Function at 0x409eed
Capabilities:
Clear file content

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rax, qword [0x004c3330]
cmp dword [rax], 0x9d6c
mov qword [rsp + 0xa0], rcx
mov qword [rsp + 0xa8], rdx
mov qword [rsp + 0xb0], r8
mov qword [rsp + 0xb8], r9
jle 0x40a87d
mov rax, qword [str.__ow4]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rdi, qword [str.RfV__]
mov rbp, qword [sym.imp.ADVAPI32.dll_ReadEventLogA]
xor ecx, ecx
mov eax, dword [rax]
mov dword [rdi], eax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call rbp
mov ecx, 0xcedcee20
call fcn.0040c910
mov rdx, qword [0x004c30b0]
mov r12, qword [sym.imp.KERNEL32.dll_SetEvent]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [0x004c33e0]
mov edx, dword [rax]
mov rax, qword [0x004c2c90]
mov dword [rax], edx
call r12
xor ecx, ecx
call r12
mov rax, qword [0x004c34a0]
mov rbx, qword [0x004c2ca0]
xor ecx, ecx
mov rsi, qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov edx, dword [rax]
mov rax, qword [0x004c3690]
mov dword [rax], edx
mov rax, qword [0x004c2b40]
mov eax, dword [rax]
mov dword [rbx], eax
call rsi
mov rax, qword [0x004c2d70]
mov ecx, dword [rax]
call fcn.0040c910
mov rdx, qword [0x004c34b0]
xor r9d, r9d
mov r14, qword [sym.imp.KERNEL32.dll_ReplaceFileA]
lea r8, str.Et_distinctio_deserunt_est
lea rcx, str.DessieKulasI
mov dword [rdx], eax
lea rdx, str.Et_fugiat_aut_tempore_non_optio_assumenda_architecto_provident_asperiores_qui_amet_ea
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call r14
xor ecx, ecx
call r12
mov rax, qword [0x004c3650]
mov rbx, qword [sym.imp.KERNEL32.dll_SetLastError]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004c2ce0]
mov dword [rax], edx
call rbx
xor r9d, r9d
xor r8d, r8d
mov r15, qword [sym.imp.KERNEL32.dll_ReadConsoleW]
mov qword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call r15
mov rax, qword [0x004c2c40]
xor ecx, ecx
mov dword [rax], 0xfb9e38d6
call r12
mov rax, qword [0x004c2ea0]
mov rdi, qword [0x004c3570]
mov ecx, 0xa1d1801b
mov dword [rax], 0x4ee8aa4e
mov rax, qword [0x004c32d0]
mov dword [rax], 0xd1c36b9a
mov rax, qword [0x004c3300]
mov eax, dword [rax]
mov dword [rdi], eax
mov rax, qword [0x004c2e80]
mov dword [rax], 0xdb13bba5
call fcn.0040c910
mov rdx, qword [0x004c2bc0]
mov rdi, qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor ecx, ecx
mov dword [rdx], eax
call rdi
mov rax, qword [0x004c29d0]
xor ecx, ecx
mov dword [rax], 0xb2f88d4d
mov rax, qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov qword [rsp + 0x40], rax
call rax
mov rax, qword [0x004c36f0]
mov ecx, 0x144109a
mov edx, dword [rax]
mov rax, qword [0x004c3400]
mov dword [rax], edx
call fcn.0040c910
mov rdx, qword [0x004c35b0]
mov ecx, 0x449c23e4
mov dword [rdx], eax
mov rax, qword [0x004c2f30]
mov dword [rax], 0x62a62a67
mov rax, qword [0x004c2ba0]
mov dword [rax], 0x5fd61ee4
call fcn.0040c910
mov rdx, qword [0x004c2ab0]
mov r13, qword [sym.imp.KERNEL32.dll_PurgeComm]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [0x004c2d90]
mov rdx, qword [0x004c3500]
mov eax, dword [rax]
mov dword [rdx], eax
xor edx, edx
call r13
mov r11, qword [0x004c3550]
xor r9d, r9d
xor r8d, r8d
mov rax, qword [0x004c3320]
xor ecx, ecx
mov edx, dword [r11]
mov dword [rax], edx
xor edx, edx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call rbp
xor ecx, ecx
call rdi
mov rax, qword [0x004c35b0]
xor ecx, ecx
mov dword [rax], 0x1985fbb2
mov rax, qword [rsp + 0x40]
call rax
xor ecx, ecx
call rdi
xor ecx, ecx
mov rax, qword [rsp + 0x40]
call rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
call rbp
xor ecx, ecx
call rsi
xor ecx, ecx
call r12
mov r10, qword [sym.imp.KERNEL32.dll_SetConsoleMode]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x48], r10
call r10
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x30], 0
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call rbp
mov rax, qword [0x004c2b90]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004c3160]
mov dword [rax], edx
call rsi
xor edx, edx
xor ecx, ecx
call r13
mov rax, qword [0x004c3500]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004c3220]
mov dword [rax], edx
call rsi
xor ecx, ecx
call rsi
mov rax, qword [0x004c2da0]
mov ecx, dword [rax]
call fcn.0040c910
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov rdx, qword [0x004c3260]
mov dword [rdx], eax
mov rax, qword [0x004c2970]
xor edx, edx
mov dword [rax], 0xca0ce7bb
mov qword [rsp + 0x20], 0
call r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
call rbp
xor r9d, r9d
lea r8, str.MrCesarHoppeSr
lea rdx, str.Voluptatem_incidunt_vel_dignissimos_a
mov qword [rsp + 0x28], 0
lea rcx, str.Est_qui_debitis_quia_consequuntur_voluptatibus_dicta_atque_possimus_odio
mov qword [rsp + 0x20], 0
call r14
mov rax, qword [0x004c2aa0]
mov rdx, qword [0x004c2ae0]
xor ecx, ecx
mov r10, qword [rsp + 0x48]
mov dword [rax], 0xd8103851
mov rax, qword [0x004c2cf0]
mov eax, dword [rax]
mov dword [rdx], eax
xor edx, edx
call r10
mov rax, qword [0x004c31a0]
mov ecx, dword [rax]
call fcn.0040c910
mov rdx, qword [0x004c3500]
mov ecx, 0x872917dd
mov dword [rdx], eax
call fcn.0040c910
mov rcx, qword [0x004c36f0]
xor r9d, r9d
xor r8d, r8d
mov dword [rcx], eax
mov rax, qword [str.RfV__]
mov edx, dword [rax]
mov rax, qword [0x004c3100]
mov dword [rax], edx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], 0
call r15
mov ecx, 0x93aa867f
call fcn.0040c910
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov rdx, qword [0x004c3430]
mov dword [rdx], eax
xor edx, edx
mov qword [rsp + 0x20], 0
call r15
xor ecx, ecx
call rbx
mov rax, qword [0x004c2e10]
mov ecx, dword [rax]
call fcn.0040c910
mov rdx, qword [0x004c2be0]
mov dword [rdx], eax
mov rax, qword [0x004c2a10]
mov edx, dword [rax]
mov rax, qword [0x004c2ed0]
mov dword [rax], edx
mov rax, qword [0x004c35c0]
mov rdx, qword [0x004c32d0]
mov eax, dword [rax]
mov dword [rdx], eax
mov rax, qword [0x004c2c50]
mov dword [rax], 0xd366774f
mov rax, qword [0x004c2d90]
mov ecx, dword [rax]
call fcn.0040c910
mov rdx, qword [0x004c3660]
xor ecx, ecx
mov dword [rdx], eax
call rdi
xor ecx, ecx
call rdi
mov rax, qword [0x004c3570]
mov rcx, qword [0x004c2960]
xor r9d, r9d
mov rdx, qword [0x004c2de0]
lea r8, str.In_aliquam_rerum_et
mov eax, dword [rax]
mov dword [rcx], eax
mov rax, qword [0x004c36f0]
lea rcx, str.Qui_laborum_quas_ut_aliquam_quis_odio_voluptate_eos_consequatur_officiis
mov eax, dword [rax]
mov dword [rdx], eax
mov rax, qword [0x004c34c0]
mov edx, dword [rax]
mov rax, qword [0x004c3580]
mov dword [rax], edx
lea rdx, str.Exercitationem_nisi_accusantium_sequi_et_architecto
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call r14
mov ecx, 0xa1aa46ec
call fcn.0040c910
mov rcx, qword [0x004c2f10]
mov dword [rcx], eax
mov ecx, 0xd98a38ca
call fcn.0040c910
mov rdx, qword [0x004c2cb0]
xor ecx, ecx
mov dword [rdx], eax
call rsi
xor r9d, r9d
lea r8, str.Iure_praesentium_repudiandae_et_dolores_doloribus
lea rdx, str.Nobis_ipsum_modi
mov qword [rsp + 0x28], 0
lea rcx, str.Dignissimos_illum_eos_minima_rerum
mov qword [rsp + 0x20], 0
call r14
xor ecx, ecx
call rbx
mov rax, qword [0x004c30a0]
xor ecx, ecx
mov dword [rax], 0x1ec9af3a
mov rax, qword [0x004c2b20]
mov edx, dword [rax]
mov rax, qword [0x004c2c30]
mov dword [rax], edx
call rbx
mov rax, qword [0x004c3640]
mov ecx, dword [rax]
call fcn.0040c910
mov rdx, qword [0x004c2ee0]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [0x004c3210]
mov dword [rax], 0xc1f6020a
call rsi
xor ecx, ecx
call rdi
xor edx, edx
xor ecx, ecx
call r13
mov rax, qword [0x004c3130]
mov rcx, qword [0x004c2da0]
mov dword [rax], 0xc2b4fc95
mov rax, qword [0x004c2cb0]
mov eax, dword [rax]
mov dword [rcx], eax
xor ecx, ecx
call rsi
xor ecx, ecx
call rbx
xor edx, edx
xor ecx, ecx
call r13
xor ecx, ecx
call rbx
mov rax, qword [0x004c2ca0]
mov dword [rax], 0xa12c2cb0
mov rax, qword [0x004c2e80]
mov ecx, dword [rax]
call fcn.0040c910
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov rdx, qword [0x004c2d20]
mov dword [rdx], eax
xor edx, edx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call rbp
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], 0
xor ecx, ecx
call r15
mov ecx, 0x83339060
call fcn.0040c910
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov rdx, qword [0x004c3700]
mov dword [rdx], eax
xor edx, edx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call rbp
xor ecx, ecx
call rbx
xor ecx, ecx
call rbx
xor edx, edx
xor ecx, ecx
call r13
xor ecx, ecx
call rsi
mov ecx, 0x88310096
call fcn.0040c910
mov rdx, qword [0x004c2c40]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [0x004c2d40]
mov dword [rax], 0x178848bd
mov rax, qword [str.:_o]
mov dword [rax], 0xe2396c25
mov rax, qword [rsp + 0x40]
call rax
mov rax, qword [str.:_o]
mov rcx, qword [0x004c2d90]
mov eax, dword [rax]
mov dword [rcx], eax
mov rax, qword [0x004c2b80]
mov ecx, 0x187c4df7
mov dword [rax], 0x10e17e91
call fcn.0040c910
mov rdx, qword [0x004c2d10]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [rsp + 0x40]
call rax
xor ecx, ecx
call rbx
xor ecx, ecx
call rsi
mov r10, qword [rsp + 0x48]
xor edx, edx
xor ecx, ecx
call r10
xor edx, edx
xor ecx, ecx
call r13
mov rax, qword [0x004c2c70]
mov ecx, dword [rax]
call fcn.0040c910
mov rdx, qword [0x004c3290]
mov ecx, 0x787a51c3
mov dword [rdx], eax
call fcn.0040c910
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov r11, qword [0x004c3550]
mov rdx, qword [0x004c36d0]
mov dword [rdx], eax
mov edx, dword [r11]
mov rax, qword [0x004c2c60]
mov dword [rax], edx
mov rax, qword [0x004c32d0]
xor edx, edx
mov dword [rax], 0xb9d3b171
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call rbp
xor edx, edx
xor ecx, ecx
call r13
xor r9d, r9d
lea r8, str.DevonteChristiansen
lea rdx, str.Amet_id_quaerat_explicabo_velit_voluptatem_qui_corporis_ullam
mov qword [rsp + 0x28], 0
lea rcx, str.Quos_animi_nihil_culpa_accusantium_voluptatum_consequuntur_et_vel_aut_voluptatem
mov qword [rsp + 0x20], 0
call r14
mov rax, qword [0x004c3240]
xor ecx, ecx
mov dword [rax], 0x26aedada
call r12
xor r9d, r9d
lea r8, str.Enim_dignissimos_enim
lea rdx, str.MaxineBrakus
mov qword [rsp + 0x28], 0
lea rcx, str.JohnnyWest
mov qword [rsp + 0x20], 0
call r14
xor ecx, ecx
call r12
mov rax, qword [0x004c33d0]
mov dword [rax], 0xfb69ce89
mov rax, qword [0x004c3600]
mov ecx, dword [rax]
call fcn.0040c910
mov rdx, qword [0x004c3560]
xor ecx, ecx
mov dword [rdx], eax
call rdi
mov ecx, 0xc2ad3fc
call fcn.0040c910
mov rdx, qword [0x004c3250]
xor ecx, ecx
mov dword [rdx], eax
call rdi
mov rax, qword [0x004c2de0]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rax], 0x4c342851
mov qword [rsp + 0x20], 0
call r15
xor ecx, ecx
call rbx
mov rax, qword [0x004c2f10]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004c2ef0]
mov dword [rax], edx
mov rax, qword [0x004c32b0]
xor edx, edx
mov dword [rax], 0x4e714e0a
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call rbp
xor ecx, ecx
call rdi
xor ecx, ecx
call rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], 0
xor ecx, ecx
call r15
mov rax, qword [0x004c2960]
xor ecx, ecx
mov dword [rax], 0x32affa61
call rbx
mov ecx, 0x2fb8dc52
call fcn.0040c910
mov rsi, qword [0x004c2960]
mov ecx, 0x46539c22
mov dword [rsi], eax
call fcn.0040c910
mov rbx, qword [0x004c2ae0]
mov dword [rbx], eax
mov rax, qword [0x004c2df0]
mov edx, dword [rax]
mov rax, qword [0x004c3420]
mov dword [rax], edx
mov rax, qword [0x004c2d30]
mov edx, dword [rax]
mov rax, qword [0x004c32e0]
mov dword [rax], edx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9, qword [rsp + 0xb0]
mov r8, qword [rsp + 0xa8]
mov rcx, rax
mov rax, qword [rsp + 0xc8]
mov rdx, qword [rsp + 0xa0]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0xc0]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x20], rax
call fcn.004097bf
nop
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret