Function at 0x7c801ef2
Capabilities:
Get process heap force flags

Disassembly:
push 0x18
push 0x7c810c78
call fcn.7c8024d6
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov esi, dword [eax + 0x10]
call dword [sym.imp.ntdll.dll_RtlAcquirePebLock]
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [0x7c8853dc], ebx
je 0x7c802018
or dword [ebp - 4], 0xffffffff
call fcn.7c8021b3
mov eax, dword [0x7c8853dc]
mov ecx, dword [eax]
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov ecx, dword [0x7c8853dc]
mov ecx, dword [ecx + 4]
mov dword [eax + 4], ecx
mov ecx, dword [0x7c8853dc]
mov ecx, dword [ecx + 8]
mov dword [eax + 8], ecx
mov ecx, dword [0x7c8853dc]
mov ecx, dword [ecx + 0xc]
mov dword [eax + 0xc], ecx
mov ecx, dword [0x7c8853dc]
mov ecx, dword [ecx + 0x10]
mov dword [eax + 0x10], ecx
mov ecx, dword [0x7c8853dc]
mov ecx, dword [ecx + 0x14]
mov dword [eax + 0x14], ecx
mov ecx, dword [0x7c8853dc]
mov ecx, dword [ecx + 0x18]
mov dword [eax + 0x18], ecx
mov ecx, dword [0x7c8853dc]
mov ecx, dword [ecx + 0x1c]
mov dword [eax + 0x1c], ecx
mov ecx, dword [0x7c8853dc]
mov ecx, dword [ecx + 0x20]
mov dword [eax + 0x20], ecx
mov ecx, dword [0x7c8853dc]
mov ecx, dword [ecx + 0x24]
mov dword [eax + 0x24], ecx
mov ecx, dword [0x7c8853dc]
mov ecx, dword [ecx + 0x28]
mov dword [eax + 0x28], ecx
mov ecx, dword [0x7c8853dc]
mov ecx, dword [ecx + 0x2c]
mov dword [eax + 0x2c], ecx
mov ecx, dword [0x7c8853dc]
mov cx, word [ecx + 0x30]
mov word [eax + 0x30], cx
mov ecx, dword [0x7c8853dc]
mov cx, word [ecx + 0x32]
mov word [eax + 0x32], cx
mov ecx, dword [0x7c8853dc]
mov ecx, dword [ecx + 0x34]
mov dword [eax + 0x34], ecx
test byte [eax + 0x2d], 7
je 0x7c8021ba
mov ecx, dword [0x7c8853dc]
mov ecx, dword [ecx + 0x38]
mov dword [eax + 0x38], ecx
mov ecx, dword [0x7c8853dc]
mov ecx, dword [ecx + 0x3c]
mov dword [eax + 0x3c], ecx
mov ecx, dword [0x7c8853dc]
mov ecx, dword [ecx + 0x40]
mov dword [eax + 0x40], ecx
call fcn.7c802511
ret 4
mov eax, dword fs:[0x18]
mov dword [ebp - 0x20], eax
push 0x44
pop edi
push edi
push dword [0x7c8856d4]
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [0x7c8853dc], eax
cmp eax, ebx
je 0x7c80217b
mov dword [eax], edi
mov eax, dword [esi + 0x4c]
mov ecx, dword [0x7c8853dc]
mov dword [ecx + 0x10], eax
mov eax, dword [esi + 0x50]
mov ecx, dword [0x7c8853dc]
mov dword [ecx + 0x14], eax
mov eax, dword [esi + 0x54]
mov ecx, dword [0x7c8853dc]
mov dword [ecx + 0x18], eax
mov eax, dword [esi + 0x58]
mov ecx, dword [0x7c8853dc]
mov dword [ecx + 0x1c], eax
mov eax, dword [esi + 0x5c]
mov ecx, dword [0x7c8853dc]
mov dword [ecx + 0x20], eax
mov eax, dword [esi + 0x60]
mov ecx, dword [0x7c8853dc]
mov dword [ecx + 0x24], eax
mov eax, dword [esi + 0x64]
mov ecx, dword [0x7c8853dc]
mov dword [ecx + 0x28], eax
mov eax, dword [esi + 0x68]
mov ecx, dword [0x7c8853dc]
mov dword [ecx + 0x2c], eax
mov ax, word [esi + 0x6c]
mov ecx, dword [0x7c8853dc]
mov word [ecx + 0x30], ax
mov ax, word [esi + 0x88]
mov ecx, dword [0x7c8853dc]
mov word [ecx + 0x32], ax
mov eax, dword [esi + 0x8c]
mov ecx, dword [0x7c8853dc]
mov dword [ecx + 0x34], eax
mov eax, dword [esi + 0x18]
mov ecx, dword [0x7c8853dc]
mov dword [ecx + 0x38], eax
mov eax, dword [esi + 0x1c]
mov ecx, dword [0x7c8853dc]
mov dword [ecx + 0x3c], eax
mov eax, dword [esi + 0x20]
mov ecx, dword [0x7c8853dc]
mov dword [ecx + 0x40], eax
mov eax, dword [0x7c8853dc]
mov dword [eax + 4], ebx
mov eax, dword [0x7c8853dc]
mov dword [eax + 8], ebx
mov eax, dword [0x7c8853dc]
mov dword [eax + 0xc], ebx
push 1
lea eax, [esi + 0x80]
push eax
lea eax, [ebp - 0x28]
push eax
mov edi, dword [sym.imp.ntdll.dll_RtlUnicodeStringToAnsiString]
call edi
mov dword [ebp - 0x1c], eax
cmp eax, ebx
jl 0x7c802190
mov eax, dword [ebp - 0x24]
mov ecx, dword [0x7c8853dc]
mov dword [ecx + 4], eax
push 1
lea eax, [esi + 0x78]
push eax
lea eax, [ebp - 0x28]
push eax
call edi
mov dword [ebp - 0x1c], eax
cmp eax, ebx
jl 0x7c802199
mov eax, dword [ebp - 0x24]
mov ecx, dword [0x7c8853dc]
mov dword [ecx + 8], eax
push 1
add esi, 0x70
push esi
lea eax, [ebp - 0x28]
push eax
call edi
mov dword [ebp - 0x1c], eax
cmp eax, ebx
jl 0x7c8021a2
mov eax, dword [ebp - 0x24]
mov ecx, dword [0x7c8853dc]
mov dword [ecx + 0xc], eax
jmp 0x7c801f21
push 0xc0000017
call dword [sym.imp.ntdll.dll_RtlRaiseStatus]
mov eax, dword [0x7c8853dc]
jmp 0x7c802044
push eax
call dword [sym.imp.ntdll.dll_RtlRaiseStatus]
jmp 0x7c802138
push eax
call dword [sym.imp.ntdll.dll_RtlRaiseStatus]
jmp 0x7c802157
push eax
call dword [sym.imp.ntdll.dll_RtlRaiseStatus]
jmp 0x7c801f21
or dword [eax + 0x38], 0xffffffff
or dword [eax + 0x3c], 0xffffffff
or dword [eax + 0x40], 0xffffffff
jmp 0x7c802010