Function at 0x45c0fb
Capabilities:
Get geographical location
Get keyboard layout
Read file via mapping
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x44
mov eax, dword [0x4b6074]
mov ebp, dword [esp + 0x58]
xor eax, esp
mov dword [esp + 0x40], eax
call fcn.00466b96
or byte [0x4b6a14], 0x44
mov dword [0x4b8664], ebp
mov dword [0x4b8668], 0
mov dword [0x4b866c], 3
call fcn.00467170
call fcn.00457390
call fcn.0046661c
call fcn.0045aa88
call fcn.00466be1
cmp dword [0x4b8670], 4
jb 0x45c164
jne 0x45c174
cmp dword [0x4b8674], 2
je 0x45c174
push str.MSWHEEL_ROLLMSG
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
mov dword [0x4b6060], eax
call fcn.004659b9
push str.user32.dll
call fcn.00466b09
add esp, 4
mov edi, eax
push str.winmm.dll
call fcn.00466b09
add esp, 4
mov esi, eax
test edi, edi
je 0x45c1b8
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.FlashWindowEx
push edi
call ebx
mov dword [0x4b828c], eax
push str.ToUnicodeEx
push edi
call ebx
jmp 0x45c1c4
xor eax, eax
mov dword [0x4b828c], 0
test esi, esi
mov dword [0x4b8650], eax
je 0x45c1db
push str.PlaySoundA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x45c1dd
xor eax, eax
mov dword [0x4b8280], eax
call fcn.00402e28
mov dword [0x4b8678], eax
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
cmp eax, 2
jb 0x45c241
push dword [0x48e058]
push str._s_Fatal_Error
call fcn.004555e0
add esp, 8
mov esi, eax
push 0x30
push eax
push str.Failed_to_initialize_COM_subsystem
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call fcn.00410de6
add esp, 4
mov ecx, dword [esp + 0x40]
xor esi, esi
inc esi
xor ecx, esp
call fcn.0046ef41
mov eax, esi
add esp, 0x44
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
mov eax, dword [0x48e05c]
mov esi, dword [esp + 0x60]
mov dword [0x4b867c], eax
push eax
call fcn.0041ac43
add esp, 4
test eax, eax
mov dword [0x4b8680], 0
je 0x45c26e
mov eax, dword [eax + 0x48]
mov dword [0x4b8680], eax
xor edi, edi
push edi
push 0x7a
push dword [0x4b8678]
call fcn.004036b0
add esp, 0xc
push dword [0x4b8678]
push edi
call fcn.0041e60c
add esp, 8
mov bl, byte [esi]
test bl, bl
je 0x45c2b1
lea edi, [esi + 2]
movsx eax, bl
push eax
call fcn.0047dbe2
add esp, 4
test eax, eax
je 0x45c2e7
mov bl, byte [edi - 1]
inc edi
test bl, bl
jne 0x45c299
push dword [0x4b8678]
call fcn.00402d6a
add esp, 4
push dword [0x4b8678]
call fcn.00402dde
add esp, 4
test al, al
jne 0x45c414
call fcn.0045aac1
test al, al
jne 0x45c414
jmp 0x45cc4d
lea eax, [edi - 2]
cmp bl, 0x26
jne 0x45c319
cmp byte [edi - 1], 0x52
jne 0x45c381
mov cl, byte [edi]
test cl, cl
je 0x45c309
cmp cl, 0x26
je 0x45c309
cmp cl, 0x40
jne 0x45c381
call fcn.0046a936
mov byte [0x4b8684], 1
mov bl, byte [edi]
jmp 0x45c31b
mov edi, eax
test bl, bl
je 0x45c2b1
cmp bl, 0x26
je 0x45c37f
cmp bl, 0x40
jne 0x45cb59
push edi
call fcn.0047e5a0
add esp, 4
mov esi, eax
mov ebx, esi
cmp esi, 2
jl 0x45c354
movsx eax, byte [edi + ebx - 1]
lea esi, [ebx - 1]
push eax
call fcn.0047dbe2
add esp, 4
test eax, eax
jne 0x45c338
mov byte [edi + ebx], 0
inc edi
push dword [0x4b8678]
push edi
call fcn.0041e60c
add esp, 8
push dword [0x4b8678]
call fcn.00412eab
add esp, 4
test al, al
je 0x45c3f9
jmp 0x45c406
mov eax, edi
lea ecx, [esp + 0x14]
inc eax
lea edx, [esp + 4]
push ecx
push edx
push 0x49d7b9
push eax
call fcn.004195c2
add esp, 0x10
cmp eax, 2
jne 0x45c3f9
xor edi, edi
push dword [esp + 0x14]
push edi
push edi
push 4
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
je 0x45c3f9
mov esi, eax
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
mov dword [ecx], esi
mov dword [ecx + 8], eax
mov dword [ecx + 4], edi
mov dword [ecx + 0xc], edi
mov dword [ecx + 0x10], ecx
push ecx
push dword [0x4b8678]
call fcn.00403b80
add esp, 8
test al, al
je 0x45cc72
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x45c406
call fcn.0045aac1
test al, al
je 0x45cc4d
push dword [0x4b8678]
call fcn.00402d6a
add esp, 4
mov esi, dword [esp + 0x5c]
push dword [0x4b8678]
call fcn.0041ab58
add esp, 4
push 0xc8
push ebp
call dword [sym.imp.USER32.dll_LoadIconA]
test esi, esi
mov dword [0x4b7158], eax
jne 0x45c485
xor esi, esi
lea edi, [esp + 0x18]
mov dword [edi], esi
mov dword [edi + 4], 0x45cdcd
mov dword [edi + 8], esi
mov dword [edi + 0xc], esi
mov dword [edi + 0x10], ebp
mov dword [edi + 0x14], eax
push 0x7f01
push esi
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], esi
mov dword [edi + 0x20], esi
push dword [0x48e058]
push esi
push esi
call fcn.00413241
add esp, 0xc
mov dword [edi + 0x24], eax
push edi
call dword [sym.imp.USER32.dll_RegisterClassW]
push 0xb10
push 0
push 0x4b715c
call fcn.00472060
add esp, 0xc
push 0x66
push dword [0x4b8678]
call fcn.00403083
add esp, 8
mov dword [0x4b8688], eax
push 0x9d
push dword [0x4b8678]
call fcn.00403083
add esp, 8
mov dword [0x4b868c], eax
call fcn.0046002f
mov dword [0x4b7c6c], 0xa
mov dword [0x4b7c70], 0x14
mov dword [0x4b7c74], 0x19
mov dword [0x4b7c78], 0x1c
push 0x75
push dword [0x4b8678]
call fcn.00403083
add esp, 8
mov edi, dword [0x4b7c78]
mov ebx, dword [0x4b7c70]
lea eax, [eax + eax*4]
lea ebp, [eax + eax + 0x19]
push 0x76
push dword [0x4b8678]
call fcn.00403083
add esp, 8
mov esi, eax
imul esi, ebx
add esi, edi
mov edi, dword [0x4b8668]
call fcn.0045be30
test eax, eax
je 0x45c547
push 2
push edi
call dword [0x4b7134]
jmp 0x45c54c
mov eax, 0x12340042
lea edi, [esp + 0x18]
mov dword [edi], 0x28
push edi
push eax
call fcn.0045bff5
mov eax, edi
mov edi, dword [edi + 0xc]
mov ebx, dword [eax + 0x10]
sub edi, dword [eax + 4]
sub ebx, dword [eax + 8]
mov eax, dword [0x48e058]
cmp ebp, edi
cmovle edi, ebp
cmp esi, ebx
cmovle ebx, esi
xor ecx, ecx
push eax
push ecx
push ecx
call fcn.00413241
add esp, 0xc
mov dword [esp], eax
push 0x6f
push dword [0x4b8678]
call fcn.00402fe3
add esp, 8
movzx ebp, al
shl ebp, 0x15
or ebp, 0xcf0000
push 0x71
push dword [0x4b8678]
call fcn.00403083
add esp, 8
mov esi, ebp
and esi, 0xea0000
xor ecx, ecx
inc ecx
cmp eax, ecx
cmovne esi, ebp
push 0x58
push dword [0x4b8678]
call fcn.00402fe3
add esp, 8
movzx ebp, al
push 0x81
push dword [0x4b8678]
call fcn.00402fe3
add esp, 8
test al, al
lea ecx, [ebp*8 + 0x200]
lea edx, [ebp*8]
mov eax, 0x80000000
cmovne edx, ecx
xor ecx, ecx
push ecx
push dword [esp + 0x5c]
push ecx
mov ecx, 0
push ecx
push ebx
mov ebx, 0
push edi
push eax
push eax
push esi
mov eax, dword [esp + 0x24]
push eax
push eax
mov esi, eax
push edx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [0x4b8668], eax
push esi
call fcn.00410de6
add esp, 4
xor ecx, ecx
xor edx, edx
call fcn.00460180
mov dword [0x4b7154], 0x4975f8
push 0x4b7154
push 0x4b715c
push dword [0x4b8678]
call fcn.0044aafb
add esp, 0xc
mov edx, dword [0x4b8678]
mov ecx, eax
mov dword [0x4b8660], eax
call fcn.00460692
push dword [0x4b8678]
push 0x4b6048
call fcn.0040fabc
add esp, 8
mov dword [0x4b8690], eax
push eax
push dword [0x4b8660]
call fcn.00450da9
add esp, 8
push 0x62
push dword [0x4b8678]
call fcn.00403083
add esp, 8
mov esi, eax
push 0x75
push dword [0x4b8678]
call fcn.00403083
add esp, 8
mov edi, eax
push 0x76
push dword [0x4b8678]
call fcn.00403083
add esp, 8
push esi
push edi
push eax
push dword [0x4b8660]
call fcn.0044ad13
add esp, 0x10
lea esi, [esp + 4]
push esi
push dword [0x4b8668]
call dword [sym.imp.USER32.dll_GetWindowRect]
lea edi, [esp + 0x18]
push edi
push dword [0x4b8668]
call dword [sym.imp.USER32.dll_GetClientRect]
push 0x82
push dword [0x4b8678]
call fcn.00403083
add esp, 8
mov ecx, dword [esi + 8]
mov dword [0x4b7c7c], eax
mov dword [0x4b7c80], eax
add eax, eax
mov edx, dword [0x4b8660]
add ecx, eax
add eax, dword [esi + 0xc]
sub ecx, dword [esi]
sub eax, dword [esi + 4]
sub ecx, dword [edi + 8]
sub eax, dword [edi + 0xc]
add ecx, dword [edi]
add eax, dword [edi + 4]
mov dword [0x4b7c74], ecx
mov dword [0x4b7c78], eax
mov esi, dword [edx + 0x128]
mov edx, dword [edx + 0x12c]
imul edx, dword [0x4b7c6c]
imul esi, dword [0x4b7c70]
add edx, ecx
add esi, eax
push 0xe
push esi
push edx
push ebx
push ebx
push ebx
push dword [0x4b8668]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [0x4b7c6c]
lea ecx, [eax + 0xf]
sar ecx, 0x1f
shr ecx, 0x1c
lea edi, [eax + ecx + 0xf]
sar edi, 4
imul edi, dword [0x4b7c70]
add edi, edi
xor ebp, ebp
inc ebp
push ebp
push edi
call fcn.00410d70
add esp, 8
mov esi, eax
push edi
push ebx
push eax
call fcn.00472060
add esp, 0xc
push esi
push ebp
push ebp
push dword [0x4b7c70]
push dword [0x4b7c6c]
call dword [sym.imp.GDI32.dll_CreateBitmap]
mov dword [0x4b7c84], eax
push esi
call fcn.00410de6
add esp, 4
push dword [0x4b7c70]
push dword [0x4b7c6c]
push dword [0x4b7c84]
push dword [0x4b8668]
call dword [sym.imp.USER32.dll_CreateCaret]
mov eax, dword [0x4b8660]
lea edx, [esp + 0x18]
mov dword [edx], 0x1c
mov dword [edx + 4], 0x1f
mov dword [edx + 8], ebx
mov eax, dword [eax + 0x128]
lea ecx, [eax - 1]
mov dword [edx + 0xc], ecx
mov dword [edx + 0x10], eax
mov dword [edx + 0x14], ebx
push ebx
push edx
push ebp
push dword [0x4b8668]
call dword [sym.imp.USER32.dll_SetScrollInfo]
mov dword [0x4b7c88], ebx
mov dword [0x4b7c8c], ebx
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
mov dword [0x4b7c90], eax
push ebx
push dword [0x4b8668]
call dword [sym.imp.USER32.dll_GetSystemMenu]
mov dword [0x4b7c94], eax
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov esi, dword [sym.imp.USER32.dll_AppendMenuA]
mov dword [0x4b7c98], eax
push 0x49cf49
push 0x190
push ebx
push eax
call esi
push str.Paste
push 0x1a0
push ebx
push dword [0x4b7c98]
call esi
call dword [sym.imp.USER32.dll_CreateMenu]
mov dword [0x4b7c9c], eax
push ebp
push 0x4b7ca0
call fcn.0041e611
add esp, 8
call fcn.00460715
mov eax, 0xfffffff8
mov ebp, dword [eax + 0x4b7c9c]
xor edi, edi
mov dword [esp], eax
push edi
push edi
mov eax, 0x800
push eax
mov ebx, 0x800
push ebp
mov esi, dword [sym.imp.USER32.dll_AppendMenuA]
call esi
push str.Event_Log
mov eax, 0x10
push eax
push edi
push ebp
call esi
push edi
push edi
push ebx
mov ebx, 0x800
push ebp
call esi
push str.New_Session...
push 0x20
push edi
push ebp
call esi
push str.Duplicate_Session
push 0x30
push edi
push ebp
call esi
push str.Saved_Sessions
push dword [0x4b7c9c]
mov eax, 0x10
push eax
push ebp
call esi
push str.Change_Settings...
push 0x50
push edi
push ebp
call esi
push edi
push edi
push ebx
push ebp
call esi
push str.Copy_All_to_Clipboard
push 0x170
push edi
push ebp
call esi
push str.Clear_Scrollback
push 0x60
push edi
push ebp
call esi
push str.Reset_Terminal
push 0x70
push edi
push ebp
call esi
push edi
push edi
push ebx
push ebp
call esi
push 0x71
push dword [0x4b8678]
call fcn.00403083
add esp, 8
xor ecx, ecx
cmp eax, 1
sete cl
push str.Full_Screen
push 0x180
push ecx
push ebp
call esi
push edi
push edi
push ebx
push ebp
call esi
call fcn.00465b06
test al, al
je 0x45c996
push str.Help
push 0x140
push 0
push ebp
call dword [sym.imp.USER32.dll_AppendMenuA]
push dword [0x48e058]
push str.About__s
call fcn.004555e0
add esp, 8
mov esi, eax
push eax
push 0x150
push 0
push ebp
call dword [sym.imp.USER32.dll_AppendMenuA]
push esi
call fcn.00410de6
add esp, 4
mov eax, dword [esp]
add eax, 4
jne 0x45c8ae
cmp byte [0x4b8684], 0
je 0x45c9ec
mov eax, dword [0x4b6048]
push str.Running_with_restricted_process_ACL
push 0x4b6048
call dword [eax]
add esp, 8
call fcn.00460796
xor ebp, ebp
push ebp
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
movzx eax, ax
push 0x14
lea esi, [esp + 0x1c]
push esi
push 0x1004
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push esi
call fcn.0047c1f8
add esp, 4
mov dword [0x4b860c], eax
push dword [esp + 0x64]
push dword [0x4b8668]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x4b8668]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov dword [0x4b7cac], ebp
mov dword [0x4b7cb0], ebp
call fcn.004609b0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
cmp eax, dword [0x4b8668]
sete cl
push ecx
push dword [0x4b8660]
call fcn.00450db8
add esp, 8
push dword [0x4b8668]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov edi, dword [sym.imp.USER32.dll_PeekMessageW]
call fcn.004017a6
test al, al
mov ebx, 0
jne 0x45cabf
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x45cabf
call dword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
cmp eax, dword [0x4b8668]
sete cl
push ecx
push dword [0x4b8660]
call fcn.00450db8
add esp, 8
xor ebx, ebx
dec ebx
lea eax, [esp + 4]
push eax
call fcn.00465699
add esp, 4
mov esi, eax
push 0x1cff
push ebx
push 0
push eax
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
cmp eax, dword [esp + 4]
jae 0x45caf2
push dword [esi + eax*4]
call fcn.004657ca
add esp, 4
push esi
call fcn.00410de6
add esp, 4
mov ebx, dword [sym.imp.USER32.dll_IsWindow]
lea esi, [esp + 0x18]
push 1
push ebp
push ebp
push ebp
push esi
call edi
test eax, eax
je 0x45cb46
cmp dword [esp + 0x1c], 0x12
je 0x45cb50
push dword [0x4b8694]
call ebx
test eax, eax
je 0x45cb35
push esi
push dword [0x4b8694]
call dword [sym.imp.USER32.dll_IsDialogMessageA]
test eax, eax
jne 0x45cb3c
push esi
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [esp + 0x1c], 0x8005
je 0x45cb05
call fcn.0040175b
jmp 0x45ca7d
push dword [esp + 0x20]
call fcn.0045cc97
lea eax, [esp + 4]
lea edi, [esp + 0x18]
push 0
push eax
push edi
push esi
call fcn.0046d621
add esp, 0x10
mov eax, dword [edi]
test eax, eax
jle 0x45cbba
xor ebx, ebx
xor edi, edi
inc edi
mov edx, dword [esp + 4]
mov ecx, dword [0x4b8678]
lea ebp, [ebx + 1]
cmp ebp, eax
mov eax, 0
mov esi, dword [edx + ebx*4]
jge 0x45cb96
mov eax, dword [edx + ebx*4 + 4]
push ecx
push edi
push eax
push esi
call fcn.0040182d
add esp, 0x10
cmp eax, edi
je 0x45cbb0
cmp eax, 2
jne 0x45cbd1
add ebx, 2
mov ebp, ebx
mov eax, dword [esp + 0x18]
mov ebx, ebp
cmp ebp, eax
jl 0x45cb79
push dword [0x4b8678]
call fcn.00402d6a
add esp, 4
mov ebp, dword [esp + 0x58]
jmp 0x45c2bf
cmp eax, 0xfffffffe
jne 0x45cbe1
push esi
push str.option___s__requires_an_argument
call fcn.0045cd75
push 0x4a0e8d
push esi
call fcn.0047e370
add esp, 8
test eax, eax
jne 0x45cc54
mov edi, dword [0x48e058]
push edi
push str.This_procedure_will_remove_ALL_Registry_entries_nassociated_with__s__and_will_also_remove_nthe_random_seed_file.__This_only_affects_the_ncurrently_logged_in_user.__n_nTHIS_PROCESS_WILL_DESTROY_YOUR_SAVED_SESSIONS._nAre_you_really_sure_you_want_to_continue_
call fcn.004555e0
add esp, 8
mov esi, eax
push edi
push str._s_Warning
call fcn.004555e0
add esp, 8
mov edi, eax
push 4
push 0x134
push eax
push esi
call fcn.0046d4b2
add esp, 0x10
cmp eax, 6
jne 0x45cc34
call fcn.0046c3da
push esi
call fcn.00410de6
add esp, 4
push edi
call fcn.00410de6
add esp, 4
push 0
call fcn.00479d8b
push 0
call fcn.0045cc97
push str._pgpfp
push esi
call fcn.0047e370
add esp, 8
test eax, eax
jne 0x45cc7c
call fcn.0046d597
push 1
call fcn.00479d8b
push str.Serialised_configuration_data_was_invalid
call fcn.0045cd1a
cmp byte [esi], 0x2d
jne 0x45cc8c
push esi
push str.unknown_option___s_
call fcn.0045cd75
push esi
push str.unexpected_argument___s_
call fcn.0045cd75