Function at 0x4091d0
Capabilities:
Manipulate console buffer
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xdc
mov edi, dword [ebp + 8]
test byte [ebp + 0x10], 8
mov esi, dword [ebp + 0xc]
mov ebx, edi
jne 0x4091f2
test esi, esi
je 0x4093e0
movzx eax, word [0x416034]
cmp word [0x416030], ax
je 0x409424
movzx eax, word [0x416036]
cmp word [0x416032], ax
je 0x409424
lea eax, [ebp - 0xa0]
mov dword [esp + 4], eax
lea eax, [ebp - 0xa4]
mov dword [esp], eax
call fcn.00407630
lea eax, [ebp - 0xa8]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0xac]
mov dword [esp + 8], eax
lea eax, [ebp - 0xb0]
mov dword [esp + 4], eax
lea eax, [ebp - 0xb4]
mov dword [esp], eax
call fcn.00408050
mov dword [ebp - 0x74], 0x408f20
mov ecx, dword [ebp - 0xb0]
lea eax, [ebp - 0x48]
mov dword [ebp - 0x78], eax
mov ebx, dword [ebp - 0xa4]
mov edx, dword [ebp - 0xb4]
mov dword [ebp - 0x70], 0x409110
mov eax, ecx
add eax, ebx
mov dword [ebp - 0x6c], edx
dec eax
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0xac]
add edx, eax
mov eax, dword [ebp - 0xa0]
dec edx
mov dword [ebp - 0x64], edx
add ecx, eax
dec ecx
mov dword [ebp - 0x60], ecx
mov dword [esp], 0
call fcn.004073d0
mov dword [ebp - 0x2c], eax
mov ebx, dword [ebp - 0xac]
mov eax, dword [ebp - 0xb4]
mov edx, dword [ebp - 0xb0]
mov ecx, dword [ebp - 0xa8]
mov dword [ebp - 0x48], eax
add eax, ebx
dec eax
mov dword [ebp - 0x40], eax
mov eax, edx
add eax, ecx
mov dword [ebp - 0x44], edx
dec eax
xor ecx, ecx
cmp dword [ebp - 0x68], edx
mov dword [ebp - 0x3c], eax
je 0x409430
mov ecx, 1
mov dword [ebp - 0x28], ecx
mov dword [esp], 0
call fcn.004073d0
mov dword [esp], eax
lea edx, [ebp - 0x98]
mov dword [esp + 4], edx
call sub.KERNEL32.dll_GetConsoleScreenBufferInfo
sub esp, 8
test eax, eax
jne 0x409499
mov dword [ebp - 0x38], 0x50
mov edx, dword [ebp - 0x6c]
mov ebx, dword [ebp - 0x68]
mov dword [ebp - 0x34], 0x19
mov word [ebp - 0x30], 7
mov eax, dword [0x41603c]
test eax, eax
je 0x40948e
xor eax, eax
mov edx, dword [ebp - 0x6c]
inc ebx
mov dword [0x41603c], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x5c], edx
cmp eax, 0xffffffff
je 0x409366
cmp ebx, eax
jg 0x409526
mov dword [esp + 8], esi
mov ecx, 1
lea eax, [ebp - 0x78]
mov dword [esp + 0xc], ecx
mov dword [esp + 4], edi
mov dword [esp], eax
call fcn.00409930
mov edx, dword [ebp - 0x5c]
mov esi, dword [ebp - 0x6c]
cmp edx, esi
je 0x4094ca
mov ecx, dword [ebp - 0x60]
mov ebx, dword [ebp - 0x58]
cmp ecx, 0xffffffff
je 0x4093a3
cmp ebx, ecx
jg 0x4094f6
movzx edx, dx
and eax, 0xffff0000
or eax, edx
shl ebx, 0x10
and eax, 0xffff
or eax, ebx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
call sub.KERNEL32.dll_SetConsoleCursorPosition
mov edx, dword [ebp - 0x68]
sub esp, 8
cmp edx, dword [ebp - 0xb0]
je 0x4093db
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x40943e
call fcn.00407650
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 0
xor edi, edi
call fcn.004073d0
mov dword [esp], eax
lea edx, [ebp - 0x9c]
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], edx
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
call sub.KERNEL32.dll_WriteFile
sub esp, 0x14
dec eax
jne 0x4093e0
mov eax, dword [ebp - 0x9c]
add ebx, eax
sub esi, eax
test esi, esi
jne 0x4093e8
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp dword [ebp - 0x60], eax
jne 0x4092ed
jmp 0x4092f2
mov word [ebp - 0xbe], dx
mov eax, dword [ebp - 0x6c]
mov word [ebp - 0xc0], ax
mov eax, dword [ebp - 0x64]
mov word [ebp - 0xbc], ax
mov eax, dword [ebp - 0x60]
mov word [ebp - 0xba], ax
lea eax, [ebp - 0xc0]
mov dword [esp + 8], eax
mov eax, 1
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
call sub.KERNEL32.dll_SetConsoleWindowInfo
sub esp, 0xc
call fcn.00407650
jmp 0x4093e0
mov dword [ebp - 0x5c], edx
mov dword [ebp - 0x58], ebx
jmp 0x409366
movsx eax, word [ebp - 0x98]
movsx edx, word [ebp - 0x94]
movsx ebx, word [ebp - 0x92]
mov dword [ebp - 0x38], eax
movsx eax, word [ebp - 0x96]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x90]
mov word [ebp - 0x30], ax
jmp 0x409338
mov ecx, dword [ebp - 0x60]
mov ebx, dword [ebp - 0x58]
lea eax, [ecx + 1]
cmp ebx, eax
jne 0x409396
mov dword [ebp - 0x58], ecx
mov edx, 1
mov ebx, ecx
mov dword [0x41603c], edx
mov edx, dword [ebp - 0x64]
mov dword [ebp - 0x5c], edx
jmp 0x4093a3
mov dword [esp + 0x10], ecx
sub ebx, ecx
mov dword [esp + 0x14], ebx
mov eax, dword [ebp - 0x64]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x68]
mov dword [esp + 4], esi
mov dword [esp + 8], eax
lea eax, [ebp - 0x78]
mov dword [esp], eax
call dword [ebp - 0x74]
mov edx, dword [ebp - 0x5c]
mov ebx, dword [ebp - 0x58]
jmp 0x4093a3
mov dword [esp + 0x10], eax
sub ebx, eax
mov dword [esp + 0x14], ebx
mov eax, dword [ebp - 0x64]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x68]
mov dword [esp + 4], edx
mov dword [esp + 8], eax
lea eax, [ebp - 0x78]
mov dword [esp], eax
call dword [ebp - 0x74]
jmp 0x409366