Function at 0x408ba0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
sub esp, 0x14
cmp ecx, 0x23
je 0x408bcb
push dword [ebp + 0x14]
mov eax, dword [0x438ce4]
push dword [ebp + 0x10]
push ecx
mov eax, dword [eax + 0x48]
push dword [ebp + 8]
mov eax, dword [eax + 0x40]
call eax
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [ebp + 8]
push esi
push edi
or edi, 0xffffffff
test eax, eax
cmovne edi, eax
mov eax, dword [ebp + 0x10]
xor esi, esi
mov dword [ebp - 0xc], edi
cmp dword [eax + 4], 2
jl 0x408bf0
mov edi, 0xc000000d
jmp 0x408db7
mov eax, dword fs:[0x18]
push ebx
mov ebx, dword [ebp + 0x14]
push ebx
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
mov dword [ebp + 0xc], esi
test esi, esi
je 0x408c95
push ebx
push dword [ebp + 0x10]
push esi
call fcn.0040da80
mov eax, dword [ebp + 0x10]
add esp, 0xc
cmp dword [eax + 4], 1
jne 0x408c80
cmp dword [ebp + 8], 0
jne 0x408c3c
mov edi, 0xc000000d
jmp 0x408db6
add eax, 0xc
mov dword [ebp - 4], eax
cmp dword [eax], 0x80
jae 0x408c95
mov eax, esi
xor esi, esi
mov dword [eax + 4], 0
cmp dword [eax + 8], esi
jbe 0x408c7b
mov edi, dword [ebp - 4]
mov ebx, eax
lea edx, [ebx + 0x14]
mov eax, dword [edx]
lea edx, [edx + 0xc]
mov ecx, dword [edi]
inc esi
mov eax, dword [eax + ecx*4]
mov dword [edx - 0xc], eax
cmp esi, dword [ebx + 8]
jb 0x408c62
mov edi, dword [ebp - 0xc]
mov ebx, dword [ebp + 0x14]
mov esi, dword [ebp + 0xc]
jmp 0x408caa
cmp dword [ebp + 8], 0
lea ecx, [eax + 0xc]
mov eax, dword [ecx]
mov dword [ebp - 4], ecx
je 0x408c9f
cmp eax, 0x80
jb 0x408caa
mov edi, 0xc0000017
jmp 0x408db6
add eax, 0xffffff80
mov dword [ebp - 4], ecx
cmp eax, 0x7f
ja 0x408c95
mov eax, dword [0x438ce4]
push ebx
push esi
push 0x23
mov eax, dword [eax + 0x48]
push edi
mov eax, dword [eax + 0x40]
call eax
mov dword [ebp - 0xc], eax
test eax, eax
js 0x408db3
mov ecx, dword [0x438ce4]
mov ecx, dword [ecx + 0x48]
add ecx, 0x14
push ecx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 0xc]
mov dword [ebp + 0x14], 0
cmp dword [eax + 8], 0
jbe 0x408d9e
mov edx, dword [ebp + 0x10]
lea ecx, [eax + 0x18]
mov ebx, eax
mov dword [ebp - 8], ecx
sub ebx, edx
xor ecx, ecx
mov dword [ebp - 0x14], ebx
lea edi, [edx + 0x14]
mov eax, dword [0x438ce4]
mov eax, dword [eax + 0x48]
add eax, 0x2c
mov dword [ebp - 0x10], eax
mov esi, dword [eax]
cmp esi, eax
je 0x408d77
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
shl ecx, 2
cmp dword [edx + 4], 1
mov edx, dword [edi]
jne 0x408d49
mov ebx, dword [esi + 0x10]
mov eax, dword [ebx + ecx]
cmp eax, dword [edx + ecx]
jne 0x408d51
push ecx
push ebx
push edx
call fcn.0040da80
mov ecx, dword [esi + 0xc]
add esp, 0xc
mov eax, dword [edi]
mov dword [esi + 0xc], eax
mov dword [edi], ecx
jmp 0x408d71
mov eax, dword [esi + 0x10]
cmp dword [ecx + eax], edx
je 0x408d5d
mov esi, dword [esi]
mov edx, dword [ebp + 0x10]
cmp esi, dword [ebp - 0x10]
je 0x408d74
jmp 0x408d17
cmp dword [ebp + 8], 0
je 0x408d69
mov eax, dword [esi + 0xc]
mov dword [ecx + eax], edx
mov eax, dword [ebp - 0x14]
mov eax, dword [edi + eax]
mov dword [edi], eax
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
mov esi, dword [ebp - 8]
inc ecx
mov dword [ebp + 0x14], ecx
mov eax, dword [esi - 8]
mov dword [edi - 4], eax
mov eax, dword [esi]
add esi, 0xc
mov dword [edi + 4], eax
add edi, 0xc
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], esi
cmp ecx, dword [eax + 8]
jb 0x408d03
mov eax, dword [0x438ce4]
mov eax, dword [eax + 0x48]
add eax, 0x14
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp - 0xc]
pop ebx
mov eax, dword fs:[0x18]
push esi
push 0
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10