Function at 0x401ba4
Capabilities:
Check os version
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xbc40
call fcn.00402960
push ebx
push esi
lea eax, [ebp - 0x2c]
push edi
push eax
push dword [0x406224]
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
mov ecx, dword [ebp + 8]
push 4
pop edi
lea eax, [ebp - 0x28]
push edi
push eax
call fcn.004018dc
lea eax, [ebp - 0xc0]
xor ebx, ebx
push eax
mov dword [ebp - 0x14], ebx
mov word [ebp - 4], bx
mov word [ebp - 2], bx
mov dword [ebp - 0xc0], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0xbc], 6
jne 0x401c85
cmp dword [ebp - 0xb8], 1
jne 0x401c85
lea eax, [ebp - 0x10]
mov word [ebp - 8], 0x50
push eax
mov word [ebp - 6], 0x64
push dword [ebp - 4]
lea eax, [ebp - 0xbc40]
mov word [ebp - 0xe], bx
mov word [ebp - 0x10], bx
push dword [ebp - 8]
mov word [ebp - 0xa], 0x63
mov word [ebp - 0xc], 0x4f
push eax
push dword [0x406224]
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputA]
xor ecx, ecx
lea eax, [ebp - 0xbc40]
mov dl, byte [eax]
add eax, edi
mov byte [ebp + ecx - 0x2000], dl
inc ecx
cmp ecx, 0x1f40
jb 0x401c53
movsx eax, word [ebp - 0xc]
movsx ecx, word [ebp - 0x10]
movsx edx, word [ebp - 0xe]
sub eax, ecx
movsx ecx, word [ebp - 0xa]
sub ecx, edx
inc eax
inc ecx
imul eax, ecx
mov dword [ebp - 0x14], eax
jmp 0x401ca7
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x2000]
push dword [ebp - 4]
push 0x1f40
push eax
push dword [0x406224]
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterA]
mov eax, dword [ebp - 0x14]
cmp byte [0x404188], bl
je 0x401d2e
xor ecx, ecx
cmp eax, ebx
mov dword [ebp - 4], ebx
jbe 0x401ccc
cmp byte [ebp + ecx - 0x2000], 0x20
jne 0x401cc9
inc ecx
cmp ecx, eax
jb 0x401cb8
jmp 0x401ccc
mov dword [ebp - 4], ecx
lea esi, [eax - 1]
cmp byte [ebp + esi - 0x2000], 0x20
jne 0x401cdc
dec esi
jmp 0x401ccf
mov ecx, dword [ebp + 8]
lea eax, [ebp - 4]
push edi
push eax
call fcn.004018dc
sub esi, dword [ebp - 4]
lea eax, [ebp - 0x3f40]
push eax
lea eax, [ebp - 0x2000]
inc esi
push esi
push eax
call fcn.0040285a
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push edi
push eax
call fcn.004018dc
push dword [ebp - 8]
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x3f40]
push eax
call fcn.004018dc
mov byte [0x404188], bl
jmp 0x401e1c
or edx, 0xffffffff
xor edi, edi
mov dword [ebp - 4], edx
xor esi, esi
mov eax, dword [ebp + esi*4 - 0x2000]
lea ecx, [esi*4 + 0x4042cc]
xor eax, dword [ecx]
cmp edx, 0xffffffff
mov dword [ecx], eax
jne 0x401d55
cmp eax, ebx
je 0x401d5b
mov edx, esi
cmp eax, ebx
je 0x401d5b
mov edi, esi
inc esi
cmp esi, 0x7d0
jl 0x401d38
cmp edx, 0xffffffff
mov dword [ebp - 4], edx
jne 0x401d71
xor edx, edx
mov dword [ebp - 4], edx
cmp dword [edx*4 + 0x4042cc], ebx
je 0x401d9b
shl edx, 2
mov eax, 0x1f40
mov dword [ebp - 4], edx
cmp edx, eax
jae 0x401da1
cmp byte [edx + 0x4042cc], bl
jne 0x401da1
inc edx
cmp edx, eax
mov dword [ebp - 4], edx
jl 0x401d89
jmp 0x401da1
shl edx, 2
mov dword [ebp - 4], edx
lea eax, [edi*4 + 3]
xor ecx, ecx
cmp eax, ebx
jbe 0x401dbf
cmp byte [eax + 0x4042cc], bl
jne 0x401dbf
cmp ecx, 4
jae 0x401dbf
dec eax
inc ecx
jmp 0x401daa
cmp eax, ebx
mov dword [ebp - 8], ebx
jne 0x401dd2
cmp edx, ebx
jne 0x401dd2
cmp byte [0x4042cc], bl
je 0x401dee
sub eax, edx
inc eax
je 0x401dee
lea ecx, [ebp - 0x3f40]
push ecx
push eax
lea eax, [edx + 0x4042cc]
push eax
call fcn.0040285a
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 8]
lea eax, [ebp - 4]
push 4
push eax
call fcn.004018dc
mov ecx, dword [ebp + 8]
lea eax, [ebp - 8]
push 4
push eax
call fcn.004018dc
push dword [ebp - 8]
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x3f40]
push eax
call fcn.004018dc
lea eax, [ebp - 0x2000]
push 0x1f40
push eax
push 0x4042cc
call sub.MSVCRT.dll_memcpy
add esp, 0xc
pop edi
pop esi
pop ebx
leave
ret