Function at 0x41152c
Capabilities:
Access the windows event log
Clear windows event logs
Set environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
mov eax, dword [rsp + 0xf0]
mov dword [rsp + 0x78], eax
mov rax, qword [0x004cc250]
mov qword [rsp + 0x50], rcx
cmp dword [rax], 0x9ab5
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
jne 0x411e3f
mov dword [rsp + 0x7c], r9d
mov rbx, qword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
lea rdx, str.RutheBechtelar
lea rcx, str.Placeat_pariatur_aut_harum_doloribus_illum_voluptas_cum_provident_qui_qui
call rbx
mov r13, qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor ecx, ecx
call r13
lea rdx, str.Consequatur_ipsum_ipsam_accusantium_exercitationem_voluptas_repudiandae_dolorum
lea rcx, str.Aperiam_maiores_autem_dolorem_voluptate_minima_minima_dolorem
call rbx
mov rax, qword [0x004cc140]
mov dword [rax], 0x28ee556e
mov rax, qword [0x004cc2d0]
mov ecx, dword [rax]
call fcn.00413350
mov rdx, qword [0x004cbcf0]
mov r12, qword [sym.imp.KERNEL32.dll_GetFileType]
xor ecx, ecx
mov dword [rdx], eax
call r12
mov rsi, qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
xor edx, edx
xor ecx, ecx
call rsi
mov rax, qword [0x004cbc80]
xor edx, edx
xor ecx, ecx
mov rdi, qword [0x004cbcc0]
mov eax, dword [rax]
mov dword [rdi], eax
call rsi
mov ecx, 0xc309d2a5
call fcn.00413350
mov rdx, qword [0x004cc4c0]
lea rcx, str.Id_id_nulla_qui_error
mov dword [rdx], eax
lea rdx, str.Aliquid_nisi_consequatur_suscipit_atque_voluptatem
call rbx
mov rax, qword [0x004cbdd0]
mov r14, qword [sym.imp.KERNEL32.dll_GetBinaryTypeA]
lea rcx, str.Molestiae_et_aspernatur_consectetur_natus_harum_repellendus_consequatur_nihil_dolorem_possimus
mov edx, dword [rax]
mov rax, qword [0x004cc370]
mov dword [rax], edx
xor edx, edx
call r14
mov rax, qword [0x004cc3c0]
xor ecx, ecx
mov dword [rax], 0x80b2314e
mov rax, qword [0x004cc450]
mov edx, dword [rax]
mov rax, qword [0x004cc180]
mov dword [rax], edx
mov rax, qword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov qword [rsp + 0x20], rax
call rax
mov rax, qword [0x004cc300]
mov rdi, qword [0x004cbc70]
mov eax, dword [rax]
mov dword [rdi], eax
mov rax, qword [0x004cc160]
mov ecx, dword [rax]
call fcn.00413350
mov rdx, qword [0x004cc480]
mov dword [rdx], eax
mov rax, qword [0x004cc0e0]
mov ecx, dword [rax]
call fcn.00413350
mov rdi, qword [0x004cc340]
xor edx, edx
lea rcx, str.KarenLabadie
mov dword [rdi], eax
call r14
mov ecx, 0x10aecbc0
call fcn.00413350
mov rdx, qword [0x004cc050]
mov ecx, 0x5dd3c292
mov dword [rdx], eax
call fcn.00413350
mov rdx, qword [0x004cbeb0]
lea rcx, str.Nisi_alias_omnis_ut_et_accusamus_voluptatibus_commodi_aut
mov dword [rdx], eax
lea rdx, str.TessLind
call rbx
mov rax, qword [sym.imp.KERNEL32.dll_OpenEventA]
xor edx, edx
xor ecx, ecx
lea r8, str.Dicta_beatae_et_saepe_est
mov qword [rsp + 0x28], rax
call rax
mov rbp, qword [0x004cbd70]
xor edx, edx
xor ecx, ecx
mov eax, dword [rbp]
mov dword [rdi], eax
mov rdi, qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
call rdi
mov rax, qword [0x004cc3b0]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004cbd40]
mov dword [rax], edx
mov rax, qword [rsp + 0x20]
call rax
mov rax, qword [0x004cbd50]
mov ecx, dword [rax]
call fcn.00413350
mov rdx, qword [0x004cbba0]
xor ecx, ecx
mov dword [rdx], eax
mov rdx, qword [0x004cc110]
mov eax, dword [rbp]
mov dword [rdx], eax
call r13
xor ecx, ecx
call r12
xor ecx, ecx
call r12
xor edx, edx
lea rcx, str.Dignissimos_asperiores_in_dicta_earum_et_fuga_magni_dolores_omnis_quia_neque_voluptatem
call r14
mov rax, qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea rdx, str.Rerum_ipsa_beatae_repellendus_et_officia_molestiae_et
lea rcx, str.JakaylaLabadie
mov qword [rsp + 0x48], rax
call rax
mov rax, qword [0x004cc0a0]
mov r15, qword [sym.imp.KERNEL32.dll_SetCommBreak]
xor ecx, ecx
mov dword [rax], 0x487baf16
call r15
mov ecx, 0xd25447d4
call fcn.00413350
mov rdx, qword [0x004cc410]
mov rbp, qword [sym.imp.ADVAPI32.dll_ClearEventLogA]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [0x004cbc60]
mov edx, dword [rax]
mov rax, qword [0x004cbc40]
mov dword [rax], edx
mov rax, qword [0x004cc1a0]
mov rdx, qword [0x004cc3b0]
mov eax, dword [rax]
mov dword [rdx], eax
lea rdx, str.ScarlettTorp
call rbp
mov r10, qword [sym.imp.KERNEL32.dll_PurgeComm]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x70], r10
call r10
mov rax, qword [0x004cc470]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rax], 0x8c827c27
mov rax, qword [0x004cbcc0]
mov dword [rax], 0xc0ca572b
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov qword [rsp + 0x30], rax
call rax
mov rax, qword [0x004cbe80]
xor ecx, ecx
mov dword [rax], 0x3ba0086f
mov rax, qword [0x004cbd00]
mov dword [rax], 0x26e55f1c
mov rax, qword [sym.imp.KERNEL32.dll_GetLargestConsoleWindowSize]
mov qword [rsp + 0x38], rax
call rax
lea rdx, str.Sit_corrupti_et_sed_aut_repudiandae_accusantium_est_fugiat
lea rcx, str.MrsCatalinaNolan
call rbx
lea rdx, str.Sunt_dolorem_quia_perferendis_eveniet_officia
xor ecx, ecx
call rbp
mov rax, qword [0x004cbe40]
mov ecx, 0xceec39b8
mov dword [rax], 0x1943abd7
mov rax, qword [0x004cbcc0]
mov dword [rax], 0x6bd8267a
call fcn.00413350
mov rdx, qword [0x004cc3b0]
mov dword [rdx], eax
mov rax, qword [0x004cbe00]
mov ecx, dword [rax]
call fcn.00413350
mov rdx, qword [0x004cbbe0]
mov r8, qword [0x004cc3a0]
lea rcx, str.Corrupti_architecto_quo_facere_minus_optio
mov dword [rdx], eax
mov rax, qword [0x004cc070]
mov rdx, qword [0x004cc140]
mov eax, dword [rax]
mov dword [rdx], eax
mov rax, qword [0x004cc470]
mov edx, dword [rax]
mov rax, qword [0x004cbe50]
mov dword [rax], edx
mov eax, dword [r8]
mov rdx, qword [0x004cbc00]
mov dword [rdx], eax
lea rdx, str.MarielaRath
call rbx
mov rax, qword [0x004cc350]
mov rcx, qword [0x004cbeb0]
lea rdx, str.Qui_consectetur_quis_sit_et_minima_consequatur_non_non
mov r8, qword [0x004cc3a0]
mov eax, dword [rax]
mov dword [rcx], eax
mov rax, qword [0x004cbbd0]
lea rcx, str.Fugit_et_totam_hic
mov eax, dword [rax]
mov dword [r8], eax
call rbx
xor edx, edx
xor ecx, ecx
call rdi
xor edx, edx
xor ecx, ecx
call rsi
xor ecx, ecx
mov rax, qword [rsp + 0x20]
call rax
mov rax, qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
xor ecx, ecx
mov qword [rsp + 0x40], rax
call rax
mov rax, qword [0x004cc1e0]
xor ecx, ecx
mov dword [rax], 0x36c476e5
mov rax, qword [0x004cc420]
mov dword [rax], 0xbe4a8d6a
call r15
lea rdx, str.Quia_consequatur_eum_harum_alias_facilis_voluptatem
lea rcx, str.Ab_veniam_iste_vero_quae
call rbx
mov rax, qword [0x004cbcd0]
xor ecx, ecx
mov dword [rax], 0xddf7e624
mov rax, qword [str._mf]
mov dword [rax], 0xea7eafd0
mov rax, qword [0x004cc3e0]
mov edx, dword [rax]
mov rax, qword [0x004cc080]
mov dword [rax], edx
mov rax, qword [rsp + 0x38]
call rax
mov ecx, 0xf88ed50a
call fcn.00413350
mov rdx, qword [0x004cbe90]
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
call rsi
mov r11, qword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
xor edx, edx
lea rcx, str.MissAlessandraStrosinII
mov qword [rsp + 0x68], r11
call r11
mov rax, qword [0x004cc1a0]
xor ecx, ecx
mov dword [rax], 0x129b299e
call r12
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_ImpersonateAnonymousToken]
xor edx, edx
xor ecx, ecx
call rsi
mov rax, qword [0x004cbe90]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004cc360]
mov dword [rax], edx
call r12
mov rax, qword [0x004cc410]
mov r12, qword [sym.imp.ADVAPI32.dll_ImpersonateNamedPipeClient]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004cc0b0]
mov dword [rax], edx
call r12
mov rax, qword [0x004cc0e0]
mov rcx, qword [0x004cc2e0]
mov eax, dword [rax]
mov dword [rcx], eax
mov rax, qword [0x004cc1a0]
xor ecx, ecx
mov dword [rax], 0xc83d125f
call r13
xor edx, edx
xor ecx, ecx
call rdi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov rax, qword [rsp + 0x30]
call rax
mov rax, qword [0x004cbe70]
mov rdx, qword [0x004cbed0]
lea rcx, str.ProfUrbanSchneider
mov r11, qword [rsp + 0x68]
mov eax, dword [rax]
mov dword [rdx], eax
xor edx, edx
call r11
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov rax, qword [rsp + 0x30]
call rax
mov r10, qword [rsp + 0x70]
xor edx, edx
xor ecx, ecx
call r10
mov rax, qword [0x004cbd00]
mov ecx, dword [rax]
call fcn.00413350
mov rcx, qword [0x004cc2d0]
mov dword [rcx], eax
mov rax, qword [0x004cc110]
xor ecx, ecx
mov dword [rax], 0xd5f4a
call r12
xor ecx, ecx
call r15
mov rax, qword [0x004cbdd0]
mov ecx, dword [rax]
call fcn.00413350
mov rdx, qword [0x004cbdb0]
xor ecx, ecx
mov dword [rdx], eax
lea rdx, str.Velit_ut_autem_dolorem_itaque_quam
call rbp
xor edx, edx
xor ecx, ecx
call rdi
xor edx, edx
xor ecx, ecx
call rsi
mov rax, qword [0x004cbc10]
mov rdx, qword [0x004cc300]
lea rcx, str.Odit_est_fugiat_ut_quia_aut
mov eax, dword [rax]
mov dword [rdx], eax
xor edx, edx
call r14
mov rax, qword [0x004cbc50]
mov rcx, qword [0x004cc2d0]
xor edx, edx
mov dword [rax], 0xc26831be
mov rax, qword [0x004cc2b0]
mov eax, dword [rax]
mov dword [rcx], eax
xor ecx, ecx
call rsi
xor ecx, ecx
mov rax, qword [rsp + 0x40]
call rax
xor ecx, ecx
lea rdx, str.Reiciendis_animi_vitae_sint_quisquam_sint_error_hic_aspernatur
call rbp
mov r12, qword [0x004cbd90]
mov rax, qword [0x004cc440]
xor ecx, ecx
mov edx, dword [r12]
mov dword [rax], edx
mov rax, qword [rsp + 0x38]
call rax
mov r14, qword [sym.imp.KERNEL32.dll_FindNextStreamW]
xor edx, edx
xor ecx, ecx
call r14
mov rax, qword [0x004cc110]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004cc150]
mov dword [rax], edx
xor edx, edx
call rsi
mov rsi, qword [sym.imp.KERNEL32.dll_FlushConsoleInputBuffer]
xor ecx, ecx
call rsi
mov rax, qword [0x004cc230]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004cc430]
mov dword [rax], edx
call r15
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov rax, qword [rsp + 0x30]
call rax
xor edx, edx
xor ecx, ecx
call r14
mov rax, qword [0x004cc1a0]
mov rdx, qword [0x004cbc70]
mov ecx, dword [rax]
mov rax, qword [0x004cbcb0]
mov dword [rax], ecx
mov rax, qword [0x004cc3b0]
mov dword [rax], 0xe53dfd2a
mov rax, qword [0x004cc200]
mov eax, dword [rax]
mov dword [rdx], eax
call fcn.00413350
mov rcx, qword [0x004cbcc0]
mov dword [rcx], eax
mov ecx, 0x7337b29d
call fcn.00413350
mov rdx, qword [0x004cbd50]
mov ecx, 0xbe13bc62
mov dword [rdx], eax
call fcn.00413350
mov rdx, qword [0x004cc490]
xor ecx, ecx
mov dword [rdx], eax
call rsi
xor edx, edx
xor ecx, ecx
call r14
mov rax, qword [0x004cc070]
xor edx, edx
xor ecx, ecx
mov rsi, qword [0x004cbd50]
lea r8, str.Aut_odit_porro_cupiditate_blanditiis_eius_corporis_id_laboriosam_unde_illum
mov eax, dword [rax]
mov dword [rsi], eax
mov rax, qword [0x004cc410]
mov dword [rax], 0x525cf1ad
mov rax, qword [rsp + 0x28]
call rax
lea rdx, str.Expedita_est_voluptates_odit_non_error_aut_vel_eum_tempora_consectetur
lea rcx, str.KarelleMonahan
call rbx
xor ecx, ecx
mov rax, qword [rsp + 0x20]
call rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetEvent]
lea rdx, str.JailynLubowitz
xor ecx, ecx
call rbp
mov rax, qword [0x004cc160]
mov rsi, qword [0x004cbda0]
mov ecx, dword [rax]
mov dword [rsi], 0xb8afa230
call fcn.00413350
mov rbx, qword [0x004cc2c0]
mov rdx, qword [0x004cc4d0]
mov ecx, dword [rbx]
mov dword [rdx], eax
call fcn.00413350
mov rcx, qword [0x004cbe70]
xor edx, edx
mov dword [rcx], eax
xor ecx, ecx
call rdi
lea r8, str.RoyalAdams
xor edx, edx
xor ecx, ecx
mov rax, qword [rsp + 0x28]
call rax
xor ecx, ecx
lea rdx, str.Quo_nihil_voluptatem_ut_non
call rbp
mov rax, qword [0x004cc210]
lea rcx, str.AlainaBlanda
mov edx, dword [rax]
mov rax, qword [0x004cc090]
mov dword [rax], edx
lea rdx, str.SylvesterWestSr
mov rax, qword [rsp + 0x48]
call rax
mov rax, qword [0x004cc160]
mov ecx, 0x43afaf0b
mov edx, dword [rax]
mov rax, qword [0x004cc100]
mov dword [rax], edx
mov rdx, qword [0x004cc2e0]
mov eax, dword [r12]
mov dword [rdx], eax
mov rax, qword [0x004cbc20]
mov dword [rax], 0x19b45829
mov rax, qword [0x004cc060]
mov dword [rax], 0xbfea233b
call fcn.00413350
mov rcx, qword [0x004cbbe0]
mov dword [rsi], 0x636857a7
mov dword [rcx], eax
mov rax, qword [0x004cbc00]
xor ecx, ecx
mov dword [rax], 0x752baa26
call r13
mov rax, qword [0x004cc450]
xor edx, edx
xor ecx, ecx
mov rsi, qword [0x004cbed0]
mov eax, dword [rax]
mov dword [rsi], eax
call rdi
xor ecx, ecx
call r13
mov rax, qword [0x004cbd80]
xor edx, edx
xor ecx, ecx
mov rdi, qword [0x004cc110]
lea r8, str.MrsDessieHickleSr
mov eax, dword [rax]
mov dword [rdi], eax
mov rax, qword [rsp + 0x28]
call rax
xor ecx, ecx
mov rax, qword [rsp + 0x40]
call rax
mov ecx, dword [rbx]
call fcn.00413350
xor ecx, ecx
mov dword [r12], eax
mov rax, qword [0x004cc470]
mov dword [rax], 0x6e054e97
call r15
mov ecx, 0x9132766c
call fcn.00413350
mov rbx, qword [0x004cc0a0]
mov dword [rbx], eax
mov rax, qword [0x004cbec0]
mov ecx, dword [rax]
call fcn.00413350
mov rbx, qword [0x004cc2d0]
mov r9d, dword [rsp + 0x7c]
mov dword [rbx], eax
lea rdx, str.VirtualAllocEx
lea rcx, str.kernel32.dll
mov dword [rsp + 0x20], r9d
call fcn.0040fab1
mov edi, dword [rsp + 0x78]
mov r9d, dword [rsp + 0x20]
mov r8, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0xf0], edi
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp rax