Function at 0x408bee
Capabilities:
Terminate process

Disassembly:
sub esp, 0x1c
mov eax, dword [0x459bdc]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
xor ebx, ebx
push 0x84
inc ebx
push ebx
call fcn.0042a777
mov dword [0x45c5b0], eax
pop ecx
pop ecx
test eax, eax
jne 0x408c1e
or eax, 0xffffffff
jmp 0x408f07
xor edx, edx
movsx eax, word [edx*2 + 0x459014]
movzx ecx, dx
mov word [eax*2 + 0x45e260], cx
movsx eax, word [edx*2 + 0x459034]
inc edx
mov word [eax*2 + 0x45e240], cx
cmp edx, 0x10
jl 0x408c20
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
or ebp, 0xffffffff
push edi
xor eax, eax
mov word [0x45e236], bp
push 0xfffffffffffffff5
mov word [0x45e234], bp
mov word [0x45e232], ax
call esi
push 0xfffffffffffffff6
mov dword [0x459008], eax
mov dword [0x459010], eax
call esi
push eax
mov dword [0x45900c], eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
push 2
pop edi
cmp eax, edi
jne 0x408f17
call dword [sym.imp.KERNEL32.dll_GetVersion]
shr eax, 0x1f
not al
and al, 1
push str.ConEmuANSI
mov byte [0x45ce82], al
call fcn.0042b35c
test eax, eax
pop ecx
setne byte [0x45e231]
test eax, eax
je 0x408cd3
push 0x444400
push eax
call fcn.0042a790
neg eax
pop ecx
sbb al, al
pop ecx
inc al
jmp 0x408cd5
xor al, al
mov esi, dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
mov byte [0x45e230], al
lea eax, [esp + 0x10]
push eax
push dword [0x459008]
call esi
push 0x45ce6c
push dword [0x459008]
call esi
push 0x45ceec
push dword [0x45900c]
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov eax, dword [0x45ceec]
and eax, 0x40
push str.LINES
mov dword [0x45e280], eax
call fcn.0042b35c
pop ecx
test eax, eax
je 0x408d30
push eax
call fcn.0042b148
pop ecx
jmp 0x408d35
call fcn.004088e2
mov ecx, eax
mov eax, dword [0x45c5b0]
push str.COLS
mov dword [eax + 0x20], ecx
call fcn.0042b35c
pop ecx
test eax, eax
je 0x408d57
push eax
call fcn.0042b148
pop ecx
jmp 0x408d5c
call fcn.00408891
mov ecx, eax
mov eax, dword [0x45c5b0]
mov dword [eax + 0x24], ecx
mov eax, dword [0x45c5b0]
mov dword [eax + 0x2c], 0x96
mov eax, dword [0x45c5b0]
mov byte [eax + 6], bl
mov eax, dword [0x45c5b0]
mov dword [eax + 0x6c], 0xff200000
cmp byte [0x45e230], 0
je 0x408d9b
mov eax, dword [0x45c5b0]
or dword [eax + 0x6c], 0x180000
mov ecx, dword [0x45c5b0]
mov dx, word [esp + 0x24]
cmp dword [ecx + 0x20], edi
jl 0x408ee6
movsx eax, dx
cmp dword [ecx + 0x20], eax
jg 0x408ee6
mov dx, word [esp + 0x22]
cmp dword [ecx + 0x24], edi
jl 0x408ed8
movsx eax, dx
cmp dword [ecx + 0x24], eax
jg 0x408ed8
mov eax, dword [esp + 0x18]
and eax, 0xf
mov word [ecx + 0xa], ax
mov ecx, dword [esp + 0x18]
mov eax, dword [0x45c5b0]
shr ecx, 4
and ecx, 0xf
push str.PDC_RESTORE_SCREEN
mov word [eax + 0xc], cx
mov eax, dword [0x45c5b0]
mov byte [eax + 9], bl
mov eax, dword [0x45c5b0]
and dword [eax + 0x48], 0
call fcn.0042b35c
pop ecx
test eax, eax
je 0x408e18
cmp byte [eax], 0x30
je 0x408e47
push 0
push ebx
push 0
push 3
push 0xc0000000
call dword [sym.imp.KERNEL32.dll_CreateConsoleScreenBuffer]
mov dword [0x459008], eax
cmp eax, ebp
jne 0x408e3f
mov eax, dword [0x459010]
mov dword [0x459008], eax
jmp 0x408e47
mov eax, dword [0x45c5b0]
mov dword [eax + 0x48], ebx
push 0x40901a
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push ebx
push 0x408f32
mov dword [0x45cee8], eax
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
push str.PDC_PRESERVE_SCREEN
call fcn.0042b35c
test eax, eax
mov eax, dword [0x45c5b0]
pop ecx
setne cl
push 0x10
mov byte [eax + 0x44], cl
push dword [0x459008]
call dword [sym.imp.KERNEL32.dll_SetConsoleMode]
test eax, eax
je 0x408e99
mov eax, dword [0x45c5b0]
or dword [eax + 0x6c], 0x160000
call fcn.0040895f
mov eax, dword [0x45c5b0]
push str.kernel32.dll
mov byte [eax + 7], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
push str.GetConsoleScreenBufferInfoEx
push edi
call esi
push str.SetConsoleScreenBufferInfoEx
push edi
mov dword [0x45ce68], eax
call esi
mov dword [0x45ce64], eax
xor eax, eax
jmp 0x408f04
push dword [ecx + 0x24]
movsx ecx, dx
push ecx
push str.COLS_value_must_be___2_and____d:_got__d_n
jmp 0x408ef2
push dword [ecx + 0x20]
movsx eax, dx
push eax
push str.LINES_value_must_be___2_and____d:_got__d_n
push edi
call fcn.0042a6ad
pop ecx
push eax
call fcn.004073fd
mov eax, ebp
add esp, 0x10
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x1c]
pop ebx
xor ecx, esp
call fcn.0040cfd1
add esp, 0x1c
ret
push str._nRedirection_is_not_supported._n
push edi
call fcn.0042a6ad
pop ecx
push eax
call fcn.004073fd
pop ecx
pop ecx
push ebx
call fcn.00427ca9
int3