Function at 0x46b3d0
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x444
mov eax, dword [0x52fe48]
cmp dword [eax + 0x1b4], 0
mov dword [ebp - 4], ecx
je 0x46b3f2
mov al, 1
mov esp, ebp
pop ebp
ret 4
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [0x52fe30]
push edi
add esi, 0xee4
mov ecx, 0x17
lea edi, [ebp - 0x78]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x52fe34]
mov dword [ebp - 0xc], 0xffffffff
mov dword [ecx + 0xf3034], 0
test ebx, ebx
je 0x46b43c
cmp word [ebx], 0
je 0x46b43c
lea edx, [ebp - 0x5c]
push ebx
push edx
call fcn.00401a00
add esp, 8
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov ecx, dword [0x52fe34]
test eax, eax
jne 0x46b45f
mov dword [ecx + 0xf3034], 4
jmp 0x46b55a
push eax
push 0
call fcn.0045c070
mov edi, eax
mov dword [ebp - 8], edi
test edi, edi
jne 0x46b485
mov edx, dword [0x52fe34]
mov dword [edx + 0xf3034], 4
jmp 0x46b55a
mov esi, dword [edi + 0xc8]
cmp word [esi], 0x40
je 0x46b539
cmp byte [0x52fe55], 0
jne 0x46b4bb
mov eax, dword [edi + 4]
mov ecx, dword [edi + 0x18]
mov edx, dword [edi + 0x1c]
push eax
push ecx
push edx
push esi
call fcn.0045c020
add esp, 0x10
test al, al
je 0x46b539
cmp byte [edi + 0x44], 9
jne 0x46b539
lea eax, [ebp - 0x5c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x46b539
mov ecx, dword [ebp - 4]
xor ebx, ebx
xor edi, edi
cmp dword [ecx + 0xf36dc], ebx
jle 0x46b54b
xor esi, esi
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xf36e8]
add eax, esi
cmp dword [eax + 0x258], 0
jne 0x46b50c
lea ecx, [ebp - 0x5c]
push ecx
add eax, 0x210
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x46b50c
lea ebx, [eax + 1]
mov edx, dword [ebp - 4]
inc edi
add esi, 0x25c
cmp edi, dword [edx + 0xf36dc]
jl 0x46b4e1
mov edi, dword [ebp - 8]
test ebx, ebx
mov ebx, dword [ebp + 8]
je 0x46b551
mov eax, dword [0x52fe34]
mov dword [eax + 0xf3034], 1
jmp 0x46b551
mov ecx, dword [0x52fe34]
mov dword [ecx + 0xf3034], 1
jmp 0x46b551
mov ebx, dword [ebp + 8]
mov edi, dword [ebp - 8]
push edi
call fcn.0044c4f0
add esp, 4
mov edx, dword [0x52fe34]
cmp dword [edx + 0xf3034], 0
jne 0x46b585
lea eax, [ebp - 0x5c]
push eax
call fcn.0045d170
add esp, 4
test al, al
jne 0x46b585
mov eax, dword [0x52fe34]
or dword [eax + 0xf3034], 2
mov ecx, dword [0x52fe34]
cmp dword [ecx + 0xf3034], 0
je 0x46b604
test ebx, ebx
jne 0x46b604
mov eax, dword [0x52fe48]
test eax, eax
je 0x46b604
cmp dword [eax + 0x1b0], 1
jne 0x46b604
push str.Courier_New
lea edx, [ebp - 0x5c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x46b604
mov eax, dword [0x52fe34]
mov ecx, dword [ebp - 4]
mov esi, dword [eax + 0xf3034]
push str.Courier_New
call fcn.0046b3d0
test al, al
je 0x46b5f8
mov ecx, dword [0x52fe30]
add ecx, 0xf00
push str.Courier_New
push ecx
call fcn.00401a00
add esp, 8
jmp 0x46b7de
mov edx, dword [0x52fe34]
mov dword [edx + 0xf3034], esi
mov eax, dword [0x52fe34]
mov eax, dword [eax + 0xf3034]
test al, 2
jne 0x46b628
cmp byte [0x52fe54], 0
je 0x46b7de
test eax, eax
je 0x46b7de
push 0x284
lea ecx, [ebp - 0x340]
push 0
push ecx
mov dword [ebp - 0x344], 0x22
call fcn.004c9b50
mov edx, dword [0x52fe2c]
add esp, 0xc
add edx, 0x5c8
push edx
push 0x144
lea eax, [ebp - 0x344]
push eax
call fcn.004017b0
lea eax, [ebp - 0x344]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x46b670
sub eax, edx
sar eax, 1
lea esi, [ebp + eax*2 - 0x344]
mov edi, 0x4e4db8
mov edx, 0x40
mov eax, esi
sub edi, esi
lea ecx, [edx + 0x7fffffbe]
test ecx, ecx
je 0x46b6b4
movzx ecx, word [edi + eax]
test cx, cx
je 0x46b6b4
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x46b694
jmp 0x46b6b8
test edx, edx
jne 0x46b6bb
sub eax, 2
xor edx, edx
mov word [eax], dx
call fcn.004c6070
test al, al
je 0x46b71c
lea eax, [ebp - 0x342]
push 0
push eax
call fcn.004c5850
add esp, 8
test al, al
jne 0x46b71c
mov edi, 0x4e4dd4
mov edx, 0x40
mov eax, esi
sub edi, esi
lea esp, [esp]
lea ecx, [edx + 0x7fffffbe]
test ecx, ecx
je 0x46b710
movzx ecx, word [edi + eax]
test cx, cx
je 0x46b710
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x46b6f0
jmp 0x46b714
test edx, edx
jne 0x46b717
sub eax, 2
xor edx, edx
mov word [eax], dx
push str.___CheckUnicode
push 0x144
lea eax, [ebp - 0x344]
push eax
call fcn.004017b0
xor eax, eax
push 0x40
push eax
lea ecx, [ebp - 0xb8]
push ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xbc], 0x44
call fcn.004c9b50
add esp, 0xc
xor edx, edx
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0xbc]
push ecx
push edx
push edx
push 0x4000030
push edx
push edx
push edx
mov word [ebp - 0x8c], dx
lea edx, [ebp - 0x344]
push edx
push 0
mov dword [ebp - 0x90], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x46b7de
mov eax, dword [ebp - 0x1c]
push 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x46b7d2
mov edx, dword [ebp - 0x1c]
lea ecx, [ebp - 0xc]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [ebp - 0xc], 0x8e
jne 0x46b7de
mov eax, dword [0x52fe34]
mov dword [eax + 0xf3034], 0
jmp 0x46b7de
mov ecx, dword [ebp - 0x1c]
push 0x64
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [0x52fe34]
mov esi, dword [ebp - 4]
xor edx, edx
cmp dword [eax + 0xf3034], edx
sete dl
cmp byte [esi + 0x125fa], 0
mov dword [esi + 0xf2bec], edx
je 0x46b842
mov eax, ebx
test ebx, ebx
jne 0x46b80b
mov eax, str.NULL
mov ecx, dword [0x52fe34]
mov edx, dword [ecx + 0xf3034]
push edx
lea ecx, [ebp - 0x5c]
push ecx
push eax
lea edx, [ebp - 0x444]
push str.CheckConsoleFontFast___s____s_____u
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
push 1
lea eax, [ebp - 0x444]
push 1
push eax
call fcn.00424fd0
add esp, 0x20
cmp dword [esi + 0xf2bec], 0
pop edi
pop esi
setne al
pop ebx
mov esp, ebp
pop ebp
ret 4