Function at 0x484d85
Capabilities:
Authenticate hmac
Check http status code
Get geographical location
Get keyboard layout
Log keystrokes via input method manager
Log keystrokes via polling
Parse pe header
Read file via mapping
Resolve function by parsing pe exports
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x44
mov eax, dword [0x42b238]
mov ebp, dword [esp + 0x58]
mov dword [esp + 0x40], eax
call fcn.0048f76e
mov dword [0x428ea8], ebp
mov dword [0x428eac], 0
mov dword [0x428eb0], 5
call fcn.0048fa98
call fcn.00480078
call fcn.0048f1b0
call fcn.00483829
call fcn.0048f7b9
test eax, eax
je 0x484e3d
cmp dword [0x429764], 4
jb 0x484de9
jne 0x484df9
cmp dword [0x429770], 2
je 0x484df9
push str.MSWHEEL_ROLLMSG
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
mov dword [0x42b1d4], eax
call fcn.0048e680
push str.user32.dll
call fcn.0048f6f9
add esp, 4
mov edi, eax
push str.winmm.dll
call fcn.0048f6f9
add esp, 4
mov esi, eax
test edi, edi
je 0x484e65
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.FlashWindowEx
push edi
call ebx
mov dword [0x428e98], eax
push str.ToUnicodeEx
push edi
call ebx
jmp 0x484e71
push dword [0x402050]
push str._s_Fatal_Error
call fcn.0043f758
add esp, 8
mov esi, eax
push 0x30
push esi
push str.Windows_refuses_to_report_a_version
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
jmp 0x484ecc
xor eax, eax
mov dword [0x428e98], 0
test esi, esi
mov dword [0x428e88], eax
je 0x484e88
push str.PlaySoundA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x484e8a
xor eax, eax
mov dword [0x428cc8], eax
call fcn.0043179c
mov dword [0x428eb4], eax
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
cmp eax, 2
jb 0x484eec
push dword [0x402050]
push str._s_Fatal_Error
call fcn.0043f758
add esp, 8
mov esi, eax
push 0x30
push esi
push str.Failed_to_initialize_COM_subsystem
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call fcn.0043f9d4
add esp, 4
mov ecx, dword [esp + 0x40]
xor esi, esi
inc esi
call fcn.00497c4a
mov eax, esi
add esp, 0x44
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
mov eax, dword [0x402054]
mov esi, dword [esp + 0x60]
mov dword [0x428eb8], eax
push eax
call fcn.0044420b
add esp, 4
test eax, eax
mov dword [0x428ebc], 0
je 0x484f19
mov eax, dword [eax + 0x4c]
mov dword [0x428ebc], eax
xor edi, edi
push edi
push 0x78
push dword [0x428eb4]
call fcn.00431ee3
add esp, 0xc
push dword [0x428eb4]
mov dword [esp + 4], 0
push edi
call fcn.0044775c
add esp, 8
mov bl, byte [esi]
test bl, bl
je 0x484f68
lea edi, [esi + 2]
movsx eax, bl
push eax
call fcn.004a7635
add esp, 4
test eax, eax
je 0x485754
mov bl, byte [edi - 1]
inc edi
test bl, bl
jne 0x484f4c
xor ebx, ebx
or ebx, dword [esp]
push dword [0x428eb4]
call fcn.00431725
add esp, 4
or ebx, dword [0x428ec0]
je 0x484f95
push dword [0x428eb4]
call fcn.00440120
add esp, 4
test eax, eax
jne 0x484fa2
call fcn.00483862
test eax, eax
je 0x485a8e
push 0
push dword [0x428eb4]
call fcn.00431a8c
add esp, 8
push eax
call fcn.0043f79e
add esp, 4
mov esi, eax
push 0x409616
push esi
call fcn.004a8220
add esp, 8
cmp byte [esi + eax], 0
lea ebx, [esi + eax]
je 0x484ffc
push pe_nt_image_headers32
push ebx
call fcn.0049af80
add esp, 8
mov edi, eax
test edi, edi
je 0x484ffc
mov byte [edi], 0
push ebx
push 0x34
push dword [0x428eb4]
call fcn.0043203b
add esp, 0xc
inc edi
mov ebx, edi
push 0x3a
push ebx
call fcn.0043f67d
add esp, 8
mov edi, eax
test edi, edi
je 0x485022
lea eax, [edi + 1]
push 0x3a
push eax
call fcn.0043f67d
add esp, 8
test eax, eax
jne 0x485022
mov byte [edi], 0
mov edi, dword [esp + 0x5c]
mov eax, esi
jmp 0x48502e
mov byte [eax], cl
inc eax
inc ebx
mov cl, byte [ebx]
cmp cl, 9
je 0x48502d
cmp cl, 0x20
je 0x48502d
test cl, cl
jne 0x48502a
xor ebx, ebx
mov byte [eax], 0
push esi
push ebx
push dword [0x428eb4]
call fcn.0043203b
add esp, 0xc
push esi
call fcn.0043f9d4
add esp, 4
test edi, edi
jne 0x4850b4
lea esi, [esp + 0x18]
mov dword [esi], ebx
mov dword [esi + 4], 0x485be2
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebp
push 0xc8
push ebp
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [esi + 0x14], eax
push 0x7f01
push ebx
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
push dword [0x402050]
push ebx
push ebx
call fcn.004404de
add esp, 0xc
mov dword [esi + 0x24], eax
push esi
call dword [sym.imp.USER32.dll_RegisterClassW]
push 0xb10
push 0
push 0x4278c4
call fcn.0049acf0
add esp, 0xc
push 0x64
push dword [0x428eb4]
call fcn.0043194f
add esp, 8
mov dword [0x428ec4], eax
push 0x90
push dword [0x428eb4]
call fcn.0043194f
add esp, 8
mov dword [0x428ec8], eax
call fcn.00489118
mov dword [0x4283d4], 0xa
mov dword [0x4283d8], 0x14
mov dword [0x4283dc], 0x19
mov dword [0x4283e0], 0x1c
push 0x73
push dword [0x428eb4]
call fcn.0043194f
add esp, 8
mov edi, dword [0x4283e0]
mov ebx, dword [0x4283d8]
lea eax, [eax + eax*4]
lea ebp, [eax + eax + 0x19]
push 0x74
push dword [0x428eb4]
call fcn.0043194f
add esp, 8
mov esi, eax
imul esi, ebx
add esi, edi
mov edi, dword [0x428eac]
call fcn.00484ae8
test eax, eax
je 0x485176
push 2
push edi
call dword [0x4278a4]
jmp 0x48517b
mov eax, 0x12340042
lea ebx, [esp + 0x18]
mov dword [ebx], 0x28
push ebx
push eax
call fcn.00484ca9
mov eax, dword [ebx + 0xc]
mov edi, dword [ebx + 0x10]
sub eax, dword [ebx + 4]
sub edi, dword [ebx + 8]
cmp ebp, eax
cmovle eax, ebp
cmp esi, edi
mov dword [esp], eax
mov eax, dword [0x402050]
cmovle edi, esi
xor ecx, ecx
push eax
push ecx
push ecx
call fcn.004404de
add esp, 0xc
mov esi, eax
push 0x6d
push dword [0x428eb4]
call fcn.0043194f
add esp, 8
test eax, eax
mov eax, 0xcf0000
mov ebx, 0xef0000
cmove ebx, eax
push 0x6f
push dword [0x428eb4]
call fcn.0043194f
add esp, 8
mov ebp, ebx
and ebp, 0xea0000
xor ecx, ecx
inc ecx
cmp eax, ecx
cmovne ebp, ebx
push 0x56
push dword [0x428eb4]
call fcn.0043194f
add esp, 8
xor ebx, ebx
test eax, eax
setne bl
push 0x7e
push dword [0x428eb4]
call fcn.0043194f
add esp, 8
test eax, eax
lea eax, [ebx*8 + 0x200]
lea ecx, [ebx*8]
cmovne ecx, eax
mov eax, 0x80000000
xor edx, edx
push edx
push dword [esp + 0x5c]
push edx
mov edx, 0
push edx
push edi
push dword [esp + 0x14]
push eax
push eax
push ebp
mov ebp, 0
push esi
push esi
push ecx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [0x428eac], eax
push esi
call fcn.0043f9d4
add esp, 4
xor ecx, ecx
xor edx, edx
call fcn.00489272
push ebp
push 0x4278c4
push dword [0x428eb4]
call fcn.00475103
add esp, 0xc
mov dword [0x428ea4], eax
push dword [0x428eb4]
push ebp
call fcn.0043d665
add esp, 8
mov dword [0x428ecc], eax
push eax
push dword [0x428ea4]
call fcn.0047b2fb
add esp, 8
push 0x60
push dword [0x428eb4]
call fcn.0043194f
add esp, 8
mov esi, eax
push 0x73
push dword [0x428eb4]
call fcn.0043194f
add esp, 8
mov edi, eax
push 0x74
push dword [0x428eb4]
call fcn.0043194f
add esp, 8
push esi
push edi
push eax
push dword [0x428ea4]
call fcn.004752f4
add esp, 0x10
lea esi, [esp + 8]
push esi
push dword [0x428eac]
call dword [sym.imp.USER32.dll_GetWindowRect]
lea edi, [esp + 0x18]
push edi
push dword [0x428eac]
call dword [sym.imp.USER32.dll_GetClientRect]
push 0x7f
push dword [0x428eb4]
call fcn.0043194f
add esp, 8
lea ecx, [eax + eax]
mov edx, edi
mov dword [0x4283e4], eax
mov dword [0x4283e8], eax
add ecx, dword [esi + 8]
sub ecx, dword [esi]
sub ecx, dword [edx + 8]
add ecx, dword [edx]
mov edx, dword [esi + 0xc]
sub edx, dword [esi + 4]
mov dword [0x4283dc], ecx
sub edx, dword [edi + 0xc]
add edx, dword [edi + 4]
lea eax, [edx + eax*2]
mov edx, dword [0x428ea4]
mov dword [0x4283e0], eax
mov esi, dword [edx + 0x128]
mov edx, dword [edx + 0x12c]
imul edx, dword [0x4283d4]
imul esi, dword [0x4283d8]
add edx, ecx
add esi, eax
push 0xe
push esi
push edx
push ebp
push ebp
push ebp
push dword [0x428eac]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [0x4283d4]
lea ecx, [eax + 0xf]
sar ecx, 0x1f
shr ecx, 0x1c
lea edi, [eax + ecx + 0xf]
sar edi, 4
imul edi, dword [0x4283d8]
add edi, edi
xor ebx, ebx
inc ebx
push ebx
push edi
call fcn.0043f807
add esp, 8
mov esi, eax
push edi
push ebp
push esi
call fcn.0049acf0
add esp, 0xc
push esi
push ebx
push ebx
push dword [0x4283d8]
push dword [0x4283d4]
call dword [sym.imp.GDI32.dll_CreateBitmap]
mov dword [0x4283ec], eax
push esi
call fcn.0043f9d4
add esp, 4
push dword [0x4283d8]
push dword [0x4283d4]
push dword [0x4283ec]
push dword [0x428eac]
call dword [sym.imp.USER32.dll_CreateCaret]
mov eax, dword [0x428ea4]
lea edx, [esp + 0x18]
mov dword [edx], 0x1c
mov dword [edx + 4], 0x1f
mov dword [edx + 8], ebp
mov eax, dword [eax + 0x128]
lea ecx, [eax - 1]
mov dword [edx + 0xc], ecx
mov dword [edx + 0x10], eax
mov dword [edx + 0x14], ebp
push ebp
push edx
push ebx
push dword [0x428eac]
call dword [sym.imp.USER32.dll_SetScrollInfo]
mov dword [0x4283f0], ebp
mov dword [0x4283f4], ebp
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
mov dword [0x4283f8], eax
push ebp
push dword [0x428eac]
call dword [sym.imp.USER32.dll_GetSystemMenu]
mov dword [0x4283fc], eax
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov dword [0x428400], eax
push str.Paste
push 0x190
push ebp
push eax
call dword [sym.imp.USER32.dll_AppendMenuA]
call dword [sym.imp.USER32.dll_CreateMenu]
mov dword [0x428404], eax
push ebx
push 0x428408
call fcn.00447761
add esp, 8
call fcn.00489776
mov edi, dword [sym.imp.USER32.dll_AppendMenuA]
mov eax, 0xfffffff8
mov ebx, dword [eax + 0x428404]
xor esi, esi
mov dword [esp], eax
push esi
push esi
mov eax, 0x800
push eax
mov ebp, 0x800
push ebx
call edi
push str.Event_Log
mov eax, 0x10
push eax
push esi
push ebx
call edi
push esi
push esi
push ebp
mov ebp, 0x800
push ebx
call edi
push str.New_Session...
push 0x20
push esi
push ebx
call edi
push str.Duplicate_Session
push 0x30
push esi
push ebx
call edi
push str.Saved_Sessions
push dword [0x428404]
mov eax, 0x10
push eax
push ebx
call edi
push str.Change_Settings...
push 0x50
push esi
push ebx
call edi
push esi
push esi
push ebp
push ebx
call edi
push str.Copy_All_to_Clipboard
push 0x170
push esi
push ebx
call edi
push str.Clear_Scrollback
push 0x60
push esi
push ebx
call edi
push str.Reset_Terminal
push 0x70
push esi
push ebx
call edi
push esi
push esi
push ebp
push ebx
call edi
push 0x6f
push dword [0x428eb4]
call fcn.0043194f
add esp, 8
xor ecx, ecx
cmp eax, 1
sete cl
push str.Full_Screen
push 0x180
push ecx
push ebx
call edi
push esi
push esi
push ebp
push ebx
call edi
call fcn.0048e82b
test eax, eax
je 0x485593
push str.Help
push 0x140
push 0
push ebx
call dword [sym.imp.USER32.dll_AppendMenuA]
push dword [0x402050]
push str.About__s
call fcn.0043f758
add esp, 8
mov esi, eax
push esi
push 0x150
push 0
push ebx
call dword [sym.imp.USER32.dll_AppendMenuA]
push esi
call fcn.0043f9d4
add esp, 4
mov eax, dword [esp]
add eax, 4
jne 0x4854b1
cmp dword [0x428ed0], 0
je 0x4855e4
push str.Running_with_restricted_process_ACL
push 0
call fcn.004842ab
add esp, 8
call fcn.004897f7
xor ebx, ebx
push ebx
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
movzx eax, ax
push 0x14
lea esi, [esp + 0x1c]
push esi
push 0x1004
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push esi
call fcn.004a65cf
add esp, 4
mov dword [0x428e34], eax
push dword [esp + 0x64]
push dword [0x428eac]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x428eac]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov dword [0x428414], ebx
mov dword [0x428418], ebx
call fcn.00489a1e
call dword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
cmp eax, dword [0x428eac]
sete cl
push ecx
push dword [0x428ea4]
call fcn.0047b30a
add esp, 8
push dword [0x428eac]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov edi, dword [sym.imp.USER32.dll_PeekMessageW]
call fcn.004302d1
test eax, eax
mov ebp, 0
jne 0x4856b7
xor ebp, ebp
push ebp
push ebp
push ebp
push ebp
push esi
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x4856b7
call dword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
cmp eax, dword [0x428eac]
sete cl
push ecx
push dword [0x428ea4]
call fcn.0047b30a
add esp, 8
xor ebp, ebp
dec ebp
lea eax, [esp + 8]
push eax
call fcn.0048e358
add esp, 4
mov esi, eax
push 0x1cff
push ebp
push 0
push esi
push dword [esp + 0x18]
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
cmp eax, dword [esp + 8]
jae 0x4856ed
push dword [esi + eax*4]
call fcn.0048e493
add esp, 4
push esi
jmp 0x4856ee
push esi
call fcn.0043f9d4
add esp, 4
mov ebp, dword [sym.imp.USER32.dll_IsWindow]
lea esi, [esp + 0x18]
push 1
push ebx
push ebx
push ebx
push esi
call edi
test eax, eax
je 0x485741
cmp dword [esp + 0x1c], 0x12
je 0x48574b
push dword [0x428ed4]
call ebp
test eax, eax
je 0x485730
push esi
push dword [0x428ed4]
call dword [sym.imp.USER32.dll_IsDialogMessageA]
test eax, eax
jne 0x485737
push esi
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [esp + 0x1c], 0x8005
je 0x485700
call fcn.00430298
jmp 0x485675
push dword [esp + 0x20]
call fcn.00485b0d
lea eax, [edi - 2]
cmp bl, 0x26
jne 0x48578d
cmp byte [edi - 1], 0x52
jne 0x48580f
mov cl, byte [edi]
test cl, cl
je 0x48577a
cmp cl, 0x26
je 0x48577a
cmp cl, 0x40
jne 0x48580f
call fcn.00493604
mov dword [0x428ed0], 1
mov bl, byte [edi]
jmp 0x48578f
mov edi, eax
test bl, bl
je 0x484f68
cmp bl, 0x26
je 0x48580d
cmp bl, 0x40
jne 0x485882
push edi
call fcn.004a7f30
add esp, 4
mov esi, eax
mov ebx, esi
cmp ebx, 2
jl 0x4857cc
movsx eax, byte [edi + ebx - 1]
lea esi, [ebx - 1]
push eax
call fcn.004a7635
add esp, 4
test eax, eax
jne 0x4857b0
mov byte [edi + ebx], 0
inc edi
push dword [0x428eb4]
push edi
call fcn.0044775c
add esp, 8
push dword [0x428eb4]
call fcn.00440120
add esp, 4
xor ebx, ebx
inc ebx
test eax, eax
jne 0x484f6a
call fcn.00483862
test eax, eax
jne 0x484f6a
push 0
call fcn.00485b0d
mov eax, edi
lea ecx, [esp + 8]
inc eax
lea edx, [esp + 0x18]
push ecx
push edx
push str._p:_u
push eax
call fcn.00442b34
add esp, 0x10
cmp eax, 2
jne 0x48586d
xor eax, eax
push dword [esp + 8]
push eax
push eax
push 4
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
je 0x48586d
push dword [esp + 8]
push esi
push dword [0x428eb4]
call fcn.0043253e
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x48587a
call fcn.00483862
test eax, eax
je 0x485a95
xor ebx, ebx
inc ebx
jmp 0x484f6a
lea eax, [esp + 8]
lea edi, [esp + 0x18]
push 0
push eax
push edi
push esi
call fcn.0049646e
add esp, 0x10
mov eax, dword [edi]
xor ebx, ebx
mov dword [esp], 0
test eax, eax
jle 0x485a7a
xor edi, edi
mov dword [esp], 0
mov edx, dword [esp + 8]
mov ecx, dword [0x428eb4]
lea esi, [edi + 1]
cmp esi, eax
mov eax, 0
mov ebp, dword [edx + edi*4]
jge 0x4858d0
mov eax, dword [edx + edi*4 + 4]
mov dword [esp + 4], edi
push ecx
xor edi, edi
inc edi
push edi
push eax
push ebp
call fcn.0043035f
add esp, 0x10
cmp eax, edi
je 0x485a69
cmp eax, 2
je 0x485976
cmp eax, 0xfffffffe
je 0x485a83
push str._cleanup
push ebp
call fcn.004a7d00
add esp, 8
test eax, eax
je 0x485a9c
push str._pgpfp
push ebp
call fcn.004a7d00
add esp, 8
test eax, eax
je 0x485af6
mov bl, byte [ebp]
cmp bl, 0x2d
je 0x485b02
cmp dword [esp], 0
je 0x48597d
push dword [0x428eb4]
push 1
push ebp
push 0x4021f8
call fcn.0043035f
add esp, 0x10
cmp eax, 2
je 0x485a67
push 0x22a
push str..._windows_window.c
push str.ret__2
call fcn.004a509d
add esp, 0xc
jmp 0x485a67
mov edi, esi
jmp 0x485a6d
push 7
push str.telnet:
push ebp
call fcn.004a7fc0
add esp, 0xc
test eax, eax
je 0x4859bc
test bl, bl
je 0x485a50
lea esi, [ebp + 1]
movsx eax, bl
push eax
call fcn.004a7635
add esp, 4
test eax, eax
jne 0x485a48
mov bl, byte [esi]
inc esi
test bl, bl
jne 0x48599c
jmp 0x485a50
cmp byte [ebp + 7], 0x2f
lea ebx, [ebp + 7]
jne 0x4859cf
cmp byte [ebp + 8], 0x2f
lea eax, [ebp + 9]
cmove ebx, eax
mov edi, dword [esp + 4]
push 1
push 2
push dword [0x428eb4]
call fcn.00431ee3
add esp, 0xc
push 0x41be0e
push ebx
call fcn.0043f60a
add esp, 8
mov cl, byte [ebx + eax]
test cl, cl
je 0x485a1b
add eax, ebx
cmp cl, 0x3a
mov byte [eax], 0
jne 0x485a1b
inc eax
push eax
call fcn.004a65cf
add esp, 4
push eax
xor eax, eax
inc eax
push eax
push dword [0x428eb4]
jmp 0x485a25
push 0xffffffffffffffff
push 1
push dword [0x428eb4]
call fcn.00431ee3
add esp, 0xc
push ebx
push 0
push dword [0x428eb4]
call fcn.0043203b
add esp, 0xc
xor eax, eax
xor ebx, ebx
inc eax
mov dword [esp], eax
jmp 0x485a6d
test bl, bl
je 0x485a50
mov byte [esi - 1], 0
push ebp
push 0
push dword [0x428eb4]
call fcn.0043203b
add esp, 0xc
xor eax, eax
inc eax
mov dword [esp], eax
xor ebx, ebx
mov edi, dword [esp + 4]
mov eax, dword [esp + 0x18]
inc edi
cmp edi, eax
jl 0x4858b3
mov ebp, dword [esp + 0x58]
jmp 0x484f6a
push ebp
push str.option___s__requires_an_argument
call fcn.00485b8e
push 0
call fcn.00485b0d
push 0
call fcn.00485b0d
mov edi, dword [0x402050]
push edi
push str.This_procedure_will_remove_ALL_Registry_entries_nassociated_with__s__and_will_also_remove_nthe_random_seed_file.__This_only_affects_the_ncurrently_logged_in_user.__n_nTHIS_PROCESS_WILL_DESTROY_YOUR_SAVED_SESSIONS._nAre_you_really_sure_you_want_to_continue_
call fcn.0043f758
add esp, 8
mov esi, eax
push edi
push str._s_Warning
call fcn.0043f758
add esp, 8
mov edi, eax
push 4
push 0x134
push edi
push esi
call fcn.00496318
add esp, 0x10
cmp eax, 6
jne 0x485add
call fcn.004951f7
push esi
call fcn.0043f9d4
add esp, 4
push edi
call fcn.0043f9d4
add esp, 4
push 0
call fcn.004a3719
call fcn.004963f9
push 1
call fcn.004a3719
push ebp
push str.unknown_option___s_
call fcn.00485b8e