Function at 0x405610
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x10]
mov ecx, ebx
mov dword [ebp - 0x20], eax
mov eax, esi
call fcn.004048d0
test eax, eax
js 0x405660
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
mov eax, ebx
call fcn.004032e0
mov edi, eax
test eax, eax
js 0x40568e
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 0x8007007e
jne 0x405672
mov edi, dword [ebp - 0x24]
test edi, edi
jne 0x40583e
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], esi
call dword [sym.imp.shlwapi.dll_SHCreateStreamOnFileW]
sub esp, 0xc
test eax, eax
jns 0x40563a
mov dword [esp + 4], 0x2e
mov edi, dword [sym.imp.ucrtbase.dll_wcsrchr]
mov dword [esp], esi
call edi
mov edx, eax
test eax, eax
je 0x4057e6
mov dword [ebp - 0x28], eax
xor ecx, ecx
mov eax, 0xf
call fcn.00402180
mov edx, dword [ebp - 0x28]
test eax, eax
mov esi, eax
je 0x4057c0
mov dword [esp + 4], 0x2c
mov dword [esp], eax
call edi
xor edx, edx
test eax, eax
je 0x4056fe
xor ecx, ecx
add eax, 2
mov word [eax - 2], cx
mov dword [esp + 8], 0xa
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcstol]
mov edx, eax
mov ecx, ebx
mov eax, esi
call fcn.004048d0
mov dword [ebp - 0x28], 0
mov edi, eax
mov dword [esp + 8], esi
mov esi, dword [sym.imp.kernel32.dll_HeapFree]
mov edx, dword fs:[0x18]
mov dword [esp + 4], 0
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x2c], edx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x2c]
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
mov eax, 1
sub esp, 0xc
test edi, edi
js 0x405775
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
mov eax, ebx
call fcn.004032e0
mov edi, eax
shr eax, 0x1f
mov edx, dword [ebp - 0x24]
test edx, edx
jne 0x40564d
test al, al
je 0x40564d
mov ecx, ebx
mov edx, 0xffff80fb
mov eax, str.user32
call fcn.004048d0
mov edi, eax
test eax, eax
js 0x40564d
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.004032e0
mov ecx, str.open
mov eax, 2
call fcn.00402180
mov dword [ebp - 0x28], eax
test eax, eax
je 0x4057e6
mov ecx, ebx
xor edx, edx
call fcn.004048d0
mov edi, eax
jmp 0x405710
mov dword [esp + 8], 0
mov esi, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [esp + 4], 0
mov edi, dword fs:[0x18]
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
sub esp, 0xc
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov edi, 0x80070490
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
mov eax, 1
sub esp, 0xc
jmp 0x405775
mov edi, 0x8007007e
test byte [section..data], 4
je 0x40564d
mov eax, esi
shr eax, 0x10
je 0x4058a7
mov dword [esp + 4], 0xffffffff
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
push ebx
push ebx
test eax, eax
jne 0x4058bc
mov eax, esi
call fcn.00401240
mov dword [esp + 0x10], eax
mov edi, 0x8007007e
mov dword [esp + 0xc], str.Cant_find_file:__s__give_a_chance_to_parent_process_to_create_it_n
mov dword [esp + 8], str.open_icon
mov dword [esp + 4], 0x40c000
mov dword [esp], 2
call fcn.004014e0
jmp 0x40564d
movzx esi, si
mov dword [esp], str._04x
mov dword [esp + 4], esi
call fcn.00401420
jmp 0x405875
mov eax, str._invalid_
jmp 0x405875