Function at 0x4048df
Capabilities:
Get geographical location
Get keyboard layout
Hide graphical window

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x44
mov edi, dword [esp + 0x58]
mov esi, dword [esp + 0x5c]
mov eax, dword [0x502034]
xor eax, esp
mov dword [esp + 0x40], eax
call fcn.0043bf50
mov dword [0x502be8], edi
mov dword [0x502be4], esi
call fcn.004352b0
call fcn.0041fd00
call fcn.00424940
call fcn.0041dc20
call fcn.0043d2f0
cmp dword [0x505304], 4
jb 0x404748
jne 0x404758
cmp dword [0x50530c], 2
je 0x404758
push str.MSWHEEL_ROLLMSG
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
mov dword [section..data], eax
call fcn.0040b280
push str.user32.dll
call fcn.0043bfb0
add esp, 4
mov esi, eax
push str.winmm.dll
call fcn.0043bfb0
add esp, 4
mov ebx, eax
push str.shcore.dll
call fcn.0043bfb0
add esp, 4
mov edi, eax
test esi, esi
je 0x4047ab
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.FlashWindowEx
push esi
call ebp
mov dword [0x503d54], eax
push str.ToUnicodeEx
push esi
call ebp
jmp 0x4047b7
mov dword [0x503d54], 0
xor eax, eax
mov dword [0x503e14], eax
test ebx, ebx
je 0x4047ce
push str.PlaySoundA
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x4047d0
xor eax, eax
mov dword [0x503d48], eax
test esi, esi
je 0x404803
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetMonitorInfoA
push esi
call ebx
mov dword [0x503dd4], eax
push str.MonitorFromPoint
push esi
call ebx
mov dword [0x503dd8], eax
push str.MonitorFromWindow
push esi
call ebx
jmp 0x404819
mov dword [0x503dd4], 0
mov dword [0x503dd8], 0
xor eax, eax
mov dword [0x503d84], eax
test edi, edi
je 0x404830
push str.GetDpiForMonitor
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x404832
xor eax, eax
mov dword [0x503d80], eax
test esi, esi
je 0x404858
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetSystemMetricsForDpi
push esi
call edi
mov dword [0x503d5c], eax
push str.AdjustWindowRectExForDpi
push esi
call edi
jmp 0x404864
mov dword [0x503d5c], 0
xor eax, eax
mov dword [0x503d60], eax
call fcn.00437920
mov dword [0x502bf0], eax
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
cmp eax, 1
jbe 0x4048c8
push dword [0x4c977c]
push str._s_Fatal_Error
call fcn.00438d90
add esp, 8
mov esi, eax
push 0x30
push eax
push str.Failed_to_initialize_COM_subsystem
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call fcn.00439860
add esp, 4
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.0049fc40
mov eax, 1
add esp, 0x44
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
push dword [esp + 0x60]
push dword [0x502bf0]
call fcn.0040acf0
add esp, 8
push 0xb0c
push 0
push 0x502bf4
call fcn.004a29a0
add esp, 0xc
push 0x6f
push dword [0x502bf0]
call fcn.00437bf0
add esp, 8
mov dword [0x5037b0], eax
push 0xa6
push dword [0x502bf0]
call fcn.00437bf0
add esp, 8
mov dword [0x5037b4], eax
mov dword [0x503700], 0xa
mov dword [0x503704], 0x14
mov dword [0x503708], 0x19
mov dword [0x50370c], 0x1c
push 0x7e
push dword [0x502bf0]
call fcn.00437bf0
add esp, 8
lea eax, [eax + eax*4]
lea ebp, [eax + eax]
add ebp, 0x19
mov edi, dword [0x50370c]
mov ebx, dword [0x503704]
push 0x7f
push dword [0x502bf0]
call fcn.00437bf0
add esp, 8
mov esi, eax
imul esi, ebx
add esi, edi
cmp dword [0x503dd4], 0
je 0x4049d1
mov eax, dword [0x503d84]
test eax, eax
je 0x4049d1
push 2
push dword [0x502004]
call eax
mov dword [esp + 0x18], 0x28
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [0x503dd4]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov dword [esp + 8], eax
mov dword [esp + 0xc], ecx
mov eax, dword [esp + 0x24]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x14], eax
jmp 0x4049e3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
sub eax, dword [esp + 8]
cmp ebp, eax
cmovle eax, ebp
mov dword [esp + 4], eax
sub ebx, dword [esp + 0xc]
cmp esi, ebx
cmovle ebx, esi
push dword [0x4c9780]
call fcn.0042ea50
add esp, 4
test eax, eax
jne 0x404a17
xor edi, edi
jmp 0x404a1e
mov al, byte [eax + 0x58]
and al, 1
mov edi, eax
mov esi, dword [0x4c977c]
push esi
push 0
push 0
call fcn.00438e70
add esp, 0xc
mov dword [esp], eax
push esi
push 0
push 0
call fcn.00438e70
add esp, 0xc
mov dword [0x503710], eax
push esi
push 0
push 0
call fcn.00438e70
add esp, 0xc
mov dword [0x503714], eax
push pe_nt_image_headers32
push dword [0x502bf0]
call fcn.00437b40
add esp, 8
movzx esi, al
shl esi, 0x15
or esi, 0xcf0000
push 0x7a
push dword [0x502bf0]
call fcn.00437bf0
add esp, 8
mov ecx, esi
and ecx, 0xea0000
mov edx, edi
test dl, dl
cmovne esi, ecx
cmp eax, 1
cmove esi, ecx
push 0x61
push dword [0x502bf0]
call fcn.00437b40
add esp, 8
movzx edi, al
lea ebp, [edi*8]
push 0x8a
push dword [0x502bf0]
call fcn.00437b40
add esp, 8
lea edi, [edi*8 + 0x200]
test al, al
cmove edi, ebp
mov byte [0x503718], 1
call fcn.00401060
push 0
push dword [esp + 0x5c]
push 0
push 0
push ebx
push dword [esp + 0x18]
push 0x80000000
push 0x80000000
push esi
mov ecx, dword [esp + 0x24]
mov ebx, ecx
push ecx
push eax
push edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [0x502004], eax
test eax, eax
jne 0x404b2a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0043d3e0
add esp, 4
push eax
push str.Unable_to_create_terminal_window:__s
call fcn.00405390
mov dword [0x503730], 0
mov dword [0x50372c], 0
mov dword [0x503728], 0
mov dword [0x503724], 0
mov dword [0x503720], 0
mov dword [0x50371c], 0
cmp dword [0x503d80], 0
je 0x404bbd
mov ecx, dword [0x503d84]
test ecx, ecx
je 0x404bbd
push 1
push eax
call ecx
lea ecx, [esp + 8]
lea edx, [esp + 0x18]
push ecx
push edx
push 0
push eax
call dword [0x503d80]
test eax, eax
jne 0x404baa
mov ecx, dword [esp + 0x18]
mov dword [0x50371c], ecx
mov eax, dword [esp + 8]
mov dword [0x503720], eax
jmp 0x404bb5
mov ecx, dword [0x50371c]
mov eax, dword [0x503720]
test ecx, ecx
je 0x404bbd
test eax, eax
jne 0x404bf2
push dword [0x502004]
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
mov esi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x58
push eax
call esi
mov dword [0x50371c], eax
push 0x5a
push edi
call esi
mov dword [0x503720], eax
push edi
push dword [0x502004]
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebx
call fcn.00439860
add esp, 4
xor esi, esi
xor ecx, ecx
xor edx, edx
call fcn.00405400
mov dword [0x503778], 0
push 0x414
push 8
push 1
call fcn.004397d0
add esp, 0xc
mov dword [0x503774], eax
mov dword [eax], 0x1060300
nop
nop
nop
nop
mov byte [eax + esi*4 + 7], 4
mov byte [eax + esi*4 + 0xb], 4
add esi, 2
cmp esi, 0x106
jne 0x404c30
mov dword [0x503734], 0x4c9004
push 0x503734
push 0x502bf4
push dword [0x502bf0]
call fcn.0040e460
add esp, 0xc
mov esi, eax
mov dword [0x503738], eax
mov edi, dword [0x502bf0]
cmp dword [eax + 0x1120], 1
je 0x404c94
push 0x3dc
push str._home_simon_mem_.build_workdirs_bob_0_vdcidh_putty_windows_window.c
push str.term__mouse_select_clipboards_0___CLIP_LOCAL
call fcn.004af403
add esp, 0xc
mov dword [esi + 0x112c], 1
push 0x9f
push edi
call fcn.00437b40
add esp, 8
test al, al
je 0x404cca
mov eax, dword [esi + 0x112c]
lea ecx, [eax + 1]
mov dword [esi + 0x112c], ecx
mov dword [esi + eax*4 + 0x1120], 2
push 0xa0
push edi
call fcn.00437bf0
add esp, 8
xor ecx, ecx
cmp eax, 2
sete cl
add ecx, ecx
cmp eax, 1
cmove ecx, eax
mov dword [esi + 0x1130], ecx
push dword [0x502bf0]
push 0x50200c
call fcn.00425b50
add esp, 8
mov dword [0x50373c], eax
push eax
push dword [0x503738]
call fcn.00415c60
add esp, 8
push 0x6b
push dword [0x502bf0]
call fcn.00437bf0
add esp, 8
mov esi, eax
push 0x7e
push dword [0x502bf0]
call fcn.00437bf0
add esp, 8
mov edi, eax
push 0x7f
push dword [0x502bf0]
call fcn.00437bf0
add esp, 8
push esi
push edi
push eax
push dword [0x503738]
call fcn.0040ea20
add esp, 0x10
lea eax, [esp + 8]
push eax
push dword [0x502004]
call dword [sym.imp.USER32.dll_GetWindowRect]
lea ebx, [esp + 0x18]
push ebx
push dword [0x502004]
call dword [sym.imp.USER32.dll_GetClientRect]
push 0x8b
push dword [0x502bf0]
call fcn.00437bf0
add esp, 8
mov dword [0x503740], eax
mov dword [0x503744], eax
add eax, eax
mov ecx, dword [esp + 0x10]
add ecx, eax
mov edx, dword [esp + 8]
mov esi, dword [esp + 0xc]
add edx, dword [esp + 0x20]
sub ecx, edx
add ecx, dword [esp + 0x18]
add eax, dword [esp + 0x14]
mov dword [0x503708], ecx
add esi, dword [esp + 0x24]
sub eax, esi
add eax, dword [esp + 0x1c]
mov dword [0x50370c], eax
mov edx, dword [0x503738]
mov esi, dword [edx + 0x128]
mov edx, dword [edx + 0x12c]
imul edx, dword [0x503700]
add edx, ecx
imul esi, dword [0x503704]
add esi, eax
push 0xe
push esi
push edx
push 0
push 0
push 0
push dword [0x502004]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov edi, dword [0x503700]
lea eax, [edi + 0xf]
add edi, 0x1e
test eax, eax
cmovns edi, eax
sar edi, 4
imul edi, dword [0x503704]
add edi, edi
push 0
push 1
push edi
call fcn.004397d0
add esp, 0xc
mov esi, eax
push edi
push 0
push eax
call fcn.004a29a0
add esp, 0xc
push esi
push 1
push 1
push dword [0x503704]
push dword [0x503700]
call dword [sym.imp.GDI32.dll_CreateBitmap]
mov dword [0x503748], eax
push esi
call fcn.00439860
add esp, 4
push dword [0x503704]
push dword [0x503700]
push dword [0x503748]
push dword [0x502004]
call dword [sym.imp.USER32.dll_CreateCaret]
mov dword [esp + 0x18], 0x1c
mov dword [esp + 0x1c], 0x1f
mov dword [esp + 0x20], 0
mov eax, dword [0x503738]
mov eax, dword [eax + 0x128]
lea ecx, [eax - 1]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], 0
push 0
push ebx
push 1
push dword [0x502004]
call dword [sym.imp.USER32.dll_SetScrollInfo]
mov dword [0x50374c], 0
mov dword [0x503750], 0
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
mov dword [0x503754], eax
push 0
push dword [0x502004]
call dword [sym.imp.USER32.dll_GetSystemMenu]
mov dword [0x503758], eax
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov dword [0x50375c], eax
mov ebp, dword [sym.imp.USER32.dll_AppendMenuA]
push 0x4df556
push 0x190
push 0
push eax
call ebp
push str.Paste
push 0x1a0
push 0
push dword [0x50375c]
call ebp
call dword [sym.imp.USER32.dll_CreateMenu]
mov dword [0x503760], eax
push 1
push 0x503764
call fcn.00433cc0
add esp, 8
mov esi, dword [sym.imp.USER32.dll_DeleteMenu]
nop
nop
push 0x400
push 0
push dword [0x503760]
call esi
test eax, eax
jne 0x404f50
cmp dword [0x503764], 2
jl 0x404fb4
mov esi, 1
mov edi, 0x1000
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [0x503768]
push dword [eax + esi*4]
push edi
push 0
push dword [0x503760]
call ebp
add esi, 1
mov eax, dword [0x503764]
cmp eax, 0x401
mov ecx, 0x401
cmovl ecx, eax
add edi, 0x10
cmp esi, ecx
jl 0x404f80
cmp eax, 1
jg 0x404fcc
push str._No_sessions_
push 0x1000
push 1
push dword [0x503760]
call dword [sym.imp.USER32.dll_AppendMenuA]
xor eax, eax
mov bl, 1
jmp 0x40501c
push dword [0x4c977c]
push str.About__s
call fcn.00438d90
add esp, 8
mov esi, eax
push eax
push 0x150
push 0
push edi
call ebp
push esi
call fcn.00439860
add esp, 4
mov eax, 1
test bl, 1
mov ebx, 0
je 0x40510d
mov edi, dword [eax*4 + 0x503758]
push 0
push 0
push 0x800
push edi
call ebp
push str.Event_Log
push 0x10
push 0
push edi
call ebp
push 0
push 0
push 0x800
push edi
call ebp
push str.New_Session...
push 0x20
push 0
push edi
call ebp
push str.Duplicate_Session
push 0x30
push 0
push edi
call ebp
push str.Saved_Sessions
push dword [0x503760]
push 0x10
push edi
call ebp
push str.Change_Settings...
push 0x50
push 0
push edi
call ebp
push 0
push 0
push 0x800
push edi
call ebp
push str.Copy_All_to_Clipboard
push 0x170
push 0
push edi
call ebp
push str.Clear_Scrollback
push 0x60
push 0
push edi
call ebp
push str.Reset_Terminal
push 0x70
push 0
push edi
call ebp
push 0
push 0
push 0x800
push edi
call ebp
push 0x7a
push dword [0x502bf0]
call fcn.00437bf0
add esp, 8
xor ecx, ecx
cmp eax, 1
sete cl
push str.Full_Screen
push 0x180
push ecx
push edi
call ebp
push 0
push 0
push 0x800
push edi
call ebp
call fcn.0040b3f0
test al, al
je 0x404fe0
push 0x4e3ac9
push 0x140
push 0
push edi
call ebp
jmp 0x404fe0
call fcn.0043ce90
test al, al
je 0x40512a
mov eax, dword [0x50200c]
push str.Running_with_restricted_process_ACL
push 0x50200c
call dword [eax]
add esp, 8
push dword [0x502004]
call fcn.00425cf0
add esp, 4
call fcn.00405be0
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
movzx eax, ax
push 0x14
lea esi, [esp + 0x1c]
push esi
push 0x1004
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push esi
call fcn.004b02f8
add esp, 4
mov dword [0x503dc4], eax
push dword [esp + 0x64]
push dword [0x502004]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x502004]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
cmp eax, dword [0x502004]
sete cl
push ecx
push dword [0x503738]
call fcn.00415c70
add esp, 8
push dword [0x502004]
call dword [sym.imp.USER32.dll_UpdateWindow]
push dword [0x503770]
push 0x502008
push dword [0x502004]
call fcn.0040b1c0
add esp, 0xc
mov ebx, dword [sym.imp.USER32.dll_PeekMessageW]
mov ebp, dword [sym.imp.USER32.dll_IsWindow]
jmp 0x4051dd
call fcn.00425f60
xor edi, edi
call fcn.00425fb0
test al, al
jne 0x405224
push 0
push 0
push 0
push 0
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x405224
call dword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
cmp eax, dword [0x502004]
sete cl
push ecx
push dword [0x503738]
call fcn.00415c70
add esp, 8
mov edi, 0xffffffff
call fcn.004263d0
mov esi, eax
push 0x1cff
push edi
push 0
push eax
push dword [eax + 0x100]
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
cmp eax, dword [esi + 0x100]
jae 0x405252
push eax
push esi
call fcn.00426470
add esp, 8
push esi
call fcn.004264e0
add esp, 4
lea edi, [esp + 0x18]
jmp 0x405285
push edi
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [esp + 0x1c], 0x8005
jne 0x4051d8
push 1
push 0
push 0
push 0
push edi
call ebx
test eax, eax
je 0x4051d8
cmp dword [esp + 0x1c], 0x12
je 0x4052bb
call fcn.0041da90
mov esi, eax
push eax
call ebp
test eax, eax
je 0x405270
push edi
push esi
call dword [sym.imp.USER32.dll_IsDialogMessageA]
test eax, eax
jne 0x405277
jmp 0x405270
push dword [esp + 0x20]
call fcn.00405da0
int3