Function at 0x4048df
Capabilities:
Get geographical location
Get keyboard layout
Hide graphical window

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x44
mov edi, dword [esp + 0x58]
mov esi, dword [esp + 0x5c]
mov eax, dword [0x500034]
xor eax, esp
mov dword [esp + 0x40], eax
call fcn.0043ba40
mov dword [0x500be8], edi
mov dword [0x500be4], esi
call fcn.00434da0
call fcn.0041f810
call fcn.00424450
call fcn.0041d6e0
call fcn.0043cdf0
cmp dword [0x503304], 4
jb 0x404748
jne 0x404758
cmp dword [0x50330c], 2
je 0x404758
push str.MSWHEEL_ROLLMSG
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
mov dword [section..data], eax
call fcn.0040b280
push str.user32.dll
call fcn.0043baa0
add esp, 4
mov esi, eax
push str.winmm.dll
call fcn.0043baa0
add esp, 4
mov ebx, eax
push str.shcore.dll
call fcn.0043baa0
add esp, 4
mov edi, eax
test esi, esi
je 0x4047ab
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.FlashWindowEx
push esi
call ebp
mov dword [0x501d54], eax
push str.ToUnicodeEx
push esi
call ebp
jmp 0x4047b7
mov dword [0x501d54], 0
xor eax, eax
mov dword [0x501e14], eax
test ebx, ebx
je 0x4047ce
push str.PlaySoundA
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x4047d0
xor eax, eax
mov dword [0x501d48], eax
test esi, esi
je 0x404803
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetMonitorInfoA
push esi
call ebx
mov dword [0x501dd4], eax
push str.MonitorFromPoint
push esi
call ebx
mov dword [0x501dd8], eax
push str.MonitorFromWindow
push esi
call ebx
jmp 0x404819
mov dword [0x501dd4], 0
mov dword [0x501dd8], 0
xor eax, eax
mov dword [0x501d84], eax
test edi, edi
je 0x404830
push str.GetDpiForMonitor
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x404832
xor eax, eax
mov dword [0x501d80], eax
test esi, esi
je 0x404858
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetSystemMetricsForDpi
push esi
call edi
mov dword [0x501d5c], eax
push str.AdjustWindowRectExForDpi
push esi
call edi
jmp 0x404864
mov dword [0x501d5c], 0
xor eax, eax
mov dword [0x501d60], eax
call fcn.00437410
mov dword [0x500bf0], eax
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
cmp eax, 1
jbe 0x4048c8
push dword [0x4c777c]
push str._s_Fatal_Error
call fcn.00438880
add esp, 8
mov esi, eax
push 0x30
push eax
push str.Failed_to_initialize_COM_subsystem
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call fcn.00439350
add esp, 4
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.0049e340
mov eax, 1
add esp, 0x44
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
push dword [esp + 0x60]
push dword [0x500bf0]
call fcn.0040acf0
add esp, 8
push 0xb0c
push 0
push 0x500bf4
call fcn.004a10a0
add esp, 0xc
push 0x6f
push dword [0x500bf0]
call fcn.004376e0
add esp, 8
mov dword [0x5017b0], eax
push 0xa6
push dword [0x500bf0]
call fcn.004376e0
add esp, 8
mov dword [0x5017b4], eax
mov dword [0x501700], 0xa
mov dword [0x501704], 0x14
mov dword [0x501708], 0x19
mov dword [0x50170c], 0x1c
push 0x7e
push dword [0x500bf0]
call fcn.004376e0
add esp, 8
lea eax, [eax + eax*4]
lea ebp, [eax + eax]
add ebp, 0x19
mov edi, dword [0x50170c]
mov ebx, dword [0x501704]
push 0x7f
push dword [0x500bf0]
call fcn.004376e0
add esp, 8
mov esi, eax
imul esi, ebx
add esi, edi
cmp dword [0x501dd4], 0
je 0x4049d1
mov eax, dword [0x501d84]
test eax, eax
je 0x4049d1
push 2
push dword [0x500004]
call eax
mov dword [esp + 0x18], 0x28
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [0x501dd4]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov dword [esp + 8], eax
mov dword [esp + 0xc], ecx
mov eax, dword [esp + 0x24]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x14], eax
jmp 0x4049e3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
sub eax, dword [esp + 8]
cmp ebp, eax
cmovle eax, ebp
mov dword [esp + 4], eax
sub ebx, dword [esp + 0xc]
cmp esi, ebx
cmovle ebx, esi
push dword [0x4c7780]
call fcn.0042e560
add esp, 4
test eax, eax
jne 0x404a17
xor edi, edi
jmp 0x404a1e
mov al, byte [eax + 0x58]
and al, 1
mov edi, eax
mov esi, dword [0x4c777c]
push esi
push 0
push 0
call fcn.00438960
add esp, 0xc
mov dword [esp], eax
push esi
push 0
push 0
call fcn.00438960
add esp, 0xc
mov dword [0x501710], eax
push esi
push 0
push 0
call fcn.00438960
add esp, 0xc
mov dword [0x501714], eax
push pe_nt_image_headers32
push dword [0x500bf0]
call fcn.00437630
add esp, 8
movzx esi, al
shl esi, 0x15
or esi, 0xcf0000
push 0x7a
push dword [0x500bf0]
call fcn.004376e0
add esp, 8
mov ecx, esi
and ecx, 0xea0000
mov edx, edi
test dl, dl
cmovne esi, ecx
cmp eax, 1
cmove esi, ecx
push 0x61
push dword [0x500bf0]
call fcn.00437630
add esp, 8
movzx edi, al
lea ebp, [edi*8]
push 0x8a
push dword [0x500bf0]
call fcn.00437630
add esp, 8
lea edi, [edi*8 + 0x200]
test al, al
cmove edi, ebp
mov byte [0x501718], 1
call fcn.00401060
push 0
push dword [esp + 0x5c]
push 0
push 0
push ebx
push dword [esp + 0x18]
push 0x80000000
push 0x80000000
push esi
mov ecx, dword [esp + 0x24]
mov ebx, ecx
push ecx
push eax
push edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [0x500004], eax
test eax, eax
jne 0x404b2a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0043cee0
add esp, 4
push eax
push str.Unable_to_create_terminal_window:__s
call fcn.00405390
mov dword [0x501730], 0
mov dword [0x50172c], 0
mov dword [0x501728], 0
mov dword [0x501724], 0
mov dword [0x501720], 0
mov dword [0x50171c], 0
cmp dword [0x501d80], 0
je 0x404bbd
mov ecx, dword [0x501d84]
test ecx, ecx
je 0x404bbd
push 1
push eax
call ecx
lea ecx, [esp + 8]
lea edx, [esp + 0x18]
push ecx
push edx
push 0
push eax
call dword [0x501d80]
test eax, eax
jne 0x404baa
mov ecx, dword [esp + 0x18]
mov dword [0x50171c], ecx
mov eax, dword [esp + 8]
mov dword [0x501720], eax
jmp 0x404bb5
mov ecx, dword [0x50171c]
mov eax, dword [0x501720]
test ecx, ecx
je 0x404bbd
test eax, eax
jne 0x404bf2
push dword [0x500004]
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
mov esi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x58
push eax
call esi
mov dword [0x50171c], eax
push 0x5a
push edi
call esi
mov dword [0x501720], eax
push edi
push dword [0x500004]
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebx
call fcn.00439350
add esp, 4
xor esi, esi
xor ecx, ecx
xor edx, edx
call fcn.00405400
mov dword [0x501778], 0
push 0x414
push 8
push 1
call fcn.004392c0
add esp, 0xc
mov dword [0x501774], eax
mov dword [eax], 0x1060300
nop
nop
nop
nop
mov byte [eax + esi*4 + 7], 4
mov byte [eax + esi*4 + 0xb], 4
add esi, 2
cmp esi, 0x106
jne 0x404c30
mov dword [0x501734], 0x4c7004
push 0x501734
push 0x500bf4
push dword [0x500bf0]
call fcn.0040e400
add esp, 0xc
mov esi, eax
mov dword [0x501738], eax
mov edi, dword [0x500bf0]
cmp dword [eax + 0x1120], 1
je 0x404c94
push 0x3dc
push str._home_simon_mem_.build_workdirs_bob_fffbk9my_putty_windows_window.c
push str.term__mouse_select_clipboards_0___CLIP_LOCAL
call fcn.004adb03
add esp, 0xc
mov dword [esi + 0x112c], 1
push 0x9f
push edi
call fcn.00437630
add esp, 8
test al, al
je 0x404cca
mov eax, dword [esi + 0x112c]
lea ecx, [eax + 1]
mov dword [esi + 0x112c], ecx
mov dword [esi + eax*4 + 0x1120], 2
push 0xa0
push edi
call fcn.004376e0
add esp, 8
xor ecx, ecx
cmp eax, 2
sete cl
add ecx, ecx
cmp eax, 1
cmove ecx, eax
mov dword [esi + 0x1130], ecx
push dword [0x500bf0]
push 0x50000c
call fcn.00425660
add esp, 8
mov dword [0x50173c], eax
push eax
push dword [0x501738]
call fcn.00415c40
add esp, 8
push 0x6b
push dword [0x500bf0]
call fcn.004376e0
add esp, 8
mov esi, eax
push 0x7e
push dword [0x500bf0]
call fcn.004376e0
add esp, 8
mov edi, eax
push 0x7f
push dword [0x500bf0]
call fcn.004376e0
add esp, 8
push esi
push edi
push eax
push dword [0x501738]
call fcn.0040e9c0
add esp, 0x10
lea eax, [esp + 8]
push eax
push dword [0x500004]
call dword [sym.imp.USER32.dll_GetWindowRect]
lea ebx, [esp + 0x18]
push ebx
push dword [0x500004]
call dword [sym.imp.USER32.dll_GetClientRect]
push 0x8b
push dword [0x500bf0]
call fcn.004376e0
add esp, 8
mov dword [0x501740], eax
mov dword [0x501744], eax
add eax, eax
mov ecx, dword [esp + 0x10]
add ecx, eax
mov edx, dword [esp + 8]
mov esi, dword [esp + 0xc]
add edx, dword [esp + 0x20]
sub ecx, edx
add ecx, dword [esp + 0x18]
add eax, dword [esp + 0x14]
mov dword [0x501708], ecx
add esi, dword [esp + 0x24]
sub eax, esi
add eax, dword [esp + 0x1c]
mov dword [0x50170c], eax
mov edx, dword [0x501738]
mov esi, dword [edx + 0x128]
mov edx, dword [edx + 0x12c]
imul edx, dword [0x501700]
add edx, ecx
imul esi, dword [0x501704]
add esi, eax
push 0xe
push esi
push edx
push 0
push 0
push 0
push dword [0x500004]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov edi, dword [0x501700]
lea eax, [edi + 0xf]
add edi, 0x1e
test eax, eax
cmovns edi, eax
sar edi, 4
imul edi, dword [0x501704]
add edi, edi
push 0
push 1
push edi
call fcn.004392c0
add esp, 0xc
mov esi, eax
push edi
push 0
push eax
call fcn.004a10a0
add esp, 0xc
push esi
push 1
push 1
push dword [0x501704]
push dword [0x501700]
call dword [sym.imp.GDI32.dll_CreateBitmap]
mov dword [0x501748], eax
push esi
call fcn.00439350
add esp, 4
push dword [0x501704]
push dword [0x501700]
push dword [0x501748]
push dword [0x500004]
call dword [sym.imp.USER32.dll_CreateCaret]
mov dword [esp + 0x18], 0x1c
mov dword [esp + 0x1c], 0x1f
mov dword [esp + 0x20], 0
mov eax, dword [0x501738]
mov eax, dword [eax + 0x128]
lea ecx, [eax - 1]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], 0
push 0
push ebx
push 1
push dword [0x500004]
call dword [sym.imp.USER32.dll_SetScrollInfo]
mov dword [0x50174c], 0
mov dword [0x501750], 0
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
mov dword [0x501754], eax
push 0
push dword [0x500004]
call dword [sym.imp.USER32.dll_GetSystemMenu]
mov dword [0x501758], eax
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov dword [0x50175c], eax
mov ebp, dword [sym.imp.USER32.dll_AppendMenuA]
push 0x4dd776
push 0x190
push 0
push eax
call ebp
push str.Paste
push 0x1a0
push 0
push dword [0x50175c]
call ebp
call dword [sym.imp.USER32.dll_CreateMenu]
mov dword [0x501760], eax
push 1
push 0x501764
call fcn.004337d0
add esp, 8
mov esi, dword [sym.imp.USER32.dll_DeleteMenu]
nop
nop
push 0x400
push 0
push dword [0x501760]
call esi
test eax, eax
jne 0x404f50
cmp dword [0x501764], 2
jl 0x404fb4
mov esi, 1
mov edi, 0x1000
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [0x501768]
push dword [eax + esi*4]
push edi
push 0
push dword [0x501760]
call ebp
add esi, 1
mov eax, dword [0x501764]
cmp eax, 0x401
mov ecx, 0x401
cmovl ecx, eax
add edi, 0x10
cmp esi, ecx
jl 0x404f80
cmp eax, 1
jg 0x404fcc
push str._No_sessions_
push 0x1000
push 1
push dword [0x501760]
call dword [sym.imp.USER32.dll_AppendMenuA]
xor eax, eax
mov bl, 1
jmp 0x40501c
push dword [0x4c777c]
push str.About__s
call fcn.00438880
add esp, 8
mov esi, eax
push eax
push 0x150
push 0
push edi
call ebp
push esi
call fcn.00439350
add esp, 4
mov eax, 1
test bl, 1
mov ebx, 0
je 0x40510d
mov edi, dword [eax*4 + 0x501758]
push 0
push 0
push 0x800
push edi
call ebp
push str.Event_Log
push 0x10
push 0
push edi
call ebp
push 0
push 0
push 0x800
push edi
call ebp
push str.New_Session...
push 0x20
push 0
push edi
call ebp
push str.Duplicate_Session
push 0x30
push 0
push edi
call ebp
push str.Saved_Sessions
push dword [0x501760]
push 0x10
push edi
call ebp
push str.Change_Settings...
push 0x50
push 0
push edi
call ebp
push 0
push 0
push 0x800
push edi
call ebp
push str.Copy_All_to_Clipboard
push 0x170
push 0
push edi
call ebp
push str.Clear_Scrollback
push 0x60
push 0
push edi
call ebp
push str.Reset_Terminal
push 0x70
push 0
push edi
call ebp
push 0
push 0
push 0x800
push edi
call ebp
push 0x7a
push dword [0x500bf0]
call fcn.004376e0
add esp, 8
xor ecx, ecx
cmp eax, 1
sete cl
push str.Full_Screen
push 0x180
push ecx
push edi
call ebp
push 0
push 0
push 0x800
push edi
call ebp
call fcn.0040b3f0
test al, al
je 0x404fe0
push 0x4e1ca5
push 0x140
push 0
push edi
call ebp
jmp 0x404fe0
call fcn.0043c990
test al, al
je 0x40512a
mov eax, dword [0x50000c]
push str.Running_with_restricted_process_ACL
push 0x50000c
call dword [eax]
add esp, 8
push dword [0x500004]
call fcn.00425800
add esp, 4
call fcn.00405be0
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
movzx eax, ax
push 0x14
lea esi, [esp + 0x1c]
push esi
push 0x1004
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push esi
call fcn.004ae9f8
add esp, 4
mov dword [0x501dc4], eax
push dword [esp + 0x64]
push dword [0x500004]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x500004]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
cmp eax, dword [0x500004]
sete cl
push ecx
push dword [0x501738]
call fcn.00415c50
add esp, 8
push dword [0x500004]
call dword [sym.imp.USER32.dll_UpdateWindow]
push dword [0x501770]
push 0x500008
push dword [0x500004]
call fcn.0040b1c0
add esp, 0xc
mov ebx, dword [sym.imp.USER32.dll_PeekMessageW]
mov ebp, dword [sym.imp.USER32.dll_IsWindow]
jmp 0x4051dd
call fcn.00425a70
xor edi, edi
call fcn.00425ac0
test al, al
jne 0x405224
push 0
push 0
push 0
push 0
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x405224
call dword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
cmp eax, dword [0x500004]
sete cl
push ecx
push dword [0x501738]
call fcn.00415c50
add esp, 8
mov edi, 0xffffffff
call fcn.00425ee0
mov esi, eax
push 0x1cff
push edi
push 0
push eax
push dword [eax + 0x100]
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
cmp eax, dword [esi + 0x100]
jae 0x405252
push eax
push esi
call fcn.00425f80
add esp, 8
push esi
call fcn.00425ff0
add esp, 4
lea edi, [esp + 0x18]
jmp 0x405285
push edi
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [esp + 0x1c], 0x8005
jne 0x4051d8
push 1
push 0
push 0
push 0
push edi
call ebx
test eax, eax
je 0x4051d8
cmp dword [esp + 0x1c], 0x12
je 0x4052bb
call fcn.0041d550
mov esi, eax
push eax
call ebp
test eax, eax
je 0x405270
push edi
push esi
call dword [sym.imp.USER32.dll_IsDialogMessageA]
test eax, eax
jne 0x405277
jmp 0x405270
push dword [esp + 0x20]
call fcn.00405da0
int3