Function at 0x45c48b
Capabilities:
Get geographical location
Get keyboard layout
Read file via mapping
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x44
mov eax, dword [0x4b507c]
mov esi, dword [esp + 0x58]
xor eax, esp
mov dword [esp + 0x40], eax
call fcn.00466db1
or byte [0x4b5a14], 0x44
mov dword [0x4b7664], esi
mov dword [0x4b7668], 0
mov dword [0x4b766c], 3
call fcn.0046738c
call fcn.004576ec
call fcn.0046682d
call fcn.0045ae16
call fcn.00466dfc
cmp dword [0x4b7670], 4
jb 0x45c4f4
jne 0x45c504
cmp dword [0x4b7674], 2
je 0x45c504
push str.MSWHEEL_ROLLMSG
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
mov dword [0x4b5064], eax
call fcn.00465c15
push str.user32.dll
call fcn.00466d24
add esp, 4
mov edi, eax
push str.winmm.dll
call fcn.00466d24
add esp, 4
mov esi, eax
test edi, edi
je 0x45c548
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.FlashWindowEx
push edi
call ebx
mov dword [0x4b728c], eax
push str.ToUnicodeEx
push edi
call ebx
jmp 0x45c554
xor eax, eax
mov dword [0x4b728c], 0
test esi, esi
mov dword [0x4b7650], eax
je 0x45c56b
push str.PlaySoundA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x45c56d
xor eax, eax
mov dword [0x4b7280], eax
call fcn.00402e20
mov dword [0x4b7678], eax
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
cmp eax, 2
jb 0x45c5d1
push dword [0x48e058]
push str._s_Fatal_Error
call fcn.004558cb
add esp, 8
mov esi, eax
push 0x30
push eax
push str.Failed_to_initialize_COM_subsystem
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call fcn.00410bcd
add esp, 4
mov ecx, dword [esp + 0x40]
xor esi, esi
inc esi
xor ecx, esp
call fcn.0046f0c8
mov eax, esi
add esp, 0x44
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
mov eax, dword [0x48e05c]
mov esi, dword [esp + 0x60]
mov dword [0x4b767c], eax
push eax
call fcn.0041aa0f
add esp, 4
test eax, eax
mov dword [0x4b7680], 0
je 0x45c5fe
mov eax, dword [eax + 0x48]
mov dword [0x4b7680], eax
xor edi, edi
push edi
push 0x7b
push dword [0x4b7678]
call fcn.004036b2
add esp, 0xc
push dword [0x4b7678]
push edi
call fcn.0041e3b5
add esp, 8
mov bl, byte [esi]
test bl, bl
je 0x45c6fd
lea edi, [esi + 2]
movsx eax, bl
push eax
call fcn.0047dd62
add esp, 4
test eax, eax
je 0x45c64a
mov bl, byte [edi - 1]
inc edi
test bl, bl
jne 0x45c62d
jmp 0x45c6fd
lea eax, [edi - 2]
cmp bl, 0x26
jne 0x45c680
cmp byte [edi - 1], 0x52
jne 0x45cf35
mov cl, byte [edi]
test cl, cl
je 0x45c670
cmp cl, 0x26
je 0x45c670
cmp cl, 0x40
jne 0x45cf35
call fcn.0046aa8c
mov byte [0x4b7684], 1
mov bl, byte [edi]
jmp 0x45c682
mov edi, eax
test bl, bl
je 0x45c6fd
cmp bl, 0x26
je 0x45cf33
cmp bl, 0x40
je 0x45cfb5
lea eax, [esp + 4]
lea edi, [esp + 0x18]
push 0
push eax
push edi
push esi
call fcn.0046d836
add esp, 0x10
mov eax, dword [edi]
test eax, eax
jle 0x45c6fd
xor ebx, ebx
xor edi, edi
inc edi
mov edx, dword [esp + 4]
mov ecx, dword [0x4b7678]
lea ebp, [ebx + 1]
cmp ebp, eax
mov eax, 0
mov esi, dword [edx + ebx*4]
jge 0x45c6d5
mov eax, dword [edx + ebx*4 + 4]
push ecx
push edi
push eax
push esi
call fcn.0040182d
add esp, 0x10
cmp eax, edi
je 0x45c6f3
cmp eax, 2
jne 0x45ce75
add ebx, 2
mov ebp, ebx
mov eax, dword [esp + 0x18]
mov ebx, ebp
cmp ebp, eax
jl 0x45c6b8
push dword [0x4b7678]
call fcn.00402d5d
add esp, 4
push dword [0x4b7678]
call fcn.00402dd3
add esp, 4
mov ebx, dword [esp + 0x58]
test al, al
jne 0x45c72e
call fcn.0045ae4f
test al, al
je 0x45d022
mov esi, dword [esp + 0x5c]
push dword [0x4b7678]
call fcn.0041a924
add esp, 4
test esi, esi
jne 0x45c79a
xor edi, edi
lea esi, [esp + 0x18]
mov dword [esi], edi
mov dword [esi + 4], 0x45d146
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], ebx
push 0xc8
push ebx
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [esi + 0x14], eax
push 0x7f01
push edi
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
push dword [0x48e058]
push edi
push edi
call fcn.00413045
add esp, 0xc
mov dword [esi + 0x24], eax
push esi
call dword [sym.imp.USER32.dll_RegisterClassW]
push 0xb10
push 0
push 0x4b6158
call fcn.004721e0
add esp, 0xc
push 0x67
push dword [0x4b7678]
call fcn.00403081
add esp, 8
mov dword [0x4b7688], eax
push 0x9e
push dword [0x4b7678]
call fcn.00403081
add esp, 8
mov dword [0x4b768c], eax
call fcn.0046022a
mov esi, 0x19
mov dword [0x4b6c68], 0xa
mov dword [0x4b6c6c], 0x14
mov dword [0x4b6c74], 0x1c
mov dword [0x4b6c70], esi
push 0x76
push dword [0x4b7678]
call fcn.00403081
add esp, 8
mov edi, dword [0x4b6c74]
lea ebp, [eax + eax*4]
mov ebx, dword [0x4b6c6c]
add ebp, ebp
add ebp, esi
push 0x77
push dword [0x4b7678]
call fcn.00403081
add esp, 8
mov esi, eax
imul esi, ebx
add esi, edi
mov edi, dword [0x4b7668]
call fcn.0045c1c0
mov ecx, eax
mov eax, 0x12340042
test ecx, ecx
je 0x45c862
push 2
push edi
call dword [0x4b6134]
lea edi, [esp + 0x18]
mov dword [edi], 0x28
push edi
push eax
call fcn.0045c385
mov eax, edi
mov edi, dword [edi + 0xc]
mov ebx, dword [eax + 0x10]
sub edi, dword [eax + 4]
sub ebx, dword [eax + 8]
mov eax, dword [0x48e058]
cmp ebp, edi
cmovle edi, ebp
cmp esi, ebx
cmovle ebx, esi
xor ecx, ecx
push eax
push ecx
push ecx
call fcn.00413045
add esp, 0xc
mov dword [esp], eax
push 0x70
push dword [0x4b7678]
call fcn.00402fe1
add esp, 8
movzx ebp, al
shl ebp, 0x15
or ebp, 0xcf0000
push 0x72
push dword [0x4b7678]
call fcn.00403081
add esp, 8
mov esi, ebp
and esi, 0xea0000
xor ecx, ecx
inc ecx
cmp eax, ecx
cmovne esi, ebp
push 0x59
push dword [0x4b7678]
call fcn.00402fe1
add esp, 8
movzx ebp, al
push 0x82
push dword [0x4b7678]
call fcn.00402fe1
add esp, 8
test al, al
lea ecx, [ebp*8 + 0x200]
lea edx, [ebp*8]
mov eax, 0x80000000
cmovne edx, ecx
xor ecx, ecx
push ecx
push dword [esp + 0x5c]
push ecx
mov ecx, 0
push ecx
push ebx
push edi
push eax
push eax
push esi
mov eax, dword [esp + 0x24]
push eax
push eax
mov esi, eax
push edx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [0x4b7668], eax
push esi
call fcn.00410bcd
add esp, 4
xor ecx, ecx
xor edx, edx
call fcn.004603a3
mov dword [0x4b6154], 0x4975c8
push 0x4b6154
push 0x4b6158
push dword [0x4b7678]
call fcn.0044a9be
add esp, 0xc
mov edx, dword [0x4b7678]
mov ecx, eax
mov dword [0x4b7660], eax
call fcn.004608db
push dword [0x4b7678]
push 0x4b504c
call fcn.0040f926
add esp, 8
mov dword [0x4b7690], eax
push eax
push dword [0x4b7660]
call fcn.00451177
add esp, 8
push 0x63
push dword [0x4b7678]
call fcn.00403081
add esp, 8
mov esi, eax
push 0x76
push dword [0x4b7678]
call fcn.00403081
add esp, 8
mov edi, eax
push 0x77
push dword [0x4b7678]
call fcn.00403081
add esp, 8
push esi
push edi
push eax
push dword [0x4b7660]
call fcn.0044abe4
add esp, 0x10
lea esi, [esp + 4]
push esi
push dword [0x4b7668]
call dword [sym.imp.USER32.dll_GetWindowRect]
lea ebp, [esp + 0x18]
push ebp
push dword [0x4b7668]
call dword [sym.imp.USER32.dll_GetClientRect]
push 0x83
push dword [0x4b7678]
call fcn.00403081
add esp, 8
mov ecx, dword [esi + 8]
mov dword [0x4b6c78], eax
mov dword [0x4b6c7c], eax
add eax, eax
mov edx, dword [0x4b7660]
add ecx, eax
add eax, dword [esi + 0xc]
sub ecx, dword [esi]
sub eax, dword [esi + 4]
sub ecx, dword [ebp + 8]
sub eax, dword [ebp + 0xc]
add ecx, dword [ebp]
add eax, dword [ebp + 4]
mov dword [0x4b6c70], ecx
mov dword [0x4b6c74], eax
mov esi, dword [edx + 0x128]
mov edx, dword [edx + 0x12c]
imul esi, dword [0x4b6c6c]
imul edx, dword [0x4b6c68]
add esi, eax
add edx, ecx
push 0xe
push esi
push edx
mov eax, 0
push eax
push eax
push eax
xor ebp, ebp
push dword [0x4b7668]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov edi, dword [0x4b6c68]
lea eax, [edi + 0xf]
add edi, 0x1e
test eax, eax
cmovns edi, eax
sar edi, 4
imul edi, dword [0x4b6c6c]
add edi, edi
push ebp
xor ebx, ebx
inc ebx
push ebx
push edi
call fcn.00410b50
add esp, 0xc
mov esi, eax
push edi
push ebp
push eax
call fcn.004721e0
add esp, 0xc
push esi
push ebx
push ebx
push dword [0x4b6c6c]
push dword [0x4b6c68]
call dword [sym.imp.GDI32.dll_CreateBitmap]
mov dword [0x4b6c80], eax
push esi
xor esi, esi
call fcn.00410bcd
add esp, 4
push dword [0x4b6c6c]
push dword [0x4b6c68]
push dword [0x4b6c80]
push dword [0x4b7668]
call dword [sym.imp.USER32.dll_CreateCaret]
mov eax, dword [0x4b7660]
lea edx, [esp + 0x18]
mov dword [edx], 0x1c
mov dword [edx + 4], 0x1f
mov dword [edx + 8], esi
mov eax, dword [eax + 0x128]
lea ecx, [eax - 1]
mov dword [edx + 0xc], ecx
mov dword [edx + 0x10], eax
mov dword [edx + 0x14], esi
push esi
push edx
push ebx
push dword [0x4b7668]
call dword [sym.imp.USER32.dll_SetScrollInfo]
mov dword [0x4b6c84], esi
mov dword [0x4b6c88], esi
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
mov dword [0x4b6c8c], eax
push esi
push dword [0x4b7668]
call dword [sym.imp.USER32.dll_GetSystemMenu]
mov dword [0x4b6c90], eax
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov edi, dword [sym.imp.USER32.dll_AppendMenuA]
mov dword [0x4b6c94], eax
push 0x49cf01
push 0x190
push esi
push eax
call edi
push str.Paste
push 0x1a0
push esi
push dword [0x4b6c94]
call edi
call dword [sym.imp.USER32.dll_CreateMenu]
mov dword [0x4b6c98], eax
push ebx
push 0x4b6c9c
call fcn.0041e3ba
add esp, 8
call fcn.0046095e
xor ebx, ebx
mov ebp, dword [ebx*4 + 0x4b6c90]
push esi
push esi
mov eax, 0x800
push eax
push ebp
call edi
push str.Event_Log
mov eax, 0x10
push eax
push esi
push ebp
call edi
push esi
push esi
mov eax, 0x800
push eax
push ebp
call edi
push str.New_Session...
push 0x20
push esi
push ebp
call edi
push str.Duplicate_Session
push 0x30
push esi
push ebp
call edi
push str.Saved_Sessions
push dword [0x4b6c98]
mov eax, 0x10
push eax
push ebp
call edi
push str.Change_Settings...
push 0x50
push esi
push ebp
call edi
push esi
push esi
mov eax, 0x800
push eax
push ebp
call edi
push str.Copy_All_to_Clipboard
push 0x170
push esi
push ebp
call edi
push str.Clear_Scrollback
push 0x60
push esi
push ebp
call edi
push str.Reset_Terminal
push 0x70
push esi
push ebp
call edi
push esi
push esi
mov eax, 0x800
push eax
push ebp
call edi
push 0x72
push dword [0x4b7678]
call fcn.00403081
add esp, 8
xor ecx, ecx
cmp eax, 1
sete cl
push str.Full_Screen
push 0x180
push ecx
push ebp
call edi
push esi
push esi
mov eax, 0x800
push eax
push ebp
call edi
call fcn.00465d44
test al, al
je 0x45ccaa
push str.Help
push 0x140
push 0
push ebp
call edi
push dword [0x48e058]
push str.About__s
call fcn.004558cb
add esp, 8
mov esi, eax
push eax
push 0x150
mov eax, 0
push eax
push ebp
call edi
push esi
xor esi, esi
call fcn.00410bcd
add esp, 4
test ebx, ebx
mov ebx, 1
je 0x45cbc6
cmp byte [0x4b7684], 0
je 0x45cd03
mov eax, dword [0x4b504c]
push str.Running_with_restricted_process_ACL
push 0x4b504c
call dword [eax]
add esp, 8
call fcn.004609df
xor edi, edi
push edi
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
movzx eax, ax
push 0x14
lea esi, [esp + 0x1c]
push esi
push 0x1004
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push esi
call fcn.0047c378
add esp, 4
mov dword [0x4b760c], eax
push dword [esp + 0x64]
push dword [0x4b7668]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x4b7668]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov dword [0x4b6ca8], edi
mov dword [0x4b6cac], edi
call fcn.00460c23
call dword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
cmp eax, dword [0x4b7668]
sete cl
push ecx
push dword [0x4b7660]
call fcn.00451186
add esp, 8
push dword [0x4b7668]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov ebp, dword [sym.imp.USER32.dll_PeekMessageW]
call fcn.004017a6
test al, al
mov ebx, 0
jne 0x45cdda
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x45cdda
call dword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
cmp eax, dword [0x4b7668]
sete cl
push ecx
push dword [0x4b7660]
call fcn.00451186
add esp, 8
xor ebx, ebx
dec ebx
lea eax, [esp + 4]
push eax
call fcn.004658f8
add esp, 4
mov esi, eax
push 0x1cff
push ebx
push 0
push eax
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
cmp eax, dword [esp + 4]
jae 0x45ce0d
push dword [esi + eax*4]
call fcn.00465a29
add esp, 4
push esi
call fcn.00410bcd
add esp, 4
push 1
push edi
push edi
push edi
lea eax, [esp + 0x28]
push eax
call ebp
test eax, eax
je 0x45ce6b
cmp dword [esp + 0x1c], 0x12
je 0x45cef1
push dword [0x4b7694]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x45ce56
lea eax, [esp + 0x18]
push eax
push dword [0x4b7694]
call dword [sym.imp.USER32.dll_IsDialogMessageA]
test eax, eax
jne 0x45ce61
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [esp + 0x1c], 0x8005
je 0x45ce16
call fcn.0040175b
jmp 0x45cd94
cmp eax, 0xfffffffe
jne 0x45ce85
push esi
push str.option___s__requires_an_argument
call fcn.0045d0ee
push 0x4a0abf
push esi
call fcn.0047e4f0
add esp, 8
test eax, eax
jne 0x45cefa
mov edi, dword [0x48e058]
push edi
push str.This_procedure_will_remove_ALL_Registry_entries_nassociated_with__s__and_will_also_remove_nthe_random_seed_file.__This_only_affects_the_ncurrently_logged_in_user.__n_nTHIS_PROCESS_WILL_DESTROY_YOUR_SAVED_SESSIONS._nAre_you_really_sure_you_want_to_continue_
call fcn.004558cb
add esp, 8
mov esi, eax
push edi
push str._s_Warning
call fcn.004558cb
add esp, 8
mov edi, eax
push 4
push 0x134
push eax
push esi
call fcn.0046d6c6
add esp, 0x10
cmp eax, 6
jne 0x45ced8
call fcn.0046c558
push esi
call fcn.00410bcd
add esp, 4
push edi
call fcn.00410bcd
add esp, 4
push 0
call fcn.00479f0b
push dword [esp + 0x20]
call fcn.0045d033
push str._pgpfp
push esi
call fcn.0047e4f0
add esp, 8
test eax, eax
jne 0x45cf18
call fcn.0046d7ab
push 1
call fcn.00479f0b
cmp byte [esi], 0x2d
jne 0x45cf28
push esi
push str.unknown_option___s_
call fcn.0045d0ee
push esi
push str.unexpected_argument___s_
call fcn.0045d0ee
mov eax, edi
lea ecx, [esp + 0x14]
inc eax
lea edx, [esp + 4]
push ecx
push edx
push 0x49d686
push eax
call fcn.00419347
add esp, 0x10
cmp eax, 2
jne 0x45d002
xor edi, edi
push dword [esp + 0x14]
push edi
push edi
push 4
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
je 0x45d002
mov esi, eax
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
mov dword [ecx], esi
mov dword [ecx + 8], eax
mov dword [ecx + 4], edi
mov dword [ecx + 0xc], edi
mov dword [ecx + 0x10], ecx
push ecx
push dword [0x4b7678]
call fcn.00403bb0
add esp, 8
test al, al
je 0x45d029
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x45d00b
push edi
call fcn.0047e720
add esp, 4
mov esi, eax
mov ebx, esi
cmp esi, 2
jl 0x45cfdc
movsx eax, byte [edi + ebx - 1]
lea esi, [ebx - 1]
push eax
call fcn.0047dd62
add esp, 4
test eax, eax
jne 0x45cfc0
mov byte [edi + ebx], 0
inc edi
push dword [0x4b7678]
push edi
call fcn.0041e3b5
add esp, 8
push dword [0x4b7678]
call fcn.00412ca9
add esp, 4
test al, al
jne 0x45d00b
call fcn.0045ae4f
test al, al
je 0x45d022
push dword [0x4b7678]
call fcn.00402d5d
add esp, 4
mov ebx, dword [esp + 0x58]
jmp 0x45c72e
push 0
call fcn.0045d033
push str.Serialised_configuration_data_was_invalid
call fcn.0045d08b