Function at 0x474a00
Capabilities:
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x617f9d
mov eax, dword fs:[0]
push eax
sub esp, 0xf0
push ebx
push ebp
push esi
push edi
mov eax, dword [0x711ab8]
xor eax, esp
push eax
lea eax, [esp + 0x104]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x114]
lea eax, [esp + 0x18]
push eax
mov ecx, str.GetNet_
call fcn.0040b990
xor ebx, ebx
mov dword [esp + 0x10c], ebx
lea ecx, [esp + 0x1c]
push ecx
call fcn.00436580
add esp, 4
mov byte [esp + 0x10c], 1
mov eax, dword [eax]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea edx, [esp + 0x20]
push edx
call fcn.004122f0
mov byte [esp + 0x10c], bl
lea ecx, [esp + 0x1c]
call fcn.0040ba40
push 1
push 0x6d3a74
lea eax, [esp + 0x20]
push eax
call fcn.004122f0
lea esi, [esp + 0x1c]
call fcn.004364c0
mov byte [esp + 0x10c], 2
mov eax, dword [eax]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x20]
push ecx
call fcn.004122f0
mov byte [esp + 0x10c], bl
mov ecx, esi
call fcn.0040ba40
push 1
push 0x6d3a74
lea edx, [esp + 0x20]
push edx
call fcn.004122f0
lea ecx, [esp + 0x1c]
call fcn.00475770
mov byte [esp + 0x10c], 3
mov eax, dword [eax]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea eax, [esp + 0x20]
push eax
call fcn.004122f0
mov byte [esp + 0x10c], bl
lea ecx, [esp + 0x1c]
call fcn.0040ba40
push 1
push 0x6d3a74
lea ecx, [esp + 0x20]
push ecx
call fcn.004122f0
lea edx, [esp + 0x88]
push edx
call fcn.00443eb0
mov byte [esp + 0x10c], 5
mov ecx, dword [ebp + 0x2c]
lea eax, [esp + 0x88]
push eax
push ecx
call fcn.00423810
lea edx, [esp + 0x24]
push edx
call fcn.0040b8d0
mov byte [esp + 0x10c], 6
mov ecx, dword [esp + 0x98]
sub ecx, dword [esp + 0x94]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x474cd7
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x8c]
call fcn.0046df30
mov esi, eax
mov byte [esp + 0x10c], 7
mov eax, dword [esi]
sub eax, 0x10
cmp dword [eax + 0xc], 1
jle 0x474ba4
mov edx, dword [eax + 4]
push edx
push esi
call fcn.0040dd10
mov esi, dword [esi]
mov eax, esi
mov dword [esp + 0x50], 0xf
mov dword [esp + 0x4c], ebx
mov byte [esp + 0x3c], bl
lea edx, [eax + 1]
jmp 0x474bc0
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x474bc0
sub eax, edx
push eax
push esi
lea ecx, [esp + 0x40]
call fcn.0040d1b0
mov byte [esp + 0x10c], 8
lea edi, [esp + 0x38]
lea ecx, [esp + 0x54]
call fcn.004359d0
mov byte [esp + 0x10c], 9
cmp dword [eax + 0x18], 8
jb 0x474bfc
mov edx, dword [eax + 4]
jmp 0x474bff
lea edx, [eax + 4]
cmp edx, ebx
je 0x474c21
mov eax, edx
lea esi, [eax + 2]
jmp 0x474c10
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x474c10
sub eax, esi
sar eax, 1
mov ebx, eax
push edx
lea eax, [esp + 0x28]
call fcn.0040fac0
mov byte [esp + 0x10c], 8
cmp dword [esp + 0x6c], 8
jb 0x474c47
mov eax, dword [esp + 0x58]
push eax
call fcn.005c396f
add esp, 4
mov eax, 7
xor ebx, ebx
xor ecx, ecx
mov dword [esp + 0x6c], eax
mov dword [esp + 0x68], ebx
mov word [esp + 0x58], cx
mov byte [esp + 0x10c], al
cmp dword [esp + 0x50], 0x10
jb 0x474c78
mov edx, dword [esp + 0x3c]
push edx
call fcn.005c396f
add esp, 4
mov dword [esp + 0x50], 0xf
mov dword [esp + 0x4c], ebx
mov byte [esp + 0x3c], bl
mov byte [esp + 0x10c], 6
lea ecx, [esp + 0x1c]
call fcn.0040b810
push str.rbrtbrtbrtbr_
push 0x6cf2e4
lea eax, [esp + 0x2c]
push eax
call fcn.0040bb60
push str.nbrnbrnbrnbr_
push 0x6cb370
lea ecx, [esp + 0x2c]
push ecx
call fcn.0040bb60
push str.tabtabtabtab_
push 0x6d3a74
lea edx, [esp + 0x2c]
push edx
call fcn.0040bb60
xor ebx, ebx
mov eax, dword [esp + 0x24]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea eax, [esp + 0x20]
push eax
call fcn.004122f0
push 1
push 0x6d3a74
lea ecx, [esp + 0x20]
push ecx
call fcn.004122f0
lea edx, [esp + 0x70]
push edx
call fcn.00443eb0
mov byte [esp + 0x10c], 0xb
mov ecx, dword [ebp + 0x2c]
lea eax, [esp + 0x70]
push eax
push ecx
call fcn.00423190
lea edx, [esp + 0x20]
push edx
call fcn.0040b8d0
mov byte [esp + 0x10c], 0xc
mov eax, dword [esp + 0x80]
sub eax, dword [esp + 0x7c]
sar eax, 5
test eax, eax
jbe 0x474da5
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x74]
call fcn.0046ed90
mov byte [esp + 0x10c], 0xd
lea edi, [esp + 0x20]
call fcn.0040ddb0
mov byte [esp + 0x10c], 0xc
lea ecx, [esp + 0x1c]
call fcn.0040ba40
push str.rbrtbrtbrtbr_
push 0x6cf2e4
mov edx, edi
push edx
call fcn.0040bb60
push str.nbrnbrnbrnbr_
push 0x6cb370
mov eax, edi
push eax
call fcn.0040bb60
push str.tabtabtabtab_
push 0x6d3a74
mov ecx, edi
push ecx
call fcn.0040bb60
mov eax, dword [esp + 0x20]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea edx, [esp + 0x20]
push edx
call fcn.004122f0
lea eax, [esp + 0xb8]
push eax
call fcn.00443eb0
mov byte [esp + 0x10c], 0xf
lea ecx, [esp + 0xd0]
push ecx
call fcn.00443eb0
mov byte [esp + 0x10c], 0x11
lea edx, [esp + 0xe8]
push edx
call fcn.00443eb0
mov byte [esp + 0x10c], 0x13
add dword [0x72b658], 1
push 1
push 0x6d3a74
adc dword [0x72b65c], ebx
lea eax, [esp + 0x20]
push eax
call fcn.004122f0
lea ecx, [esp + 0x30]
push ecx
call fcn.0040b8d0
mov byte [esp + 0x10c], 0x14
mov ecx, dword [esp + 0xc8]
sub ecx, dword [esp + 0xc4]
mov eax, 0x66666667
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x474eb1
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0xbc]
call fcn.0046f760
mov byte [esp + 0x10c], 0x15
lea edi, [esp + 0x30]
call fcn.0040ddb0
mov byte [esp + 0x10c], 0x14
lea ecx, [esp + 0x1c]
call fcn.0040ba40
push str.rbrtbrtbrtbr_
push 0x6cf2e4
mov edx, edi
push edx
call fcn.0040bb60
push str.nbrnbrnbrnbr_
push 0x6cb370
mov eax, edi
push eax
call fcn.0040bb60
push str.tabtabtabtab_
push 0x6d3a74
mov ecx, edi
push ecx
call fcn.0040bb60
mov eax, dword [esp + 0x30]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea edx, [esp + 0x20]
push edx
call fcn.004122f0
push 1
push 0x6d3a74
lea eax, [esp + 0x20]
push eax
call fcn.004122f0
lea ecx, [esp + 0x28]
push ecx
call fcn.0040b8d0
mov byte [esp + 0x10c], 0x16
mov edx, dword [esp + 0xe0]
sub edx, dword [esp + 0xdc]
sar edx, 5
test edx, edx
jbe 0x474f65
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0xd4]
call fcn.0046ffd0
mov byte [esp + 0x10c], 0x17
lea edi, [esp + 0x28]
call fcn.0040ddb0
mov byte [esp + 0x10c], 0x16
lea ecx, [esp + 0x1c]
call fcn.0040ba40
push str.rbrtbrtbrtbr_
push 0x6cf2e4
mov ecx, edi
push ecx
call fcn.0040bb60
push str.nbrnbrnbrnbr_
push 0x6cb370
mov edx, edi
push edx
call fcn.0040bb60
push str.tabtabtabtab_
push 0x6d3a74
mov eax, edi
push eax
call fcn.0040bb60
mov eax, dword [esp + 0x28]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x20]
push ecx
call fcn.004122f0
push 1
push 0x6d3a74
lea edx, [esp + 0x20]
push edx
call fcn.004122f0
lea eax, [esp + 0x34]
push eax
call fcn.0040b8d0
mov byte [esp + 0x10c], 0x18
mov ecx, dword [esp + 0xf8]
sub ecx, dword [esp + 0xf4]
sar ecx, 3
test ecx, ecx
jbe 0x475019
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0xec]
call fcn.00470720
mov byte [esp + 0x10c], 0x19
lea edi, [esp + 0x34]
call fcn.0040ddb0
mov byte [esp + 0x10c], 0x18
lea ecx, [esp + 0x1c]
call fcn.0040ba40
push str.rbrtbrtbrtbr_
push 0x6cf2e4
mov eax, edi
push eax
call fcn.0040bb60
push str.nbrnbrnbrnbr_
push 0x6cb370
mov ecx, edi
push ecx
call fcn.0040bb60
push str.tabtabtabtab_
push 0x6d3a74
mov edx, edi
push edx
call fcn.0040bb60
mov eax, dword [esp + 0x34]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea eax, [esp + 0x20]
push eax
call fcn.004122f0
push 1
push 0x6d3a74
lea ecx, [esp + 0x20]
push ecx
call fcn.004122f0
lea edx, [esp + 0xa0]
push edx
call fcn.00443eb0
mov byte [esp + 0x10c], 0x1b
mov eax, dword [ebp + 0x2c]
push eax
lea ecx, [esp + 0xa4]
call fcn.00423a40
lea ecx, [esp + 0x2c]
push ecx
call fcn.0040b8d0
mov byte [esp + 0x10c], 0x1c
mov edx, dword [esp + 0xb0]
sub edx, dword [esp + 0xac]
sar edx, 5
test edx, edx
jbe 0x4751e7
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0xa4]
call fcn.0046e640
mov esi, eax
mov byte [esp + 0x10c], 0x1d
mov eax, dword [esi]
sub eax, 0x10
cmp dword [eax + 0xc], 1
jle 0x4750bd
mov ecx, dword [eax + 4]
push ecx
push esi
call fcn.0040dd10
mov esi, dword [esi]
mov eax, esi
mov dword [esp + 0x50], 0xf
mov dword [esp + 0x4c], ebx
mov byte [esp + 0x3c], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4750d4
sub eax, edx
push eax
push esi
lea ecx, [esp + 0x40]
call fcn.0040d1b0
mov byte [esp + 0x10c], 0x1e
lea edi, [esp + 0x38]
lea ecx, [esp + 0x54]
call fcn.004359d0
mov byte [esp + 0x10c], 0x1f
cmp dword [eax + 0x18], 8
jb 0x475110
mov edx, dword [eax + 4]
jmp 0x475113
lea edx, [eax + 4]
cmp edx, ebx
je 0x475131
mov eax, edx
lea esi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x475120
sub eax, esi
sar eax, 1
mov ebx, eax
push edx
lea eax, [esp + 0x30]
call fcn.0040fac0
mov byte [esp + 0x10c], 0x1e
cmp dword [esp + 0x6c], 8
jb 0x475157
mov edx, dword [esp + 0x58]
push edx
call fcn.005c396f
add esp, 4
xor ebx, ebx
xor eax, eax
mov dword [esp + 0x6c], 7
mov dword [esp + 0x68], ebx
mov word [esp + 0x58], ax
mov byte [esp + 0x10c], 0x1d
cmp dword [esp + 0x50], 0x10
jb 0x475188
mov ecx, dword [esp + 0x3c]
push ecx
call fcn.005c396f
add esp, 4
mov dword [esp + 0x50], 0xf
mov dword [esp + 0x4c], ebx
mov byte [esp + 0x3c], bl
mov byte [esp + 0x10c], 0x1c
lea ecx, [esp + 0x1c]
call fcn.0040b810
push str.rbrtbrtbrtbr_
push 0x6cf2e4
lea edx, [esp + 0x34]
push edx
call fcn.0040bb60
push str.nbrnbrnbrnbr_
push 0x6cb370
lea eax, [esp + 0x34]
push eax
call fcn.0040bb60
push str.tabtabtabtab_
push 0x6d3a74
lea ecx, [esp + 0x34]
push ecx
call fcn.0040bb60
xor ebx, ebx
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea edx, [esp + 0x20]
push edx
call fcn.004122f0
push 2
push 0x6d1590
lea eax, [esp + 0x20]
push eax
call fcn.004122f0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
lea edx, [esp + 0x20]
push edx
push ecx
call fcn.0040b930
mov byte [esp + 0x114], 0x20
mov byte [esp + 0x114], 0x1c
mov ecx, ebp
call fcn.004710a0
cmp al, bl
je 0x475248
mov ecx, dword [ebp + 0x2c]
lea eax, [esp + 0x70]
push eax
push ecx
call fcn.004235f0
mov byte [esp + 0x10c], 0x1b
lea ecx, [esp + 0x2c]
call fcn.0040ba40
mov byte [esp + 0x10c], 0x18
lea edx, [esp + 0xa0]
push edx
call fcn.00475cb0
mov byte [esp + 0x10c], 0x16
lea ecx, [esp + 0x34]
call fcn.0040ba40
mov byte [esp + 0x10c], 0x14
lea ecx, [esp + 0x28]
call fcn.0040ba40
mov byte [esp + 0x10c], 0x13
lea ecx, [esp + 0x30]
call fcn.0040ba40
mov byte [esp + 0x10c], 0x11
lea eax, [esp + 0xe8]
push eax
call fcn.004848f0
mov byte [esp + 0x10c], 0xf
lea ecx, [esp + 0xd0]
push ecx
call fcn.00475e70
mov byte [esp + 0x10c], 0xc
lea edx, [esp + 0xb8]
push edx
call fcn.00475d70
mov byte [esp + 0x10c], 0xb
lea ecx, [esp + 0x20]
call fcn.0040ba40
mov byte [esp + 0x10c], 6
lea eax, [esp + 0x70]
push eax
call fcn.00475d10
mov byte [esp + 0x10c], 5
lea ecx, [esp + 0x24]
call fcn.0040ba40
mov byte [esp + 0x10c], bl
lea ecx, [esp + 0x88]
push ecx
call fcn.00475b90
mov dword [esp + 0x10c], 0xffffffff
lea ecx, [esp + 0x18]
call fcn.0040ba40
mov ecx, dword [esp + 0x104]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xfc
ret 4