Function at 0x45cc1f
Capabilities:
Get geographical location
Get keyboard layout
Read file via mapping
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x44
mov eax, dword [0x4b6078]
mov ebp, dword [esp + 0x58]
xor eax, esp
mov dword [esp + 0x40], eax
call fcn.00467657
or byte [0x4b6a14], 0x44
mov dword [0x4b8664], ebp
mov dword [0x4b8668], 0
mov dword [0x4b866c], 3
call fcn.00467c38
call fcn.00457e64
call fcn.004670d4
call fcn.0045b5a8
call fcn.004676a2
cmp dword [0x4b8670], 4
jb 0x45cc88
jne 0x45cc98
cmp dword [0x4b8674], 2
je 0x45cc98
push str.MSWHEEL_ROLLMSG
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
mov dword [0x4b6060], eax
call fcn.004664a1
push str.user32.dll
call fcn.004675ca
add esp, 4
mov edi, eax
push str.winmm.dll
call fcn.004675ca
add esp, 4
mov esi, eax
test edi, edi
je 0x45ccdc
mov ebx, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push str.FlashWindowEx
push edi
call ebx
mov dword [0x4b828c], eax
push str.ToUnicodeEx
push edi
call ebx
jmp 0x45cce8
xor eax, eax
mov dword [0x4b828c], 0
test esi, esi
mov dword [0x4b8650], eax
je 0x45ccff
push str.PlaySoundA
push esi
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
jmp 0x45cd01
xor eax, eax
mov dword [0x4b8280], eax
call fcn.00402e2c
mov dword [0x4b8678], eax
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
cmp eax, 2
jb 0x45cd65
push dword [0x48f058]
push str._s_Fatal_Error
call fcn.004560a0
add esp, 8
mov esi, eax
push 0x30
push eax
push str.Failed_to_initialize_COM_subsystem
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call fcn.00410c0e
add esp, 4
mov ecx, dword [esp + 0x40]
xor esi, esi
inc esi
xor ecx, esp
call fcn.0046fa9a
mov eax, esi
add esp, 0x44
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
mov eax, dword [0x48f05c]
mov esi, dword [esp + 0x60]
mov dword [0x4b867c], eax
push eax
call fcn.0041aa7f
add esp, 4
test eax, eax
mov dword [0x4b8680], 0
je 0x45cd92
mov eax, dword [eax + 0x48]
mov dword [0x4b8680], eax
xor edi, edi
push edi
push 0x7a
push dword [0x4b8678]
call fcn.004036be
add esp, 0xc
push dword [0x4b8678]
push edi
call fcn.0041e4a3
add esp, 8
mov bl, byte [esi]
test bl, bl
je 0x45cdd5
lea edi, [esi + 2]
movsx eax, bl
push eax
call fcn.0047e732
add esp, 4
test eax, eax
je 0x45ce0b
mov bl, byte [edi - 1]
inc edi
test bl, bl
jne 0x45cdbd
push dword [0x4b8678]
call fcn.00402d6e
add esp, 4
push dword [0x4b8678]
call fcn.00402de2
add esp, 4
test al, al
jne 0x45cf38
call fcn.0045b5e1
test al, al
jne 0x45cf38
jmp 0x45d76d
lea eax, [edi - 2]
cmp bl, 0x26
jne 0x45ce3d
cmp byte [edi - 1], 0x52
jne 0x45cea5
mov cl, byte [edi]
test cl, cl
je 0x45ce2d
cmp cl, 0x26
je 0x45ce2d
cmp cl, 0x40
jne 0x45cea5
call fcn.0046b3ac
mov byte [0x4b8684], 1
mov bl, byte [edi]
jmp 0x45ce3f
mov edi, eax
test bl, bl
je 0x45cdd5
cmp bl, 0x26
je 0x45cea3
cmp bl, 0x40
jne 0x45d679
push edi
call fcn.0047f0f0
add esp, 4
mov esi, eax
mov ebx, esi
cmp esi, 2
jl 0x45ce78
movsx eax, byte [edi + ebx - 1]
lea esi, [ebx - 1]
push eax
call fcn.0047e732
add esp, 4
test eax, eax
jne 0x45ce5c
mov byte [edi + ebx], 0
inc edi
push dword [0x4b8678]
push edi
call fcn.0041e4a3
add esp, 8
push dword [0x4b8678]
call fcn.00412cdd
add esp, 4
test al, al
je 0x45cf1d
jmp 0x45cf2a
mov eax, edi
lea ecx, [esp + 0x14]
inc eax
lea edx, [esp + 4]
push ecx
push edx
push 0x49e65e
push eax
call fcn.004193ef
add esp, 0x10
cmp eax, 2
jne 0x45cf1d
xor edi, edi
push dword [esp + 0x14]
push edi
push edi
push 4
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.DLL_MapViewOfFile]
test eax, eax
je 0x45cf1d
mov esi, eax
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
mov dword [ecx], esi
mov dword [ecx + 8], eax
mov dword [ecx + 4], edi
mov dword [ecx + 0xc], edi
mov dword [ecx + 0x10], ecx
push ecx
push dword [0x4b8678]
call fcn.00403bbc
add esp, 8
test al, al
je 0x45d792
push esi
call dword [sym.imp.KERNEL32.DLL_UnmapViewOfFile]
push dword [esp + 4]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x45cf2a
call fcn.0045b5e1
test al, al
je 0x45d76d
push dword [0x4b8678]
call fcn.00402d6e
add esp, 4
mov esi, dword [esp + 0x5c]
push dword [0x4b8678]
call fcn.0041a994
add esp, 4
test esi, esi
jne 0x45cfa4
xor edi, edi
lea esi, [esp + 0x18]
mov dword [esi], edi
mov dword [esi + 4], 0x45d8c2
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], ebp
push 0xc8
push ebp
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [esi + 0x14], eax
push 0x7f01
push edi
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
push dword [0x48f058]
push edi
push edi
call fcn.00413079
add esp, 0xc
mov dword [esi + 0x24], eax
push esi
call dword [sym.imp.USER32.dll_RegisterClassW]
push 0xb10
push 0
push 0x4b7158
call fcn.00472bb0
add esp, 0xc
push 0x66
push dword [0x4b8678]
call fcn.0040308d
add esp, 8
mov dword [0x4b8688], eax
push 0x9d
push dword [0x4b8678]
call fcn.0040308d
add esp, 8
mov dword [0x4b868c], eax
call fcn.00460afa
mov dword [0x4b7c68], 0xa
mov dword [0x4b7c6c], 0x14
mov dword [0x4b7c70], 0x19
mov dword [0x4b7c74], 0x1c
push 0x75
push dword [0x4b8678]
call fcn.0040308d
add esp, 8
mov edi, dword [0x4b7c74]
mov ebx, dword [0x4b7c6c]
lea eax, [eax + eax*4]
lea ebp, [eax + eax + 0x19]
push 0x76
push dword [0x4b8678]
call fcn.0040308d
add esp, 8
mov esi, eax
imul esi, ebx
add esi, edi
mov edi, dword [0x4b8668]
call fcn.0045c954
test eax, eax
je 0x45d066
push 2
push edi
call dword [0x4b7134]
jmp 0x45d06b
mov eax, 0x12340042
lea edi, [esp + 0x18]
mov dword [edi], 0x28
push edi
push eax
call fcn.0045cb19
mov eax, edi
mov edi, dword [edi + 0xc]
mov ebx, dword [eax + 0x10]
sub edi, dword [eax + 4]
sub ebx, dword [eax + 8]
mov eax, dword [0x48f058]
cmp ebp, edi
cmovle edi, ebp
cmp esi, ebx
cmovle ebx, esi
xor ecx, ecx
push eax
push ecx
push ecx
call fcn.00413079
add esp, 0xc
mov dword [esp], eax
push 0x6f
push dword [0x4b8678]
call fcn.00402fed
add esp, 8
movzx ebp, al
shl ebp, 0x15
or ebp, 0xcf0000
push 0x71
push dword [0x4b8678]
call fcn.0040308d
add esp, 8
mov esi, ebp
and esi, 0xea0000
xor ecx, ecx
inc ecx
cmp eax, ecx
cmovne esi, ebp
push 0x58
push dword [0x4b8678]
call fcn.00402fed
add esp, 8
movzx ebp, al
push 0x81
push dword [0x4b8678]
call fcn.00402fed
add esp, 8
test al, al
lea ecx, [ebp*8 + 0x200]
lea edx, [ebp*8]
mov eax, 0x80000000
cmovne edx, ecx
xor ecx, ecx
push ecx
push dword [esp + 0x5c]
push ecx
mov ecx, 0
push ecx
push ebx
mov ebx, 0
push edi
push eax
push eax
push esi
mov eax, dword [esp + 0x24]
push eax
push eax
mov esi, eax
push edx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [0x4b8668], eax
push esi
call fcn.00410c0e
add esp, 4
xor ecx, ecx
xor edx, edx
call fcn.00460c4b
mov dword [0x4b7154], 0x4985f8
push 0x4b7154
push 0x4b7158
push dword [0x4b8678]
call fcn.0044afcf
add esp, 0xc
mov edx, dword [0x4b8678]
mov ecx, eax
mov dword [0x4b8660], eax
call fcn.00461196
push dword [0x4b8678]
push 0x4b6048
call fcn.0040f918
add esp, 8
mov dword [0x4b8690], eax
push eax
push dword [0x4b8660]
call fcn.0045180f
add esp, 8
push 0x62
push dword [0x4b8678]
call fcn.0040308d
add esp, 8
mov esi, eax
push 0x75
push dword [0x4b8678]
call fcn.0040308d
add esp, 8
mov edi, eax
push 0x76
push dword [0x4b8678]
call fcn.0040308d
add esp, 8
push esi
push edi
push eax
push dword [0x4b8660]
call fcn.0044b1f4
add esp, 0x10
lea esi, [esp + 4]
push esi
push dword [0x4b8668]
call dword [sym.imp.USER32.dll_GetWindowRect]
lea edi, [esp + 0x18]
push edi
push dword [0x4b8668]
call dword [sym.imp.USER32.dll_GetClientRect]
push 0x82
push dword [0x4b8678]
call fcn.0040308d
add esp, 8
mov ecx, dword [esi + 8]
mov dword [0x4b7c78], eax
mov dword [0x4b7c7c], eax
add eax, eax
mov edx, dword [0x4b8660]
add ecx, eax
add eax, dword [esi + 0xc]
sub ecx, dword [esi]
sub eax, dword [esi + 4]
sub ecx, dword [edi + 8]
sub eax, dword [edi + 0xc]
add ecx, dword [edi]
add eax, dword [edi + 4]
mov dword [0x4b7c70], ecx
mov dword [0x4b7c74], eax
mov esi, dword [edx + 0x128]
mov edx, dword [edx + 0x12c]
imul edx, dword [0x4b7c68]
imul esi, dword [0x4b7c6c]
add edx, ecx
add esi, eax
push 0xe
push esi
push edx
push ebx
push ebx
push ebx
push dword [0x4b8668]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [0x4b7c68]
lea ecx, [eax + 0xf]
sar ecx, 0x1f
shr ecx, 0x1c
lea edi, [eax + ecx + 0xf]
sar edi, 4
imul edi, dword [0x4b7c6c]
add edi, edi
push ebx
xor ebp, ebp
inc ebp
push ebp
push edi
call fcn.00410b8c
add esp, 0xc
mov esi, eax
push edi
push ebx
push eax
call fcn.00472bb0
add esp, 0xc
push esi
push ebp
push ebp
push dword [0x4b7c6c]
push dword [0x4b7c68]
call dword [sym.imp.GDI32.dll_CreateBitmap]
mov dword [0x4b7c80], eax
push esi
call fcn.00410c0e
add esp, 4
push dword [0x4b7c6c]
push dword [0x4b7c68]
push dword [0x4b7c80]
push dword [0x4b8668]
call dword [sym.imp.USER32.dll_CreateCaret]
mov eax, dword [0x4b8660]
lea edx, [esp + 0x18]
mov dword [edx], 0x1c
mov dword [edx + 4], 0x1f
mov dword [edx + 8], ebx
mov eax, dword [eax + 0x128]
lea ecx, [eax - 1]
mov dword [edx + 0xc], ecx
mov dword [edx + 0x10], eax
mov dword [edx + 0x14], ebx
push ebx
push edx
push ebp
push dword [0x4b8668]
call dword [sym.imp.USER32.dll_SetScrollInfo]
mov dword [0x4b7c84], ebx
mov dword [0x4b7c88], ebx
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
mov dword [0x4b7c8c], eax
push ebx
push dword [0x4b8668]
call dword [sym.imp.USER32.dll_GetSystemMenu]
mov dword [0x4b7c90], eax
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov esi, dword [sym.imp.USER32.dll_AppendMenuA]
mov dword [0x4b7c94], eax
push 0x49def1
push 0x190
push ebx
push eax
call esi
push str.Paste
push 0x1a0
push ebx
push dword [0x4b7c94]
call esi
call dword [sym.imp.USER32.dll_CreateMenu]
mov dword [0x4b7c98], eax
push ebp
push 0x4b7c9c
call fcn.0041e4a8
add esp, 8
call fcn.00461219
mov eax, 0xfffffff8
mov ebp, dword [eax + 0x4b7c98]
xor edi, edi
mov dword [esp], eax
push edi
push edi
mov eax, 0x800
push eax
mov ebx, 0x800
push ebp
mov esi, dword [sym.imp.USER32.dll_AppendMenuA]
call esi
push str.Event_Log
mov eax, 0x10
push eax
push edi
push ebp
call esi
push edi
push edi
push ebx
mov ebx, 0x800
push ebp
call esi
push str.New_Session...
push 0x20
push edi
push ebp
call esi
push str.Duplicate_Session
push 0x30
push edi
push ebp
call esi
push str.Saved_Sessions
push dword [0x4b7c98]
mov eax, 0x10
push eax
push ebp
call esi
push str.Change_Settings...
push 0x50
push edi
push ebp
call esi
push edi
push edi
push ebx
push ebp
call esi
push str.Copy_All_to_Clipboard
push 0x170
push edi
push ebp
call esi
push str.Clear_Scrollback
push 0x60
push edi
push ebp
call esi
push str.Reset_Terminal
push 0x70
push edi
push ebp
call esi
push edi
push edi
push ebx
push ebp
call esi
push 0x71
push dword [0x4b8678]
call fcn.0040308d
add esp, 8
xor ecx, ecx
cmp eax, 1
sete cl
push str.Full_Screen
push 0x180
push ecx
push ebp
call esi
push edi
push edi
push ebx
push ebp
call esi
call fcn.004665ee
test al, al
je 0x45d4b6
push str.Help
push 0x140
push 0
push ebp
call dword [sym.imp.USER32.dll_AppendMenuA]
push dword [0x48f058]
push str.About__s
call fcn.004560a0
add esp, 8
mov esi, eax
push eax
push 0x150
push 0
push ebp
call dword [sym.imp.USER32.dll_AppendMenuA]
push esi
call fcn.00410c0e
add esp, 4
mov eax, dword [esp]
add eax, 4
jne 0x45d3ce
cmp byte [0x4b8684], 0
je 0x45d50c
mov eax, dword [0x4b6048]
push str.Running_with_restricted_process_ACL
push 0x4b6048
call dword [eax]
add esp, 8
call fcn.0046129a
xor ebp, ebp
push ebp
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
movzx eax, ax
push 0x14
lea esi, [esp + 0x1c]
push esi
push 0x1004
push eax
call dword [sym.imp.KERNEL32.DLL_GetLocaleInfoA]
push esi
call fcn.0047cd48
add esp, 4
mov dword [0x4b860c], eax
push dword [esp + 0x64]
push dword [0x4b8668]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x4b8668]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov dword [0x4b7ca8], ebp
mov dword [0x4b7cac], ebp
call fcn.004614c6
call dword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
cmp eax, dword [0x4b8668]
sete cl
push ecx
push dword [0x4b8660]
call fcn.0045181e
add esp, 8
push dword [0x4b8668]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov edi, dword [sym.imp.USER32.dll_PeekMessageW]
call fcn.004017ac
test al, al
mov ebx, 0
jne 0x45d5df
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x45d5df
call dword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
cmp eax, dword [0x4b8668]
sete cl
push ecx
push dword [0x4b8660]
call fcn.0045181e
add esp, 8
xor ebx, ebx
dec ebx
lea eax, [esp + 4]
push eax
call fcn.00466182
add esp, 4
mov esi, eax
push 0x1cff
push ebx
push 0
push eax
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
cmp eax, dword [esp + 4]
jae 0x45d612
push dword [esi + eax*4]
call fcn.004662b3
add esp, 4
push esi
call fcn.00410c0e
add esp, 4
mov ebx, dword [sym.imp.USER32.dll_IsWindow]
lea esi, [esp + 0x18]
push 1
push ebp
push ebp
push ebp
push esi
call edi
test eax, eax
je 0x45d666
cmp dword [esp + 0x1c], 0x12
je 0x45d670
push dword [0x4b8694]
call ebx
test eax, eax
je 0x45d655
push esi
push dword [0x4b8694]
call dword [sym.imp.USER32.dll_IsDialogMessageA]
test eax, eax
jne 0x45d65c
push esi
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [esp + 0x1c], 0x8005
je 0x45d625
call fcn.00401761
jmp 0x45d59d
push dword [esp + 0x20]
call fcn.0045d7b7
lea eax, [esp + 4]
lea edi, [esp + 0x18]
push 0
push eax
push edi
push esi
call fcn.0046e14e
add esp, 0x10
mov eax, dword [edi]
test eax, eax
jle 0x45d6da
xor ebx, ebx
xor edi, edi
inc edi
mov edx, dword [esp + 4]
mov ecx, dword [0x4b8678]
lea ebp, [ebx + 1]
cmp ebp, eax
mov eax, 0
mov esi, dword [edx + ebx*4]
jge 0x45d6b6
mov eax, dword [edx + ebx*4 + 4]
push ecx
push edi
push eax
push esi
call fcn.00401831
add esp, 0x10
cmp eax, edi
je 0x45d6d0
cmp eax, 2
jne 0x45d6f1
add ebx, 2
mov ebp, ebx
mov eax, dword [esp + 0x18]
mov ebx, ebp
cmp ebp, eax
jl 0x45d699
push dword [0x4b8678]
call fcn.00402d6e
add esp, 4
mov ebp, dword [esp + 0x58]
jmp 0x45cde3
cmp eax, 0xfffffffe
jne 0x45d701
push esi
push str.option___s__requires_an_argument
call fcn.0045d86a
push 0x4a1a16
push esi
call fcn.0047eec0
add esp, 8
test eax, eax
jne 0x45d774
mov edi, dword [0x48f058]
push edi
push str.This_procedure_will_remove_ALL_Registry_entries_nassociated_with__s__and_will_also_remove_nthe_random_seed_file.__This_only_affects_the_ncurrently_logged_in_user.__n_nTHIS_PROCESS_WILL_DESTROY_YOUR_SAVED_SESSIONS._nAre_you_really_sure_you_want_to_continue_
call fcn.004560a0
add esp, 8
mov esi, eax
push edi
push str._s_Warning
call fcn.004560a0
add esp, 8
mov edi, eax
push 4
push 0x134
push eax
push esi
call fcn.0046dfde
add esp, 0x10
cmp eax, 6
jne 0x45d754
call fcn.0046ce83
push esi
call fcn.00410c0e
add esp, 4
push edi
call fcn.00410c0e
add esp, 4
push 0
call fcn.0047a8db
push 0
call fcn.0045d7b7
push str._pgpfp
push esi
call fcn.0047eec0
add esp, 8
test eax, eax
jne 0x45d79c
call fcn.0046e0c3
push 1
call fcn.0047a8db
push str.Serialised_configuration_data_was_invalid
call fcn.0045d80f
cmp byte [esi], 0x2d
jne 0x45d7ac
push esi
push str.unknown_option___s_
call fcn.0045d86a
push esi
push str.unexpected_argument___s_
call fcn.0045d86a