Function at 0x64a8ff50
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea edx, [ebp - 0x20]
push ebx
sub esp, 0x6c
mov esi, dword [ebp + 0xc]
mov eax, dword [esi]
mov dword [esp + 4], edx
mov dword [esp], esi
call dword [eax + 0x30]
mov eax, dword [ebp - 0x20]
sub esp, 8
cmp eax, 1
ja 0x64a903e0
lea eax, [ebp - 0x2c]
xor edi, edi
mov dword [ebp - 0x3c], eax
mov eax, dword [esi]
lea ecx, [ebp - 0x28]
mov dword [esp + 4], 0x64abd554
mov dword [esp + 8], ecx
mov dword [esp], esi
call dword [eax]
sub esp, 0xc
test eax, eax
je 0x64a90058
cmp dword [ebp - 0x20], 1
jbe 0x64a903a0
mov eax, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], eax
mov dword [esp + 8], 0x12
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebp - 0x48], eax
sub esp, 0xc
test eax, eax
je 0x64a90740
mov ecx, eax
mov eax, 3
mov word [ecx + 8], ax
lea eax, [ecx + 0x10]
mov dword [ecx + 0xc], eax
mov eax, 1
mov dword [ecx], 0x5101
mov dword [ecx + 4], 2
mov word [ecx + 0x10], ax
test edi, edi
je 0x64a90032
mov eax, dword [ebp + 8]
mov edx, edi
call sym._add_property
mov eax, dword [ebp - 0x50]
test eax, eax
je 0x64a90043
mov edx, eax
mov eax, dword [ebp + 8]
call sym._add_property
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp + 8]
call sym._add_property
jmp 0x64a900df
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x1c]
mov edx, dword [eax]
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [edx + 0x10]
sub esp, 8
test eax, eax
je 0x64a902b0
mov eax, dword [ebp - 0x28]
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
sub esp, 4
cmp dword [ebp - 0x20], 1
ja 0x64a8ffad
test edi, edi
je 0x64a904d0
mov eax, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 8]
mov edx, edi
call sym._add_property
mov eax, dword [ebp - 0x50]
test eax, eax
je 0x64a900d4
mov edx, eax
mov eax, dword [ebp + 8]
call sym._add_property
mov eax, dword [ebp - 0x48]
test eax, eax
jne 0x64a90043
mov eax, dword [ebp - 0x44]
test eax, eax
je 0x64a900f0
mov edx, eax
mov eax, dword [ebp + 8]
call sym._add_property
mov eax, dword [ebp - 0x40]
test eax, eax
je 0x64a90101
mov edx, eax
mov eax, dword [ebp + 8]
call sym._add_property
mov ebx, dword fs:[0x18]
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword [ebx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov edi, dword [ebp - 0x4c]
call edi
mov eax, dword [ebp - 0x50]
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call edi
mov eax, dword [ebp - 0x48]
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call edi
mov eax, dword [ebp - 0x44]
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call edi
mov eax, dword [ebp - 0x40]
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call edi
mov eax, dword [esi]
mov ecx, dword [ebp - 0x3c]
sub esp, 0xc
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
mov dword [esp], esi
call dword [eax + 0x34]
sub esp, 0xc
test eax, eax
jne 0x64a9020a
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x28]
mov edx, dword [eax]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0x64abd554
mov dword [esp], eax
call dword [edx]
sub esp, 0xc
test eax, eax
je 0x64a90218
xor edi, edi
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x4c]
call eax
mov eax, dword [ebp - 0x2c]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x1c]
mov edx, dword [eax]
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [edx + 0x10]
sub esp, 8
test eax, eax
mov eax, dword [ebp - 0x28]
mov edx, dword [eax]
jne 0x64a904b8
mov esi, dword [ebp - 0x1c]
xor edi, edi
xor ebx, ebx
lea ecx, [ebp - 0x24]
test esi, esi
je 0x64a904b8
mov esi, ecx
nop
mov edx, dword [eax]
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [edx + 0x14]
sub esp, 0xc
test eax, eax
jne 0x64a9027d
test edi, edi
je 0x64a90578
mov eax, dword [ebp - 0x24]
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
sub esp, 4
mov eax, dword [ebp - 0x28]
add ebx, 1
cmp ebx, dword [ebp - 0x1c]
jb 0x64a90250
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
sub esp, 4
test edi, edi
je 0x64a901d9
mov eax, dword [ebp + 8]
mov edx, edi
call sym._add_property
jmp 0x64a901d9
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x64a90075
mov ecx, dword [sym.imp.kernel32.dll_HeapFree]
xor edx, edx
lea eax, [ebp - 0x24]
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x44], 0
xor ebx, ebx
mov edi, eax
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x4c], ecx
mov dword [ebp + 0xc], esi
mov esi, edx
lea esi, [esi]
mov eax, dword [ebp - 0x28]
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [edx + 0x14]
sub esp, 0xc
test eax, eax
jne 0x64a90347
test esi, esi
je 0x64a90540
cmp dword [ebp - 0x20], 1
jbe 0x64a90323
mov eax, dword [ebp - 0x48]
test eax, eax
je 0x64a905c0
mov edx, dword [ebp - 0x40]
test edx, edx
je 0x64a90518
mov eax, dword [ebp - 0x44]
test eax, eax
je 0x64a90500
mov eax, dword [ebp - 0x24]
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
sub esp, 4
add ebx, 1
cmp ebx, dword [ebp - 0x1c]
jb 0x64a902f0
mov eax, dword [ebp - 0x28]
mov edi, dword [ebp - 0x50]
mov dword [ebp - 0x50], esi
mov esi, dword [ebp + 0xc]
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
sub esp, 4
cmp dword [ebp - 0x20], 1
jbe 0x64a90567
mov eax, dword [ebp - 0x48]
test eax, eax
je 0x64a8ffca
test edi, edi
jne 0x64a90028
mov edx, dword [ebp - 0x50]
test edx, edx
je 0x64a90043
mov eax, dword [ebp + 8]
call sym._add_property
jmp 0x64a90043
test edi, edi
je 0x64a904d0
mov eax, dword [ebp + 8]
mov edx, edi
call sym._add_property
mov eax, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x4c], eax
jmp 0x64a90101
lea eax, [eax*4 + 0x10]
mov dword [esp + 4], 8
mov dword [esp + 8], eax
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov edi, eax
test eax, eax
je 0x64a8ff7a
mov eax, 4
mov dword [edi], 0x5100
mov word [edi + 8], ax
mov eax, dword [ebp - 0x20]
lea edx, [eax*4]
mov dword [edi + 4], edx
lea edx, [edi + 0x10]
mov dword [edi + 0xc], edx
test eax, eax
je 0x64a90770
lea eax, [ebp - 0x2c]
xor ebx, ebx
mov dword [ebp - 0x3c], eax
lea esi, [esi]
nop
mov eax, dword [esi]
mov ecx, dword [ebp - 0x3c]
mov dword [esp + 4], ebx
mov dword [esp], esi
mov dword [esp + 8], ecx
call dword [eax + 0x34]
sub esp, 0xc
test eax, eax
je 0x64a90480
mov dword [edi + ebx*4 + 0x10], 0
add ebx, 1
cmp ebx, dword [ebp - 0x20]
jb 0x64a90450
jmp 0x64a8ff82
mov eax, dword [ebp - 0x2c]
mov ecx, str.Delay
mov edx, 0x64abdca4
call sym._get_gif_frame_property
mov dword [edi + ebx*4 + 0x10], eax
mov eax, dword [ebp - 0x2c]
add ebx, 1
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
sub esp, 4
cmp ebx, dword [ebp - 0x20]
jb 0x64a90450
jmp 0x64a8ff82
mov dword [esp], eax
call dword [edx + 8]
sub esp, 4
jmp 0x64a901d7
mov eax, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], eax
jmp 0x64a90101
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp + 0xc]
call sym._get_gif_palette
mov dword [ebp - 0x44], eax
jmp 0x64a90339
mov eax, dword [ebp - 0x24]
mov ecx, str.BackgroundColorIndex
mov edx, 0x64abdcb4
call sym._get_property
mov dword [ebp - 0x40], eax
test eax, eax
je 0x64a9032e
mov dword [eax], 0x5103
jmp 0x64a9032e
mov eax, dword [ebp - 0x24]
mov ecx, str.TextEntry
mov edx, 0x64abdc84
call sym._get_property
mov esi, eax
test eax, eax
je 0x64a90312
mov dword [eax], 0x9286
jmp 0x64a90312
test edi, edi
je 0x64a900c3
jmp 0x64a900b9
mov eax, dword [ebp - 0x24]
mov ecx, str.TransparencyFlag
mov edx, 0x64abdca4
mov dword [ebp - 0x3c], eax
call sym._get_bool_property
test eax, eax
je 0x64a9026f
mov eax, dword [ebp - 0x3c]
mov ecx, str.TransparentColorIndex
mov edx, 0x64abdca4
call sym._get_property
mov edi, eax
test eax, eax
je 0x64a9026f
mov dword [eax], 0x5104
jmp 0x64a9026f
mov eax, dword [ebp - 0x24]
mov ecx, str.Application
mov edx, 0x64abdc94
mov dword [ebp - 0x48], eax
call sym._get_property
mov dword [ebp - 0x54], eax
test eax, eax
je 0x64a906e0
cmp word [eax + 8], 1
jne 0x64a906e0
cmp dword [eax + 4], 0xb
jne 0x64a906e0
mov eax, dword [eax + 0xc]
cmp dword [eax], 0x5354454e
je 0x64a90787
cmp dword [eax], 0x4d494e41
jne 0x64a906e0
cmp dword [eax + 4], 0x53545845
jne 0x64a906e0
cmp dword [eax + 7], 0x302e3153
jne 0x64a906e0
mov eax, dword [ebp - 0x48]
mov ecx, str.Data
mov edx, 0x64abdc94
call sym._get_property
mov ecx, eax
test eax, eax
je 0x64a906e0
cmp word [eax + 8], 1
mov dword [ebp - 0x48], 0
jne 0x64a906e9
cmp dword [eax + 4], 4
jne 0x64a906e9
mov edx, dword [eax + 0xc]
cmp byte [edx], 3
jne 0x64a906e9
cmp byte [edx + 1], 1
jne 0x64a906e9
mov dword [ebp - 0x5c], edx
mov dword [ebp - 0x58], eax
mov dword [esp + 8], 0x12
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov ecx, dword [ebp - 0x58]
sub esp, 0xc
test eax, eax
mov dword [ebp - 0x48], eax
mov edx, eax
je 0x64a906e9
mov eax, 3
mov dword [edx], 0x5101
mov word [edx + 8], ax
lea eax, [edx + 0x10]
mov dword [edx + 0xc], eax
mov dword [edx + 4], 2
mov edx, dword [ebp - 0x5c]
movzx eax, word [edx + 2]
mov edx, dword [ebp - 0x48]
mov word [edx + 0x10], ax
jmp 0x64a906e9
mov dword [ebp - 0x48], 0
xor ecx, ecx
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], ecx
mov edx, dword fs:[0x18]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x54], edx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x4c]
call eax
mov ecx, dword [ebp - 0x58]
sub esp, 0xc
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
mov edx, dword [ebp - 0x54]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x4c]
call eax
sub esp, 0xc
jmp 0x64a90323
test edi, edi
je 0x64a9077b
mov eax, dword [ebp + 8]
mov edx, edi
call sym._add_property
mov eax, dword [ebp - 0x50]
test eax, eax
je 0x64a900df
mov edx, eax
mov eax, dword [ebp + 8]
call sym._add_property
jmp 0x64a900df
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x3c], eax
jmp 0x64a8ff82
mov eax, dword [ebp - 0x50]
test eax, eax
jne 0x64a90759
jmp 0x64a900df
cmp dword [eax + 4], 0x45504143
jne 0x64a90604
cmp dword [eax + 7], 0x302e3245
jne 0x64a90604
jmp 0x64a9062a