Function at 0x4683e1
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x458
mov eax, dword [0x5836e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x5a2408]
mov dword [ebp - 0x3f4], ecx
xor ecx, ecx
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x400], ebx
cmp dword [eax + 0x1c4], ecx
je 0x46841a
mov al, 1
jmp 0x468846
mov eax, dword [0x5a23f0]
push esi
mov esi, dword [0x5a23ec]
push edi
push 0x17
add esi, 0xc44
lea edi, [ebp - 0x3e8]
pop ecx
rep movsd dword es:[edi], dword [esi]
or dword [ebp - 0x3f0], 0xffffffff
xor edi, edi
mov dword [eax + 0x11ffc], edi
test ebx, ebx
je 0x46845f
cmp word [ebx], di
je 0x46845f
push ebx
push 0x20
lea eax, [ebp - 0x3cc]
push eax
call fcn.00401a0b
lea eax, [ebp - 0x3e8]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
xor esi, esi
mov dword [ebp - 0x404], eax
inc esi
test eax, eax
jne 0x46848d
mov eax, dword [0x5a23f0]
mov dword [eax + 0x11ffc], 4
jmp 0x4685a1
push eax
push edi
call fcn.0044432d
mov esi, eax
mov dword [ebp - 0x3fc], esi
pop ecx
pop ecx
test esi, esi
jne 0x4684b6
mov eax, dword [0x5a23f0]
mov dword [eax + 0x11ffc], 4
jmp 0x468592
mov edi, dword [esi + 0xc8]
push 0x40
pop eax
cmp word [edi], ax
je 0x46857a
cmp byte [0x5a22be], 0
jne 0x4684e7
push esi
lea eax, [esi + 4]
push eax
push edi
call fcn.00444255
add esp, 0xc
test al, al
je 0x46857a
cmp byte [esi + 0x44], 9
jne 0x46857a
lea eax, [ebp - 0x3cc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x46857a
mov eax, dword [0x5a2298]
xor edi, edi
mov edx, edi
mov dword [ebp - 0x3ec], edx
cmp dword [eax + 0x12c], edi
jle 0x46858b
xor esi, esi
mov ebx, edx
inc esi
mov ecx, dword [eax + 0x138]
cmp dword [ecx + edi + 0x258], 0
jne 0x468555
lea eax, [ebp - 0x3cc]
push eax
lea eax, [ecx + 0x210]
add eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov edx, dword [ebp - 0x3ec]
test eax, eax
mov eax, dword [0x5a2298]
cmove ebx, esi
inc edx
add edi, 0x25c
mov dword [ebp - 0x3ec], edx
cmp edx, dword [eax + 0x12c]
jl 0x46851f
mov esi, dword [ebp - 0x3fc]
test ebx, ebx
mov ebx, dword [ebp - 0x400]
je 0x468589
mov eax, dword [0x5a23f0]
mov dword [eax + 0x11ffc], 1
xor edi, edi
push esi
call fcn.004e1bea
pop ecx
push dword [ebp - 0x404]
call dword [sym.imp.GDI32.dll_DeleteObject]
xor esi, esi
inc esi
mov eax, dword [0x5a23f0]
cmp dword [eax + 0x11ffc], edi
jne 0x4685cb
lea eax, [ebp - 0x3cc]
push eax
call fcn.00468855
pop ecx
test al, al
jne 0x4685cb
mov eax, dword [0x5a23f0]
or dword [eax + 0x11ffc], 2
mov ecx, dword [0x5a2408]
test ecx, ecx
je 0x46864a
test ebx, ebx
jne 0x46864a
mov eax, dword [0x5a23f0]
cmp dword [eax + 0x11ffc], edi
je 0x46864a
cmp dword [ecx + 0x1bc], esi
jne 0x46864a
push str.Courier_New
lea eax, [ebp - 0x3cc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x46864a
mov eax, dword [0x5a23f0]
mov ecx, dword [ebp - 0x3f4]
push str.Courier_New
mov esi, dword [eax + 0x11ffc]
call fcn.004683e1
test al, al
je 0x46863f
mov eax, dword [0x5a23ec]
push str.Courier_New
push 0x20
add eax, 0xc60
push eax
call fcn.00401a0b
jmp 0x4687d2
mov eax, dword [0x5a23f0]
mov dword [eax + 0x11ffc], esi
mov eax, dword [0x5a23f0]
mov eax, dword [eax + 0x11ffc]
test al, 2
jne 0x46866e
cmp byte [0x5a22bd], 0
je 0x4687d2
test eax, eax
je 0x4687d2
push 0x284
lea eax, [ebp - 0x288]
mov dword [ebp - 0x28c], 0x22
push edi
push eax
call fcn.004f5a90
mov eax, dword [0x5a22a0]
add esp, 0xc
add eax, 0xea4
push eax
push 0x144
lea eax, [ebp - 0x28c]
push eax
call fcn.004019cd
lea ecx, [ebp - 0x28c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x4686b2
push 0x523280
sub ecx, edx
lea esi, [ebp - 0x28c]
push 0x40
sar ecx, 1
pop eax
push eax
lea esi, [esi + ecx*2]
push esi
call fcn.00401a0b
call fcn.004e3cd3
test al, al
je 0x468704
lea eax, [ebp - 0x28a]
push edi
push eax
call fcn.004e2e74
pop ecx
pop ecx
test al, al
jne 0x468704
push 0x523260
push 0x40
pop eax
push eax
push esi
call fcn.00401a0b
push str.___CheckUnicode
push 0x144
lea eax, [ebp - 0x28c]
push eax
call fcn.004019cd
xor eax, eax
mov dword [ebp - 0x458], 0x44
lea edi, [ebp - 0x414]
stosd dword es:[edi], eax
push 0x40
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop eax
push eax
xor edi, edi
lea eax, [ebp - 0x454]
push edi
push eax
call fcn.004f5a90
add esp, 0xc
mov dword [ebp - 0x42c], 1
xor eax, eax
mov word [ebp - 0x428], ax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x458]
push eax
push edi
push edi
push 0x4000030
push edi
push edi
push edi
lea eax, [ebp - 0x28c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4687d2
push 0x1388
push dword [ebp - 0x414]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4687c4
lea eax, [ebp - 0x3f0]
push eax
push dword [ebp - 0x414]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [ebp - 0x3f0], 0x8e
jne 0x4687d2
mov eax, dword [0x5a23f0]
mov dword [eax + 0x11ffc], edi
jmp 0x4687d2
push 0x64
push dword [ebp - 0x414]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [0x5a23f0]
mov esi, dword [ebp - 0x3f4]
cmp dword [eax + 0x11ffc], edi
sete al
xor edi, edi
mov byte [esi + 0x11fb5], al
inc edi
mov ecx, dword [0x5a23ec]
push edi
call fcn.004673c5
test eax, eax
je 0x46883e
mov eax, dword [0x5a23f0]
test ebx, ebx
push dword [eax + 0x11ffc]
lea eax, [ebp - 0x3cc]
push eax
mov eax, str.NULL
cmovne eax, ebx
push eax
lea eax, [ebp - 0x38c]
push str.CheckConsoleFontFast___s____s_____u
push eax
call fcn.00401133
push edi
lea eax, [ebp - 0x38c]
push edi
push eax
call fcn.00421c79
add esp, 0x20
mov al, byte [esi + 0x11fb5]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004f4166
leave
ret 4