Function at 0x406730
Capabilities:
Get process heap flags

Disassembly:
mov al, 0
add byte [eax], al
mov edx, dword [edx + 0x10]
lea ecx, [edx + ecx + 1]
mov dword [ebx + 0x77c], ecx
mov eax, dword [eax + 0xc]
inc eax
push 0x7f
mov dword [ebx + 0x780], eax
call fcn.00405fb4
pop ecx
push 0x30
mov dword [ebx + 0x78], eax
call fcn.0045e235
cmp eax, edi
pop ecx
je 0x40676b
mov esi, eax
call fcn.004053c7
jmp 0x40676d
xor eax, eax
push dword [ebx + 0x78]
lea esi, [ebx + 0xbc]
push eax
mov dword [esi], eax
call fcn.004056db
mov esi, dword [esi]
cmp dword [esi + 0x18], 0x20
jne 0x40678b
call fcn.00407179
push 0x75
call fcn.00405fb4
pop ecx
push 0x30
mov dword [ebp - 0x29e8], eax
mov dword [ebx + 0x34], eax
call fcn.0045e235
cmp eax, edi
pop ecx
je 0x4067b1
mov esi, eax
call fcn.004053c7
jmp 0x4067b3
xor eax, eax
push dword [ebp - 0x29e8]
mov edi, dword [ebp - 0x29fc]
push eax
mov dword [edi + 0x2c], eax
call fcn.004056db
test eax, eax
je 0x4067dd
mov ecx, dword [edi + 0x2c]
test ecx, ecx
je 0x4067d9
mov eax, dword [ecx]
push 1
call dword [eax]
and dword [edi + 0x2c], 0
mov esi, dword [edi + 0x2c]
call fcn.00459d2a
mov eax, dword [edi + 0x2c]
mov ecx, dword [eax + 0xc]
mov dword [edi + 0x24], ecx
mov eax, dword [eax + 0x10]
mov dword [edi + 0x28], eax
and dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0x10e
mov eax, dword [ebx + 0x780]
push 0x78
mov dword [ebx + 0x514], eax
mov byte [ebx + 0x50c], 0
call fcn.00405fb4
mov esi, dword [ebp - 0x2a10]
pop ecx
push 4
mov dword [ebx + 0x38], eax
push eax
mov eax, esi
call fcn.00459483
mov eax, dword [ebx + 0x780]
push 0xa
pop edi
sub eax, 0x1f
push 0x79
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], edi
call fcn.00405fb4
mov esi, dword [ebp - 0x2a18]
pop ecx
push 4
mov dword [ebx + 0x3c], eax
push eax
mov eax, esi
call fcn.00459483
mov eax, dword [ebx + 0x780]
sub eax, 0x3e
push 0x94
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], edi
call fcn.00405fb4
pop ecx
push 0x93
mov dword [ebx + 0x1c], eax
call fcn.00405fb4
pop ecx
push 0x95
mov dword [ebx + 0x20], eax
call fcn.00405fb4
pop ecx
push 0x96
mov dword [ebx + 0x24], eax
call fcn.00405fb4
pop ecx
push 0x97
mov dword [ebx + 0x28], eax
call fcn.00405fb4
cmp byte [ebx + 0x77a], 0
pop ecx
mov dword [ebx + 0x2c], eax
je 0x4068bd
mov eax, dword [ebx + 0x28]
jmp 0x4068c0
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp - 0x2a20]
push 4
mov dword [ebx + 0x30], eax
push eax
mov eax, esi
call fcn.00459483
push 0x9a
mov dword [esi + 0x2c], 0x17f
mov dword [esi + 0x30], 0xc1
call fcn.00405fb4
pop ecx
push 0x98
mov dword [ebx + 0x40], eax
call fcn.00405fb4
pop ecx
push 0x99
mov dword [ebx + 0x44], eax
call fcn.00405fb4
pop ecx
push 0x80
mov dword [ebx + 0x48], eax
call fcn.00405fb4
mov esi, dword [ebp - 0x2a28]
pop ecx
push 4
mov dword [ebx + 0x74], eax
push eax
mov eax, esi
call fcn.00459483
push 0x7e
mov dword [esi + 0x2c], 0x16c
mov dword [esi + 0x30], 0x11b
call fcn.00405fb4
pop ecx
push 0x7d
mov dword [ebx + 0x50], eax
call fcn.00405fb4
pop ecx
push 0x7b
mov dword [ebx + 0x54], eax
call fcn.00405fb4
mov edi, dword [ebp - 0x2a30]
pop ecx
push eax
mov dword [ebx + 0x4c], eax
call fcn.004597df
mov eax, dword [edi + 0x68]
mov ecx, 0x158
mov dword [edi + 0x64], ecx
add eax, 0x26
mov dword [edi + 0x60], 0x1c
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], ecx
mov eax, 0x4885a8
lea ecx, [ebp - 0x30]
call fcn.00404680
lea eax, [ebx + 0x2b0]
push eax
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 0x15
call fcn.004599f2
push 0
push 1
lea esi, [ebp - 0x30]
mov byte [ebp - 4], 0x14
call fcn.00404a28
mov eax, edi
call fcn.00459841
mov dword [ebx + 0x2d0], 0x464646
mov byte [edi + 0x3c], 0
mov byte [edi + 0x5c], 0
push dword [ebx + 0x4c]
mov edi, dword [ebp - 0x2a38]
call fcn.004597df
mov eax, dword [edi + 0x68]
mov ecx, 0x13e
add eax, 0x26
mov dword [edi + 0x60], 0x1c
mov dword [edi + 0x64], ecx
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], ecx
mov eax, 0x4885bc
lea ecx, [ebp - 0x30]
call fcn.00404680
lea eax, [ebx + 0x320]
push eax
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 0x16
call fcn.004599f2
push 0
push 1
lea esi, [ebp - 0x30]
mov byte [ebp - 4], 0x14
call fcn.00404a28
mov eax, edi
call fcn.00459841
push dword [ebx + 0x4c]
mov edi, dword [ebp - 0x29f4]
mov dword [ebx + 0x340], 0x464646
call fcn.004597df
mov eax, dword [edi + 0x68]
mov ecx, 0x158
mov dword [edi + 0x64], ecx
add eax, 0x10b
mov dword [edi + 0x60], 0x101
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], ecx
mov eax, 0x4885cc
lea ecx, [ebp - 0x30]
call fcn.00404680
lea eax, [ebx + 0x390]
push eax
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 0x17
call fcn.004599f2
push 0
push 1
lea esi, [ebp - 0x30]
mov byte [ebp - 4], 0x14
call fcn.00404a28
mov eax, edi
call fcn.00459841
mov dword [ebx + 0x3b0], 0x464646
add dh, al
inc edi
cmp al, 0