Function at 0x64187b40
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x48
mov eax, dword [ecx + 4]
mov edi, dword [ecx]
mov ebx, dword [ecx + 8]
mov esi, dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov dword [ebp - 0x1c], eax
mov eax, dword [ecx + 0xc]
mov dword [ebp - 0x34], eax
mov eax, dword [ecx + 0x10]
mov dword [esp + 0x14], 0
mov dword [ebp - 0x24], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], 0
call esi
mov dword [ebp - 0x28], 0
sub esp, 0x18
test eax, eax
jne 0x64187df0
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
call esi
mov dword [ebp - 0x2c], 0
sub esp, 0x18
mov edi, eax
test eax, eax
jne 0x64187db0
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x64187c0a
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_GdiConvertToDevmodeW]
mov dword [ebp - 0x24], eax
sub esp, 4
mov eax, dword [ebp - 0x34]
movzx esi, bx
test eax, eax
je 0x64187c29
mov eax, ebx
and eax, 0xfffffffd
cmp ax, 0xc
je 0x64187ca8
cmp bx, 0x10
je 0x64187ca8
mov eax, dword [ebp - 0x24]
mov dword [esp + 8], esi
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call sym.winspool.drv_DeviceCapabilitiesW
mov ebx, dword [sym.imp.ucrtbase.dll_free]
mov dword [ebp - 0x20], eax
sub esp, 0x14
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call ebx
mov edx, dword [ebp - 0x24]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [ebp - 0x2c]
sub esp, 0xc
mov dword [esp], eax
call ebx
mov eax, dword [ebp - 0x20]
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x14
mov eax, dword [ebp - 0x24]
mov dword [esp + 0xc], 0
mov dword [esp + 8], esi
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call sym.winspool.drv_DeviceCapabilitiesW
sub esp, 0x14
cmp eax, 0xffffffff
je 0x64187e50
lea edx, [ebx - 0xe]
test dx, 0xfffd
je 0x64187e38
mov dword [ebp - 0x1c], 0
xor edx, edx
cmp bx, 0xc
jne 0x64187d03
mov dword [ebp - 0x1c], 0x18
lea edx, [eax + eax*2]
shl edx, 4
mov dword [esp], edx
call dword [sym.imp.ucrtbase.dll_malloc]
mov edx, dword [ebp - 0x24]
mov dword [esp + 8], esi
mov dword [ebp - 0x38], eax
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x10], edx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call sym.winspool.drv_DeviceCapabilitiesW
mov dword [ebp - 0x20], eax
sub esp, 0x14
test eax, eax
je 0x64187d9b
mov eax, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x38]
xor ebx, ebx
mov esi, dword [ebp - 0x34]
add eax, eax
mov dword [ebp - 0x30], eax
lea esi, [esi]
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0x10], esi
inc ebx
mov dword [esp + 8], edi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
add edi, dword [ebp - 0x30]
add esi, dword [ebp - 0x1c]
sub esp, 0x20
cmp dword [ebp - 0x20], ebx
jne 0x64187d50
mov eax, dword [ebp - 0x38]
mov ebx, dword [sym.imp.ucrtbase.dll_free]
mov dword [esp], eax
call ebx
jmp 0x64187c59
add eax, eax
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov dword [esp + 0x14], edi
mov dword [ebp - 0x2c], eax
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
call esi
sub esp, 0x18
jmp 0x64187bf4
mov edx, eax
add eax, eax
mov dword [ebp - 0x20], edx
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov edx, dword [ebp - 0x20]
mov dword [esp + 0xc], 0xffffffff
mov dword [ebp - 0x28], eax
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], 0
call esi
sub esp, 0x18
jmp 0x64187bb0
shl eax, 7
mov dword [ebp - 0x1c], 0x40
mov edx, eax
jmp 0x64187d03
mov dword [ebp - 0x20], 0xffffffff
mov ebx, dword [sym.imp.ucrtbase.dll_free]
jmp 0x64187c59