Function at 0x77cb48fc
Capabilities:
Get process heap flags

Disassembly:
lea eax, [esi + 0x14]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0xa
xor edi, edi
inc edi
push edi
push 0x77cb505c
mov dword [esi + 8], 0xc355
mov dword [esi + 0xc], ebx
call dword [sym.imp.ntdll.dll_RtlAllocateAndInitializeSid]
cmp eax, ebx
jl 0x77cb494d
mov eax, dword fs:[0x18]
push 8
mov dword [esi + 0x18], 0x4000000
mov dword [esi + 0x10], edi
mov dword [esi + 0x34], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x4c], edi
mov dword [esi + 0x48], edi
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
cmp edi, ebx
mov dword [esi + 0x50], edi
je 0x77ce0b3f
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push dword [esi + 0x50]
mov edi, dword [sym.imp.ntdll.dll_RtlAllocateAndInitializeSid]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0xc
push 1
push 0x77cb505c
call edi
cmp eax, ebx
jl 0x77cb494d
push 8
pop eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x3c], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0x40
push ebx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
cmp eax, ebx
mov dword [esi + 0x44], eax
je 0x77ce0b3f
push 0x40
push ebx
push eax
call sub.ntdll.dll_memset
mov eax, dword [esi + 0x44]
or dword [eax + 4], 0xffffffff
add esp, 0xc
push dword [esi + 0x44]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0xa
push 1
push 0x77cb505c
call edi
mov eax, dword [esi + 0x44]
or dword [eax + 0xc], 0xffffffff
mov eax, dword [esi + 0x44]
add eax, 8
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
push 0x77cb505c
call edi
cmp eax, ebx
jl 0x77cb494d
mov eax, dword [esi + 0x44]
or dword [eax + 0x14], 0xffffffff
mov eax, dword [esi + 0x44]
add eax, 0x10
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x223
push 0x20
push 2
push 0x77cb505c
call edi
cmp eax, ebx
jl 0x77cb494d
mov eax, dword [esi + 0x44]
mov dword [eax + 0x1c], 1
mov eax, dword [esi + 0x44]
add eax, 0x18
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x200
push 0x15
push 2
push 0x77cb505c
call edi
cmp eax, ebx
jl 0x77cb494d
mov eax, dword [esi + 0x44]
mov dword [eax + 0x24], 1
mov eax, dword [esi + 0x44]
add eax, 0x20
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x205
push 0x15
push 2
push 0x77cb505c
call edi
cmp eax, ebx
jl 0x77cb494d
mov eax, dword [esi + 0x44]
mov dword [eax + 0x2c], 1
mov eax, dword [esi + 0x44]
add eax, 0x28
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x206
push 0x15
push 2
push 0x77cb505c
call edi
cmp eax, ebx
jl 0x77cb494d
mov eax, dword [esi + 0x44]
mov dword [eax + 0x34], 1
mov eax, dword [esi + 0x44]
add eax, 0x30
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x207
push 0x15
push 2
push 0x77cb505c
call edi
cmp eax, ebx
jl 0x77cb494d
mov eax, dword [esi + 0x44]
mov dword [eax + 0x3c], 1
mov eax, dword [esi + 0x44]
add eax, 0x38
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x208
push 0x15
push 2
push 0x77cb505c
call edi
cmp eax, ebx
jge 0x77cb4782
jmp 0x77cb494d
push 7
pop eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x20], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0x38
push ebx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
cmp eax, ebx
mov dword [esi + 0x28], eax
je 0x77ce0b3f
push 0x38
push ebx
push eax
call sub.ntdll.dll_memset
mov eax, dword [esi + 0x28]
or dword [eax + 4], 0xffffffff
add esp, 0xc
push dword [esi + 0x28]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
push 0x77cb505c
call edi
cmp eax, ebx
jl 0x77cb494d
mov eax, dword [esi + 0x28]
or dword [eax + 0xc], 0xffffffff
mov eax, dword [esi + 0x28]
add eax, 8
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x223
push 0x20
push 2
push 0x77cb505c
call edi
cmp eax, ebx
jl 0x77cb494d
mov eax, dword [esi + 0x28]
mov dword [eax + 0x14], 1
mov eax, dword [esi + 0x28]
add eax, 0x10
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x200
push 0x15
push 2
push 0x77cb505c
call edi
cmp eax, ebx
jl 0x77cb494d
mov eax, dword [esi + 0x28]
mov dword [eax + 0x1c], 1
mov eax, dword [esi + 0x28]
add eax, 0x18
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x205
push 0x15
push 2
push 0x77cb505c
call edi
cmp eax, ebx
jl 0x77cb494d
mov eax, dword [esi + 0x28]
mov dword [eax + 0x24], 1
mov eax, dword [esi + 0x28]
add eax, 0x20
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x206
push 0x15
push 2
push 0x77cb505c
call edi
cmp eax, ebx
jl 0x77cb494d
mov eax, dword [esi + 0x28]
mov dword [eax + 0x2c], 1
mov eax, dword [esi + 0x28]
add eax, 0x28
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x207
push 0x15
push 2
push 0x77cb505c
call edi
cmp eax, ebx
jl 0x77cb494d
mov eax, dword [esi + 0x28]
mov dword [eax + 0x34], 1
mov eax, dword [esi + 0x28]
add eax, 0x30
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x208
push 0x15
push 2
push 0x77cb505c
call edi
cmp eax, ebx
jl 0x77cb494d
mov dword [esi + 0x1c], ebx
jmp 0x77cb494b
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, ebx
je 0x77ce0b21
mov eax, dword [esi]
mov ecx, 0x40000
cmp eax, ecx
push edi
mov edi, 0x10000
mov edx, 0x1000
je 0x77cb4954
cmp eax, 0x20000
je 0x77cb4954
cmp eax, edi
je 0x77cb4954
cmp eax, edx
je 0x77cb4954
cmp eax, ebx
jne 0x77ce0b2b
mov dword [esi + 8], 0xc351
mov dword [esi + 0xc], 1
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 4
cmp eax, ebx
je 0x77cb493d
cmp eax, edx
je 0x77cb4e2b
cmp eax, edi
je 0x77cb4560
cmp eax, 0x20000
je 0x77cb499b
cmp eax, ecx
jne 0x77ce0b35
mov dword [esi + 8], 0xc359
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x2c], ebx
jmp 0x77cb494b
mov edi, dword [sym.imp.ntdll.dll_RtlAllocateAndInitializeSid]
lea eax, [esi + 0x14]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0xa
push 1
push 0x77cb505c
mov dword [esi + 8], 0xc357
mov dword [esi + 0xc], ebx
call edi
cmp eax, ebx
jl 0x77cb494d
mov dword [esi + 0x18], ebx
mov dword [esi + 0x10], 1
mov dword [esi + 0x34], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x4c], ebx
jmp 0x77cb4782
lea eax, [esi + 0x14]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0xa
xor edi, edi
inc edi
push edi
push 0x77cb505c
mov dword [esi + 8], 0xc353
mov dword [esi + 0xc], ebx
call dword [sym.imp.ntdll.dll_RtlAllocateAndInitializeSid]
cmp eax, ebx
jl 0x77cb494d
push 5
pop eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x48], eax
mov eax, dword fs:[0x18]
push 0x28
mov dword [esi + 0x18], 0x3000000
mov dword [esi + 0x10], edi
mov dword [esi + 0x34], ebx
mov dword [esi + 0x2c], ebx
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
cmp edi, ebx
mov dword [esi + 0x50], edi
je 0x77ce0b3f
push 0xa
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
push dword [esi + 0x50]
mov edi, dword [sym.imp.ntdll.dll_RtlAllocateAndInitializeSid]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0xc
push 1
push 0x77cb505c
call edi
cmp eax, ebx
jl 0x77cb494d
mov eax, dword [esi + 0x50]
add eax, 8
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 1
push 0x77cb5054
call edi
cmp eax, ebx
jl 0x77cb494d
mov eax, dword [esi + 0x50]
add eax, 0x10
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 4
push 1
push 0x77cb505c
call edi
cmp eax, ebx
jl 0x77cb494d
mov eax, dword [esi + 0x50]
add eax, 0x18
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0xb
push 1
push 0x77cb505c
call edi
cmp eax, ebx
jl 0x77cb494d
mov eax, dword [esi + 0x50]
add eax, 0x20
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x221
push 0x20
push 2
push 0x77cb505c
call edi
cmp eax, ebx
jl 0x77cb494d
push 5
pop eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x20], eax
mov eax, dword fs:[0x18]
push 0x28
mov dword [esi + 0x40], ebx
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
cmp edi, ebx
mov dword [esi + 0x28], edi
je 0x77ce0b3f
push 0xa
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
mov eax, dword [esi + 0x28]
or dword [eax + 4], 0xffffffff
push dword [esi + 0x28]
mov edi, dword [sym.imp.ntdll.dll_RtlAllocateAndInitializeSid]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 1
push 0x77cb5054
call edi
cmp eax, ebx
jl 0x77cb494d
mov eax, dword [esi + 0x28]
or dword [eax + 0xc], 0xffffffff
mov eax, dword [esi + 0x28]
add eax, 8
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 4
push 1
push 0x77cb505c
call edi
cmp eax, ebx
jl 0x77cb494d
mov eax, dword [esi + 0x28]
or dword [eax + 0x14], 0xffffffff
mov eax, dword [esi + 0x28]
add eax, 0x10
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0xa
push 1
push 0x77cb505c
call edi
cmp eax, ebx
jl 0x77cb494d
mov eax, dword [esi + 0x28]
or dword [eax + 0x1c], 0xffffffff
mov eax, dword [esi + 0x28]
add eax, 0x18
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0xb
push 1
push 0x77cb505c
call edi
cmp eax, ebx
jl 0x77cb494d
mov eax, dword [esi + 0x28]
or dword [eax + 0x24], 0xffffffff
mov eax, dword [esi + 0x28]
add eax, 0x20
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x221
push 0x20
push 2
push 0x77cb505c
call edi
cmp eax, ebx
jl 0x77cb494d
mov dword [esi + 0x1c], 1
jmp 0x77cb494b
mov eax, 0xc000000d
jmp 0x77cb494e
mov eax, 0xc0000002
jmp 0x77cb494d
mov eax, 0xc0000001
jmp 0x77cb494d
mov eax, 0xc0000017
jmp 0x77cb494d