Function at 0x456450
Capabilities:
Get keyboard layout
Read file via mapping
Resolve function by parsing pe exports
Terminate process

Disassembly:
sub esp, 0x70
mov eax, dword [0x4adadc]
xor eax, esp
mov dword [esp + 0x6c], eax
push ebx
mov ebx, dword [esp + 0x78]
push esi
push edi
mov edi, dword [esp + 0x88]
mov dword [esp + 0x10], ebx
call fcn.0045ddf1
mov dword [0x4b27c8], ebx
call fcn.0045f18b
call fcn.00450422
call fcn.0045da23
call fcn.00453588
call fcn.0045e16d
mov eax, dword [0x4b27c4]
cmp eax, 4
jb 0x4564a9
jne 0x4564b9
cmp dword [0x4b27bc], 2
je 0x4564b9
push str.MSWHEEL_ROLLMSG
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
mov dword [0x4adac0], eax
call fcn.0045d05c
call fcn.0045abd8
call fcn.00403560
push 0
mov dword [0x4af738], eax
call dword [sym.imp.ole32.dll_CoInitialize]
xor ecx, ecx
inc ecx
test eax, eax
je 0x456524
cmp eax, ecx
je 0x456524
push dword [0x48567c]
push str._s_Fatal_Error
call fcn.0044dc6c
pop ecx
pop ecx
push 0x30
mov esi, eax
push esi
push str.Failed_to_initialize_COM_subsystem
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call fcn.0040dab8
pop ecx
xor ecx, ecx
pop edi
pop esi
pop ebx
lea eax, [ecx + 1]
mov ecx, dword [esp + 0x6c]
xor ecx, esp
call fcn.004659d6
add esp, 0x70
ret 0x10
push dword [0x485678]
mov byte [esp + 0x13], 0
call fcn.00418b6e
push dword [0x485678]
call fcn.00415ed9
push 0
mov esi, eax
call fcn.00418b64
add esp, 0xc
test esi, esi
je 0x456558
push dword [esi + 0x4c]
call fcn.00418b64
pop ecx
push 0
push 0x7f
push dword [0x4af738]
call fcn.004037b8
push dword [0x4af738]
push 0
call fcn.00415eff
add esp, 0x14
mov esi, edi
cmp byte [edi], 0
je 0x456592
movsx eax, byte [esi]
push eax
call fcn.00471f6a
pop ecx
test eax, eax
je 0x456592
inc esi
cmp byte [esi], 0
jne 0x45657e
cmp byte [esi], 0x26
push ebp
jne 0x4565b5
cmp byte [esi + 1], 0x52
jne 0x4565b5
mov al, byte [esi + 2]
test al, al
je 0x4565ad
cmp al, 0x40
je 0x4565ad
cmp al, 0x26
jne 0x4565b5
call fcn.00461dae
add esi, 2
mov al, byte [esi]
cmp al, 0x40
jne 0x456620
push esi
call fcn.0046a0b0
xor ebp, ebp
mov edi, eax
pop ecx
inc ebp
jmp 0x4565da
movsx ecx, byte [esi + edi - 1]
push ecx
call fcn.00471f6a
pop ecx
test eax, eax
je 0x4565de
dec edi
cmp edi, ebp
jg 0x4565c9
push dword [0x4af738]
lea eax, [esi + 1]
mov byte [edi + esi], 0
push eax
call fcn.00415eff
push dword [0x4af738]
call fcn.0040f9a7
add esp, 0xc
test al, al
jne 0x4566a7
push dword [0x4af738]
call fcn.004535bb
pop ecx
test al, al
jne 0x4566a7
jmp 0x456f02
cmp al, 0x26
jne 0x456767
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esi + 1]
push str._p:_u
push eax
call fcn.00415575
add esp, 0x10
cmp eax, 2
jne 0x456607
push dword [esp + 0x1c]
push 0
push 0
push 4
push dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
je 0x456607
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x44]
and dword [esp + 0x48], 0
and dword [esp + 0x50], 0
push eax
push dword [0x4af738]
mov dword [esp + 0x4c], esi
mov dword [esp + 0x54], ecx
mov dword [esp + 0x5c], eax
call fcn.00402eec
pop ecx
pop ecx
test al, al
je 0x456f09
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
mov byte [esp + 0x13], al
push dword [0x4af738]
call fcn.00402b36
cmp byte [esp + 0x17], 0
pop ecx
jne 0x4566e5
push dword [0x4af738]
call fcn.004017f1
pop ecx
test al, al
jne 0x4566e5
push dword [0x4af738]
call fcn.004535bb
pop ecx
test al, al
je 0x456f02
push dword [0x4af738]
call fcn.00415dff
cmp dword [esp + 0x8c], 0
pop ecx
jne 0x45687e
xor eax, eax
mov dword [esp + 0x48], 0x456f38
push 0xc8
push ebx
mov dword [esp + 0x4c], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], ebx
call dword [sym.imp.USER32.dll_LoadIconA]
push 0x7f01
xor ebx, ebx
mov dword [esp + 0x5c], eax
push ebx
call dword [sym.imp.USER32.dll_LoadCursorA]
push dword [0x48567c]
mov dword [esp + 0x60], eax
push ebx
push ebx
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x70], ebx
call fcn.0040fcab
add esp, 0xc
mov dword [esp + 0x68], eax
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.USER32.dll_RegisterClassW]
jmp 0x456880
test al, al
je 0x4566ae
push 0
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x2c]
push eax
push edi
call fcn.00464392
mov eax, dword [esp + 0x34]
add esp, 0x10
xor edi, edi
test eax, eax
jle 0x4566ae
xor edx, edx
inc edx
mov ebx, edx
mov ecx, dword [esp + 0x18]
mov esi, dword [ecx + edi*4]
cmp ebx, eax
jge 0x4567a8
mov eax, dword [ecx + edi*4 + 4]
jmp 0x4567aa
xor eax, eax
push dword [0x4af738]
push edx
push eax
push esi
call fcn.00401837
add esp, 0x10
cmp eax, 0xfffffffe
je 0x456873
xor edx, edx
cmp eax, 2
jne 0x4567d0
inc edi
inc ebx
inc edx
jmp 0x4567d5
inc edx
cmp eax, edx
jne 0x4567e8
mov eax, dword [esp + 0x24]
inc edi
inc ebx
cmp edi, eax
jl 0x456797
mov ebx, dword [esp + 0x14]
jmp 0x4566ae
push str._cleanup
push esi
call fcn.0046e740
pop ecx
pop ecx
test eax, eax
jne 0x45683e
push dword [0x48567c]
push str.This_procedure_will_remove_ALL_Registry_entries_nassociated_with__s__and_will_also_remove_nthe_random_seed_file.__This_only_affects_the_ncurrently_logged_in_user.__n_nTHIS_PROCESS_WILL_DESTROY_YOUR_SAVED_SESSIONS._nAre_you_really_sure_you_want_to_continue_
call fcn.0044dc6c
push dword [0x48567c]
mov esi, eax
push str._s_Warning
call fcn.0044dc6c
push 4
push 0x134
mov edi, eax
push edi
push esi
push 0
call fcn.00464209
add esp, 0x24
cmp eax, 6
jne 0x456f18
jmp 0x456f13
push str._pgpfp
push esi
call fcn.0046e740
pop ecx
pop ecx
test eax, eax
jne 0x45685f
push eax
call fcn.004642c3
xor eax, eax
pop ecx
inc eax
push eax
jmp 0x456f28
cmp byte [esi], 0x2d
push esi
jne 0x456f2d
push str.unknown_option___s_
jmp 0x456f32
push esi
push str.option___s__requires_an_argument
jmp 0x456f32
xor ebx, ebx
push 0xb10
push ebx
push 0x4aec18
call fcn.00467540
call fcn.004592ef
call fcn.0045931a
push 0x7a
push dword [0x4af738]
mov dword [0x4aebf0], 0xa
mov dword [0x4aebf4], 0x14
mov dword [0x4aebe8], 0x19
mov dword [0x4aebec], 0x1c
call fcn.0040319c
mov esi, eax
imul esi, dword [0x4aebf0]
push 0x7b
push dword [0x4af738]
add esi, dword [0x4aebe8]
call fcn.0040319c
mov edi, eax
lea eax, [esp + 0x88]
imul edi, dword [0x4aebf4]
push eax
add edi, dword [0x4aebec]
call fcn.0045a566
mov ecx, dword [esp + 0x94]
mov ebp, 0xef0000
sub ecx, dword [esp + 0x8c]
mov eax, dword [esp + 0x98]
cmp esi, ecx
push dword [0x485678]
cmovg esi, ecx
sub eax, dword [esp + 0x94]
cmp edi, eax
cmovg edi, eax
call fcn.00415ed9
add esp, 0x24
test eax, eax
je 0x456951
test byte [eax + 0x50], 1
push 1
movzx ebx, bl
pop eax
cmovne ebx, eax
push dword [0x48567c]
push 0
push 0
call fcn.0040fcab
push 0x74
push dword [0x4af738]
mov dword [esp + 0x2c], eax
call fcn.00403019
test al, al
mov ecx, 0xcf0000
push 0x76
push dword [0x4af738]
cmove ebp, ecx
call fcn.0040319c
xor ecx, ecx
add esp, 0x1c
inc ecx
cmp eax, ecx
je 0x456996
test bl, bl
je 0x45699c
and ebp, 0xfffaffff
push 0x5d
push dword [0x4af738]
call fcn.00403019
push 8
pop ecx
xor ebx, ebx
test al, al
push 0x86
push dword [0x4af738]
cmovne ebx, ecx
call fcn.00403019
add esp, 0x10
test al, al
je 0x4569d0
or ebx, 0x200
xor eax, eax
push eax
push dword [esp + 0x18]
push eax
push eax
push edi
push esi
mov eax, 0x80000000
push eax
push eax
push ebp
mov ebp, dword [esp + 0x3c]
push ebp
push ebp
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExW]
push ebp
mov dword [0x4adacc], eax
call fcn.0040dab8
xor ebx, ebx
push ebx
push ebx
call fcn.0045a5d5
push 0x4b0c7c
push 0x4aec18
push dword [0x4af738]
mov dword [0x4b0c7c], 0x49f298
call fcn.00447a0f
push dword [0x4af738]
mov dword [0x4af740], eax
push eax
call fcn.0045b62d
push dword [0x4af738]
push 0x4adad4
call fcn.0040bfbc
push eax
push dword [0x4af740]
mov dword [0x4af73c], eax
call fcn.0044b2c8
push 0x67
push dword [0x4af738]
call fcn.0040319c
add esp, 0x38
push eax
push 0x7a
push dword [0x4af738]
call fcn.0040319c
pop ecx
pop ecx
push eax
push 0x7b
push dword [0x4af738]
call fcn.0040319c
pop ecx
pop ecx
push eax
push dword [0x4af740]
call fcn.0044b8bf
add esp, 0x10
lea eax, [esp + 0x44]
push eax
push dword [0x4adacc]
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [esp + 0x6c]
push eax
push dword [0x4adacc]
call dword [sym.imp.USER32.dll_GetClientRect]
push 0x87
push dword [0x4af738]
call fcn.0040319c
pop ecx
pop ecx
mov dword [0x4aec00], eax
lea edx, [eax + eax]
mov dword [0x4aebfc], eax
mov esi, edx
sub esi, dword [esp + 0x74]
sub esi, dword [esp + 0x44]
add esi, dword [esp + 0x6c]
add esi, dword [esp + 0x4c]
mov dword [0x4aebe8], esi
mov ecx, dword [0x4af740]
sub edx, dword [esp + 0x78]
sub edx, dword [esp + 0x48]
add edx, dword [esp + 0x70]
mov eax, dword [ecx + 0x128]
imul eax, dword [0x4aebf4]
add edx, dword [esp + 0x50]
push 0xe
mov dword [0x4aebec], edx
add eax, edx
push eax
mov eax, dword [ecx + 0x12c]
imul eax, dword [0x4aebf0]
add eax, esi
push eax
push ebx
push ebx
push ebx
push dword [0x4adacc]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [0x4aebf0]
add eax, 0xf
cdq
and edx, 0xf
push ebx
lea esi, [edx + eax]
xor eax, eax
sar esi, 4
inc eax
imul esi, dword [0x4aebf4]
push eax
add esi, esi
push esi
call fcn.0040dbd9
push esi
mov edi, eax
push ebx
push edi
call fcn.00467540
add esp, 0x18
xor eax, eax
inc eax
push edi
push eax
push eax
push dword [0x4aebf4]
push dword [0x4aebf0]
call dword [sym.imp.GDI32.dll_CreateBitmap]
push edi
mov dword [0x4b094c], eax
call fcn.0040dab8
pop ecx
push dword [0x4aebf4]
push dword [0x4aebf0]
push dword [0x4b094c]
push dword [0x4adacc]
call dword [sym.imp.USER32.dll_CreateCaret]
mov eax, dword [0x4af740]
push ebx
mov dword [esp + 0x48], 0x1c
mov dword [esp + 0x4c], 0x1f
mov ecx, dword [eax + 0x128]
mov dword [esp + 0x50], ebx
mov dword [esp + 0x58], ecx
mov dword [esp + 0x5c], ebx
lea eax, [ecx - 1]
mov dword [esp + 0x54], eax
lea eax, [esp + 0x48]
push eax
xor eax, eax
inc eax
push eax
push dword [0x4adacc]
call dword [sym.imp.USER32.dll_SetScrollInfo]
mov dword [0x4b0c6c], ebx
mov dword [0x4b0c70], ebx
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
push ebx
push dword [0x4adacc]
mov dword [0x4b0c64], eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
mov dword [0x4af72c], eax
call dword [sym.imp.USER32.dll_CreatePopupMenu]
push 0x49f668
push 0x190
push ebx
mov ebx, dword [sym.imp.USER32.dll_AppendMenuA]
push eax
mov dword [0x4af730], eax
call ebx
push str.Paste
push 0x1a0
push 0
push dword [0x4af730]
call ebx
call dword [sym.imp.USER32.dll_CreateMenu]
mov dword [0x4af734], eax
xor eax, eax
inc eax
push eax
push 0x4af74c
call fcn.00415f36
pop ecx
pop ecx
call fcn.0045bb1c
xor ebp, ebp
mov esi, 0x800
mov edi, dword [ebp + 0x4af72c]
push 0
push 0
push esi
push edi
call ebx
push str.Event_Log
push 0x10
push 0
push edi
call ebx
push 0
push 0
push esi
push edi
call ebx
push str.New_Session...
push 0x20
push 0
push edi
call ebx
push str.Duplicate_Session
push 0x30
push 0
push edi
call ebx
push str.Saved_Sessions
push dword [0x4af734]
push 0x10
push edi
call ebx
push str.Change_Settings...
push 0x50
push 0
push edi
call ebx
push 0
push 0
push esi
push edi
call ebx
push str.Copy_All_to_Clipboard
push 0x170
push 0
push edi
call ebx
push str.Clear_Scrollback
push 0x60
push 0
push edi
call ebx
push str.Reset_Terminal
push 0x70
push 0
push edi
call ebx
push 0
push 0
push esi
push edi
call ebx
push str.Full_Screen
push 0x180
push 0x76
push dword [0x4af738]
call fcn.0040319c
dec eax
neg eax
pop ecx
sbb eax, eax
pop ecx
inc eax
push eax
push edi
call ebx
push 0
push 0
push esi
push edi
call ebx
call fcn.0045d043
test al, al
je 0x456d46
push str.Help
push 0x140
push 0
push edi
call ebx
push dword [0x48567c]
push str.About__s
call fcn.0044dc6c
pop ecx
pop ecx
mov esi, eax
push esi
push 0x150
push 0
push edi
call ebx
push esi
call fcn.0040dab8
add ebp, 4
mov esi, 0x800
pop ecx
cmp ebp, 8
jb 0x456c76
call fcn.00461dd7
test al, al
je 0x456d99
mov eax, dword [0x4adad4]
push str.Running_with_restricted_process_ACL
push 0x4adad4
call dword [eax]
pop ecx
pop ecx
push dword [0x4adacc]
call fcn.00461e3e
pop ecx
call fcn.0045b6ff
xor ebx, ebx
push ebx
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
call fcn.0045b5e8
pop ecx
push dword [esp + 0x90]
push dword [0x4adacc]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x4adacc]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov dword [0x4af8e4], ebx
mov dword [0x4b0948], ebx
call fcn.0045aae4
mov ebp, dword [sym.imp.USER32.dll_GetForegroundWindow]
call ebp
cmp eax, dword [0x4adacc]
sete al
movzx eax, al
push eax
push dword [0x4af740]
call fcn.0044b89a
pop ecx
pop ecx
push dword [0x4adacc]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov ebx, dword [sym.imp.USER32.dll_PeekMessageW]
call fcn.00401721
test al, al
jne 0x456e5d
xor eax, eax
push eax
push eax
push eax
push eax
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x456e5d
or edi, 0xffffffff
call ebp
cmp eax, dword [0x4adacc]
sete al
movzx eax, al
push eax
push dword [0x4af740]
call fcn.0044b89a
pop ecx
pop ecx
jmp 0x456e5f
xor edi, edi
lea eax, [esp + 0x14]
push eax
call fcn.0045c8ee
mov dword [esp], 0x1cff
mov esi, eax
push edi
push 0
push esi
push dword [esp + 0x24]
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
cmp eax, dword [esp + 0x14]
jae 0x456e97
push dword [esi + eax*4]
call fcn.0045c959
push esi
call fcn.0040dab8
pop ecx
jmp 0x456e9d
push esi
call fcn.0040dab8
pop ecx
jmp 0x456ede
cmp dword [esp + 0x2c], 0x12
je 0x456efc
call fcn.004537ce
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x456ec9
lea eax, [esp + 0x28]
push eax
push esi
call dword [sym.imp.USER32.dll_IsDialogMessageA]
test eax, eax
jne 0x456ed4
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [esp + 0x2c], 0x8005
jne 0x456ef2
xor eax, eax
inc eax
push eax
xor eax, eax
push eax
push eax
push eax
lea eax, [esp + 0x38]
push eax
call ebx
test eax, eax
jne 0x456ea0
call fcn.004016d3
jmp 0x456e1e
push dword [esp + 0x30]
jmp 0x456f04
push 0
call fcn.00458f94
push str.Serialised_configuration_data_was_invalid
call fcn.0045ae57
call fcn.00462876
push esi
call fcn.0040dab8
push edi
call fcn.0040dab8
pop ecx
pop ecx
push 0
call fcn.00475525
push str.unexpected_argument___s_
call fcn.00459281
int3