Function at 0x441d5b
Capabilities:
Get keyboard layout
Read file via mapping
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x68]
sub esp, 0x88
mov eax, dword [ebp + 0x70]
push ebx
xor ebx, ebx
push esi
mov dword [0x477a6c], eax
mov dword [0x477a58], ebx
mov dword [0x474ed4], 5
call fcn.0044404d
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
call fcn.0043b3b9
call fcn.00443e2c
test eax, eax
jne 0x441db9
push dword [0x4554c8]
push str._s_Fatal_Error
call fcn.0040aae5
pop ecx
pop ecx
push 0x30
mov esi, eax
push esi
push str.Windows_refuses_to_report_a_version
jmp 0x441e37
mov eax, dword [0x474e24]
cmp eax, 4
jb 0x441dce
jne 0x441dde
cmp dword [0x474e30], 2
je 0x441dde
push str.MSWHEEL_ROLLMSG
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
mov dword [0x471260], eax
call fcn.00443529
push str.user32.dll
call fcn.00443e55
cmp eax, ebx
pop ecx
je 0x441e05
push str.FlashWindowEx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x473618], eax
jmp 0x441e0b
mov dword [0x473618], ebx
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
cmp eax, ebx
je 0x441e51
cmp eax, 1
je 0x441e51
push dword [0x4554c8]
push str._s_Fatal_Error
call fcn.0040aae5
pop ecx
pop ecx
push 0x30
mov esi, eax
push esi
push str.Failed_to_initialize_COM_subsystem
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call fcn.0040a770
pop ecx
xor eax, eax
pop esi
inc eax
pop ebx
add ebp, 0x68
leave
ret 0x10
mov eax, dword [0x4554cc]
push eax
mov dword [ebp + 0x5c], ebx
mov dword [ebp + 0x60], ebx
mov dword [0x474eb4], eax
call fcn.0040d8da
cmp eax, ebx
pop ecx
mov dword [0x474ebc], ebx
je 0x441e7a
mov eax, dword [eax + 0x48]
mov dword [0x474ebc], eax
mov esi, 0x474ee0
push esi
push ebx
mov dword [0x476df8], ebx
call fcn.0040fe7b
mov edi, dword [ebp + 0x78]
mov eax, edi
cmp byte [eax], bl
pop ecx
pop ecx
je 0x441ec5
cmp dword [0x47131c], 1
movsx eax, byte [edi]
jle 0x441eaf
push 8
push eax
call fcn.0044a775
pop ecx
pop ecx
jmp 0x441ebc
mov ecx, dword [str.________________________________H]
movzx eax, byte [ecx + eax*2]
and eax, 8
cmp eax, ebx
je 0x441ec5
inc edi
cmp byte [edi], bl
jne 0x441e97
mov al, byte [edi]
cmp al, 0x40
jne 0x442521
push edi
call fcn.00449600
cmp eax, 1
pop ecx
mov dword [ebp + 0x78], eax
jle 0x441f15
cmp dword [0x47131c], 1
mov eax, dword [ebp + 0x78]
movsx eax, byte [eax + edi - 1]
jle 0x441efb
push 8
push eax
call fcn.0044a775
pop ecx
pop ecx
jmp 0x441f08
mov ecx, dword [str.________________________________H]
movzx eax, byte [ecx + eax*2]
and eax, 8
cmp eax, ebx
je 0x441f15
dec dword [ebp + 0x78]
cmp dword [ebp + 0x78], 1
jg 0x441ede
mov eax, dword [ebp + 0x78]
mov byte [eax + edi], bl
push esi
inc edi
push edi
call fcn.0040fe7b
push esi
call fcn.0040a77d
add esp, 0xc
test eax, eax
jne 0x441f3f
call fcn.0043b3ec
test eax, eax
jne 0x441f3f
push ebx
jmp 0x442894
mov dword [ebp + 0x60], 1
push esi
call fcn.00401e32
cmp dword [0x477a64], ebx
pop ecx
jne 0x441f5a
cmp dword [ebp + 0x5c], ebx
je 0x441f61
mov dword [ebp + 0x60], 1
cmp dword [ebp + 0x60], ebx
je 0x441f71
push esi
call fcn.0040a77d
test eax, eax
pop ecx
jne 0x441f7a
call fcn.0043b3ec
test eax, eax
je 0x441f39
push 0x469e30
push esi
call fcn.0044c390
push esi
mov edi, eax
call fcn.00449600
xor ecx, ecx
inc ecx
sub ecx, edi
add eax, ecx
push eax
lea eax, [edi + 0x474ee0]
push eax
push esi
call fcn.0044a320
add esp, 0x18
cmp byte [0x474ee0], bl
je 0x441fec
push 0x40
push esi
call fcn.0044b910
mov edi, eax
cmp edi, ebx
pop ecx
pop ecx
je 0x441fec
sub eax, esi
cmp eax, 0x64
jae 0x441fd9
push eax
push esi
push 0x4767f4
call fcn.00449690
add esp, 0xc
mov byte [edi + 0x1914], bl
inc edi
push edi
call fcn.00449600
inc eax
push eax
push edi
push esi
call fcn.0044a320
add esp, 0x10
push 0x3a
push esi
call fcn.00449c60
mov edi, eax
cmp edi, ebx
pop ecx
pop ecx
je 0x44200f
lea eax, [edi + 1]
push 0x3a
push eax
call fcn.00449c60
test eax, eax
pop ecx
pop ecx
jne 0x44200f
mov byte [edi], bl
xor edx, edx
cmp byte [0x474ee0], bl
je 0x442031
mov ecx, esi
mov al, byte [ecx]
cmp al, 0x20
je 0x44202c
cmp al, 9
je 0x44202c
mov byte [edx + 0x474ee0], al
inc edx
inc ecx
cmp byte [ecx], bl
jne 0x44201b
cmp dword [ebp + 0x74], ebx
mov byte [edx + 0x474ee0], bl
jne 0x442088
mov eax, dword [ebp + 0x70]
push 0xc8
push eax
mov dword [ebp - 4], ebx
mov dword [ebp], 0x44032b
mov dword [ebp + 4], ebx
mov dword [ebp + 8], ebx
mov dword [ebp + 0xc], eax
call dword [sym.imp.USER32.dll_LoadIconA]
push 0x7f01
push ebx
mov dword [ebp + 0x10], eax
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [ebp + 0x14], eax
mov eax, dword [0x4554c8]
mov dword [ebp + 0x20], eax
lea eax, [ebp - 4]
push eax
mov dword [ebp + 0x18], ebx
mov dword [ebp + 0x1c], ebx
call dword [sym.imp.USER32.dll_RegisterClassA]
push 0xb10
push ebx
mov edi, 0x472b08
push edi
call fcn.004495a0
call fcn.0043e875
mov eax, dword [0x476c9c]
lea eax, [eax + eax*4]
lea eax, [eax + eax + 0x19]
mov dword [ebp + 0x74], eax
mov eax, dword [0x476ca0]
lea eax, [eax + eax*4]
lea eax, [eax*4 + 0x1c]
mov dword [ebp + 0x78], eax
lea eax, [ebp + 0x48]
push eax
mov dword [0x472af8], 0xa
mov dword [0x473664], 0x14
mov dword [0x4727ac], 0x19
mov dword [0x473658], 0x1c
call fcn.0043e643
mov eax, dword [ebp + 0x50]
sub eax, dword [ebp + 0x48]
add esp, 0x10
cmp dword [ebp + 0x74], eax
jle 0x442101
mov dword [ebp + 0x74], eax
mov eax, dword [ebp + 0x54]
sub eax, dword [ebp + 0x4c]
cmp dword [ebp + 0x78], eax
jle 0x44210f
mov dword [ebp + 0x78], eax
xor ecx, ecx
cmp dword [0x476c84], ebx
mov edx, 0xef0000
jne 0x442123
mov edx, 0xcf0000
cmp dword [0x476c8c], 1
jne 0x442132
and edx, 0xfffaffff
cmp dword [0x476a34], ebx
je 0x44213d
push 8
pop ecx
cmp dword [0x476e10], ebx
je 0x44214b
or ecx, 0x200
push ebx
push dword [ebp + 0x70]
mov eax, 0x80000000
push ebx
push ebx
push dword [ebp + 0x78]
push dword [ebp + 0x74]
push eax
push eax
mov eax, dword [0x4554c8]
push edx
push eax
push eax
push ecx
call dword [sym.imp.USER32.dll_CreateWindowExA]
push ebx
push edi
push esi
mov dword [0x477a58], eax
call fcn.004324d3
push esi
push ebx
mov dword [0x474ecc], eax
call fcn.0040825e
push eax
push dword [0x474ecc]
mov dword [0x474ec0], eax
call fcn.00430bdf
push dword [0x476b50]
push dword [0x476c9c]
push dword [0x476ca0]
push dword [0x474ecc]
call fcn.00432675
push ebx
push ebx
call fcn.0043c3f5
add esp, 0x34
lea eax, [ebp + 0x30]
push eax
push dword [0x477a58]
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp + 0x48]
push eax
push dword [0x477a58]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [0x476e14]
mov ecx, dword [ebp + 0x4c]
sub ecx, dword [ebp + 0x54]
lea edx, [eax + eax]
sub ecx, dword [ebp + 0x34]
mov dword [0x473a98], eax
add ecx, dword [ebp + 0x3c]
mov dword [0x473620], eax
mov eax, dword [ebp + 0x48]
sub eax, dword [ebp + 0x50]
add ecx, edx
sub eax, dword [ebp + 0x30]
mov dword [0x473658], ecx
add eax, dword [ebp + 0x38]
push 0xe
add eax, edx
mov edx, dword [0x474ecc]
mov esi, dword [edx + 0x128]
imul esi, dword [0x473664]
add esi, ecx
mov ecx, dword [edx + 0x12c]
imul ecx, dword [0x472af8]
push esi
add ecx, eax
push ecx
push ebx
push ebx
push ebx
push dword [0x477a58]
mov dword [0x4727ac], eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [0x472af8]
add eax, 0xf
push 0x10
cdq
pop ecx
idiv ecx
push 1
mov esi, eax
imul esi, dword [0x473664]
shl esi, 1
push esi
call fcn.0040a6b0
push esi
mov edi, eax
push ebx
push edi
call fcn.004495a0
add esp, 0x14
push edi
push 1
push 1
push dword [0x473664]
push dword [0x472af8]
call dword [sym.imp.GDI32.dll_CreateBitmap]
push edi
mov dword [0x473678], eax
call fcn.0040a770
pop ecx
push dword [0x473664]
push dword [0x472af8]
push dword [0x473678]
push dword [0x477a58]
call dword [sym.imp.USER32.dll_CreateCaret]
mov eax, dword [0x474ecc]
add eax, 0x128
mov dword [ebp + 0x24], 0x1c
mov dword [ebp + 0x28], 0x1f
mov dword [ebp + 0x2c], ebx
mov ecx, dword [eax]
dec ecx
mov dword [ebp + 0x30], ecx
mov eax, dword [eax]
push ebx
mov dword [ebp + 0x34], eax
lea eax, [ebp + 0x24]
push eax
push 1
push dword [0x477a58]
mov dword [ebp + 0x38], ebx
call dword [sym.imp.USER32.dll_SetScrollInfo]
mov dword [0x4725d8], ebx
mov dword [0x472afc], ebx
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
push ebx
push dword [0x477a58]
mov dword [0x473654], eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
mov dword [0x4727b8], eax
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov esi, dword [sym.imp.USER32.dll_AppendMenuA]
push str.Paste
push 0x190
push ebx
push eax
mov dword [0x4727bc], eax
call esi
call dword [sym.imp.USER32.dll_CreateMenu]
push 1
push 0x47362c
mov dword [0x473674], eax
call fcn.0040fcb0
pop ecx
pop ecx
call fcn.0043bcd0
mov dword [ebp + 0x70], ebx
mov edi, 0x800
mov eax, dword [ebp + 0x70]
mov eax, dword [eax + 0x4727b8]
push ebx
push ebx
push edi
push eax
mov dword [ebp + 0x78], eax
call esi
push str.Event_Log
push 0x10
push ebx
push dword [ebp + 0x78]
call esi
push ebx
push ebx
push edi
push dword [ebp + 0x78]
call esi
push str.New_Session...
push 0x20
push ebx
push dword [ebp + 0x78]
call esi
push str.Duplicate_Session
push 0x30
push ebx
push dword [ebp + 0x78]
call esi
push str.Saved_Sessions
push dword [0x473674]
push 0x10
push dword [ebp + 0x78]
call esi
push str.Change_Settings...
push 0x50
push ebx
push dword [ebp + 0x78]
call esi
push ebx
push ebx
push edi
push dword [ebp + 0x78]
call esi
push str.Copy_All_to_Clipboard
push 0x170
push ebx
push dword [ebp + 0x78]
call esi
push str.Clear_Scrollback
push 0x60
push ebx
push dword [ebp + 0x78]
call esi
push str.Reset_Terminal
push 0x70
push ebx
push dword [ebp + 0x78]
call esi
push ebx
push ebx
push edi
push dword [ebp + 0x78]
call esi
xor eax, eax
cmp dword [0x476c8c], 1
push str.Full_Screen
sete al
push 0x180
push eax
push dword [ebp + 0x78]
call esi
push ebx
push ebx
push edi
push dword [ebp + 0x78]
call esi
call fcn.0044368f
test eax, eax
je 0x44243e
push str.Help
push 0x140
push ebx
push dword [ebp + 0x78]
call esi
push dword [0x4554c8]
push str.About__s
call fcn.0040aae5
pop ecx
pop ecx
push eax
push 0x150
push ebx
push dword [ebp + 0x78]
mov dword [ebp + 0x74], eax
call esi
push dword [ebp + 0x74]
call fcn.0040a770
add dword [ebp + 0x70], 4
cmp dword [ebp + 0x70], 8
pop ecx
jb 0x442367
call fcn.0043f21a
push ebx
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
call fcn.0043c990
pop ecx
push dword [ebp + 0x7c]
push dword [0x477a58]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x477a58]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov dword [0x473668], ebx
mov dword [0x4727b4], ebx
call fcn.0043c0bc
call dword [sym.imp.USER32.dll_GetForegroundWindow]
sub eax, dword [0x477a58]
neg eax
sbb eax, eax
inc eax
push eax
push dword [0x474ecc]
call fcn.0043190f
pop ecx
pop ecx
push dword [0x477a58]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov edi, dword [sym.imp.USER32.dll_PeekMessageA]
lea eax, [ebp + 0x78]
push eax
call fcn.0044330b
pop ecx
push 0xff
push 0xffffffffffffffff
push ebx
mov esi, eax
push esi
push dword [ebp + 0x78]
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
cmp eax, dword [ebp + 0x78]
jae 0x4427f2
push dword [esi + eax*4]
call fcn.00443405
push esi
call fcn.0040a770
pop ecx
jmp 0x44283e
cmp al, 0x26
jne 0x442583
lea eax, [ebp + 0x78]
push eax
push 0x469d70
inc edi
push edi
call fcn.0044b8d5
add esp, 0xc
cmp eax, 1
jne 0x441f30
push 0x2b78
push ebx
push ebx
push 4
push dword [ebp + 0x78]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, ebx
je 0x441f30
mov esi, eax
mov ecx, 0xade
mov edi, 0x474ee0
push eax
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp + 0x78]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 0x474ee0
jmp 0x441f3f
push ebx
lea eax, [ebp + 0x44]
push eax
lea eax, [ebp + 0x58]
push eax
push dword [ebp + 0x78]
call fcn.004484a3
mov ecx, dword [ebp + 0x58]
add esp, 0x10
cmp ecx, ebx
mov dword [ebp + 0x78], ebx
jle 0x441f46
mov dword [ebp + 0x64], 1
cmp dword [ebp + 0x64], ecx
mov eax, dword [ebp + 0x44]
mov edx, dword [ebp + 0x78]
lea eax, [eax + edx*4]
mov edi, dword [eax]
jge 0x4425c1
mov eax, dword [eax + 4]
jmp 0x4425c3
xor eax, eax
push esi
push 1
push eax
push edi
call fcn.00401118
add esp, 0x10
cmp eax, 0xfffffffe
jne 0x4425e0
push edi
push str.option___s__requires_an_argument
jmp 0x44274d
cmp eax, 2
jne 0x4425f0
inc dword [ebp + 0x78]
inc dword [ebp + 0x64]
jmp 0x442754
cmp eax, 1
je 0x442754
push str._cleanup
push edi
call fcn.00449d20
test eax, eax
pop ecx
pop ecx
je 0x442774
push str._cleanup_during_uninstall
push edi
call fcn.00449d20
test eax, eax
pop ecx
pop ecx
je 0x442774
push str._pgpfp
push edi
call fcn.00449d20
test eax, eax
pop ecx
pop ecx
je 0x44276b
cmp byte [edi], 0x2d
je 0x442747
cmp dword [ebp + 0x5c], ebx
mov dword [ebp + 0x40], edi
je 0x44267f
push esi
push 1
push edi
push 0x455654
call fcn.00401118
add esp, 0x10
cmp eax, 2
je 0x442754
push 0x20e
push str...windowswindow.c
push str.ret__2
call fcn.00449e00
add esp, 0xc
jmp 0x442754
push 7
push str.telnet:
push edi
call fcn.004497c0
add esp, 0xc
test eax, eax
jne 0x442705
add edi, 7
cmp byte [edi], 0x2f
jne 0x4426a3
cmp byte [edi + 1], 0x2f
jne 0x4426a3
inc edi
inc edi
mov dword [0x4750e4], 1
cmp byte [edi], bl
mov eax, edi
je 0x4426c4
mov cl, byte [eax]
cmp cl, 0x3a
je 0x4426c4
cmp cl, 0x2f
je 0x4426c4
inc eax
cmp byte [eax], bl
jne 0x4426b3
mov cl, byte [eax]
cmp cl, bl
je 0x4426cd
mov byte [eax], bl
inc eax
cmp cl, 0x3a
jne 0x4426e0
push eax
call fcn.004498fe
pop ecx
mov dword [0x4750e0], eax
jmp 0x4426e7
or dword [0x4750e0], 0xffffffff
push 0x1ff
push edi
push esi
call fcn.00449690
add esp, 0xc
mov byte [0x4750df], bl
mov dword [ebp + 0x5c], 1
jmp 0x442754
cmp byte [edi], bl
je 0x44273d
cmp dword [0x47131c], 1
movsx eax, byte [edi]
jle 0x442721
push 8
push eax
call fcn.0044a775
pop ecx
pop ecx
jmp 0x44272e
mov ecx, dword [str.________________________________H]
movzx eax, byte [ecx + eax*2]
and eax, 8
cmp eax, ebx
jne 0x442737
inc edi
cmp byte [edi], bl
jne 0x442709
cmp byte [edi], bl
je 0x44273d
mov byte [edi], bl
push 0x1ff
push dword [ebp + 0x40]
jmp 0x4426ed
push edi
push str.unknown_option___s_
call fcn.0043bfde
pop ecx
pop ecx
inc dword [ebp + 0x78]
mov ecx, dword [ebp + 0x58]
inc dword [ebp + 0x64]
cmp dword [ebp + 0x78], ecx
jl 0x4425ac
jmp 0x441f46
call fcn.0044848c
push 1
jmp 0x4427ed
push str._cleanup_during_uninstall
push edi
call fcn.00449d20
test eax, eax
pop ecx
pop ecx
push dword [0x4554c8]
jne 0x4427a2
push str.Remove_saved_sessions_and_random_seed_file__n_nIf_you_hit_Yes__ALL_Registry_entries_associated_nwith__s_will_be_removed__as_well_as_the_nrandom_seed_file._THIS_PROCESS_WILL_nDESTROY_YOUR_SAVED_SESSIONS._n_This_only_affects_the_currently_logged_in_user.__n_nIf_you_hit_No__uninstallation_will_proceed__but_nsaved_sessions_etc_will_be_left_on_the_machine.
call fcn.0040aae5
push dword [0x4554c8]
push str._s_Uninstallation
jmp 0x4427b7
push str.This_procedure_will_remove_ALL_Registry_entries_nassociated_with__s__and_will_also_remove_nthe_random_seed_file.__This_only_affects_the_ncurrently_logged_in_user.__n_nTHIS_PROCESS_WILL_DESTROY_YOUR_SAVED_SESSIONS._nAre_you_really_sure_you_want_to_continue_
call fcn.0040aae5
push dword [0x4554c8]
push str._s_Warning
mov esi, eax
call fcn.0040aae5
add esp, 0x10
push 4
mov edi, eax
push 0x134
push edi
push esi
call fcn.0044842f
add esp, 0x10
cmp eax, 6
jne 0x4427de
call fcn.00447703
push esi
call fcn.0040a770
push edi
call fcn.0040a770
pop ecx
pop ecx
push ebx
call fcn.0044c347
push esi
call fcn.0040a770
pop ecx
jmp 0x44284c
cmp dword [ebp - 0x1c], 0x12
je 0x442891
push dword [0x474ec4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x442829
lea eax, [ebp - 0x20]
push eax
push dword [0x474ec4]
call dword [sym.imp.USER32.dll_IsDialogMessageA]
test eax, eax
jne 0x442833
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push dword [0x474ecc]
call fcn.00430ab8
cmp dword [0x4727a4], ebx
pop ecx
je 0x44284c
call fcn.0043e76a
push 1
push ebx
push ebx
lea eax, [ebp - 0x20]
push ebx
push eax
call edi
test eax, eax
jne 0x4427fb
call dword [sym.imp.USER32.dll_GetForegroundWindow]
sub eax, dword [0x477a58]
neg eax
sbb eax, eax
inc eax
push eax
push dword [0x474ecc]
call fcn.0043190f
cmp dword [0x473ac4], ebx
pop ecx
pop ecx
je 0x442887
call fcn.0043c02c
call fcn.00445599
jmp 0x4424e6
push dword [ebp - 0x18]
call fcn.0043e82c
int3