Function at 0x404a00
Capabilities:
Manipulate console buffer
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xdc
mov edi, dword [ebp + 8]
test byte [ebp + 0x10], 8
mov esi, dword [ebp + 0xc]
mov ebx, edi
jne 0x404a22
test esi, esi
je 0x404c10
movzx eax, word [0x410664]
cmp word [0x410660], ax
je 0x404c54
movzx eax, word [0x410666]
cmp word [0x410662], ax
je 0x404c54
lea eax, [ebp - 0xa0]
mov dword [esp + 4], eax
lea eax, [ebp - 0xa4]
mov dword [esp], eax
call fcn.00404030
lea eax, [ebp - 0xa8]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0xac]
mov dword [esp + 8], eax
lea eax, [ebp - 0xb0]
mov dword [esp + 4], eax
lea eax, [ebp - 0xb4]
mov dword [esp], eax
call fcn.00404440
mov dword [ebp - 0x74], 0x404750
mov ecx, dword [ebp - 0xb0]
lea eax, [ebp - 0x48]
mov dword [ebp - 0x78], eax
mov ebx, dword [ebp - 0xa4]
mov edx, dword [ebp - 0xb4]
mov dword [ebp - 0x70], 0x404940
mov eax, ecx
add eax, ebx
mov dword [ebp - 0x6c], edx
dec eax
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0xac]
add edx, eax
mov eax, dword [ebp - 0xa0]
dec edx
mov dword [ebp - 0x64], edx
add ecx, eax
dec ecx
mov dword [ebp - 0x60], ecx
mov dword [esp], 0
call fcn.00403e00
mov dword [ebp - 0x2c], eax
mov ebx, dword [ebp - 0xac]
mov eax, dword [ebp - 0xb4]
mov edx, dword [ebp - 0xb0]
mov ecx, dword [ebp - 0xa8]
mov dword [ebp - 0x48], eax
add eax, ebx
dec eax
mov dword [ebp - 0x40], eax
mov eax, edx
add eax, ecx
mov dword [ebp - 0x44], edx
dec eax
xor ecx, ecx
cmp dword [ebp - 0x68], edx
mov dword [ebp - 0x3c], eax
je 0x404c60
mov ecx, 1
mov dword [ebp - 0x28], ecx
mov dword [esp], 0
call fcn.00403e00
mov dword [esp], eax
lea edx, [ebp - 0x98]
mov dword [esp + 4], edx
call sub.KERNEL32.dll_GetConsoleScreenBufferInfo
sub esp, 8
test eax, eax
jne 0x404cc9
mov dword [ebp - 0x38], 0x50
mov edx, dword [ebp - 0x6c]
mov ebx, dword [ebp - 0x68]
mov dword [ebp - 0x34], 0x19
mov word [ebp - 0x30], 7
mov eax, dword [0x408040]
test eax, eax
je 0x404cbe
xor eax, eax
mov edx, dword [ebp - 0x6c]
inc ebx
mov dword [0x408040], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x5c], edx
cmp eax, 0xffffffff
je 0x404b96
cmp ebx, eax
jg 0x404d56
mov dword [esp + 8], esi
mov ecx, 1
lea eax, [ebp - 0x78]
mov dword [esp + 0xc], ecx
mov dword [esp + 4], edi
mov dword [esp], eax
call fcn.00404e70
mov edx, dword [ebp - 0x5c]
mov esi, dword [ebp - 0x6c]
cmp edx, esi
je 0x404cfa
mov ecx, dword [ebp - 0x60]
mov ebx, dword [ebp - 0x58]
cmp ecx, 0xffffffff
je 0x404bd3
cmp ebx, ecx
jg 0x404d26
movzx edx, dx
and eax, 0xffff0000
or eax, edx
shl ebx, 0x10
and eax, 0xffff
or eax, ebx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
call sub.KERNEL32.dll_SetConsoleCursorPosition
mov edx, dword [ebp - 0x68]
sub esp, 8
cmp edx, dword [ebp - 0xb0]
je 0x404c0b
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x404c6e
call fcn.00403a90
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 0
xor edi, edi
call fcn.00403e00
mov dword [esp], eax
lea edx, [ebp - 0x9c]
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], edx
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
call sub.KERNEL32.dll_WriteFile
sub esp, 0x14
dec eax
jne 0x404c10
mov eax, dword [ebp - 0x9c]
add ebx, eax
sub esi, eax
test esi, esi
jne 0x404c18
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp dword [ebp - 0x60], eax
jne 0x404b1d
jmp 0x404b22
mov word [ebp - 0xbe], dx
mov eax, dword [ebp - 0x6c]
mov word [ebp - 0xc0], ax
mov eax, dword [ebp - 0x64]
mov word [ebp - 0xbc], ax
mov eax, dword [ebp - 0x60]
mov word [ebp - 0xba], ax
lea eax, [ebp - 0xc0]
mov dword [esp + 8], eax
mov eax, 1
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
call sub.KERNEL32.dll_SetConsoleWindowInfo
sub esp, 0xc
call fcn.00403a90
jmp 0x404c10
mov dword [ebp - 0x5c], edx
mov dword [ebp - 0x58], ebx
jmp 0x404b96
movsx eax, word [ebp - 0x98]
movsx edx, word [ebp - 0x94]
movsx ebx, word [ebp - 0x92]
mov dword [ebp - 0x38], eax
movsx eax, word [ebp - 0x96]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x90]
mov word [ebp - 0x30], ax
jmp 0x404b68
mov ecx, dword [ebp - 0x60]
mov ebx, dword [ebp - 0x58]
lea eax, [ecx + 1]
cmp ebx, eax
jne 0x404bc6
mov dword [ebp - 0x58], ecx
mov edx, 1
mov ebx, ecx
mov dword [0x408040], edx
mov edx, dword [ebp - 0x64]
mov dword [ebp - 0x5c], edx
jmp 0x404bd3
mov dword [esp + 0x10], ecx
sub ebx, ecx
mov dword [esp + 0x14], ebx
mov eax, dword [ebp - 0x64]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x68]
mov dword [esp + 4], esi
mov dword [esp + 8], eax
lea eax, [ebp - 0x78]
mov dword [esp], eax
call dword [ebp - 0x74]
mov edx, dword [ebp - 0x5c]
mov ebx, dword [ebp - 0x58]
jmp 0x404bd3
mov dword [esp + 0x10], eax
sub ebx, eax
mov dword [esp + 0x14], ebx
mov eax, dword [ebp - 0x64]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x68]
mov dword [esp + 4], edx
mov dword [esp + 8], eax
lea eax, [ebp - 0x78]
mov dword [esp], eax
call dword [ebp - 0x74]
jmp 0x404b96