Function at 0xa9891c
Capabilities:
Get process heap flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xafdd54
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0xc940a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [edi + 0x70]
mov dword [edi], 0x9e6298
test ecx, ecx
je 0xa9895b
push ecx
call fcn.00aad037
lea esi, [edi + 0x104]
mov bl, 1
cmp dword [esi + 0xb8], 0
mov dword [esi], 0x9e62e0
je 0xa989be
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
call fcn.00a90597
mov ecx, dword [esi + 0xb8]
test ecx, ecx
je 0xa9898c
cmp dword [ecx], 1
je 0xa989b2
xor bl, bl
test ecx, ecx
je 0xa989b2
or eax, 0xffffffff
lock xadd dword [ecx], eax
jne 0xa989ab
mov ecx, dword [esi + 0xb8]
test ecx, ecx
je 0xa989ab
push ecx
call fcn.00c19924
and dword [esi + 0xb8], 0
lea ecx, [ebp - 0x10]
call fcn.00a5714f
test bl, bl
je 0xa989d3
mov ecx, dword [esi + 0x18]
cmp dword [ecx], 1
jne 0xa989d3
call fcn.00b5e226
push ecx
mov ecx, esi
call fcn.00ab6df8
mov ecx, dword [esi + 0xb8]
test ecx, ecx
je 0xa98a00
or eax, 0xffffffff
lock xadd dword [ecx], eax
jne 0xa989f6
mov ecx, dword [esi + 0xb8]
test ecx, ecx
je 0xa989f6
push ecx
call fcn.00c19924
xor ebx, ebx
mov dword [esi + 0xb8], ebx
jmp 0xa98a02
xor ebx, ebx
lea ecx, [esi + 0xac]
call fcn.00a48c27
lea ecx, [esi + 0x44]
call fcn.00a7d7ad
cmp dword [esi + 0x1c], 1
jne 0xa98a32
mov dword [esi + 0x1c], 2
call fcn.00a7d820
lea edx, [esi + 0x24]
mov ecx, dword [eax + 4]
call fcn.00c18254
lea ecx, [esi + 4]
mov dword [esi + 0x1c], 3
cmp dword [ecx + 0xc], ebx
je 0xa98a46
call fcn.00a59db6
mov eax, dword [edi + 0x100]
test eax, eax
je 0xa98a59
push eax
mov dword [ebp - 0x34], eax
call fcn.00a8f70d
mov dword [ebp - 4], ebx
mov dword [edi + 0xe4], ebx
call fcn.00a96783
mov eax, dword [edi + 0xfc]
mov dword [edi + 0xfc], ebx
test eax, eax
je 0xa98a7e
push eax
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
mov eax, dword [edi + 0xdc]
mov dword [edi + 0xdc], ebx
test eax, eax
je 0xa98a95
push eax
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
or dword [ebp - 4], 0xffffffff
mov eax, dword [edi + 0xd8]
mov esi, dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test eax, eax
je 0xa98abf
cmp eax, 0xffffffff
je 0xa98abf
lea edx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], esi
call fcn.00a4a6f6
mov eax, dword [edi + 0xd4]
test eax, eax
je 0xa98adf
cmp eax, 0xffffffff
je 0xa98adf
lea edx, [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], esi
call fcn.00a4a6f6
lea ecx, [edi + 0xd0]
call fcn.00a98bef
mov ecx, dword [edi + 0xcc]
test ecx, ecx
je 0xa98b0a
mov dword [edi + 0xcc], ebx
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0xc99200]
call esi
mov eax, dword [edi + 0xc8]
mov esi, dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
test eax, eax
je 0xa98b2b
lea edx, [ebp - 0x24]
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x28], esi
call fcn.00a4a6f6
mov eax, dword [edi + 0xc4]
test eax, eax
je 0xa98b46
lea edx, [ebp - 0x2c]
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], esi
call fcn.00a4a6f6
lea ecx, [edi + 0xb4]
call fcn.00a4539d
lea ecx, [edi + 0x94]
call fcn.00a99062
mov ecx, dword [edi + 0x64]
test ecx, ecx
je 0xa98b76
mov dword [edi + 0x64], ebx
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0xc99200]
call esi
lea ecx, [edi + 0x5c]
mov ebx, 0x9d3fb4
mov dword [ecx], ebx
call fcn.00a95ad5
lea ecx, [edi + 0x54]
mov dword [edi + 0x54], ebx
call fcn.00a95ad5
lea ecx, [edi + 0x50]
call fcn.00a98bef
lea ecx, [edi + 0x4c]
call fcn.00a98bef
lea ecx, [edi + 0x48]
call fcn.00a98bef
lea ecx, [edi + 0x40]
call fcn.00a7d210
lea ecx, [edi + 0x38]
call fcn.00a7d210
lea ecx, [edi + 0x30]
call fcn.00a7d210
lea ecx, [edi + 0x28]
call fcn.00a7d210
lea ecx, [edi + 0x20]
call fcn.00a7d210
lea ecx, [edi + 0x18]
call fcn.00a7d210
mov dword [edi + 8], 0xc0000001
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret