dword [ebp - 0x1c]
shr ecx, 1
call fcn.00401d90
mov dword [ebp - 0x20], eax
mov esi, eax
test eax, eax
je 0x4047b7
mov eax, dword [0x41825c]
test eax, eax
je 0x404943
xor ebx, ebx
mov dword [ebp - 0x24], edi
mov edi, ebx
jmp 0x40483f
add edi, 1
cmp edi, dword [0x41825c]
jae 0x404940
mov dword [esp + 4], esi
mov eax, dword [0x418260]
lea ebx, [edi*4]
mov eax, dword [eax + edi*4]
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll__wcsicmp]
test eax, eax
jne 0x404830
mov eax, dword [0x418260]
mov esi, ebx
mov ebx, edi
mov edi, dword [ebp - 0x24]
mov ecx, dword [eax + ebx*4]
mov eax, dword [ecx + 4]
mov dword [ebp - 0x24], ecx
mov dword [esp], eax
call sub.user32.dll_DestroyIcon
mov ecx, dword [ebp - 0x24]
sub esp, 4
mov edx, dword fs:[0x18]
mov eax, dword [ecx]
mov dword [ebp - 0x2c], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x28], edx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [ebp - 0x24], eax
call eax
mov ecx, dword [ebp - 0x2c]
sub esp, 0xc
mov eax, dword [ecx + 8]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x24]
call eax
mov ecx, dword [ebp - 0x2c]
sub esp, 0xc
mov dword [esp + 4], 0
mov dword [esp + 8], ecx
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x24]
call eax
mov eax, dword [0x41825c]
sub esp, 0xc
sub eax, 1
mov dword [0x41825c], eax
jne 0x4049a0
mov ebx, dword [ebp - 0x20]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], ebx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x24]
call eax
sub esp, 0xc
jmp 0x4047e2
mov edi, dword [ebp - 0x24]
mov edx, dword [ebp - 0x20]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
jmp 0x4047b7
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.unexpected_action__lu_n
mov dword [esp + 8], str.process_changes
mov dword [esp + 4], 0x411020
mov dword [esp], 2
call fcn.00402610
jmp 0x4047b7
mov ecx, dword [0x418260]
sub eax, ebx
shl eax, 2
mov dword [esp + 8], eax
lea eax, [ecx + esi + 4]
add ecx, esi
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [sym.imp.ucrtbase.dll_memmove]
jmp 0x404911