Function at 0x4046f0
Capabilities:
Create process on windows
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x461a2b
mov eax, dword fs:[0]
push eax
mov eax, 0x1c64
call fcn.0045db90
mov eax, dword [0x4920c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x1c50], ebx
cmp byte [ebx + 0x60], 0
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x1c58], esi
je 0x404d5f
mov edx, dword [ebx + 0x84]
lea eax, [ebx + 0x80]
mov dword [ebp - 0x1c54], eax
push dword [ebp - 0x1c54]
push ecx
mov ecx, dword [eax]
call fcn.004099d0
mov eax, dword [ebx + 0x80]
lea ecx, [ebx + 0x80]
add esp, 8
mov dword [ecx + 4], eax
mov eax, dword [ebx + 0x7c]
mov dword [ebx + 0x8c], 0
test eax, eax
je 0x4047ba
cmp dword [eax], 0
je 0x4047ba
push 0x44
call fcn.00450970
add esp, 4
test eax, eax
je 0x4047a5
push esi
push ecx
push 0x64
push 0
mov ecx, eax
call fcn.00403970
jmp 0x4047a7
xor eax, eax
push 0
push eax
mov eax, dword [ebx + 0x7c]
push 0x8064
push dword [eax]
call dword [sym.imp.USER32.dll_PostMessageW]
cmp dword [ebx + 0x18], 8
lea esi, [ebx + 4]
jb 0x4047c7
mov eax, dword [esi]
jmp 0x4047c9
mov eax, esi
push edi
push eax
lea eax, [ebp - 0x1bc8]
push str.__sdism.exe___s
push eax
call fcn.00409950
add esp, 0x10
cmp dword [ebx + 0x44], 0
je 0x404834
push str.__logpath:_
lea eax, [ebp - 0x1bc8]
push 0x800
push eax
call fcn.00451274
lea eax, [ebx + 0x34]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x404809
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x1bc8]
push 0x800
push eax
call fcn.00451274
push 0x46ba84
lea eax, [ebp - 0x1bc8]
push 0x800
push eax
call fcn.00451274
add esp, 0x18
cmp dword [ebx + 0x6c], 0
jne 0x404853
push 0x46ba88
lea eax, [ebp - 0x1bc8]
push 0x800
push eax
call fcn.00451274
add esp, 0xc
cmp dword [ebx + 0x6c], 1
jne 0x404872
push str.__loglevel:2
lea eax, [ebp - 0x1bc8]
push 0x800
push eax
call fcn.00451274
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x40487a
mov esi, dword [esi]
push esi
lea eax, [ebp - 0xbc8]
push 0x1f4
push eax
call fcn.004513ee
push 0x44
xorps xmm0, xmm0
lea eax, [ebp - 0x1c30]
push 0
push eax
movq qword [ebp - 0x1c40], xmm0
movq qword [ebp - 0x1c38], xmm0
call fcn.00455910
add esp, 0x18
xor eax, eax
mov word [ebp - 0x1c00], ax
lea eax, [ebp - 0x1c40]
push eax
lea eax, [ebp - 0x1c30]
push eax
lea eax, [ebp - 0xbc8]
push eax
push 0
push dword [ebx + 0x68]
lea eax, [ebp - 0x1bc8]
push 1
push 0
push 0
push eax
push 0
mov dword [ebp - 0x1c30], 0x44
mov dword [ebp - 0x1c04], 1
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
test eax, eax
je 0x404d5f
xor eax, eax
push 0x7ce
push eax
mov word [ebp - 0x7e0], ax
lea eax, [ebp - 0x7de]
push eax
call fcn.00455910
mov ebx, dword [sym.imp.KERNEL32.DLL_AllocConsole]
xor eax, eax
mov dword [ebp - 0x1c4c], eax
mov dword [ebp - 0x1bcc], eax
xor al, al
add esp, 0xc
xor edi, edi
mov byte [ebp - 0x1c41], al
xor esi, esi
push 0x64
call dword [sym.imp.KERNEL32.DLL_Sleep]
push dword [ebp - 0x1c38]
call dword [sym.imp.KERNEL32.DLL_AttachConsole]
test eax, eax
jne 0x404972
call ebx
call dword [sym.imp.KERNEL32.DLL_FreeConsole]
inc esi
cmp esi, 0x14
jl 0x404944
mov al, byte [ebp - 0x1c41]
jmp 0x40497a
mov al, 1
mov byte [ebp - 0x1c41], al
xor ebx, ebx
mov dword [ebp - 0x1c48], ebx
test al, al
je 0x40499e
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
mov ebx, eax
xor eax, eax
cmp ebx, 0xffffffff
cmove ebx, eax
mov dword [ebp - 0x1c48], ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_Sleep]
mov dword [ebp - 0x1bd0], edi
lea ebx, [ebx]
lea eax, [ebp - 0x1bd0]
push eax
push dword [ebp - 0x1c40]
call dword [sym.imp.KERNEL32.DLL_GetExitCodeProcess]
mov edx, dword [ebp - 0x1c48]
test edx, edx
je 0x404b63
test di, di
jne 0x404a4b
xor esi, esi
jmp 0x4049e0
lea eax, [ebp - 0x1bcc]
push eax
mov di, si
mov word [ebp - 0x1c4a], di
push dword [ebp - 0x1c4c]
lea eax, [ebp - 0x7e0]
push 0x46
push eax
push edx
call dword [sym.imp.KERNEL32.DLL_ReadConsoleOutputCharacterW]
test eax, eax
je 0x404a15
cmp word [ebp - 0x7e0], 0x5b
je 0x404a3c
xor edi, edi
mov word [ebp - 0x1c4a], di
cmp esi, 9
jne 0x404a2a
push 0xfa
call ebx
mov edx, dword [ebp - 0x1c48]
inc esi
cmp esi, 0xa
jge 0x404b63
jmp 0x4049e0
mov edx, dword [ebp - 0x1c48]
test si, si
je 0x404b63
lea eax, [ebp - 0x1bcc]
push eax
push dword [ebp - 0x1c4c]
lea eax, [ebp - 0x7e0]
push 0x46
push eax
push edx
call dword [sym.imp.KERNEL32.DLL_ReadConsoleOutputCharacterW]
test eax, eax
je 0x404b4c
xor eax, eax
mov word [ebp - 0x754], ax
mov esi, 1
mov edi, edi
cmp word [ebp + esi*2 - 0x7e0], 0x3d
jne 0x404ab1
cmp word [ebp + esi*2 - 0x7de], 0x3d
jne 0x404ab0
cmp word [ebp + esi*2 - 0x7dc], 0x3d
jne 0x404aab
add esi, 3
cmp esi, 0x46
jl 0x404a80
jmp 0x404ab1
add esi, 2
jmp 0x404ab1
inc esi
mov eax, dword [ebp - 0x1c50]
mov eax, dword [eax + 0x7c]
test eax, eax
je 0x404b4c
cmp dword [eax], 0
je 0x404b4c
push 0x44
call fcn.00450970
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x404b31
lea ecx, [ebp - 0x7e0]
lea ecx, [ecx + esi*2]
push ecx
call fcn.004505f4
mov dword [ebx], 1
mov dword [ebx + 0x18], 7
mov dword [ebx + 0x14], 0
add esp, 4
xor ecx, ecx
mov word [ebx + 4], cx
mov dword [ebx + 0x30], 7
mov dword [ebx + 0x2c], ecx
mov word [ebx + 0x1c], cx
mov dword [ebx + 0x34], eax
mov eax, dword [ebp - 0x1c58]
mov dword [ebx + 0x38], 0x64
mov dword [ebx + 0x3c], 0xffffffff
mov dword [ebx + 0x40], eax
jmp 0x404b33
xor ebx, ebx
mov eax, dword [ebp - 0x1c50]
push 0
mov eax, dword [eax + 0x7c]
push ebx
push 0x8064
push dword [eax]
call dword [sym.imp.USER32.dll_PostMessageW]
push 0xfa
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov ebx, dword [sym.imp.KERNEL32.DLL_Sleep]
mov edx, dword [ebp - 0x1c48]
mov eax, dword [ebp - 0x1bd0]
cmp eax, 0x103
je 0x4049b0
mov ecx, dword [ebp - 0x1c50]
mov dword [ecx + 0x8c], eax
test edx, edx
je 0x404d30
lea eax, [ebp - 0x1be8]
push eax
push edx
call dword [sym.imp.KERNEL32.DLL_GetConsoleScreenBufferInfo]
test eax, eax
je 0x404d30
mov dx, word [ebp - 0x1bda]
mov eax, 0x3e7
cmp dx, ax
cmovg edx, eax
mov ax, word [ebp - 0x1bd8]
inc ax
inc dx
xor ecx, ecx
xor esi, esi
mov word [ebp - 0x1bda], dx
mov word [ebp - 0x1bd8], ax
cmp cx, ax
jge 0x404d30
mov ebx, dword [ebp - 0x1c48]
lea esp, [esp]
lea eax, [ebp - 0x1bcc]
push eax
movsx eax, dx
mov word [ebp - 0x1c4a], si
push dword [ebp - 0x1c4c]
push eax
lea eax, [ebp - 0x7e0]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_ReadConsoleOutputCharacterW]
test eax, eax
je 0x404d19
mov dx, word [ebp - 0x1bda]
movsx eax, dx
add eax, eax
cmp eax, 0x7d0
jae 0x404d5a
xor ecx, ecx
mov word [ebp + eax - 0x7e0], cx
lea ecx, [ebp - 0x7e0]
lea edi, [ecx + 2]
jmp 0x404c40
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x404c40
sub ecx, edi
sar ecx, 1
lea eax, [ecx - 1]
test eax, eax
js 0x404c6e
jmp 0x404c60
cmp word [ebp + eax*2 - 0x7e0], 0x20
jne 0x404c6e
dec eax
jns 0x404c60
inc eax
lea ecx, [eax + eax]
cmp ecx, 0x7d0
jae 0x404d5a
xor edi, edi
mov word [ebp + ecx - 0x7e0], di
test eax, eax
jle 0x404d20
xor eax, eax
mov dword [ebp - 0x1c5c], 7
mov dword [ebp - 0x1c60], edi
mov word [ebp - 0x1c70], ax
cmp word [ebp - 0x7e0], ax
jne 0x404cb6
xor ecx, ecx
jmp 0x404ccf
lea ecx, [ebp - 0x7e0]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x404cc0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x7e0]
push eax
lea ecx, [ebp - 0x1c70]
call fcn.004023a0
lea eax, [ebp - 0x1c70]
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x1c54]
push eax
call fcn.00408fe0
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x1c5c], 8
jb 0x404d19
push dword [ebp - 0x1c70]
call fcn.00450920
add esp, 4
mov dx, word [ebp - 0x1bda]
movsx eax, word [ebp - 0x1bd8]
inc esi
cmp esi, eax
jl 0x404be0
mov al, byte [ebp - 0x1c41]
test al, al
je 0x404d40
call dword [sym.imp.KERNEL32.DLL_FreeConsole]
push dword [ebp - 0x1c40]
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
call esi
push dword [ebp - 0x1c3c]
call esi
mov al, 1
jmp 0x404d61
call fcn.0045119a
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044fdac
mov esp, ebp
pop ebp
ret 8