Function at 0x403520
Capabilities:
Get process heap flags

Disassembly:
push edi
lea edi, [esp + 8]
and esp, 0xfffffff8
push dword [edi - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x308
mov ebx, dword [eax + 0x2a8]
mov dword [ebp - 0x2ec], eax
test ebx, ebx
je 0x403a61
mov esi, dword [eax + 0x14]
lea ecx, [ebp - 0x2d4]
mov eax, dword [ebx]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], 0xce0
mov dword [esp + 4], edx
mov dword [esp], ebx
call dword [eax + 0x10]
mov dword [ebp - 0x2e8], 0
sub esp, 0x10
test eax, eax
js 0x403a4b
lea eax, [esi + 1]
mov dword [ebp - 0x2e4], ebx
xor esi, esi
mov dword [ebp - 0x2f0], eax
lea esi, [esi]
lea edi, [ebp - 0x298]
xor eax, eax
mov ecx, 0x20
mov dword [ebp - 0x2cc], 0
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x2d4]
lea edi, [ebp - 0x2cc]
mov edx, dword [eax]
mov dword [esp + 0xc], edi
lea edi, [ebp - 0x298]
mov dword [esp + 8], edi
mov dword [esp + 4], 0x20
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0x10
test eax, eax
js 0x403a30
cmp eax, 1
je 0x403a30
mov ecx, dword [ebp - 0x2cc]
test ecx, ecx
je 0x403598
mov dword [ebp - 0x2dc], edi
mov dword [ebp - 0x2e0], 0
jmp 0x4037d0
mov ebx, dword [ebp - 0x2e4]
lea ecx, [ebp - 0x2d8]
mov edx, dword [ebx]
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], 0x4125f8
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [edx + 0x14]
mov edx, eax
sub esp, 0x14
xor eax, eax
test edx, edx
js 0x40364d
mov eax, dword [ebp - 0x2d8]
cmp word [esi + 0x44], 0
mov dword [esi + 0x2a8], eax
je 0x403ac0
test byte [esi + 0x18], 0x10
je 0x403671
test byte [ebp - 0x2cd], 0x40
jne 0x403775
mov eax, dword [ebp - 0x2dc]
mov edi, dword [eax]
mov ebx, dword [ebp - 0x2e4]
mov dword [ebp - 0x2c8], edi
lea edx, [ebp - 0x2c4]
mov eax, dword [ebx]
mov dword [esp + 0x18], edx
lea edx, [ebp - 0x2c8]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0x412488
mov dword [esp + 0xc], edx
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], ebx
call dword [eax + 0x28]
sub esp, 0x1c
test eax, eax
js 0x403aa8
mov eax, dword [ebp - 0x2c4]
lea ecx, [ebp - 0x2c0]
lea ebx, [ebp - 0x218]
mov edx, dword [eax]
mov dword [esp + 0x14], ecx
lea ecx, [ebp - 0x2b8]
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], 0x104
mov dword [esp + 8], ebx
mov dword [esp + 4], 2
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0x18
test eax, eax
js 0x403aa8
test byte [ebp - 0x2c0], 8
jne 0x403b10
mov eax, dword [ebp - 0x2b8]
cmp eax, 0xffffffff
jne 0x403737
mov dword [ebp - 0x2b8], 0
xor eax, eax
lea edx, [ebp - 0x2bc]
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.shell32.dll_ExtractIconExW]
sub esp, 0x14
mov eax, dword [ebp - 0x2bc]
mov dword [esi + 0x2ac], eax
test eax, eax
je 0x403aa8
mov eax, dword [ebp - 0x2ec]
mov dword [esi + 4], 0
add dword [ebp - 0x2e0], 1
mov dword [esi + 0xc], 0
add dword [ebp - 0x2dc], 4
mov dword [esi + 0x10], 0
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x2f0]
mov dword [esi + 0x2a0], 1
mov dword [esi + 0x29c], 0
mov dword [esi + 0x14], eax
mov eax, dword [ebp - 0x2e0]
cmp eax, dword [ebp - 0x2cc]
jae 0x403598
mov dword [esp + 8], 0x2b0
mov ebx, esi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [eax + 0x2a4], 0
mov esi, eax
sub esp, 0xc
mov dword [eax + 0x2a8], 0
mov dword [eax + 0x2ac], 0
mov eax, dword [ebp - 0x2e8]
test eax, eax
cmove eax, esi
mov dword [ebp - 0x2e8], eax
test ebx, ebx
je 0x403831
mov dword [ebx], esi
lea ebx, [esi + 0x18]
xor eax, eax
mov ecx, 0x94
mov dword [ebp - 0x2d0], 0xbfffffff
lea edx, [ebp - 0x2d0]
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 0x2e4]
mov dword [esi + 0x29c], 0
mov eax, dword [ecx]
mov dword [esp + 0xc], edx
mov edi, dword [ebp - 0x2dc]
mov dword [esp + 4], 1
mov dword [esp], ecx
mov dword [esp + 8], edi
call dword [eax + 0x24]
sub esp, 0x10
test eax, eax
js 0x403a70
mov eax, dword [ebp - 0x2dc]
mov edi, dword [ebp - 0x2d0]
mov eax, dword [eax]
cmp edi, 0xbfffffff
je 0x403a90
mov dword [ebp - 0x2c0], eax
test edi, 0x40000000
jne 0x403b88
mov eax, dword [0x416878]
lea edx, [ebp - 0x2bc]
mov dword [ebp - 0x2b8], 0
mov dword [ebp - 0x2b4], 0
mov ecx, dword [ebp - 0x2e4]
mov dword [ebp - 0x2b0], 0
mov dword [ebp - 0x2a8], 0
mov word [ebp - 0x2ac], ax
mov dword [ebp - 0x2a4], 1
mov dword [ebp - 0x2a0], 0xffffffff
mov dword [ebp - 0x29c], 1
mov eax, dword [ecx]
mov dword [esp + 0x18], edx
lea edx, [ebp - 0x2c0]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0x4139b8
mov dword [esp + 0xc], edx
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], ecx
call dword [eax + 0x28]
sub esp, 0x1c
test eax, eax
js 0x40398f
mov eax, dword [ebp - 0x2bc]
lea ecx, [ebp - 0x2b8]
mov edx, dword [eax]
mov dword [esp + 8], ecx
lea ecx, [ebp - 0x2ac]
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [edx + 0xc]
mov ebx, eax
mov eax, dword [ebp - 0x2bc]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
sub esp, 4
test ebx, ebx
jns 0x403bc0
mov edx, dword [esi + 0x18]
test edi, 0xa0000000
je 0x4039a0
or edx, 0x10
mov dword [esi + 0x18], edx
test edi, 0x40000
je 0x4039ae
or edx, 1
mov dword [esi + 0x18], edx
and edi, 0x4000000
je 0x4039bc
or dh, 8
mov dword [esi + 0x18], edx
mov dword [esi + 0x29c], 1
mov eax, dword [ebp - 0x2dc]
mov eax, dword [eax]
and edx, 0x10
mov edi, eax
mov dword [esi + 0x2a4], eax
jne 0x403610
mov dword [esi + 0x2a8], 0
cmp word [esi + 0x44], 0
jne 0x403679
mov edx, dword [ebp - 0x2e4]
lea ebx, [ebp - 0x218]
mov eax, dword [edx]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x2000
mov dword [esp + 4], edi
mov dword [esp], edx
call dword [eax + 0x2c]
sub esp, 0x10
test eax, eax
jns 0x403ad0
xor eax, eax
mov word [esi + 0x44], ax
jmp 0x40365e
mov eax, dword [ebp - 0x2d4]
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
sub esp, 4
test esi, esi
je 0x403a4b
mov dword [esi], 0
mov eax, dword [ebp - 0x2ec]
mov edi, dword [ebp - 0x2e8]
mov dword [eax + 0x10], 1
mov dword [eax + 4], edi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
lea esp, [edi - 8]
pop edi
ret
mov dword [ebp - 0x2d0], 0
mov eax, dword [ebp - 0x2dc]
mov edx, dword [esi + 0x18]
mov eax, dword [eax]
jmp 0x4039ce
mov dword [ebp - 0x2d0], 0
mov edx, dword [esi + 0x18]
jmp 0x4039ce
mov dword [esi + 0x2ac], 0xffffffff
jmp 0x403775
mov eax, dword [ebp - 0x2dc]
mov edi, dword [eax]
jmp 0x4039f4
lea ecx, [esi + 0x44]
mov edx, edi
mov eax, ebx
call fcn.00402a20
mov edx, dword [ebp - 0x218]
test edx, edx
jne 0x40365e
mov eax, dword [0x416874]
mov ecx, dword [ebp - 0x214]
mov edx, dword [eax]
mov dword [esp], eax
mov dword [esp + 4], ecx
call dword [edx + 0x14]
sub esp, 8
jmp 0x40365e
mov dword [ebp - 0x2ac], 0
mov dword [esp], 0x31
call dword [sym.imp.user32.dll_GetSystemMetrics]
mov edx, dword [ebp - 0x2c4]
sub esp, 4
shl eax, 0x10
mov ecx, dword [edx]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x2bc]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x2ac]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x2b8]
mov dword [esp + 4], ebx
mov dword [esp], edx
mov dword [esp + 8], eax
call dword [ecx + 0x10]
sub esp, 0x18
test eax, eax
js 0x403761
mov eax, dword [ebp - 0x2ac]
mov dword [esp], eax
call dword [sym.imp.user32.dll_DestroyIcon]
sub esp, 4
jmp 0x403761
mov dword [esp + 0x10], 0x250
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 1
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x2e4]
mov dword [esp], eax
call dword [sym.imp.shell32.dll_SHGetDataFromIDListW]
sub esp, 0x14
test eax, eax
jns 0x40398f
jmp 0x4038b4
mov eax, dword [ebp - 0x2b4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GlobalLock]
mov ebx, dword [sym.imp.kernel32.dll_SetErrorMode]
sub esp, 4
mov dword [ebp - 0x2f4], eax
mov dword [esp], 1
call ebx
mov dword [ebp - 0x2f8], eax
lea eax, [ebp - 0x218]
sub esp, 4
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x2f4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetFileAttributesExW]
sub esp, 0xc
test eax, eax
je 0x403c68
mov edx, dword [ebp - 0x214]
mov ecx, dword [ebp - 0x210]
mov eax, dword [ebp - 0x218]
mov dword [esi + 0x1c], edx
mov edx, dword [ebp - 0x20c]
mov dword [esi + 0x20], ecx
mov ecx, dword [ebp - 0x208]
mov dword [esi + 0x18], eax
mov dword [esi + 0x24], edx
mov edx, dword [ebp - 0x204]
mov dword [esi + 0x28], ecx
mov ecx, dword [ebp - 0x200]
mov dword [esi + 0x2c], edx
mov dword [esi + 0x30], ecx
test al, 0x10
jne 0x403c68
movq xmm0, qword [ebp - 0x1fc]
movq qword [esi + 0x34], xmm0
mov eax, dword [ebp - 0x2f8]
mov dword [esp], eax
call ebx
mov eax, dword [ebp - 0x2b4]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GlobalUnlock]
mov eax, dword [ebp - 0x2b4]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GlobalFree]
sub esp, 4
jmp 0x40398f