Function at 0x6bad6c5d
Capabilities:
Access the windows event log
Clear windows event logs
Set current directory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
cmp dword [0x6bb7ad60], 0x2159
jne 0x6bad75ce
mov eax, dword [0x6bb7ae70]
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [esp], 0
mov dword [0x6bb7aea4], eax
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_ClearEventLogA]
push eax
mov eax, dword [0x6bb7ae94]
mov dword [0x6bb7ae24], eax
mov eax, dword [0x6bb7afb4]
mov dword [esp + 4], str.MarilouHammes
mov dword [0x6bb7add8], eax
mov dword [esp], 0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetCommModemStatus]
push edx
push edx
mov dword [esp + 4], 0
mov dword [esp], 0
call edi
mov eax, dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
push ecx
push ecx
mov dword [ebp - 0x34], eax
mov dword [esp + 4], str.CamrenMannDDS
mov dword [esp], str.ProfHendersonKerlukeV
call eax
push eax
push eax
mov dword [esp + 4], str.Qui_aperiam_ullam_repellat_fugiat_officiis_ut_necessitatibus_rerum_magni_omnis
mov dword [esp], 0
call esi
push eax
push eax
mov eax, dword [sym.imp.KERNEL32.dll_ReadConsoleW]
mov dword [ebp - 0x38], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call eax
sub esp, 0x14
mov dword [esp], 0xdfc9c5d1
mov dword [esp + 4], 0
call fcn.6badcbb4
mov dword [esp], 0x2632fa0
mov dword [0x6bb7afd4], eax
mov eax, dword [0x6bb7ae64]
mov dword [0x6bb7b030], eax
mov eax, dword [0x6bb7adf8]
mov dword [0x6bb7ae9c], eax
call fcn.6badcbb4
mov dword [esp + 4], 0
mov dword [0x6bb7add4], eax
mov eax, dword [sym.imp.KERNEL32.dll_SetCommMask]
mov dword [esp], 0
mov dword [ebp - 0x1c], eax
call eax
push eax
push eax
mov eax, dword [0x6bb7add4]
mov dword [esp], eax
call fcn.6badcbb4
mov dword [esp], 0
mov dword [0x6bb7b060], eax
call ebx
mov dword [0x6bb7add4], 0x6110b59e
push eax
mov eax, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [0x6bb7af50], 0x2e667273
mov dword [ebp - 0x20], eax
mov dword [esp], str.DrFaustoJaskolskiIV
call eax
push eax
mov eax, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov dword [ebp - 0x2c], eax
mov dword [esp], str.HershelWintheiser
call eax
push edx
mov dword [esp + 4], str.KattieCarroll
mov dword [esp], 0
call esi
push ecx
push ecx
mov dword [esp], 0
call ebx
push eax
mov eax, dword [sym.imp.KERNEL32.dll_OpenEventA]
mov dword [ebp - 0x28], eax
mov dword [esp + 8], str.OttisStrosin
mov dword [esp + 4], 0
mov dword [esp], 0
call eax
mov eax, dword [0x6bb7add0]
sub esp, 0xc
mov dword [0x6bb7ae44], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], str.NicoleCummings
mov dword [esp], str.Dignissimos_doloribus_eum_quo_quam
call eax
push eax
push eax
mov dword [esp + 4], str.Est_et_iusto_sit_sunt_voluptatem_culpa_ut
mov dword [esp], 0
call esi
mov dword [0x6bb7af54], 0x5a23d113
push eax
push eax
mov eax, dword [0x6bb7af8c]
mov dword [0x6bb7addc], eax
mov dword [esp], 0
call ebx
push eax
mov eax, dword [ebp - 0x20]
mov dword [esp], str.Praesentium_libero_dolore_incidunt_voluptatem_voluptatem_quod
call eax
push eax
mov eax, dword [0x6bb7aef8]
mov dword [esp], eax
call fcn.6badcbb4
mov dword [esp], 0xb71108be
mov dword [esp + 4], 0
mov dword [0x6bb7afac], eax
call fcn.6badcbb4
mov dword [esp], 0
mov dword [0x6bb7af70], eax
call ebx
push edx
mov dword [esp + 4], str.Numquam_quisquam_molestiae_laudantium_possimus_illum
mov dword [esp], 0
call esi
push ecx
push ecx
mov dword [esp + 4], 0
mov dword [esp], 0
call edi
push eax
push eax
mov eax, dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0x30], eax
mov dword [esp], 0
call eax
push eax
mov dword [esp + 4], 0
mov dword [esp], 0
call edi
push eax
push eax
mov eax, dword [ebp - 0x2c]
mov dword [esp], str.DrWyattStarkV
call eax
push eax
mov eax, dword [0x6bb7b044]
mov dword [esp], eax
call fcn.6badcbb4
mov dword [esp + 4], 0
mov dword [0x6bb7adcc], eax
mov eax, dword [0x6bb7ae40]
mov dword [esp], 0
mov dword [0x6bb7afa8], eax
call edi
push eax
push eax
mov eax, dword [ebp - 0x30]
mov dword [esp], 0
call eax
mov eax, dword [0x6bb7afa0]
push edx
mov dword [esp], eax
call fcn.6badcbb4
mov dword [esp + 4], 0
mov dword [0x6bb7adf8], eax
mov dword [esp], 0
call edi
mov eax, dword [ebp - 0x1c]
push ecx
push ecx
mov dword [esp + 4], 0
mov dword [esp], 0
call eax
push eax
push eax
mov dword [esp], 0xa3b15dd0
mov dword [esp + 4], 0
call fcn.6badcbb4
mov dword [esp], 0
mov dword [0x6bb7b010], eax
mov eax, dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov dword [ebp - 0x24], eax
call eax
mov dword [str.:y_2], 0x9165950a
push eax
mov eax, dword [0x6bb7aea0]
mov dword [0x6bb7af20], eax
mov eax, dword [ebp - 0x28]
mov dword [esp + 8], str.EmersonDickinsonDVM
mov dword [esp + 4], 0
mov dword [esp], 0
call eax
mov eax, dword [0x6bb7ae9c]
sub esp, 0xc
mov dword [esp], 0x9098c652
mov dword [esp + 4], 0
mov dword [0x6bb7aea0], eax
call fcn.6badcbb4
mov dword [0x6bb7adc8], eax
mov eax, dword [0x6bb7b028]
mov dword [0x6bb7adc4], eax
mov eax, dword [0x6bb7af78]
mov dword [esp], eax
call fcn.6badcbb4
mov dword [esp + 4], 0
mov dword [0x6bb7aecc], eax
mov eax, dword [0x6bb7b00c]
mov dword [0x6bb7af98], 0x4c25d3c3
mov dword [0x6bb7ae84], eax
mov eax, dword [0x6bb7af0c]
mov dword [esp], 0
mov dword [0x6bb7afe0], eax
call edi
push eax
push eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], 0
mov dword [esp], 0
call eax
push eax
push eax
mov eax, dword [ebp - 0x20]
mov dword [esp], str.BentonKohler
call eax
push eax
mov eax, dword [0x6bb7adc0]
mov dword [0x6bb7aef0], eax
mov dword [esp + 4], str.CortneyGibson
mov dword [esp], 0
call esi
mov eax, dword [ebp - 0x28]
push edx
push edx
mov dword [esp + 8], str.MissAlexaBernhardV
mov dword [esp + 4], 0
mov dword [esp], 0
call eax
mov eax, dword [ebp - 0x1c]
sub esp, 0xc
mov dword [esp + 4], 0
mov dword [esp], 0
call eax
push ecx
push ecx
mov dword [esp], 0
call ebx
push eax
mov eax, dword [0x6bb7af64]
mov dword [0x6bb7ae44], eax
mov eax, dword [0x6bb7aef8]
mov dword [esp + 4], str.Aliquid_harum_magnam_labore_molestias_ab_maiores_et_est_repellendus_asperiores_et
mov dword [0x6bb7aef4], eax
mov eax, dword [0x6bb7ae68]
mov dword [esp], 0
mov dword [0x6bb7aed0], eax
call esi
push eax
push eax
mov dword [esp], 0
call ebx
push eax
mov dword [esp + 4], str.Ex_mollitia_minima
mov dword [esp], 0
call esi
push eax
push eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], 0
mov dword [esp], 0
call eax
push eax
push eax
mov eax, dword [ebp - 0x2c]
mov dword [esp], str.Doloremque_nam_praesentium_tempora
call eax
mov eax, dword [0x6bb7aea8]
mov dword [0x6bb7af94], 0xa73b88cb
push edx
mov dword [0x6bb7af48], eax
mov eax, dword [0x6bb7af4c]
mov dword [0x6bb7ade0], 0x8d81762b
mov dword [0x6bb7b064], eax
mov eax, dword [ebp - 0x24]
mov dword [esp], 0
call eax
mov eax, dword [ebp - 0x1c]
push ecx
mov dword [esp + 4], 0
mov dword [esp], 0
call eax
push eax
push eax
mov dword [esp], 0
call ebx
push eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], 0
mov dword [esp], 0
call eax
push eax
push eax
mov eax, dword [ebp - 0x30]
mov dword [esp], 0
call eax
push eax
mov eax, dword [ebp - 0x38]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call eax
mov eax, dword [ebp - 0x28]
sub esp, 0x14
mov dword [esp + 8], str.EbbaJohnson
mov dword [esp + 4], 0
mov dword [esp], 0
call eax
mov eax, dword [0x6bb7b030]
mov dword [0x6bb7af70], 0x3a55cd05
sub esp, 0xc
mov dword [esp], eax
call fcn.6badcbb4
mov dword [esp], 0
mov dword [0x6bb7af14], eax
mov eax, dword [ebp - 0x24]
call eax
push eax
mov eax, dword [0x6bb7adb8]
mov dword [esp], eax
call fcn.6badcbb4
mov dword [esp + 4], 0
mov dword [0x6bb7adbc], eax
mov eax, dword [0x6bb7afcc]
mov dword [0x6bb7aed0], 0x10671240
mov dword [0x6bb7adb4], eax
mov eax, dword [ebp - 0x1c]
mov dword [0x6bb7af70], 0x8cbf4415
mov dword [esp], 0
call eax
push edx
push edx
mov dword [esp + 4], str.Voluptatum_mollitia_dolorum_qui_et_temporibus_harum
mov dword [esp], 0
call esi
mov eax, dword [0x6bb7adb0]
push ecx
push ecx
mov dword [0x6bb7af18], eax
mov dword [esp], 0xa920f115
mov dword [esp + 4], 0
call fcn.6badcbb4
mov dword [esp + 4], str.JessikaDenesikV
mov dword [0x6bb7af90], eax
mov eax, dword [0x6bb7af68]
mov dword [esp], str.MaciHoppe
mov dword [0x6bb7addc], eax
mov eax, dword [ebp - 0x34]
call eax
push eax
push eax
mov eax, dword [ebp - 0x2c]
mov dword [esp], str.AbrahamKrajcik
call eax
push eax
mov eax, dword [ebp - 0x30]
mov dword [esp], 0
call eax
mov dword [0x6bb7adac], 0xc0fabb11
push eax
mov eax, dword [0x6bb7af78]
mov dword [esp], eax
call fcn.6badcbb4
mov dword [esp], str.Nam_quas_voluptatem_molestias
mov dword [0x6bb7ae58], eax
mov eax, dword [ebp - 0x20]
call eax
push eax
mov dword [esp + 4], 0
mov dword [esp], 0
call edi
push eax
push eax
mov eax, dword [0x6bb7ade4]
mov dword [esp], eax
call fcn.6badcbb4
mov dword [esp], str.RoslynRodriguezIII
mov dword [0x6bb7ae44], eax
mov eax, dword [ebp - 0x20]
call eax
mov eax, dword [ebp - 0x24]
push edx
mov dword [esp], 0
call eax
mov eax, dword [ebp - 0x38]
push ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call eax
mov eax, dword [ebp - 0x20]
sub esp, 0x14
mov dword [esp], str.BradlyParisian
call eax
push eax
mov eax, dword [ebp - 0x24]
mov dword [esp], 0
call eax
push eax
mov dword [esp], 0
call ebx
push eax
mov dword [esp], 0x7c3d6041
call fcn.6badcbb4
mov dword [esp], 0
mov dword [0x6bb7ae9c], eax
mov eax, dword [0x6bb7af2c]
mov dword [0x6bb7ae90], 0xb511dee3
mov dword [0x6bb7af00], eax
mov eax, dword [ebp - 0x24]
mov dword [0x6bb7b068], 0xe5c75ba0
call eax
push eax
mov eax, dword [0x6bb7af78]
mov dword [esp], eax
call fcn.6badcbb4
mov dword [esp], 0
mov dword [0x6bb7b034], eax
mov eax, dword [0x6bb7ae70]
mov dword [0x6bb7ada8], 0x752f2af0
mov dword [0x6bb7afe0], 0xa04ad10a
mov dword [0x6bb7af2c], eax
mov dword [0x6bb7b064], 0xb235a26c
mov dword [0x6bb7ada4], 0xcf4586a3
call ebx
mov dword [0x6bb7ae0c], 0x702da323
push eax
mov eax, dword [ebp - 0x28]
mov dword [esp + 8], str.MsLaylaQuitzonPhD
mov dword [esp + 4], 0
mov dword [esp], 0
call eax
sub esp, 0xc
mov dword [esp + 4], 0
mov dword [esp], 0
call edi
push edx
push edx
mov dword [esp], 0xa13cb964
mov dword [esp + 4], 0
call fcn.6badcbb4
mov dword [esp], str.ProfEltaBaileyV
mov dword [0x6bb7af6c], eax
mov eax, dword [ebp - 0x2c]
call eax
mov eax, dword [ebp - 0x38]
push ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call eax
mov eax, dword [ebp - 0x20]
sub esp, 0x14
mov dword [esp], str.KolbyReinger
call eax
mov dword [0x6bb7ada0], 0x17006541
push eax
mov eax, dword [0x6bb7add4]
mov dword [esp], eax
call fcn.6badcbb4
mov dword [esp], 0
mov dword [0x6bb7aff4], eax
mov eax, dword [ebp - 0x30]
call eax
push eax
mov dword [esp], 0
call ebx
push eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], str.Temporibus_similique_quia_delectus_sed_non_voluptatem
mov dword [esp], str.Cumque_natus_dolor
call eax
push eax
push eax
mov dword [esp], 0
call ebx
push eax
mov eax, dword [ebp - 0x28]
mov dword [esp + 8], str.Quo_adipisci_quod_ut_numquam_laboriosam_ad
mov dword [esp + 4], 0
mov dword [esp], 0
call eax
mov eax, dword [0x6bb7afd0]
sub esp, 0xc
mov dword [0x6bb7aecc], eax
mov eax, dword [0x6bb7af08]
mov dword [esp], eax
call fcn.6badcbb4
mov dword [esp], 0
mov dword [0x6bb7add4], eax
mov eax, dword [ebp - 0x24]
call eax
push edx
mov dword [esp + 4], str.VerlaWalsh
mov dword [esp], 0
call esi
mov eax, dword [0x6bb7ade4]
mov dword [0x6bb7ad9c], 0x7d3e78fd
push ecx
push ecx
mov dword [0x6bb7b07c], eax
mov eax, dword [ebp - 0x20]
mov dword [0x6bb7aedc], 0xa9a1b9c4
mov dword [esp], str.Optio_est_dolorem_non_quisquam_molestias_repellat_et_neque_optio_vel_nobis
call eax
push ebx
mov dword [esp + 4], 0
mov dword [esp], 0
call edi
mov eax, dword [0x6bb7ad98]
mov dword [0x6bb7afd0], 0xf83e2e61
push esi
mov dword [0x6bb7ae94], eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, dword [ebp + 0x14]
mov dword [esp], eax
mov dword [esp + 0x10], edx
mov edx, dword [ebp + 0x10]
mov dword [esp + 0xc], edx
mov edx, dword [ebp + 0xc]
mov dword [esp + 8], edx
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
call fcn.6bad62d1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret