Function at 0x4634b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bf254
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.00443e40
xor ebx, ebx
xor eax, eax
xor ecx, ecx
mov dword [ebp - 4], ebx
mov dword [esi + 0x127dc], ebx
mov dword [esi + 0x127e4], ebx
mov dword [esi + 0x127e0], ebx
mov dword [esi + 0x127e8], 0xffffffff
mov word [esi + 0x127ec], ax
mov word [esi + 0x128f0], cx
mov dword [esi + 0x128ec], ebx
lea edi, [esi + 0x12d1c]
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], ebx
mov dword [edi + 0x1c], ebx
mov dword [edi + 0x20], ebx
mov dword [edi + 0x24], ebx
mov dword [edi + 0x28], ebx
mov dword [edi + 0x2c], ebx
mov dword [edi + 0x30], ebx
mov dword [edi + 0x34], ebx
mov dword [edi + 0x38], ebx
mov dword [edi + 0x3c], ebx
mov dword [esi + 0x12d5c], ebx
mov dword [esi + 0x12d60], ebx
mov dword [esi + 0xf38bc], ebx
mov dword [esi + 0xf38ac], 0x25c
mov dword [esi + 0xf38b0], ebx
mov dword [esi + 0xf38b4], ebx
mov dword [esi + 0xf38b8], 0xcccccccc
mov dword [0x50b3a4], esi
mov dword [0x50b3a0], esi
push 0x5c
lea edx, [esi + 0x1226c]
push ebx
push edx
mov byte [ebp - 4], 2
mov byte [esi + 0x127d2], bl
mov dword [esi + 0x127d4], ebx
mov dword [esi + 0x127d8], ebx
mov byte [esi + 0x12264], bl
mov dword [esi + 0x12268], 0x3e8
call fcn.004b03e0
push 0x5c
lea eax, [esi + 0x122c8]
push ebx
push eax
call fcn.004b03e0
or eax, 0xffffffff
mov dword [esi + 0x12334], ebx
mov dword [esi + 0x1232c], ebx
mov dword [esi + 0x12330], 0x10
mov dword [esi + 0x1253c], ebx
mov dword [esi + 0x12538], ebx
mov dword [esi + 0x12328], eax
mov dword [esi + 0x12324], eax
mov byte [esi + 0x127d1], bl
mov eax, dword [0x50b3c4]
add esp, 0x18
cmp eax, 6
jae 0x46361c
cmp eax, 5
jne 0x463618
cmp dword [0x50b3c8], 1
jae 0x46361c
xor eax, eax
jmp 0x463621
mov eax, 1
lea edx, [esi + 0x11a74]
xor ecx, ecx
push str.SoftwareConEmu.Vanilla
push edx
mov byte [esi + 0xf38c4], al
mov byte [esi + 0x127d0], bl
mov word [esi + 0xf3246], cx
call fcn.0040f0b0
add esp, 8
xor eax, eax
push 0x4d6a40
mov ecx, esi
mov word [esi + 0x11c7c], ax
call fcn.0045da50
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.ConEmuViewSetMapping._u
lea ecx, [esi + 0x127dc]
call fcn.004135a0
push 0xffffffffffffffff
push 1
push 1
lea ecx, [esi + 0x127dc]
call fcn.0045efa0
test eax, eax
jne 0x46369f
push ebx
push ebx
lea ecx, [esi + 0x128f0]
push 0x40
push ecx
call fcn.00420020
add esp, 0x10
mov ecx, dword [0x50b3a0]
call fcn.00445820
mov dword [esi + 0x1225c], ebx
mov dword [esi + 0x12260], ebx
mov dword [esi + 0xf38c0], ebx
mov dword [esi + 0xf3694], ebx
mov dword [esi + 0xf3698], 1
mov edx, dword [0x50b3a0]
push 0x5c
lea eax, [esi + 0xf2d64]
push ebx
mov dword [edx + 0x1208], ebx
push eax
mov dword [esi + 0xf38a0], ebx
call fcn.004b03e0
xor ecx, ecx
add esp, 0xc
mov dword [esi + 0xf385c], ebx
mov dword [esi + 0xf3860], ebx
mov byte [esi + 0xf3245], bl
mov byte [esi + 0xf3244], bl
mov dword [esi + 0xf3208], ebx
mov dword [esi + 0xf3210], ebx
mov dword [esi + 0xf2dc0], ebx
mov word [esi + 0xf2dc8], cx
mov dword [esi + 0xf2dc4], ebx
cmp byte [0x50b4d5], bl
je 0x463747
lea edx, [esi + 0xf31c8]
push str.Lucida_Console
push edx
call fcn.0040ee90
add esp, 8
jmp 0x463750
xor eax, eax
mov word [esi + 0xf31c8], ax
lea ecx, [esi + 0xf36a0]
push ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor eax, eax
mov dword [esi + 0xf37f8], eax
mov dword [esi + 0xf37fc], eax
mov dword [esi + 0xf3800], eax
mov dword [esi + 0xf3804], eax
mov dword [esi + 0xf3808], eax
mov dword [esi + 0xf380c], eax
mov dword [esi + 0xf3810], eax
mov dword [esi + 0xf3814], eax
mov dword [esi + 0xf3818], eax
mov dword [esi + 0xf381c], eax
mov dword [esi + 0xf3820], eax
mov dword [esi + 0xf3824], eax
mov dword [esi + 0xf3828], eax
mov dword [esi + 0xf382c], eax
mov dword [esi + 0xf3830], eax
mov dword [esi + 0xf3834], eax
mov dword [esi + 0xf3838], eax
push 0xa0
mov dword [esi + 0xf383c], eax
lea edx, [esi + 0xf36a8]
push ebx
mov dword [esi + 0xf3840], eax
push edx
mov dword [esi + 0xf3844], eax
call fcn.004b03e0
push 0xa0
lea eax, [esi + 0xf3750]
push ebx
push eax
mov dword [esi + 0xf3748], ebx
call fcn.004b03e0
xor eax, eax
mov dword [esi + 0xf37f0], ebx
mov dword [esi + 0xf3848], eax
mov dword [esi + 0xf384c], eax
mov dword [esi + 0xf3850], eax
mov dword [esi + 0xf3854], eax
mov dword [esi + 0xf3858], eax
push 0x40
push ebx
push edi
mov byte [esi + 0x12540], bl
mov dword [esi + 0x12d08], ebx
mov byte [esi + 0x12d0c], bl
mov dword [esi + 0x12d18], ebx
mov dword [esi + 0x12d10], ebx
mov dword [esi + 0x12d14], ebx
mov dword [esi + 0x12d00], ebx
mov dword [esi + 0x12d04], ebx
call fcn.004b03e0
xor ecx, ecx
push 0x1e0
mov dword [esi + 0x12d60], ecx
lea ecx, [esi + 0x12338]
mov eax, 1
push ebx
push ecx
mov dword [esi + 0x12d5c], eax
call fcn.004b03e0
xor eax, eax
mov dword [esi + 0x12518], eax
mov dword [esi + 0x1251c], eax
mov dword [esi + 0x12520], eax
mov dword [esi + 0x12524], eax
mov dword [esi + 0x12528], eax
push 0x20000
mov dword [esi + 0x1252c], eax
lea edx, [esi + 0x12d64]
push ebx
mov dword [esi + 0x12530], eax
push edx
mov dword [esi + 0x12534], eax
call fcn.004b03e0
push 0xc0000
push ebx
lea eax, [esi + 0x32d64]
push eax
call fcn.004b03e0
add esp, 0x48
push 0x44
lea edi, [esi + 0x1278c]
push ebx
push edi
call fcn.004b03e0
push 0x30
lea edx, [esi + 0xf3864]
xor ecx, ecx
push ebx
push edx
mov dword [edi], 0x44
mov word [esi + 0x11e5c], cx
mov dword [esi + 0xf320c], ebx
call fcn.004b03e0
add esp, 0x18
push edi
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov edi, dword [sym.imp.USER32.dll_RegisterWindowMessageW]
xor eax, eax
push str.ConEmuSettings::Counter
mov dword [ebp - 4], 2
mov word [esi + 0xf38a8], ax
call edi
push str.Settings::RecreateFont
mov dword [esi + 0xf3894], eax
call edi
push str.Settings::LoadFontNames
mov dword [esi + 0xf3898], eax
call edi
push str.Settings::ActivateTab
mov dword [esi + 0xf389c], eax
call edi
push 4
mov dword [esi + 0xf3648], eax
mov dword [esi + 0xf38a4], ebx
mov dword [esi + 0xf3650], ebx
call fcn.004412a0
add esp, 4
cmp eax, ebx
je 0x463983
mov dword [eax], ebx
jmp 0x463985
xor eax, eax
mov ecx, esi
mov dword [esi + 0xf38d0], eax
mov dword [esi + 0xf38c8], ebx
mov dword [esi + 0xf38cc], ebx
call fcn.0044d4c0
mov ecx, esi
mov dword [esi + 0xf38d4], ebx
call fcn.0044dc50
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret