Function at 0x4ad12da0
Capabilities:
Manipulate console buffer

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x18], r8d
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov r12, rcx
mov ecx, 0xfffffff5
mov r15, r9
mov edi, r8d
mov rsi, rdx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x4ad17567
xor r13d, r13d
cmp byte [0x4ad2e0ca], r13b
je 0x4ad178b8
lea eax, [r13 + 0x20]
cmp word [0x4ad2e0e0], ax
jae 0x4ad178b8
cmp word [0x4ad2e1d8], ax
jae 0x4ad178b8
lea rdx, [rsp + 0x50]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
cmp eax, r13d
je 0x4ad178b8
mov cl, byte [0x4ad2e1d8]
mov ebx, dword [rsp + 0x54]
lea edx, [r13 + 1]
shl edx, cl
mov cl, byte [0x4ad2e0e0]
lea eax, [r13 + 1]
shl eax, cl
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x40], 0x10
or edx, eax
mov dword [rsp + 0x44], r13d
mov dword [rsp + 0x4c], r13d
mov dword [rsp + 0x48], edx
call fcn.4ad12eb0
mov dword [0x4ad2e154], r13d
mov dword [0x4ad2e14c], r13d
mov dword [0x4ad2e148], r13d
mov dword [0x4ad2e150], r13d
mov rbp, r13
lea rax, [rsp + 0x40]
mov r9, r15
mov r8d, edi
mov rdx, rsi
mov rcx, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadConsoleW]
nop
jmp 0x4ad17578
lea ecx, [rax + 2]
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov r14, rax
jmp 0x4ad12de2
mov ecx, dword [r15]
mov dword [rsp + 0x38], ecx
mov edi, eax
cmp dword [0x4ad2e19c], r13d
je 0x4ad175ab
call fcn.4ad0231c
cmp rbp, r13
je 0x4ad175a8
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbp, r13
cmp edi, r13d
je 0x4ad175fd
or eax, 0xffffffff
xor r11d, r11d
or rdx, 0xffffffffffffffff
mov r12d, eax
mov r8d, eax
mov eax, r11d
mov rcx, r11
cmp dword [r15], r11d
jbe 0x4ad175fa
movzx r9d, word [0x4ad2e0e0]
movzx r10d, word [0x4ad2e1d8]
cmp word [rsi + rcx*2], 0xd
je 0x4ad17633
cmp word [rsi + rcx*2], r9w
je 0x4ad1762b
cmp word [rsi + rcx*2], r10w
je 0x4ad1761d
inc eax
inc rcx
cmp eax, dword [r15]
jb 0x4ad175db
xor r13d, r13d
cmp rbp, r13
je 0x4ad17616
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
jmp 0x4ad178cf
mov r12d, eax
mov rdx, rcx
mov r13d, 1
jmp 0x4ad17636
mov r12d, eax
mov rdx, rcx
jmp 0x4ad1763c
mov r8d, eax
cmp r8d, 0xffffffff
jne 0x4ad175fa
cmp r12d, 0xffffffff
je 0x4ad175fa
mov dword [r15], r12d
mov word [rsi + rdx*2], r11w
cmp rbp, r11
je 0x4ad17673
mov rdi, rbp
mov rax, rsi
sub rdi, rsi
movzx ecx, word [rax]
movzx edx, word [rax + rdi]
sub ecx, edx
jne 0x4ad1766b
add rax, 2
test edx, edx
jne 0x4ad17658
mov edi, r11d
cmp ecx, r11d
je 0x4ad17678
mov edi, 1
cmp r13d, r11d
jne 0x4ad1774f
cmp r12d, 2
jbe 0x4ad1774f
lea rdx, [0x4ad29fb8]
mov r8d, 3
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__wcsnicmp]
test eax, eax
je 0x4ad17749
lea rdx, [0x4ad29fc0]
mov r8d, 3
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__wcsnicmp]
test eax, eax
je 0x4ad17749
lea rdx, [0x4ad29fc8]
mov r8d, 3
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__wcsnicmp]
test eax, eax
je 0x4ad17749
lea rdx, str.chdir
mov r8d, 6
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__wcsnicmp]
test eax, eax
je 0x4ad17749
lea rdx, str.rmdir
mov r8d, 6
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__wcsnicmp]
test eax, eax
je 0x4ad17749
lea rdx, str.mkdir
mov r8d, 6
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__wcsnicmp]
test eax, eax
je 0x4ad17749
lea rdx, str.pushd
mov r8d, 6
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__wcsnicmp]
test eax, eax
jne 0x4ad1774f
mov r13d, 1
mov r9d, dword [rsp + 0x4c]
mov edx, dword [rsp + 0xc0]
mov r8d, r12d
shr r9d, 4
mov rcx, rsi
mov dword [rsp + 0x28], edi
not r9d
mov dword [rsp + 0x20], r13d
and r9d, 1
call fcn.4ad26970
xor r13d, r13d
cmp eax, r13d
je 0x4ad17824
lea rdx, [rsp + 0x50]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
cmp eax, r13d
je 0x4ad177bb
movsx ecx, word [rsp + 0x50]
movsx eax, word [rsp + 0x30]
xor edx, edx
add eax, r12d
div ecx
movzx ecx, word [rsp + 0x56]
sub cx, ax
mov word [rsp + 0x32], cx
mov ebx, dword [rsp + 0x30]
xor eax, eax
or r12, 0xffffffffffffffff
mov rdi, rsi
mov rcx, r12
mov edx, ebx
repne scasw ax, word [rdi]
not rcx
dec rcx
mov dword [rsp + 0x34], ecx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov r8d, dword [rsp + 0x38]
lea rax, [rsp + 0x38]
lea edx, [r12 + 0x21]
mov r9d, ebx
mov rcx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterW]
mov r8d, dword [rsp + 0x34]
lea r9, [rsp + 0x34]
mov rdx, rsi
mov rcx, r14
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov edx, dword [rsp + 0x34]
mov dword [rsp + 0x44], edx
jmp 0x4ad17846
or ecx, 0xffffffff
call qword [sym.imp.USER32.dll_MessageBeep]
or r12, 0xffffffffffffffff
xor eax, eax
mov rcx, r12
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
dec rcx
mov dword [rsp + 0x44], ecx
cmp rbp, r13
je 0x4ad1785f
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov rcx, r12
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
and ecx, ecx
mov r12d, ecx
lea rdi, [rcx + rcx]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
cmp rax, r13
je 0x4ad178b4
mov r8, rsi
mov rdx, r12
mov rcx, rax
call fcn.4ad01744
mov edi, dword [rsp + 0xc0]
mov r12, qword [rsp + 0xb0]
jmp 0x4ad12e83
xor eax, eax
jmp 0x4ad178cf
mov r9, r15
mov r8d, edi
mov rdx, rsi
mov rcx, r12
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_ReadConsoleW]
mov rbx, qword [rsp + 0xb8]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret