Function at 0x4441f2
Capabilities:
Get keyboard layout
Read file via mapping
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x68]
sub esp, 0x84
mov eax, dword [ebp + 0x70]
push ebx
xor ebx, ebx
push esi
mov dword [0x477518], eax
mov dword [0x4774fc], ebx
mov dword [0x4774f8], 5
call fcn.004468e7
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
call fcn.0043ceae
call fcn.00446489
test eax, eax
jne 0x444253
push dword [0x4574d8]
push str._s_Fatal_Error
call fcn.0040b852
pop ecx
pop ecx
push 0x30
mov esi, eax
push esi
push str.Windows_refuses_to_report_a_version
jmp 0x4442db
mov eax, dword [0x477444]
cmp eax, 4
jb 0x444268
jne 0x444278
cmp dword [0x477450], 2
je 0x444278
push str.MSWHEEL_ROLLMSG
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
mov dword [0x4737c8], eax
call fcn.00445b09
push str.user32.dll
call fcn.004464b2
cmp eax, ebx
pop ecx
je 0x44429f
push str.FlashWindowEx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x475c30], eax
jmp 0x4442a5
mov dword [0x475c30], ebx
call fcn.00401eb4
push ebx
mov dword [0x4774dc], eax
call dword [sym.imp.ole32.dll_CoInitialize]
cmp eax, ebx
je 0x4442f5
cmp eax, 1
je 0x4442f5
push dword [0x4574d8]
push str._s_Fatal_Error
call fcn.0040b852
pop ecx
pop ecx
push 0x30
mov esi, eax
push esi
push str.Failed_to_initialize_COM_subsystem
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call fcn.0040b470
pop ecx
xor eax, eax
pop esi
inc eax
pop ebx
add ebp, 0x68
leave
ret 0x10
mov eax, dword [0x4574dc]
push eax
mov dword [ebp + 0x5c], ebx
mov dword [ebp + 0x64], ebx
mov dword [0x4774d4], eax
call fcn.0040e75f
cmp eax, ebx
pop ecx
mov dword [0x4774e0], ebx
je 0x44431e
mov eax, dword [eax + 0x48]
mov dword [0x4774e0], eax
push ebx
push 0x73
push dword [0x4774dc]
call fcn.0040248b
push dword [0x4774dc]
push ebx
call fcn.00410eae
mov edi, dword [ebp + 0x78]
add esp, 0x14
cmp byte [edi], bl
mov esi, edi
je 0x444372
cmp dword [0x473898], 1
movsx eax, byte [esi]
jle 0x44435c
push 8
push eax
call fcn.0044d22d
pop ecx
pop ecx
jmp 0x444369
mov ecx, dword [str.________________________________H]
movzx eax, byte [ecx + eax*2]
and eax, 8
cmp eax, ebx
je 0x444372
inc esi
cmp byte [esi], bl
jne 0x444344
mov al, byte [esi]
cmp al, 0x40
jne 0x4444ab
push esi
call fcn.0044c220
pop ecx
mov edi, eax
jmp 0x4443b3
cmp dword [0x473898], 1
movsx eax, byte [edi + esi - 1]
jle 0x4443a1
push 8
push eax
call fcn.0044d22d
pop ecx
pop ecx
jmp 0x4443ae
mov ecx, dword [str.________________________________H]
movzx eax, byte [ecx + eax*2]
and eax, 8
cmp eax, ebx
je 0x4443b8
dec edi
cmp edi, 1
jg 0x444387
mov byte [edi + esi], bl
push dword [0x4774dc]
inc esi
push esi
call fcn.00410eae
push dword [0x4774dc]
call fcn.0040b47d
add esp, 0xc
test eax, eax
jne 0x4443e9
call fcn.0043cee1
test eax, eax
jne 0x4443e9
push ebx
jmp 0x444deb
mov dword [ebp + 0x64], 1
push dword [0x4774dc]
call fcn.00401dd7
cmp dword [0x47750c], ebx
pop ecx
jne 0x444409
cmp dword [ebp + 0x5c], ebx
je 0x444410
mov dword [ebp + 0x64], 1
cmp dword [ebp + 0x64], ebx
je 0x444425
push dword [0x4774dc]
call fcn.0040b47d
test eax, eax
pop ecx
jne 0x44442e
call fcn.0043cee1
test eax, eax
je 0x4443e3
push ebx
push dword [0x4774dc]
call fcn.0040213a
push eax
call fcn.0040b625
push 0x46c140
push eax
mov dword [ebp + 0x78], eax
call fcn.0044e500
mov esi, eax
add esi, dword [ebp + 0x78]
add esp, 0x14
cmp byte [esi], bl
je 0x444480
push 0x40
push esi
call fcn.0044e4d0
mov edi, eax
cmp edi, ebx
pop ecx
pop ecx
je 0x444480
push esi
mov byte [edi], bl
push 0x32
push dword [0x4774dc]
call fcn.00402564
add esp, 0xc
lea esi, [edi + 1]
push 0x3a
push esi
call fcn.0044c410
mov edi, eax
cmp edi, ebx
pop ecx
pop ecx
je 0x4444a3
lea eax, [edi + 1]
push 0x3a
push eax
call fcn.0044c410
test eax, eax
pop ecx
pop ecx
jne 0x4444a3
mov byte [edi], bl
mov ecx, dword [ebp + 0x78]
jmp 0x4447bc
cmp al, 0x26
jne 0x444510
lea eax, [ebp + 0x78]
push eax
lea eax, [ebp + 0x64]
push eax
push str._p:_u
inc esi
push esi
call fcn.0044e48e
add esp, 0x10
cmp eax, 2
jne 0x4443da
push dword [ebp + 0x78]
push ebx
push ebx
push 4
push dword [ebp + 0x64]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
cmp esi, ebx
je 0x4443da
push dword [ebp + 0x78]
push esi
push dword [0x4774dc]
call fcn.0040295f
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp + 0x64]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4443e9
push ebx
lea eax, [ebp + 0x44]
push eax
lea eax, [ebp + 0x58]
push eax
push edi
call fcn.0044b11f
mov ecx, dword [ebp + 0x58]
add esp, 0x10
cmp ecx, ebx
mov dword [ebp + 0x78], ebx
jle 0x4443f0
mov dword [ebp + 0x60], 1
cmp dword [ebp + 0x60], ecx
mov eax, dword [ebp + 0x44]
mov edx, dword [ebp + 0x78]
lea eax, [eax + edx*4]
mov esi, dword [eax]
jge 0x44454c
mov eax, dword [eax + 4]
jmp 0x44454e
xor eax, eax
push dword [0x4774dc]
push 1
push eax
push esi
call fcn.004010f6
add esp, 0x10
cmp eax, 0xfffffffe
jne 0x444570
push esi
push str.option___s__requires_an_argument
jmp 0x444709
cmp eax, 2
jne 0x444580
inc dword [ebp + 0x78]
inc dword [ebp + 0x60]
jmp 0x444710
cmp eax, 1
je 0x444710
push str._cleanup
push esi
call fcn.0044c4d0
test eax, eax
pop ecx
pop ecx
je 0x444730
push str._cleanup_during_uninstall
push esi
call fcn.0044c4d0
test eax, eax
pop ecx
pop ecx
je 0x444730
push str._pgpfp
push esi
call fcn.0044c4d0
test eax, eax
pop ecx
pop ecx
je 0x444727
cmp byte [esi], 0x2d
je 0x444703
cmp dword [ebp + 0x5c], ebx
mov edi, esi
je 0x444613
push dword [0x4774dc]
push 1
push esi
push 0x457664
call fcn.004010f6
add esp, 0x10
cmp eax, 2
je 0x444710
push 0x21e
push str...windowswindow.c
push str.ret__2
call fcn.0044c558
add esp, 0xc
jmp 0x444710
push 7
push str.telnet:
push esi
call fcn.0044c2b0
add esp, 0xc
test eax, eax
jne 0x4446b2
add esi, 7
cmp byte [esi], 0x2f
jne 0x44463b
cmp byte [esi + 1], 0x2f
jne 0x44463b
inc esi
inc esi
xor edi, edi
inc edi
push edi
push 2
push dword [0x4774dc]
call fcn.0040248b
add esp, 0xc
cmp byte [esi], bl
mov eax, esi
je 0x444666
mov cl, byte [eax]
cmp cl, 0x3a
je 0x444666
cmp cl, 0x2f
je 0x444666
inc eax
cmp byte [eax], bl
jne 0x444655
mov cl, byte [eax]
cmp cl, bl
je 0x44466f
mov byte [eax], bl
inc eax
cmp cl, 0x3a
jne 0x44468c
push eax
call fcn.0044c3ee
push eax
push edi
push dword [0x4774dc]
call fcn.0040248b
add esp, 0x10
jmp 0x44469d
push 0xffffffffffffffff
push edi
push dword [0x4774dc]
call fcn.0040248b
add esp, 0xc
push esi
push ebx
push dword [0x4774dc]
call fcn.00402564
add esp, 0xc
mov dword [ebp + 0x5c], edi
jmp 0x444710
cmp byte [esi], bl
je 0x4446ea
cmp dword [0x473898], 1
movsx eax, byte [esi]
jle 0x4446ce
push 8
push eax
call fcn.0044d22d
pop ecx
pop ecx
jmp 0x4446db
mov ecx, dword [str.________________________________H]
movzx eax, byte [ecx + eax*2]
and eax, 8
cmp eax, ebx
jne 0x4446e4
inc esi
cmp byte [esi], bl
jne 0x4446b6
cmp byte [esi], bl
je 0x4446ea
mov byte [esi], bl
push edi
push ebx
push dword [0x4774dc]
call fcn.00402564
add esp, 0xc
mov dword [ebp + 0x5c], 1
jmp 0x444710
push esi
push str.unknown_option___s_
call fcn.0043daf0
pop ecx
pop ecx
inc dword [ebp + 0x78]
mov ecx, dword [ebp + 0x58]
inc dword [ebp + 0x60]
cmp dword [ebp + 0x78], ecx
jl 0x444537
jmp 0x4443f0
call fcn.0044b0ba
push 1
jmp 0x4447a9
push str._cleanup_during_uninstall
push esi
call fcn.0044c4d0
test eax, eax
pop ecx
pop ecx
push dword [0x4574d8]
jne 0x44475e
push str.Remove_saved_sessions_and_random_seed_file__n_nIf_you_hit_Yes__ALL_Registry_entries_associated_nwith__s_will_be_removed__as_well_as_the_nrandom_seed_file._THIS_PROCESS_WILL_nDESTROY_YOUR_SAVED_SESSIONS._n_This_only_affects_the_currently_logged_in_user.__n_nIf_you_hit_No__uninstallation_will_proceed__but_nsaved_sessions_etc_will_be_left_on_the_machine.
call fcn.0040b852
push dword [0x4574d8]
push str._s_Uninstallation
jmp 0x444773
push str.This_procedure_will_remove_ALL_Registry_entries_nassociated_with__s__and_will_also_remove_nthe_random_seed_file.__This_only_affects_the_ncurrently_logged_in_user.__n_nTHIS_PROCESS_WILL_DESTROY_YOUR_SAVED_SESSIONS._nAre_you_really_sure_you_want_to_continue_
call fcn.0040b852
push dword [0x4574d8]
push str._s_Warning
mov esi, eax
call fcn.0040b852
add esp, 0x10
push 4
mov edi, eax
push 0x134
push edi
push esi
call fcn.0044b05d
add esp, 0x10
cmp eax, 6
jne 0x44479a
call fcn.0044a3e8
push esi
call fcn.0040b470
push edi
call fcn.0040b470
pop ecx
pop ecx
push ebx
call fcn.0044ef2f
mov al, byte [esi]
cmp al, 0x20
je 0x4447bb
cmp al, 9
je 0x4447bb
mov byte [ecx], al
inc ecx
inc esi
cmp byte [esi], bl
jne 0x4447ae
push dword [ebp + 0x78]
mov byte [ecx], bl
push ebx
push dword [0x4774dc]
call fcn.00402564
push dword [ebp + 0x78]
call fcn.0040b470
add esp, 0x10
cmp dword [ebp + 0x74], ebx
jne 0x44482d
mov eax, dword [ebp + 0x70]
push 0xc8
push eax
mov dword [ebp], ebx
mov dword [ebp + 4], 0x4424a0
mov dword [ebp + 8], ebx
mov dword [ebp + 0xc], ebx
mov dword [ebp + 0x10], eax
call dword [sym.imp.USER32.dll_LoadIconA]
push 0x7f01
push ebx
mov dword [ebp + 0x14], eax
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [ebp + 0x18], eax
mov eax, dword [str.PuTTY]
mov dword [ebp + 0x24], eax
lea eax, [ebp]
push eax
mov dword [ebp + 0x1c], ebx
mov dword [ebp + 0x20], ebx
call dword [sym.imp.USER32.dll_RegisterClassA]
push 0xb10
push ebx
mov edi, 0x475120
push edi
call fcn.0044ce90
call fcn.0043e6a4
call fcn.00440832
push 0x6e
push dword [0x4774dc]
mov dword [0x475110], 0xa
mov dword [0x475c70], 0x14
mov dword [0x474dc0], 0x19
mov dword [0x475c64], 0x1c
call fcn.00402036
mov esi, eax
imul esi, dword [0x475110]
add esi, dword [0x474dc0]
push 0x6f
push dword [0x4774dc]
call fcn.00402036
imul eax, dword [0x475c70]
add eax, dword [0x475c64]
mov dword [ebp + 0x64], eax
lea eax, [ebp + 0x48]
push eax
call fcn.004405db
mov eax, dword [ebp + 0x50]
sub eax, dword [ebp + 0x48]
add esp, 0x20
cmp esi, eax
jle 0x4448c1
mov esi, eax
mov eax, dword [ebp + 0x54]
sub eax, dword [ebp + 0x4c]
cmp dword [ebp + 0x64], eax
jle 0x4448cf
mov dword [ebp + 0x64], eax
push 0x68
push dword [0x4774dc]
mov dword [ebp + 0x78], 0xef0000
mov dword [ebp + 0x74], ebx
call fcn.00402036
test eax, eax
pop ecx
pop ecx
jne 0x4448f3
mov dword [ebp + 0x78], 0xcf0000
push 0x6a
push dword [0x4774dc]
call fcn.00402036
cmp eax, 1
pop ecx
pop ecx
jne 0x44490b
and byte [ebp + 0x7a], 0xfa
push 0x53
push dword [0x4774dc]
call fcn.00402036
test eax, eax
pop ecx
pop ecx
je 0x444925
mov dword [ebp + 0x74], 8
push 0x79
push dword [0x4774dc]
call fcn.00402036
test eax, eax
pop ecx
pop ecx
je 0x44493c
or byte [ebp + 0x75], 2
push ebx
push dword [ebp + 0x70]
mov eax, 0x80000000
push ebx
push ebx
push dword [ebp + 0x64]
push esi
push eax
push eax
push dword [ebp + 0x78]
mov eax, dword [str.PuTTY]
push eax
push eax
push dword [ebp + 0x74]
call dword [sym.imp.USER32.dll_CreateWindowExA]
push ebx
push ebx
mov dword [0x4774fc], eax
call fcn.0043df14
push ebx
push edi
push dword [0x4774dc]
call fcn.00433b95
push dword [0x4774dc]
mov dword [0x4774f0], eax
push ebx
call fcn.00408ce2
push eax
push dword [0x4774f0]
mov dword [0x4774e4], eax
call fcn.0043260c
push 0x5b
push dword [0x4774dc]
call fcn.00402036
add esp, 0x2c
push eax
push 0x6e
push dword [0x4774dc]
call fcn.00402036
pop ecx
pop ecx
push eax
push 0x6f
push dword [0x4774dc]
call fcn.00402036
pop ecx
pop ecx
push eax
push dword [0x4774f0]
call fcn.00433d3b
add esp, 0x10
lea eax, [ebp + 0x34]
push eax
push dword [0x4774fc]
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp + 0x48]
push eax
push dword [0x4774fc]
call dword [sym.imp.USER32.dll_GetClientRect]
push 0x7a
push dword [0x4774dc]
call fcn.00402036
lea edx, [eax + eax]
mov dword [0x4760b0], eax
mov dword [0x475c34], eax
mov eax, dword [ebp + 0x48]
sub eax, dword [ebp + 0x50]
pop ecx
sub eax, dword [ebp + 0x34]
pop ecx
mov ecx, dword [ebp + 0x4c]
sub ecx, dword [ebp + 0x54]
add eax, dword [ebp + 0x3c]
sub ecx, dword [ebp + 0x38]
add eax, edx
add ecx, dword [ebp + 0x40]
mov dword [0x474dc0], eax
add ecx, edx
mov edx, dword [0x4774f0]
mov dword [0x475c64], ecx
push 0xe
mov esi, dword [edx + 0x128]
imul esi, dword [0x475c70]
add esi, ecx
mov ecx, dword [edx + 0x12c]
imul ecx, dword [0x475110]
push esi
add ecx, eax
push ecx
push ebx
push ebx
push ebx
push dword [0x4774fc]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [0x475110]
add eax, 0xf
push 0x10
pop ecx
cdq
idiv ecx
push 1
mov esi, eax
imul esi, dword [0x475c70]
shl esi, 1
push esi
call fcn.0040b3b0
push esi
mov edi, eax
push ebx
push edi
call fcn.0044ce90
add esp, 0x14
push edi
push 1
push 1
push dword [0x475c70]
push dword [0x475110]
call dword [sym.imp.GDI32.dll_CreateBitmap]
push edi
mov dword [0x475c90], eax
call fcn.0040b470
pop ecx
push dword [0x475c70]
push dword [0x475110]
push dword [0x475c90]
push dword [0x4774fc]
call dword [sym.imp.USER32.dll_CreateCaret]
mov eax, dword [0x4774f0]
add eax, 0x128
mov dword [ebp + 0x28], 0x1c
mov dword [ebp + 0x2c], 0x1f
mov dword [ebp + 0x30], ebx
mov ecx, dword [eax]
dec ecx
mov dword [ebp + 0x34], ecx
mov eax, dword [eax]
push ebx
mov dword [ebp + 0x38], eax
lea eax, [ebp + 0x28]
push eax
push 1
push dword [0x4774fc]
mov dword [ebp + 0x3c], ebx
call dword [sym.imp.USER32.dll_SetScrollInfo]
mov dword [0x474b58], ebx
mov dword [0x475114], ebx
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
push ebx
push dword [0x4774fc]
mov dword [0x475c60], eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
mov dword [0x474dcc], eax
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov esi, dword [sym.imp.USER32.dll_AppendMenuA]
push str.Paste
push 0x190
push ebx
push eax
mov dword [0x474dd0], eax
call esi
call dword [sym.imp.USER32.dll_CreateMenu]
mov dword [0x475c8c], eax
push 1
push 0x475c40
call fcn.00410ce3
pop ecx
pop ecx
call fcn.0043d7ca
mov dword [ebp + 0x78], ebx
mov edi, 0x800
mov eax, dword [ebp + 0x78]
mov eax, dword [eax + 0x474dcc]
push ebx
push ebx
push edi
push eax
mov dword [ebp + 0x70], eax
call esi
push str.Event_Log
push 0x10
push ebx
push dword [ebp + 0x70]
call esi
push ebx
push ebx
push edi
push dword [ebp + 0x70]
call esi
push str.New_Session...
push 0x20
push ebx
push dword [ebp + 0x70]
call esi
push str.Duplicate_Session
push 0x30
push ebx
push dword [ebp + 0x70]
call esi
push str.Saved_Sessions
push dword [0x475c8c]
push 0x10
push dword [ebp + 0x70]
call esi
push str.Change_Settings...
push 0x50
push ebx
push dword [ebp + 0x70]
call esi
push ebx
push ebx
push edi
push dword [ebp + 0x70]
call esi
push str.Copy_All_to_Clipboard
push 0x170
push ebx
push dword [ebp + 0x70]
call esi
push str.Clear_Scrollback
push 0x60
push ebx
push dword [ebp + 0x70]
call esi
push str.Reset_Terminal
push 0x70
push ebx
push dword [ebp + 0x70]
call esi
push ebx
push ebx
push edi
push dword [ebp + 0x70]
call esi
push str.Full_Screen
push 0x180
push 0x6a
push dword [0x4774dc]
call fcn.00402036
dec eax
neg eax
pop ecx
sbb eax, eax
pop ecx
inc eax
push eax
push dword [ebp + 0x70]
call esi
push ebx
push ebx
push edi
push dword [ebp + 0x70]
call esi
call fcn.00445c6f
test eax, eax
je 0x444c6d
push str.Help
push 0x140
push ebx
push dword [ebp + 0x70]
call esi
push dword [0x4574d8]
push str.About__s
call fcn.0040b852
pop ecx
pop ecx
push eax
push 0x150
push ebx
push dword [ebp + 0x70]
mov dword [ebp + 0x74], eax
call esi
push dword [ebp + 0x74]
call fcn.0040b470
add dword [ebp + 0x78], 4
cmp dword [ebp + 0x78], 8
pop ecx
jb 0x444b8d
call fcn.0044122e
push ebx
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
call fcn.0043e4f6
pop ecx
push dword [ebp + 0x7c]
push dword [0x4774fc]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x4774fc]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov dword [0x475c74], ebx
mov dword [0x474dc8], ebx
call fcn.0043dbce
call dword [sym.imp.USER32.dll_GetForegroundWindow]
sub eax, dword [0x4774fc]
neg eax
sbb eax, eax
inc eax
push eax
push dword [0x4774f0]
call fcn.00432e3c
pop ecx
pop ecx
push dword [0x4774fc]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov edi, dword [sym.imp.USER32.dll_PeekMessageA]
lea eax, [ebp + 0x70]
push eax
call fcn.004458eb
pop ecx
push 0xff
push 0xffffffffffffffff
push ebx
mov esi, eax
push esi
push dword [ebp + 0x70]
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
cmp eax, dword [ebp + 0x70]
jae 0x444d49
push dword [esi + eax*4]
call fcn.004459e5
push esi
call fcn.0040b470
pop ecx
jmp 0x444d95
push esi
call fcn.0040b470
pop ecx
jmp 0x444da3
cmp dword [ebp - 0x18], 0x12
je 0x444de8
push dword [0x4774e8]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x444d80
lea eax, [ebp - 0x1c]
push eax
push dword [0x4774e8]
call dword [sym.imp.USER32.dll_IsDialogMessageA]
test eax, eax
jne 0x444d8a
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push dword [0x4774f0]
call fcn.004324e5
cmp dword [0x474db8], ebx
pop ecx
je 0x444da3
call fcn.0044071c
push 1
push ebx
push ebx
lea eax, [ebp - 0x1c]
push ebx
push eax
call edi
test eax, eax
jne 0x444d52
call dword [sym.imp.USER32.dll_GetForegroundWindow]
sub eax, dword [0x4774fc]
neg eax
sbb eax, eax
inc eax
push eax
push dword [0x4774f0]
call fcn.00432e3c
cmp dword [0x4760dc], ebx
pop ecx
pop ecx
je 0x444dde
call fcn.0043db3e
call fcn.004480b2
jmp 0x444d15
push dword [ebp - 0x14]
call fcn.004407de
int3