Function at 0x448bce
Capabilities:
Get keyboard layout
Read file via mapping
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push esi
mov dword [0x47e578], eax
mov dword [0x47e55c], ebx
mov dword [0x47e558], 5
call fcn.0044b6a2
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
call fcn.00441872
call fcn.0044b20b
test eax, eax
jne 0x448c27
push dword [0x45d510]
push str._s_Fatal_Error
call fcn.0040c314
pop ecx
pop ecx
push 0x30
mov esi, eax
push esi
push str.Windows_refuses_to_report_a_version
jmp 0x448c8c
mov eax, dword [0x47e4a4]
cmp eax, 4
jb 0x448c3c
jne 0x448c4c
cmp dword [0x47e4b0], 2
je 0x448c4c
push str.MSWHEEL_ROLLMSG
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
mov dword [0x47a7f8], eax
call fcn.0044a589
call fcn.00443e72
call fcn.00402097
push ebx
mov dword [0x47e53c], eax
call dword [sym.imp.ole32.dll_CoInitialize]
cmp eax, ebx
je 0x448ca3
cmp eax, 1
je 0x448ca3
push dword [0x45d510]
push str._s_Fatal_Error
call fcn.0040c314
pop ecx
pop ecx
push 0x30
mov esi, eax
push esi
push str.Failed_to_initialize_COM_subsystem
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call fcn.0040bd73
pop ecx
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret 0x10
mov eax, dword [0x45d514]
push eax
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov dword [0x47e534], eax
call fcn.0040f3c5
cmp eax, ebx
pop ecx
mov dword [0x47e540], ebx
je 0x448ccc
mov eax, dword [eax + 0x48]
mov dword [0x47e540], eax
push ebx
push 0x73
push dword [0x47e53c]
call fcn.0040266e
push dword [0x47e53c]
push ebx
call fcn.00411c54
mov edi, dword [ebp + 0x10]
add esp, 0x14
cmp byte [edi], bl
mov esi, edi
je 0x448d20
cmp dword [0x47a8c8], 1
movsx eax, byte [esi]
jle 0x448d0a
push 8
push eax
call fcn.00452fad
pop ecx
pop ecx
jmp 0x448d17
mov ecx, dword [str.________________________________H]
movzx eax, byte [ecx + eax*2]
and eax, 8
cmp eax, ebx
je 0x448d20
inc esi
cmp byte [esi], bl
jne 0x448cf2
mov al, byte [esi]
cmp al, 0x40
jne 0x448e59
push esi
call fcn.00451fa0
pop ecx
mov edi, eax
jmp 0x448d61
cmp dword [0x47a8c8], 1
movsx eax, byte [edi + esi - 1]
jle 0x448d4f
push 8
push eax
call fcn.00452fad
pop ecx
pop ecx
jmp 0x448d5c
mov ecx, dword [str.________________________________H]
movzx eax, byte [ecx + eax*2]
and eax, 8
cmp eax, ebx
je 0x448d66
dec edi
cmp edi, 1
jg 0x448d35
mov byte [edi + esi], bl
push dword [0x47e53c]
inc esi
push esi
call fcn.00411c54
push dword [0x47e53c]
call fcn.0040bd80
add esp, 0xc
test eax, eax
jne 0x448d97
call fcn.004418a5
test eax, eax
jne 0x448d97
push ebx
jmp 0x4497ae
mov dword [ebp - 0xc], 1
push dword [0x47e53c]
call fcn.00401fba
cmp dword [0x47e56c], ebx
pop ecx
jne 0x448db7
cmp dword [ebp - 8], ebx
je 0x448dbe
mov dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], ebx
je 0x448dd3
push dword [0x47e53c]
call fcn.0040bd80
test eax, eax
pop ecx
jne 0x448ddc
call fcn.004418a5
test eax, eax
je 0x448d91
push ebx
push dword [0x47e53c]
call fcn.0040231d
push eax
call fcn.0040c0e7
push 0x463984
push eax
mov dword [ebp + 0x10], eax
call fcn.004541c0
mov esi, eax
add esi, dword [ebp + 0x10]
add esp, 0x14
cmp byte [esi], bl
je 0x448e2e
push 0x40
push esi
call fcn.004546d0
mov edi, eax
cmp edi, ebx
pop ecx
pop ecx
je 0x448e2e
push esi
mov byte [edi], bl
push 0x32
push dword [0x47e53c]
call fcn.00402747
add esp, 0xc
lea esi, [edi + 1]
push 0x3a
push esi
call fcn.0040ba57
mov edi, eax
cmp edi, ebx
pop ecx
pop ecx
je 0x448e51
lea eax, [edi + 1]
push 0x3a
push eax
call fcn.0040ba57
test eax, eax
pop ecx
pop ecx
jne 0x448e51
mov byte [edi], bl
mov ecx, dword [ebp + 0x10]
jmp 0x44915c
cmp al, 0x26
jne 0x448ebe
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push str._p:_u
inc esi
push esi
call fcn.004542b3
add esp, 0x10
cmp eax, 2
jne 0x448d88
push dword [ebp + 0x10]
push ebx
push ebx
push 4
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
cmp esi, ebx
je 0x448d88
push dword [ebp + 0x10]
push esi
push dword [0x47e53c]
call fcn.00402b42
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x448d97
push ebx
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push edi
call fcn.00450a7a
mov ecx, dword [ebp - 0x10]
add esp, 0x10
cmp ecx, ebx
mov dword [ebp + 0x10], ebx
jle 0x448d9e
mov dword [ebp - 4], 1
cmp dword [ebp - 4], ecx
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 0x10]
lea eax, [eax + edx*4]
mov esi, dword [eax]
jge 0x448efa
mov eax, dword [eax + 4]
jmp 0x448efc
xor eax, eax
push dword [0x47e53c]
push 1
push eax
push esi
call fcn.00401189
add esp, 0x10
cmp eax, 0xfffffffe
jne 0x448f1e
push esi
push str.option___s__requires_an_argument
jmp 0x4490a9
cmp eax, 2
jne 0x448f2e
inc dword [ebp + 0x10]
inc dword [ebp - 4]
jmp 0x4490b0
cmp eax, 1
je 0x4490b0
push str._cleanup
push esi
call fcn.00452250
test eax, eax
pop ecx
pop ecx
je 0x4490d0
push str._cleanup_during_uninstall
push esi
call fcn.00452250
test eax, eax
pop ecx
pop ecx
je 0x4490d0
push str._pgpfp
push esi
call fcn.00452250
test eax, eax
pop ecx
pop ecx
je 0x4490c7
cmp byte [esi], 0x2d
je 0x4490a3
cmp dword [ebp - 8], ebx
mov edi, esi
je 0x448fc1
push dword [0x47e53c]
push 1
push esi
push 0x45d6bc
call fcn.00401189
add esp, 0x10
cmp eax, 2
je 0x4490b0
push 0x21d
push str...windowswindow.c
push str.ret__2
call fcn.004522d8
add esp, 0xc
jmp 0x4490b0
push 7
push str.telnet:
push esi
call fcn.00452030
add esp, 0xc
test eax, eax
jne 0x449052
add esi, 7
cmp byte [esi], 0x2f
jne 0x448fe5
cmp byte [esi + 1], 0x2f
jne 0x448fe5
inc esi
inc esi
xor edi, edi
inc edi
push edi
push 2
push dword [0x47e53c]
call fcn.0040266e
push 0x473240
push esi
call fcn.0040ba32
add eax, esi
mov cl, byte [eax]
add esp, 0x14
cmp cl, bl
je 0x44900f
mov byte [eax], bl
inc eax
cmp cl, 0x3a
jne 0x44902c
push eax
call fcn.00452243
push eax
push edi
push dword [0x47e53c]
call fcn.0040266e
add esp, 0x10
jmp 0x44903d
push 0xffffffffffffffff
push edi
push dword [0x47e53c]
call fcn.0040266e
add esp, 0xc
push esi
push ebx
push dword [0x47e53c]
call fcn.00402747
add esp, 0xc
mov dword [ebp - 8], edi
jmp 0x4490b0
cmp byte [esi], bl
je 0x44908a
cmp dword [0x47a8c8], 1
movsx eax, byte [esi]
jle 0x44906e
push 8
push eax
call fcn.00452fad
pop ecx
pop ecx
jmp 0x44907b
mov ecx, dword [str.________________________________H]
movzx eax, byte [ecx + eax*2]
and eax, 8
cmp eax, ebx
jne 0x449084
inc esi
cmp byte [esi], bl
jne 0x449056
cmp byte [esi], bl
je 0x44908a
mov byte [esi], bl
push edi
push ebx
push dword [0x47e53c]
call fcn.00402747
add esp, 0xc
mov dword [ebp - 8], 1
jmp 0x4490b0
push esi
push str.unknown_option___s_
call fcn.00442444
pop ecx
pop ecx
inc dword [ebp + 0x10]
mov ecx, dword [ebp - 0x10]
inc dword [ebp - 4]
cmp dword [ebp + 0x10], ecx
jl 0x448ee5
jmp 0x448d9e
call fcn.00450a15
push 1
jmp 0x449149
push str._cleanup_during_uninstall
push esi
call fcn.00452250
test eax, eax
pop ecx
pop ecx
push dword [0x45d510]
jne 0x4490fe
push str.Remove_saved_sessions_and_random_seed_file__n_nIf_you_hit_Yes__ALL_Registry_entries_associated_nwith__s_will_be_removed__as_well_as_the_nrandom_seed_file._THIS_PROCESS_WILL_nDESTROY_YOUR_SAVED_SESSIONS._n_This_only_affects_the_currently_logged_in_user.__n_nIf_you_hit_No__uninstallation_will_proceed__but_nsaved_sessions_etc_will_be_left_on_the_machine.
call fcn.0040c314
push dword [0x45d510]
push str._s_Uninstallation
jmp 0x449113
push str.This_procedure_will_remove_ALL_Registry_entries_nassociated_with__s__and_will_also_remove_nthe_random_seed_file.__This_only_affects_the_ncurrently_logged_in_user.__n_nTHIS_PROCESS_WILL_DESTROY_YOUR_SAVED_SESSIONS._nAre_you_really_sure_you_want_to_continue_
call fcn.0040c314
push dword [0x45d510]
push str._s_Warning
mov esi, eax
call fcn.0040c314
add esp, 0x10
push 4
mov edi, eax
push 0x134
push edi
push esi
call fcn.004509b8
add esp, 0x10
cmp eax, 6
jne 0x44913a
call fcn.0044fd5e
push esi
call fcn.0040bd73
push edi
call fcn.0040bd73
pop ecx
pop ecx
push ebx
call fcn.00454cba
mov al, byte [esi]
cmp al, 0x20
je 0x44915b
cmp al, 9
je 0x44915b
mov byte [ecx], al
inc ecx
inc esi
cmp byte [esi], bl
jne 0x44914e
push dword [ebp + 0x10]
mov byte [ecx], bl
push ebx
push dword [0x47e53c]
call fcn.00402747
push dword [ebp + 0x10]
call fcn.0040bd73
add esp, 0x10
cmp dword [ebp + 0xc], ebx
jne 0x4491d8
mov eax, dword [ebp + 8]
push 0xc8
push eax
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], 0x446e9c
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], eax
call dword [sym.imp.USER32.dll_LoadIconA]
push 0x7f01
push ebx
mov dword [ebp - 0x38], eax
call dword [sym.imp.USER32.dll_LoadCursorA]
push dword [0x45d510]
mov dword [ebp - 0x34], eax
push ebx
push ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
call fcn.0040c41d
mov dword [ebp - 0x28], eax
add esp, 0xc
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_RegisterClassW]
push 0xb10
push ebx
mov edi, 0x47c150
push edi
call fcn.00452c10
call fcn.00442f67
call fcn.004451af
push 0x6e
push dword [0x47e53c]
mov dword [0x47c140], 0xa
mov dword [0x47cca0], 0x14
mov dword [0x47bdec], 0x19
mov dword [0x47cc94], 0x1c
call fcn.00402219
mov esi, eax
imul esi, dword [0x47c140]
add esi, dword [0x47bdec]
push 0x6f
push dword [0x47e53c]
call fcn.00402219
imul eax, dword [0x47cca0]
add eax, dword [0x47cc94]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x24]
push eax
call fcn.00444eea
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x24]
add esp, 0x20
cmp esi, eax
jle 0x44926c
mov esi, eax
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x20]
cmp dword [ebp - 0xc], eax
jle 0x44927a
mov dword [ebp - 0xc], eax
push dword [0x45d510]
mov dword [ebp + 0x10], 0xef0000
push ebx
push ebx
mov dword [ebp + 0xc], ebx
call fcn.0040c41d
push 0x68
push dword [0x47e53c]
mov dword [ebp - 8], eax
call fcn.00402219
add esp, 0x14
test eax, eax
jne 0x4492af
mov dword [ebp + 0x10], 0xcf0000
push 0x6a
push dword [0x47e53c]
call fcn.00402219
cmp eax, 1
pop ecx
pop ecx
jne 0x4492c7
and byte [ebp + 0x12], 0xfa
push 0x53
push dword [0x47e53c]
call fcn.00402219
test eax, eax
pop ecx
pop ecx
je 0x4492e1
mov dword [ebp + 0xc], 8
push 0x79
push dword [0x47e53c]
call fcn.00402219
test eax, eax
pop ecx
pop ecx
je 0x4492f8
or byte [ebp + 0xd], 2
push ebx
push dword [ebp + 8]
mov eax, 0x80000000
push ebx
push ebx
push dword [ebp - 0xc]
push esi
push eax
push eax
push dword [ebp + 0x10]
push dword [ebp - 8]
push dword [ebp - 8]
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_CreateWindowExW]
push dword [ebp - 8]
mov dword [0x47e55c], eax
call fcn.0040bd73
push ebx
push ebx
call fcn.0044284d
push ebx
push edi
push dword [0x47e53c]
call fcn.0043838c
push dword [0x47e53c]
mov dword [0x47e550], eax
push ebx
call fcn.004093be
push eax
push dword [0x47e550]
mov dword [0x47e544], eax
call fcn.00436cb0
push 0x5b
push dword [0x47e53c]
call fcn.00402219
add esp, 0x30
push eax
push 0x6e
push dword [0x47e53c]
call fcn.00402219
pop ecx
pop ecx
push eax
push 0x6f
push dword [0x47e53c]
call fcn.00402219
pop ecx
pop ecx
push eax
push dword [0x47e550]
call fcn.0043852c
add esp, 0x10
lea eax, [ebp - 0x34]
push eax
push dword [0x47e55c]
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x24]
push eax
push dword [0x47e55c]
call dword [sym.imp.USER32.dll_GetClientRect]
push 0x7a
push dword [0x47e53c]
call fcn.00402219
lea edx, [eax + eax]
mov dword [0x47d0e4], eax
mov dword [0x47cc64], eax
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x1c]
pop ecx
sub eax, dword [ebp - 0x34]
pop ecx
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 0x18]
add eax, dword [ebp - 0x2c]
sub ecx, dword [ebp - 0x30]
add eax, edx
add ecx, dword [ebp - 0x28]
mov dword [0x47bdec], eax
add ecx, edx
mov dword [0x47cc94], ecx
push 0xe
mov edx, dword [0x47e550]
mov esi, dword [edx + 0x128]
imul esi, dword [0x47cca0]
add esi, ecx
mov ecx, dword [edx + 0x12c]
imul ecx, dword [0x47c140]
push esi
add ecx, eax
push ecx
push ebx
push ebx
push ebx
push dword [0x47e55c]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [0x47c140]
add eax, 0xf
push 0x10
pop ecx
cdq
idiv ecx
push 1
mov esi, eax
imul esi, dword [0x47cca0]
shl esi, 1
push esi
call fcn.0040bca9
push esi
mov edi, eax
push ebx
push edi
call fcn.00452c10
add esp, 0x14
push edi
push 1
push 1
push dword [0x47cca0]
push dword [0x47c140]
call dword [sym.imp.GDI32.dll_CreateBitmap]
push edi
mov dword [0x47ccc0], eax
call fcn.0040bd73
pop ecx
push dword [0x47cca0]
push dword [0x47c140]
push dword [0x47ccc0]
push dword [0x47e55c]
call dword [sym.imp.USER32.dll_CreateCaret]
mov eax, dword [0x47e550]
add eax, 0x128
mov dword [ebp - 0x40], 0x1c
mov dword [ebp - 0x3c], 0x1f
mov dword [ebp - 0x38], ebx
mov ecx, dword [eax]
dec ecx
mov dword [ebp - 0x34], ecx
mov eax, dword [eax]
push ebx
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x40]
push eax
push 1
push dword [0x47e55c]
mov dword [ebp - 0x2c], ebx
call dword [sym.imp.USER32.dll_SetScrollInfo]
mov dword [0x47bb88], ebx
mov dword [0x47c144], ebx
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
push ebx
push dword [0x47e55c]
mov dword [0x47cc90], eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
mov dword [0x47bdf8], eax
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov esi, dword [sym.imp.USER32.dll_AppendMenuA]
push str.Paste
push 0x190
push ebx
push eax
mov dword [0x47bdfc], eax
call esi
call dword [sym.imp.USER32.dll_CreateMenu]
push 1
push 0x47cc70
mov dword [0x47ccbc], eax
call fcn.00411a89
pop ecx
pop ecx
call fcn.0044218e
mov dword [ebp + 0x10], ebx
mov edi, 0x800
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 0x47bdf8]
push ebx
push ebx
push edi
push eax
mov dword [ebp + 8], eax
call esi
push str.Event_Log
push 0x10
push ebx
push dword [ebp + 8]
call esi
push ebx
push ebx
push edi
push dword [ebp + 8]
call esi
push str.New_Session...
push 0x20
push ebx
push dword [ebp + 8]
call esi
push str.Duplicate_Session
push 0x30
push ebx
push dword [ebp + 8]
call esi
push str.Saved_Sessions
push dword [0x47ccbc]
push 0x10
push dword [ebp + 8]
call esi
push str.Change_Settings...
push 0x50
push ebx
push dword [ebp + 8]
call esi
push ebx
push ebx
push edi
push dword [ebp + 8]
call esi
push str.Copy_All_to_Clipboard
push 0x170
push ebx
push dword [ebp + 8]
call esi
push str.Clear_Scrollback
push 0x60
push ebx
push dword [ebp + 8]
call esi
push str.Reset_Terminal
push 0x70
push ebx
push dword [ebp + 8]
call esi
push ebx
push ebx
push edi
push dword [ebp + 8]
call esi
push str.Full_Screen
push 0x180
push 0x6a
push dword [0x47e53c]
call fcn.00402219
dec eax
neg eax
pop ecx
sbb eax, eax
pop ecx
inc eax
push eax
push dword [ebp + 8]
call esi
push ebx
push ebx
push edi
push dword [ebp + 8]
call esi
call fcn.0044a6ef
test eax, eax
je 0x449630
push str.Help
push 0x140
push ebx
push dword [ebp + 8]
call esi
push dword [0x45d510]
push str.About__s
call fcn.0040c314
pop ecx
pop ecx
push eax
push 0x150
push ebx
push dword [ebp + 8]
mov dword [ebp + 0xc], eax
call esi
push dword [ebp + 0xc]
call fcn.0040bd73
add dword [ebp + 0x10], 4
cmp dword [ebp + 0x10], 8
pop ecx
jb 0x449550
call fcn.00445c2e
push ebx
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
call fcn.00442e2f
pop ecx
push dword [ebp + 0x14]
push dword [0x47e55c]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x47e55c]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov dword [0x47cca4], ebx
mov dword [0x47bdf4], ebx
call fcn.00442507
call dword [sym.imp.USER32.dll_GetForegroundWindow]
sub eax, dword [0x47e55c]
neg eax
sbb eax, eax
inc eax
push eax
push dword [0x47e550]
call fcn.00437617
pop ecx
pop ecx
push dword [0x47e55c]
call dword [sym.imp.USER32.dll_UpdateWindow]
call fcn.00401087
test eax, eax
jne 0x449711
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x449711
or edi, 0xffffffff
call dword [sym.imp.USER32.dll_GetForegroundWindow]
sub eax, dword [0x47e55c]
neg eax
sbb eax, eax
inc eax
push eax
push dword [0x47e550]
call fcn.00437617
pop ecx
pop ecx
jmp 0x449713
xor edi, edi
lea eax, [ebp + 8]
push eax
call fcn.0044a345
pop ecx
push 0xff
push edi
push ebx
mov esi, eax
push esi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
cmp eax, dword [ebp + 8]
jae 0x449746
push dword [esi + eax*4]
call fcn.0044a444
push esi
call fcn.0040bd73
pop ecx
jmp 0x44974c
push esi
call fcn.0040bd73
mov esi, dword [sym.imp.USER32.dll_PeekMessageW]
pop ecx
jmp 0x449792
cmp dword [ebp - 0x64], 0x12
je 0x4497ab
push dword [0x47e548]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x44977f
lea eax, [ebp - 0x68]
push eax
push dword [0x47e548]
call dword [sym.imp.USER32.dll_IsDialogMessageA]
test eax, eax
jne 0x449789
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [ebp - 0x64], 0x8005
jne 0x4497a1
push 1
push ebx
push ebx
lea eax, [ebp - 0x68]
push ebx
push eax
call esi
test eax, eax
jne 0x449755
call fcn.00401055
jmp 0x4496d2
push dword [ebp - 0x60]
call fcn.004450e7
int3