Function at 0x44d580
Capabilities:
Get keyboard layout
Read file via mapping
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x80
push ebp
xor ebp, ebp
push esi
mov dword [0x48a974], eax
mov dword [0x48a960], ebp
mov dword [0x487d74], 5
call fcn.0044fe70
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
call fcn.004456c0
call fcn.0044fbd0
test eax, eax
jne 0x44d5fa
mov ecx, dword [0x469550]
push ecx
push 0x47bee8
call fcn.0040cc90
add esp, 8
push 0x30
mov esi, eax
push esi
push str.Windows_refuses_to_report_a_version
push ebp
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call fcn.0040c850
add esp, 4
pop esi
mov eax, 1
pop ebp
add esp, 0x80
ret 0x10
mov eax, dword [0x487cc4]
cmp eax, 4
jb 0x44d60f
jne 0x44d61f
cmp dword [0x487cd0], 2
je 0x44d61f
push str.MSWHEEL_ROLLMSG
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
mov dword [0x483248], eax
call fcn.0044f060
call fcn.00448d30
push ebp
call dword [sym.imp.ole32.dll_CoInitialize]
cmp eax, ebp
je 0x44d659
cmp eax, 1
je 0x44d659
mov edx, dword [0x469550]
push edx
push 0x47bee8
call fcn.0040cc90
add esp, 8
push 0x30
mov esi, eax
push esi
push str.Failed_to_initialize_COM_subsystem
jmp 0x44d5da
mov eax, dword [0x469554]
push eax
mov dword [esp + 0x10], ebp
mov dword [0x487d54], eax
call fcn.004105e0
add esp, 4
mov dword [0x487d5c], ebp
cmp eax, ebp
je 0x44d682
mov eax, dword [eax + 0x48]
mov dword [0x487d5c], eax
push edi
push 0x487d80
push ebp
mov dword [0x489cfc], ebp
call fcn.00412f90
mov edi, dword [esp + 0xa0]
add esp, 8
cmp byte [edi], 0
mov esi, edi
je 0x44d6bb
movsx ecx, byte [esi]
push ecx
call fcn.00457701
add esp, 4
test eax, eax
je 0x44d6bb
inc esi
cmp byte [esi], 0
jne 0x44d6a5
mov al, byte [esi]
push ebx
cmp al, 0x40
jne 0x44d728
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x44d6c7
sub eax, edx
mov edi, eax
cmp edi, 1
jle 0x44d6f8
jmp 0x44d6e0
movsx edx, byte [esi + edi - 1]
push edx
call fcn.00457701
add esp, 4
test eax, eax
je 0x44d6f8
dec edi
cmp edi, 1
jg 0x44d6e0
mov byte [edi + esi], 0
push 0x487d80
inc esi
push esi
call fcn.00412f90
push 0x487d80
call fcn.0040c870
add esp, 0xc
test eax, eax
jne 0x44d788
call fcn.00445700
test eax, eax
jne 0x44d788
push ebp
call fcn.00449410
cmp al, 0x26
jne 0x44d7d8
lea eax, [esp + 0x14]
push eax
push 0x47be8c
inc esi
push esi
call fcn.004593a8
add esp, 0xc
cmp eax, 1
jne 0x44d719
mov ecx, dword [esp + 0x14]
push 0x2be0
push ebp
push ebp
push 4
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
cmp esi, ebp
je 0x44d719
push 0x2be0
push esi
push 0x487d80
call fcn.00456ba0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x14], 1
push 0x487d80
call fcn.00402730
add esp, 4
cmp dword [0x48a96c], 0
jne 0x44d7b0
test ebp, ebp
jne 0x44d7b0
cmp dword [esp + 0x14], ebp
je 0x44d7c5
push 0x487d80
call fcn.0040c870
add esp, 4
test eax, eax
jne 0x44dab2
call fcn.00445700
test eax, eax
jne 0x44dab2
push eax
call fcn.00449410
push 0
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x20]
push ecx
push edi
call fcn.00455140
mov eax, dword [esp + 0x28]
add esp, 0x10
xor ebx, ebx
test eax, eax
jle 0x44d790
mov dword [esp + 0x10], 1
nop
cmp dword [esp + 0x10], eax
mov ecx, dword [esp + 0x1c]
mov esi, dword [ecx + ebx*4]
jge 0x44d813
mov eax, dword [ecx + ebx*4 + 4]
jmp 0x44d815
xor eax, eax
push 0x487d80
push 1
push eax
push esi
call fcn.00401140
add esp, 0x10
cmp eax, 0xfffffffe
je 0x44d9e4
cmp eax, 2
jne 0x44d83e
inc ebx
inc dword [esp + 0x10]
jmp 0x44d9ce
cmp eax, 1
je 0x44d9ce
mov ecx, str._cleanup
mov eax, esi
mov edi, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x44d870
test dl, dl
je 0x44d86c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x44d870
add eax, 2
add ecx, 2
test dl, dl
jne 0x44d850
xor eax, eax
jmp 0x44d875
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x44da06
mov ecx, str._cleanup_during_uninstall
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x44d8a4
test dl, dl
je 0x44d8a0
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x44d8a4
add eax, 2
add ecx, 2
test dl, dl
jne 0x44d884
xor eax, eax
jmp 0x44d8a9
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x44da06
mov ecx, str._pgpfp
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x44d8d8
test dl, dl
je 0x44d8d4
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x44d8d8
add eax, 2
add ecx, 2
test dl, dl
jne 0x44d8b8
xor eax, eax
jmp 0x44d8dd
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x44d9ef
cmp byte [esi], 0x2d
je 0x44d9fb
mov edi, esi
test ebp, ebp
je 0x44d90e
push 0x487d80
push 1
push esi
push 0x4696d4
call fcn.00401140
add esp, 0x10
jmp 0x44d9ce
push 7
push str.telnet:
push esi
call fcn.00456714
add esp, 0xc
test eax, eax
jne 0x44d98d
add esi, 7
cmp byte [esi], 0x2f
jne 0x44d933
cmp byte [esi + 1], 0x2f
jne 0x44d933
add esi, 2
mov dword [0x487f84], 1
cmp byte [esi], 0
mov eax, esi
je 0x44d956
mov cl, byte [eax]
cmp cl, 0x3a
je 0x44d956
cmp cl, 0x2f
je 0x44d956
inc eax
cmp byte [eax], 0
jne 0x44d944
mov cl, byte [eax]
test cl, cl
je 0x44d960
mov byte [eax], 0
inc eax
cmp cl, 0x3a
jne 0x44d97b
push eax
call fcn.00456abc
add esp, 4
push 0x1ff
mov dword [0x487f80], eax
push esi
jmp 0x44d9b5
push 0x1ff
mov dword [0x487f80], 0xffffffff
push esi
jmp 0x44d9b5
cmp byte [esi], 0
je 0x44d9af
movsx edx, byte [esi]
push edx
call fcn.00457701
add esp, 4
test eax, eax
jne 0x44d9a7
inc esi
cmp byte [esi], al
jne 0x44d992
cmp byte [esi], 0
je 0x44d9af
mov byte [esi], 0
push 0x1ff
push edi
push 0x487d80
call fcn.004565f0
mov ebp, 1
mov byte [0x487f7f], 0
add esp, 0xc
mov eax, dword [esp + 0x18]
inc dword [esp + 0x10]
inc ebx
cmp ebx, eax
jl 0x44d800
jmp 0x44d790
push esi
push str.option___s__requires_an_argument
call fcn.00446520
call fcn.00455120
push 1
call fcn.0045a46c
push esi
push str.unknown_option___s_
call fcn.00446520
mov ecx, str._cleanup_during_uninstall
mov eax, esi
lea ecx, [ecx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x44da30
test dl, dl
je 0x44da2c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x44da30
add eax, 2
add ecx, 2
test dl, dl
jne 0x44da10
xor eax, eax
jmp 0x44da35
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x44da59
mov eax, dword [0x469550]
push eax
push str.Remove_saved_sessions_and_random_seed_file__n_nIf_you_hit_Yes__ALL_Registry_entries_associated_nwith__s_will_be_removed__as_well_as_the_nrandom_seed_file._THIS_PROCESS_WILL_nDESTROY_YOUR_SAVED_SESSIONS._n_This_only_affects_the_currently_logged_in_user.__n_nIf_you_hit_No__uninstallation_will_proceed__but_nsaved_sessions_etc_will_be_left_on_the_machine.
call fcn.0040cc90
mov ecx, dword [0x469550]
push ecx
mov esi, eax
push str._s_Uninstallation
jmp 0x44da77
mov edx, dword [0x469550]
push edx
push str.This_procedure_will_remove_ALL_Registry_entries_nassociated_with__s__and_will_also_remove_nthe_random_seed_file.__This_only_affects_the_ncurrently_logged_in_user.__n_nTHIS_PROCESS_WILL_DESTROY_YOUR_SAVED_SESSIONS._n
call fcn.0040cc90
mov esi, eax
mov eax, dword [0x469550]
push eax
push 0x47bbbc
call fcn.0040cc90
add esp, 0x10
push 4
mov edi, eax
push 0x134
push edi
push esi
call fcn.004550b0
add esp, 0x10
cmp eax, 6
jne 0x44da9c
call fcn.004541a0
push esi
call fcn.0040c850
push edi
call fcn.0040c850
add esp, 8
push 0
call fcn.0045a46c
push 0x47bbb8
push 0x487d80
call fcn.0045a510
mov ecx, 0x487d80
add esp, 8
lea esi, [ecx + 1]
lea esp, [esp]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x44dad0
sub ecx, esi
sub ecx, eax
inc ecx
push ecx
lea ecx, [eax + 0x487d80]
push ecx
push 0x487d80
call fcn.00456fd0
add esp, 0xc
cmp byte [0x487d80], 0
je 0x44db5b
push 0x40
push 0x487d80
call fcn.004593d0
mov esi, eax
xor edi, edi
add esp, 8
cmp esi, edi
je 0x44db5d
sub eax, 0x487d80
cmp eax, 0x64
jae 0x44db35
push eax
push 0x487d80
push 0x489694
call fcn.004565f0
add esp, 0xc
mov byte [esi + 0x1914], 0
lea edx, [esi + 1]
mov eax, edx
lea esi, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x44db40
sub eax, esi
inc eax
push eax
push edx
push 0x487d80
call fcn.00456fd0
add esp, 0xc
jmp 0x44db5d
xor edi, edi
push 0x3a
push 0x487d80
call fcn.00456ae0
mov esi, eax
add esp, 8
cmp esi, edi
je 0x44db86
lea edx, [esi + 1]
push 0x3a
push edx
call fcn.00456ae0
add esp, 8
test eax, eax
jne 0x44db86
mov byte [esi], al
xor edx, edx
cmp byte [0x487d80], dl
je 0x44dbac
mov ecx, 0x487d80
mov al, byte [ecx]
cmp al, 0x20
je 0x44dba6
cmp al, 9
je 0x44dba6
mov byte [edx + 0x487d80], al
inc edx
inc ecx
cmp byte [ecx], 0
jne 0x44db95
mov byte [edx + 0x487d80], 0
cmp dword [esp + 0x98], edi
jne 0x44dc29
mov eax, dword [esp + 0x94]
push 0xc8
push eax
mov dword [esp + 0x70], edi
mov dword [esp + 0x74], 0x44b510
mov dword [esp + 0x78], edi
mov dword [esp + 0x7c], edi
mov dword [esp + 0x80], eax
call dword [sym.imp.USER32.dll_LoadIconA]
push 0x7f01
push edi
mov dword [esp + 0x84], eax
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [esp + 0x80], eax
mov eax, dword [0x469550]
lea ecx, [esp + 0x68]
push ecx
mov dword [esp + 0x88], edi
mov dword [esp + 0x8c], edi
mov dword [esp + 0x90], eax
call dword [sym.imp.USER32.dll_RegisterClassA]
push 0xb10
push 0
push 0x485280
call fcn.00456570
add esp, 0xc
call fcn.00449460
mov eax, dword [0x489ba0]
lea edi, [eax + eax*4]
mov eax, dword [0x489ba4]
lea ebp, [eax + eax*4]
mov ebx, 0x1c
lea esi, [esp + 0x20]
mov dword [0x485274], 0xa
mov dword [0x485ddc], 0x14
mov dword [0x484f28], 0x19
mov dword [0x485dd0], ebx
lea edi, [edi + edi + 0x19]
lea ebp, [ebp*4 + 0x1c]
call fcn.004491d0
mov eax, dword [esp + 0x28]
sub eax, dword [esp + 0x20]
cmp edi, eax
jle 0x44dc9d
mov edi, eax
mov eax, dword [esp + 0x2c]
sub eax, dword [esp + 0x24]
cmp ebp, eax
jle 0x44dcab
mov ebp, eax
xor ecx, ecx
mov eax, 0xef0000
cmp dword [0x489b88], ecx
jne 0x44dcbf
mov eax, 0xcf0000
cmp dword [0x489b90], 1
jne 0x44dccd
and eax, 0xfffaffff
cmp dword [0x489938], 0
je 0x44dcdb
mov ecx, 8
cmp dword [0x489d14], 0
je 0x44dcea
or ecx, 0x200
mov edx, dword [esp + 0x94]
push 0
push edx
push 0
push 0
push ebp
push edi
push 0x80000000
push 0x80000000
push eax
mov eax, dword [0x469550]
push eax
push eax
push ecx
call dword [sym.imp.USER32.dll_CreateWindowExA]
push 0
push 0x485280
push 0x487d80
mov dword [0x48a960], eax
call fcn.0043b530
push 0x487d80
push 0
mov dword [0x487d6c], eax
call fcn.00409760
push eax
mov dword [0x487d60], eax
mov eax, dword [0x487d6c]
push eax
call fcn.00439790
mov ecx, dword [0x489a54]
mov edx, dword [0x489ba0]
mov eax, dword [0x489ba4]
push ecx
mov ecx, dword [0x487d6c]
push edx
push eax
push ecx
call fcn.0043b6f0
push 0
push 0
call fcn.00446a30
mov eax, dword [0x48a960]
add esp, 0x34
lea edx, [esp + 0x30]
push edx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [0x48a960]
lea ecx, [esp + 0x20]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [0x489d18]
mov ecx, dword [esp + 0x24]
sub ecx, dword [esp + 0x2c]
lea edx, [eax + eax]
sub ecx, dword [esp + 0x34]
mov dword [0x485df4], eax
add ecx, dword [esp + 0x3c]
mov dword [0x485d98], eax
mov eax, dword [esp + 0x20]
sub eax, dword [esp + 0x28]
add ecx, edx
sub eax, dword [esp + 0x30]
mov dword [0x485dd0], ecx
add eax, dword [esp + 0x38]
push 0xe
add eax, edx
mov edx, dword [0x487d6c]
mov esi, dword [edx + 0x128]
imul esi, dword [0x485ddc]
add esi, ecx
mov ecx, dword [edx + 0x12c]
imul ecx, dword [0x485274]
push esi
add ecx, eax
push ecx
push 0
push 0
mov dword [0x484f28], eax
push 0
mov edx, dword [0x48a960]
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [0x485274]
add eax, 0xf
cdq
and edx, 0xf
add eax, edx
mov esi, eax
sar esi, 4
imul esi, dword [0x485ddc]
add esi, esi
push 1
push esi
call fcn.0040c6e0
push esi
xor ebp, ebp
mov edi, eax
push ebp
push edi
call fcn.00456570
mov eax, dword [0x485ddc]
mov ecx, dword [0x485274]
add esp, 0x14
push edi
push 1
push 1
push eax
push ecx
call dword [sym.imp.GDI32.dll_CreateBitmap]
push edi
mov dword [0x485df0], eax
call fcn.0040c850
mov edx, dword [0x485ddc]
mov eax, dword [0x485274]
mov ecx, dword [0x485df0]
add esp, 4
push edx
mov edx, dword [0x48a960]
push eax
push ecx
push edx
call dword [sym.imp.USER32.dll_CreateCaret]
mov eax, dword [0x487d6c]
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], 0x1f
mov dword [esp + 0x38], ebp
mov ecx, dword [eax + 0x128]
dec ecx
mov dword [esp + 0x3c], ecx
mov edx, dword [eax + 0x128]
mov ecx, dword [0x48a960]
push ebp
lea eax, [esp + 0x34]
push eax
push 1
push ecx
mov dword [esp + 0x50], edx
mov dword [esp + 0x54], ebp
call dword [sym.imp.USER32.dll_SetScrollInfo]
mov dword [0x484d58], ebp
mov dword [0x485278], ebp
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
mov edx, dword [0x48a960]
push ebp
push edx
mov dword [0x485dcc], eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
mov dword [0x484f34], eax
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov edi, dword [sym.imp.USER32.dll_AppendMenuA]
push 0x47bbac
push 0x190
push ebp
push eax
mov dword [0x484f38], eax
call edi
call dword [sym.imp.USER32.dll_CreateMenu]
push 1
mov dword [0x485dec], eax
push 0x485da4
call fcn.00412d10
add esp, 8
call fcn.004461d0
jmp 0x44df40
mov esi, dword [ebp + 0x484f34]
push 0
push 0
push 0x800
push esi
call edi
push 0x47bb98
push 0x10
push 0
push esi
call edi
push 0
push 0
push 0x800
push esi
call edi
push 0x47bb88
push 0x20
push 0
push esi
call edi
push 0x47bb78
push 0x30
push 0
push esi
call edi
mov eax, dword [0x485dec]
push 0x47bb68
push eax
push 0x10
push esi
call edi
push 0x47bb58
push 0x50
push 0
push esi
call edi
push 0
push 0
push 0x800
push esi
call edi
push 0x47bb3c
push 0x170
push 0
push esi
call edi
push 0x47bb2c
push 0x60
push 0
push esi
call edi
push 0x47bb1c
push 0x70
push 0
push esi
call edi
push 0
push 0
push 0x800
push esi
call edi
xor ecx, ecx
cmp dword [0x489b90], 1
push 0x47bb10
sete cl
push 0x180
push ecx
push esi
call edi
push 0
push 0
push 0x800
push esi
call edi
call fcn.0044f230
test eax, eax
je 0x44e01b
push 0x47bb04
push 0x140
push 0
push esi
call edi
mov edx, dword [0x469550]
push edx
push 0x47baf8
call fcn.0040cc90
add esp, 8
mov ebx, eax
push ebx
push 0x150
push 0
push esi
call edi
push ebx
call fcn.0040c850
add ebp, 4
add esp, 4
cmp ebp, 8
jb 0x44df40
call fcn.00449ec0
xor ebx, ebx
push ebx
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
call fcn.00447050
mov eax, dword [esp + 0xa4]
mov ecx, dword [0x48a960]
add esp, 4
push eax
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [0x48a960]
push edx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov dword [0x485de0], ebx
mov dword [0x484f30], ebx
call fcn.00446630
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edx, dword [0x487d6c]
xor ecx, ecx
cmp eax, dword [0x48a960]
sete cl
push ecx
push edx
call fcn.0043a750
mov eax, dword [0x48a960]
add esp, 8
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov ebp, dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov edi, dword [sym.imp.USER32.dll_PeekMessageA]
lea ecx, [esp + 0x18]
push ecx
call fcn.0044ee30
mov edx, dword [esp + 0x1c]
add esp, 4
push 0x4ff
push 0xffffffffffffffff
push ebx
mov esi, eax
push esi
push edx
call ebp
cmp eax, dword [esp + 0x18]
jae 0x44e11a
mov eax, dword [esi + eax*4]
push eax
call fcn.0044ef50
push esi
call fcn.0040c850
add esp, 8
cmp dword [0x484e64], ebx
je 0x44e123
call fcn.00449320
jmp 0x44e123
push esi
call fcn.0040c850
add esp, 4
push 1
push ebx
push ebx
push ebx
lea ecx, [esp + 0x5c]
push ecx
call edi
test eax, eax
je 0x44e1a4
mov esi, dword [sym.imp.USER32.dll_IsWindow]
lea esp, [esp]
cmp dword [esp + 0x50], 0x12
je 0x44e1db
mov edx, dword [0x487d64]
push edx
call esi
test eax, eax
je 0x44e16e
mov ecx, dword [0x487d64]
lea eax, [esp + 0x4c]
push eax
push ecx
call dword [sym.imp.USER32.dll_IsDialogMessageA]
test eax, eax
jne 0x44e179
lea edx, [esp + 0x4c]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageA]
mov eax, dword [0x487d6c]
push eax
call fcn.00439630
add esp, 4
cmp dword [0x484e64], ebx
je 0x44e194
call fcn.00449320
push 1
push ebx
push ebx
push ebx
lea ecx, [esp + 0x5c]
push ecx
call edi
test eax, eax
jne 0x44e140
call dword [sym.imp.USER32.dll_GetForegroundWindow]
xor edx, edx
cmp eax, dword [0x48a960]
mov eax, dword [0x487d6c]
sete dl
push edx
push eax
call fcn.0043a750
add esp, 8
cmp dword [0x486238], ebx
je 0x44e1d1
call fcn.00446580
call fcn.00451640
jmp 0x44e0d4
mov ecx, dword [esp + 0x54]
push ecx
call fcn.00449410
int3